IT Provider Insurance Requirements: What to Ask For

A certificate of insurance isn't one document, it's usually three policies bundled into a single page. Each one covers a different kind of failure, and providers who skip one aren't saving you money, they're shifting risk onto you without telling you.

General liability

This covers bodily injury and physical property damage, think a technician tripping over a cable and knocking over a rack, or damaging your building during a cabling job. It's the baseline every vendor should carry, and it's the easiest to verify. It will not touch a ransomware event or a botched software deployment.

Technology errors and omissions (E&O)

This is the one most owners have never heard of, and it's the one that matters most for day-to-day IT work. Tech E&O covers financial loss caused by a mistake in the provider's professional services, a misconfigured firewall rule that let traffic through, a bad patch that took down production, a backup job that silently failed for six months. If your IT company's error costs you revenue or data, this is the policy that responds. Without it, you're relying entirely on the provider's cash reserves and goodwill.

Cyber liability

Cyber liability on the provider's own policy covers losses connected to a breach that originates from their systems or their access, not yours. If a provider's remote management tool gets compromised and that compromise spreads into your network, this coverage addresses the provider's liability for that chain of events. It's distinct from the cyber insurance your own business should carry, which protects you directly when you're the victim. Both matter, and they answer different questions.

Being named as an additional insured on the provider's general liability and, ideally, their E&O policy means you can make a claim directly rather than waiting for the provider to file one on your behalf and hoping they follow through. It also gives your own insurer a cleaner subrogation path if a claim gets paid out and the provider's error is the root cause. Ask your provider's agent to add you as an additional insured with a certificate holder notice, so you're informed automatically if the policy lapses or gets canceled mid-contract. Most agents can do this in a day. Providers who hesitate are telling you something.

A certificate of insurance shows the policy type and the limit, usually per-occurrence and aggregate. A $1 million per-occurrence limit sounds like a lot until you remember that a single ransomware event with recovery costs, legal fees, and notification expenses can blow past that number fast. Sophos puts the median recovery cost of a ransomware incident, not counting any ransom paid, at $375,000, with the average pulled up to $1.7 million by a long tail of severe cases (Sophos, State of Ransomware 2026). If your provider's aggregate limit is lower than that, ask what happens when the claim exceeds the policy.

Exclusions matter as much as limits. Look for carve-outs around subcontracted work, war and terrorism exclusions that some insurers have stretched to cover state-sponsored cyberattacks, and prior-acts coverage dates. A policy that only covers incidents after a certain retroactive date won't help if the vulnerability that caused your breach was introduced before that date.

Insurance is not a regulatory checkbox, it's a contractual term you negotiate. Regulators care about something adjacent but different: whether your written agreement actually spells out the provider's obligations. Under the FTC Safeguards Rule, financial institutions and their affiliates must ensure service providers are contractually bound to implement and maintain appropriate safeguards, and that arrangement has to be periodically reassessed, not signed once and forgotten, per 16 CFR 314.4(f). CISA's guidance on securing service provider relationships pushes the same point from a different angle: contracts should clearly define security responsibilities and require timely incident notification, as laid out in CISA Advisory AA22-131A. Neither document tells you what insurance to require. That part is on you, and it belongs in the master services agreement alongside your Safeguards Rule obligations if you're a covered entity.

Don't just ask your IT provider about coverage, call their agent directly. A legitimate agent will answer these without hesitation:

• What are the per-occurrence and aggregate limits on the tech E&O policy, and when do they reset?
• Is cyber liability a standalone policy or an endorsement bolted onto general liability with a much lower sublimit?
• Is there a retroactive date, and does it predate the start of our contract?
• Can our business be added as an additional insured with automatic notice of cancellation?
• Are subcontractors or offshore support staff covered under the same policy, or excluded?

If the agent dodges, or the provider can't produce an agent's contact at all, that's a signal worth weighing as heavily as price when you're evaluating managed IT services or comparing a switch, which our guide to switching IT providers covers in more detail.

Insurance is one piece of a larger due diligence picture that includes how a provider handles cybersecurity incident response, how they manage privileged access through tools covered under privileged access management, and whether their contract language matches what they tell you in sales meetings. Texas owners evaluating providers around The Woodlands or anywhere else in the state should treat the certificate of insurance the same way they'd treat a reference check, something you verify, not something you assume.

Is my IT provider legally required to carry cyber liability insurance?

No federal or Texas statute mandates it. It's a contractual requirement you set, not a regulatory one. The FTC Safeguards Rule requires written oversight of service providers' safeguards, not specific insurance products.

What's the difference between the provider's cyber liability and my own business's cyber insurance?

The provider's policy covers their liability when their error or compromised access causes your loss. Your own policy covers your business directly as the breach victim, regardless of whose system the attacker entered through first. You need both conversations, not just one.

How often should I ask for an updated certificate of insurance?

Annually at minimum, and any time you renew or renegotiate the services agreement. Policies lapse, limits change, and a provider that was properly insured two years ago may not be today.

Should tech E&O limits scale with the size of my IT environment?

Yes. A provider managing a single-location office with a handful of servers needs less coverage than one managing multi-site networks, cloud infrastructure, and compliance-regulated data. Ask the agent how the limit was set and whether it reflects your actual environment.

If you're not sure what your current provider's certificate actually covers, or you've never seen one, that's worth fixing before the next contract renewal rather than after an incident. Start with a free IT assessment or contact LayerLogix to walk through what your vendor agreements should actually require.