Understanding Business Income Risk From Data Centers

This article originally appeared in Independent Agent’s November 2021 issue.

 

The imperative for businesses to move to the cloud is stronger than ever. But that doesn’t mean they can just flip a switch and let the computers run the show – and neither can their independent insurance agents and brokers. In fact, agents who can speak to the risk exposures associated with cloud data center deployments increase their effectiveness by helping their clients gain a better edge.

 

It starts with fundamentals from the perspective of the CIOs and IT managers responsible for ensuring data delivery continuity at tech companies. To them, the cloud isn’t a cloud. Instead, cloud storage is a very real physical component of corporate infrastructure that happens to sit outside the company’s direct control.

 

And that’s the way they like it. Data management has evolved the way it has because of the efficiencies to be gained, and the cloud indisputably helps companies reduce capital expenditures, save operational costs, increase flexibility and scalability and serve customers and stakeholders better. It wouldn’t exist if it didn’t.

 

The pandemic clearly increased the pace of change, however. As commerce and work patterns transformed during shutdowns and quarantines, data centers became even more essential outsource partners than they were before.

 

As a result, according to IDC, the global cloud services market grew 24.1% during the pandemic in 2020, with revenues totaling $312 billion.¹

 

The next piece of the puzzle comes from understanding that data centers don’t exist in a vacuum – they’re part of the environment and changing the world around them. And when it comes to the cloud, the biggest change today is a change in the weather.

 

According to Andrew Zarkowsky, Technology Industry Practice Lead at The Hartford, and James Charron, director of underwriting for Technology at The Hartford, recent unexpected climate events impose new conditions on data centers that warrant reassessment by companies and agents. And maybe a fresh look at contracts and coverages.

 

“We thought climate change might be a problem for our children and grandchildren, but it’s here now,” Zarkowsky said.

 

“Data centers are built for the kinds of severe weather events we’ve seen in the past, but what we have in front of us is new.”

 

It’s not that data centers themselves are always vulnerable. Facilities are generally well built to withstand today’s more intense storms and other manifestations of climate change, but what happens around them is outside their control.

 

The February 2021 winter storm in Texas is a great example. The power grid failed in that event, arguably because of political decisions made years before. But when the unimaginable finally happened, it put the diesel fuel generators the facilities used as power backups under threat. Some data centers had problems with their diesel fuel gelling from the cold.

 

“The data centers’ backups performed well, but the municipalities were not prepared for negative 7-degree temperatures in Texas,” Charron said. “Some data centers had trouble getting the fuel they needed because the delivery trucks couldn’t get to them.”

 

It was fortunate that the data facilities remained operational during the Texas event, but some companies and websites lost connectivity. Putting that storm in the context of other recent weather-related events, including the 2017 Hurricane Harvey floods in Texas, the historic wildfire disaster in Australia in 2019-20, and the California wildfires of summer 2021, it’s clear that data center vulnerabilities need reconsideration as established climate patterns go further awry.

 

“Flooding from Hurricane Sandy caused downtime for some companies in 2012 in Manhattan because the data centers were in the basements,” Charron said. “That’s likely been corrected but highlights how the risk from a severe weather event wasn’t properly mitigated.”

 

Hurricane Harvey worked the same way in Houston, where areas that had never been considered flood zones were inundated, and again with Hurricane Ida, which left unexpected flood damage and tragedy behind on a journey all the way up the east coast in August 2021.

 

What’s more, even mitigating against the potential effects of climate change can have consequences. In Strasbourg, France, a month or so after the 2021 Texas winter storm, a fire in a data center operated by European cloud provider OVH cloud brought millions of commercial and government websites down.

 

In 2022 OVH will release an official assessment of the factors leading to the fire, but maintenance mishaps on battery backups used at the facility apparently contributed. Those backups were there to protect against outages potentially induced by climate change.

 

“It seems like there should never be a fire in a data center because they have really good protections,” Charron said. “But fire protection for data centers is complex and we don’t assume they all have best in class controls.”

 

Meanwhile, migration to the cloud continues. For millions of companies, success hinges on being where their customers are.

 

For companies delivering B2B technology and IT services that exist solely on the cloud, their ability to produce value literally depends on the infrastructure and services around their data continuing to function. Within The Hartford’s Technology Practice, Zarkowsky and Charron work to address data imperatives on behalf of customers.

 

With a more than 15-year track record, The Hartford’s Technology Practice includes specialized underwriters, claims handlers , and a Risk Engineering team empowered to focus on an industry where mission critical is always in real time. The insurer offers tech insurance solutions that keeps up with everchanging industry needs.

 

Approaching the problem of business income risk from data centers from an agent’s point of view, Zarkowsky and Charron recommend first thinking about risk management controls. For that, nailing down or reassessing business continuity plans is essential, as is reviewing existing and upcoming data center contracts.

 

In the OVH fire, lack of external backups led to companies losing weeks of access, highlighting the importance of ensuring contracts reflect mutual expectations.

 

And then, it’s all about the agent negotiating the most optimal terms and conditions.

 

“Start thinking about the cloud as an essential part of the business and make sure there’s appropriate coverage from a business interruption perspective,” Zarkowsky said. “For example, the more backup your client has, that potentially costs more money but that cost might be worth it.”

 

Getting there is a challenge Zarkowsky and Charron encourage agents and brokers to think more strategically about.

 

“Particularly with customers in software and IT services, it’s hard to put your finger on how much you would lose if a data center goes down,” Zarkowsky said. “But it’s becoming more critical as more technology companies rely on the cloud and the climate continues to behave more unpredictably.”

 

It’s important to also understand that for many tech businesses, the reputational effects of service discontinuities may reverberate beyond specific downtime events and cause disproportionate damage.

 

“In today’s environment, being down for days or even hours could potentially have a devastating impact on a company’s business.” Charron said.

 

Rather than handling these issues through a quick business interruption worksheet, the best next step might be to bring in an agent or broker with expertise in the technology space to walk through the implications of business interruptions more systematically.

 

That’s when the experience and perspective of a specialized carrier can come to the fore for the client and help engineer the best possible defense against the next change in the weather. A specialized carrier can apply what it learns over time to identify and address new concerns and challenges. It can also keep its finger on the pulse of an industry to anticipate areas of change and make the best positive adjustments.

 

Specialized technology underwriting, risk engineering services and claims handling at The Hartford serves businesses from small startups to large, publicly traded companies.

 

“We know how technology companies work,” Zarkowsky said. “We understand where technology might be going in the future and how companies can best protect themselves.”

 

This is what helps agents determine which services actually make the most sense for a particular client.

 

“Maybe it’s ergonomics to reduce injuries or maybe it’s fire protection on the data center,” Charron said. “But because it’s what we do, we know what’s most important for these technology companies and it helps us protect them.”

 

Anyone will tell you that it’s impossible to predict the weather ten days out. With the sudden impact of the pandemic arriving as new weather norms take hold, agents need a good team behind them to have the best impact.

 

“Things are changing,” Zarkowsky said. “And when things change, you want to go to experienced professionals.”

 

Learn more about The Hartford’s specialized tech insurance solutions for mid- to large-size businesses.

 

 

¹ IDC, “Worldwide Public Cloud Services Market Totaled $312 Billion in 2020 with Amazon Web Services and Microsoft Vying for the Top Position Overall, According to IDC”

 

The information provided in these materials is intended to be general and advisory in nature. It shall not be considered legal advice. The Hartford does not warrant that the implementation of any view or recommendation contained herein will: (i) result in the elimination of any unsafe conditions at your business locations or with respect to your business operations; or (ii) be an appropriate legal or business practice. The Hartford assumes no responsibility for the control or correction of hazards or legal compliance with respect to your business practices, and the views and recommendations contained herein shall not constitute our undertaking, on your behalf or for the benefit of others, to determine or warrant that your business premises, locations or operations are safe or healthful, or are in compliance with any law, rule or regulation. Readers seeking to resolve specific safety, legal or business issues or concerns related to the information provided in these materials should consult their safety consultant, attorney or business advisors. All information and representations herein are as of September 2021.

Links from this site to an external site, unaffiliated with The Hartford, may be provided for users' convenience only. The Hartford does not control or review these sites nor does the provision of any link imply an endorsement or association of such non-Hartford sites. The Hartford is not responsible for and makes no representation or warranty regarding the contents, completeness or accuracy or security of any materials on such sites. If you decide to access such non-Hartford sites, you do so at your own risk.

 

The Hartford Financial Services Group, Inc., (NYSE: HIG) operates through its subsidiaries, including the underwriting company Hartford Fire insurance Company, under the brand name, The Hartford,^® and is headquartered in Hartford, CT. For additional details, please read The Hartford’s legal notice at https://www.thehartford.com.