Insurance and indemnification in technology contracts

Reference article · 5 min read

Insurance and indemnification are where a technology contract settles who pays when something goes wrong. Insurance is a promise by an insurer to pay certain kinds of loss up to a stated limit. Indemnification is a promise by the vendor to defend and pay claims that someone else brings. A contract needs both, and they should line up: the coverages required should respond to the risks the vendor has agreed to indemnify.

Vendors negotiate these terms constantly. Some objections reflect how the insurance market works, and others are a request that the agency carry the risk instead. What follows is what each requirement actually does.

The coverages commonly required

• Commercial general liability. Bodily injury and property damage to third parties, such as damage to a facility during an installation. It generally does not reach defective software or professional advice, and many forms exclude electronic data.
• Professional liability, also called errors and omissions or technology E&O. Negligent acts and omissions in performing services: flawed design, missed requirements, defective code, bad advice. This answers the core risk of a software engagement.
• Cyber liability. Privacy and network security exposure: forensics, notification, and credit monitoring costs, liability to affected individuals and regulators, and often business interruption and extortion coverage. Forms vary widely, so the insuring agreements matter more than the label.
• Workers compensation and employers liability. Statutory, and required wherever the vendor's employees work. Requirements differ by state.
• Commercial automobile, including hired and non-owned. Needed where staff drive to agency sites, including in personal vehicles.

Cyber and professional liability are sometimes written on one policy with a shared limit. Ask which it is, because a limit exhausted by a breach leaves nothing for a performance claim.

Certificates, endorsements, and the wording that matters

A certificate is evidence that a policy existed when it was issued. It is not the policy and confers no rights. Endorsements are what change coverage.

• Additional insured status. Extends the vendor's liability coverage to the agency for liability arising out of its work, and is standard on general liability and auto. Professional liability covers the insured's own negligence and is generally not endorsed this way, so a vendor declining there is describing the market.
• Primary and noncontributory. The vendor's policy pays first and does not seek contribution from the agency's coverage, retention, or risk pool.
• Waiver of subrogation. The insurer gives up its right to pursue the agency after paying a claim.
• Notice of cancellation. Insurers often will not promise notice, so put that obligation on the vendor.
• Retentions and insurer quality. A large self insured retention held by a small firm is a solvency question. State an acceptable rating.

Keeping coverage in force, including the tail

General liability is usually occurrence-based, responding to incidents during the policy period whenever the claim arrives. Professional liability and cyber are usually claims-made, responding only when the claim is made and reported during that period. So set a retroactive date on or before the start of work, and require claims-made coverage through the term and for a defined period afterward, by renewal or by an extended reporting period, commonly called a tail. Choose the length with counsel, and verify renewal certificates annually, because lapsed coverage is usually discovered after a loss.

Indemnification for third party claims

Indemnity addresses claims brought by someone else, not the agency's own direct losses. The mechanics that matter are the duty to defend, who controls counsel, and the agency's right to participate.

• Intellectual property infringement. The vendor should defend claims that the product infringes a patent, copyright, trademark, or trade secret. If use is enjoined, its remedies should be to procure the right to continue, or to replace or modify without loss of function, with a refund as the last option rather than the only one. A refund is poor compensation to an agency that has already migrated its records.
• Data breach and privacy. The vendor should indemnify third party claims arising from its failure to protect agency data, separate from its direct obligation to pay breach response costs.

State law matters here. Some states restrict indemnity for a party's own negligence, and many public entities are limited in indemnifying a vendor in return. Confirm the rule with counsel.

Where limitation of liability meets those promises

The common proposal is a cap equal to fees paid, often fees in the preceding twelve months, plus a waiver of consequential damages. Applied without exception, it makes the indemnities close to meaningless, since defending one privacy claim can exceed a year of fees. Shape the cap rather than reject it.

• Exclude the third party indemnities from the cap, intellectual property in particular, along with gross negligence, willful misconduct, and the insurance obligations.
• Set a separate, higher cap for data protection if a full carve-out is not achievable, sized in relation to the cyber limits required.
• Define what counts as direct damage. Name notification, credit monitoring, forensics, and substitute services, so the consequential damages waiver does not remove them.
• Say that insurance limits are not a cap on liability, or the required limits will be read as the ceiling.

What to ask and what to require

1. Put these requirements in the solicitation, require bidders to state exceptions with their proposals, and decide in advance which terms are firm.
2. Scale requirements to the work, with tiers based on data sensitivity and contract value.
3. On significant awards, ask for declarations pages and endorsement forms, not only the certificate.
4. Ask what the retroactive date and retention are, and whether subcontractors and hosting providers carry their own coverage.
5. Require certificates and endorsements before notice to proceed, flow-down to subcontractors, and renewal evidence annually.

HQT works with state and local agencies on technology delivery and advisory work, including technical review of vendor security practices to support these conversations with counsel and risk management.

Frequently asked questions