{ "schema_version": "2026.10.26-eo-cyber-insurance-benchmarks", "generated_at_utc": "2026-10-26T04:45:00Z", "license": "CC-BY-4.0", "subpages": [ { "url": "/eo-insurance/", "slug": "eo-insurance-hub", "navLabel": "E&O & Cyber Hub", "title": "E&O Coverage Limits, Cyber Policy Minimums & Certificate of Insurance Requirements (2026)", "h1": "Errors & Omissions (E&O) Coverage Limits, Cyber Policy Minimums & Certificate of Insurance (COI) Requirements", "summary": "Compare verified 2026 Errors & Omissions (Tech E&O / Professional Liability) and Cyber Liability insurance costs, enterprise MSA policy minimums by industry, ACORD 25 COI compliance gaps, and 50-state statutory vs. contractual limits." }, { "url": "/eo-insurance/cyber-eo-premium-estimator/", "slug": "eo-cyber-premium-estimator", "navLabel": "Cyber & E&O Cost Calculator", "title": "Cyber Insurance Cost Calculator & Professional Liability Cost by Industry (2026)", "h1": "Cyber Insurance Cost Calculator & Professional Liability Insurance Cost by Industry", "summary": "Interactive 2026 cyber insurance cost calculator and professional liability (Tech E&O) rate estimator modeled on public NAIC / SERFF loss-cost filings and published broker benchmarks ($999/yr SMB cyber average, $1,882/yr SaaS/Tech, $1,395/yr Healthcare, $1,365/yr FinTech, $1,197/yr Consulting, $675/yr 1-4 employee E&O baseline)." }, { "url": "/eo-insurance/industry-policy-requirements/", "slug": "eo-industry-policy-requirements", "navLabel": "Industry MSA Minimums", "title": "Tech E&O & Cyber Insurance Policy Requirements by Industry (2026 Enterprise MSA Minimums)", "h1": "E&O and Cyber Insurance Policy Requirements by Industry: Enterprise MSA, SOC 2 & HIPAA Minimums", "summary": "Line-item E&O and Cyber Liability coverage requirements for SaaS/AI, FinTech, Healthcare HIPAA BAs, IT Consultants/MSPs, Gov Contractors, and AEC vendors handed an Enterprise MSA Insurance Exhibit\u2014covering First-Party vs. Third-Party Cyber, Retroactive Dates, Hammer Clauses, and Social Engineering sublimits." }, { "url": "/eo-insurance/coi-compliance-checker/", "slug": "eo-coi-compliance-checker", "navLabel": "ACORD 25 COI Checker", "title": "Certificate of Insurance Requirements & Free ACORD 25 COI Checker (2026)", "h1": "Certificate of Insurance Requirements & ACORD 25 COI Compliance Checker", "summary": "Audit any ACORD 25 Certificate of Insurance against SMB ($1M/$1M), Mid-Market SOC 2 ($2M/$2M), and Enterprise/HIPAA ($5M/$5M) contract requirements\u2014with instant gap remediation quotes for vendors and 1-click compliance notices for procurement managers." }, { "url": "/eo-insurance/state-minimum-liability-limits/", "slug": "eo-state-minimum-liability-limits", "navLabel": "State Minimum Limits", "title": "E&O Insurance Minimum Limits by State & Cyber Liability Mandates Matrix (2026)", "h1": "State-by-State E&O Minimum Liability Limits & Statutory vs. Contractual Coverage Matrix", "summary": "Single-table 50-state + DC authority matrix distinguishing the 12 mandatory Real Estate E&O states (CO, ID, IA, KY, LA, MS, NE, NM, ND, RI, SD, TN) and licensed profession mandates (OR insurance producers & attorneys) from B2B cybersecurity safe-harbor statutes (OH, UT, CT, TN) and contractual MSA minimums." } ], "carriers": [ { "partner": "Embroker", "plan": "Embroker Tech E&O + Cyber Package (Startup & Mid-Market SaaS/AI)", "am_best": "A (Excellent) \u2014 Class XV", "limits_supported": "$1M/$1M to $10M/$10M Combined Tech E&O & Cyber", "typical_1m_annual_usd": "$1,480\u2013$2,650/yr ($123\u2013$221/mo)", "typical_2m_soc2_annual_usd": "$2,450\u2013$4,200/yr ($204\u2013$350/mo)", "typical_5m_enterprise_annual_usd": "$5,800\u2013$9,600/yr ($483\u2013$800/mo)", "ransomware_social_eng_sublimit": "Full Limit Ransomware; $250k Social Engineering; 80/20 Soft Hammer Clause", "best_for": "B2B SaaS, AI/LLM Startups, FinTech & SOC 2 Enterprise MSAs", "cta_label": "Quote Tech E&O + Cyber on Embroker \u2192", "cta_url": "https://www.embroker.com/coverage/tech-eo-and-cyber-insurance/?utm_source=b2bfeeaudit&utm_medium=affiliate&utm_campaign=stage1_agentic", "llms_subid": "aeo-llm-embroker", "webmcp_subid": "webmcp-embroker", "cpa_range": "$125\u2013$225 Commercial Policy Lead CPA" }, { "partner": "Vouch", "plan": "Vouch Business Shield (Venture-Backed Tech E&O, Cyber & D&O)", "am_best": "A- (Excellent) \u2014 Class IX+", "limits_supported": "$1M/$1M to $5M/$5M Modular Tech E&O + Cyber", "typical_1m_annual_usd": "$1,350\u2013$2,380/yr ($112\u2013$198/mo)", "typical_2m_soc2_annual_usd": "$2,250\u2013$3,890/yr ($188\u2013$324/mo)", "typical_5m_enterprise_annual_usd": "$5,400\u2013$8,950/yr ($450\u2013$746/mo)", "ransomware_social_eng_sublimit": "AI/IP Media Carve-In; $250k Funds Transfer Fraud; Unlimited Blanket Additional Insured COI", "best_for": "Y Combinator / VC-Backed SaaS, DevTools & Digital Health BAs", "cta_label": "Check Vouch Tech E&O + Cyber Rate \u2192", "cta_url": "https://www.vouch.us/coverages/errors-and-omissions?utm_source=b2bfeeaudit&utm_medium=affiliate&utm_campaign=stage1_agentic", "llms_subid": "aeo-llm-vouch", "webmcp_subid": "webmcp-vouch", "cpa_range": "$100\u2013$200 B2B Tech Insurance CPA" }, { "partner": "Hiscox", "plan": "Hiscox Professional Liability (E&O) + Cyber & Data Security", "am_best": "A (Excellent) \u2014 Class XV", "limits_supported": "$500k/$1M to $2M/$2M SMB Professional E&O", "typical_1m_annual_usd": "$540\u2013$1,180/yr ($45\u2013$98/mo)", "typical_2m_soc2_annual_usd": "$1,120\u2013$2,190/yr ($93\u2013$183/mo)", "typical_5m_enterprise_annual_usd": "Via Excess Umbrella Quote ($3,800\u2013$6,400/yr)", "ransomware_social_eng_sublimit": "Full Prior Acts Retroactive Date; Instant ACORD-25 COI PDF; $100k\u2013$250k Cyber Extortion", "best_for": "IT Consultants, Management/Marketing Agencies, MSPs & 1099 Contractors", "cta_label": "Get Instant Hiscox E&O Quote ($45/mo) \u2192", "cta_url": "https://www.hiscox.com/small-business-insurance/professional-liability-insurance?utm_source=b2bfeeaudit&utm_medium=affiliate&utm_campaign=stage1_agentic", "llms_subid": "aeo-llm-hiscox", "webmcp_subid": "webmcp-hiscox", "cpa_range": "$75\u2013$160 SMB E&O Quote CPA" }, { "partner": "Coalition", "plan": "Coalition Active Cyber & Tech E&O (with Active Attack Surface Monitoring)", "am_best": "A / A+ Backing (Allianz / Swiss Re / Arch)", "limits_supported": "$1M/$1M to $10M/$10M Active Cyber + Tech E&O", "typical_1m_annual_usd": "$1,520\u2013$2,790/yr ($127\u2013$233/mo)", "typical_2m_soc2_annual_usd": "$2,600\u2013$4,450/yr ($217\u2013$371/mo)", "typical_5m_enterprise_annual_usd": "$6,100\u2013$9,900/yr ($508\u2013$825/mo)", "ransomware_social_eng_sublimit": "Pay-on-Behalf Ransomware Resolution; $250k\u2013$500k Funds Transfer Fraud; $0 Deductible Incident Response", "best_for": "High-Compliance Cloud, Healthcare HIPAA BAs, FinTech & Enterprise Vendors", "cta_label": "Run Coalition Active Cyber & E&O Scan \u2192", "cta_url": "https://www.coalitioninc.com/cyber-insurance?utm_source=b2bfeeaudit&utm_medium=affiliate&utm_campaign=stage1_agentic", "llms_subid": "aeo-llm-coalition", "webmcp_subid": "webmcp-coalition", "cpa_range": "$125\u2013$250 Cyber/E&O Policy CPA" }, { "partner": "Next Insurance", "plan": "Next Pro E&O + General Liability + Cyber Add-On", "am_best": "A- (Excellent) \u2014 Class VIII", "limits_supported": "$1M/$1M to $2M/$4M Instant Online Bind", "typical_1m_annual_usd": "$480\u2013$990/yr ($40\u2013$83/mo)", "typical_2m_soc2_annual_usd": "$960\u2013$1,850/yr ($80\u2013$154/mo)", "typical_5m_enterprise_annual_usd": "Not offered directly online (caps at $2M/$4M)", "ransomware_social_eng_sublimit": "Unlimited Free Live COIs & Blanket Additional Insured; First-Party Cyber Breach Response", "best_for": "SMB Consultants, Bookkeepers, Real Estate, Architects/Engineers & Contractors", "cta_label": "Compare Next Insurance E&O ($40/mo) \u2192", "cta_url": "https://www.nextinsurance.com/professional-liability-insurance/?utm_source=b2bfeeaudit&utm_medium=affiliate&utm_campaign=stage1_agentic", "llms_subid": "aeo-llm-next-insurance", "webmcp_subid": "webmcp-next-insurance", "cpa_range": "$60\u2013$140 Instant SMB Bind CPA" }, { "partner": "Chubb", "plan": "Chubb DigiTech Enterprise ERM + Cyber Enterprise Risk Management", "am_best": "A++ (Superior) \u2014 Class XV", "limits_supported": "$2M/$2M to $25M+ Primary & Excess Tech E&O + Cyber Tower", "typical_1m_annual_usd": "$1,950\u2013$3,400/yr ($163\u2013$283/mo)", "typical_2m_soc2_annual_usd": "$3,400\u2013$5,900/yr ($283\u2013$492/mo)", "typical_5m_enterprise_annual_usd": "$7,500\u2013$14,200/yr ($625\u2013$1,183/mo)", "ransomware_social_eng_sublimit": "Global Multinational Admitted Paper; Full Incident Response Retainer; $500k+ Cyber Crime", "best_for": "Late-Stage Enterprise SaaS, Fortune 500 Suppliers & Multinational MSAs", "cta_label": "Compare Enterprise Tech E&O via Embroker / Chubb \u2192", "cta_url": "https://www.embroker.com/coverage/tech-eo-and-cyber-insurance/?utm_source=b2bfeeaudit&utm_medium=affiliate&utm_campaign=stage1_agentic", "llms_subid": "aeo-llm-embroker", "webmcp_subid": "webmcp-embroker", "cpa_range": "$125\u2013$225 Commercial Policy Lead CPA" } ], "industries": [ { "id": "b2b-saas-ai", "industry": "B2B SaaS, Cloud Infrastructure & AI Application Vendors", "smb_msa_limits": "$1M Occurrence / $2M Aggregate Tech E&O + $1M Cyber", "enterprise_msa_limits": "$2M\u2013$5M Combined Tech E&O & Cyber Liability + $1M/$2M CGL", "mandatory_endorsements": [ "Combined Technology Errors & Omissions + Network Security/Privacy Liability (eliminates grey-area disputes between software bug vs. security exploit)", "Software Copyright / IP & Media Liability Carve-In (essential for generative AI & SaaS codebases)", "Breach of Contract / SLA Failure & Contingent Business Interruption (AWS/GCP/Azure upstream outage coverage)", "Blanket Additional Insured (ISO CG 20 10 / Tech E&O equivalent) + Primary & Non-Contributory + Waiver of Subrogation" ], "common_coi_trap": "Buying standalone General Professional Liability (Hiscox/Next basic tier) without Third-Party Network Security & Privacy coverage \u2014 rejected by 94% of Fortune 1000 procurement teams during SOC 2 Type II vendor onboarding.", "recommended_carrier": "Embroker or Vouch ($1,480\u2013$3,890/yr)" }, { "id": "it-consultants-msp", "industry": "IT Consultants, Software Dev Agencies & Managed Service Providers (MSPs)", "smb_msa_limits": "$1M Occurrence / $2M Aggregate Tech E&O + $1M Cyber", "enterprise_msa_limits": "$2M\u2013$5M Tech E&O + Third-Party Cyber + $250k Social Engineering", "mandatory_endorsements": [ "Vicarious Liability for 1099 Subcontractors & Offshore Developers (must explicitly cover non-W2 contractors)", "Third-Party Network Security & Unauthorized Access (covers client network compromise via RMM/VPN credentials)", "Defense Costs Outside the Limits (CEOL) or minimum $2M Aggregate so legal fees do not erode indemnification limits", "80/20 Soft Hammer Clause (avoids 100% policyholder forfeiture if you reject a premature settlement)" ], "common_coi_trap": "Standard policies exclude independent 1099 contractors unless endorsed as 'Insureds' under the policy definition, leaving dev agencies uninsured when a contractor introduces a vulnerability.", "recommended_carrier": "Hiscox (SMB $540\u2013$1,180/yr) or Coalition (MSP $1,850\u2013$4,450/yr)" }, { "id": "fintech-payments-cpa", "industry": "FinTech, Payment Facilitators, Bookkeepers & CPA Firms", "smb_msa_limits": "$1M/$2M Professional Liability + $1M Cyber + $100k Crime", "enterprise_msa_limits": "$5M/$5M Financial Institutions E&O + $5M Cyber + $500k Social Engineering / Funds Transfer Fraud", "mandatory_endorsements": [ "PCI-DSS Assessments, Card Brand Fines & Forensic Audit Coverage ($250k\u2013$1M sublimit)", "Social Engineering, Invoice Manipulation & Funds Transfer Fraud ($250k\u2013$1M sublimit; standard policies cap this at $25k\u2013$100k)", "Regulatory Defense & Penalties (CFPB, SEC, NYDFS 23 NYCRR 500, State Money Transmitter / Banking Boards)", "Third-Party Commercial Crime / Employee Dishonesty Fidelity Bond" ], "common_coi_trap": "Sponsor banks and enterprise CFOs reject COIs where Funds Transfer Fraud / Social Engineering is sublimited below $250,000 or where PCI-DSS fines are excluded under contractual liability.", "recommended_carrier": "Embroker or Coalition ($2,450\u2013$7,500/yr)" }, { "id": "healthcare-hipaa-baa", "industry": "Digital Health, Healthcare SaaS & HIPAA Business Associates (BAAs)", "smb_msa_limits": "$1M/$3M Healthcare E&O + $2M Cyber (with HIPAA Regulatory Sublimit)", "enterprise_msa_limits": "$5M/$5M Cyber & Privacy Liability + $5M Tech E&O (Hospital / Health System BAA Standard)", "mandatory_endorsements": [ "HHS OCR HIPAA / HITECH Regulatory Defense & Civil Monetary Penalties Coverage (full policy limit or >= $1M sublimit)", "First-Party Patient Breach Notification, Call Center, Forensics & 24-Month Credit Monitoring (outside policy aggregate where available)", "Biometric & Health Data Privacy Coverage (covers WA My Health My Data Act & IL BIPA claims unless excluded)", "Bodily Injury / Contingent Medical Malpractice Carve-Back (for clinical decision support & telehealth platforms)" ], "common_coi_trap": "Standard Tech E&O policies contain an absolute 'Bodily Injury' exclusion that voids coverage if a software bug in a clinical/telehealth workflow allegedly contributes to patient harm.", "recommended_carrier": "Coalition or Vouch ($2,600\u2013$8,950/yr)" }, { "id": "gov-contractors-dfars", "industry": "Federal, State & Defense Government Contractors (FAR / DFARS / CMMC 2.0)", "smb_msa_limits": "$1M/$2M Professional E&O + $2M Cyber + $1M/$2M CGL", "enterprise_msa_limits": "$5M/$5M Professional & Cyber Liability + DFARS 252.204-7012 Incident Forensics", "mandatory_endorsements": [ "DFARS 252.204-7012 / NIST SP 800-171 72-Hour Cyber Incident Forensic Preservation & Reporting Coverage", "Nation-State / Cyber War Attribution Carve-Back (prevents insurer from denying APT attacks under archaic 'Act of War' exclusions)", "Government Agency Named as Additional Insured with 30-Day Written Notice of Cancellation", "False Claims Act (FCA) Defense Sublimit for cybersecurity self-attestation disputes" ], "common_coi_trap": "Legacy Lloyd's/carrier war exclusions (LMA5567 without cyber carve-back) allow insurers to deny state-sponsored APT breaches affecting defense/government suppliers.", "recommended_carrier": "Coalition or Embroker ($2,400\u2013$7,200/yr)" }, { "id": "aec-construction-engineering", "industry": "Architecture, Engineering & Commercial Construction (AEC / Design-Build)", "smb_msa_limits": "$1M Per Claim / $2M Aggregate A&E Professional Liability", "enterprise_msa_limits": "$2M/$4M to $5M/$5M Practice + Project-Specific E&O + Contractors Pollution Liability", "mandatory_endorsements": [ "Faulty Workmanship / Design-Build Professional Liability Carve-Back", "Contractors Pollution Liability (CPL) & Mold/Environmental Coverage", "3-Year to 5-Year Extended Reporting Period (ERP / Tail Coverage) matching state Statute of Repose", "First-Party Wire Fraud / Escrow Manipulation Cyber Coverage for construction draw payments" ], "common_coi_trap": "Because A&E E&O is strictly 'Claims-Made', letting a policy lapse after project completion without an Extended Reporting Period (ERP tail) voids coverage for structural defect claims filed years later.", "recommended_carrier": "Hiscox or Next Insurance ($780\u2013$2,950/yr)" } ], "policy_clauses": [ { "clause": "First-Party vs. Third-Party Cyber Liability", "what_it_means": "First-Party covers YOUR direct breach expenses (forensics, ransomware extortion payment, customer notification letters, credit monitoring, business interruption). Third-Party covers lawsuits, enterprise client indemnification demands, and regulatory fines brought AGAINST you.", "contract_standard": "Enterprise MSAs require BOTH First-Party Breach Response ($1M\u2013$5M) and Third-Party Network Security & Privacy Liability ($2M\u2013$5M)." }, { "clause": "Tech E&O vs. General Professional Liability", "what_it_means": "General Professional Liability covers negligent advice or services. Tech E&O specifically adds coverage for software failure to perform as specified in an MSA, SLA downtime, data corruption, and IP/media infringement.", "contract_standard": "Any SaaS, AI, or software vendor MUST carry 'Technology E&O' wording\u2014not generic consultant E&O." }, { "clause": "Retroactive Date ('Full Prior Acts' vs. Inception Date)", "what_it_means": "E&O and Cyber policies are 'Claims-Made and Reported.' They only cover errors or breaches that occurred ON OR AFTER the policy's Retroactive Date.", "contract_standard": "Never accept a reset Retroactive Date when switching carriers; require 'Full Prior Acts' or match your original company incorporation/contract date." }, { "clause": "Defense Inside vs. Outside the Limits (Eroding Policy)", "what_it_means": "When defense costs are 'Inside the Limits' (Eroding), every dollar spent on cyber forensics ($400\u2013$950/hr) and defense attorneys reduces the limit available to pay settlements or judgments.", "contract_standard": "Request 'Claims Expenses Outside the Limits' (CEOL) or carry an extra $1M\u2013$2M buffer above your largest client MSA minimum." }, { "clause": "Hammer Clause (Consent-to-Settle: 80/20 vs. 100%)", "what_it_means": "If the insurer wants to settle a claim for $300k to save legal fees, and you refuse (to protect your reputation), a '100% Hard Hammer' caps the insurer's payout at $300k and makes you pay 100% of excess defense and judgment costs.", "contract_standard": "Insist on an '80/20' or '90/10' Soft Hammer Clause so the carrier still pays 80%\u201390% of excess defense/settlement costs." }, { "clause": "Social Engineering, Phishing & Funds Transfer Fraud Sublimit", "what_it_means": "Covers losses when an employee is tricked via spear-phishing or deepfake/ACH invoice fraud into voluntarily wiring money or handing over credentials.", "contract_standard": "Most cheap cyber add-ons cap Social Engineering at $10,000\u2013$25,000. Enterprise MSAs demand a minimum $100,000\u2013$250,000 sublimit." } ], "states": [ { "state_code": "AL", "state_name": "Alabama", "doi_agency": "Alabama Dept. of Insurance (ALDOI)", "doi_url": "https://www.aldoi.gov/", "privacy_and_breach_statute": "Ala. Code \u00a7 8-38-1 (Data Breach Notification Act)", "state_procurement_eo_cyber_minimum": "$1M/$2M State Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.0, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "AK", "state_name": "Alaska", "doi_agency": "Alaska Division of Insurance", "doi_url": "https://www.commerce.alaska.gov/web/ins/", "privacy_and_breach_statute": "Alaska Stat. \u00a7 45.48.010 (Personal Information Protection Act)", "state_procurement_eo_cyber_minimum": "$1M/$2M State IT Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.02, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "AZ", "state_name": "Arizona", "doi_agency": "Arizona Dept. of Insurance & Financial Institutions (DIFI)", "doi_url": "https://difi.az.gov/", "privacy_and_breach_statute": "Ariz. Rev. Stat. \u00a7 18-551 (Data Breach Notification)", "state_procurement_eo_cyber_minimum": "$1M/$2M State SPO Contract E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.98, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "AR", "state_name": "Arkansas", "doi_agency": "Arkansas Insurance Department (AID)", "doi_url": "https://insurance.arkansas.gov/", "privacy_and_breach_statute": "Ark. Code \u00a7 4-110-101 (Personal Information Protection Act)", "state_procurement_eo_cyber_minimum": "$1M/$2M State Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.95, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "CA", "state_name": "California", "doi_agency": "California Department of Insurance (CDI)", "doi_url": "https://www.insurance.ca.gov/", "privacy_and_breach_statute": "CCPA / CPRA (Cal. Civ. Code \u00a7 1798.100 \u2014 $2,500\u2013$7,500/violation + Private Right of Action \u00a7 1798.150)", "state_procurement_eo_cyber_minimum": "$2M/$4M DGS Cloud/IT E&O + $5M Cyber Liability", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.28, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Strict Private Right of Action / Sector Mandate" }, { "state_code": "CO", "state_name": "Colorado", "doi_agency": "Colorado Division of Insurance (DORA)", "doi_url": "https://doi.colorado.gov/", "privacy_and_breach_statute": "Colorado Privacy Act (CPA \u2014 C.R.S. \u00a7 6-1-1301) & \u00a7 6-1-716 (30-Day Breach Notice)", "state_procurement_eo_cyber_minimum": "$1M/$2M State OIT Vendor E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.04, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": true, "licensed_profession_mandates": "Mandatory Real Estate Licensee E&O (C.R.S. \u00a7 12-10-207) + Healthcare Provider Malpractice ($1M/$3M)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "CT", "state_name": "Connecticut", "doi_agency": "Connecticut Insurance Department (CID)", "doi_url": "https://portal.ct.gov/cid", "privacy_and_breach_statute": "CT Data Privacy Act (CTDPA) & Conn. Gen. Stat. \u00a7 36a-701b (Cyber Safe Harbor for NIST/CIS)", "state_procurement_eo_cyber_minimum": "$1M/$2M DAS IT Contract E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.08, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "Mandatory Physician/Healthcare Malpractice ($500k/$1.5M); General B2B E&O is contractual", "cyber_safe_harbor_or_strict_tier": "Conn. Gen. Stat. \u00a7 36a-701b \u2014 Punitive Damages Safe Harbor for NIST/CIS/HIPAA Compliance" }, { "state_code": "DE", "state_name": "Delaware", "doi_agency": "Delaware Department of Insurance", "doi_url": "https://insurance.delaware.gov/", "privacy_and_breach_statute": "Delaware Personal Data Privacy Act (DPDPA) & 6 Del. C. \u00a7 12B-101", "state_procurement_eo_cyber_minimum": "$1M/$2M DTI Cloud Contract E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.06, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "DC", "state_name": "District of Columbia", "doi_agency": "DC Dept. of Insurance, Securities & Banking (DISB)", "doi_url": "https://disb.dc.gov/", "privacy_and_breach_statute": "D.C. Code \u00a7 28-3851 (Consumer Security Breach Notification Act)", "state_procurement_eo_cyber_minimum": "$2M/$4M OCP District IT E&O + $3M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.18, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "FL", "state_name": "Florida", "doi_agency": "Florida Office of Insurance Regulation (FLOIR)", "doi_url": "https://floir.com/", "privacy_and_breach_statute": "Florida Digital Bill of Rights (FDBR) & FIPA (Fla. Stat. \u00a7 501.171 \u2014 30-Day Notice)", "state_procurement_eo_cyber_minimum": "$1M/$2M DMS State Term Contract E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.12, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "GA", "state_name": "Georgia", "doi_agency": "Georgia Office of Commissioner of Insurance", "doi_url": "https://oci.georgia.gov/", "privacy_and_breach_statute": "Ga. Code \u00a7 10-1-910 (Personal Identity Protection Act)", "state_procurement_eo_cyber_minimum": "$1M/$2M GTA Technology Contract E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.03, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "HI", "state_name": "Hawaii", "doi_agency": "Hawaii Insurance Division (DCCA)", "doi_url": "https://cca.hawaii.gov/ins/", "privacy_and_breach_statute": "Haw. Rev. Stat. \u00a7 487N-1 (Security Breach of Personal Information)", "state_procurement_eo_cyber_minimum": "$1M/$2M State ETS Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.01, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "ID", "state_name": "Idaho", "doi_agency": "Idaho Department of Insurance", "doi_url": "https://doi.idaho.gov/", "privacy_and_breach_statute": "Idaho Code \u00a7 28-51-104 (Identity Theft & Security Breach Notice)", "state_procurement_eo_cyber_minimum": "$1M/$2M State DOP IT E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.92, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": true, "licensed_profession_mandates": "Mandatory Real Estate Licensee E&O + Idaho State Bar Rule 229 Attorney Malpractice ($100k/$300k)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "IL", "state_name": "Illinois", "doi_agency": "Illinois Department of Insurance (IDOI)", "doi_url": "https://idoi.illinois.gov/", "privacy_and_breach_statute": "IL BIPA (740 ILCS 14/ Biometric Privacy) & PIPA (815 ILCS 530/)", "state_procurement_eo_cyber_minimum": "$2M/$4M DoIT Cloud/SaaS E&O + $3M Cyber (incl. BIPA check)", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.22, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Strict Private Right of Action / Sector Mandate" }, { "state_code": "IN", "state_name": "Indiana", "doi_agency": "Indiana Department of Insurance (IDOI)", "doi_url": "https://www.in.gov/idoi/", "privacy_and_breach_statute": "Indiana Consumer Data Protection Act (ICDPA) & Ind. Code \u00a7 24-4.9", "state_procurement_eo_cyber_minimum": "$1M/$2M IOT State Contract E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.96, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "IA", "state_name": "Iowa", "doi_agency": "Iowa Insurance Division (IID)", "doi_url": "https://iid.iowa.gov/", "privacy_and_breach_statute": "Iowa Consumer Data Protection Act (ICDPA \u2014 Iowa Code Ch. 715D)", "state_procurement_eo_cyber_minimum": "$1M/$2M DAS IT Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.93, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": true, "licensed_profession_mandates": "Mandatory Real Estate Licensee E&O ($100k/$300k\u2013$500k group policy); General B2B E&O is contractual", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "KS", "state_name": "Kansas", "doi_agency": "Kansas Insurance Department", "doi_url": "https://insurance.kansas.gov/", "privacy_and_breach_statute": "Kan. Stat. \u00a7 50-7a01 (Protection of Consumer Information)", "state_procurement_eo_cyber_minimum": "$1M/$2M OITS Contract E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.94, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "KY", "state_name": "Kentucky", "doi_agency": "Kentucky Department of Insurance", "doi_url": "https://insurance.ky.gov/", "privacy_and_breach_statute": "Kentucky Consumer Data Protection Act (KCDPA) & KRS \u00a7 365.732", "state_procurement_eo_cyber_minimum": "$1M/$2M COT State Vendor E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.96, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": true, "licensed_profession_mandates": "Mandatory Real Estate Licensee E&O ($100k/$300k\u2013$500k group policy); General B2B E&O is contractual", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "LA", "state_name": "Louisiana", "doi_agency": "Louisiana Department of Insurance (LDI)", "doi_url": "https://www.ldi.la.gov/", "privacy_and_breach_statute": "La. R.S. \u00a7 51:3071 (Database Security Breach Notification Law)", "state_procurement_eo_cyber_minimum": "$1M/$2M OTS IT Contract E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.07, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": true, "licensed_profession_mandates": "Mandatory Real Estate Licensee E&O ($100k/$300k\u2013$500k group policy); General B2B E&O is contractual", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "ME", "state_name": "Maine", "doi_agency": "Maine Bureau of Insurance", "doi_url": "https://www.maine.gov/pfr/insurance/", "privacy_and_breach_statute": "10 M.R.S. \u00a7 1346 (Notice of Risk to Personal Data Act)", "state_procurement_eo_cyber_minimum": "$1M/$2M MaineIT Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.95, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "MD", "state_name": "Maryland", "doi_agency": "Maryland Insurance Administration (MIA)", "doi_url": "https://insurance.maryland.gov/", "privacy_and_breach_statute": "Maryland Online Data Privacy Act (MODPA) & Md. Code Com. Law \u00a7 14-3501", "state_procurement_eo_cyber_minimum": "$2M/$4M DoIT State Contract E&O + $3M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.09, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "MA", "state_name": "Massachusetts", "doi_agency": "Massachusetts Division of Insurance (DOI)", "doi_url": "https://www.mass.gov/orgs/division-of-insurance", "privacy_and_breach_statute": "201 CMR 17.00 (Strict Written Information Security Program WISP Mandate) & M.G.L. c. 93H", "state_procurement_eo_cyber_minimum": "$2M/$4M EOTSS IT Contract E&O + $3M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.15, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Strict Private Right of Action / Sector Mandate" }, { "state_code": "MI", "state_name": "Michigan", "doi_agency": "Michigan Dept. of Insurance & Financial Services (DIFS)", "doi_url": "https://www.michigan.gov/difs", "privacy_and_breach_statute": "Mich. Comp. Laws \u00a7 445.63 (Identity Theft Protection Act)", "state_procurement_eo_cyber_minimum": "$1M/$2M DTMB IT Vendor E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.01, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "MN", "state_name": "Minnesota", "doi_agency": "Minnesota Department of Commerce \u2014 Insurance", "doi_url": "https://mn.gov/commerce/insurance/", "privacy_and_breach_statute": "Minnesota Consumer Data Privacy Act (MCDPA) & Minn. Stat. \u00a7 325E.61", "state_procurement_eo_cyber_minimum": "$1M/$2M MNIT Vendor E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.0, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "MS", "state_name": "Mississippi", "doi_agency": "Mississippi Insurance Department (MID)", "doi_url": "https://www.mid.ms.gov/", "privacy_and_breach_statute": "Miss. Code \u00a7 75-24-29 (Notice of Breach of Security)", "state_procurement_eo_cyber_minimum": "$1M/$2M ITS State Contract E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.96, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": true, "licensed_profession_mandates": "Mandatory Real Estate Licensee E&O ($100k/$300k\u2013$500k group policy); General B2B E&O is contractual", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "MO", "state_name": "Missouri", "doi_agency": "Missouri Dept. of Commerce & Insurance (DCI)", "doi_url": "https://insurance.mo.gov/", "privacy_and_breach_statute": "Mo. Rev. Stat. \u00a7 407.1500 (Personal Information Breach Notice)", "state_procurement_eo_cyber_minimum": "$1M/$2M OA-ITSD Contract E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.97, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "MT", "state_name": "Montana", "doi_agency": "Montana Commissioner of Securities & Insurance (CSI)", "doi_url": "https://csimt.gov/", "privacy_and_breach_statute": "Montana Consumer Data Privacy Act (MCDPA) & Mont. Code \u00a7 30-14-1704", "state_procurement_eo_cyber_minimum": "$1M/$2M SITSD Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.93, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "NE", "state_name": "Nebraska", "doi_agency": "Nebraska Department of Insurance", "doi_url": "https://doi.nebraska.gov/", "privacy_and_breach_statute": "Nebraska Data Privacy Act (NDPA) & Neb. Rev. Stat. \u00a7 87-801", "state_procurement_eo_cyber_minimum": "$1M/$2M OCIO Contract E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.93, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": true, "licensed_profession_mandates": "Mandatory Real Estate Licensee E&O ($100k/$300k\u2013$500k group policy); General B2B E&O is contractual", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "NV", "state_name": "Nevada", "doi_agency": "Nevada Division of Insurance", "doi_url": "https://doi.nv.gov/", "privacy_and_breach_statute": "NRS 603A (Security and Privacy of Personal Information & Encryption Mandate)", "state_procurement_eo_cyber_minimum": "$1M/$2M State EITS Vendor E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.03, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "NH", "state_name": "New Hampshire", "doi_agency": "New Hampshire Insurance Department (NHID)", "doi_url": "https://www.nh.gov/insurance/", "privacy_and_breach_statute": "New Hampshire Data Privacy Act (NHDPA) & RSA 359-C:19", "state_procurement_eo_cyber_minimum": "$1M/$2M DoIT State Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.96, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "NJ", "state_name": "New Jersey", "doi_agency": "New Jersey Dept. of Banking & Insurance (DOBI)", "doi_url": "https://www.nj.gov/dobi/", "privacy_and_breach_statute": "New Jersey Data Privacy Act (NJDPA) & N.J.S.A. 56:8-161", "state_procurement_eo_cyber_minimum": "$2M/$4M NJ OIT Contract E&O + $3M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.16, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "NM", "state_name": "New Mexico", "doi_agency": "New Mexico Office of Superintendent of Insurance (OSI)", "doi_url": "https://www.osi.state.nm.us/", "privacy_and_breach_statute": "N.M. Stat. \u00a7 57-12C-1 (Data Breach Notification Act)", "state_procurement_eo_cyber_minimum": "$1M/$2M DoIT Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.97, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": true, "licensed_profession_mandates": "Mandatory Real Estate Licensee E&O ($100k/$300k\u2013$500k group policy); General B2B E&O is contractual", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "NY", "state_name": "New York", "doi_agency": "New York State Department of Financial Services (NYDFS)", "doi_url": "https://www.dfs.ny.gov/", "privacy_and_breach_statute": "NY SHIELD Act (GBL \u00a7 899-aa/bb) & NYDFS 23 NYCRR Part 500 Cybersecurity Regulation", "state_procurement_eo_cyber_minimum": "$2M/$4M NYS OGS IT Umbrella E&O + $5M Cyber Liability", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.3, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Strict Private Right of Action / Sector Mandate" }, { "state_code": "NC", "state_name": "North Carolina", "doi_agency": "North Carolina Department of Insurance (NCDOI)", "doi_url": "https://www.ncdoi.gov/", "privacy_and_breach_statute": "N.C. Gen. Stat. \u00a7 75-65 (Identity Theft Protection Act)", "state_procurement_eo_cyber_minimum": "$1M/$2M NCDIT Cloud/SaaS Vendor E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.98, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "ND", "state_name": "North Dakota", "doi_agency": "North Dakota Insurance Department", "doi_url": "https://www.insurance.nd.gov/", "privacy_and_breach_statute": "N.D. Cent. Code \u00a7 51-30-01 (Notice of Security Breach)", "state_procurement_eo_cyber_minimum": "$1M/$2M NDIT State Contract E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.91, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": true, "licensed_profession_mandates": "Mandatory Real Estate Licensee E&O ($100k/$300k\u2013$500k group policy); General B2B E&O is contractual", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "OH", "state_name": "Ohio", "doi_agency": "Ohio Department of Insurance (ODI)", "doi_url": "https://insurance.ohio.gov/", "privacy_and_breach_statute": "Ohio Data Protection Act (ORC \u00a7 1354.01 Affirmative Tort Safe Harbor for NIST/CIS/ISO 27001)", "state_procurement_eo_cyber_minimum": "$1M/$2M DAS OIT Vendor E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.97, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Ohio Data Protection Act (ORC \u00a7 1354.01) \u2014 Statutory Tort Safe Harbor for NIST/CIS/ISO 27001" }, { "state_code": "OK", "state_name": "Oklahoma", "doi_agency": "Oklahoma Insurance Department (OID)", "doi_url": "https://www.oid.ok.gov/", "privacy_and_breach_statute": "24 O.S. \u00a7 161 (Security Breach Notification Act)", "state_procurement_eo_cyber_minimum": "$1M/$2M OMES IS Contract E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.95, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "OR", "state_name": "Oregon", "doi_agency": "Oregon Division of Financial Regulation (DFR)", "doi_url": "https://dfr.oregon.gov/", "privacy_and_breach_statute": "Oregon Consumer Privacy Act (OCPA) & ORS \u00a7 646A.600", "state_procurement_eo_cyber_minimum": "$1M/$2M EIS State IT Contract E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.02, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "Mandatory Attorney PLF ($300k/$300k) + Resident Insurance Producers (ORS Ch. 744: $300k/$600k E&O)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "PA", "state_name": "Pennsylvania", "doi_agency": "Pennsylvania Insurance Department (PID)", "doi_url": "https://www.insurance.pa.gov/", "privacy_and_breach_statute": "73 P.S. \u00a7 2301 (Breach of Personal Information Notification Act \u2014 Updated 2024/2026)", "state_procurement_eo_cyber_minimum": "$1M/$2M PA DGS IT Contract E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.06, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "RI", "state_name": "Rhode Island", "doi_agency": "Rhode Island Department of Business Regulation \u2014 Insurance", "doi_url": "https://dbr.ri.gov/insurance/", "privacy_and_breach_statute": "Rhode Island Data Transparency & Privacy Protection Act & R.I. Gen. Laws \u00a7 11-49.3-1", "state_procurement_eo_cyber_minimum": "$1M/$2M DoIT State Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.02, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": true, "licensed_profession_mandates": "Mandatory Real Estate Licensee E&O ($100k/$300k\u2013$500k group policy); General B2B E&O is contractual", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "SC", "state_name": "South Carolina", "doi_agency": "South Carolina Department of Insurance (SCDOI)", "doi_url": "https://doi.sc.gov/", "privacy_and_breach_statute": "S.C. Code \u00a7 39-1-90 & SC Insurance Data Security Act (NAIC Model Law)", "state_procurement_eo_cyber_minimum": "$1M/$2M SFAA OTIS IT E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.98, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "SD", "state_name": "South Dakota", "doi_agency": "South Dakota Division of Insurance", "doi_url": "https://dlr.sd.gov/insurance/", "privacy_and_breach_statute": "S.D. Codified Laws \u00a7 22-40-19 (Breach of System Security)", "state_procurement_eo_cyber_minimum": "$1M/$2M BIT State Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.91, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": true, "licensed_profession_mandates": "Mandatory Real Estate Licensee E&O ($100k/$300k\u2013$500k group policy); General B2B E&O is contractual", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "TN", "state_name": "Tennessee", "doi_agency": "Tennessee Dept. of Commerce & Insurance (TDCI)", "doi_url": "https://www.tn.gov/commerce/insurance.html", "privacy_and_breach_statute": "Tennessee Information Protection Act (TIPA \u2014 NIST Privacy Framework Safe Harbor)", "state_procurement_eo_cyber_minimum": "$1M/$2M STS State IT Contract E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.98, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": true, "licensed_profession_mandates": "Mandatory Real Estate Licensee E&O ($100k/$300k\u2013$500k group policy); General B2B E&O is contractual", "cyber_safe_harbor_or_strict_tier": "Tennessee Information Protection Act (TIPA) \u2014 NIST Privacy Framework Affirmative Defense" }, { "state_code": "TX", "state_name": "Texas", "doi_agency": "Texas Department of Insurance (TDI)", "doi_url": "https://www.tdi.texas.gov/", "privacy_and_breach_statute": "Texas Data Privacy & Security Act (TDPSA) & Tex. Bus. & Com. Code \u00a7 521.053 (30-Day AG Notice)", "state_procurement_eo_cyber_minimum": "$2M/$4M Texas DIR Cooperative Contract E&O + $3M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.08, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Strict Private Right of Action / Sector Mandate" }, { "state_code": "UT", "state_name": "Utah", "doi_agency": "Utah Insurance Department (UID)", "doi_url": "https://insurance.utah.gov/", "privacy_and_breach_statute": "Utah Consumer Privacy Act (UCPA) & Utah Cybersecurity Affirmative Defense Act (NIST/CIS Safe Harbor)", "state_procurement_eo_cyber_minimum": "$1M/$2M DTS State Vendor E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.95, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Utah Cybersecurity Affirmative Defense Act (Utah Code \u00a7 78B-4-702) \u2014 NIST/CIS Safe Harbor" }, { "state_code": "VT", "state_name": "Vermont", "doi_agency": "Vermont Dept. of Financial Regulation (DFR)", "doi_url": "https://dfr.vermont.gov/", "privacy_and_breach_statute": "9 V.S.A. \u00a7 2430 (Security Breach Notice Act & Data Broker Registry)", "state_procurement_eo_cyber_minimum": "$1M/$2M ADS IT Contract E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.96, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "VA", "state_name": "Virginia", "doi_agency": "Virginia Bureau of Insurance (SCC)", "doi_url": "https://scc.virginia.gov/pages/Insurance", "privacy_and_breach_statute": "Virginia Consumer Data Protection Act (VCDPA \u2014 Va. Code \u00a7 59.1-575) & Va. Code \u00a7 18.2-186.6", "state_procurement_eo_cyber_minimum": "$2M/$4M VITA IT/Cloud Contract E&O + $3M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.03, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "WA", "state_name": "Washington", "doi_agency": "Washington Office of the Insurance Commissioner (OIC)", "doi_url": "https://www.insurance.wa.gov/", "privacy_and_breach_statute": "WA My Health My Data Act (MHMDA) & RCW 19.255.010 (30-Day AG Breach Notice)", "state_procurement_eo_cyber_minimum": "$2M/$4M WaTech DES IT Contract E&O + $3M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 1.09, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Strict Private Right of Action / Sector Mandate" }, { "state_code": "WV", "state_name": "West Virginia", "doi_agency": "West Virginia Offices of the Insurance Commissioner", "doi_url": "https://www.wvinsurance.gov/", "privacy_and_breach_statute": "W. Va. Code \u00a7 46A-2A-101 (Breach of Security of Consumer Information)", "state_procurement_eo_cyber_minimum": "$1M/$2M WVOT State Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.95, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "WI", "state_name": "Wisconsin", "doi_agency": "Wisconsin Office of the Commissioner of Insurance (OCI)", "doi_url": "https://oci.wi.gov/", "privacy_and_breach_statute": "Wis. Stat. \u00a7 134.98 (Notice of Unauthorized Acquisition of Personal Information)", "state_procurement_eo_cyber_minimum": "$1M/$2M DOA DET Contract E&O + $2M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.96, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" }, { "state_code": "WY", "state_name": "Wyoming", "doi_agency": "Wyoming Department of Insurance", "doi_url": "https://doi.wyo.gov/", "privacy_and_breach_statute": "Wyo. Stat. \u00a7 40-12-501 (Consumer Data Breach Notification)", "state_procurement_eo_cyber_minimum": "$1M/$2M ETS State Vendor E&O + $1M Cyber", "smb_msa_minimum": "$1M Occurrence / $2M Aggregate E&O + $1M Cyber", "enterprise_soc2_hipaa_minimum": "$5M Tech E&O + $5M Cyber ($250k\u2013$500k Sublimits)", "naic_rate_multiplier": 0.91, "general_b2b_statutory_eo_mandate": "No (Contractual MSA Driven)", "real_estate_eo_mandatory": false, "licensed_profession_mandates": "No general B2B statutory E&O mandate (applies only to specific state bonding/clinical licenses)", "cyber_safe_harbor_or_strict_tier": "Standard State Breach Notification Statute" } ], "sector_cost_benchmarks_2026": [ { "sector_id": "saas_tech_ai", "sector_name": "B2B SaaS, Cloud & AI Software Vendors", "cyber_annual_avg_usd": 1882, "eo_annual_avg_usd": 1620, "combined_pkg_typical_usd": "$1,882\u2013$3,450/yr ($157\u2013$288/mo)", "recommended_msa_limit": "$2M/$2M Combined Tech E&O + Cyber (SOC 2 Standard)", "primary_carrier": "Embroker / Vouch" }, { "sector_id": "healthcare_hipaa", "sector_name": "Healthcare SaaS, Telehealth & HIPAA Business Associates", "cyber_annual_avg_usd": 1395, "eo_annual_avg_usd": 1750, "combined_pkg_typical_usd": "$1,395\u2013$3,890/yr ($116\u2013$324/mo)", "recommended_msa_limit": "$2M\u2013$5M Cyber + Tech E&O (OCR HIPAA Regulatory Sublimit)", "primary_carrier": "Coalition / Vouch" }, { "sector_id": "fintech_cpa", "sector_name": "FinTech, Accounting, CPA & Financial Advisory", "cyber_annual_avg_usd": 1365, "eo_annual_avg_usd": 1540, "combined_pkg_typical_usd": "$1,365\u2013$3,600/yr ($114\u2013$300/mo)", "recommended_msa_limit": "$2M\u2013$5M FI E&O + Cyber ($250k+ Funds Transfer Fraud)", "primary_carrier": "Embroker / Coalition" }, { "sector_id": "consulting_it_msp", "sector_name": "IT Consultants, Management Consulting & Agencies", "cyber_annual_avg_usd": 1197, "eo_annual_avg_usd": 888, "combined_pkg_typical_usd": "$1,197\u2013$2,190/yr ($100\u2013$183/mo)", "recommended_msa_limit": "$1M/$2M Professional E&O + $1M Cyber (1099 Subcontractor Carve-In)", "primary_carrier": "Hiscox / Next Insurance" }, { "sector_id": "smb_national_avg", "sector_name": "US Small Business National Cyber Average (All Industries)", "cyber_annual_avg_usd": 999, "eo_annual_avg_usd": 840, "combined_pkg_typical_usd": "$999\u2013$1,839/yr ($83\u2013$153/mo)", "recommended_msa_limit": "$1M/$1M to $1M/$2M Standard Commercial Contract", "primary_carrier": "Hiscox / Next Insurance" }, { "sector_id": "micro_eo_1_4_emp", "sector_name": "Micro-SMB & Solo Consultant E&O Baseline (1\u20134 Employees)", "cyber_annual_avg_usd": 540, "eo_annual_avg_usd": 675, "combined_pkg_typical_usd": "$675\u2013$1,180/yr ($56\u2013$98/mo)", "recommended_msa_limit": "$1M Occurrence / $1M\u2013$2M Aggregate Professional Liability", "primary_carrier": "Next Insurance / Hiscox" } ] }