Is there a standard scope for a data centre flood risk assessment?

No published template was found. EN 50600-2-1 says the environmental risk analysis shall be considered in design, TIA-942-C is reported to require formal risk analysis at site selection, and FM Global guidance is widely cited as using the 500-year flood plus freeboard. The scope on this page is our synthesis of those standards.

What data is available for Johor and Klang Valley sites?

JPS publishes flood hotspot lists ahead of the monsoon; for 2026/27 Johor listed 337, including 27 in Kulai and 44 in Johor Bahru district. JPS flood maps exist but are criticised as technical and fragmented, with no single public portal, so local flood history and site survey carry more weight.

What data is available in Singapore?

PUB publishes a list of flood-prone areas (36 entries as of November 2025) and a separate hotspots list. PUB's drainage code sets the minimum platform level, and for critical or key infrastructure PUB can advise modelled flood levels that the platform must clear by 300 mm.

Who carries out a data centre flood risk assessment?

Typically flood or hydraulic engineering consultants, insurer risk engineers, and data centre certification bodies such as Uptime Institute, whose Operational Sustainability assessments include site location risks. In Singapore the Qualified Person on the project must advise the owner to identify critical M&E equipment before design.

Should an operating data centre be reassessed?

Yes. EN 50600-2-1 calls for a risk analysis of existing premises, Uptime advises regular risk assessments as flooding increases, and observed short-duration rainfall in Peninsular Malaysia has already intensified. Drainage around a site also changes as neighbouring land is developed.

Data centre flood risk assessment

By the FloodProtection.now team · Last reviewed 9 November 2026

A data centre flood risk assessment works out how water could reach the site and its critical systems, at what level and how often, and what that means for design, operations and insurance. Before acquisition it decides whether the land works and what platform level it needs; at an operating site it checks plant levels, openings, drains, access and the emergency plan against that flood level. No standard template exists, but EN 50600-2-1, TIA-942-C, Uptime and FM Global all expect a site-specific flood analysis to feed the design.

Why a separate flood assessment

General due diligence asks whether a plot is in a flood zone. That is not enough for a data centre. The question is whether water can reach any one of the systems the site cannot run without, including the substation, fuel, cooling, cable entries and the access road, and for how long.

The standards point the same way. EN 50600-2-1:2021 says "the results of the environmental risk analysis shall be considered during design of the data centre", and for existing buildings that suitability "shall be determined by a risk analysis" (iTeh preview). TIA-942-C (2024) is reported to require formal risk analysis and mitigation at site selection rather than a simple flood-zone check (Cablinginstall). FM Global guidance, as widely cited from unofficial copies, works to the 500-year flood plus freeboard and expects a written flood emergency response plan where that flood reaches the site (DS 5-32 copy).

None of these sets out a deliverables list. The scope below is our inference from those standards; we found no standard template for a data centre flood risk assessment.

Two different jobs: before you buy, and once you operate

	Pre-acquisition and site selection	Operating site
Main question	Does this land work, and what will it cost to make it work?	Where would water get in today, and what fails first?
Hazards	Fluvial, flash and pluvial, coastal and tidal, drainage surcharge, groundwater	Same, plus internal water from cooling and roof drainage
Levels	Design flood level and required platform level	Surveyed levels of floors, plant, openings and drains against that flood level
Utilities and access	Substation route, fibre routes, roads that flood	Fuel delivery, staff access, generator autonomy under isolation
Outputs	Go or no-go, platform level, plant layout rules, cost of mitigation	Gap list, retrofit options, a tested emergency plan

At the pre-acquisition stage the cheap decisions are still open: where on the plot to put the building, how high to set the platform, and whether any plant goes below grade. In Singapore this is built into the drainage code: the Qualified Person must advise the owner to identify power, communications and other critical M&E equipment before the site is designed (PUB code, clause 2.5).

At an operating site, the assessment is a survey and a test. Which openings are below the design level? Are drains fitted with backflow protection? How long can the site run if the road is cut? Does the flood emergency response plan work in the warning time you actually get?

What it should cover

Synthesised from the standards above, a thorough assessment typically includes:

Hazard identification. River, flash and surface water, coastal and tidal, groundwater, drainage surcharge, and internal water.
Design flood levels. The 100-, 500- and 1,000-year floods with an allowance for climate change. ASCE 24-24 uses the 1,000-year flood for essential facilities (FEMA).
Site and building survey. Levels of floors, plant, penetrations, drains, ramps and loading docks.
Utility and access dependencies. Substation, fibre routes, roads, fuel supply.
Gap analysis against FM Global guidance, ASCE 24, TIA-942 and local rules (PUB in Singapore; JPS and the local authority in Malaysia).
Mitigation options. Raising, relocating plant, sealing, backflow valves, pumps, and flood barriers certified to ANSI/FM 2510 where warning time allows.
A flood emergency response plan with triggers and drills.

Inputs in Malaysia

JPS flood hotspot lists. Ahead of the 2026/27 northeast monsoon, Johor listed 337 hotspots, including 65 in Muar, 44 in Johor Bahru district and 27 in Kulai, and JKR listed 30 high-risk road locations (Malay Mail). The road list matters as much as the hotspots for access.
JPS flood maps. They exist, but an expert has called them "too technical" and in need of updating for climate and land-use change (Malay Mail via Yahoo), and access is fragmented with no central public portal (theSun). JPS is building flood forecasting for 74 river basins, due by 2030 (Malay Mail).
Local flood history. News reports and evacuation records fill gaps in the maps. Kulai flooded in January 2024 and again in January 2025, when Sungai Siku passed danger level (Malay Mail).
Rainfall projections. NAHRIM figures show observed 1-hour and 3-hour rainfall intensities up 17% and 29% between the 1970s and 2000 to 2007 (NAHRIM), and extreme rainfall intensity in the Peninsula is projected to rise 16 to 20% (UTM).
Draft national method. A 2023 CIDB draft standard on flood risk assessment includes flood hazard map conventions and asks whether a site lies in a flood risk area in the development plan (CIDB draft).

Malaysia has no numeric national platform level that we could find, so the assessment has to set the design flood level itself. More in Malaysia flood protection.

Inputs in Singapore

PUB flood-prone areas. 36 entries as of November 2025, including Second Chin Bee Road in the Jurong industrial area (PUB list). PUB says flood-prone land has fallen from about 3,200 ha in the 1970s to under 25 ha (PUB).
Design levels in the PUB code. Minimum platform levels of 4.0 m above Singapore Height Datum on the south coast and 4.5 m on the north, or higher where the code requires. For critical or key infrastructure, the platform must also be 300 mm above modelled flood levels advised by PUB (PUB code).
Sea level and rainfall. The Third National Climate Change Study projects up to 1.15 m of sea level rise by 2100, and up to about 5 m with storm surge and high tides (V3 infographics).
Coastal duties. Under the 2026 coastal protection law, owners of prescribed coastal places will have to put protection in place by stipulated dates, closer to the early 2030s (MSE). That is relevant to reclaimed sites such as Jurong Island.

See Singapore flood protection for the code in detail.

What you should get at the end

A design flood level for the site, with the method and the climate allowance stated.
A map or schedule of every opening, penetration and drain below that level.
A list of critical systems with their level relative to the flood, and what fails if each floods.
An access and fuel assessment: which roads flood, and how long the site can run isolated.
A ranked set of mitigation options with rough cost and effect.
A draft or reviewed flood emergency response plan.
A summary written for the insurer. Underwriters such as AXA XL say capacity goes to sites with "transparent exposure data" and "credible recovery plans" (InsuranceAsia News). See data centre flood insurance.

Questions to ask whoever does it

Which flood sources did you model, and which did you leave out? Was flash and surface water included, not only rivers?
Which return periods, and what climate uplift?
What local data did you use: JPS or PUB lists, flood history, site survey?
Did you survey actual levels of plant and openings, or rely on drawings?
Did you check the access roads and the fuel supply route?
Which standards did you test against, and where does the site fall short?
Is the mitigation advice independent of any product you sell?

Who does it

Usually flood or hydraulic engineering consultants, insurer risk engineers, and data centre certification bodies. Uptime Institute's Operational Sustainability standard covers site location and natural disaster risk, and those assessments are carried out by Uptime Institute Professional Services (Uptime). In Singapore, platform-level compliance goes through PUB submissions by the project's Qualified Person.

FloodProtection.now carries out site flood risk assessments for data centres and critical facilities. We do not certify sites or sell insurance. For the wider picture, start with data centre flood protection or the Johor data centre flood risk guide.

Talk to us about your site. Tell us what you need protected and where. We reply within one business day with next steps for an assessment, a barrier system, a flood plan or an insurer report.

Frequently asked questions

Is there a standard scope for a data centre flood risk assessment?: No published template was found. EN 50600-2-1 says the environmental risk analysis shall be considered in design, TIA-942-C is reported to require formal risk analysis at site selection, and FM Global guidance is widely cited as using the 500-year flood plus freeboard. The scope on this page is our synthesis of those standards.
What data is available for Johor and Klang Valley sites?: JPS publishes flood hotspot lists ahead of the monsoon; for 2026/27 Johor listed 337, including 27 in Kulai and 44 in Johor Bahru district. JPS flood maps exist but are criticised as technical and fragmented, with no single public portal, so local flood history and site survey carry more weight.
What data is available in Singapore?: PUB publishes a list of flood-prone areas (36 entries as of November 2025) and a separate hotspots list. PUB's drainage code sets the minimum platform level, and for critical or key infrastructure PUB can advise modelled flood levels that the platform must clear by 300 mm.
Who carries out a data centre flood risk assessment?: Typically flood or hydraulic engineering consultants, insurer risk engineers, and data centre certification bodies such as Uptime Institute, whose Operational Sustainability assessments include site location risks. In Singapore the Qualified Person on the project must advise the owner to identify critical M&E equipment before design.
Should an operating data centre be reassessed?: Yes. EN 50600-2-1 calls for a risk analysis of existing premises, Uptime advises regular risk assessments as flooding increases, and observed short-duration rainfall in Peninsular Malaysia has already intensified. Drainage around a site also changes as neighbouring land is developed.

About this guide. Written by the FloodProtection.now team. Each fact is checked against a primary source, such as the regulator, the national statistics office or the published engineering standard, and linked where it is used. Guides are general information; site-specific advice comes from an assessment.