Should I Require Cyber Insurance From My Clients?

The Short Answer for an MSP

Requiring cyber insurance is one of the cheapest protections an MSP can put in place. It costs you a clause in the agreement and a few minutes at onboarding and renewal. What it buys is a second party, with money and incident response resources, standing behind the client when something goes wrong.

Without it, a breached client has two places to look for help paying for recovery, notification, legal costs and lost income: their own bank account and you. Even if your agreement limits your liability, being the only party with anything to lose makes you the natural target for a claim.

Require it, do not sell it. Selling insurance requires an insurance license, which an MSP usually does not hold, and recommending a specific policy puts you in the position of advising on coverage. Point clients to a broker, and keep your role to the security controls the policy will ask about.

Why It Protects the MSP, Not Only the Client

Many of the losses that drive cyber claims are not stopped by the tools an MSP deploys. Coalition's 2025 Cyber Claims Report found that 60% of its policyholders' claims in 2024 came from business email compromise and funds transfer fraud. Those incidents often end with an employee authorizing a payment to a criminal. Your EDR will not stop a staff member wiring money after a convincing email.

When that happens, the client's first question is who is responsible. A client with insurance calls their carrier, gets a breach coach and forensic team, and recovers what the policy covers. A client without insurance calls you, and the conversation turns quickly to what you should have prevented.

Insurance also gives you leverage on security. Carriers ask detailed questions about controls before they write or renew a policy. When the client's renewal depends on MFA being enforced everywhere, the argument for rolling it out stops being your opinion and becomes their insurer's condition.

What to Put in Your Agreement

A short clause in your master services agreement does most of the work. Have your attorney draft or review the wording, and make sure it covers these points:

• The client maintains cyber liability insurance for the term of the agreement, at limits appropriate to its size and data, chosen with its own broker.
• The client provides a certificate of insurance at onboarding and at each renewal on request.
• The client notifies you promptly of any claim, cancellation or material change to the policy.
• The client answers insurer questionnaires accurately and consults you before attesting to technical controls you manage.
• If the client declines coverage, it signs a written acknowledgment that it understands the risk and accepts it.
• Your limitation of liability and indemnity clauses are unaffected by whether the client carries insurance.

Some MSPs also ask to be named as an additional insured. Whether that is available depends on the carrier and policy, so treat it as a question for the client's broker rather than a hard requirement.

What the Client's Policy Should Cover

You are not the one choosing the policy, but you should know enough to spot a thin one. The FTC's small business guidance splits cyber coverage into two halves, and a useful policy has both.

The FTC also suggests confirming that a policy covers breaches at vendors and includes a breach hotline. Both matter to an MSP, because in a supply-chain incident you may be the vendor.

The Questionnaire Is Where MSPs Get Hurt

Insurers decide on coverage and price largely from the client's application. It asks whether MFA is enforced, whether endpoints run EDR, whether backups are tested and kept offline, and whether staff receive security training. The client signs it, but you manage most of what it describes.

If the answers are wrong, the carrier may deny a claim, and the client will ask why their MSP let them attest to controls that were not in place. Protect yourself by being part of the process:

1. Ask every client to send you the questionnaire before they submit it.
2. Answer the technical questions from evidence: your MFA coverage, backup success rate and restore test pass rate reports.
3. Mark any control that is only partly deployed as partial, and state the gap in writing.
4. Keep a copy of what was submitted with the client's documentation.
5. Review it again at renewal, when the questions usually get stricter.

A QBR is a natural place to walk through the upcoming renewal questionnaire and agree which gaps to close before it is due. Putting the questionnaire on the review agenda also shows the client decision maker that the controls you recommend are the same ones the insurer is asking about.

Bringing Existing Clients Onto the Requirement

New clients can sign the clause from the start. Existing clients need a gentler path, because you are changing terms on a relationship that already works. The simplest route is to add the requirement at each client's next renewal, explained in plain terms: it protects them, it makes their security investment count with an insurer, and it is now standard for every client you serve.

Give clients time to talk to a broker before the renewal date, and offer to join the call to answer technical questions. Track who has provided a certificate in your PSA or documentation tool, the same way you track license renewals, so nobody slips through because the renewal was busy.

When a Client Refuses

Some clients will decline, usually on cost. You have several reasonable responses, and the right one depends on the client's risk and how much of your revenue they represent.

Clients in regulated sectors deserve extra care. If a client handles health records, read the HIPAA answer alongside this one, because a breach there brings obligations beyond the direct recovery cost.

Your Own Coverage Is a Separate Question

Requiring clients to carry insurance does not replace your own. An MSP should consider technology errors and omissions coverage for claims that your service caused a loss, and its own cyber coverage for incidents in your tools and tenant. Your broker should know that you hold administrative access to many client environments, because that is the fact that shapes your risk.

Evidence That Helps Your Own Renewal

• Documented security controls on your own systems, starting with MFA on every admin account and remote access tool.
• Contracts that include client insurance requirements and clear limitation of liability.
• An incident response plan with named roles, tested at least once.
• Independent assurance where clients ask for it; the SOC answer covers what that involves.

Treat the two policies as a pair. The client's covers the client's losses; yours covers your liability for them. With both in place, an incident becomes a recovery project instead of a dispute about who pays.