Insurance requirements in federal contracting are not uniform. There is no single federal statute that mandates one set of coverages for all contractors. Instead, requirements vary by contract type, agency, scope of work, and the specific clauses in each solicitation. What a cybersecurity firm needs to carry is different from what a facilities management company needs, and both are different from what a staffing firm or a construction subcontractor is expected to hold.
What is consistent is that contracting officers increasingly scrutinize insurance as a risk management indicator before award, and that prime contractors flow down insurance requirements to subcontractors that often exceed what the government itself mandates. For SDVOSB firms, understanding the insurance landscape before you pursue a contract — not after — affects your bid pricing, your proposal competitiveness, and your ability to perform without a claim disrupting your operations.
How Insurance Requirements Get Into Contracts
Insurance requirements appear in federal contracts through several mechanisms. FAR 28.301 authorizes agencies to require contractors to carry insurance when it is in the government’s interest. The specific coverages and minimum limits appear in Section H (special contract requirements) or through the incorporation of agency-specific clauses. FAR 52.228-5 (Insurance — Work on a Government Installation) and FAR 52.228-7 (Insurance — Liability to Third Persons) are the most commonly cited base clauses, but agencies layer additional requirements on top of them.
Prime contractors add another layer. When a prime requires subcontractors to carry insurance, those requirements appear in the subcontract and flow down as a condition of being on the team. Prime-mandated subcontractor insurance often exceeds the government’s own requirements and should be reviewed carefully during teaming agreement negotiations, before you commit to a subcontracting arrangement.
General Liability Insurance
General liability (GL) insurance is the baseline coverage most federal contractors are expected to carry. It covers bodily injury and property damage claims arising from your operations, completed operations, and premises. For service contractors working at government facilities — offices, bases, depots — GL is almost always required.
Minimum limits vary, but $1 million per occurrence and $2 million aggregate are common requirements on civilian agency service contracts. DoD contracts and larger programs frequently require higher limits. The solicitation will specify both the minimum coverage amount and whether the government must be named as an additional insured on the policy.
The additional insured requirement is important and sometimes overlooked. If the government is an additional insured, your GL carrier must issue a certificate of insurance naming the specific agency, and changes to or cancellation of the policy must be reported to the government within a specified period — typically 30 days. Your insurance broker needs to coordinate this before contract start. A certificate of insurance that does not name the correct agency entity or that uses the wrong legal name for the insured party is technically non-compliant.
Professional Liability (Errors and Omissions)
Professional liability insurance — commonly called errors and omissions (E&O) — covers claims arising from mistakes, omissions, negligence, or inadequate professional services. It is mandatory for most service contracts involving any professional function: IT, engineering, consulting, financial advisory, legal support, architecture, and similar work.
Unlike GL, professional liability policies are typically written on a claims-made basis, meaning the policy in effect when the claim is made — not when the work was performed — is the one that responds. This creates a retroactive coverage gap for firms that switch carriers or let coverage lapse after contract completion. For SDVOSB firms with past performance on previous contracts, maintaining a retroactive date that covers all prior work is important. “Tail coverage” (extended reporting period endorsements) can bridge the gap when switching carriers, but it adds cost.
Common minimum limits for professional liability on federal contracts are $1 million per claim and $2 million aggregate, though IT and cybersecurity contracts frequently require $2 million per claim or more. If you are bidding on a contract where E&O is required and your current limits are below the threshold, obtain a certificate showing the required limits before proposal submission — the solicitation may require proof of insurability as part of the proposal.
Workers’ Compensation
Workers’ compensation is required in virtually every state for businesses with employees. Federal contractors must comply with state workers’ compensation laws applicable to the location of performance. On federal installations, the Defense Base Act (DBA) applies to certain overseas contractors and can extend to employees working on U.S. military bases abroad — a separate insurance requirement from domestic workers’ comp.
For SDVOSB firms with employees working at government sites, workers’ comp certificates are routinely requested as a condition of badging and facility access. If your firm operates in multiple states, your policy must cover all states of operation, including any “other states” endorsement required by your carrier for states where you do not have a primary filing. Subcontractors you use must also carry workers’ comp that meets state requirements — confirm this before any subcontractor personnel begin work on a federal program.
Cyber Liability Insurance
Cyber liability insurance has moved from optional to effectively mandatory for federal IT contractors over the past several years, and the trend is accelerating alongside CMMC implementation. Cyber coverage protects against data breaches, ransomware, business interruption from cyber events, and regulatory notification costs.
First-party coverage (protecting your own firm) and third-party coverage (protecting you from claims by clients or the government for a breach affecting their data) are distinct, and both are increasingly required. Minimum limits of $1 million are common on agency IT contracts; contracts involving controlled unclassified information (CUI) or sensitive government data frequently require $2 million or more.
Carriers underwriting cyber policies now conduct detailed security questionnaires before issuing coverage. Firms without multi-factor authentication, endpoint detection tools, regular patching, and incident response plans may face coverage exclusions or inflated premiums. If you are pursuing CMMC certification, the security controls required for CMMC Level 2 will also make you a better cyber insurance risk — there is meaningful overlap between what the carrier wants and what the government requires.
Automobile Liability
If your contract involves the use of vehicles for contract performance — transportation, site visits, courier functions, or any other driving in support of the work — commercial automobile liability insurance is required. The coverage applies to owned, non-owned (employee personal vehicles used for work), and hired vehicles. Minimum limits are typically $1 million combined single limit per occurrence.
If you use personal vehicles for government site visits and do not carry non-owned auto coverage, you have a gap. Personal auto policies typically exclude commercial use. A standalone non-owned auto endorsement to your commercial policy is inexpensive and fills this gap. Confirm with your broker whether your current policy covers employees driving their personal vehicles to government facilities on company business.
Bonding
Surety bonds are not insurance, but they are closely related and frequently required alongside insurance on federal construction, service, and supply contracts. The three primary bond types in federal contracting are bid bonds, performance bonds, and payment bonds — collectively referred to as contract bonds under the Miller Act for construction contracts above $150,000.
A bid bond guarantees that if you are awarded the contract, you will execute it and provide the required performance and payment bonds. It protects the government against a bidder who wins and then declines to perform. A performance bond guarantees you will complete the contract in accordance with its terms. A payment bond guarantees that you will pay your subcontractors and suppliers. For construction contracts above $150,000, all three are mandatory under the Miller Act. For service contracts, bonding is less universally required but appears on contracts involving substantial financial risk to the government.
Obtaining bonding requires a surety relationship, which is credit-underwritten. The surety evaluates your firm’s financial statements, working capital, experience, and management capacity. New SDVOSB firms often struggle to qualify for bonding because they lack the track record and financial depth that sureties require. The SBA’s Surety Bond Guarantee (SBG) program can help — it guarantees bonds for small businesses that cannot otherwise qualify, covering up to $9 million (and $14 million in some cases). Apply for the SBG program through an SBA-approved surety agent before you need it, not after a bid has closed.
What to Do Before Pursuing a Contract
The most common insurance mistake small federal contractors make is discovering insurance requirements after they have submitted a proposal — or worse, after award — and finding that their current coverage does not meet the contract requirements. Closing that gap under time pressure is expensive and sometimes impossible in the timeline the government provides.
Before pursuing any contract over $500,000, review Section H and any insurance clause in the solicitation and compare the required coverages and limits against your current policies. If there is a gap — a required coverage type you do not carry, or minimum limits below what the contract requires — contact your broker to understand the cost and lead time to cure the gap before your go/no-go decision. Insurance cost is a direct contract cost that should be priced into your proposal, not treated as overhead.
Working with a broker who specializes in federal contractor insurance makes a significant difference. General commercial insurance brokers are not always familiar with additional insured requirements, the Defense Base Act, or the distinction between claims-made and occurrence policies as they apply to government work. A broker with a federal contractor practice will know the standard requirements before you hand them the RFP, and can often pre-negotiate certificate language that agencies and prime contractors will accept without revision.