Liability insurance policies: Tips for covering MSP businesses

Why purchase liability insurance policies?

"Insurance, specifically cyber liability insurance, is important because it provides MSPs with additional coverage for situations where they are at fault and there is harm to the customer," explained Charles Weaver, co-founder and CEO of the industry group MSPAlliance. "Many MSPs do not have sufficient coverage, as they usually have general liability or professional liability coverage, which does not tend to address cyberattacks, data loss and other similar events."

Michael Corey

"When you take over someone's IT environment and they're trusting you to run their business and something goes wrong, they're going to look at you -- whether right or wrong -- as being the responsible party," added Corey, who is also an advisory member to the MSPAlliance. "It's just the reality of the world."

Without professional liability insurance, the customer has no remedy in the event of an incident on the part of the MSP. It opens MSPs up to the possibility of a lawsuit, noted Rob Scott, managing partner of Scott & Scott LLP, a legal firm based in Southlake, Texas, that specializes in MSP law, and who works with the MSPAlliance. The firm helped MSPAlliance develop a liability insurance policy.

Charles Weaver

"One side or the other is left holding a disproportional level of risk, so when it comes to risk balance, the liability insurance allows a service provider to offer an acceptable amount of coverage to each customer with a fixed premium," Scott said. "Bringing in a professional liability insurer allows a transfer of the risk to a third party so that neither the customer nor the MSP has to bear a disproportionate burden of risk."

Rob Scott

Some of the common risks MSPs could face if they don't have liability insurance policies include claims related to data breaches, Scott said. For example, if an MSP is responsible for maintaining a customer's server, doesn't patch it, and the server gets hacked, compromising the customer's data, the customer can sue the MSP for the cost of the forensic investigation and, potentially, the loss of its end customers as well.

Another type of claim stems from ransomware attacks. If the MSP fails to provide adequate security measures to prevent an infection, the customer's business is shut down for a number of days.

Data breach, data loss and business interruption are typically the three areas where MSPs are most frequently sued, Scott noted.

Liability insurance policies for MSP business models

Weaver declined to say how many members of MSPAlliance have purchased the organization's liability insurance policy, but he said the number of MSPs that do is increasing. He said it can be very challenging to obtain liability insurance policies via traditional insurance brokers.

When you take over someone's IT environment ... and something goes wrong, they're going to look at you -- whether right or wrong -- as being the responsible party.

"Most insurance brokers have no clue what a managed service provider is or what they do," Weaver said. "Typically, we hear a lot of stories about misclassifying MSPs into the wrong category, which in turn provides them with the wrong coverage and inaccurate pricing."

For example, brokers commonly categorize MSPs under "computer retail," he said. Having a program geared specifically at the MSP profession can simplify the approval process and ensure a more accurate fit with the right coverage, Weaver said.

MSPAlliance was "way ahead of the curve when we introduced our product" in 2008, and at that time there were no viable liability insurance policies for MSPs, Scott said. The MSP insurance product scales to companies with up to $10 million in revenue. The cost is based on the MSP's revenue, and he said he has seen policies for the product ranging from $2,500 a year to $10,000 a year. Typically, MSPAlliance's policy runs between $3,000 and $3,500 for an annual policy, he said.

It used to be challenging to obtain liability insurance via traditional insurance brokers but that has changed, Scott said. "At the time we launched the MSPAlliance program, we were getting feedback from members they were having trouble getting insurance from traditional brokers but ... more carriers and brokers are familiar now with professional liability insurance for technology."

Liability insurance policies allow "an MSP to change the terms of a service contract to be more customer-friendly and more competitive in the marketplace without taking on any extra risk,'' he added.

Tips for obtaining MSP insurance coverage

Scott said MSPs should speak to its insurance advisor and explain they need professional liability coverage for technology services. Then they need to carefully evaluate the specific coverages that are available under each of the liability insurance policies considered.

"Every insurance company packages their professional liability coverage in slightly different ways. There are things that are covered and things that are not covered, and you have to do a comparison," he stressed.

It's also important to "take a fresh look at your customer contracts after you get the liability insurance because there are provisions in the customer contracts that could be affected by the existence of insurance," Scott added. "After you get insurance, it makes good sense to have an attorney look at your customer contracts and make sure your contracts with your customers align with your insurance contracts."

Liability insurance policies allow MSPs "to offer something that the market requires in light of the threat landscape," Scott said. "Customers are now expecting MSPs to take on more responsibility than six months of fees, and how can an MSP do that without risking their business? They use the insurance to do it."