What enterprise clients require: insurance in vendor onboarding and master services agreements

What the enterprise vendor form actually requires

QUICK ANSWER

Enterprise vendor onboarding requires general liability with the client as additional insured, professional liability for service providers, cyber liability for anyone touching data or systems, workers' compensation, and frequently an umbrella and crime coverage. Limits sit in the master services agreement's insurance exhibit, and procurement will not release the first purchase order until the certificate matches it.

Reviewed by Michael LaBarbera, Licensed property & casualty agent, Provident Financial Group · Reviewed Oct 11, 2026 Updated Oct 14, 2026

Typical requirements and how to check them
Requirement	What they usually ask for	How to check what you have
General liability	Per-occurrence and aggregate at the exhibit's limits, the client and affiliates as additional insured, primary and non-contributory, waiver of subrogation	Dec page limits and the blanket additional insured, primary and non-contributory and waiver forms.
Professional liability / errors & omissions	A per-claim and aggregate limit for services, advice or technology; retroactive date before the engagement; a tail period after it	Professional liability dec page: limits, retroactive date, claims-made basis.
Cyber liability	First- and third-party coverage at a stated limit for vendors with data or system access; sometimes combined with tech E&O	Cyber dec page: limits, sublimits for extortion and funds transfer fraud, whether the aggregate is shared with E&O.
Workers' compensation and employers' liability	Statutory with employers' liability limits in the exhibit; waiver of subrogation in favour of the client	Information page and waiver endorsement.
Commercial auto	Owned, hired and non-owned at a combined single limit where vendors visit sites	Auto dec page or hired and non-owned endorsement.
Umbrella or excess	A layer above GL, auto and employers' liability at the exhibit's limit	Umbrella dec page scheduling the underlying policies and following form.
Commercial crime / fidelity	Employee theft and third-party coverage for vendors handling client funds or property; social engineering where payments are involved	Crime dec page with third-party (client property) coverage and social engineering sublimit.
Certificate and notice terms	Certificates before work starts and at each renewal, thirty days' notice of cancellation, endorsements attached	A live certificate link plus endorsement copies in the vendor portal.

Requirement

What they usually ask for

How to check what you have

General liability

Per-occurrence and aggregate at the exhibit's limits, the client and affiliates as additional insured, primary and non-contributory, waiver of subrogation

Dec page limits and the blanket additional insured, primary and non-contributory and waiver forms.

Professional liability / errors & omissions

A per-claim and aggregate limit for services, advice or technology; retroactive date before the engagement; a tail period after it

Professional liability dec page: limits, retroactive date, claims-made basis.

Cyber liability

First- and third-party coverage at a stated limit for vendors with data or system access; sometimes combined with tech E&O

Cyber dec page: limits, sublimits for extortion and funds transfer fraud, whether the aggregate is shared with E&O.

Workers' compensation and employers' liability

Statutory with employers' liability limits in the exhibit; waiver of subrogation in favour of the client

Information page and waiver endorsement.

Commercial auto

Owned, hired and non-owned at a combined single limit where vendors visit sites

Auto dec page or hired and non-owned endorsement.

Umbrella or excess

A layer above GL, auto and employers' liability at the exhibit's limit

Umbrella dec page scheduling the underlying policies and following form.

Commercial crime / fidelity

Employee theft and third-party coverage for vendors handling client funds or property; social engineering where payments are involved

Crime dec page with third-party (client property) coverage and social engineering sublimit.

Certificate and notice terms

Certificates before work starts and at each renewal, thirty days' notice of cancellation, endorsements attached

A live certificate link plus endorsement copies in the vendor portal.

Where the requirement hides

Master services agreements carry an insurance section and often an exhibit; purchase orders incorporate the client's standard terms by reference; vendor portals restate the requirement as a checklist. When the versions differ, the signed agreement governs, but the portal's checklist is what the compliance reviewer uses.

The two that stall onboarding

Professional liability with the wrong retroactive date or a limit sized for a smaller client. Cyber absent or with a sublimit for funds transfer fraud that the exhibit specifically addresses. Both can be fixed at renewal or mid-term with a quote; neither can be fixed by rewording the certificate.

Additional insured on professional liability

Clients often ask for it; most professional liability policies do not offer it. The usual resolution is additional insured status on general liability plus a certificate showing the professional liability limits, with a note from the agent explaining the market practice. Procurement teams see this daily and accept it when it is explained.

What to send the client

A certificate matching the exhibit line by line, the client's legal entities named exactly, endorsement forms referenced and attached in the vendor portal, and a live certificate link so annual re-verification happens without a request.

Questions people actually ask

Procurement rejected my certificate. What are the usual reasons?

A limit below the exhibit, a missing endorsement form reference, the client's legal entity named incorrectly, professional or cyber coverage absent, or an expiration date too close. Compliance teams match line by line against the exhibit.

The MSA asks for a tail on professional liability. What is that?

An extended reporting period: the right to report claims after the policy ends for work done during it. Clients ask for it so a claim arising after the engagement is still covered. It is bought from the carrier at the end of the policy or arranged through continuous coverage.

Can I negotiate the insurance exhibit?

Sometimes, especially where a requirement does not fit the service (additional insured on professional liability, for example, is often unavailable). Procurement will accept reasonable substitutes if a licensed agent explains them; they will not accept a blank.

Do remote-only vendors need general liability?

Almost every exhibit still requires it, and it is inexpensive relative to professional and cyber. It also carries the additional insured status the client wants.