Industry Insights
Words of wisdom from our business insurance experts.
How to Read the Insurance Clause in an Enterprise MSA
The insurance clause in an enterprise master services agreement (MSA) usually lists the coverages you must carry, the minimum limits for each, and conditions such as additional insured status, a waiver of subrogation and primary and non-contributory wording. Before you sign, check that your actual policies meet each requirement, not just your certificate.
If you sell software or services to larger companies, procurement will eventually send you an MSA with an insurance section. This guide explains how to read it, how it connects to the rest of the contract, which requirements are reasonable to push back on, and how to get a compliant certificate of insurance without delaying the deal.
Where the insurance clause sits, and why the rest of the contract matters
The insurance clause is usually a short section near the end of the MSA, or a separate exhibit. It rarely stands alone. Three other clauses decide how much it actually matters:
It rarely stands alone. Three other clauses decide how much it actually matters:
- Indemnification. This says when you must cover the customer's losses or legal costs, for example if your software infringes someone's IP or a data breach exposes the customer's data. Insurance is often how you fund these promises, but not every indemnity you agree to will be insured.
- Limitation of liability. This caps how much either side can owe the other, often tied to the fees paid under the contract. Many MSAs carve certain claims out of the cap, such as data breaches, confidentiality breaches or IP infringement. Those carve-outs are where your insurance limits matter most.
- Data protection and security. These clauses set your security obligations and breach-notification duties, which can drive the customer's cyber insurance requirements.
Read these sections together. An insurance requirement that looks reasonable on its own may be inadequate if the liability cap has been removed for data breaches, and an indemnity may be broader than anything your policies cover.
The coverages enterprise customers typically require
Requirements vary by customer, industry and deal size. These are the coverages that appear most often in software and services MSAs:
Tech E&O and cyber are often combined in one policy for software companies. If the MSA lists them separately, check whether a combined policy with a shared limit satisfies the requirement or whether the customer expects separate limits.
The conditions attached to the coverages
Beyond coverages and limits, most insurance clauses add conditions. Each one has to be supported by your policy wording or an endorsement.
- Additional insured. The customer asks to be added to your liability policy, usually CGL and sometimes umbrella, so it can seek defense and indemnity for claims within the endorsement's scope. Additional insured status must be supported by the policy, often through a scheduled or blanket endorsement. Listing the customer on a certificate doesn't create that status. Customers sometimes ask for additional insured status on E&O or cyber, which many insurers don't offer; that's a common point to negotiate.
- Waiver of subrogation. Your insurer agrees not to pursue the customer to recover a claim it paid. Your policy must allow it, sometimes by endorsement, before you sign.
- Primary and non-contributory. Your policy responds first to covered claims involving the customer, without asking the customer's insurer to share the cost. Again, the policy must support it.
- Notice of cancellation. The MSA may require notice to the customer if your coverage is cancelled or reduced. Check who must give that notice. Naming the customer as certificate holder doesn't by itself oblige your insurer to notify them.
- Insurer rating. Many MSAs require insurers with a minimum AM Best rating, such as A- or better.
- Duration and continuity. For claims-made coverage such as Tech E&O and many cyber liability forms, check the retroactive date, reporting requirements and any obligation to maintain coverage after services end. Preserve coverage for prior acts when renewing or changing insurers. An extended reporting period (tail) may allow qualifying claims involving earlier work to be reported after the policy ends, but it doesn't insure new work performed afterward.
Red flags worth pushing back on
Enterprise MSAs are often written from a template that wasn't built with startups in mind. These requirements are common negotiation points:
- Limits out of proportion to the deal. A requirement for very high limits on a small contract can cost more in premium than the deal is worth. Ask whether the limits can reflect the services, data sensitivity, potential loss, customer requirements and contract value.
- Coverages that don't fit your business. Auto, pollution or professional coverages unrelated to what you sell can often be removed.
- Additional insured on E&O or cyber. Many insurers won't add additional insureds to these policies. Ask whether the requirement can apply to CGL and umbrella only.
- Uncapped indemnity. An indemnity with no cap, especially for data breaches, can exceed any insurance you could reasonably buy. Ask counsel to negotiate a defined cap or a higher super-cap for specified risks. Evaluate it alongside available insurance, but don't assume the policy limit guarantees funds will be available for that obligation.
- Clauses saying insurance doesn't limit your liability. Many MSAs say your liability isn't limited to your insurance. That's standard, but read it alongside the liability cap.
- Unworkable timing. Requirements to have coverage in place before signing, with no time to place it, can stall a deal. If you need time to obtain coverage or endorsements, negotiate the required effective date and evidence-of-insurance deadline in writing. Distinguish between extra time to provide documentation and permission to begin work before the required coverage is in place.
- Insurer ratings or forms you can't meet. Ask your broker before agreeing to a specific rating, policy form or endorsement wording.
Pushing back is normal. Procurement teams often have approved fallback positions, and asking early is far easier than finding a gap after signing.
How to respond to procurement and get a compliant certificate
- Send your broker the full insurance section, plus the indemnity, liability cap and data protection clauses. The wording matters, not a summary.
- Get a gap list. Your broker should compare each requirement with your current policies and flag what's missing: limits, coverages or endorsements.
- Decide: buy, endorse or negotiate. Some gaps are fixed with an endorsement or a limit increase. Others are better negotiated out of the contract.
- Send procurement a clear response. List what you meet, what you'll add and by when, and any requested changes with a short reason.
- Have your broker issue the certificate and provide applicable endorsements. Use the customer's exact legal name as certificate holder, and reference the endorsements for additional insured, waiver of subrogation and primary and non-contributory. A certificate is evidence of coverage; it doesn't change your policy.
- Track renewals. Many MSAs require an updated certificate each policy year. Set a reminder.
Tell your broker the signing date upfront. Gaps found early are easier and cheaper to fix. For more on certificates, see Certificate of Insurance: Why Every Startup Needs One
Frequently asked questions
What insurance do enterprise customers usually require from software vendors?
Most often technology errors and omissions (Tech E&O), cyber liability, commercial general liability, umbrella or excess liability, and workers' compensation with employer's liability. Requirements vary by customer, industry and deal size.
Can I negotiate the insurance requirements in an MSA?
Often, yes. Limits, coverages that don't fit your business, additional insured requests on E&O or cyber, and timing are common negotiation points. Raise them early, with a short explanation.
Is a certificate of insurance enough to satisfy an MSA?
It's usually what the customer asks for as evidence, but it doesn't change your policy. Your policies and endorsements must actually meet the contract's requirements.
Do I need to add the customer as an additional insured?
If the agreed MSA requires additional insured status, your policies must support that requirement. It commonly applies to CGL and may also apply to umbrella or excess coverage, depending on the contract and policy wording. Requests involving E&O or cyber may need to be negotiated.
What happens if I sign an MSA my insurance doesn't meet?
You may be in breach of contract, and some obligations, such as an uninsured indemnity, may fall on the company directly. Close the gaps before signing or negotiate the terms.
How long does it take to meet MSA insurance requirements?
Adding endorsements can be quick. Buying new coverage, such as Tech E&O or cyber for the first time, takes longer because the insurer needs to underwrite it. Start as soon as you receive the contract.
This article is general information, not insurance, legal or financial advice. Contract requirements, coverage and availability vary by insurer, policy wording and the facts of each deal. Have your broker and counsel review your agreement.
management specialist