A data center aisle at night, locked server racks with status lights and bundled network cabling, an operations room behind glass — MSP and IT service provider cyber liability

California commercial insurance

MSP & IT Services Cyber Insurance CA

Managed service providers are not ordinary cyber insureds. An MSP may hold administrator credentials, deploy endpoint tools, manage backups and remotely access dozens or hundreds of client environments — a compromise of the MSP can create a one-to-many loss affecting many customers at once.

Downstream Client Claims
Cyber & Tech E&O
Ransomware

Reviewed by David Gleason, Principal — October 11, 2026

Start Quote Now 844-978-7283

Next Level Experience. Insurance Done Right.

Request a Quote Call 844-978-7283 See FAQs

CaliforniaGeneral information only, not legal advice — illustrative scenarios and coverage, subject to change without notice. Content may be out of date or contain errors, and requirements vary by city, county, state, agency, project, contract, carrier and policy, among other factors; verifying what applies to your own situation is your responsibility. Full disclaimer

Prefer to send everything at once? Complete a streamlined submission — just needs your review. Especially worth it if your business does $2M+ in annual sales — it can meaningfully speed up carrier turnaround.

Interactive coverage guide

Build a coverage stack around how the business actually operates.

Start with the preselected industry or trade, then adjust the operational questions. The commonly considered stack updates live. Keep the coverages you want GIB to evaluate, remove ones you do not want included in your quote request, and add other available lines before continuing.

Common Starting Coverages

Professional Liability / E&OErrors in professional services or advice

What it is

Professional Liability may address covered claims alleging errors, omissions or failures in professional services.

Why businesses like yours commonly carry it

Technology and IT firms may face claims alleging service failure, implementation errors or missed contractual obligations.

Possible coverage gap

General Liability is generally not intended to replace coverage for economic loss arising from professional errors.

Learn more about Professional Liability / E&O

Cyber Liability & Data BreachCyber events, data and system interruption

What it is

Cyber insurance may address certain first-party and third-party losses from covered data breaches, cyberattacks, ransomware and system interruption, depending on the policy.

Why businesses like yours commonly carry it

Technology firms' operations and contractual obligations often depend directly on systems, data and service availability.

Possible coverage gap

General Liability generally should not be assumed to address data breach response, ransomware or network interruption.

Learn more about what cyber insurance costs in California

Commonly Added Based on Operations

General LiabilityThird-party injury and property damage

What it is

General Liability commonly addresses covered third-party bodily injury, property damage and certain personal or advertising injury claims, subject to the policy.

Why businesses like yours commonly carry it

Businesses commonly use it as a starting liability policy and to satisfy customer, landlord or contract requirements.

Possible coverage gap

General Liability is not intended to replace policies for employee injuries, business vehicles, owned property, cyber events or professional errors.

Learn more about General Liability

Exposure-Dependent Coverages

Business Owners Policy / Commercial PackageLiability and property components evaluated together

What it is

A Business Owners Policy commonly combines liability and property coverages for eligible businesses. A Commercial Package Policy may combine multiple commercial coverage parts depending on the account and carrier.

Why businesses like yours commonly carry it

Businesses with premises, contents, inventory or other property exposures may ask GIB to evaluate whether liability and property components can be packaged where appropriate.

Possible coverage gap

Eligibility, included coverages and package structure vary by carrier. Commercial Property may also be written separately rather than as part of a package.

Learn more about Business Owners Policy / Commercial Package

Employment Practices LiabilityEmployment-related allegations

What it is

EPLI may address certain covered employment-related claims such as discrimination, harassment, retaliation or wrongful termination.

Why businesses like yours commonly carry it

Businesses with employees or managers commonly consider employment-practices protection as the workforce grows.

Possible coverage gap

Workers Compensation and General Liability generally do not replace employment-practices coverage.

Learn more about Employment Practices Liability

Umbrella / Excess LiabilityAdditional limits above scheduled liability policies

What it is

Umbrella or Excess Liability may provide additional limits above identified underlying liability policies, subject to its own terms and exclusions.

Why businesses like yours commonly carry it

Businesses with larger contracts, vehicles, public exposure or higher severity potential commonly consider additional limits.

Possible coverage gap

An umbrella does not automatically broaden every exclusion or sit over every policy unless the issued terms say it does.

Learn more about Umbrella / Excess Liability

Do you have specific insurance requirements from a project, customer, vendor, landlord, lender, lease, or contract?

Yes — I have them nowOpen the Requirements Analyzer to review or upload them.Yes — but I don't have them available yetContinue now and flag the quote for follow-up.No — I don't have specific requirementsContinue directly to the quote request.

Loading quote and requirements options…

Continue With These Coverages

Educational guidance only. Results are not a coverage recommendation, quote, binder, policy interpretation, or guarantee of coverage. Actual needs, availability, forms, limits, exclusions and requirements vary. A licensed insurance professional should review the complete risk and issued policy terms.

Verified Google reviews

What our cyber insurance clients say about us

5.0 / 5from 7 Google reviews

Reviews reflect individual client experiences and are not a guarantee of coverage, pricing or results.

91 Enterprise LLC

March 24, 2026

We are using Gleason insurance for our commercial auto policy and GL policy. David is the best insurance broker I've worked with — very honest, responsive, and knowledgeable. Highly recommend.

Fito Plumbers

February 20, 2026

We have been working with David at Gleason Insurance Brokers for 8+ years. David always goes above and beyond to make sure we have the appropriate coverages. He explains everything in detail and makes sure we feel confident and understand all of our policies. He is always available and responds right away!

Barry Stay

February 17, 2026

David provides great service and I highly recommend him for your insurance needs.

Why Managed Service Providers Carry Concentrated Risk

California MSPs, IT consultants and cybersecurity firms should evaluate cyber insurance together with technology errors and omissions. The question isn't only "what happens if our network is hacked?" It's also "what happens if a customer alleges our service, configuration, advice or security tool failed?"

Attackers have historically targeted trusted service relationships specifically because MSP tools can provide scalable access into many downstream businesses at once — which is why an MSP's own security posture carries outsized consequences.

One compromised MSP can create claims from many clients simultaneously

Cyber and Tech E&O address different questions and both usually matter

Attackers specifically target MSP tools for their scalable downstream access

The MSP's own security posture has outsized consequences for its clients

What an MSP Cyber Policy Commonly Covers

Remote monitoring and management platforms, administrative credentials and service accounts can provide broad access to customer systems. A policy should be reviewed for claims arising from unauthorized access that passes through the MSP environment, and for how privileged credentials are vaulted and protected with MFA.

Failure to patch a system, configure a backup correctly or deploy a security tool can produce a professional-negligence allegation even when the MSP itself was never hacked. Tech E&O addresses this service-performance exposure, and it should be coordinated with cyber so a claim doesn't fall between inconsistent definitions.

Coverage should reach claims from unauthorized access passing through the MSP

Credential vaulting and MFA protection are core underwriting questions

A configuration or patching failure can trigger Tech E&O without a hack

Cyber and Tech E&O should be coordinated, not purchased in isolation

One Intrusion, Many Clients: How the Losses Divide

When an attacker reaches a managed service provider, the losses rarely stop at the MSP. The provider's own costs come first: investigating its remote-monitoring and management tools, rebuilding administrator accounts, notifying anyone whose data was exposed, and the revenue lost while technicians spend every hour on recovery instead of billable work.

The larger exposure is downstream. Each affected client may claim its own downtime, restoration and notice costs, and a single event can produce many claims against one aggregate limit. Some of those allegations will be about the breach and fall under cyber liability; others will allege negligent configuration, patching or advice and fall under technology errors and omissions. Treating the two policies as one program, with limits sized for a multi-client event, is the core of MSP coverage design.

Own costs: investigating RMM tools and rebuilding admin access

Downstream: each client's downtime, restoration and notice costs

One event can produce many claims against one aggregate

Breach allegations go to cyber; negligent-service allegations to Tech E&O

Where MSP Exposure Lives: RMM, Admin Access and Backups

A single event may generate claims from many clients simultaneously. Shared policy limits can be consumed quickly if the MSP has meaningful client concentration — larger providers should evaluate whether primary limits, excess limits and aggregate language realistically match their customer base.

MSA language can require indemnification, specific insurance limits, incident notice and cybersecurity standards. Some contracts attempt to transfer broad liability to the MSP, so cyber and Tech E&O forms should be reviewed against the business's actual agreements, not just a certificate requirement. If your clients include clinics or medical offices, their own exposure is described on cyber insurance for healthcare organizations.

Multi-client aggregation can consume a shared limit faster than expected

Primary and excess limits should match the size of the actual client base

MSA indemnification language can transfer more liability than a certificate implies

Review actual contracts, not just the certificate requirement they generate

California Considerations for IT Service Firms

California privacy and breach-notification rules may become relevant if the MSP holds or controls information involving California residents. More importantly, an MSP may have contractual duties to notify customers much faster than a statute would otherwise require.

Incident response should therefore include both legal review and a customer-communication plan built around the fastest contractual deadline the MSP has actually agreed to, not the statutory minimum.

California rules apply when the MSP holds California-resident information

Contractual notice deadlines are often faster than the statutory minimum

Incident response needs a customer-communication plan, not just legal review

Build the plan around the fastest deadline actually signed, not the statute

An Illustrative Supply-Chain Attack Through an MSP

A threat actor gains access to the MSP's remote-management platform and reaches multiple client systems at once — a single intrusion point becoming a multi-client incident within hours.

In a separate pattern, a customer suffers ransomware and alleges the MSP failed to configure backups according to the service agreement — a professional-negligence claim that may implicate Tech E&O more than a straightforward cyber breach.

This example is illustrative, not a report of an actual case or a promise of how any real claim would resolve — real outcomes depend on the specific policy, the facts involved, and the carrier's own review. For a situation that's actually happened or is happening, talk to your broker, a licensed attorney, or the relevant regulatory authority directly.

A single RMM compromise can reach many client systems within hours

A backup-configuration dispute can raise a Tech E&O claim without a hack

Credential-vault exposure can force emergency rotation across many clients

This is illustrative — real claims depend on the actual policy and facts

Preparing an MSP and IT Services Cyber Submission

Prepare annual revenue, client count, largest-client percentage, number of endpoints managed, RMM tools, privileged-access management, MFA coverage, backup responsibilities, subcontractors and customer contract language.

We structure cyber and Tech E&O together for California MSPs and IT firms and review client contracts for indemnity and limitation-of-liability terms that change the exposure. Call 844-978-7283 or request a quote with Cyber Liability selected.

Expect detailed control questions; what a cyber insurance application asks previews them.

Disclose client count, largest-client concentration and endpoints managed

Describe RMM tools, privileged-access management and MFA coverage

Note subcontractors and how customer contracts allocate liability

Call 844-978-7283 or request a quote to get started

Frequently asked questions

10 questions — start typing to filter

What is cyber insurance for an IT company, and is IT insurance the same thing?

"IT insurance" is how most buyers describe the package an IT firm actually needs, and it is usually two policies rather than one. Cyber covers your own breach, ransomware and outage costs. Technology errors and omissions covers a client alleging your work was negligent — a bad patch, a missed configuration, an outage you caused. An MSP with privileged access to many client networks generally needs both evaluated together, because one incident can produce claims under each.

Why is an MSP harder to insure than a normal IT consultant?

An MSP often has persistent privileged access to many customer systems, so one security failure can create multiple client claims at once — that aggregation exposure changes underwriting.

Does an MSP need Tech E&O if it already has cyber insurance?

Usually it should be evaluated. A customer may allege negligent service, configuration or advice without any breach of the MSP's own network.

Will cyber insurance cover a ransomware event that affects clients?

Coverage depends on how the event occurred, the allegations and the policy wording. The MSP's own response expenses and client liability claims may fall under different insuring agreements.

Do MSP contracts affect cyber insurance?

Yes. Indemnity, warranties, security promises and limitation-of-liability clauses can materially change the MSP's practical exposure beyond what the policy alone assumes.

What controls do cyber underwriters expect from MSPs?

MFA, privileged-access management, segmented administrator accounts, EDR, secure backups, patching, logging and documented incident response are commonly scrutinized.

Can an MSP buy higher limits than its clients require?

Yes, subject to underwriting and available capacity. Required limits should be treated as a floor for contract compliance, not automatically the correct risk limit.

Are subcontracted IT services covered?

Possibly, but subcontractors and outsourced services should be disclosed — policy treatment of vicarious liability and subcontracted professional services varies by carrier.

What is the biggest insurance gap for MSPs?

One of the biggest is the gap between cyber and Tech E&O. Another is assuming a single aggregate limit is adequate for a multi-client event.

How does this compare to a SaaS company's cyber exposure?

A SaaS company's exposure centers on its own platform and customer data; an MSP's centers on privileged access into many separate client networks. See our Technology & SaaS Cyber Insurance page for that comparison.

Official resources

Verify current licensing, regulatory and program requirements directly with the responsible agency — this is general information, not legal advice, requirements change without notice, and what is summarized here may be out of date or contain errors. Confirming what applies to your own city, project, contract and policy is your responsibility.

California Privacy Protection Agency — CCPA RegulationsVerified 2026-09-10 California Department of InsuranceVerified 2026-09-10 California AG — Data Security Breach ReportingVerified 2026-09-10 NIST — Cybersecurity Framework 2.0Verified 2026-10-11

Explore Related Coverage and Resources

Related coverage

Cyber insurance quotes by industry Management liability: D&O, EPLI and crime Professional liability and errors and omissions General liability insurance in California Commercial property insurance Business owners policy for smaller operations Workers compensation insurance in California Umbrella and excess liability limits Commercial auto and fleet insurance

Guides and resources

What a cyber application asks The cyber industries directory Cyber exposure in colocation Technology cyber programs Manufacturing and production businesses Business insurance in California What AI means for business cyber risk

Updated October 11, 2026

Next Level Experience. Insurance Done Right.

One Stop. We Shop. Real Results.

Get a Quote