After you buy a managed service provider (MSP), check first that your policies cover both a mistake in your services and a breach of client systems that starts through your own remote access tools. For most MSPs that means technology errors and omissions plus cyber, often in one combined policy, with limits sized to your largest client contracts and to one attack hitting many clients at once. This checklist is for searchers, Small Business Administration (SBA) loan buyers and holding companies that just closed on a managed IT, managed security or IT support business.
The short answer
- Technology errors and omissions covers claims that your service failed or your advice was wrong. Cyber covers breaches, ransomware and data loss. MSPs usually need both.
- The worst case is one attack through your remote monitoring and management (RMM) tool reaching many clients. Check how the policy groups those claims and whether the aggregate limit (the most the policy pays for all claims in a policy year) can absorb them.
- Your master services agreements decide how much of a client's loss lands on you. Read the liability caps, indemnities and required insurance limits.
- Scams hit MSPs twice: someone can trick your staff into sending money, and attackers can pose as clients to fool your help desk. Both are called social engineering, and they need different coverage checks.
- If you subcontract the help desk or after-hours monitoring, you can still be liable for their mistakes. Check their insurance and your contract with them.
Which policies does an MSP actually need?
An MSP's biggest risks are financial, not physical: a client's systems go down, data is lost or stolen, or an attacker gets in through a tool you manage. General liability, the policy most owners think of first, excludes damage to electronic data in the standard form, and policies for tech firms usually add a professional services exclusion, so it does little for those claims. The table shows the core program and the gap each policy commonly leaves.
| Policy | What it does for an MSP | Common gap to check |
|---|---|---|
| Technology errors and omissions | Client claims that your service, configuration or advice caused financial loss | Services description, claims-made dates, contract liability exclusion |
| Cyber, third-party (network security and privacy liability) | Claims that a breach of your systems harmed clients or exposed data | How related claims are grouped, aggregate limit |
| Cyber, first-party | Your own breach response, ransomware, data restoration and lost income | Ransomware terms, outages that start at a vendor you rely on |
| Commercial crime with social engineering | Theft of your money, including staff tricked into wiring funds | Social engineering sublimit (a smaller cap inside the main limit) and verification conditions |
| General liability | Injury or property damage during visits to client sites | Electronic data and professional services exclusions |
| Property and inland marine | Hardware inventory, loaner equipment and gear at client sites | Property away from your premises, valuation |
| Workers' comp and employment practices | Employee injuries and employment claims | Payroll by class, use of contractors |
A commercial umbrella usually does not sit over tech errors and omissions or cyber, so those limits must stand on their own. For the difference between the two main policies, see professional liability vs cyber liability, and for the sector overview see insurance for IT and technology services.
What happens if a breach spreads to clients through your tools?
This is one of the scenarios MSP underwriters focus on most. Your remote monitoring and management platform, backup console and admin accounts reach into every client network. If an attacker gets those credentials, one event can become dozens of client claims. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned specifically that attackers target MSPs to reach their customers.
Read how the inherited policy handles this. Many policies treat claims from the same event as one related claim. That can help with the deductible, but it also means every client shares one per-claim limit (the most the policy pays for a single claim), and defense costs often reduce that limit. Check the aggregate, any sublimit for widespread or systemic events, and whether the policy excludes failures of infrastructure you do not control.
A hypothetical example. A buyer acquires an MSP with 60 clients and a combined tech errors and omissions and cyber policy with a $1 million limit per claim and a $2 million aggregate. Five months after closing, an attacker uses a stolen technician login to push ransomware through the management tool to 12 clients. Their recovery costs and lost income add up to $3 million, and they look to the MSP. The policy treats the 12 claims as one related claim, so a single $1 million per-claim limit, reduced by defense costs, is shared across all 12, and the other $1 million of aggregate never comes into play. Contract liability caps may reduce some claims if they hold up. The lesson for your financial model: size limits to a correlated event, not an average claim, and treat controls such as multifactor authentication (MFA) on every admin tool as both a security and an insurance item.
For how carriers price those controls, see cyber controls that can lower your premium.
Do your client contracts cap your liability?
Often, but not always in the way you hope. Master services agreements set the terms that decide how much of a client's loss becomes yours. Insurance and contracts have to work together, because many tech errors and omissions and cyber policies exclude liability you took on by contract beyond what you would owe anyway.
| Contract term | Why it matters | What to check |
|---|---|---|
| Limitation of liability | Often caps damages at a period of fees, but carve-outs are common | Carve-outs for data breach, confidentiality, gross negligence; enforceability under the governing law |
| Indemnity | Can make you pay the client's breach costs or third-party claims | Whether your cyber and errors and omissions policies cover the promise |
| Required insurance | Clients name minimum cyber and errors and omissions limits | Your limits, sublimits and whether the client must be an additional insured |
| Incident notice | Short deadlines to tell the client about a security event | Your incident plan and the policy's notice condition |
| Subcontracting | May require consent or flow-down terms | Who does the work and under what contract |
Whether a cap holds up depends on the contract and the governing state's law, so ask deal counsel. In an asset purchase, contracts with anti-assignment clauses need client consent to move to your company, and clients may ask for higher limits when they sign. See how to check customer contracts against your policies.
What if a scammer tricks your staff or your help desk?
That is social engineering: a scammer posing as someone you trust to get money or access. An MSP is more exposed than most businesses, because it is both a target and a path. The Internet Crime Complaint Center run by the Federal Bureau of Investigation tracks business email compromise as one of the costliest fraud types it sees. Two different losses need two different checks.
- Your own money. If an employee is tricked into wiring funds by a fake vendor or executive email, that is a social engineering loss. Funds transfer fraud coverage generally responds when someone sends instructions to your bank without your knowledge. It usually does not cover an employee who was fooled. Many crime and cyber policies exclude those voluntary transfers unless social engineering or fraudulent impersonation coverage is added. That added coverage often has a lower sublimit and requires you to verify payment changes by another channel.
- Your clients' systems. If an attacker poses as a client user and your help desk resets a password or disables multifactor authentication, the result is a client breach. That is a tech errors and omissions or cyber liability question, not a crime question.
Also ask whether the cyber policy includes invoice manipulation coverage, which can pay part of your own loss, often the cost of the services rather than the full invoice, when a client pays a fake invoice sent from your hacked email. A client's claim against you for that loss is a liability question under the cyber or tech errors and omissions policy. See funds transfer fraud for new owners and the new owner review of crime insurance.
Who is liable when a subcontracted help desk makes a mistake?
Usually you, at least first. Clients contract with your company, so a mistake by an outsourced help desk, network operations center (NOC) or security monitoring partner usually lands on you. Check that your tech errors and omissions policy covers services performed on your behalf by subcontractors, because definitions vary. Then check the subcontractor side:
- Does the subcontractor carry its own errors and omissions and cyber coverage, with limits that mean something?
- Does your contract with it include indemnity and require it to name your company where appropriate?
- What admin access does it have, and is that access protected with multifactor authentication and logging?
Individual contractors paid on a 1099 raise a separate workers' comp audit question. See whether your subcontractors carry required coverage and 1099 contractors and the workers' comp audit.
Will anything cover claims about the seller's work before closing?
Tech errors and omissions and cyber liability are usually claims-made. The answer turns on three things: the retroactive date (the earliest date of work the policy reaches back to), any change in control wording and, in an asset purchase, whether your carrier agreed to cover the seller's prior acts. One step is specific to MSPs: make sure any known security events, client complaints and suspicious activity in the remote management tools are reported now to the policy that was in force before closing, while it can still accept notice. In an asset purchase, that means asking the seller to report them. For the stock and asset mechanics and how tails work, see prior acts and tail coverage after an acquisition.
What belongs on my first-month checklist?
| Check | Why it matters | Ask for |
|---|---|---|
| Tech errors and omissions and cyber | Core exposure, often one combined policy | Full policy, application, retroactive date, change in control wording |
| Limits against a multi-client event | One tool compromise can create many claims | Related claims wording, aggregate, systemic event sublimits |
| Security controls | Application answers must stay true after closing | Multifactor authentication on admin tools, backups, endpoint detection, access reviews |
| Top client contracts | Caps, indemnity, required limits | Top 20 master services agreements |
| Crime with social engineering | Your own funds and payment changes | Crime policy, sublimit, verification conditions |
| Subcontractors | You answer for their mistakes | Contracts, certificates, access lists |
| Loss history | Underwriters and future buyers will ask | Five years of loss runs and incident logs |
A Morrow review can compare your limits to your contracts and to a realistic multi-client event, and request quotes where it makes sense. For the documents to gather, see documents for an insurance review.
Keep reading
- New Owner Review: Cyber Insurance
- New Owner Review: Professional Liability (Errors and Omissions)
- Cyber Controls That Can Lower Your Cyber Insurance Premium
- Funds Transfer Fraud: Why New Owners Are a Favorite Target
- Just Bought a Healthcare Services Company? Your Insurance Review Checklist
- All guides for new business owners
Frequently asked questions
Is tech errors and omissions the same as cyber insurance?
No. Tech errors and omissions covers claims that your services or advice failed and caused a client financial loss. Cyber covers breaches, ransomware, data loss and privacy claims. MSPs face both, and many carriers sell them together in one policy with separate or shared limits.
Does cyber insurance cover my clients' losses from a breach that started with us?
It can, through the third-party liability part of a cyber policy or a tech errors and omissions policy, subject to the limits, exclusions and how related claims are grouped. First-party cyber covers your own costs, not your clients' losses. Check both parts of the policy.
Will my umbrella policy sit over tech errors and omissions and cyber?
Usually not. Most commercial umbrellas sit over general liability, auto and employers liability. If you need more professional or cyber limits, that usually means a higher primary limit or a separate excess policy written over those lines.
If my contracts cap liability, do I need less insurance?
Not necessarily. Caps often have carve-outs for data breaches and confidentiality, may not bind third parties, and may not hold up under some state laws. You still need defense costs covered. Size limits to your contracts and to a multi-client event, and ask counsel about enforceability.
Should the seller buy a tail on its tech errors and omissions policy?
Often yes, especially in an asset purchase, because the seller's tail lets claims about the seller's work be reported after the policy ends. It protects the seller's company, not yours, so also ask your own carrier about prior acts coverage.
References
- Cybersecurity and Infrastructure Security Agency: Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A)
- Cybersecurity and Infrastructure Security Agency: Multifactor Authentication
- FBI Internet Crime Complaint Center: Business Email Compromise, The $55 Billion Scam (PSA, September 2024)
- The D&O Diary: Voluntary Parting Exclusion Precludes Coverage for Social Engineering Fraud Loss (2020)
- IRMI: Retroactive date (definition)
- Insurance Services Office: Commercial General Liability Coverage Form CG 00 01 12 07 (carrier-hosted copy)
Just bought a business? Get your insurance reviewed.
Send Morrow the declarations pages, loss runs and key contracts you inherited. Morrow can review them against the business you bought, flag gaps and request quotes where it makes sense. Any new terms depend on carrier underwriting.
Morrow · 25 New Chardon Street, 4th Floor, Boston, MA 02114
This article is general information, not legal, tax or financial advice, and not a coverage determination. Coverage depends on the actual policy wording, carrier underwriting, your purchase agreement and your contracts. Ask your attorney and accountant about deal and legal questions.