The Essentials: Protect — Freelance Tech & IT Services Business

What insurance does a freelance IT provider need?

Errors and omissions (E&O) coverage should reflect the real scale of harm a mistake could cause, not just a minimum policy limit; a provider managing financial or healthcare data for multiple clients needs higher limits than one doing basic help desk support for a single retail shop. Solo providers commonly start with $1 million per claim and $1 million to $2 million aggregate, and premiums often run from several hundred to a few thousand dollars a year depending on services, revenue and claims history. Cyber liability coverage, increasingly required contractually by clients in regulated industries before they'll sign, should specifically cover incident response costs and any claim that a breach originated through your remote access tools or credentials, since that's the most realistic pathway for a freelancer's business to become the entry point for a client's incident.

How should you store client credentials?

Storing client admin passwords in a spreadsheet, a personal password manager without audit logging, or worse, memorized and reused across clients, is the most common real-world failure mode for solo IT providers, because a single compromised device or account can expose every client you manage at once. Use a dedicated, audited password vault built for MSPs (IT Glue, Hudu, or a business-tier password manager with access logging), enable multi-factor authentication on every account that supports it including your own, and rotate any shared credentials immediately after ending a client relationship, not "eventually."

What should every IT services contract say about liability?

Cap your liability in every master services agreement, typically to a multiple of recent fees paid (often 3-12 months), so a single incident can't expose your entire business regardless of the actual damages claimed. Clarify in writing who is responsible for backup verification and testing, since "we set up backups" and "we verify backups restore correctly" are very different service levels and clients often assume the more comprehensive one by default. Document exactly what you're responsible for monitoring versus what remains the client's own responsibility (like reporting suspicious emails or not sharing passwords with staff), so a gap in the client's own behavior doesn't become your liability.

How do you vet contractors who touch client systems?

The moment you hire a contractor or employee who gets access to client networks and credentials, your liability exposure now includes their conduct, not just your own. Run a background check before granting any client-facing access, use individually assigned (not shared) credentials in your password vault so every action is attributable to a specific person, and revoke access immediately, the same day, when a working relationship ends, not at the next convenient moment. A former technician who retains active access to client systems after leaving is a foreseeable and entirely preventable liability event, and courts and insurers treat it accordingly if something goes wrong.

A Worked Example: The Cost of Skipping Offboarding

Consider a part-time technician who leaves on reasonable terms, but their individual account in your RMM platform and their access to the shared password vault aren't revoked until you happen to notice weeks later during a routine review. If that account is compromised through a personal device breach unrelated to your business, an attacker could potentially access every client's credentials the technician had touched, turning what should have been a routine staffing change into a multi-client security incident. A same-day offboarding checklist, revoke RMM access, remove vault permissions, rotate any credentials they had standing access to, costs a few minutes per departure and eliminates this entire class of risk.

Keep a Simple Incident Log Even When Nothing Goes Wrong

Record every security-relevant event, a suspicious login attempt flagged by your RMM, a phishing email a client forwarded to you, even minor ones, in a simple running log with date, client, and resolution. This log becomes valuable evidence of your diligence if a client ever disputes how a security matter was handled, and it also surfaces patterns, like one client's staff repeatedly falling for phishing tests, that justify a targeted training conversation before a real incident occurs.

Review Your Coverage Every Time You Add a Regulated-Industry Client

Signing your first healthcare, legal, or financial services client is a meaningful shift in your risk profile, not just a revenue win. Confirm with your insurance broker that your existing E&O and cyber liability limits and terms still make sense given the specific regulatory exposure of that new client, rather than assuming your general small-business coverage automatically extends to cover the higher stakes involved.

What backup and security standards should you promise?

Describe a standard in writing, such as the 3-2-1 rule: three copies of data, on two types of media, with one offsite or immutable. Specify how often you test restores, for example a documented sample restore every quarter, how quickly you patch critical vulnerabilities, and whether you manage multi-factor authentication and endpoint protection. If you manage systems containing health information, sign a business associate agreement under HIPAA before you touch it, and review contract security terms for regulated clients such as payment card, legal or financial firms. Say plainly what you do not cover, such as employee training or line-of-business software.

Take this further

FREQUENTLY ASKED QUESTIONS