Why Insurance Is a Contract Requirement, Not Optional
Insurance is not a box to check after you win a contract. It's a threshold requirement baked into the solicitation itself. If you don't have the coverage levels the agency specifies, your proposal is non-responsive — and non-responsive proposals don't get evaluated. They get discarded.
There's a second problem that trips up contractors who do get coverage: the certificate of insurance has to be in hand before you start work. Not when you get around to it. Before day one. Miss that window and the contracting officer can stop your work order or, in worst cases, issue a cure notice that puts your entire contract in jeopardy.
The good news is that the rules aren't complicated once you understand them. FAR Part 28 sets the federal floor. Agency supplements and solicitation clauses layer on top. Know the framework, get the right policy, and insurance becomes a one-time setup — not an ongoing scramble before every new award.
FAR 28.307-2
Sets minimum liability coverage amounts
$500K
Min general liability per occurrence (FAR floor)
$150K
Miller Act threshold for bonding on construction
30 days
Typical advance notice required for cancellation
The coverage levels the government requires often look low compared to what commercial clients demand. But "low" is relative. A small business paying $1,800 per year for general liability might need to step up to a $1 million policy to meet agency requirements — and that can mean a different policy or an endorsement, not just a higher premium.
Understanding what you need before you respond to a solicitation is what separates contractors who are proposal-ready from those who scramble after they win. Use CapturePilot's proposal tools to flag compliance requirements — including insurance clauses — during opportunity review.
FAR Part 28: The Legal Framework for Contractor Insurance
The Federal Acquisition Regulation's Part 28 covers all bonds, insurance, and indemnification requirements across federal contracts. Two clauses matter most for the typical small business contractor.
FAR 52.228-5
Insurance — Work on a Government Installation
When it applies: Fixed-price contracts for work performed on government property
Requires the contractor to maintain insurance during performance and provide certificates to the contracting officer before starting work. The government is not liable for damages to contractor property.
FAR 52.228-7
Insurance — Liability to Third Persons
When it applies: Cost-reimbursement contracts (the government reimburses allowable insurance costs)
Requires the contractor to carry and maintain adequate insurance to cover third-party liability. Allowable insurance costs can be billed as overhead on cost-type contracts.
The actual minimum dollar amounts live in FAR 28.307-2. This is the table contracting officers reference when writing insurance requirements into solicitations, and it's the floor you must meet at minimum. Most agencies set higher limits — especially DoD, VA, and DHS — but you have to know the baseline to understand when agency requirements are standard versus elevated.
Always read Section H and Section I of every solicitation
One more clause worth knowing: FAR 52.228-3(Workers' Compensation Insurance) is incorporated when a contract requires performance in a state where the contractor might not automatically be covered by state law. If you're working across state lines, confirm your workers' comp policy covers all states where employees will perform work.
The Seven Insurance Types Every Contractor Must Know
Not every federal contract requires every type of insurance. But you need to understand all seven so you know which apply to your work — and so you can spot a solicitation that asks for something unusual before you bid.
Commercial General Liability (CGL)
Almost always requiredCovers bodily injury and property damage claims from third parties arising from your work. This is the most commonly required coverage in federal solicitations. FAR 28.307-2(c) sets a $500,000 per-occurrence floor for bodily injury — but most agencies require $1 million to $2 million. Your CGL policy also needs to name the government as an additional insured on most construction and services contracts.
Workers' Compensation & Employer's Liability
Required for employeesWorkers' comp is mandatory in virtually every state once you have employees, and federal contracts reinforce this. FAR 28.307-2(a) requires compliance with applicable state workers' comp laws, with a $100,000 per-accident floor for employer's liability coverage (FAR 28.307-2(b)). If you have 1099 subcontractors doing the work, confirm whether your policy — and the contract — requires them to carry their own.
Commercial Auto Liability
Required when vehicles are usedFAR 28.307-2(d) sets the minimum at $200,000 per person / $500,000 per occurrence for bodily injury, and $20,000 per occurrence for property damage. If employees use personal vehicles for contract work, you need hired and non-owned auto coverage added to your commercial policy — standard personal auto policies don't cover business use on government work.
Professional Liability (Errors & Omissions)
Required for professional servicesCovers claims arising from errors, omissions, or negligent acts in professional services — consulting, engineering, IT, accounting, legal work. This is not part of the FAR minimums for general contracts, but most professional services solicitations specifically require it. Common limits are $1 million per claim / $2 million aggregate. IT contracts frequently require $2 million to $5 million depending on the sensitivity of the systems involved.
Cyber Liability Insurance
Growing requirement — especially DoDNot explicitly mandated by FAR Part 28, but becoming a standard clause in agency solicitations — particularly DoD contracts where DFARS 252.204-7012 requires safeguarding Covered Defense Information and 72-hour cyber incident reporting. Covers data breach response costs, ransomware, business interruption, and third-party liability. If you handle Controlled Unclassified Information (CUI) or operate IT systems on government networks, expect agencies to require cyber coverage of $1 million or more. Costs typically run $1,500–$5,000/year for a $1M policy at the small business level.
Defense Base Act (DBA) Insurance
Required for overseas contractsA statutory requirement — not optional — for any U.S. government contractor employing workers outside the United States on military bases or government contracts, under 42 U.S.C. § 1651. The DBA extends workers' compensation benefits to employees injured or killed overseas. FAR 52.228-3 triggers this clause. Failure to obtain DBA coverage results in fines, possible contract loss, and eliminates standard legal defenses in lawsuits. If you pursue DoD, DoS, or USAID work involving overseas performance, DBA coverage is mandatory before your first employee lands.
Umbrella / Excess Liability
Common on larger contractsProvides additional limits above your CGL, auto, and employer's liability policies. If an agency requires $5 million in general liability but your underlying policy only goes to $2 million, an umbrella policy fills the gap — usually at a lower per-dollar cost than extending the underlying policy. Commonly required on larger construction contracts, facility management awards, and security services contracts where government liability exposure is high.
Check your proposal readiness before you bid
CapturePilot flags insurance requirements, bonding thresholds, and compliance clauses in every opportunity so you know exactly what you need before you commit to a pursuit.
Minimum Coverage Amounts by Contract Type
FAR 28.307-2 is your baseline. Agencies regularly require higher limits — and they can. The table below shows what the regulation mandates versus what you typically see in the field. Use it as a starting point, not an ending point.
| Coverage Type | FAR Minimum | Typical Field Requirement |
|---|---|---|
| Workers' Compensation | Per applicable state law | Per state law + employer's liability |
| Employer's Liability | $100,000 per accident | $100,000–$500,000 per accident |
| General Liability (bodily injury) | $500,000 per occurrence | $1M–$2M per occurrence / $2M–$4M aggregate |
| Auto Liability (bodily injury) | $200,000/person; $500,000/occurrence | $1M combined single limit |
| Auto Liability (property damage) | $20,000 per occurrence | Usually bundled into combined single limit |
| Professional Liability | Not specified — solicitation-dependent | $1M–$5M per claim / aggregate |
| Cyber Liability | Not specified — DFARS/solicitation-dependent | $1M–$5M (DoD often requires $5M) |
| Umbrella / Excess | Not specified | $5M–$10M on large construction/services |
The agency can always require more than FAR minimums
The easiest way to manage coverage across multiple pursuits is to maintain a "base" policy that meets FAR minimums, then purchase endorsements or umbrella coverage when a specific opportunity requires higher limits. Many carriers that specialize in government contractors offer modular policies designed exactly for this approach.
Construction Contracts: Bonding and the Miller Act
Construction contracts come with a completely separate layer of requirements that go beyond insurance: performance bonds and payment bonds, mandated by the Miller Act (40 U.S.C. §§ 3131–3134). These are not optional and not waivable on federal construction contracts above the threshold.
Performance Bond
100% of contract value
Required on contracts above $150,000
Guarantees the contractor will complete the project according to contract terms. If the contractor defaults, the surety steps in to complete the work or compensate the government.
Payment Bond
100% of contract value
Required on contracts above $150,000
Guarantees the contractor will pay subcontractors, suppliers, and laborers. Protects subs and suppliers who can't file mechanics' liens against government property.
Bonding is different from insurance. Insurance transfers risk to an insurer for losses you can't foresee. A surety bond is a three-party agreement where the surety backs your ability to perform — and if you fail, the surety pays out but then seeks repayment from you. Sureties are not charities. They want to see your financial statements, backlog, work-in-progress schedule, bank references, and sometimes personal financial information before writing a bond.
For contracts between $150,000 and $350,000, the contracting officer may accept alternatives to standard bonds: irrevocable letters of credit, U.S. bonds or notes, or certified checks. Above $350,000, full surety bonds are the standard.
Get your bonding capacity established before you pursue construction work
If you're targeting federal construction contracts, the SBA's Surety Bond Guarantee Programcan help small businesses obtain bonding by guaranteeing up to 90% of the surety's loss on contracts up to $9 million (up to $14 million when a federal contracting officer certifies the guarantee is needed). The fee is 0.6% of the contract price for performance and payment bonds — bid bonds are free. In FY2025 the program hit a record $10.6 billion in total contract value supported, a 15% jump over the prior year, with over 2,200 small businesses assisted. If your bonding history is thin, this program is the fastest path to getting on construction solicitations above the $150,000 threshold.
Professional Services and IT: E&O and Cyber Coverage
If your work is knowledge-based — consulting, engineering, software development, financial analysis, legal or accounting services — general liability alone won't satisfy most federal clients. Professional liability (also called Errors & Omissions or E&O) covers claims arising from your advice, your deliverables, or your failure to perform a professional service correctly.
The federal government buys more services than any other type of contract — well over half of annual procurement spending. If you're in the IT contracting space, or providing any form of management consulting, you will encounter E&O requirements in the solicitation. Standard limits run $1 million per claim and $2 million aggregate — but agencies with sensitive systems regularly require $2 to $5 million.
Cyber Coverage: What the DoD Now Expects
CMMC Phase 1 took effect November 10, 2025, requiring DoD contractors to self-assess against CMMC Level 1 or Level 2 and affirm compliance in the Supplier Performance Risk System (SPRS). Phase 2 — which would have required third-party C3PAO assessments — was suspended by the Department of War on July 13, 2026, pending a 60-day reform review. DFARS 252.204-7012 remains fully in effect regardless: contractors handling Covered Defense Information must safeguard CUI and report cyber incidents to DIBNet within 72 hours. Separately, many DoD solicitations now independently require cyber liability insurance for contracts involving IT systems, networks, or CUI. The typical structure:
If you're pursuing CMMC-scoped contracts, cyber insurance is not a substitute for compliance — but it's an increasingly expected parallel requirement. Cyber insurers are now requiring documented NIST 800-171 controls as a condition for coverage, meaning CMMC compliance and insurability are functionally linked. Budget $1,500–$5,000 per year for a $1 million cyber policy depending on your IT profile, revenue, and security posture.
One coverage type that's easy to miss: Technology E&O. If you develop, sell, or support software or technology products, standard professional liability may exclude technology-related claims. You may need a Technology E&O policy or a combined Tech E&O and cyber policy — increasingly sold together by carriers serving the government IT market.
How to Get the Right Coverage Without Overpaying
The government contracting insurance market is specialized. A carrier that writes great policies for restaurants or retail won't necessarily understand that you need specific endorsements, that the government is not a standard "additional insured," or that your contract requires 30-day cancellation notice. Work with a broker or agent who specifically writes government contractor insurance — they know how to structure policies that meet FAR and agency-supplement requirements without overbuilding.
Build your coverage baseline first
General liability + workers' comp + auto covers 80% of what federal solicitations require. Get these in place before you chase your first contract. Expect $800–$2,000/year for GL alone at a $1M/$2M limit for most non-construction small businesses; construction firms run higher. Workers' comp varies by industry and state but averages $254/month for GCs.
Read every solicitation before bidding
Section H and Section I will list specific limits, endorsements, and requirements. Note them before you bid — not after. Some solicitations require government additional insured status or waiver of subrogation.
Add professional liability when you cross into services
If any part of your contract involves professional judgment, advice, or deliverables — get E&O. Add cyber if you're handling government data or operating IT systems. Don't add these for work that doesn't need them.
Establish bonding capacity for construction early
Contact a surety agent 90 days before you plan to bid your first construction project. Prepare two to three years of financial statements. Surety underwriting takes time and your bonding capacity grows over time.
What government contractor insurance actually costs
Look for carriers with experience in government contractor markets: Travelers, CNA, Hartford, and specialized markets like AIG or Chubb for professional lines. For small businesses, insurtech platforms that bundle CGL, professional liability, and cyber into a single policy can reduce administrative overhead and sometimes cost less than buying each line separately. Compare multiple quotes — premiums in this market vary more than most business owners expect.
Certificates of Insurance and Proposal Requirements
Winning a contract isn't the end of the insurance process — it's the beginning of the documentation phase. Before your contracting officer can issue a notice to proceed, you'll need to provide proof of coverage. That means a certificate of insurance, almost always on ACORD Form 25, naming the correct government entity and showing all required coverage types and limits.
ACORD 25 is the standard certificate form. Your carrier issues it — don't create your own.
The certificate must name the contracting agency as the certificate holder, using the exact legal name from the contract.
If the contract requires additional insured status for the government, your carrier adds an endorsement — not a note on the certificate.
FAR contracts typically require 30 days written notice to the contracting officer before cancellation. Your policy must include this endorsement.
Do not submit a certificate with expiration dates inside the contract period of performance. Get a renewal in place before your policy lapses.
Do not assume the certificate showing 'General Liability: $1M/$2M' satisfies a clause that requires 'each occurrence $2M, aggregate $4M.' Read carefully.
Some contracts require you to maintain coverage throughout the entire period of performance, including any option years exercised. Set a calendar reminder 90 days before policy expiration so you're not scrambling for a renewal when an option year is about to start. A gap in coverage — even a single day — can trigger a cure notice and give the contracting officer grounds to terminate for default.
If your insurance requirements change during a contract — you add employees, expand to a new work site, or the government exercises an option that changes the scope — update your certificates and notify the contracting officer. Proactive communication on coverage changes is far better than being caught with inadequate coverage during a contract audit.
Track compliance requirements across every pursuit
CapturePilot's pipeline tools let you log insurance requirements, bonding thresholds, and certificate deadlines for every active opportunity — so nothing falls through the cracks between bid and award.
Insurance Mistakes That Kill Contracts
Most insurance problems in government contracting are avoidable. They happen because contractors treat insurance as an afterthought instead of a pre-bid checklist item. Here are the mistakes that actually cost contractors work — and their fixes.
Relying on FAR minimums when the agency requires more
Read Section H and I of every solicitation. Flag insurance clauses before you decide to bid, not after award.
Getting coverage after winning instead of before
Maintain a base policy year-round. When an agency requires higher limits, get the endorsement or umbrella policy within days of award — not weeks.
Letting the policy lapse between contracts
Keep coverage continuous. Set renewal reminders 90 days out. A lapse in the middle of a contract period of performance can trigger termination for default.
Missing the additional insured endorsement
When the solicitation requires the government to be named as additional insured, that requires a specific endorsement from your carrier — not a note on the certificate. Confirm with your broker before award.
Not carrying hired and non-owned auto coverage
If employees ever drive personal vehicles for contract work, standard commercial auto won't cover it. Add hired and non-owned auto to your policy. It's inexpensive.
Submitting certificates with wrong entity names
The certificate holder name must match the contracting agency exactly as listed in the contract. A certificate that says 'US Army' for a contract with 'U.S. Army Corps of Engineers' can be rejected.
Assuming CGL covers professional work
General liability specifically excludes professional services errors. If you provide advice, deliverables, or technical services, you need professional liability — CGL will not respond to those claims.
Use insurance as a competitive signal
If you're building out your compliance infrastructure alongside your contracting strategy, the CapturePilot bid checklist includes insurance documentation as one of its pre-submission verification items. Use it every time before you submit a proposal — the compliance sections alone prevent the most common technical deficiencies.
For a broader look at what compliance looks like across the full proposal process, see our guide on building a compliance matrix — the structure that makes sure every solicitation requirement gets addressed before you submit.
The bottom line on government contractor insurance: get it in place before you start bidding, keep it current throughout your contract, and read every solicitation's insurance section before you commit to a pursuit. The coverage is not expensive relative to the revenue it protects. The cost of a gap — a non-responsive proposal, a work stop, or a default termination — is.
Ready to pursue your first federal contract?
CapturePilot matches your business profile — including certifications, NAICS codes, and size standard — to real federal opportunities, flags compliance requirements in each solicitation, and helps you build proposals that pass the compliance matrix.