Managed service providers (MSPs) insurance checklist: what a managed service provider should carry

The managed service provider insurance checklist

QUICK ANSWER

Managed service providers (MSPs) usually carry technology e&o, cyber liability and general liability. MSPs hold administrative access to every client's network, push updates and backups the clients depend on, and are the way attackers reach dozens of businesses at once, which is why cyber carriers underwrite them hardest. The client's vendor desk and your landlord ask for proof of each. The checklist below covers who asks and how to check what you have.

Reviewed by Michael LaBarbera, Licensed property & casualty agent, Provident Financial Group · Reviewed Oct 12, 2026 Updated Oct 14, 2026

Who asks a managed service provider for what

Who	What they usually want to see
Enterprise clients & vendor onboarding	General liability, professional or cyber liability, workers' compensation and often an umbrella
Landlords & commercial leases	General liability with the landlord as additional insured, property coverage on tenant improvements and workers' compensation
Banks, lenders & SBA loans	Property or auto physical damage with the lender as loss payee, and liability proof at closing and every renewal

Each of them wants a certificate, and most want it again at every renewal. A live certificate link from the wallet shows today's coverage to every holder and tells them when it changes.

How to check what you already have

Technology E&O declarations. The retroactive date, whether cyber coverages are included in the same form, contractual liability wording and the exclusions for guarantees of uptime.
Cyber declarations. The headline limit matters less than the sublimits: social engineering, funds-transfer fraud, ransomware and business interruption, plus the regulatory coverage and the panel of breach vendors.
General liability declarations page. Three liability numbers matter: each occurrence, general aggregate and the products–completed operations aggregate. Then the forms list: blanket additional insured, waiver of subrogation and primary and non-contributory wording satisfy every contract; scheduled forms satisfy one.
Workers' compensation information page. Item 3.A must list every state you work in, item 4 must carry the right class codes, and the employers' liability limits should meet what contracts ask. Check that the estimated payroll is close to this year's.
Employment practices declarations. Limit and retention, third-party coverage for claims by customers, and whether wage-and-hour claims carry any defence sublimit.
Property section. Limits for building, business personal property and tenant improvements against replacement cost, the coinsurance percentage, the deductible, and whether flood and earthquake are excluded (they usually are).
Crime declarations. Employee theft, forgery, funds-transfer fraud and social engineering each have their own limit; third-party coverage if you work in clients' premises.
Professional liability declarations. Claims-made or occurrence, the retroactive date (it should not have moved), the limit per claim and aggregate, the deductible, and whether defence costs sit inside or outside the limit.

What usually goes wrong for managed service providers

An attacker using the MSP's tools to reach every client, the catastrophic claim of the class.
Service agreements with no limitation of liability and no security responsibilities defined.
Contracts that promise uptime or indemnity the policy excludes.
Social engineering (wire fraud) sublimited to a small amount on a cyber policy with a large headline limit.
A retroactive date that moved when you switched carriers, cutting off earlier work.
Contracts with indemnity clauses wider than the policy will support.

What underwriters will ask a managed service provider

Clients and endpoints managed, tools and access controls, backup practice, and service agreement terms
Services, SLAs offered and the largest client contract
Security controls and whether you hold client credentials or data
Multi-factor authentication, backups and endpoint protection
Records held, payment card handling and any client network access
Services, largest engagement size and the contracts you sign

Have the answers in the wallet before the renewal and the quote request fills itself in; CoverMatch sends one application to every eligible carrier and lines the quotes up against what you have.

Renewal timing

Audits at year end compare payroll, receipts and subcontractor costs with the estimate, so keep the wallet's size figures and the subcontractor certificates current. Start comparing sixty days before expiration, and ask for the limits the next contract will need rather than the ones the last one did.

Questions people actually ask

Why do cyber carriers scrutinise MSPs?

Because the MSP's credentials open every client, and ransomware groups target them for that reason. Multi-factor authentication on every tool, privileged-access controls and tested backups are the conditions; carriers decline MSPs without them.

What should an MSP's service agreement say about security?

Who is responsible for what, what the MSP guarantees and a limitation of liability the policy can support. Technology E&O and cyber answer the claims; the agreement decides how large they can be.

What is the difference between tech E&O and cyber?

Tech E&O responds when your product or service fails and a client loses money. Cyber responds when data or systems are compromised, yours or a client's. Most carriers package them for technology businesses because one incident usually triggers both.

Does cyber insurance cover a fraudulent wire transfer?

Only under a social-engineering or funds-transfer-fraud insuring agreement, and often at a sublimit well below the policy limit. Ask for the sublimit before you buy; it is the claim small businesses actually have.

What is a retroactive date on an E&O policy?

The date before which no work is covered. On a claims-made policy you want it to stay at the day you first bought coverage, not reset at each renewal or carrier change. CoverMatch checks it on every quote comparison because it is the difference between covering ten years of work and one.