Agency Controls Qualified Coverage
Cyber and Tech E&O insurance, priced for companies that do security right
A specialty Cyber and Technology E&O program for companies whose SOC 2 and ISO 27001 audits are validated by Agency — backed by Tokio Marine Kiln at Lloyd's of London.
What is Agency Controls Qualified Coverage — and who qualifies?
Agency Controls Qualified Coverage is a specialty Cyber and Technology E&O insurance program from OnePark Risk, underwritten by Tokio Marine Kiln (TMK) at Lloyd's of London — the Lloyd's market is rated A+ (Superior) by AM Best. It is open only to startups and technology companies whose SOC 2 and/or ISO 27001 audits are validated by Agency. Because your security controls are independently verified, you qualify for combined Cyber Liability and Tech E&O limits, with pricing that reflects your verified controls.
Why cyber and Tech E&O coverage matters (as of 2026)
The global average cost of a data breach reached a record $4.99M in 2026, up 12% year over year (IBM Cost of a Data Breach Report 2026). Ransomware is among the most expensive cyber events: the median ransom payment ran about $1M in 2025, with average recovery costs of $1.53M on top of any ransom paid (Sophos State of Ransomware 2025). Large cyber claims keep climbing — frequency up 14% and severity up 17% in the first half of 2024 (Allianz Commercial, 2024). Typical startup premiums, as of 2026: about $2,900 a year for cyber liability and about $3,700 a year for Tech E&O / professional liability (Vouch, 2026).
How security controls affect pricing
Carriers price cyber and Tech E&O on the strength of your security controls. An independently validated SOC 2 or ISO 27001 program — the eligibility bar for this program — is the single biggest lever for preferred terms, because it gives the underwriter proof of the controls (MFA, EDR, backups, incident response) they would otherwise have to assume you lack.
Verified market access and program price anchor
OnePark Risk shops 17 cyber, 53 startup, 22 management-liability, 63 commercial, and 14 private-client carriers. Carrier selection depends on your industry, geography, loss history, coverage limits, and underwriting fit. A controls-validated cyber program through Tokio Marine Kiln at Lloyd's of London (the Lloyd's market is rated A+ (Superior) by AM Best), has an illustrative price anchor of approximately $2,500 per year for $1M of combined Cyber + Tech E&O coverage for eligible companies with SOC 2 or ISO 27001 validation. This figure is illustrative only and is not a quote or an offer of coverage; actual pricing requires underwriting and carrier approval, and coverage is subject to carrier availability, eligibility, terms, and conditions. Ratings source: Lloyd's market ratings.
Frequently asked questions
What is Agency Controls Qualified Coverage?
It is a specialty Cyber and Technology E&O insurance program placed by OnePark Risk and underwritten by Tokio Marine Kiln at Lloyd's of London. It is built exclusively for startups and technology companies whose SOC 2 and/or ISO 27001 audits are validated by Agency. Combined limits of $1M and $2M are available under current program terms, subject to underwriting and carrier approval.
Who qualifies for this program?
Startups and technology companies — SaaS, MSPs, IT consultancies, data and cloud platforms — whose SOC 2 and/or ISO 27001 audits have been validated by Agency. If you don't have an audit yet, you can start one with Agency and qualify when it's complete.
Does a SOC 2 or ISO 27001 audit actually lower my cyber insurance premium?
Security controls are the primary factor carriers use to price cyber and Tech E&O. An independently validated SOC 2 or ISO 27001 program gives the underwriter proof of the controls they would otherwise have to assume you lack, which is why validated companies generally earn preferred terms through this program.
What is the difference between cyber and Tech E&O?
Cyber Liability responds to security and privacy incidents — breaches, ransomware, data loss, regulatory action. Tech E&O responds when a customer says your product or service failed to perform — bugs, downtime, missed deliverables. Most technology companies need both, which is why this program combines them.
Do I need both cyber and Tech E&O?
For most technology companies, yes. A single incident often triggers both — for example, a ransomware attack that takes a customer offline. This program structures the two together so they coordinate without gaps.
What limits are available?
Under current program terms, $1M and $2M combined limits are available, subject to underwriting and carrier approval. The $1M limit typically suits early-stage and growing companies satisfying customer and contractual insurance requirements; the $2M limit fits companies with larger contracts, enterprise customers, or heightened data obligations.
Who is the insurance carrier?
Tokio Marine Kiln (TMK), a managing agent at Lloyd's of London. Policies written in the Lloyd's market are backed by the market's financial strength ratings: A+ (Superior) from AM Best and AA− from Standard & Poor's and Fitch.
I don't have a SOC 2 or ISO 27001 audit yet — can I still get covered?
Yes. OnePark Risk places cyber and Tech E&O for technology companies through multiple markets. To access this specific preferred program you'll need an audit validated by Agency, which you can begin and qualify for once complete.