Guides / COI basics

Cyber Liability on a Certificate of Insurance: When to Require It from Vendors

By SubCover HQ · Updated Nov 4, 2026 · 2 min read

Most COI programs focus on general liability, auto, and workers' comp. But a growing share of vendors, from the IT company managing your network to the software that holds tenant or resident data, can cause losses those policies weren't built for. That's where cyber liability comes in.

Which vendors to ask

• Managed IT and network providers with access to your systems.
• Property management, accounting, or payment software that stores tenant, resident, or customer data.
• Access control, camera, and smart-building vendors connected to your network.
• Anyone who processes payments or handles personal information on your behalf.

What cyber liability usually covers

Cyber policies vary a lot, but they commonly include third-party coverage for claims arising from a data breach or network security failure, and first-party coverage for the vendor's own costs such as breach notification, forensics, and restoring data. Many technology vendors buy it together with professional liability as technology errors and omissions. See our professional liability guide.

Checking it on the ACORD 25

1. Cyber has no dedicated row. Look in the Other row or the description box for a cyber, network security, privacy, or technology E&O policy with its own policy number, dates, and limit.
2. Cyber is almost always written on a claims-made basis. Note the retroactive date if it's listed, and expect continuous coverage after the contract ends. See claims-made vs. occurrence.
3. Compare the limit against your contract. Your insurance professional and the size of the data or systems involved should drive the number.
4. Confirm the named insured matches the vendor you contracted with.

Key takeaways

If a vendor touches your data, your network, or your payments, general liability probably won't cover a breach they cause. Require cyber or technology E&O in the contract, look for it in the Other row, and track its claims-made dates. SubCover HQ collects and reviews vendor certificates against your requirements and tracks every expiration, for $99/month.

Frequently asked questions

Where does cyber liability appear on a COI?

There's no dedicated row on the ACORD 25. It usually appears in the Other row or the description box with its own policy number, dates, and limit.

Is cyber liability claims-made?

Almost always. Check the retroactive date and require coverage to continue after the contract ends.

Which vendors should carry cyber liability?

Vendors with access to your systems, data, or payments, such as IT providers, property software, access control, and payment processors.

This guide is general information, not insurance or legal advice. Cyber coverage varies widely; your insurance professional and attorney determine what you should require.