Short answer
Contracts that require cyber coverage usually list cyber liability in the insurance section next to professional liability and general liability. The clause typically names a minimum limit and sometimes adds conditions. Read the exact wording before you sign, because the requirement and your current policy may not match. Whether a policy satisfies a clause depends on its terms, exclusions and endorsements.
Where contracts that require cyber coverage show up
Cyber requirements tend to appear in the insurance exhibit or the insurance article of the agreement. Some firms first see them in a vendor onboarding form or a prime consultant’s subcontract template.
Owners, developers, public agencies and larger consulting firms may all include them. A requirement can also arrive after you have already won the work, which is a common reason firms scramble to buy a policy.
If the contract is silent on cyber, a client may still ask about it in a security questionnaire. Treat those questions as part of the same conversation.
What does the clause usually ask for?
Language varies, so use the list below as a guide to what to look for rather than a standard.
- A minimum limit of liability, stated per claim or in the aggregate.
- A description of the coverage, using terms such as network security, privacy liability or data breach response.
- A requirement to keep the coverage in force for a set period, sometimes beyond the end of the project.
- A request for a certificate of insurance as proof.
- Occasionally, a request to name the client as an additional insured.
Each of those items needs to match something specific in your policy. If a clause uses a term your policy does not use, ask your broker how the two line up.
Want this looked at for your firm?Tell us what your firm does. A specialist reviews it and comes back with options.
Get a Quote →How to compare a cyber clause with your policy
Start with the limit. Then check whether the policy’s coverage grants line up with the wording in the contract. Look at retentions, sublimits and exclusions too, since a policy can show a large headline limit while limiting certain coverages to lower amounts.
Also check whether the policy responds to claims made against you, costs you incur or both. The clause may expect one and your policy may provide the other.
Our Cyber Liability page describes the main coverage areas. If you need to buy a policy, the cyber application shows what carriers ask about your controls.
Example: a cyber requirement in an engineering subcontract
A hypothetical engineering firm receives a subcontract from a prime consultant. The insurance section lists professional liability, general liability and cyber liability, with a minimum limit for each. The firm carries the first two but has no cyber policy.
Before signing, the firm sends the section to its broker. The broker explains the requested coverage and the limit, and the firm decides whether to ask the prime consultant about the wording, buy a policy or both. The firm also confirms whether the certificate of insurance has to be delivered before work starts.
The details of any real clause will differ, so the actual contract language should guide each step.
What to check before you sign
- Which insurance coverages does the contract list, and at what limits?
- Does the clause describe the cyber coverage in terms you can match to a policy?
- When must you deliver proof of coverage?
- How long must the coverage stay in force?
- Can the client ask for changes to your policy or additional endorsements?
- Does the project involve sensitive data that raises the stakes?
Our Insurance Requirements Check can help you identify what a contract is asking for.
Do I need cyber insurance to sign a client contract?
Only if the contract requires it. Read the insurance section, and ask the client if the wording is unclear.
Can I negotiate a cyber coverage requirement?
Sometimes. Clients may adjust limits or wording on request, especially for small firms. Your broker can help you frame the question.
Does professional liability satisfy a cyber requirement?
Not automatically. Professional liability and cyber liability are separate coverages, so check how the clause describes what it wants.
Contract checkSend us the contract before you sign.
We read the insurance and indemnity sections against your actual policies and tell you what we see.
