What insurance does a small business need?

General liability, workers comp where required, professional/E&O for services, cyber if you hold data, and D&O once you have outside investors or a board. Lease and client contracts add requirements.

How much coverage is enough?

Start with $1m/$2m general liability, $1m professional, and $1m cyber as baselines, then size to contracts, payroll, and data risk. Enterprise customers often mandate higher and additional insured status.

How do controls lower premiums?

Documented access reviews, backups, MFA, vendor management, and safety training reduce loss history and improve underwriting — the same controls auditors want.

What is a certificate of insurance?

Proof of coverage for clients and landlords. Track expiry and additional-insured endorsements; lapsed COIs block payments and renewals.

Small Business Insurance 2026: General Liability vs Professional vs Cyber Compared

Coverage Map

Risk	Policy	Trigger
Premises/operations	General liability	Lease, foot traffic
Service errors	Professional / E&O	Client contracts
Data breach	Cyber	PII, payments — see NIST and PCI
Injury	Workers comp	Payroll — see Payroll
Board suits	D&O	Outside investors — see D&O

Pair with Vendor Due Diligence, Procurement Fraud, Compliance Checklist, and Enterprise Risk.

Buying Checklist

Inventory contracts for insurance clauses and limits.
Right-size limits to revenue, payroll, and data.
Implement MFA, backup, access reviews before renewal.
Calendar COI renewals in Month-End Close.
File policies + loss runs for PBC.

Link safety training to Payroll Controls and incident response to Whistleblower.

Worked Example: The $40k Contract That Required $2m Coverage

A $40k/year SaaS deal with an enterprise buyer stalls in legal over insurance: buyer demands $2m general liability, $2m E&O, $2m cyber, and additional-insured endorsement with 30-day notice of cancellation. Current policies: $1m/$2m GL, $1m E&O, no cyber. Options: (a) walk from $40k ARR, (b) buy a $1m cyber policy (~$1,500–$3,000/yr SMB) and raise E&O to $2m (~$800–$1,500 delta), closing the deal in two weeks. The insurance spend pays back 10× in retained ARR — but only if the gap is found during contracting, not at signature. Build an insurance-requirements checklist into the sales process for any deal over $25k ARR: limits, additional insured, waiver of subrogation, and COI delivery SLA. File executed COIs where Month-End Close can find them — lost COIs delay payment as surely as lost invoices.

Cyber Insurance: What Underwriters Actually Score

Cyber applications have become mini security audits. The five controls that move premiums and approvability:

MFA everywhere (including email, VPN, and admin consoles) — see NIST. No MFA = decline or 2× premium.
Tested backups (immutable, offline copy, restore tested) — ransomware payouts hinge on this answer.
EDR on all endpoints with 24/7 response (in-house or MDR service).
Patch cadence with critical-patch SLA under 30 days — see PCI where payments are involved.
Vendor risk process for sub-processors holding customer data — see Vendor Due Diligence.

Answer “in progress” honestly with dated remediation plans rather than aspirational “yes” — misrepresentation voids coverage exactly when claimed. Re-quote annually after remediating the prior year’s conditions; premiums drop as controls mature.

D&O Timing (Before You Need It)

Buy D&O before the priced round closes, not after a claim arrives — prior-acts coverage and continuity dates punish late buyers. Seed-stage: $1m side-A/DIC protection for directors joining the board is often enough to recruit independents. Series A+: $3–5m towers with Side B (company reimbursement) and employment-practices riders. Coordinate with Board composition timing and D&O counsel review — personal assets of directors sit behind this decision. File binders where diligence finds them — see PBC and IPO Readiness.