Short answer
A cyber insurance limit requirement from a larger client can far exceed what a small design firm carries. Many small firms carry $1M in cyber coverage. Before you buy more, ask the client what data you will touch and whether a lower limit is acceptable. Many requirements come from templates, and clients often accept a reasonable counter. Pricing depends on the firm, state, claims history and limits.
Why clients add a cyber insurance limit requirement
Larger architecture and engineering firms now push cyber requirements down to their consultants. Several factors drive this. Data breaches and wire fraud have hit large firms, and their own insurers ask about vendors. Template contracts then carry the same language to every consultant.
Fake payment instructions are a common example. The FBI’s Internet Crime Complaint Center tracks business email compromise, and design firms that handle invoices and payments can face the same risk.
A small firm often receives the requirement without any explanation. The client may not have looked at the size of the project when the template went out.
What cyber insurance does for a design firm
Cyber liability coverage helps a firm respond when its systems or data are compromised. The exact terms vary by carrier and policy. Common features include:
- Breach response costs, such as notification and forensic work
- Ransomware and extortion response
- Business interruption after a system outage
- Social engineering coverage, which may apply to fake payment instructions
Many firms assume their general liability or umbrella policy handles these losses. Those policies usually exclude or limit cyber events. Cyber is typically a separate policy, so check your own wording.
The CISA small business guidance covers practical security steps that also help during underwriting.
Why a huge cyber insurance limit may not fit
A very high limit can be hard to justify for a small firm. Carriers price large limits based on the firm’s size, data and controls. Availability for small firms can also be limited. Cost may rise sharply as the limit rises, though the amount depends on the firm and the carrier.
Contract size matters too. A small project may carry a fee that is a fraction of the premium for the requested limit. When the requirement and the work do not match, the requirement may deserve a closer look.
How to respond to a cyber insurance limit requirement
You can often keep the conversation professional and practical. Work through these steps:
- Ask what data you will access and which systems you will connect to.
- Send your current certificate and ask whether your existing limit works.
- Offer a limit tied to the contract value or a project-based solution if the client needs more.
- Ask your agent to price the requested limit so you know the real cost before deciding.
Many clients accept a reasonable counter once they see what the firm carries. Keep the tone cooperative and explain your reasoning briefly.
When it is worth buying more
Sometimes a higher limit makes business sense. A client that represents a large share of your revenue may justify the cost. Holding sensitive client data can also raise the stakes.
This is a business decision. Compare the premium, the contract value and the risk of losing the client. Whether a policy responds to a loss depends on its wording, exclusions and the facts.
What we see at Hardcover
A small landscape architecture firm received a request from a larger client for a cyber limit far above the $1M it carried. The project was small, and the requirement looked like template language.
We talked through asking the client whether the existing limit would work before pricing a much larger policy. That order saved the firm from chasing a quote it might not have needed.
Related questions
How much cyber insurance does a small design firm need?
Many small firms carry $1M. The right limit depends on the data you hold, your clients’ requirements and what a breach could cost you.
Can I negotiate an insurance requirement in a contract?
Often, yes. Many requirements come from templates. Ask the client whether a lower limit is acceptable and explain why.
Does my general liability or umbrella cover cyber?
Usually not. Cyber is typically a separate policy. Review your actual policy wording to confirm.
What if the client will not lower the requirement?
You can ask your agent to price the requested limit, then compare it with the contract value. Some firms choose a project-specific solution or decide to pass on the work.
General education, not legal advice. Hardcover is an insurance agency, not a law firm.