What Insurance Should You Require from Vendors? A Practical Checklist

Vendor insurance requirements are the specific coverage types, minimum limits, and endorsements an organization mandates from third parties before they begin work. At a minimum, most procurement teams require General Liability, Workers’ Compensation, and Auto Liability, but the right requirements depend on the vendor’s scope and the risk transfer language in your agreement.

In this blog, we’ll walk you through the vendor insurance requirements you must look for during procurement, the minimum insurance requirements you need to protect your organization, and how you can verify a complete and compliant certificate of insurance for vendors.

Key Takeaways

• Vendor insurance requirements should be tied to the contractual risk you’re transferring.
• General Liability, Workers’ Compensation, Auto Liability, and Professional Liability are the minimum needs. Higher-risk vendors need umbrella, cyber, and pollution coverage.
• Minimum limits vary significantly by industry. A $1M General Liability limit may be sufficient for a hospitality vendor but low for construction subcontractor insurance requirements.
• Additional Insured, Primary and Noncontributory, and Waiver of Subrogation endorsements determine whether the policy actually responds the way your contract assumes.
• A certificate of insurance (COI) on file is not the same as verified compliance. Policies expire, endorsements get omitted, and limits change mid-term.
• Ongoing verification is what closes the gap between paper vendor compliance and real risk transfer.

Why Vendor Insurance Requirements Matter

Imagine this: your facilities team hires a cleaning vendor to handle nightly janitorial work across three office locations. The contract requires $1M in General Liability and Workers’ Compensation per statute. Procurement collects a certificate of insurance for vendors at onboarding, files it, and moves on.

Eighteen months later, a contractor’s employee slips on a wet floor left by that vendor and suffers a back injury. The claim lands at $250,000. Your team pulls the COI and sees the General Liability policy expired four months ago, the Workers’ Compensation policy was issued in a state where the vendor no longer operates, and there’s no Additional Insured endorsement naming your organization.

Vendor insurance requirements close that gap. They shift financial exposure to the party best positioned to control the risk. When done poorly, your organization absorbs losses you thought you’d contracted away.

A defensible program requires three things working together:

1. Requirements tied to actual exposure
2. Verification that goes beyond document collection
3. Continuous monitoring

The Core Vendor Insurance Requirements Checklist

Every vendor compliance check should start with a baseline set of coverages, then layer in vendor-specific requirements based on scope. Here’s the working checklist most procurement teams should adapt:

Baseline Coverages

• Coverage General Liability
  • Includes third-party bodily injury, property damage, personal and advertising injury
  • Applies to any vendor with physical presence on your premises or interacting with your customers
• Workers’ Compensation
  • Includes employee injury and occupational illness for the vendor’s workforce
  • Applies to any vendor with employees (statutory in nearly every state)
• Employer’s Liability
  • Includes employer exposure beyond statutory WC coverage
  • Bundled with Workers’ Comp; verify limits separately
• Commercial Auto Liability
  • Includes vehicle-related bodily injury and property damage
  • Any vendor operating vehicles for your work
• Umbrella / Excess Liability
  • Includes additional limits above primary CGL, Auto, and Employer’s Liability
  • High-exposure work, large contract values, or where required by contract

Scope-Specific Coverages (Required Based on Vendor Work)

• Professional Liability (E&O)
  • Vendors providing advice, design, or professional services, like IT consultants, engineers, architects, accounting firms
• Cyber Liability
  • Vendors with access to your data, systems, or networks
• Pollution / Environmental Liability
  • Janitorial, waste handling, landscaping with chemicals, construction with environmental exposure
• Crime / Fidelity Bond
  • Vendors handling cash, valuables, or with unsupervised access to facilities
• Inland Marine
  • Vendors transporting or storing your property
• Builder’s Risk
  • Construction vendors during the course of a project

Minimum Insurance Limits by Industry

Minimums should reflect the financial exposure of the work. Here’s a working reference for common industries:

	General Liability (Per Occurrence / Aggregate)	Auto Liability	Workers’ Comp	Umbrella / Excess
Construction (general)	$1M / $2M	$1M CSL	Statutory + $100K/$500K/$100K EL	$5M–$10M+
Construction (subcontractor)	$1M / $2M	$1M CSL	Statutory + $100K/$500K/$100K EL	$2M–$5M
Equipment Rental (vendors servicing fleet)	$1M / $2M	$1M CSL	Statutory + $1M EL	$2M–$5M
Hospitality	$1M / $2M	$1M CSL	Statutory + $1M EL	Up to $5M
Public Sector Vendors	$1M / $2M minimum; often $2M / $4M	$1M CSL	Statutory + $1M EL	$5M+ common
Partner Networks (B2B2C)	$1M / $2M	$1M CSL (if applicable)	Statutory + $1M EL	$2M–$5M
Transportation & Logistics	$1M / $2M	$1M–$5M CSL (often higher per FMCSA)	Statutory + $1M EL	$5M+
Manufacturing	$1M / $2M	$1M CSL	Statutory + $1M EL	$2M–$5M
IT / Professional Services	$1M / $2M	$1M CSL	Statutory + $1M EL	$2M–$5M

 

The $100K/$500K/$100K EL figure shown for construction is the ISO/NCCI default minimum that comes bundled with most WC policies — it is not necessarily adequate for the exposure. Many general contractor and owner contracts require subcontractors to carry $500K or $1M EL specifically because of the higher injury severity on job sites, so treat the default as a floor to verify against, not a target.

For construction-specific guidance, including subcontractor insurance requirements, project value, and OCIP/CCIP wrap-up affect requirements, see our deeper treatment in Understanding subcontractor insurance.

Endorsements to Require

Three endorsements matter most when requiring insurance from vendors:

Additional Insured

This extends the vendor’s General Liability policy to cover your organization as an insured for liability arising out of the vendor’s work. Without it, the vendor’s policy defends the vendor only.

Primary and Noncontributory

This endorsement does two things: it requires the vendor’s policy to respond first (primary), and it prevents the vendor’s insurer from demanding that your insurer share the loss (noncontributory). Without it, your insurer can be pulled into a claim that contractually belonged to the vendor.

Primary and Noncontributory is frequently confused with Waiver of Subrogation. They are not the same. Primary and Noncontributory governs how the policy responds at the time of claim. Waiver of Subrogation governs whether the insurer can pursue recovery after paying a claim.

For a full walkthrough of how this endorsement operates and where teams misread it, see our deep-dive on primary and noncontributory endorsements.

Waiver of Subrogation

This prevents the vendor’s insurer from suing your organization after paying a claim. It’s standard in most master service agreements and required by many public sector procurement codes.

How to Verify a Vendor COI Is Complete and Compliant

Collecting a certificate of insurance for vendors is the start of the verification process. A complete verification workflow has five steps:

1. Confirm the COI Matches the Contract: Coverage types, limits, and endorsements on the certificate need to align with what the contract requires.
2. Verify Policy Effective Dates: Confirm the policy is in force at the time the vendor begins work.
3. Request and Review the Actual Endorsement Forms: ACORD checkboxes are not proof of endorsement. Pull the forms and verify they name your organization and apply to the scope of work.
4. Flag Exceptions: Vendors will occasionally request exceptions. These need a documented review and approval workflow, not a one-off email.
5. Set Monitoring Triggers: Track policy expiration, mid-term cancellation notices, and any changes to coverage.

To learn more about how to request a COI in the first place, see How To Request a Certificate of Insurance From A Vendor. For the full vendor onboarding process, see our vendor onboarding checklist and our supplier onboarding best practices.

This is where manual programs break down at scale. A procurement team managing 50 vendors can run this workflow with a spreadsheet and discipline. A team managing 500 or 5,000 cannot. Evident’s third-party risk management platform handles continuous monitoring, automated policy validation against contract requirements, expiration tracking, and exception detection. That means the verification workflow runs in the background rather than consuming procurement and risk team hours.

When (and How) to Allow Exceptions

No vendor insurance program is purely binary. There will always be vendors who can’t meet a stated requirement. Exceptions aren’t inherently a problem. Undocumented, unreviewed exceptions are.

We’ve put together a downloadable Vendor Insurance Exception Review Checklist that walks through each of these steps with the specific questions to ask, fields to capture, and approval routing to consider.

For the broader contractual risk transfer framework this exception process sits inside, see our 5-step checklist to transfer and reduce risk.

Frequently Asked Questions

What insurance should I require from my vendors?

At minimum, most vendors should carry Commercial General Liability, Workers’ Compensation with Employer’s Liability, and Commercial Auto Liability. Vendors providing professional services should also carry Professional Liability (E&O). Vendors with access to your data or systems should carry Cyber Liability.

What are typical minimum insurance limits for a vendor COI?

The most common baseline is $1M per occurrence / $2M aggregate for General Liability, $1M combined single limit for Auto Liability, and statutory Workers’ Compensation with $1M Employer’s Liability. Higher-risk industries typically require $2M / $4M or higher, plus umbrella limits of $5M to $10M.

Should I require additional insured status from every vendor?

For any vendor performing work on your premises, interacting with your customers, or where your organization could be named in a liability claim arising out of the vendor’s work, yes. For low-risk vendors with no on-site presence and no exposure to your customers or property, additional insured status may not be necessary, but the decision should be documented.

How do vendor insurance requirements differ by industry?

Industry drives both the coverage mix and the limits. Construction vendors typically need higher GL limits, robust umbrella coverage, and strict endorsement requirements including Primary and Noncontributory. Transportation vendors need higher Auto Liability limits and cargo coverage. IT and professional service vendors need Professional Liability and Cyber. Public sector vendors often face limits set by procurement code rather than risk assessment. Hospitality vendors serving alcohol need Liquor Liability.

What does a complete vendor COI look like?

A complete COI includes: the vendor’s legal name and address; the producer (broker) issuing the certificate; each policy with carrier name, policy number, effective and expiration dates, and limits; the certificate holder (your organization, correctly named); a description of operations field referencing the contract or scope of work; and notation of required endorsements (Additional Insured, Primary and Noncontributory, Waiver of Subrogation).

How often should vendor insurance requirements be reviewed?

Vendor insurance requirements should be reviewed at least annually at the program level, and at each contract renewal at the vendor level. Material changes in scope, claim history, regulatory environment, or market conditions can warrant interim reviews.