Managed Service Provider Insurance: The 2026 Liability Playbook

Most managed service providers meet commercial insurance not by asking “what’s my risk?” but by finding a coverage requirement inside the master services agreement they need to sign. The client’s MSA asks for technology E&O and cyber at named limits. A regulated client’s security schedule adds more. The lease asks for general liability and names the landlord additional insured. By the time you are reading policies, most of what you will carry has already been decided by the clients whose systems you manage.

That reframe is the point of this playbook. It is not a catalog of what each policy does — that work belongs on the sister library, isthiscovered.org. This is the professional-liability map: five exposures that actually generate claims at an MSP, who can assert each one, and which line of coverage is supposed to answer it. The decisions left to you are narrower than the brochure suggests, and they are the ones that matter.

Where these hit your timeline. Few arrive at incorporation. They attach to milestones.

Milestone	What enters	Why then
Founder-only shop, no managed clients	Defer most coverage	No client is demanding anything; no privileged access yet
First managed-services client	Tech E&O + cyber	The MSA conditions the deal on proof of both; you now hold access to the client’s systems
Regulated client (finance, healthcare)	Heightened cyber + security schedule	The client’s own regulators push requirements down the chain
First hire or W-2 technician	EPLI exposure + workers’ comp	Every pay and termination decision becomes a potential claim; the employee threshold trips law
Office or equipment depot	General liability + property	The lease demands it; any premises or field-installation exposure activates GL

1. A configuration error or outage takes a client’s systems down

A configuration change breaks a client’s directory, a migration corrupts a database, a backup fails to restore, or monitoring misses the warning that preceded an outage. The client loses revenue and points at the service you were paid to run. This is the central exposure of an MSP, and the coverage that answers it is technology E&O — professional liability written for companies whose product is a technology service. It pays to defend and settle claims that your service failed a client: a negligent configuration, a missed service level, a recovery that did not recover.

What trips providers is the line next door. General liability covers bodily injury and property damage to third parties; it does not turn a client’s economic loss into a covered claim, and a professional-services exclusion is where that line gets drawn. A bad patch, a misjudged change window, or a service that did not meet the SLA is a professional-liability matter, and the boundary between the two is read from the policy, not assumed.

In practice you carry this one because the client made you. The MSA’s insurance exhibit names the limit and conditions the deal on proof, and the number in your largest contract is the floor, not a suggestion. Two details earn the attention they rarely get. First, whether the policy’s definition of “technology services” actually includes managed services and not just software. Second, whether a contract-liability exclusion can push a breach-of-MSA claim back outside coverage — forms advertise “failure to perform” while carrying exclusions that can cut the other way.

2. A breach of the client systems you manage

Ransomware, a compromised credential, or a privilege you held that an attacker abused exposes the very systems you were engaged to protect. Two enforcement paths hit you at once, and that is what makes this exposure different from the first. Your client can sue or demand coverage under the MSA — but the client’s own regulators can also act under state breach law and sector rules, whether or not the client complained. The contract is one trigger; the statute is another.

The coverage is cyber, and what makes it heightened for an MSP is the access itself: you hold privileged credentials across many clients, so one failure of your environment can cascade into many. Most MSPs buy cyber blended with technology E&O in a single policy. The distinction that matters is first-party versus third-party. The client’s suit after a breach sits on the E&O side; the cost of your own forensic, notification, and ransomware response is first-party cyber, and a standalone E&O form leaves that side bare. Clients who understand the model ask for a higher cyber limit precisely because you sit inside their perimeter. The mechanics of what cyber responds to live on the sister library, isthiscovered.org.

3. The line where technology E&O ends and cyber begins

A service failure can exist without a breach — a bad configuration takes a client offline but nothing was exfiltrated. A breach can create obligations beyond the service error — you restored the backups, but the client still owes notification and credit monitoring to its own customers. One event can walk across both lines, which is exactly why clients require both coverages and why the boundary is read from the policy, not assumed.

The split is mapped in cyber insurance versus tech E&O; the practical consequence is a boundary dispute when E&O sits with one carrier and cyber with another, each pointing at the other on the overlap claim. Buying both from one carrier closes that gap, and most MSP forms ship that way. The thing to verify is the definition of “technology services” and whether the cyber module is inside the form or missing — the label matters less than the insuring agreement.

4. A firing or contractor-reclassification claim lands

Your first real termination, a reduction in force, or a dispute over whether the technician you paid as a 1099 was really an employee. The former worker — or a candidate you never hired — alleges discrimination, harassment, or retaliation. The coverage is EPLI.

This one is unlike the others, and the difference matters: nothing requires it. No client, no landlord, no statute demands EPLI. It is a judgment call, and that is exactly why it is underbought. The exposure starts at your first hire, because every hiring, pay, discipline, and termination decision is a potential claim that none of your other policies will answer — general liability, workers’ comp, and tech E&O all exclude employment acts. The EEOC identifies retaliation as the most frequently alleged basis of discrimination, which compounds quietly: whatever you do after an employee complains can become a second claim even when the first fails. Contractor reclassification is its own flavor — the same technician whose status you misjudged can trigger a state employment-tax or workers’-comp inquiry alongside the discrimination claim. The policy’s most-used benefit is paying for a defense that ends in no finding of wrongdoing.

5. Someone is hurt or property is damaged on your premises

A visitor injured at your office, a technician who damages a client’s equipment on site, or gear stolen from your depot. The coverage is general liability for bodily injury, property damage, and certain advertising injuries; it is the one line where the claim and the stakes are both comparatively predictable.

For an MSP this is real but modest at the office — and potentially sharper in the field, where a technician is physically inside a client’s site. What makes it non-optional is the lease. Commercial landlords require general liability, commonly at $1 million per occurrence, and name the landlord additional insured. If you operate an equipment or staging depot, the premises exposure and the property value both climb.

The decisions that are actually yours

Strip away the requirements and a pattern emerges across the five. The same three questions decide almost every line, and buyers conflate them constantly:

Exposure	Legally required?	Someone will require it?	Prudent even if not?
Technology E&O	No	Yes — client MSA	Yes, before you take on a client’s systems
Cyber	Partly — state breach law	Yes — client MSA	Yes; you hold access others don’t
EPLI	No	Sometimes — board or investor	Yes, at your first hire
General liability	No	Yes — your landlord	Premises or field-installation exposure

Those are different reasons to buy the same policy, and they point at different limits. The genuine decisions — the ones a brochure will not make for you — are narrower still. Size limits against your worst single exposure, not a generic tier. The floor is whatever your largest MSA demands; the sanity check is the most plausible loss from one failure — a multi-client outage or a cascade breach — defense costs included. Read the claims-made trigger before you switch carriers. Most E&O and cyber policies respond when the claim is made, not when the work happened, so a changed retroactive date or a lapsed policy can open a gap over managed-services work you performed years ago. Decide where cyber ends and tech E&O begins for the services you actually run, because underwriters draw that line in the policy’s definition of technology services and your MSA may require both separately.

A short checklist

1. Signed a first MSA → read the insurance exhibit; the limit it names is your tech E&O and cyber floor.
2. Onboarded a regulated client → expect a higher cyber limit and a security schedule; the certificate and the additional-insured endorsement are separate documents.
3. Made your first hire → get an EPLI quote and decide on numbers, not on category; confirm contractor status before a reclassification claim does it for you.
4. Signing a lease or opening a depot → confirm the general-liability limit and the additional-insured endorsement before you take the keys.
5. Renewing or switching carriers → check the retroactive date and prior-acts language before you replace a policy.

---

Sources are linked below. This playbook frames the liability exposures; the coverage mechanics — forms, certificates, mandates, claims — are on isthiscovered.org, and each exposure above links to its own question page for the sourcing behind the claim.