Who We Insure

Insurance for Internet Service Providers

An internet service provider sells always-on access, and when it is gone, the harm is immediate and widespread: subscribers cannot work, businesses cannot transact, and the provider's phones light up all at once. The failure can start in the core — a bad configuration or an upstream problem — or out in the last-mile plant, where a downed aerial line, a cut in a conduit, or a botched customer install takes a neighborhood offline. That last mile is built and maintained by crews working from bucket trucks, on poles, and behind directional-boring rigs, which makes the ISP as much a construction operation as a network operator.

Why internet service providers carry specialized insurance

Insurance requirements arrive through the ISP's whole web of relationships. Business subscribers write uptime commitments and service credits into their agreements; municipal franchise and build arrangements, pole-attachment agreements, and right-of-way permits carry their own insurance and indemnity terms; property owners require certificates before crews can wire a multi-dwelling building; and prime contractors on network builds flow down limit floors and additional-insured status. The ISP is also a data custodian, holding subscriber records, usage data, and billing information that carry breach consequences of their own. A OnePark Risk advisor structures an ISP program around the two halves of the business at once: the outage and service-failure exposure that belongs on the technology errors-and-omissions side, and the heavy field exposure — bodily injury, property damage, and vehicles — that belongs on general liability, workers' compensation, and auto. Cyber answers for the subscriber data and for any customer network equipment the ISP manages.

The risk profile of an internet service provider

ISP exposure combines network blast radius with the hazards of a construction trade: one plant failure or configuration error takes a service area offline, and the crews who build and repair that plant work aloft and underground every day. Key exposures: Widespread outages from plant damage, upstream failures, or bad configuration changes; Business-subscriber SLA and business-interruption claims after downtime; Aerial bucket-truck, pole, and directional-boring injuries to field crews; Utility strikes and property damage during trenching, boring, and drop installs; Customer-premises installation damage — walls, roofs, existing wiring, and fixtures; Breach or misuse of subscriber data, usage records, and billing information; Subcontracted construction and install crews working under the ISP's contracts.

Technology E&O + Cyber (combined form) for internet service providers

An ISP's service failure and its data exposure often meet in the same event: an outage a business subscriber says breached the SLA, or a compromise of managed customer equipment that becomes the subscriber's breach. A combined form puts one carrier behind the service-failure liability and the ISP's own incident response, with the outage and service-interruption wording — how network downtime is treated — reviewed line by line. Typically responds to: business-subscriber claims for financial loss from outages and provisioning errors; the ISP's own breach response: forensics, notification, extortion negotiation; liability tied to subscriber data, usage records, and billing information; liability for security incidents on managed customer network equipment.

General Liability for internet service providers

The last-mile plant is built in the physical world, and its hazards are classic general liability territory — a bucket truck that strikes a building, a bore that severs a utility line, a drop install that damages a customer's roof or wiring, a passerby hurt near an open trench. A general liability certificate, commonly $1 million per occurrence, is a routine requirement in pole-attachment, right-of-way, and building-access agreements before crews mobilize. Typically responds to: third-party property damage during construction, boring, and drop installs; utility strikes and the resulting repair and business-interruption demands; customer-premises damage during installation — walls, roofs, and existing wiring.

Workers' Compensation for internet service providers

Working from bucket trucks, on poles, and around boring equipment is genuinely dangerous, and workers' compensation is both legally required where the ISP employs anyone and universally demanded in build and access contracts. It funds medical care and lost wages for an injured technician so those costs do not land on the operating budget.

Hired & Non-Owned Auto for internet service providers

Technicians and contractors driving between installs and repairs create liability a personal auto policy will not fully absorb. Hired and non-owned auto answers that gap; ISPs running owned service fleets and bucket trucks need full commercial auto instead, and the two are typically placed together.

Crime / Employee Dishonesty for internet service providers

Staff hold access to provisioning platforms, subscriber accounts, and billing systems, which concentrates insider and social-engineering risk. Crime coverage responds to employee theft and, with the right endorsements, to funds-transfer fraud where a cyber sublimit stops.

Employment Practices Liability (EPLI) for internet service providers

A dispatched field workforce with on-call rotations and route-based scheduling generates wage-and-hour, overtime, and termination disputes. EPLI funds the defense and any settlement so those claims stay off the operating line.

Contract and certificate requirements

ISP agreements and permits settle into a recognizable insurance exhibit: general liability at $1 million per occurrence, technology errors-and-omissions and cyber commonly at $1 million to $5 million for business-subscriber and enterprise contracts, statutory workers' compensation, commercial auto where owned vehicles are used, and additional-insured status with waiver of subrogation. Municipal franchise and build arrangements, pole-attachment agreements, and right-of-way permits each carry their own insurance and indemnity terms, and prime contractors flow down higher requirements on network builds. The recurring trap is committing to service credits and indemnification that outrun the program — uncapped downtime liability against a fixed cyber limit — while certificate requests arrive continuously from property owners, municipalities, and prime contractors. A OnePark Risk advisor reviews the SLA credit schedules and indemnity clauses against the actual policies and keeps certificate issuance aligned with real coverage as agreements and permits renew.

What coverage costs

As of 2026, ISP pricing is driven by revenue, the balance of network operation versus field construction, subscriber count and the share of business versus residential customers, the volume of aerial and underground work, subcontractor use, and both safety and cyber controls. Carriers weigh the field-hazard side — safety programs, fleet management, and locate-before-you-dig discipline — as closely as the network side. On the service-failure and data side, underwriters focus on change management, network monitoring, and how subscriber data is protected, because one configuration error reaches an entire service area and a subscriber-data breach carries notification and liability consequences. The Sophos State of Ransomware 2025 report put average recovery costs at $1.53 million excluding any ransom — a reminder that an operational compromise, not only a data breach, can drive severe cost for a network operator. Rather than quoting a single figure, a OnePark Risk advisor benchmarks the ISP across the carriers that actively write this class and shows how limits, deductibles, safety controls, and the split between construction and operations move the premium — appetite varies widely, so the comparison is where the value is.

AI exposure note

ISPs using AI-driven traffic management and automated network remediation should confirm how their technology errors-and-omissions form treats an outage caused by an automated action. If an automated change propagates a fault across a service area, the ISP wants the subscriber claims analyzed as a covered service failure rather than excluded as an unapproved automated process. Confirm the treatment at placement.

Illustrative example: The neighborhood outage

A contractor working near an ISP's aerial plant snaps a fiber run, taking a service area offline during business hours. Several business subscribers cannot process transactions; two invoke the service-credit schedule and one demands compensation for lost revenue. The combined technology errors-and-omissions and cyber form defends the subscriber claims that the outage breached the SLA and examines the service-interruption wording for the business-interruption demands, while any recovery from the responsible contractor is pursued separately.

Illustrative example: The drop-install damage

During a residential fiber install, a technician drilling a wall penetration hits a concealed water line, and the resulting leak damages the customer's finished basement over the following day. General liability responds to the property damage at the customer's premises, funds the repair and any defense, and resolves the claim — and the coverage is why the ISP could offer the professionally installed drop in the first place.

Illustrative example: The boring strike

A directional-boring crew placing new conduit severs an unmarked gas line, forcing an evacuation and halting nearby businesses for the afternoon. General liability responds to the third-party property damage and the resulting business-interruption demands and coordinates with the utility over the repair; the locate records and the subcontractor certificates, if a sub performed the bore, shape how responsibility is allocated.

How much does insurance cost for an internet service provider?

There is no flat rate. As of 2026, pricing is driven by revenue, the balance of network operation versus field construction, subscriber count and the residential-versus-business mix, the volume of aerial and underground work, subcontractor use, and both safety and cyber controls. Many ISPs structure technology errors-and-omissions and cyber at $1 million to $5 million alongside general liability at $1 million per occurrence; the right way to size premium is to benchmark the specific ISP across several carriers rather than rely on a single quoted number.

Does insurance cover subscriber losses during an outage?

The service-failure side of a technology errors-and-omissions and cyber form responds when a business subscriber claims an outage breached the SLA and caused financial loss, funding defense and settlement. How the form treats network downtime and business interruption varies significantly between carriers, so that wording is the first thing to review — and service credits should never promise more than the program can fund.

What insurance do our build agreements and permits require?

Expect general liability (commonly $1 million per occurrence), technology errors-and-omissions and cyber ($1 million to $5 million for business and enterprise contracts), statutory workers' compensation, commercial auto where owned vehicles are used, and additional-insured status with waiver of subrogation. Municipal franchise arrangements, pole-attachment agreements, and right-of-way permits add their own terms, and prime contractors flow down higher requirements on builds.

How is our field-crew and installation exposure covered?

Workers' compensation funds medical care and lost wages for injured employees and is legally required where you employ anyone. General liability responds to property damage and injuries affecting non-employees — including damage during customer-premises installs — and commercial or hired and non-owned auto answers vehicle exposure. Carriers weigh your safety program closely because bucket-truck, pole, and boring work is hazardous.

Are we responsible for subscriber data if we are breached?

You hold subscriber records, usage data, and billing information, and a breach carries notification and liability consequences. The cyber side of your program funds the response and answers third-party claims; underwriters will ask about access controls, monitoring, and how that data is protected before they quote.

Do subcontracted construction crews change our coverage needs?

Yes. Confirm your policies contemplate work performed by subcontractors on your behalf, collect certificates and additional-insured status from the subs themselves, and make sure your agreements permit subcontracting. Gaps here surface only after an incident, when every carrier is looking for someone else to pay.

Can OnePark Risk review our subscriber and build agreements?

Yes. We review the insurance exhibits, service-credit schedules, and indemnification clauses in your subscriber, franchise, and build agreements against your actual policies and flag mismatches — limit floors, additional-insured wording, uncapped downtime liability — before a municipality, property owner, or prime contractor finds them for you.

Frequently asked questions