What corporate clients require of IT service providers: MSP, software and integration contract insurance clauses and how to prove you meet them

What a corporate client requires of an IT services provider

QUICK ANSWER

A corporate IT services agreement typically requires combined technology errors and omissions and cyber liability of $2M to $10M per claim covering third-party liability, breach response, regulatory defence and dependent business interruption, general liability of $1M per occurrence and $2M aggregate with the client as additional insured, statutory workers' compensation with $1M employers' liability, hired and non-owned auto of $1M, an umbrella of $1M to $5M, crime coverage with computer fraud, and security attestations alongside the certificates.

Reviewed by Michael LaBarbera, Licensed property & casualty agent, Provident Financial Group · Reviewed Oct 11, 2026 Updated Oct 14, 2026

Typical requirements and how to check them
Requirement	What they usually ask for	How to check what you have
Technology errors and omissions with cyber liability	$2M to $10M per claim on a combined tech E&O and cyber form: failure of your services or software, network security and privacy liability, breach response costs, regulatory defence and penalties where insurable, media liability, and dependent business interruption for the client; claims-made with a retroactive date before the engagement	Dec page insuring agreements and limits, retroactive date, and the definition of technology services against the statement of work; sub-limits for regulatory and breach response often fall below the MSA's requirement.
Commercial general liability	$1M each occurrence / $2M aggregate with the client and affiliates as additional insureds, primary and non-contributory, for staff on client premises and hardware installed	Dec page limits and the additional insured form; general liability does not cover software failure or data incidents, which is why the tech E&O line exists.
Workers' compensation and employers' liability	Statutory in each state where staff work plus employers' liability of $1M / $1M / $1M, with a waiver	Information page with each state, Part Two limits and the waiver endorsement.
Hired and non-owned auto	$1M combined single limit for staff who drive to client sites in rental or personal cars; commercial auto where the provider runs service vehicles	The hired and non-owned endorsement or auto dec page.
Umbrella or excess liability	$1M to $5M following form over general liability, auto and employers' liability; excess cyber and tech E&O purchased separately where the MSA requires more than the primary limit	Umbrella dec page and underlying schedule; a separate excess cyber policy where needed.
Crime with computer and funds transfer fraud	Employee dishonesty, computer fraud, funds transfer fraud and social engineering coverage, with a client property extension where the provider has access to client funds or systems	Crime policy insuring agreements; social engineering is often a sub-limit that the MSA sets separately.
Security attestations	SOC 2 Type II or ISO 27001 report, penetration test summary, incident response plan and cyber insurance evidence delivered together; some clients require the provider to carry coverage for the client's notification costs	Not insurance, but delivered with the certificates; the cyber policy's breach response insuring agreement should cover notification of the client's affected individuals.
Certificates and tail	Certificate at signing and each renewal; tech E&O and cyber maintained for one to three years after termination	A live certificate for the term; extended reporting or continuous renewal for the tail.

Requirement

What they usually ask for

How to check what you have

Technology errors and omissions with cyber liability

$2M to $10M per claim on a combined tech E&O and cyber form: failure of your services or software, network security and privacy liability, breach response costs, regulatory defence and penalties where insurable, media liability, and dependent business interruption for the client; claims-made with a retroactive date before the engagement

Dec page insuring agreements and limits, retroactive date, and the definition of technology services against the statement of work; sub-limits for regulatory and breach response often fall below the MSA's requirement.

Commercial general liability

$1M each occurrence / $2M aggregate with the client and affiliates as additional insureds, primary and non-contributory, for staff on client premises and hardware installed

Dec page limits and the additional insured form; general liability does not cover software failure or data incidents, which is why the tech E&O line exists.

Workers' compensation and employers' liability

Statutory in each state where staff work plus employers' liability of $1M / $1M / $1M, with a waiver

Information page with each state, Part Two limits and the waiver endorsement.

Hired and non-owned auto

$1M combined single limit for staff who drive to client sites in rental or personal cars; commercial auto where the provider runs service vehicles

The hired and non-owned endorsement or auto dec page.

Umbrella or excess liability

$1M to $5M following form over general liability, auto and employers' liability; excess cyber and tech E&O purchased separately where the MSA requires more than the primary limit

Umbrella dec page and underlying schedule; a separate excess cyber policy where needed.

Crime with computer and funds transfer fraud

Employee dishonesty, computer fraud, funds transfer fraud and social engineering coverage, with a client property extension where the provider has access to client funds or systems

Crime policy insuring agreements; social engineering is often a sub-limit that the MSA sets separately.

Security attestations

SOC 2 Type II or ISO 27001 report, penetration test summary, incident response plan and cyber insurance evidence delivered together; some clients require the provider to carry coverage for the client's notification costs

Not insurance, but delivered with the certificates; the cyber policy's breach response insuring agreement should cover notification of the client's affected individuals.

Certificates and tail

Certificate at signing and each renewal; tech E&O and cyber maintained for one to three years after termination

A live certificate for the term; extended reporting or continuous renewal for the tail.

What the client is protecting

A corporate client that outsources IT exposes its systems, data and operations to the provider's mistakes. The agreement protects it from service failure, breaches that become its regulatory problem, downtime caused by the provider, and theft through compromised access, for the life of the engagement and a tail afterwards. Procurement and security review the exhibit together and track it through a supplier portal.

The lines an IT services agreement names

Combined technology E&O and cyber liability at a limit sized to the client's exposure, with regulatory, breach response and dependent business interruption at full limits. General liability with the client added for time on premises. Workers' compensation with a waiver. Hired and non-owned auto. An umbrella, and excess cyber where the primary falls short. Crime with computer and funds transfer fraud. Security attestations delivered with the certificates, and a tail after termination.

How to check your policies against the agreement

Read the tech E&O and cyber dec page insuring agreement by insuring agreement, including sub-limits, against the exhibit. Check the retroactive date and the definition of services against the statement of work. Confirm general liability's additional insured form, the waiver on workers' compensation, hired and non-owned auto, the umbrella and the crime insuring agreements. Assemble the attestations with the certificate.

Keep the certificate current

Supplier portals expire certificates at renewal and hold payment; security teams re-request attestations annually. A live certificate link stays current as policies renew, carries the endorsements as attachments and notifies the client when a line changes, with the official PDF attached.

Questions people actually ask

What is the difference between cyber liability and technology errors and omissions?

Tech E&O covers claims that your service or software failed to perform; cyber covers network security and privacy incidents. IT providers buy them on one combined form because a single incident, such as a misconfiguration that leads to a breach, triggers both.

Why does the client ask about regulatory defence and dependent business interruption?

Because a breach at the provider becomes the client's regulatory problem and the client's downtime. The MSA wants your policy to pay for the client's regulatory defence and lost income arising from your failure, which only some policies include at a full limit.

Our cyber policy has a $250K sub-limit for breach response. Is that a problem?

Usually yes under an MSA with a $2M or higher requirement, because notification and forensics for a client's affected individuals can exceed it quickly. Ask the carrier to raise the sub-limit to the full policy limit.

Does a SOC 2 report replace insurance?

No. The attestation shows the controls exist; the insurance pays when they fail. Clients ask for both, and many cyber carriers now price on the same attestation.