Severe Weather and Physical Disruption Continuity Guide for IT: Flood, Heat and Storm Planning

Most IT continuity plans treat weather as a power cut, yet floods, heatwaves, storms and snow break technology through water, heat, blocked roads and absent staff long before, or without, the grid failing. This guide covers the weather hazards that reach IT and facilities directly: flooding of plant and basements, cooling failure in extreme heat, wind and storm damage, snow and ice that stop people and deliveries, and the knock-on effect on suppliers. It shows how to turn public warnings into pre-agreed actions, how to protect server rooms and data centres, how to keep a security team functioning when sites are unreachable, and how to test it. It is written for IT operations, facilities, security and continuity managers. Grid loss itself is covered in depth in the Power and Physical Infrastructure Dependency, and the planning method in the Business Continuity and Disaster Recovery Guide; this page does not repeat them.

Key takeaways

• Weather usually gives warning, so plan actions by warning level. National warning services issue impact-based warnings days or hours ahead; the value is in deciding beforehand what you do at each level.
• Water finds the plant room first. Basement fuel pumps, transfer switches and electrical rooms were the single points of failure that took Lower Manhattan data centres offline in Hurricane Sandy, even where generators sat on upper floors.
• Heat defeats redundancy that was sized for normal summers. Google's London zone outage in July 2022 followed a simultaneous failure of multiple redundant cooling systems during record temperatures.
• People and access are the hidden dependency. Snow, flooding and storms stop engineers, guards and suppliers reaching sites; remote operation and pre-positioned staff decide how long you can run.
• Your suppliers face the same weather. Colocation, carriers, managed SOC and logistics providers in the same region share your hazard, so ask how their plans work, not just whether they exist.

How weather hazards reach IT

Each hazard has a different failure path. Mapping them separately avoids the common gap where a plan says "loss of site" and nothing about why or how fast.

Grid loss can follow any of these. When it does, switch to the power runbook; the rest of this guide deals with the effects that arrive with or without mains power.

Turning warnings into actions

In the UK, the Met Office National Severe Weather Warning Service runs 24/7 and issues yellow, amber and red warnings for rain, thunderstorms, wind, snow, lightning, ice, extreme heat and fog, up to seven days ahead. Colour reflects both the likely impact and its likelihood, shown in an impact and likelihood matrix in each warning; the Met Office states it introduced a harmonised matrix in October 2026 that changes the impact level wording, so check your triggers still match. A yellow warning can mean moderate impacts are highly likely or that much bigger impacts are possible but less certain, so read the warning text rather than reacting to the colour alone. Its Extreme Heat Warning is impact based and separate from England's heat-health alerts.

In England, Environment Agency flood alerts mean flooding is possible and are usually issued 2 to 12 hours ahead; flood warnings mean flooding is expected and usually come 30 minutes to 2 hours ahead; severe flood warnings indicate danger to life and have no fixed timeframe. Every site should be registered for flood warnings. Other countries run equivalent services; use the national meteorological and hydrological agency for each site.

Build a trigger table per site, owned by facilities and IT operations together:

The key decision is pre-emptive failover. Moving workloads during an amber warning, while staff, networks and the site still work, is cheaper and safer than recovering from an unplanned outage. The Cloud Region Outage Resilience guide covers evacuating a cloud region, which applies when a provider's region sits in the warning area.

Flood: protecting plant, not just servers

Hurricane Sandy in October 2012 is the reference case. At 75 Broad Street and 33 Whitehall in Lower Manhattan, both in the city's Zone A flood zone, basement flooding disabled the diesel fuel pumps, so generators on higher floors could not be refuelled. At 75 Broad, staff from tenant companies formed a bucket brigade carrying diesel in 5 gallon buckets up 17 flights of stairs to the roof generator, an effort one participant called not sustainable. At 121 Varick Street, flooding in the generator room damaged an automatic transfer switch. Some facilities that switched to generator before the utility shutdown stayed online.

• Find the lowest critical component: trace fuel tanks, fuel pumps, transfer switches, switchgear, UPS, comms rooms and carrier entry points to their floor level. The lowest one sets the site's flood tolerance.
• Elevate or protect: move pumps and switchgear above expected flood levels where possible, or use sealed enclosures and flood doors; NIST SP 800-53 PE-15 requires protecting systems from water damage with accessible, working master shutoff or isolation valves.
• Detect water early: leak detection under raised floors, in plant rooms and in cable ducts, wired to the building management system with alerts to on-call staff (PE-14(2) for alarm monitoring).
• Siting: PE-18 asks you to position system components to minimise damage from physical and environmental hazards. Use national flood maps when choosing or reviewing sites, and see the ANSI/TIA-942 and EN 50600 Guide for data centre design standards.
• Never re-energise wet plant without inspection: flood water contaminates electrical equipment; get a qualified electrician's sign-off before restoring power.

Heat: cooling capacity and thermal load shedding

On 19 July 2022, as UK temperatures reached a record 40C, one Google data centre hosting part of zone europe-west2-a could not maintain a safe operating temperature after what Google's incident report calls a simultaneous failure of multiple, redundant cooling systems combined with extremely high outside temperatures. Google first terminated 42% of preemptible VMs across the region to reduce heat load, then powered down servers, taking out about 35% of VMs in the zone. A separate routing change made during the incident affected all three zones. Google's remediation commitments included methods to progressively reduce thermal load within a data centre space to avoid full shutdowns, retesting failover automation, and auditing cooling equipment globally.

The lessons translate to any server room or colocation suite:

1. Know the design ambient temperature: ask facilities or your colocation provider what outside temperature the cooling plant was designed for, and compare it with recent local records. Plant sized for past summers is the common gap.
2. Pre-define a thermal load-shedding order: list workloads that can be shut down or moved first (development, batch, test, preemptible capacity), so operators shed heat in minutes, not by debate. This mirrors Google's first move.
3. Monitor inlet temperatures, not room averages: alert on rack inlet temperature and rate of rise; hot spots appear before the room average moves (PE-14 environmental controls with PE-14(2) alarms).
4. Maintain and clean heat rejection: dry coolers and condensers lose capacity when coils are dirty; schedule cleaning before summer and inspect rooftop units after storms and smoke events.
5. Plan temporary cooling: know where portable units could be placed, how they would be powered, and how heat would be exhausted, and pre-agree hire with a supplier.
6. Edge and branch equipment: comms cabinets in offices often rely on building air conditioning that is switched off at weekends; heat warnings over a weekend need a specific action.

Heat also affects people: engineers working in hot plant rooms and staff travelling in extreme heat need welfare measures and shorter shifts, which reduces available capacity just when it is needed.

Storms, snow and site access

Wind, snow and ice mostly hit through access. When roads close, the site still runs, but nobody can replace a failed disk, refuel a generator or respond to an alarm.

• Remote operation: out-of-band management for servers and network devices, remote power control, and remotely viewable building management and CCTV, so most tasks need no visit.
• Pre-positioned staff and spares: for amber and red warnings, book accommodation near critical sites and stock critical spares on site.
• Remote hands: agree in the colocation contract what remote hands will do during severe weather and whether their staff are also affected.
• Physical security during disruption: guards may not arrive and doors may be propped for deliveries; review which controls rely on staff presence. See the Physical Security Guide for Security Teams.
• Remote working at scale: when offices close, home connections, VPN capacity and endpoint support carry the business. See the Home Office and Remote Worker Security Guide.

Suppliers in the same weather

Regional weather is a concentration risk: your colocation provider, carriers, fuel supplier, managed SOC and logistics firms may all be in the warning area. Questions to ask each critical supplier:

Build these into contracts and reviews with the IT Service-Level and Operational Supplier Assurance approach.

Where identity fits

When staff work from unexpected places during disruption, sign-in risk rules may block legitimate users, and help desk resets spike. Decide in advance which conditional access exceptions are acceptable and for how long, keep them time-bound, and make sure break-glass accounts work if the identity provider is reachable only from some locations. Pressure to restore access quickly is also when social engineering of the help desk succeeds, so keep verification steps. See the Break-Glass Account Guide.

Implementation: a phased approach

1. Hazard profile per site (weeks 1 to 4): flood maps, recent heat records, storm and snow history; record the lowest critical plant component and the cooling design ambient.
2. Warning registration and trigger tables (weeks 2 to 6): register every site for flood and weather warnings; agree trigger tables with facilities, IT operations and the crisis team.
3. Quick physical fixes (months 1 to 3): leak detection, inlet temperature alerting, flood barriers, condenser cleaning, spares stock.
4. Load-shedding and failover runbooks (months 2 to 4): thermal shedding order, pre-emptive failover procedure, and the rollback: how to move workloads back once the warning lifts, with data consistency checks.
5. Supplier review (months 3 to 6): ask the questions above and record answers in the supplier register.
6. Exercise (twice a year): run a tabletop for a flood warning in winter and a heatwave in summer, then a live test of pre-emptive failover on one non-critical service. See the Tabletop Exercise Guide.
7. Capital decisions (annual): relocating plant above flood level, extra cooling capacity or moving out of a high-risk site, fed by exercise findings.

Decision guidance

• Harden or move: if the lowest critical plant sits below known flood levels and cannot be raised, relocating workloads to cloud or another site is often cheaper over time than repeated protection.
• Pre-emptive failover or ride it out: fail over early when the warning covers the site, failover is tested and the workload tolerates the switch; ride it out when failover is untested, since an untested failover during a storm adds a second incident.
• Small organisations: a single server room in an office is the most exposed case. Prioritise cloud backups, documented shutdown, and remote working over facility upgrades.
• Large organisations: geographic separation matters. NIST SP 800-53 CP-6(1) and CP-7(1) require alternate storage and processing sites separated from the primary to reduce susceptibility to the same threats; check that separation covers the same flood plain and weather system, not just a different building.

Detection and measurement

• Warning-to-action time: minutes from a relevant warning being issued to the trigger table actions starting, measured in real events and exercises.
• Cooling headroom: margin between peak rack inlet temperature on the hottest day of the year and the alarm threshold.
• Flood exposure: number of critical plant components below the site's assessed flood level, trending to zero.
• Pre-emptive failover success: percentage of critical services failed over and back within their recovery time objective in tests.
• Supplier coverage: percentage of critical suppliers with weather questions answered and evidence on file.

Common failure patterns

• Generators upstairs, pumps downstairs: the Sandy pattern; a dry generator is useless without dry fuel pumps and switchgear.
• Redundancy that shares a cause: multiple cooling units all sized for the same outside temperature fail together in a heatwave, as Google's report describes.
• Changes made in a hurry during the event: Google's routing change during the London incident spread impact to other zones; freeze changes and use runbooks.
• Plans that assume people can travel: the plan names an engineer who cannot reach site through snow or flood water.
• Alternate site in the same weather system: primary and recovery sites both inside the warning area.
• Re-energising too fast: powering up flood-exposed plant or many systems at once without inspection or staged restart.

Framework mapping

Practitioner checklist

• Register every site for national weather and flood warnings.
• Write a trigger table per site with actions for each warning level.
• Record the floor level of fuel pumps, transfer switches, switchgear and comms rooms against flood risk.
• Find the cooling design ambient temperature and compare it with recent local records.
• Define a thermal load-shedding order and a pre-emptive failover runbook with rollback.
• Install leak detection and rack inlet temperature alerting to on-call staff.
• Agree remote hands, accommodation and spares for sites staff may not reach.
• Ask critical suppliers the weather questions and keep the evidence.
• Exercise a winter flood and a summer heatwave scenario each year.

Standards and references

• Met Office: Weather warnings guide
• GOV.UK: Flood alerts and warnings, what they are and what to do
• NIST: SP 800-53 Rev. 5, Security and Privacy Controls
• Google Cloud: europe-west2 incident report, July 2022
• DatacenterDynamics: Google London outage during heatwave
• Data Center Knowledge: Massive flooding damages several NYC data centers
• Data Center Knowledge: Diesel bucket brigade keeps Peer 1 online at 75 Broad

Related NHI Mgmt Group resources: Power and Physical Infrastructure Dependency · Business Continuity and Disaster Recovery Guide · Cloud Region Outage Resilience · Data Centre Security Guide · Crisis Management Guide