What a $5M Cyber Insurance Contract Requirement Really Means
Your client’s agreement says “$5,000,000 cyber and Technology E&O.” Here’s how to read that clause, what your current policy needs to show, and your options if you carry less.
A new client sends over a master services agreement, and buried in the insurance section is a line like this: “Vendor shall maintain Cyber Liability and Technology Errors & Omissions insurance with limits of not less than $5,000,000 per claim and in the aggregate.” Your policy has a $2M limit, the deal is ready to sign, and the client wants a certificate by Friday.
A $5M requirement usually means your policy must be able to pay up to $5 million for a single claim and $5 million in total during the policy period, for the coverage types the contract names. The wording matters: whether the limit is per claim or aggregate, combined or separate for cyber and Tech E&O, and whether the contract adds requirements like additional insured status. If you carry less, the usual fixes are raising your primary limit, adding an excess layer, or negotiating the requirement.
Start by reading the whole insurance clause
The dollar amount gets the attention, but the surrounding words decide whether your current program qualifies. Before you call your broker, find these details in the contract:
- Which coverages: cyber liability, Technology E&O, media liability, or all three.
- How the limit is stated: per claim, aggregate, or both.
- Combined or separate: one $5M limit shared by cyber and Tech E&O, or $5M for each.
- Extra terms: additional insured, primary and non-contributory, waiver of subrogation, notice of cancellation, and how long coverage must continue after the contract ends.
- Insurer quality: many contracts require an insurer rating such as A.M. Best “A- VII” or better.
To find these details faster, paste the clause into our free Cyber Insurance Contract Checker. It pulls out the limits, endorsements, notice, and other terms, then compares them with the coverage you have now.
Common contract phrases, decoded
| Contract says | What it usually means | What to check |
|---|---|---|
| “$5M per claim and in the aggregate” | Up to $5M for one claim, and $5M total for all claims in the policy period. | Your declarations page shows both limits at $5M or more. |
| “$5M combined” | Cyber and Tech E&O together must total at least $5M. | A combined policy with a $5M shared limit may qualify. |
| “$5M each” or listed separately | Each coverage needs its own $5M. | A combined $5M policy with one shared aggregate may not qualify. |
| “Additional insured” | The client wants to be covered under your policy. | Many cyber and E&O policies limit or don’t offer this. It may need an endorsement or negotiation. |
| “Primary and non-contributory” | Your policy pays before the client’s own insurance. | Usually requires an endorsement. |
| “Waiver of subrogation” | Your insurer can’t pursue the client to recover a loss. | Available on some policies by endorsement. |
| “Maintain for 3 years after termination” | Coverage must continue for claims reported after the contract ends. | Keep renewing, or plan for an extended reporting period. |
| “30 days’ notice of cancellation” | The client must be told if your policy is canceled. | Your insurer or broker may need to agree to provide notice. |
The aggregate trap in combined policies
Many technology companies carry a combined cyber and Tech E&O policy, which is efficient and avoids gaps between the two coverages. But a combined policy often has one aggregate limit shared by everything it covers: breach response, ransomware, business interruption, and client claims.
If the contract asks for $5M of each coverage, a single $5M shared aggregate may not satisfy it, and a ransomware event early in the policy year could reduce what’s left for a client’s claim. Read the requirement carefully, and ask your broker whether the policy’s limits are shared, separate, or can be structured to match.
Sublimits don’t count toward the headline limit
A $5M policy can still carry smaller sublimits for specific coverages, such as ransomware, social engineering, or regulatory fines. Most contracts focus on liability limits, but some name specific coverages. If a contract requires $5M for something your policy sublimits at $1M, the certificate may look compliant while the coverage isn’t.
Your options if you carry less than $5M
1. Raise your primary limit
Your current insurer may offer a higher limit at renewal or mid-term. This is the simplest structure, but not every insurer will write $5M on its own for every risk.
2. Add an excess layer
An excess policy sits above your primary policy. For example, a $3M excess layer above a $2M primary policy creates $5M of total limit. Excess layers should “follow form,” meaning they track the primary policy’s terms. Our guide to high-limit and excess cyber insurance explains how towers fit together.
3. Negotiate the requirement
Insurance requirements are often boilerplate. Clients may accept a lower limit, a combined limit, or different wording, especially for smaller engagements. Requests the market can’t easily meet, such as additional insured status on a cyber policy, are often negotiated out or rewritten.
Timing: start before you sign
Increasing limits takes underwriting. Insurers typically want a current application, details about your security controls, and sometimes information about the client relationship. Excess insurers also review the primary policy. Give yourself at least two to four weeks when you can, and send the insurance clause to your broker before the contract is final, while there’s still room to negotiate.
What to send your broker
- The full insurance section of the contract, not just the limit
- Your current policy and declarations pages
- The contract’s deadline for proof of insurance
- The value of the contract and what services you’ll provide
- Any other client contracts with similar requirements
A certificate of insurance only summarizes your policy. It can’t add coverage the policy doesn’t have, so it’s worth confirming the policy itself matches the contract. Learn how we handle this on our contractual insurance requirements page.
Check where you stand
Cyber Insurance Contract Checker
Paste the contract’s insurance section. The checker marks each requirement Meets, Gap, or Verify, and runs in your browser, so your contract is never uploaded. About 3 minutes.
Check your contract →Coverage Mapper
Enter your current limit and the limit your contracts require. The map flags the difference. About 5 minutes.
Map your coverage →Get Quotes
Our application includes a section for contract requirements, so we can quote to the limit you need.
Start your application →Frequently asked questions
What does “per claim and in the aggregate” mean?
“Per claim” is the most the policy pays for one claim. “Aggregate” is the most it pays for all claims during the policy period. A requirement of $5M for both means your policy must show at least $5M for each.
Can my client be added as an additional insured on a cyber policy?
Sometimes. Some cyber and Tech E&O insurers offer additional insured endorsements, often limited to claims arising from your work. Others don’t. When it isn’t available, clients often accept alternative wording or remove the requirement.
Is a $5M excess policy the same as a $5M primary policy?
Together, a primary policy and an excess layer can provide the same total limit. The excess layer pays only after the primary limit is used up, and it should follow the primary policy’s terms so the coverage is consistent.
Can I negotiate a contract’s insurance requirements?
Often, yes. Requirements are frequently standard language. Raising questions before signing, with your broker’s input on what the market can provide, usually leads to terms you can meet.
Christine Marciano is the founder and president of Cyber Data Risk Managers LLC, an independent brokerage in Miami that has specialized in cyber and Technology E&O insurance since 2011. More about Christine
Have a contract requirement on your desk?
Send us the insurance clause. We’ll compare it to your policy and show you the fastest way to meet it.
Request a Contract Review Get QuotesThis article is general information, not a coverage determination or legal advice. Contract requirements and policy terms vary. Coverage depends on your policy’s wording, endorsements, exclusions, and limits, and is subject to insurer underwriting.