Sound Policy four qualities of a well-protected data center

Brian Amaral (Host)
Welcome to Sound Policy, a podcast from FM about protecting today's businesses. On today's show, we'll be talking about one of the biggest stories in recent years: the data center boom. How can this be done at speed and with resilience? To break it down, we're speaking to Paul Heisel, chief underwriter for FM Intellium. Well, welcome back to the show, Paul.

Paul Heisel (Guest)
Yes. Thank you. Thanks for having me back.

Brian Amaral (Host)
You are our first ever return guest of Sound Policy, which tells me that this is a very important topic and that you were a great podcast guest.

Paul Heisel (Guest)
Yes. Thank you.

Brian Amaral (Host)
Since we last spoke in late 2025, what do you think has changed in the data ecosystem that has most surprised you?

Paul Heisel (Guest)
Well, I think you might find it a surprise that it's, it's not slowing down. I mean, I, I think you might see references in the news to delays and slowdowns, but, you know, things are moving forward and the delays that you might be seeing are related to supply chain or site selection, or they can't get the connection to the power grid quick enough, or even labor shortages. You know, you think, think about how much construction is going on and the need for labor, and so they have to have the people to, to build these data centers.

Brian Amaral (Host)
You are the chief underwriter for FM Intellium, which is a new title since the last time we spoke. What is FM Intellium? How do you explain that to people?

Paul Heisel (Guest)
FM Intellium: What we’re charged with is bringing solutions including insurance, engineering and all aspects of this data center ecosystem to our clients. So, it’s, it's engineering. It's underwriting. It's claims. It's research. It's business risk consulting. It's a, it’s a whole suite of talented people to work with our data center clients on making their data centers more resilient; but most importantly, making sure that they stay up and running.

Brian Amaral (Host)
It was launched about a year ago as a business unit. How's it going so far?

Paul Heisel (Guest)
It's going really well. You think the data center space is moving fast. So is FM Intellium. And

as we're building out this business, we're moving even, even faster to get our, our people together and so we can service all these clients in the way that they need to be serviced.

Brian Amaral (Host)
Yeah. You've been involved in data centers for quite a while, right? I mean, it's, it's a new big news story, but it's not a new thing. It's not a new thing that, that you've been involved in. How has it changed over the past, even three or four years?

Paul Heisel (Guest)
The technology has changed from the—when you think of a, a traditional or I'll say older data center, I say older data center—that's five years— your older data center with, with servers in it. You have your traditional, all the backup power, all the backup systems. Now you have hyperscale builds that are these very large deployments of GPUs, of these graphics processing units. They are cooled by putting liquid basically to the chip to cool ‘em. And that has introduced, you know, different hazards into the occupancy. So, those are some of the changes. And even usage of lithium-ion batteries in UPS systems, or uninterruptible power supplies, they introduce additional hazards that we haven't really seen in the past in your traditional-type data centers.

Brian Amaral (Host)
Yeah, I understand there's a resource, The Four Qualities of a Well-protected Data Center, that you were involved in, and it's available on FM’s website. But let's break it down. What are some of those four qualities of a well-protected data center?

Paul Heisel (Guest)
The first one is a strategic design, so. And that's making sure that before you even put a shovel in the ground, you have a, a design that's going to withstand the hazards that you're introducing into the data center, but also the hazards of where you built it, like natural hazards, like flood, wind, earthquake, depending on what site that you've selected.

Brian Amaral (Host)
How do you make sure that a place in Australia is as protected as it would be in Virginia, which has already been data center alley for a long time?

Paul Heisel (Guest)
Yeah, generally the, our clients have standard, I’ll say cookie-cutter-type, designs that are applicable to almost anywhere in the world. Now, some of that is depends on the availability of materials and maybe some local codes and that, but generally worldwide the, the builds are all similar. Now, you may have some constraints depending on where you are and, like I said, in the availability of the, of the materials and also what’s available for land. We see a lot of vertical construction in some areas of the world where there's not a lot of extra space, whereas in the United States, we do have the luxury of being able to put everything on one floor. So, you just have these big, large buildings; whereas, in maybe in Asia or Hong Kong, you might have to have an 8- or 10-story building. The challenge is, availability of materials is driving some of these strategic designs. Whereas in the past you might have been building with steel and concrete, now it's steel-on-steel. And I'm not saying that's a bad risk. What I'm saying is it's a different risk. And so, it needs different engineering, different research. So, like, for instance, in a steel-on-steel construction, fire and wind that may be bigger exposures than if you have a steel and concrete structure at the same, at the same site.

Brian Amaral (Host)
The last time we talked, we talked about how data centers even, like, looked different from when you first started. Do they look different now than even the last time we talked, or is it evolving that quickly?

Paul Heisel (Guest)
Yeah, I think they, they look different, and they're trying to be, I'll say, incognito. You don't walk up to a data center and it says “data center.” It just looks like an office building. Or in some cases, it might even just look like a, a warehouse.

Brian Amaral (Host)
Integrated protection is another one of those four qualities. What new technologies are coming into this space that, that are going to help actually drive that integrated production?

Paul Heisel (Guest)
Much of it is the attention to the liquid cooling and the introduction of batteries. So, the, all that these new technologies—and there are new risks as well—but you can layer the protection. So, we, we are big proponents of sprinkler systems, water mist systems. And you can put in your gaseous or gaseous protection; but layer that with detection, detections for smoke detection, for leaks, and other things, that you have these—they have this ability to stop a loss before it starts to actually emerge. And those are layering those systems. So that's integrated protection: Your physical, fixed protection and layer that on with this monitoring.

Brian Amaral (Host)
Integrated protection: one of the four qualities of a well-protected data center. What is, what is one technology that you're hoping might emerge or improve to, to drive integrated protection?

Paul Heisel (Guest)
Well, what I would like to see is the continued integration of monitoring systems, like for UPS batteries, to where they can detect the off-gassing or detect when a cell is going bad, to help, so the operator can stop a loss before it starts to emerge into something that could be a really bad day.

Brian Amaral (Host)
I'm interested in the direct-to-chip cooling. You're putting liquid right on the chip. That also seems maybe to introduce some risk because escaped liquids is one of the most common causes of property damage. How do you make sure that you're, you know, getting liquid near the chip but not right on the chip?

Paul Heisel (Guest)
Yeah; it is—what we've been finding with the liquid-to-chip cooling is, there—it's under pressure, right? We've seen some losses with the fittings, like compression fittings. So, just when you think of a coolant leak, it's not like a drip, drip, drip; it's like a spray. And, and I think that's maybe when I was thinking about a cooling leak I was like, you know, a thing dripping out from your radiator of your car or something. But no; this is under pressure and can spray, and the spray can get into electrical components and maybe cause some arcing and some other things. So, there’s certainly some risks with liquid cooling that we're, that we're seeing.

Brian Amaral (Host)
Well, there's also, I mean, the chips are also getting much more expensive too, right? You’re the chief underwriter for FM Intellium. There's a lot more value at stake in these data centers, that has changed, too, right?

Paul Heisel (Guest)
That has changed. The, the density of the values has gone up. Now, I'm not saying that's a bad risk. Just because you have lots of values there doesn't mean it's a bad risk and/or it's not protected. It's just when you have one little thing go wrong, it can be a bad day, but only for, for one rack. You know, when racks are approaching $10 million apiece, you spray that cooling all over that rack, and maybe you damage some of the chips and the components, that's $10 million. But it's in a, you know, a, you know, a couple square feet of area. So, the density of the values is, has definitely become a concern, when you look at these data halls that are massive and don't have any type of firebreak or MFL-type wall separation to where you can contain those values to a, I'll say, an insurable amount. You know, if you put $5 billion of servers in a data hall that are all exposed to each other, that may not be insurable. But if you break that $5 billion into $1 billion chunks, to where you have two-hour firewalls between them; we have low combustibility in a data center, that is much more tolerable from an underwriting standpoint.

Brian Amaral (Host)
Operational readiness. What does that mean for a for a data center? I think people could probably understand what that means for them, but what does that look like at a data center when there's so much at stake and the downtime is just not an option?

Paul Heisel (Guest)
Yeah, the, the operational readiness, that kind of leans into n+1, where you have extra components and the data center can tolerate a component failure, and they can keep working. So, one thing can break, the system keeps working and they can take that component out, fix it and put it back in. But this success of n+1, it really depends on maintenance procedures, training, change management. All of that plays into making sure that this data center can maintain the uptime. So, example: so, if you have a data center maintenance, say, it's not being carried out, they just say, “Oh, we’ve got n+1. We don't need to maintain this,”—which I don't think, hopefully it's not happening—they say we, we don't need to maintain this because we have this redundancy, but then that becomes a false sense of security, because if you're not maintaining that plus one, when it's called on to work, it may not work.

Brian Amaral (Host)
And the last of the four qualities—skilled teams and structured processes. I, I saw a stat from the Uptime Institute that 40% of data center outages are due to human error. What sort of errors can humans make and what could be done to address that?

Paul Heisel (Guest)
A lot of it comes down to training; but also filling those gaps in procedures or even emergency response. If the human doesn't know what to do in an emergency, they can do things that even make it worse. And, and so, that goes back to, to the training. So, you can take something that's basically benign—so, something's benign and someone needs to push a button, and they, but they don't do it, and then it makes it worse, and then you have a really bad day.

Brian Amaral (Host)
Structured processes. What does that mean?

Paul Heisel (Guest)
Structured processes. That's making sure that you have those emergency procedures and the emergency response plans and their maintenance plans and all that, so the data center can run smoothly.

Brian Amaral (Host)
Of those four qualities, are there certain parts of it that are harder for data centers to achieve than others?

Paul Heisel (Guest)
Let’s see; that's a good question. The, I think it might be—really it comes down, I think, my personal opinion could be the last part of it. Because it's--not saying it's easy, but if you get the design right, and you pick the right spot, and it's built right, you already have a great asset. Then it's just a matter of what are you going to do to operate that asset in the best way possible so it can maintain that uptime. And that might be the one of the more difficult parts. And again, it might go back to the lean teams, or it could, same like we have in a lot of industries where you have a shortage of labor, a shortage of skilled people to run the data center.

Brian Amaral (Host)
It also seems like the sort of thing that you're going to need to continue to stay on top of. If you've got a good design and you pick a good site that's done and dusted as soon as you're off and running. If you have the integrated protection, that…

Paul Heisel (Guest)
Yeah, there your fixed protection, it's, it’s always gonna be there. It’s always gonna be there.

Brian Amaral (Host)
It’s there.

Paul Heisel (Guest)
It’s always gonna be there.

Brian Amaral (Host)
Whereas having the right people, keeping them trained in the latest things, which might be evolving over time, that might be a bit of a challenge. Does that, does the fact that the industry is changing, even the technology is changing seemingly day-by-day, does that pose new challenges? That there, that it, that it’s just the pace of how it's moving so quickly?

Paul Heisel (Guest)
It, it does introduce new challenges. I think as an industry, you look at the, the larger companies, the hyperscalers; they all more or less kind of work together. I mean, not in collusion, but they work together on this new technology. And our part in, FMs part in this is, is the research is making sure that what they are doing can be done as safely as possible to protect the property. That they're not introducing, say, we got this great idea, let's do this, and they put it in their data center, not realizing that they just really introduced a bad risk or a potential risk into the data center, without knowing.

Brian Amaral (Host)
What sorts of those things have you seen?

Paul Heisel (Guest)
Some of it is the lithium-ion battery technology. And, you know, we recommend these large UPS systems with that technology be located outside, outside, on an outside wall if possible, or even in a cut-off room outside attached to the building, just because of the thermal runaway possibility. Now, you can monitor all that and make sure that you can shut off those cells that might be going into thermal runaway. But our best advice is if you're going to put that type of technology in, don't put it anywhere near the, the white space where the where the money is made. It comes down to the design. So, if they put it in the design upfront, then it's not an issue. But if they've designed it so they've put it in an interior room and that they're already started building, they're not going—relocating that's gonna not only delay the project, but it could cost, maybe, maybe millions to relocate it, so. But in that case, that's, you have a risk and we know about the risk and we can underwrite that, underwrite that risk.

Brian Amaral (Host)
How do these four qualities connect to your job as an underwriter and just insurability in general? If somebody is hitting these marks, how does that connect back to what insurance they're able to get?

Paul Heisel (Guest)
You know, these really good quality data centers, they can develop the maximum capacity that that we have. We have $5 billion of capacity that we can offer our qualified clients. Now, it's just not given to everyone. But there, you know, we look at our clients and what they're doing and what they're building and how they’re working towards making their locations even more resilient. And it comes down sometimes to site selection and where are you putting your data centers? And when that happens, we can offer—when all those good things happen, we can offer large capacities for our clients.

Brian Amaral (Host)
And what about the financing aspect of it, too? That they’ll be able to go to their bank or their lender and say…

Paul Heisel (Guest)
They can go to their lender and say that we have capacity, or the pie in the sky is that our, our clients are going to the lender saying this data center was designed and built in partnership with FM. It's resilient, and you should feel that your asset is protected; it's going to be run well.

Brian Amaral (Host)
Shifting gears a little bit, what are the top causes of, of data center loss, and is there anything, as you look at the data that might surprise people?

Paul Heisel (Guest)
The data that I have is, we have, we frequently will have fires, and, but the fires are not in the white space. And I would knock on some wood if we had wood here,that the fires don't occur in the white space where the money’s made; it's generally in, will be in, in a UPS or in an electrical switch or something like that. So, it's away from where the money is made. So, those happen frequently. Generally, those are the result of a mechanical breakdown or an electrical breakdown, so, and that just depends, that the fire usually results from that. The other side of that coin is liquid damage. We see sprinkler leakage. We see just pipes leaking in general. But some of the, I'll say it's a death by a thousand cuts; they’re small losses, but they're annoying.

Brian Amaral (Host)
Yeah, knock on noncombustible materials instead of wood, maybe, that that it doesn't get worse. What are the big takeaways from this data that you think somebody who is thinking about investing or building a data center should know? When they see fire by percentage of loss cost is the, is the biggest driver? That escaped liquid damage is the most frequent? Are, are there any, are there any lessons to be learned here from people thinking in this, in this industry, or thinking about getting into it?

Paul Heisel (Guest)
If you're basing what you're going to do on the on the loss history, it's really paying attention to—like for the escaped liquids—is, well, you need to have monitoring. You know, whether it's a pressurized system or your sprinkler leakage, that or just basic water liquid damage, is make sure you have the monitoring and you have the trained personnel that know how turn that system off, so the water doesn't keep flowing. Or how to isolate that system so you can, so you can repair it.

Brian Amaral (Host)
When you're talking about losses in data centers, how does it break down from property damage versus business interruption?

Paul Heisel (Guest)
You know, in FM’s loss history, the division between property damage and time element loss, it's predominantly on the physical damage part, mainly because these data centers have good redundancy. When we do have that fire in an electrical system, the data center keeps running. And so, they don't lose revenue. They can still collect rent. The GPUs can still charge for their compute time. They don't, we don't have a lot of that down time. Now, the exposure is time element. If you have that really bad day where something goes terribly wrong, then you could have, you know, a data center that's down, say, it's down for a month. Well, it’s you know, the co-location owner there, they lose their rental income. The, the tenants who are, have the GPUs, they're losing their compute time, their lease with whatever company, their, or their individual leases that they have with clients. They're losing that income because they can't run.

Brian Amaral (Host)
That’s maybe counterintuitive to think the property damage is right now a bigger loss driver than time element. Because you always hear that statistic: downtime is nine—it can be $9,000 a minute at a data center. But I guess that just shows…what does that show to you?

Paul Heisel (Guest)
It, it. it just shows that at least FM clients are more resilient in either, in the design or how they're operating. These losses that we see, like I said, death by a thousand cuts. They're just little annoyances. And the little annoyances add up over time into property damage. But they don't really translate into these long time element losses or a long time element downtimes.

Brian Amaral (Host)
But there could be, if there was that black swan event, that's the big thing.

Paul Heisel (Guest)
It, it could be if the, you know, the Swiss cheese all lines up and you have that really bad day, that time element loss. Depending on what the GPUs are doing, it could be a significant amount of money that's, that's being processed or made at that time that could be lost.

Brian Amaral (Host)
Well, knock on non-combustible materials, yeah, again here. We haven't talked about power generation. The last time we talked, that was one of the big topics. The middle of 2026, so, almost a year since we last spoke, because is that still a big bottleneck for data centers?

Paul Heisel (Guest)
It is. It’s, and there—it’s waiting to get the grid connection, which is delaying some of these projects. The more savvy operators, what they have done is they are bringing in their own power. So, it might just be skid-mounted or trailer-mounted power to get them up and going. That will suffice until they can get the grid connection done, that temporary power. But also many of the new builds that are, are being designed have on-site or behind-the-meter power generation, which is generally gas turbines.

Brian Amaral (Host)
How does that change how you think about a project from an underwriting perspective? That it's not just now a data center where 20 years ago, it's a room full of servers, and now a much bigger room, full of much more expensive servers and power generation nearby?

Paul Heisel (Guest)
Right. So, you, you have the same risks that you have if you’re a power producer, which is the equipment. And one, a few things that data center operators may not completely understand are the risks with putting behind-the-meter power. It’s different maintenance, different personnel. You have to have the right personnel to own it. There's also, there may be regulations about operating a power plant that I'm not saying they're not aware of, but they may not think about. “Oh, if I run this power plant, I need to buy carbon credits because I'm putting emissions into the air.” Or there may be other permitting things that they have to do. And Just like the data center runs 24/7, so does the power plant. The power plant never stops either.

Brian Amaral (Host)
There's also, they need uninterrupted power. And when you're connecting to the grid, there are sometimes outages. These battery backup units are based in some ways on lithium-ion batteries, which you've talked a little bit about. How are data centers dealing with the lithium-ion battery challenge?

Paul Heisel (Guest)
One, they understand that the lithium-ion battery technology does introduce some risks, and that, that is one of the things that keeps me up at night as an underwriter. You have a UPS system and it's, and it’s being used to help, I'll say, modulate the power. So, it's not just strictly for backup; they're running the power through. And these units, they cycle back and forth. And as they get older, just like your battery that you might have for your lawnmower or for your weed whacker, over time that, you have that cyclic fatigue and things. The reason it keeps me up at night is because when you do have that thermal runaway, you know, it, it may not be able to be stopped by either the sprinkler system that you have installed, or, if you get off-gassing and it hits an ignition source, you're going to have an explosion. And that can be a really bad day. And just like we talked about, where is that UPS system? If it's in the middle of your building, that's going have a bigger risk than if it's on an exterior wall where it's may not going to do damage to the to the stuff that's making the money. It does keep me up at night because we've had some loss history and it's been very significant.

Brian Amaral (Host)
We all carry these cell phones around in our pockets that have lithium-ion batteries. The way you describe cycle fatigue, when you see your battery going low, how do you conceptualize the level of risk that we're taking on with a lithium-ion battery?

Paul Heisel (Guest)
The losses that we have had have been with lithium-ion battery systems that are older. And you can see that they have gone through this, I'll say this cyclic fatigue, over time, which increases the, increases the, the chance that it's going to evolve into thermal runaway or into a loss.

Brian Amaral (Host)
…Being done to address that? I understand there's some, some research projects to figure out, you know, to help you sleep better at night.

Paul Heisel (Guest)
Yeah, we've done research into how these systems fail, how they can be monitored and protected. The research that's gone into that make these systems or able to, to mitigate that thermal runaway before, before it starts.

Brian Amaral (Host)
What else keeps you up at night?

Paul Heisel (Guest)
What else keeps me up? Well, when you're thinking about the GPUs, think about non-thermal damage. So, you have a small fire in a large data hall with $1 billion, $5 billion worth of equipment. Well, imagine smoke getting sucked in through all those, you know, servers, getting soot on them. If there's any humidity or moisture, that becomes acidic, starts etching things. And at one, at some point, you have to consider those smoke damaged items as being damaged, you know? Maybe they still run, or maybe they can't run at full capacity, but they're damaged. That smoke damage, that non-thermal damage, that's one of the other things that keeps me, keeps me up at night is wondering how bad is that going to be just from a small, small fire incident?

Brian Amaral (Host)
Anything else that's keeping you up at night these days?

Paul Heisel (Guest)
Well, the last thing, and it's more of an emerging risk, I would say, is think about your traditional data center, a smaller data center, 50MW, 40MW, where traditionally what you would do is you would put in enough diesel generation as backup. So, if you lose your grid connection, you just flip on the generators. Nothing happens; you keep running. When you have these very large hyperscale campuses with ten buildings, and each building is $1 billion and it's a gigawatt, you cannot put a gigawatt of backup generation there. Not only would it probably not be feasible, but having a gigawatt of energy that's just sitting there doing nothing, that would, doesn't seem to be like a good economic choice. So, you have these large campuses and they may have multiple feeds, but what I wonder is how are these large campuses going to react to an area-wide event? Maybe it's not possible, but take away all the power from this huge campus. What happens to it? How does it shed the load? How does, do things power down? And how does it power down without damaging everything? So, that's what I'm wondering. Then, on the flip side, power comes back, how do you power it all up? How do you get it up back and going? And which building gets to go first, or which data hall gets to go first? So, these different aspects of the load shedding, but also bringing it back online that, that need to be considered.

Brian Amaral (Host)
Let's end this on a positive note. We talked about what keeps you up at night from a risk perspective. What keeps you up at night because you're just so excited about what's coming next in the data center world?

Paul Heisel (Guest)
What excites me next is just that what we're doing with FM Intellium is really supporting, like, a worldwide infrastructure. I'm excited to be involved in helping this industry become more resilient, also helping it to, to build these facilities and operate these facilities. That's what really excites me.

Brian Amaral (Host)
Yeah, it's not just the rest of today. It's the rest of tomorrow too, right?

Paul Heisel (Guest)
It’s a fast-moving industry, and that I like that that it's fast moving and it's a challenge; it's a challenge to keep up. But, you know, we're up to the challenge to, to move with our, with our clients and, and move where they are, you know, in the world and help them with their, with their builds and, and with their operations.

Brian Amaral (Host)
Well, thanks for coming back on the show. We'll have you back soon.

Paul Heisel (Guest)
Well, thanks for having me. I look forward to my next episode.

Brian Amaral (Host)
If you'd like to reach the show, email podcast@fm.

Legal Disclaimer
Copyright 2026, Factory Mutual Insurance Company. The views and opinions expressed by speakers or participants are their own and are provided for informational purposes only. This podcast does not constitute legal, regulatory, or professional advice. References to any products, organizations or third parties do not constitute an endorsement by FM unless expressly stated. FM makes no express or implied warranties, and assumes no liability for any use of, or reliance upon the information or products discussed.