Master service agreement insurance requirements, line by line

A master service agreement (MSA) usually requires the vendor to carry general liability, auto, workers' compensation and an umbrella, plus professional liability, cyber or crime coverage when the services touch the client's data, money or advice. It also asks for additional insured status, primary and noncontributory wording, waivers of subrogation, minimum insurer ratings, certificates and notice of cancellation. Most of it is negotiable, and the cheapest time to negotiate is before the first statement of work is signed, because every later SOW inherits the MSA terms.

Below is a sample clause we wrote for illustration. It is not taken from any real contract and is not a recommended standard, but it collects the requirements a vendor sees most often. Each numbered line is explained after it.

The sample clause (illustrative)

Insurance. (1) Supplier shall maintain the following insurance at its own expense during the Term and while any Services are performed, and, for any claims-made coverage, for three years after. (2) Commercial general liability on an occurrence form, ISO CG 00 01 or equivalent, with limits of at least $1,000,000 per occurrence and $2,000,000 general aggregate, including products-completed operations and contractual liability. (3) Business automobile liability covering owned, hired and non-owned autos with a combined single limit of at least $1,000,000. (4) Workers' compensation as required by law and employer's liability of at least $1,000,000 each accident, each employee and policy limit. (5) Umbrella or excess liability of at least $5,000,000, following the form of the underlying policies. (6) Professional liability (errors and omissions), including technology E&O, of at least $2,000,000 per claim. (7) Network security and privacy liability of at least $2,000,000 per claim. (8) Commercial crime, including employee theft of Customer's property, of at least $500,000, naming Customer as loss payee. (9) Customer and its affiliates, officers and employees shall be additional insureds on the policies in (2), (3) and (5), on a primary and noncontributory basis. (10) Supplier waives, and shall cause its insurers to waive, subrogation against Customer on all required policies. (11) Insurers must be rated A- VIII or better by AM Best. (12) Supplier shall deliver certificates and endorsements before performing Services and at each renewal. (13) Supplier shall give Customer 30 days' written notice of cancellation or material change. (14) Supplier is responsible for all deductibles and self-insured retentions, and any retention above $100,000 requires Customer's approval. (15) These requirements do not limit Supplier's liability or indemnity obligations. (16) Supplier shall require its subcontractors to carry the same insurance. (17) Failure to maintain the insurance is a material breach, and Customer may purchase it and offset the cost.

Line by line

(1) Duration. Occurrence policies respond to injury during the policy period, so they only need to be in force while you work. Claims-made policies (E&O, cyber, often crime) respond only to claims made while the policy is in force, which is why the clause asks for three years after. You satisfy that by renewing without a gap and keeping the same retroactive date, or by buying an extended reporting period if you stop. Push back if the tail runs longer than the statute of limitations on the work, or if the customer expects you to keep a specific carrier.

(2) CGL. This is the baseline, and $1 million / $2 million is the most common requirement. "Contractual liability" is already in the standard form through the insured contract definition, which covers tort liability you assume in a contract; it does not cover every promise in the MSA. Check that your aggregate applies per location or per project if the customer asks.

(3) Auto. If your people drive their own cars to the client's site, hired and non-owned auto is what matters. A firm with no company vehicles can often meet this with HNOA alone, but say so in negotiation rather than signing a requirement for "owned" autos you do not have.

(4) Workers' comp and employer's liability. The amount is set by state law; employer's liability limits are the negotiable part, and $1 million each is common with an umbrella sitting on top. In monopolistic-fund states, employer's liability is bought separately as stop-gap coverage. If you are a sole owner exempt from comp in your state, the clause should say "as required by law" so an exemption counts.

(5) Umbrella. "Following form" means the umbrella adopts the underlying terms, including the additional insured grant. Confirm the umbrella actually extends additional insured status, and that it sits over all three primaries. Many small vendors carry $1 million to $2 million; asking for $5 million from a five-person consultancy may be negotiable down.

(6) Professional liability. This is the coverage that pays when the work itself is wrong: a missed requirement, a botched migration, bad advice. It is claims-made, and the per-claim limit is often shared with defense costs. Professional liability policies generally do not offer additional insured status, so resist any clause that extends (9) to E&O. For software and IT firms, see Technology E&O insurance for software, SaaS and IT firms.

(7) Cyber. Customers ask for this when you hold their data or have network access. Check that your policy's third-party liability insuring agreement covers a breach of the customer's data while in your care, not only your own systems, and look at sublimits for regulatory fines and PCI assessments. Background in cyber insurance: what it covers for a business.

(8) Crime with client coverage. Standard employee theft coverage protects your money. A janitorial, staffing or bookkeeping vendor needs a clients' property extension so a theft by your employee from the customer is covered, and the loss payee wording sends the payment to the customer. Some customers also want third-party coverage for social engineering losses; that is a separate, usually sublimited grant.

(9) Additional insured, primary and noncontributory. The additional insured grant lets the customer use your CGL, auto and umbrella for claims arising from your work. Many carriers include a blanket endorsement that adds anyone you agree in a written contract to cover; check that its wording reaches the customer's affiliates and employees, and whether it covers completed operations. Primary and noncontributory wording means your policy pays first and does not share with the customer's insurance, which typically requires a specific endorsement such as ISO CG 20 01. Read additional insured endorsements explained and primary and noncontributory wording in contracts.

(10) Waiver of subrogation on all policies. On CGL and auto, a blanket waiver endorsement is normally inexpensive. On workers' compensation it carries a premium charge in most states, because the carrier gives up recovery against the customer if the customer's negligence injures your employee. A waiver on professional liability or cyber is unusual. Ask for the waiver to apply only to the CGL, auto, umbrella and comp, and only where the contract requires it. Details in waiver of subrogation: what it is and when contracts require it.

(11) Insurer rating. "A- VIII" is an AM Best rating of A- or better with a Financial Size Category of VIII or larger. Surplus lines carriers and smaller regional companies can fall short of the size class even when financially sound, so ask for "or as otherwise approved." See AM Best ratings explained for business buyers.

(12) Certificates and endorsements. A certificate of insurance proves a policy exists; it does not create coverage. Customers that demand "endorsements" want the actual forms, and your broker can provide them. Build a renewal calendar so the customer's compliance vendor is not chasing you. The Certificate of insurance (COI) review checklist covers what a certificate can and cannot show.

(13) Notice of cancellation. Since ACORD's 2009 revision, certificates no longer promise advance notice, and insurers will not guarantee notice to every certificate holder. Offer to give notice yourself, or ask your broker whether the carrier will issue a notice-of-cancellation endorsement for scheduled parties. Change "material change" to something measurable, or strike it.

(14) Deductibles and retentions. Paying your own deductible is fair. A cap on self-insured retentions matters more than it looks: if your E&O or cyber policy carries a high retention, the customer is betting on your balance sheet. Disclose your retentions rather than risk a breach.

(15) Insurance does not limit liability. This line pairs with the MSA's limitation of liability. If the MSA caps your liability at fees paid, but carves out "amounts covered by required insurance," the insurance limits effectively become the cap. That is often a reasonable trade for both sides; just make sure the carve-out reads "amounts actually paid by insurance," not the full limits regardless of coverage. Read it together with indemnification and hold harmless clauses and your insurance.

(16) Subcontractors. Flowing identical limits to a two-person subcontractor may be impossible. Propose limits appropriate to the subcontractor's scope, or agree that you remain responsible for the subcontractor's work under your own policies.

(17) Breach and self-help. A lapse can terminate the relationship, so put the renewal dates where someone sees them. A right to buy coverage and offset is uncommon in practice, but it means you would pay the customer's price for coverage you could have bought cheaper.

What to push back on, in priority order

1. Any requirement to name the customer as additional insured on professional liability, cyber or workers' compensation.
2. Limits that are out of scale for the work or for what your class of business can buy, especially umbrella and E&O.
3. Advance notice of cancellation from the insurer to the customer.
4. Waivers of subrogation on every policy, rather than on the liability lines and comp where the contract requires them.
5. Tail periods longer than the realistic claim window.
6. Rating floors without an "or as approved" escape.

Send the clause to your broker before you sign and ask two questions: which requirements does my current program already meet, and what does closing each gap cost? The contract insurance requirements checker lays the comparison out, and how to review the insurance requirements in a contract covers the general method. For how MSAs compare with construction contracts, leases and government work, see insurance requirements by contract type: a side-by-side guide. Contract terms with real money behind them deserve a lawyer's read as well.

Key takeaways

• An MSA's insurance clause applies to every future statement of work, so negotiate it once, up front.
• Additional insured and primary wording belong on CGL, auto and umbrella; professional liability and cyber policies generally do not provide them.
• Claims-made coverages (E&O, cyber) need continuity of the retroactive date or a tail to satisfy post-term requirements.
• Watch how the insurance clause interacts with the limitation of liability; a carve-out for insured amounts can make your limits the real cap.
• Certificates prove coverage exists; the endorsements and the policy terms are what the customer actually relies on.