When you sign or renew an MSP or technology supplier contract, its SLA, security warranty or indemnity can create uninsured liabilities. Map each promise against cyber and professional indemnity cover before signing. Seek broker or legal advice on unclear clauses.
When contract promises exceed cyber cover
Cyber insurance covers defined events, not every sentence in a contract.
A service level agreement (SLA) sets expected standards, such as uptime or response times. An indemnity promises repayment for certain losses. A security warranty confirms that stated controls are in place.
Cyber cover may fund breach response and system restoration. Professional indemnity may cover negligent work. Neither policy automatically pays unlimited contract promises.
A contract promise can cost more than a cyber claim.
Negligence is not every promise
Negligence arises when a business fails to meet a reasonable standard of care. Contractual liability exists because the business agreed to take on an obligation.
Phrases such as “regardless of fault” or “all losses” can create uninsured exposure. So can “guaranteed availability” or “hold harmless”.
A policy may exclude liability accepted under a contract. Cover may apply only where liability would have existed anyway.
Limits, sub-limits and retention
A policy limit is the most an insurer pays for covered claims. A sub-limit is a smaller pot for a specific risk. A retention is the amount your business pays first.
A £1 million contract cap does not increase a £250,000 cyber sub-limit. Think of the sub-limit as a smaller wallet inside the main policy wallet.
Check the smallest relevant limit before you accept a promise.
Clause-to-cover matrix for MSP deals
Review the wording line by line.
The matrix helps customers, MSPs and technology suppliers spot duties that may exceed normal cyber or professional indemnity cover. It is a starting point, not a policy interpretation.
| Contract clause | Possible policy response | Question to ask |
|---|
| SLA, uptime or service credits | Tech E&O may cover negligent service failure. | Are fixed credits or guaranteed uptime excluded? |
| Security warranty | Cyber cover may fund response and restoration. | Does an absolute promise breach a policy condition? |
| Indemnity or hold harmless | May cover only liability existing without the contract. | Does it include all losses, fines or third parties? |
| Liability cap | Does not increase policy limits. | Is it per claim, annual aggregate or uncapped? |
| Breach notification | Legal and notification costs may be covered. | Who tells the ICO, customers and insurer? |
| Supplier failure | Contingent business interruption may apply. | Are cloud and subprocessor outages included? |
SLAs and downtime clauses
An SLA should state measurable levels and realistic remedies. A 99.9% monthly availability promise allows roughly 43 minutes of downtime in a 30-day month.
A 99.99% promise allows roughly 4 minutes of downtime. Exclude planned maintenance, customer-caused outages and wider internet failures.
State whether service credits are the sole remedy. This can stop a small outage becoming a much larger damages claim.
Indemnities and supplier evidence
Ask for more than an insurance certificate. It rarely shows exclusions, territory, retroactive date, retention, sub-limits or subcontractor cover.
Suppliers should explain whether cyber and professional indemnity cover extends to cloud hosts. They should also confirm cover for sub-processors and overseas support teams.
A certificate proves insurance exists, not what it pays.
The three-party review before renewal
Bring the broker in early.
List each vendor, cloud platform, subprocessor and MSP. Then mark administrator access, backup locations, UK data transfers and dependencies that could stop trading.
Security schedules should promise controls that you can prove. Examples include MFA, EDR, tested backups and incident contacts.
✅
Our recommendation
A FIDO2 USB security key can support MFA for privileged MSP and administrator accounts. It is most useful for access to customer systems, backups or Microsoft 365 tenant controls.
- Reduces reliance on passwords for high-risk administrator logins
- Creates a physical authentication step for remote access accounts
- Supports evidence of stronger access controls during insurance renewals
Check availability →
Map access, data and dependencies
The business explains the data and services involved. The vendor explains what it can genuinely deliver.
The FCA-authorised broker tests whether the policy wording responds. This three-party review compares the promise, the proof and the policy.
A common case involves an MSP with full backup access. Its contract promises rapid recovery, but the policy has a lower outage sub-limit.
Test the policy wording
Send the draft SLA, data processing agreement and security schedule to the broker. Send the indemnities and insurance clause too.
Ask about contractual liability, supplier outage and regulatory investigations. Ask who can appoint breach-response advisers.
Keep a written record of what is insured, excluded, self-funded or subject to a sub-limit. This record matters when staff change or a claim arrives.
Wording traps that need negotiation
Avoid absolute promises where evidence is limited.
A safer limitation clause can cap total liability at a defined sum. This is often between 100% and 200% of fees paid in the previous 12 months.
Keep careful carve-outs for liabilities that the law does not allow you to limit. The right cap depends on the service, data and likely loss.
The most common error is treating a liability cap as insurance.
Clauses to ask your solicitor about
Limit indemnities to third-party claims caused by your proven breach, negligence or unlawful act. Promise named security controls instead of promising that no breach will occur.
Avoid admitting liability or settling claims without insurer consent where the policy requires it. An early admission can make an insurer challenge cover.
High-risk deals need tailored legal and insurance advice. These include payment processing, NHS-linked services, special category data and international transfers.
Seek legal and insurance review where the contract includes special category data, essential services, international transfers, payment processing, sector rules or high financial exposure. This is not the main framework for low-risk software that has no access to systems, personal data or business continuity.
FAQs
Does cyber insurance cover every MSP contract?
No, cyber insurance does not automatically cover every MSP contract promise. It may cover breach response and some third-party claims. A voluntary indemnity or guaranteed SLA can fall outside cover.
What clauses should an MSP review for insurance?
Review SLAs, security warranties, indemnities, liability caps, incident notices and subcontractor terms. Also give the DPA and insurance requirements clause to the broker before signature.
Does a liability cap match my insurance limit?
No, a contract liability cap and a policy limit are separate figures. A £500,000 contract cap can exceed a £250,000 sub-limit. It can also be restricted by a £5,000 retention.
Can an SLA guarantee 99.99% uptime?
Yes, but 99.99% uptime allows only about 4 minutes of downtime in a 30-day month. Check exclusions, service-credit remedies and cover for related losses.
Is a supplier insurance certificate enough?
No, an insurance certificate alone is rarely enough. Ask about policy type, limits, retention, exclusions, territory, renewal date and subcontractor cover.
What is contractual liability in cyber insurance?
Contractual liability is liability accepted because of contract wording. Many policies cover it only when the same liability would exist without that extra promise.
Should a small business use a broker and solicitor?
Yes, use both for material MSP or technology contracts. A broker tests insurance response. An English commercial solicitor checks enforceability and risk allocation.
Align the promise, proof and policy
The essentials:- Match every SLA, warranty and indemnity to a real policy response before accepting it.
- Check sub-limits and retention, not just the headline cyber insurance limit.
- Ask for supplier policy details, not only a certificate of insurance.
- Use a three-party review whenever scope, data access or security duties change.
For a renewal or new supplier agreement, send the draft to your broker and solicitor together. Keep their answers with the policy schedule.
Clear written answers are your best evidence later.
Must a supplier tell us about a data breach?
No, UK GDPR does not impose a universal 72-hour supplier deadline. The 72-hour period usually applies to a controller notifying the ICO.
Supplier contracts often require much faster notice. Agree who tells the ICO, customers and insurer before an incident happens.
Related sources
These articles can help you explore the topic in more depth:
