Who We Insure
Insurance for IT Support & Repair Services
An IT support company is the team a business calls when something breaks — a desktop that will not boot, a server that went down, a mailbox migration that has to happen this weekend, a network that needs tuning. To do that work the company reaches into client systems with administrative rights, often through remote-support tools, and it takes physical custody of the devices people leave for repair. The failure modes follow from that access: a repair that loses data, a migration that corrupts mailboxes, a support session or a compromised tool that becomes the path into a client's breach, or a project that never quite delivers what the statement of work promised.
Why it support & repair services carry specialized insurance
Insurance requirements arrive even without a full managed-services contract. Business clients ask for a certificate before letting a technician on site or into their systems; project statements of work specify deliverables, timelines, and performance that become the basis for a dispute; and larger clients and vendor-onboarding portals require technology errors-and-omissions and cyber limits with additional-insured status. Because break-fix and support firms hold privileged access, they increasingly face the same security questionnaires their larger managed-services cousins do. A OnePark Risk advisor builds an IT support program around a combined technology errors-and-omissions and cyber form — with the cyber side weighted toward third-party liability for incidents on client systems the company touched — and supports it with general liability, workers' compensation, and auto for the on-site work and crime coverage for the privileged access and device handling. The aim is a program that answers whether the client's loss came from a botched repair, a lost device, or an incident that traced back through the company's tooling.
The risk profile of an IT support company
IT support exposure centers on privileged access and hands-on device work: the company can be blamed when data is lost, when a device goes astray, or when a client breach traces back to a support session or a compromised tool. Key exposures: Data loss or corruption during repairs, migrations, and reimaging; A support session or remote-tool compromise that becomes the path to a client breach (third-party cyber); Project statement-of-work disputes — a migration or rollout that misses scope, timeline, or performance; Chain-of-custody and privacy exposure for client devices left for repair; Backup or restore failures discovered only when the client needs the data; On-site injury and property damage during desk-side and server-room work; Subcontracted or 1099 technicians delivering support under the company's name.
Technology E&O + Cyber (combined form) for it support & repair services
For an IT support company these are inseparable, and the cyber side is largely third-party: a support session or a compromised remote-support tool can become a client's breach, and a botched repair or migration is a professional-services failure the client blames on the company. A combined form puts one carrier behind both the company's own incident response and its liability for client losses, eliminating the seam that separate policies create. The downstream-liability wording — claims arising from incidents on client systems the company touched — deserves line-by-line review. Typically responds to: client claims for data loss, corrupted migrations, or repairs that made things worse; the company's own breach response: forensics, notification, and extortion negotiation; liability for security incidents that reach client systems through the company's access or tools; project deliverable disputes when a rollout misses scope or performance.
General Liability for it support & repair services
Technicians work on client premises, and the ordinary hazards of that work — a dropped monitor, damage to a server rack, an injury to someone who is not an employee — are classic general liability exposure. A general liability certificate, commonly $1 million per occurrence, is a routine requirement before a technician badges in to a client site. Typically responds to: property damage at client sites during desk-side and server-room work; bodily injury to non-employees around the company's work; damage to a client's existing equipment during a service visit.
Workers' Compensation for it support & repair services
On-site work means real injury exposure — lifting equipment, ladder work in server closets, and driving between client sites — and workers' compensation is legally required where the company employs anyone and routinely demanded in client contracts alongside general liability. It funds medical care and lost wages so those costs do not land on the company.
Hired & Non-Owned Auto for it support & repair services
Technicians driving personal or rented vehicles to client sites create liability a personal auto policy will not fully absorb. Hired and non-owned auto answers that gap; companies with owned service vehicles need full commercial auto instead.
Crime / Employee Dishonesty for it support & repair services
Technicians hold administrative credentials to client systems and take custody of client devices, a trust concentration clients now ask about in security questionnaires. Crime coverage responds to employee theft — including third-party-property endorsements for theft of client property — and to funds-transfer fraud where a cyber sublimit stops.
Employment Practices Liability (EPLI) for it support & repair services
Dispatch-driven scheduling, on-call rotations, and technician turnover generate wage-and-hour and termination disputes. EPLI funds the defense and any settlement so those claims stay off the operating budget.
Contract and certificate requirements
Even short of a managed-services agreement, IT support work brings steady certificate requests: general liability at $1 million per occurrence, technology errors-and-omissions and cyber commonly at $1 million to $5 million depending on the client, statutory workers' compensation, and additional-insured status with waiver of subrogation. Vendor-onboarding portals for larger clients add security questionnaires, minimum limits, and sometimes crime coverage requirements because the company holds privileged access, and project statements of work fix the deliverables and timelines against which a dispute will later be measured. The recurring trap is signing statements of work and indemnification terms that promise more than the program will fund — unlimited liability for data loss against a fixed cyber limit — while managing certificates for the company's own subcontractors. A OnePark Risk advisor reviews the insurance and indemnity provisions in client agreements against the actual policies, sets up certificate collection from any subcontracted technicians, and keeps limits and additional-insured wording aligned as clients and projects change.
What coverage costs
As of 2026, IT support pricing is driven by revenue, headcount, the scope of administrative access the company holds, the sensitivity of client industries, the mix of break-fix versus project work, subcontractor use, and — heavily — the company's own security controls. Carriers ask about multi-factor authentication on remote-support tools, endpoint protection, backup discipline, and how privileged access is managed, because those controls sit between a routine support session and a client-side incident. The severity math explains the scrutiny: the Sophos State of Ransomware 2025 report put average recovery costs at $1.53 million excluding any ransom payment, and an incident that reaches a client through the company's access or tooling can turn a single support relationship into a serious third-party claim. Well-documented controls move terms in the company's favor. Rather than quoting a single figure, a OnePark Risk advisor benchmarks the company across the carriers that actively write IT support and technology-services risk and shows how limits, deductibles, and the depth of client-system access move the premium so the tradeoffs are visible before renewal.
AI exposure note
IT support firms using AI-assisted troubleshooting, automated remediation scripts, or AI service-desk tools should confirm how their technology errors-and-omissions form treats work executed by automated systems on a client's environment. If an AI-driven action damages client data or systems, the company wants the claim analyzed as a covered professional-services failure rather than excluded as an unapproved automated process. Ask the question at placement.
Illustrative example: The migration that lost data
A company migrates a client's email to a new platform over a weekend, and on Monday the client discovers that a portion of one department's historical mail did not come across and cannot be recovered from the source. The client claims the lost records cost it time and a missed deadline. This is a technology errors-and-omissions claim — a professional-services failure with client financial loss. The combined form assigns defense counsel and funds settlement discussions reflecting the client's loss and the engagement's limitation-of-liability terms.
Illustrative example: The support tool as the vector
Attackers compromise a technician's remote-support session and use the company's access to move into a client's network, deploying ransomware before the intrusion is caught. The client suffers downtime and demands compensation, alleging the company's tooling was the entry point. The cyber side funds the company's own forensics and response and defends the client's claim that the company's access was the vector — the downstream-liability scenario the combined form exists for. The multi-factor and access-management record becomes central to the outcome.
Illustrative example: The device left for repair
A laptop a client dropped off for repair, holding sensitive files, goes missing from the company's workspace, and the investigation points to an employee. The client raises both the theft and the privacy exposure of the data on the device. Crime coverage with a third-party-property endorsement responds to the theft of the client's device, while the data-exposure concern is handled on the cyber side — the combination clients probe in their security questionnaires about how the company handles devices and access.
How much does insurance cost for an IT support company?
There is no flat rate. As of 2026, pricing is driven by revenue, headcount, the scope of administrative access the company holds, client-industry sensitivity, the mix of break-fix versus project work, subcontractor use, and security controls. Many IT support firms structure technology errors-and-omissions and cyber at $1 million to $5 million alongside general liability at $1 million per occurrence to satisfy client requirements; the right way to size premium is to benchmark the specific company across several carriers rather than rely on a single quoted number.
Why do we need both technology E&O and cyber coverage?
Because IT support incidents are usually both at once: a security event on a client system that becomes a service-failure claim against you, or a botched repair that also exposes data. Buying them on one combined form means one carrier, one retention, and no dispute about which policy owns a claim that straddles the line — and it keeps the downstream-liability wording consistent.
Are we liable if a client is breached through our access or tools?
You can be — the client's counsel will examine what access you held, what you were engaged to do, and whether the incident traced back through your tooling. Whether the claim succeeds depends on the facts and the contract, but defending it is expensive either way, and that defense is precisely what the technology errors-and-omissions and cyber form funds. Downstream-liability wording varies significantly between carriers.
What happens if we lose or corrupt a client's data during a repair?
That is a professional-services failure, and the technology errors-and-omissions side responds to the client's claim for the resulting loss — funding defense and any settlement reflecting the engagement's limitation-of-liability terms. Documenting backups and the client's sign-off before major work reduces both the likelihood and the severity of these claims.
What security controls do underwriters expect from an IT support firm?
Expect questions about multi-factor authentication on remote-support tools and privileged accounts, endpoint protection, tested backups, how administrative access to client systems is managed, and an incident-response plan. Because you hold privileged access, you are held to a higher standard than a generic business, and documented controls lead to better pricing and fewer exclusions.
Do subcontracted or 1099 technicians change our coverage needs?
Yes. Confirm your policies cover work performed by subcontractors on your behalf, collect certificates and additional-insured status from the subs themselves, and make sure your client agreements permit subcontracting. Gaps here surface only after an incident, when every carrier is looking for someone else to pay.
Can OnePark Risk review the insurance requirements in our client agreements?
Yes. We review the insurance exhibits, statements of work, and indemnification clauses in your client agreements against your actual policies and flag mismatches — limit floors, additional-insured wording, uncapped data-loss liability — before a client's vendor-onboarding team or counsel finds them for you.
Frequently asked questions
How much does insurance cost for an IT support company?
There is no flat rate. As of 2026, pricing is driven by revenue, headcount, the scope of administrative access the company holds, client-industry sensitivity, the mix of break-fix versus project work, subcontractor use, and security controls. Many IT support firms structure technology errors-and-omissions and cyber at $1 million to $5 million alongside general liability at $1 million per occurrence to satisfy client requirements; the right way to size premium is to benchmark the specific company across several carriers rather than rely on a single quoted number.
Why do we need both technology E&O and cyber coverage?
Because IT support incidents are usually both at once: a security event on a client system that becomes a service-failure claim against you, or a botched repair that also exposes data. Buying them on one combined form means one carrier, one retention, and no dispute about which policy owns a claim that straddles the line — and it keeps the downstream-liability wording consistent.
Are we liable if a client is breached through our access or tools?
You can be — the client's counsel will examine what access you held, what you were engaged to do, and whether the incident traced back through your tooling. Whether the claim succeeds depends on the facts and the contract, but defending it is expensive either way, and that defense is precisely what the technology errors-and-omissions and cyber form funds. Downstream-liability wording varies significantly between carriers.
What happens if we lose or corrupt a client's data during a repair?
That is a professional-services failure, and the technology errors-and-omissions side responds to the client's claim for the resulting loss — funding defense and any settlement reflecting the engagement's limitation-of-liability terms. Documenting backups and the client's sign-off before major work reduces both the likelihood and the severity of these claims.
What security controls do underwriters expect from an IT support firm?
Expect questions about multi-factor authentication on remote-support tools and privileged accounts, endpoint protection, tested backups, how administrative access to client systems is managed, and an incident-response plan. Because you hold privileged access, you are held to a higher standard than a generic business, and documented controls lead to better pricing and fewer exclusions.
Do subcontracted or 1099 technicians change our coverage needs?
Yes. Confirm your policies cover work performed by subcontractors on your behalf, collect certificates and additional-insured status from the subs themselves, and make sure your client agreements permit subcontracting. Gaps here surface only after an incident, when every carrier is looking for someone else to pay.
Can OnePark Risk review the insurance requirements in our client agreements?
Yes. We review the insurance exhibits, statements of work, and indemnification clauses in your client agreements against your actual policies and flag mismatches — limit floors, additional-insured wording, uncapped data-loss liability — before a client's vendor-onboarding team or counsel finds them for you.
This material is general educational information, not legal, tax, or insurance advice. Coverage availability, policy terms, and regulatory requirements vary by state, carrier, and applicant.