Colocation Renewal: A 99.999% Promise and a Flood Map

Framing: separate risks you can negotiate (contractual) from risks you can only price or relocate (physical). Both must appear in the register with an owner.

1. Concentration and single-site exposure - physical, high impact. Both halls are in one flood-exposed building with no in-region alternate. A flood or a site-wide power event is a total loss of production, not a degraded service. Likelihood is low annually but non-trivial over 36 months, and insurance excludes it, so the loss is uninsured. This is the dominant risk.
2. RTO mismatch - physical/architectural, certain impact if invoked. The DR site's 24-hour RTO against a 4-hour requirement means the recovery strategy does not meet the business requirement today. No contract term fixes this; it is a capability gap.
3. Remedy inadequacy - contractual, high impact. 99.999% allows about 5 minutes of downtime a year. Credits capped at 10% of a monthly fee on a 300 kW footprint (~€450k/month at €1,500/kW) are ~€45k - trivial against trading losses and regulatory consequences. The SLA promises availability but transfers almost none of the loss.
4. No audit rights or maintenance notification - contractual, medium likelihood, high impact. Without audit or notification, the firm cannot verify the 99.999% claim, cannot plan around maintenance, and cannot meet its own 2-hour regulatory notification duty because it may not learn of an incident in time.
5. Subcontracted electrical maintenance - contractual/physical, medium. Flow-down of competence, permits and response times is unverifiable without audit rights; a subcontractor failure is invisible until it causes an outage.
6. Term lock-in - commercial, medium. A 36-month term at a 6% discount locks the firm into risks 1–5 for three years for a saving far smaller than one day of trading disruption.

Note that risk 2 and risk 1 compound: a flood at the primary site invokes a DR capability that cannot meet the requirement.

Non-negotiable (walk-away items):

• Audit and information rights, including the right to review maintenance procedures, subcontractor competence and incident root-cause reports. Without this the SLA is unverifiable.
• Incident notification within 1 hour of detection, to support the firm's 2-hour regulatory duty. This is a legal obligation, not a preference.
• Maintenance notification with a minimum notice period and the right to defer once per year.
• Liability floor above the credit cap for prolonged outages - at minimum a multiple of monthly fees, with credits as an addition rather than the sole remedy.

Tradeable:

• Term length - offer 24 months instead of 36 in exchange for the audit and notification terms; the 6% discount is worth less than the risk it locks in.
• Notice periods and reporting frequency.
• Rack rate, provided the physical risks are addressed separately.

If refused - the real recommendation. Do not simply renew. A 99.999% claim with no audit rights and no remedy is a marketing position, not a control. Options in preference order:

1. Renew for 12 months at a higher rate to buy time, and immediately run a competitive tender including providers outside the flood zone.
2. Split the footprint: keep latency-sensitive trading racks at the current site and place the regulated/reporting workloads in a second provider's facility in a different region, closing the RTO gap.
3. Require a funded remediation plan from the provider for flood mitigation and DR capability, with contractual milestones.

The decision test is simple: if the provider will not let you verify the availability it sells, you should not be buying 36 months of it.

Recommendation: do not sign the 36-month renewal as offered. Authorise a 12-month bridge at the current rate, conditional on the terms below, while a competitive tender runs.

Why. The offer transfers availability risk to the firm while retaining control at the provider. The three material gaps are cumulative, not independent: uninsured flood exposure at a single site, a DR capability that misses the required RTO by 20 hours, and a remedy capped at roughly one month's fee fraction that bears no relation to trading loss or regulatory breach. A 6% discount does not begin to price any one of these, let alone all three.

Conditions to attach to any renewal, including the bridge:

1. Audit and information rights, including subcontractor oversight and root-cause reporting.
2. Incident notification within 1 hour of detection; maintenance notification with deferral right.
3. Liability above the credit cap for outages exceeding a defined duration.
4. A joint DR test within 6 months demonstrating the recovery sequence, with the firm's own recovery plan re-baselined to actual measured timings - if 24 hours is real, the business must formally accept the RTO gap or fund an alternative.
5. A flood mitigation evidence pack from the provider (survey levels, pump capacity, response plan) reviewed by the firm's insurer.

Residual risk to record on the board paper: until an alternate site exists, the firm carries uninsured single-site concentration. That is a risk acceptance decision for the board, not a procurement decision for IT, and it should be minuted as such with a review date. Present the numbers - expected annual loss, regulatory exposure, and the cost of dual-siting - so the board is choosing with its eyes open rather than accepting a discount.