If you work for a prime contractor, a county, a school district or a university, your contract now asks for two insurance policies most contractors have never bought. Here is what they cover, and how to buy them so your certificate passes the first time.
Your subcontract has a section that lists the insurance you must carry. Next to general liability, auto and workers' comp, you may now see two more lines: cyber liability and professional liability. Professional liability is also called errors and omissions, or E&O.
Two things put them there. The first is federal cybersecurity rules. Any federal contract that involves government information not meant for the public comes with 15 basic safeguards (FAR 52.204-21). The prime contractor must pass them down to subcontractors who store or send that information. Defense work adds stricter rules (DFARS 252.204-7012), including reporting any cyber incident within 72 hours.
You may have heard that the Pentagon paused a plan for outside cyber audits, called CMMC Phase 2, on July 13, 2026. That pause did not cancel the rules above. They still apply to subcontractors.
The second reason is simpler. Prime contractors, counties, cities and universities now make the companies that touch their data carry insurance for it. That is not a law. It is a clause in the contract, and it changes from one contract to the next. Read yours.
One example: Stanislaus County, California, asks IT contractors for cyber or technology E&O coverage of $2,000,000 per claim and $2,000,000 in total. That coverage, with proof, must last five years after the work is done. The county also sets rules on the retroactive date and the tail, two terms explained below. And the contractor's own subcontractors must carry the same.
The contract often lists them on one line. They are two different policies.
Cyber liability pays when hackers attack your computers or your data leaks. It covers your own costs: finding out what happened, fixing your systems, telling the people whose information leaked, credit monitoring for them, ransom demands, and the income you lose while you are down. It also covers privacy lawsuits, regulator costs, and fines where the law allows.
Errors and omissions pays when your work is wrong and it costs a client money. Think of a mistake in the plans, or a setup that crashes a client's system. Nobody is hurt and nothing burns, so general liability does not pay. General liability covers injuries and property damage, not money a client loses because of your work.
IT and software companies can usually buy both in one policy, called technology E&O. Construction trades, engineers and consultants usually buy them separately. If the contract asks for both, you need both.
Five things decide whether your certificate passes. The certificate is the proof of coverage your broker sends to the prime contractor or the agency.
Before they quote, cyber insurers ask about your security. Do you use multi-factor authentication (a code on your phone, plus a password) for email and remote access? Are your backups offline and tested? Is there virus protection on every computer? Do you install updates and train staff? Do you still use software the maker no longer supports? Weak answers can mean a higher price, a lower limit, or no policy.
The good news: that list overlaps heavily with the 15 federal safeguards. The work you do for the contract is also your insurance application. And prices are down: cyber premiums fell an average of 3.2% in the second quarter of 2026, one of the largest drops of any commercial line in the Council of Insurance Agents & Brokers survey. Buy the limit the contract asks for, not the minimum.
This does not mean every subcontractor needs the biggest policy on the market. Your contract and your data set the limit. And the policy does not replace the security work. The insurer pays after something goes wrong. The safeguards keep you on the contract.
¡Sí, hablamos español! Si eres subcontratista de un contratista principal, un condado o una agencia pública y tu contrato exige seguro de responsabilidad cibernética o de errores y omisiones, un corredor licenciado revisa el contrato contigo y cotiza ambas pólizas, en inglés o en español: (888) 585-9910.
New Decade Insurance is an independent brokerage built by agents who have been writing insurance since 2005. Licensed in CA, TX, FL and AZ.
This article is general information, not insurance, legal or tax advice, and not a quote. Contract insurance requirements vary by agency, prime contractor and project; the examples above are taken from public documents as of September 2026 and may change. Coverage depends on the terms, conditions and exclusions of the policy issued.
We read the insurance section with you, quote cyber and E&O from carriers that write government subcontractors in California, Texas, Florida and Arizona, and have the certificate written in the words your prime contractor or agency requires. Get a quote, or call (888) 585-9910.