Cyber Insurance Requirements for Vendors
What Your Client’s Contract Really Asks For, and Why Certificates Get Rejected
Index
Gordon B. Coyle
CEO, The Coyle Group
845-474-2924
How to get started
TL;DR. Executive summary
The deal is almost done.
Then the insurance section of the contract arrives: “Vendor shall maintain cyber liability insurance with limits of not less than $1,000,000 per occurrence and name Client as additional insured.”
I hear versions of the same story all the time: “they want 5m of coverage, our current coverage is 1m which is perfect for 99.9% of our clients.”
Now you have a short deadline, a coverage you may never have bought, and a client who won’t sign until a certificate shows up.
Here’s what that moment is really about.
You need to satisfy the client on paper, and you need a policy that actually pays if something goes wrong on their account.
The Coyle Group is a commercial insurance agency that handles the complex, high-value risks other agencies don’t know how to structure, where the details in the policy are the difference between a paid claim and a denied one.
This guide to cyber insurance requirements for vendors is written for established technology, service, and healthcare vendors selling to large clients.
A client contract or vendor onboarding packet demands cyber liability insurance, a specific limit, and a list of endorsements, and you can’t tell whether your current policy meets it or which terms you can push back on. Our approach starts with the contract, not a quote: we read the clause against your actual policy, then manage the market for you so the right insurers compete for your business. We return calls and emails within one business day, which matters when a deal is waiting on a certificate, and 95% of our clients stay with us.
The next step is a 15-minute call, not an application. Book a call.
Do You Need Cyber Insurance to Work With Large Clients?
Usually, yes, but the requirement comes from the contract, not the law. No federal rule makes most vendors buy cyber insurance; large clients write it into vendor agreements because a breach at a vendor becomes their breach. The catch is that having cyber insurance and meeting the clause are two different tests.
Most cyber insurance requirements for vendors start with the client’s own risk, and three authorities explain why:
Regulations rarely force the purchase, though.
HIPAA, for example, requires a business associate agreement with vendors that handle patient data, and the HHS sample provisions don’t require the vendor to buy insurance. The insurance demand comes from the client’s lawyers.
The cost of getting it wrong is real:
So every vendor has to pass two tests:
When I talk with tech founders, the first deadly mistake I warn about is getting blindsided by an enterprise contract insurance requirement.
What Does a Typical Vendor Cyber Insurance Clause Require?
A typical clause requires a minimum limit, third-party liability plus first-party breach coverage, and endorsements that protect the client. Most owners read the dollar amount and stop there. However, the endorsements are where certificates fail, because some cyber insurers won’t add them at all.
When I review cyber insurance requirements for vendors, I break every clause into the same parts.
Here’s what each term means and what to check in your own policy before you promise it:
Clause term |
What it means |
What to check in your policy |
|---|---|---|
|
Minimum limit |
The least the policy must pay, per claim and in total |
Per-occurrence and aggregate limits, and any sublimits underneath |
|
Pays claims, defense, and settlements when the client or its customers sue you |
Network security and privacy liability, with defense costs stated |
|
|
First-party breach costs |
Pays your forensics, notification, data restoration, and downtime |
Breach response limits and business interruption waiting period |
|
Additional insured |
Gives the client rights under your policy |
An actual endorsement, not just a name on the certificate |
|
Waiver of subrogation |
Stops your insurer from suing the client after paying a claim |
A waiver endorsement your insurer agreed to |
|
Primary and noncontributory |
Your policy pays first, before the client’s insurance |
Policy wording or an endorsement that says so |
|
Notice of cancellation |
The client hears if your policy lapses |
Notice terms the insurer accepts, not a promise on the certificate |
|
Breach notification window |
You alert the client within a deadline the contract sets |
Your incident response plan and the policy’s own notice rules |
How Do You Decode a Vendor Cyber Insurance Clause?
Take the sample clause from the top of this page.
That one sentence commits you to five separate things:
That’s what I mean by contract-to-policy mapping: every phrase in the clause gets matched to a line in the policy.
Some clauses also ask for technology errors and omissions coverage.
Others reach past cyber into general liability and umbrella limits.
Our guide to customer contract insurance requirements covers those broader terms, and our page on the waiver of subrogation explains how that endorsement works.
Send me the insurance section of your contract and I’ll tell you whether your current policy meets it.
How Much Cyber Liability Coverage Do Vendors Need?
Most vendor contracts start at $1 million per occurrence. Health care, financial, government, and Fortune 500 clients often ask for $2 million to $25 million. The number on the contract isn’t the only one that matters, though: your aggregate limit is shared by every client you serve.
Here’s what cyber insurance limits Fortune 500 companies and other buyers commonly require from vendors, as of October 2026. Treat these cyber insurance requirements for vendors as patterns, not rules; your contract controls.
Vendor type |
What contracts commonly ask |
What drives it higher |
|---|---|---|
|
Service vendor with little client data |
$1 million per occurrence, the default ask I see most |
Access to client systems or customer records |
|
Marketing agency or vendor holding customer data |
Usually starts at the $1 million default |
Record count, sensitive fields, email systems you run |
|
Often $2 million to $5 million for younger firms, and far more for established platforms, usually alongside technology E&O |
Admin access, uptime promises, number of clients on one platform |
|
|
Healthcare vendor handling patient data |
$2 million to $5 million is common for health care system clients, plus a business associate agreement |
Patient record volume, regulatory defense and fines exposure |
|
Vendor handling customer payment card data |
E-commerce platforms often ask for $2 million to $10 million and breach cost-sharing |
Card-brand fines and assessments the client may pass to you |
|
Bank or financial institution client |
Often $3 million to $10 million, with additional insured status |
SOC 2 audits and encryption standards |
|
Fortune 500 or large enterprise client |
Often $5 million to $25 million |
Penetration testing and a pre-contract security assessment |
|
Federal government contractor |
Often $5 million to $10 million |
FedRAMP, NIST, or DFARS requirements; state and local templates vary |
Now the part most vendors miss. Your aggregate limit covers all of your clients at once. If one attack hits your shared platform, every client’s claim draws on the same limit.
I call a limit picked by habit rather than measurement the Million-Dollar Illusion, and on a multi-client platform it can disappear in a single event.
What If the Contract Limit Is Too High?
Start by asking the client’s risk team three questions:
Then weigh your options:
How Do Cyber Liability Insurance Options Compare for Software and Service Vendors?
A standalone cyber policy satisfies most vendor clauses; a cyber endorsement on a business owners policy usually doesn’t. Software and IT vendors typically need technology E&O alongside cyber, because clients sue over failed services as well as stolen data. The policy form also decides whether the client’s endorsements are even available.
Here’s how the three common options compare when you’re trying to meet a contract, not just check a box:
Feature |
Cyber endorsement on a BOP or GL policy |
Standalone cyber policy |
Technology E&O with cyber |
|---|---|---|---|
|
First-party breach costs |
Often small, sometimes $10,000 to $25,000 in total |
Yes, at full policy limits or stated sublimits |
Yes, when the cyber part is included |
|
Breach notification and credit monitoring |
Limited or sublimited |
Yes, usually under breach response |
Yes, under the cyber part |
|
Third-party liability to the client |
Often missing or thin |
Yes |
Yes |
|
Failed or faulty services |
No |
No |
Yes, this is the E&O part |
|
Regulatory defense and fines |
Rarely |
Often, where insurable |
Often, under the cyber part |
|
Additional insured availability |
Rarely |
Varies by insurer |
Varies by insurer |
|
Best fit |
Very small, low-data businesses |
Most service vendors |
Software, SaaS, IT, and managed services firms |
The first column is the trap.
I call it the Cyber Coverage Mirage: a policy that says “cyber” on the declarations page but can’t carry a real claim.
We replaced it with a standalone policy for about $1,300 a year.
For software and IT firms, technology E&O covers what you do, while cyber covers what you hold.
Most enterprise contracts want both.
A cheap policy with a useless sublimit is not a deal; it is a false economy.
Have a clause in front of you right now? Contact us and send it over with your current declarations page.
Why Would a Client Reject Your Cyber Insurance Certificate?
Clients reject a vendor’s cyber certificate when the policy behind it doesn’t match the clause: the limit is short, an endorsement is missing, or the coverage is first-party only. Sometimes the certificate passes and the policy still fails later. That second problem is the more expensive one, and it’s easy to prevent.
These are the seven gaps I see most often when a vendor’s cyber insurance gets rejected, and how to fix each one:
Rejection reason |
Why it fails |
The fix |
|---|---|---|
|
Limit below the contract minimum |
The certificate shows $1 million and the clause says $2 million |
Raise the limit or add an excess layer before the deadline |
|
Client not named as additional insured |
A certificate holder isn’t an additional insured |
Add the endorsement, or move to an insurer that offers it |
|
First-party-only coverage |
A BOP or GL endorsement covers your costs, not the client’s claims |
Buy a standalone cyber policy with third-party liability |
|
Sublimits below the required limit |
Notification, ransomware, or regulatory costs cap out early |
Read the sublimit schedule against the clause |
|
Contractual liability exclusion |
The policy won’t pay liability you took on by contract |
Negotiate the exclusion or limit what you promise |
|
Retroactive date problems |
A claims-made policy may not cover work done before its start date |
Check the retroactive date against your contract history |
|
Missing or expired terms on the certificate |
Wrong policy period, no waiver, no primary wording |
Ask for the endorsement pages, not just the certificate |
The certificate of insurance itself changes nothing in your policy.
It reports what the policy says.
So the fix always lives in the policy.
There’s a difference between being covered and being adequately covered. One checks a box. The other protects your business.
Why Isn’t General Liability and an Umbrella Enough?
General liability and umbrella policies usually don’t pay for a data breach, because most breaches involve no injury, no property damage, and sometimes no proof anyone saw the data. A court case proved it with a $6.2 million bill. The real lesson for vendors is what your client will ask you to repay.
Real-world example
In Recall Total Information Management v. Federal Insurance Co., IBM hired Recall to transport and store computer tapes, and Recall hired a subcontractor for transport. A cart of 130 tapes holding personal data on about 500,000 IBM employees fell out of the subcontractor’s van. IBM spent $6.2 million responding: $2.5 million on notification, $600,000 on a call center, and $3.1 million on credit monitoring. Recall reimbursed IBM, then turned to the subcontractor’s $2 million general liability policy and $5 million umbrella, both naming Recall as an additional insured. The insurers denied the claim because there was no evidence anyone had published the data, and the Connecticut Supreme Court agreed. As Taft Law’s analysis of the case concludes, the subcontractor should have carried cyber insurance.
Then a data incident lands, and the general liability form asks for bodily injury, property damage, or a publication that never happened.
That’s why clients now name cyber coverage specifically.
And it’s why I check every vendor’s general liability, umbrella, and cyber forms side by side.
Book a call and we’ll check whether your current forms would have paid the Recall claim.
How Do Indemnity and Liability Caps Change What You Need?
Your indemnity clause decides what you owe the client; your policy decides what your insurer pays. When the two don’t match, you pay the difference. Many cyber policies exclude liability you assume by contract, so the promise you signed may not be a promise your insurer backs.
Clients write vendor indemnities broadly.
They often want you to cover notification costs, regulatory fines, card-brand assessments, lawsuits, and their own lost income after a breach you caused.
Read your indemnity next to your policy and look for these gaps:
The fix is to line up three numbers before you sign: the indemnity scope, the liability cap, and the policy limit.
Our guide to risk transfer and indemnity agreements explains how these clauses shift risk between parties.
Signing an MSA this month? Contact us and we’ll compare its indemnity against your policy before you sign.
What Do Insurers Look at Before Covering a Vendor?
Insurers look at five things before they cover a vendor: size, the data you touch, your security controls, the services you deliver, and your loss history. Each one moves price and eligibility. Your controls matter twice, though, because they also decide whether a claim gets paid later.
Here’s how underwriters weigh each factor and what to have ready when you apply, whatever cyber insurance requirements for vendors your client sets:
Factor |
Why underwriters care |
What to have ready |
|---|---|---|
|
Revenue and size |
Sets the base premium and the limits insurers will offer |
Current revenue, employee count, and client count |
|
Data you hold or touch |
Personal, health, and payment data drive breach costs |
Record counts and data types, including client data you access |
|
Security controls |
Weak controls drive claims, so insurers require MFA, EDR, backups, patching, training, and an incident response plan |
A plain description of each control and where it applies |
|
Services you deliver |
Access to client systems turns your incident into their incident |
A description of services, system access, and uptime promises |
|
Loss and incident history |
Past incidents predict future ones |
Any incidents, claims, or near misses in the last five years |
Why Do Vendor Cyber Claims Get Denied?
Answer the application honestly.
Insurers treat your answers as representations, and a wrong answer can void a claim.
From what I’ve seen, cyber claims get denied for four main reasons:
We cover these in more depth in our guide to why cyber insurance isn’t paying out.
How Much Does Vendor Cyber Insurance Cost, and How Fast Can You Get It?
Vendor cyber insurance cost depends on revenue, records, controls, limits, and the services you provide, so no honest broker can price it from a contract alone. Timing is often the bigger risk. Underwriting needs a full application, and the deal clock is already running when the clause shows up.
Here’s what moves the price:
Cost driver |
Pushes premium up |
Pushes premium down |
|---|---|---|
|
Limit required |
$5 million or more, or high sublimits |
$1 million with a modest retention |
|
Data volume and type |
Health, payment, or large customer databases |
Little personal data |
|
Controls |
Gaps in MFA, backups, or EDR |
Documented controls across every system |
|
Services |
Admin access to client systems |
Advisory work with no system access |
|
Loss history |
Recent incidents or claims |
Clean history |
Your number will differ.
Our cyber insurance cost calculator gives a rough starting point, but the application decides the real price.
To protect the deal timeline:
Contact us as soon as the draft contract lands, and we’ll map out what the insurers will need.
What Are the Red Flags That Your Vendor Cyber Coverage Won’t Hold Up?
Your vendor cyber coverage probably won’t hold up if any of these signs show up in your policy or your broker’s process. Most of them are cheap to fix before a claim and expensive after one. The hard part is spotting them, because every one of them looks fine on a certificate.
Every one of these is a contract promise with nothing behind it. Most aren’t expensive to fix. They come from nobody reading the contract and the policy together.
Spot one of these in your own program? Book a call and we’ll walk through the fix.
How Does The Coyle Group Review a Vendor Cyber Insurance Requirement?
We start with the contract, not a quote. I read the insurance and indemnity sections, map each requirement to your policy wording, and fix what fails before anything goes to market. That sounds slower. In practice, it’s the fastest path to a certificate the client accepts and a policy that pays.
How We Work
Our process for cyber insurance requirements for vendors follows the same steps every time:
For you, that means fewer applications, fewer duplicate requests, and one point of contact.
We’re an independent commercial brokerage, we only handle business insurance, and we place coverage nationally.
I hold the CPCU and ARM designations, and Donna Richard, our Senior Account Manager, has spent 8 years on cyber and E&O accounts.
If you’re comparing brokers who specialize in vendor cyber insurance requirements, ask each one to show you this contract-to-policy mapping before they quote.
Our family has been in the insurance business for more than 95 years, and clients notice the difference in the details.
If you only need the cheapest certificate the client will accept, there are brokers who will do that, and we’re not one of them.
Our sweet spot is established companies with real contracts and complex operations.
If you’re a very small business with a simple, standard risk and no contract demands, a basic packaged policy may serve you well, and I’ll say so.
And if the plan is to put three brokers in a race, we’re not the right fit.
Comparing options is smart.
Sending the same contract to several brokers usually isn’t.
Each broker approaches the same insurers, so insurers see duplicate submissions, you fill out repeat applications, and a generalist can misclassify a technology risk.
One broker who manages the market for you gets the right insurers to compete on terms that meet your contract.
Want one broker handling your contract from clause to certificate? Contact us.
What Should Vendors Check Before Signing a Contract?
Before you sign, map every insurance requirement in the contract to your actual policy wording. A checklist keeps you from discovering the gap after the client’s risk team does. It takes an hour with the right documents, and it can save the deal or the claim.
You don’t need five brokers shopping your insurance.
You need one capable broker making sure the right insurers compete for your business.
That’s how we handle cyber insurance requirements for vendors: we manage the market for you.
Take one of two paths on a 15-minute call:
Book a call for a 15-minute conversation, not an application.
Questions about Cyber Insurance Requirements For Vendors?
Get the Right Coverage for Your cyber insurance requirements for vendors
Our job isn’t to get you an insurance quote. Our job is to make sure your insurance is right. When a client hands you a cyber clause, that means reading the contract before anyone fills out an application, so the policy you buy is the one your client accepts and your insurer actually pays.
We stay with you after the certificate goes out. We re-underwrite your business every year and start each renewal 90 to 120 days before expiration, so new contracts, higher limits, and changing security controls are built in before a client’s risk team asks. And when something goes wrong, we work with adjusters and carriers to push your claim forward.
You’ll always know how we’re paid: carrier commissions, with no upfront fees for standard placements. If your next big client just sent over an insurance exhibit, send it to us first. A 15-minute call tells you what you have, what’s missing, and what it takes to close the deal.
This article was written by the CEO of The Coyle Group, Gordon B. Coyle, CPCU, ARM, AMIM, PWCA, who has over 40 years of experience working with business owners of all sizes and industries across the US, solving their insurance challenges.
Here’s how to take the next step
Schedule Your Insurance Confidence Assessment
In our 30-minute call, you’ll discover:
Not ready for a call?
Get Free Access to Our Gated Video:
“How to Finally Feel Confident in Your Coverage. “
And discover the exact system we use to help business owners eliminate hidden coverage gaps, stop overpaying, and finally feel confident in their protection.
What Peace of Mind Looks Like
Trusted by business owners across the U.S.
The Coyle Group is 1st class! Gordon and his team are knowledgeable, responsive, and attentive to detail. Gordon is that rare breed of professional who genuinely cares for his clients and works hard to exceed their expectations. I highly recommend them.
The insurance brokerage service was truly tailored to my needs, nothing like those big brokers who steer you toward random policies that don’t fit your profile. Thank you to the team for your help.
I was working with another broker and having difficulty acquiring General Liability coverage. A colleague recommended The Coyle Group. They were able to get coverage bound in just a couple of business days and a policy issued in ten days, and with a solid carrier at a competitive premium. Truly impressive results, plus it was a pleasure working with them. I highly recommend the Coyle Group!
If any business is looking to work with an insurance brokerage firm that is not only excellent at what the firm does, but one that deeply values the needs of the clients, then The Coyle Group is the firm for you. Give them a call and see for yourself. I can assure that you will quickly agree.
Want to know more?
See related blogs
The Crowdstrike Debacle and Cyber Insurance
Third Party Employment Practices Liability Insurance. Protect Your Business
Are You Overpaying or Underinsured on Your Business Insurance?
