Managed Service Provider Insurance: The 2026 Requirements Guide

A managed service provider rarely picks its insurance off a menu. The clients whose systems you manage, your landlord, and state law each hand you requirements, and those requirements — not your own risk assessment — decide most of what you bind. Because an MSP administers client environments, the master services agreement typically demands technology E&O and cyber together, not one or the other. This guide is the mechanics side: for each party who can force you to carry coverage, what they actually ask for, which form satisfies it, and where the paperwork trips you. The liability side, who can sue you and what is at stake, is on the sister library, pleasedontsue.us. This is the requirements map.

Where these hit your timeline. Few appear at incorporation. Each attaches to a milestone, and each comes with a document you have to produce.

Milestone	Requirement that appears	What you will be asked to produce
Founder-only shop, no managed clients	None binding	Nothing yet — most coverage is elective
First managed-services client	Tech E&O + cyber (client MSA)	A certificate of insurance showing the limits the contract names
Regulated client (finance, healthcare)	Heightened cyber + security schedule	A certificate with a higher cyber limit and an additional-insured endorsement
First W-2 employee	Workers’ comp (state law)	A workers’ comp policy, or a valid owner exemption filing
Office or equipment depot signed	General liability + property (landlord)	A certificate naming the landlord additional insured

What your clients require

The client’s master services agreement carries an insurance exhibit, and that exhibit names the lines and the limits. For an MSP the core demand is technology E&O paired with cyber, evidenced by a certificate of insurance. The number in that clause is a requirement, not a suggestion — it is the floor for the limits you bind. And because you manage client systems, clients ask for both: a service failure and a security event are different failures, and the MSA names them separately.

Three mechanics trip providers here, and all are common. First, a certificate proves coverage exists, but it does not make the client an insured. To extend your defense and settlement protection to them you need an additional-insured endorsement on the policy itself. New York’s insurance department states the rule plainly: a certificate holder is not an additional insured, and a certificate cannot alter the policy. Clients conflate the two constantly; the policy language is what controls. Second, most tech E&O and cyber is written on a claims-made trigger, so the retroactive date decides whether years-old managed-services work stays inside the coverage window. Switch carriers without carrying prior acts forward and the old exposure reopens. Third, read the policy’s definition of “technology services” against what you actually do — managed services, monitoring, backup, identity administration — before you certificate it. That definition is where underwriters draw the line, and an MSA can require distinct E&O and cyber limits that a blended policy still has to evidence separately.

Why a blended tech E&O and cyber form fits an MSP

A standalone E&O form answers the client’s lawsuit after a service failure; it does not pay your own forensic, notification, or ransomware costs, and those invoices arrive in the first 48 hours before anyone sues. A blended technology E&O and cyber policy — one carrier, one form — closes that gap and avoids the boundary dispute that split carriers create when one event touches both lines. That is the market’s settled recommendation for technology providers, and it fits the MSP model precisely: the same privileged access that creates the service-failure exposure also creates the breach exposure, so the failure modes travel together.

The thing to verify on a blended form is not the label but the insuring agreement — whether the definition of technology services covers managed services, and whether the cyber module is inside the form or an optional add-on. Regulated clients who understand the model ask for a higher cyber limit because you sit inside their perimeter; match that limit to your largest MSA before you certificate it. The mechanics of what cyber actually responds to are covered at do I need cyber insurance and on the broader what does cyber insurance cover question.

What your landlord requires

The lease is the bluntest instrument. A commercial landlord typically requires general liability — commonly $1 million per occurrence and a $2 million aggregate — and names the landlord additional insured on that policy. Property coverage for your tenant improvements and contents usually rides alongside it.

For most MSPs the efficient shape is a business owner’s policy, a package that bundles general liability and commercial property and costs less than buying each separately. A provider that runs an office or a staging depot usually qualifies, because the BOP is built for lower-risk operations; a carrier can decline it for operations that look higher-risk. The lease clause is a literal specification: match the limits it names, add the landlord by the exact additional-insured wording, and deliver the certificate before you take the keys. A BOP never includes professional liability, cyber, or workers’ comp — those stay separate.

What the state requires

Workers’ compensation is the one requirement backed by law rather than by a counterparty. The trigger is your state’s employee threshold, and it varies sharply enough that generalizing from one state is a mistake. California requires it with even a single employee under Labor Code 3700; Florida sets the line at four or more employees for non-construction businesses. Most states let an owner or officer elect exemption, but the election is a filing, not an assumption.

The mechanics that catch MSPs: a 1099 technician who is reclassified as an employee counts toward the threshold after the fact, workers’ comp is a separate statutory policy that no BOP includes, and an uninsured workplace injury is both a regulatory penalty and an uncovered loss. If you have employees or a reclassifiable contractor, your state’s workers’ comp authority — not a carrier’s marketing page — is the source for your trigger. See whether you need workers’ comp with no employees for the threshold question and how workers’ comp relates to general liability for why the two are not substitutes.

The decisions that are actually yours

Strip away the three sources above and one line is left genuinely elective: EPLI, employment practices liability. No client, landlord, or statute requires it — yet the exposure starts at your first hire, because every termination and pay decision is a claim that none of your other policies will answer, and contractor reclassification can trigger it alongside a state inquiry. The case for carrying it is on the sister library; the decision is yours. The remaining decisions are about the requirements you already face, not whether to face them: size limits against your worst single failure — a multi-client outage or a cascade breach — rather than a generic tier, carry the retroactive date forward when you switch carriers so old managed-services work does not walk back out of coverage, and verify the technology-services definition before you certificate a blended form to a client.

A short checklist

1. First MSA signed → read the insurance exhibit; the limits it names are your tech E&O and cyber floor, and the additional-insured endorsement is separate from the certificate.
2. Regulated client onboarded → expect a higher cyber limit; confirm the blended form evidences both E&O and cyber at the required numbers.
3. Lease or depot signed → match the GL limits, add the landlord by the exact wording, and deliver the certificate before you take the keys.
4. First hire or reclassifiable contractor → confirm your state’s workers’ comp threshold and bind or file the owner exemption.
5. Renewing or switching carriers → carry the retroactive date forward, or the old work walks back out of coverage.

---

Sources are linked below. This guide covers the requirements and the mechanics of meeting them — forms, certificates, endorsements, and state thresholds. The liability exposures behind each requirement are on pleasedontsue.us.