When you sign your first enterprise client, three things trigger obligations at once: a Master Services Agreement (MSA) with new liability and indemnification terms, insurance requirements (usually $1M general liability plus $1M–$5M cyber and professional liability named on a certificate of insurance), and data-security commitments you must actually meet. The enterprise's procurement team will send you a compliance checklist before the deal closes. This guide maps each clause you sign to the specific legal, insurance, and security obligation it creates, with dated sources you can verify yourself.
Last updated: August 2026. Coverage limits vary by contract — confirm what yours requires with a licensed broker before committing.
Methodology: Every obligation below is mapped to a public authority source (contract-management, small-business, or insurance-industry guidance) with a last-verified date. We do not recommend buying any coverage until your MSA specifies the exact limits required.
Disclosure: "Erni" is our own contract-scanning product. Where we reference it below, treat that as a first-party recommendation, not independent third-party endorsement. The scan and decode features described are free to use.
TL;DR
- Enterprise buyers require a certificate of insurance (COI) before signing, typically $1M per-occurrence general liability and $1M–$5M cyber/professional liability.
- Your first MSA transfers risk to you through indemnification, limitation-of-liability caps, and data-processing terms many first-timers sign blind.
- Do not sign an MSA — or buy any insurance — until you have read the indemnification clause, the liability cap, and the data-security exhibit, and confirmed the exact coverage limits the contract requires.
What is an MSA and what does it obligate you to do?
A Master Services Agreement (MSA) is the master contract that governs an ongoing enterprise relationship, and it obligates you to meet specific insurance, liability, data-security, and compliance terms for the life of the engagement. Individual projects then run under short Statements of Work (SOWs) that inherit the MSA's terms.
Definition — First MSA obligations: the set of legal, insurance, and operational duties triggered the moment you sign your first Master Services Agreement with an enterprise buyer. These commonly include naming the client as an additional insured, maintaining minimum coverage limits, indemnifying the client against your errors, meeting a data-breach notification window, and passing a security review.
Here is what many 2–20 person shops miss: the MSA is not a formality you sign to start billing. It is a risk-transfer document. Small vendors often carry the most one-sided terms because they have the least leverage. The U.S. Small Business Administration (reviewed 2024) notes that many client contracts contractually require specific liability coverage before work begins — meaning your ability to close the deal depends on your policy, not just your pitch.
What do I need to do when I get my first enterprise client?
Run your signed or draft MSA through a five-step workflow: scan the contract for obligations, decode your current coverage against those obligations, close the insurance gap, meet the security requirements, and produce the certificate of insurance the procurement team requires.
Before you touch any tool, complete this checkpoint:
Do not sign an MSA until you have:
- Read the indemnification clause and identified who pays for what if a claim arises.
- Located the limitation-of-liability cap and confirmed it is mutual (or negotiated it toward mutual).
- Found the data-processing or security exhibit and listed every requirement it names.
- Confirmed the exact insurance limits and endorsements required (e.g., "additional insured," "waiver of subrogation").
- Asked a licensed broker to quote those limits before you commit.
Only after that checkpoint should you evaluate tooling. The National Federation of Independent Business (small-business guidance, 2024) and state insurance regulators such as those listed by the National Association of Insurance Commissioners (consumer resources, updated 2024) can help you confirm whether a policy actually satisfies the contract's language before you certify it.
The five-step workflow
- Scan the contract. Identify every insurance, liability, and data-security clause. A free first pass can flag these obligations so nothing is missed.
- Decode your current coverage. Compare your existing general liability, cyber, and professional liability policies against the limits and endorsements the MSA demands.
- Close the insurance gap. Work with a licensed broker to add limits or endorsements only where the contract requires them. Do not over-buy.
- Meet the security requirements. Implement the breach-notification window, access controls, and any review the exhibit specifies.
- Produce the certificate of insurance (COI). Have your broker issue a COI naming the client as required, and deliver it to procurement before signing.
Free tools can handle the first two steps: our Erni Contract Requirement Scanner flags insurance and security clauses, and our Policy Decoder checks whether your current coverage satisfies them. (First-party product; see disclosure above.)