128 days but this thread is still relevant.
Off topic but since you brought it up, has anyone actually seen IPMI exposed to the public internet in the wild recently? I scan ranges for work and the numbers dropped off a cliff around 2021. Either people wisened up or the big clouds finally stopped defaulting to routable addresses.
Back on topic though, the insurance angle is interesting. I work with a couple mid-sized hosts, one on Contabo, one self-colo in a Hetzner facility. Neither has ever been asked for Tier anything by their underwriter. They want to see maintenance logs and environmental monitoring, sure. But the certificate itself? Not once.
Maybe the insurance paranoia depends on which country you're writing the policy in.