IT consultant and MSP insurance: coverage, requirements and costs

An IT consultant or managed service provider (MSP) needs technology errors and omissions (tech E&O) first, because the typical lawsuit says your work did not do what the contract promised. Cyber liability comes second and is not optional for an MSP that holds administrator access to client networks. General liability, crime cover and workers' comp complete the program. Your trade sits in NAICS 541512 (computer systems design), 541511 (custom programming), 541513 (facilities management), 541519 (other computer related services) and 518210 (computing infrastructure, data processing and hosting). The insurance problem is leverage: one technician's mistake, or one compromised management console, can reach dozens of client networks at once.

Why IT consultants and MSPs need business insurance

You are paid for a result the client cannot see failing. A migration that drops files, a backup that was never tested, a firewall rule left open: the loss shows up weeks later and the client sues for its lost revenue, not for your invoice. A general liability policy responds to bodily injury and property damage, and standard forms generally treat data as intangible, so these losses fall to tech E&O. Travelers' page for IT businesses describes the exposure as customer claims over mistakes, negligence or products that do not perform as promised.

Your tools are an attack path. An MSP's remote-monitoring and management software, password vault and admin accounts reach every client. When an attacker takes them, the claims come from many clients at once, and the question becomes whether your tech E&O or your cyber policy responds, and whether either has a sublimit or aggregate shared across clients.

Outages cascade. Estimates of insured losses from the July 2024 CrowdStrike software update outage ranged from $400 million to $1.5 billion (CyberCube estimate), which shows how a single faulty change reaches a whole customer base. Your exposure is smaller, but the pattern is the same: one change, many claimants.

Core coverages

• Technology E&O. Pays defense and damages for financial loss to clients from your services or products. Check four things: whether breach-of-contract claims are covered or only negligence, whether delay and failure to deliver are excluded, whether your contractual liability and warranties are carved out, and whether the policy has an intellectual property exclusion. Chubb's DigiTech ERM page, for example, says the form has no exclusions for delays or failure to deliver and offers software copyright infringement coverage, which shows how much forms differ. See Technology E&O insurance for software, SaaS and IT firms.
• Cyber liability. First-party cover (incident response, data recovery, business interruption, ransomware extortion) plus third-party liability for privacy and network security claims. For an MSP the key question is whether a breach of a client's data via your credentials is a covered third-party claim. See cyber insurance: what it covers for a business and Cyber insurance vs tech E&O: which policy pays when. Some carriers combine the two on one form, which closes the gap where each policy points to the other; Chubb's DigiTech ERM and Travelers' CyberRisk Tech are published examples.
• Crime and social engineering. Covers funds stolen by employees or by fraud. For an MSP also ask for coverage when a technician's account is used to move client money. See social engineering fraud: cyber policy or crime policy?.
• General liability. Visitors at your office, damage to a client's equipment when your tech is on site, and advertising injury. Commercial property and equipment cover your own servers and lab.
• Workers' compensation and employment practices. Required once you have employees. Field technicians can claim for lifting and falls on site visits. See employment practices liability.
• Hired and non-owned auto. Technicians driving personal vehicles to client sites; see Hired and non-owned auto (HNOA) coverage: what it covers and who needs it.

Coverage you may be required to carry

No state requires tech E&O. The requirement is contractual, and IT services agreements are among the heaviest on insurance. Expect clients to ask for tech E&O and cyber in the $1 million to $5 million range (higher for regulated or enterprise clients), CGL at $1 million per occurrence / $2 million aggregate, umbrella, crime, and workers' comp with a waiver of subrogation. They will usually want to be named as additional insured on the GL, 30 days' notice of cancellation, and the E&O and cyber kept in force for a period after the engagement. Government and healthcare clients add their own terms: a covered entity under HIPAA will require a business associate agreement, and its insurance schedule often requires cyber with regulatory coverage. Match the contract's limit-of-liability clause to your policy: if the contract caps your liability at fees paid but the insurance schedule requires $5 million, you are paying for limits the contract says you will not owe. Review with contract insurance requirements checker; see how to review the insurance requirements in a contract. State workers' comp rules apply per workers' comp requirements by state: who must carry it.

Common claims and how to prevent them

• Failed projects. Write a statement of work with scope, acceptance criteria and change orders. Keep the client's written sign-off at each milestone.
• Backup and restore failures. Test restores on a schedule and keep one copy offline or immutable. Put the test log in the file.
• Credential compromise. Multi-factor authentication on every management tool, unique admin accounts per client, and revocation the day a technician leaves. See MFA, EDR and backups: the controls cyber insurers now require.
• Misconfiguration. Change management, peer review of firewall and identity changes, and a rollback plan.
• Overpromising security. Do not say "fully secure" or "guaranteed compliant." Insurers read marketing pages and proposals as well as contracts.
• IP disputes. Track open-source licenses and have clear ownership of work product.
• Contract terms. Cap liability, exclude consequential damages and state the standard of care. Insurers ask whether you do this, and a signed unlimited indemnity is often uninsured.

What drives the cost

• Tech E&O and cyber: annual revenue, split by service line, is the usual exposure base. Underwriters price by what you do (consulting versus managed services versus custom development), number of clients and their industries, largest contracts, and contract terms such as limitation of liability.
• For MSPs: endpoint count, whether you hold privileged access to clients, and your own security controls (multi-factor authentication, EDR, backups, segmentation).
• Claims-made structure: the retroactive date and prior claims. Moving carriers without prior acts coverage can leave old work uninsured; see prior acts coverage and retroactive dates.
• General liability and property: revenue and building values. Workers' comp: payroll by class code, with a low professional class for office staff and higher classes for field technicians who install cabling or equipment.
• Underwriting questions: the application typically asks about security controls, subcontracted work, and any customers in healthcare, financial services or critical infrastructure.

Specialized coverages to consider

• Umbrella for client-required limits.
• Contingent business interruption if you depend on a cloud provider. See cyber business interruption and dependent system failure.
• Directors and officers for MSPs with investors or those preparing for a sale.
• Tail coverage if you sell the business or close; see tail coverage and extended reporting periods.

How to buy

Solo consultants and small IT firms can buy tech E&O and cyber online from carriers with technology pages, including Travelers and Chubb as published. MSPs with more than a handful of clients usually benefit from a broker who places technology accounts and can compare combined E&O and cyber forms and sublimits. Have ready: revenue by service line, client list and industries, sample contracts including limitation-of-liability clauses, a security controls summary, and five years of loss runs. Complete a cyber insurance readiness checklist before applying. See how to prepare an insurance submission underwriters will read.

Key takeaways

• Tech E&O is the core policy; cyber is a second core policy for MSPs.
• Read whether breach-of-contract claims, delays and data losses are covered or excluded.
• A compromised management console can create claims from many clients at once, so check aggregate and sublimit wording.
• Contracts set the required limits, so align the insurance schedule with the contract's liability cap.
• Keep proof of MFA, backups and tested restores; underwriters ask for it.