Data Center Due Diligence Checklist for Buyers

Data center due diligence covers four verifiable pillars: power (interconnection, redundancy, fuel reserves), technical infrastructure (electrical/mechanical condition, Tier certification, capacity headroom), contracts and compliance (leases, PPAs, SLAs, ISO 27001/SOC 2 status), and financials (customer concentration, capex backlog, escalators). Power failures caused roughly 45% of impactful outages tracked by Uptime Institute in 2025 — more than any other category — making power the single highest-priority item to verify before signing a colocation contract or closing an acquisition.

Key takeaways

• Power is the top risk category. Power-related failures accounted for ~45% of impactful outages in Uptime Institute’s 2025 Annual Outage Analysis. Verify substation diversity, generator fuel contracts, and UPS topology directly — not sales-deck claims.
• 12 hours is the fuel-reserve baseline for Tier III; Tier IV facilities with 2N generator plants typically carry 48-96 hours. Ask for fuel delivery contracts and the last 12 months of load-bank test logs.
• “Tier III-equivalent” is not “Tier III Certified.” Only an Uptime Institute-issued certificate, checkable on their public registry, is independently verified. Self-declared “equivalent” claims are marketing language.
• Human error is rising as a cause. The share of outages tied to staff not following procedures rose roughly 10 percentage points year over year in Uptime’s 2025 report — a signal to review operational procedures and staffing, not just hardware.
• Compliance certifications must be audit reports, not badges. ISO 27001, SOC 2 Type II, and PCI DSS (where card data applies) should be requested as full audit reports with scope statements, not logos on a website.
• In M&A, power purchase agreements often outlast the customer contracts backing them — a mismatch that shifts merchant power-price risk onto the buyer if anchor tenants churn.
• Vacancy is near zero in primary markets, so due diligence increasingly focuses on whether claimed expansion capacity is real, interconnected, and timeline-committed rather than merely zoned.

For live benchmark pricing to sanity-check deal economics against, see our colocation price index and the underlying data center catalog.

1. Power: the highest-priority category

Power is where due diligence fails most often, because “available capacity” is frequently a sales claim rather than a contracted fact.

Verify, in this order:

1. Utility interconnection agreement (not a letter of intent). Confirm signed status, contracted MW, and the milestone schedule for energization.
2. Substation diversity. Diverse feeds from separate substations are the standard for resilience against a single local grid failure; a facility fed from one substation has a structural single point of failure regardless of its internal redundancy.
3. Generator fuel reserves and contracts. 12 hours at full load is the common baseline for Tier III; Tier IV sites with 2N generator plants typically run 48-96 hours. A large tank alone doesn’t prove supply — ask for the fuel delivery contract and refill SLA.
4. UPS topology and battery age. Tier III requires N+1 UPS redundancy; Tier IV requires 2N — two fully independent systems with no shared point of failure. UPS batteries typically bridge only the 10-20 seconds before generators stabilize, so battery maintenance logs matter as much as generator specs.
5. Load-bank test records. Request the last 12 months of generator load-bank tests, not just a maintenance schedule. A generator that has never been tested under full simulated load is an unverified assumption, not a verified asset.

Redundancy tier	UPS configuration	Generator fuel baseline	Typical use case
Tier II (N+1 partial)	Single path, some redundant components	12-24 hours	Non-critical / dev workloads
Tier III (N+1)	Concurrently maintainable, N+1	12 hours minimum	Standard enterprise colocation
Tier IV (2N)	Two independent systems, fault tolerant	48-96 hours	Mission-critical, financial, AI training

2. Technical infrastructure and Tier certification

Distinguish certified claims from marketing claims immediately — this single check eliminates the most common due diligence error.

• Uptime Institute Tier Certification (Design Documents and/or Constructed Facility) is issued only after an independent, on-site audit against Uptime’s published standard. Ask for the certificate number and verify it against Uptime’s public registry.
• “Tier III-equivalent” or “Tier IV-ready” are self-declared, unaudited claims. They may be accurate, but they carry no third-party verification and should be priced and negotiated as such.
• Request the one-line electrical diagram, current substation and transformer loading, PUE trailing-twelve-month average (not design PUE), and building management system (BMS) alarm history for the past 12-24 months.
• Equipment age matters as much as topology. A well-designed Tier III facility running on 15-year-old switchgear carries different risk than a newer facility with identical topology on paper.

3. Compliance and certifications

Certification	What it verifies	Relevant tenant type
ISO 27001	Information security management system	All enterprise tenants
SOC 2 Type II	Operational controls, audited over a period (vs. Type I point-in-time)	SaaS, cloud, tech providers
PCI DSS	Payment card data handling	Any tenant processing card payments
HIPAA attestation	Healthcare data handling	Healthcare, health-tech
FedRAMP / government-grade	Public-sector security baseline	Government, defense contractors

The Uptime Institute’s 2024 Global Data Center Survey found 60% of operators now require at least one security-related certification for mid-level and senior hires, up from 42% in 2020 — a proxy for how seriously the industry now treats operational security staffing, and a reasonable interview question for facility management during a site visit.

Always request the actual audit report with its scope statement (which systems and locations it covers), not a certification logo. A SOC 2 report scoped only to a provider’s billing systems says nothing about the data hall’s physical security controls.

4. Contracts: colocation agreement and lease terms

For a colocation contract (not an outright facility purchase), the checklist shifts to terms that determine your effective cost and risk over the deal life:

• Power and uptime SLA with a credit schedule that reaches 100% of the monthly fee for extended outages — not a token 5-10% credit cap.
• Escalators capped at 3-5% annually, no open-ended “market re-rate” language at renewal. Northern Virginia tenants renewing legacy leases in 2025-26 faced 30-50%+ increases where renewal caps were absent.
• Cross-connect and remote-hands pricing fixed for the term. See our cross-connect pricing guide for current market rates to benchmark against.
• Step-in and portability rights if the operator is acquired, refinanced, or enters distress — increasingly requested in 2026 deals given active M&A in the sector, per Clifford Chance’s 2026 compute infrastructure outlook.
• Audit rights to verify metered power billing and PUE assumptions directly rather than trusting invoiced figures.

For real estate leases underlying a facility (relevant in acquisitions), a triple-net (NNN) structure with 15+ year terms is the benchmark buyers look for, per BDO’s investment due diligence guidance — shorter or gross leases shift more operating risk and cost volatility onto the landlord side of the cap table.

5. Financial due diligence (acquisitions and large commitments)

Financial review for a data center acquisition or large multi-year commitment differs from a standard commercial lease review because power and customer concentration dominate the risk:

• Customer concentration. A single tenant above 30-40% of facility revenue is a structural risk — churn risk becomes cash-flow risk.
• Power purchase agreement (PPA) terms. Check for “take-or-pay” clauses and confirm the PPA term doesn’t outlast the customer contracts it was sized to serve; if anchor tenants churn, the buyer inherits merchant power-price exposure.
• Deferred capex. Compare stated maintenance capex against actual electrical/mechanical equipment age. Deferred cooling or switchgear replacement is a common source of post-close surprise cost.
• Stranded capacity. Confirm that committed power the seller markets as “available” actually has a signed interconnection agreement and delivery date — not just an application in a utility queue. Grid interconnection queues have become the binding constraint on new supply in most primary markets through 2026, per Ropes & Gray’s investment outlook.
• Workforce and local talent availability, particularly for specialized electrical/mechanical operations staff — a growing constraint as data center headcount competes with grid and renewable-energy buildouts for the same skilled trades, per BDO’s checklist.

6. Site visit checklist

A physical site visit should verify, in person, everything the paperwork claims:

• Confirm diverse utility feeds enter the building from physically separate paths, not just separate breakers on a shared feed.
• Inspect generator fuel tanks and ask to see (not just hear about) the most recent load-bank test report.
• Walk the data hall floor for visible signs of deferred maintenance: temporary cable runs, aging CRAC/CRAH units, or ad hoc cooling fixes.
• Review physical security layers: perimeter, mantraps, cage-level access control, and camera retention policy.
• Ask facility staff directly about generator testing cadence and the most recent actual utility outage the site weathered — operational answers reveal more than documentation.

What to do with this checklist

Treat the power section as a hard gate: no utility interconnection agreement, no deal, regardless of how compelling the rest of the facility looks. For a standard colocation contract, prioritize the SLA credit schedule and escalator caps — they determine your real cost over a 3-5 year term far more than the headline $/kW rate. For an acquisition or large multi-year commitment, run the financial and power-contract review before the site visit, since a facility that looks excellent in person but carries stranded capacity or PPA mismatches is a worse deal than a modest facility with clean contracts. Benchmark any quoted rate against current market data in our price index and request a comparison through our quote service before signing.