Insurance for MSPs and IT Service Providers: Cyber vs. Technology E&O
IT service providers face two kinds of risk: what happens to your own systems, and what happens to your clients because of your work. Here’s how cyber and Tech E&O cover each, and where the gaps usually are.
Managed service providers and IT firms hold the keys to their clients’ systems. That access is what makes you valuable, and it’s also why insurers look at your business differently than at almost any other. One incident can reach dozens of clients at once, and one routine change can take a client offline.
Most MSPs and IT service providers need both cyber insurance and Technology E&O. Cyber insurance responds when your own systems or data are attacked. Technology E&O responds when a client claims your services, advice, or mistakes caused them a financial loss. Many insurers offer them together on one policy for IT firms, but the details, such as how “technology services” is defined and which exclusions apply, decide whether a claim is actually covered.
Which coverage responds? Common MSP scenarios
| What happens | Coverage that typically responds |
|---|---|
| Ransomware encrypts your own systems | Cyber: incident response, data restoration, extortion, and your lost income |
| An attacker uses your remote management tool to reach clients | Both: cyber for your own response, and Tech E&O or network security liability for client claims |
| A patch or configuration change you push takes a client offline | Technology E&O |
| A backup you manage fails and a client loses data | Technology E&O |
| A client sues after a breach of data you store or manage for them | Cyber privacy liability and/or Technology E&O, depending on the policy wording |
| Your staff are tricked into sending a payment to a fraudster | Cyber social engineering or a crime policy, often with a lower sublimit |
| Criminals impersonate your company to redirect a client’s invoice payment | Varies widely; look for invoice manipulation or impersonation coverage |
The pattern is simple: if the loss is yours, look to cyber. If the loss is your client’s and they blame you, look to Tech E&O. Many real incidents involve both, which is why coordinating the two matters as much as having them. For a broader comparison, see Cyber insurance vs. Technology E&O.
Why insurers underwrite MSPs differently
Insurers worry about aggregation: one compromised tool or credential affecting many clients at the same time. Several widely reported attacks have spread through IT providers’ remote management tools, and underwriters now ask detailed questions about how you protect that access. Expect questions like these:
- Is multi-factor authentication (MFA) required on your remote monitoring and management (RMM) and remote access tools?
- How are client administrator credentials stored, in a password vault or privileged access tool, or somewhere less secure?
- Is endpoint detection and response (EDR) deployed across your own environment and the clients you manage?
- How many clients and endpoints do you manage, and what services do you provide to them?
- Have you completed a SOC 2 or similar independent audit?
- Do your contracts limit your liability, and do you use written agreements with every client?
Clear, documented answers to these questions often matter more to price and terms than your revenue does.
Coverage features worth checking
A definition of “technology services” that fits what you do
Tech E&O only covers the services the policy describes. If you provide managed security, cloud administration, software development, or hardware resale alongside managed IT, confirm each one is included. An activity left out of the definition can be left out of coverage.
Security services treated the same as IT services
Some insurers limit or exclude coverage for cybersecurity services such as managed detection, penetration testing, or incident response. If you offer them, make sure they’re covered the same way as your core IT work.
Contractual liability
Many policies exclude liability you take on by contract, beyond what you’d owe anyway. Indemnities, service credits, and guarantees in your client agreements can fall into that gap. Check how the policy treats them before you sign a client contract with broad promises.
Dependent business interruption
If your RMM platform, cloud host, or another key vendor goes down, your business stops even though nothing happened to you directly. Dependent business interruption coverage addresses that lost income.
Funds transfer fraud and impersonation
Social engineering losses are often covered at a much lower limit than the rest of the policy. Check the sublimit, and whether the policy covers fraud where someone impersonates your company to your clients.
Retroactive date and continuity
Tech E&O is usually written on a claims-made basis. A retroactive date that goes back to when you started providing services protects you from claims about older work. Keep continuity when you change insurers.
Your contracts shape your insurance
Client agreements decide how much risk you carry and what insurance you need. Before renewing, review your master services agreement for:
- Limitation of liability: a cap tied to fees paid is common and important.
- Indemnification: promises that go beyond your own negligence can create uninsured exposure.
- Insurance requirements: required limits, additional insured status, and notice of cancellation. See contractual insurance requirements.
- Subcontractors: if others help deliver your services, require them to carry insurance and indemnify you.
One combined policy or two separate policies?
Many insurers write cyber and Technology E&O together for IT firms. A combined policy is simpler and avoids disputes between insurers about which policy should respond. The trade-off is that both coverages may share one aggregate limit, so a large claim on one side reduces what’s left for the other. Separate policies, or excess limits above a combined policy, can make sense as your client base and contract requirements grow. Our Technology E&O insurance page explains the options in more detail.
Get your coverage right
Coverage Mapper
Choose the services you provide and see which exposures they create and where you may have gaps. About 5 minutes.
Map your coverage →Cyber Insurance Application
One application for cyber and Tech E&O, with questions written for managed and IT service providers.
Start your application →Frequently asked questions
Does cyber insurance cover mistakes I make for clients?
Usually not on its own. Cyber insurance focuses on attacks, breaches, and your own losses. Claims that your services or mistakes caused a client’s financial loss are generally covered by Technology E&O. Many IT firms carry both, often on one combined policy.
Why do client contracts require Technology E&O?
Clients want to know that if your work causes them a loss, there’s insurance to pay the claim. Contracts often specify a minimum limit and sometimes cyber coverage as well. Review those requirements before you sign so your policy matches them.
How much coverage does an MSP need?
It depends on your largest client contracts, the number of clients and endpoints you manage, the data you can reach, and how your contracts limit liability. Your highest contractual requirement is a common starting point, with excess limits added as you grow.
Is software or hardware I resell covered?
It can be, but only if the policy’s definition of technology services or products includes resale. Physical products can also raise bodily injury and property damage questions that Tech E&O doesn’t address, so general and product liability matter too.
What do insurers check most closely for MSPs?
How you secure privileged access: MFA on remote management tools, secure storage of client credentials, EDR coverage, and your own incident response planning. Strong answers in these areas help with both eligibility and pricing.
Christine Marciano is the founder and president of Cyber Data Risk Managers LLC, an independent brokerage in Miami that has specialized in cyber and Technology E&O insurance since 2011. More about Christine
Run an MSP or IT services firm? Let’s review your coverage.
Send us your current policy and a sample client contract. We’ll show you where cyber and Tech E&O line up, and where they don’t.
Request a Coverage Review Get QuotesThis article is general information, not a coverage determination or legal advice. Coverage depends on the specific policy wording, and underwriting requirements vary by insurer. Coverage availability, terms, and pricing are subject to insurer underwriting and approval.