Who We Insure
Insurance for Managed Service Providers (MSPs)
MSPs hold the keys to other people's kingdoms: remote-access tools, privileged credentials, backup systems, and patching pipelines for dozens or hundreds of client environments at once. That concentration is the business model — and it is exactly why attackers target MSPs, why client contracts keep tightening, and why insurance underwriters treat MSPs as their own risk class.
Why managed service providers (msps) carry specialized insurance
When something breaks — a botched migration, a missed patch that preceded a client breach, an RMM compromise that spreads downstream — the client's first call is to their lawyer and their second is to your certificate of insurance. Master service agreements increasingly specify Tech E&O and cyber limits, name the client as additional insured, and require notice provisions your policies must actually support. A OnePark Risk advisor builds MSP programs around the downstream question: if a client environment you touch suffers a loss, which policy responds, at what limit, and with which exclusions? Getting that answer right before an incident is the entire game.
The risk profile of a managed service provider
MSP exposure is inherently multiplied: one operational failure or one compromised tool can generate simultaneous claims from many clients, each with their own damages, contracts, and lawyers. Key exposures: Supply-chain attack through RMM, remote-access, or patching tools that spreads to client environments; Client claims that your work — or missed work — contributed to their breach or downtime; Backup and recovery failures discovered only when the client needs the restore; Contractual liability: indemnification clauses and SLA penalties in MSAs; Field-technician injuries and auto exposure from client-site visits; Insider misuse of privileged access across client systems.
Technology E&O + Cyber (combined form) for managed service providers (msps)
For an MSP these are inseparable: a security incident in your stack becomes a professional-services claim from every affected client. A combined form puts one carrier behind both — your own breach response and your liability for client losses — eliminating the coverage seam that separate policies create. Downstream-liability terms (claims arising from client-environment incidents) deserve line-by-line review. Typically responds to: client claims for financial loss from service failures, missed patches, or bad configurations; your own breach response: forensics, notification, extortion; liability for security incidents that propagate to client environments; contingent business-interruption terms on stronger forms.
General Liability for managed service providers (msps)
Technicians working on client premises create classic GL exposure: property damage during an install, a dropped server, an injury involving a non-employee. Nearly every MSA requires a GL certificate — commonly $1 million per occurrence — before your team badges in.
Workers' Compensation for managed service providers (msps)
Field work means real injury exposure — lifting equipment, ladder work in server closets, driving between sites. Workers' comp is legally required in the states where you employ anyone and is universally demanded in client contracts alongside GL.
Hired & Non-Owned Auto (HNOA) for managed service providers (msps)
Technicians driving personal vehicles to client sites put the company on the hook for accidents that personal auto policies won't fully absorb. HNOA fills that gap; MSPs with owned vehicles need full commercial auto instead.
Crime / Employee Dishonesty for managed service providers (msps)
Privileged access cuts both ways: an employee with domain-admin rights across client environments is a trust concentration clients increasingly ask about. Crime coverage — including third-party-property endorsements covering theft of client property — answers the question in MSA security questionnaires.
Employment Practices Liability (EPLI) for managed service providers (msps)
Dispatch-driven scheduling, on-call rotations, and technician turnover generate wage-and-hour and termination disputes. EPLI keeps those claims from landing on the operating budget.
Contract and certificate requirements
MSP master service agreements have converged on a familiar insurance exhibit: general liability at $1 million per occurrence, Tech E&O and cyber at $1–5 million depending on client size, workers' compensation at statutory limits, and additional-insured status with waiver of subrogation for the client. Larger and regulated clients push limits higher and add requirements like crime coverage with third-party endorsements. The trap is signing MSAs whose indemnification and liability provisions exceed what your policies will actually fund — unlimited indemnity for data breaches against a $1 million cyber limit, for example. A OnePark Risk advisor reviews the insurance and indemnity sections together so what you promise and what you carry stay aligned as contracts renew.
What coverage costs
MSP pricing is driven by revenue, client count and concentration, the sensitivity of client industries (healthcare and financial clients raise the bar), your tooling stack, and — heavily — your own security controls. Carriers underwriting MSPs ask about MFA on all remote access, RMM hardening, privileged-access management, and tested backups, because those controls sit between one compromise and a portfolio-wide event. The severity math explains the scrutiny: the Sophos State of Ransomware 2025 report put average recovery costs at $1.53 million excluding any ransom payment, and an MSP incident can multiply that exposure across affected clients. IBM's Cost of a Data Breach Report 2026 put the global average breach cost at $4.99 million. As of 2026, smaller MSPs commonly carry $1–2 million combined Tech E&O/cyber limits and scale toward $5 million as client requirements accumulate. An advisor benchmarks across the carriers that actively want MSP business — appetite varies more in this class than most.
AI exposure note
MSPs deploying AI tooling — automated remediation, AI-assisted service desks, scripts generated by coding assistants — should confirm how their Tech E&O form treats work product produced or executed by automated systems. If an AI-driven action damages a client environment, you want the claim analyzed as a covered professional-services failure, not excluded as an unapproved automated process. Ask the question at placement.
Illustrative example: The compromised remote-access tool
Attackers exploit a vulnerability in an MSP's remote-monitoring platform and push ransomware to a subset of client endpoints through the MSP's own deployment mechanism. Four clients suffer downtime; two demand compensation and one terminates its contract. The combined Tech E&O/cyber form funds the MSP's own incident response and defends the client claims alleging the MSP's platform was the vector — the downstream-liability scenario this policy structure exists for. Contingent terms are examined for the clients' business-interruption demands.
Illustrative example: The backup that wasn't
A client suffers a server failure and calls for a restore. The MSP discovers the client's backup job had been silently failing for months after a storage migration. The client reconstructs data at significant cost and claims the MSP's monitoring should have caught the failures. This is a pure Technology E&O claim — a professional-services failure with client financial loss. The policy assigns defense counsel and funds settlement discussions reflecting the reconstruction costs and the contract's limitation-of-liability terms.
Illustrative example: The server-room injury
During an after-hours rack installation at a client site, a technician loses balance on a ladder; the falling equipment injures the client's facilities employee working alongside. Workers' compensation covers the technician's injury. The client employee's claim lands on the MSP's general liability policy, which funds medical damages and defense — and the certificate showing both coverages is why the MSA allowed the MSP on-site to begin with.
How much does insurance cost for a managed service provider?
There is no flat rate. As of 2026, pricing is driven by the client mix (regulated industries price higher), the scope of administrative access the MSP holds, revenue, headcount, security controls, and the limits client MSAs require. Many small MSPs structure Tech E&O and cyber at $1 million to $5 million to satisfy contract exhibits; the right way to size premium is to benchmark the specific firm across several carriers rather than rely on a single quoted number.
What insurance do clients require from an MSP?
The standard MSA exhibit asks for general liability ($1 million per occurrence is typical), Technology E&O and cyber (commonly $1–5 million depending on client size), statutory workers' compensation, and often additional-insured status. Regulated clients — healthcare, finance — frequently push higher and add crime coverage requirements.
Why do MSPs need both Tech E&O and cyber coverage?
Because MSP incidents are usually both at once: a security event (cyber) that becomes a client service failure (E&O). Buying them on one combined form means one carrier, one retention, and no dispute about which policy owns a claim that straddles the line.
Are we liable if a client gets breached through something we manage?
You can be — clients' lawyers will examine what you were contracted to do and whether you did it. Whether their claim succeeds depends on facts and contracts, but defending it is expensive either way, and that defense is precisely what the Tech E&O policy funds. Downstream-liability wording varies significantly between carriers.
Does our cyber policy cover our clients' losses, or just ours?
The first-party side covers your own response costs; your clients' losses come through the liability side when they claim against you. Their own direct losses are ultimately their own policies' problem — which is why well-run MSPs also encourage clients to carry their own cyber coverage rather than treating the MSP's policy as shared protection.
What security controls do underwriters expect from MSPs?
MFA on all remote access and privileged accounts, hardened and monitored RMM tooling, privileged-access management, EDR across managed endpoints, tested and segmented backups, and an incident-response plan. MSPs are held to a higher standard than generic businesses because their compromise multiplies.
Do subcontracted technicians change our coverage needs?
Yes. Confirm your policies cover work performed by subcontractors on your behalf, collect certificates and additional-insured status from the subs themselves, and make sure client MSAs permit subcontracting at all. Gaps here surface only after an incident, when everyone's carrier is looking for someone else to pay.
Can OnePark Risk review the insurance requirements in our MSAs?
Yes. We review the insurance exhibits and indemnification clauses in your client agreements against your actual policies and flag mismatches — limits, additional-insured wording, notice obligations — before a client's counsel finds them for you.
Frequently asked questions
How much does insurance cost for a managed service provider?
There is no flat rate. As of 2026, pricing is driven by the client mix (regulated industries price higher), the scope of administrative access the MSP holds, revenue, headcount, security controls, and the limits client MSAs require. Many small MSPs structure Tech E&O and cyber at $1 million to $5 million to satisfy contract exhibits; the right way to size premium is to benchmark the specific firm across several carriers rather than rely on a single quoted number.
What insurance do clients require from an MSP?
The standard MSA exhibit asks for general liability ($1 million per occurrence is typical), Technology E&O and cyber (commonly $1–5 million depending on client size), statutory workers' compensation, and often additional-insured status. Regulated clients — healthcare, finance — frequently push higher and add crime coverage requirements.
Why do MSPs need both Tech E&O and cyber coverage?
Because MSP incidents are usually both at once: a security event (cyber) that becomes a client service failure (E&O). Buying them on one combined form means one carrier, one retention, and no dispute about which policy owns a claim that straddles the line.
Are we liable if a client gets breached through something we manage?
You can be — clients' lawyers will examine what you were contracted to do and whether you did it. Whether their claim succeeds depends on facts and contracts, but defending it is expensive either way, and that defense is precisely what the Tech E&O policy funds. Downstream-liability wording varies significantly between carriers.
Does our cyber policy cover our clients' losses, or just ours?
The first-party side covers your own response costs; your clients' losses come through the liability side when they claim against you. Their own direct losses are ultimately their own policies' problem — which is why well-run MSPs also encourage clients to carry their own cyber coverage rather than treating the MSP's policy as shared protection.
What security controls do underwriters expect from MSPs?
MFA on all remote access and privileged accounts, hardened and monitored RMM tooling, privileged-access management, EDR across managed endpoints, tested and segmented backups, and an incident-response plan. MSPs are held to a higher standard than generic businesses because their compromise multiplies.
Do subcontracted technicians change our coverage needs?
Yes. Confirm your policies cover work performed by subcontractors on your behalf, collect certificates and additional-insured status from the subs themselves, and make sure client MSAs permit subcontracting at all. Gaps here surface only after an incident, when everyone's carrier is looking for someone else to pay.
Can OnePark Risk review the insurance requirements in our MSAs?
Yes. We review the insurance exhibits and indemnification clauses in your client agreements against your actual policies and flag mismatches — limits, additional-insured wording, notice obligations — before a client's counsel finds them for you.
This material is general educational information, not legal, tax, or insurance advice. Coverage availability, policy terms, and regulatory requirements vary by state, carrier, and applicant.