Insurance Coverage Types Every Compliance Officer Must Know

Insurance compliance is only as strong as your understanding of the coverages you require. Every line on a Certificate of Insurance represents a specific type of protection, and each one has its own structure, standard limits, exclusions, and verification nuances.

This guide covers the 17 coverage types most commonly found in COI requirements. We start with deep dives into the four core coverages — the ones that appear on virtually every requirement set — and then provide practical overviews of 13 specialty coverages that apply to specific industries, trades, or risk profiles.

Whether you are building a new compliance program or refining an existing one, this is the reference you will keep coming back to.

Disclaimer: This information is for educational purposes only and does not constitute insurance advice. Consult a licensed insurance professional for specific coverage requirements.

---

The Four Core Coverages

These four coverage types form the foundation of nearly every vendor, subcontractor, and tenant insurance requirement. If a vendor works on your property, provides services to your business, or has employees on your premises, you will almost certainly require all four.

---

1. Commercial General Liability (CGL)

Commercial General Liability is the cornerstone of every COI requirement. It protects against third-party claims of bodily injury, property damage, personal injury, and advertising injury arising from business operations. If you only require one coverage from a vendor, this is the one.

How CGL Policies Are Structured

A CGL policy has several distinct limit categories, each serving a different purpose. Understanding the structure is essential for verifying that a certificate meets your requirements.

Each Occurrence Limit is the maximum the insurer will pay for a single claim or incident. The standard each occurrence limit is $1,000,000. This is the single most important number on the CGL line of a certificate.

General Aggregate Limit is the maximum the insurer will pay for all claims during the policy period, excluding products/completed operations. The standard general aggregate is $2,000,000. Once this limit is exhausted, the insured has no further coverage for the remainder of the policy term — a critical consideration for vendors who work on multiple sites simultaneously.

Products/Completed Operations Aggregate is a separate aggregate that applies specifically to claims arising from the insured's products or from work that has been completed. This is particularly important in construction, where a defect may not manifest until after the subcontractor has left the site. The standard limit is $2,000,000.

Damage to Rented Premises (also called Fire Legal Liability) covers property damage to premises rented to the insured. The standard limit is $100,000, though many commercial real estate requirement sets push this to $300,000 or $500,000 for tenants and vendors working inside the building.

Medical Expense covers medical costs for third parties injured on or because of the insured's premises or operations, regardless of fault. It is a goodwill coverage with a standard limit of $5,000 per person. It rarely factors into compliance decisions, but it does appear on every ACORD 25.

Personal and Advertising Injury covers non-physical torts including libel, slander, false arrest, wrongful eviction, and copyright infringement in advertising. The standard limit is $1,000,000 and typically equals the each occurrence limit.

Occurrence vs. Claims-Made

There are two trigger mechanisms for CGL policies, and the distinction matters enormously for compliance.

An occurrence-based policy covers incidents that happen during the policy period, regardless of when the claim is filed. If a vendor had an occurrence policy in effect when an accident happened in 2025, that policy responds even if the claim is not filed until 2027. This is the standard form and what most requirement sets require.

A claims-made policy covers claims that are both made and reported during the policy period (or an extended reporting period). If the policy is cancelled or not renewed, there is no coverage for claims made after the termination date — even if the incident happened while the policy was in force. Claims-made CGL policies are uncommon but do exist, particularly in professional services. If you accept claims-made CGL policies, you should require a retroactive date that precedes the start of the vendor's work and ideally require an extended reporting period (tail) of at least two years after work is complete.

When to Require Higher Limits

The standard $1M/$2M CGL limits are appropriate for most low-to-medium risk vendors. You should consider requiring higher limits when:

• High-traffic environments: Vendors working in occupied commercial buildings, retail centers, or event venues where the probability of third-party injury is elevated.
• High-value property exposure: Vendors working near expensive equipment, tenant improvements, or in data centers.
• Construction trades with significant risk: Demolition, roofing, structural steel, and excavation contractors routinely carry $2M/$4M or higher CGL limits.
• Contractual requirements flow down: If your own insurance program or client contracts require minimum limits from you, you need to push those same minimums (or higher) to your subcontractors.

In many cases, rather than requiring higher primary CGL limits, you can accept standard $1M/$2M primary limits supplemented by an umbrella or excess policy. We cover the rules for this approach in the Umbrella/Excess section below.

Additional Insured Status Under CGL

Requiring additional insured status on a vendor's CGL policy is one of the most important risk transfer mechanisms in commercial insurance. When your organization is named as an additional insured, the vendor's policy provides primary coverage for claims arising from the vendor's work — meaning the vendor's insurer pays first, before your own insurance is implicated.

On an ACORD 25, additional insured status is indicated in the Description of Operations section or by checking the Additional Insured box in the CGL row. The underlying endorsement form matters: CG 20 10 covers ongoing operations, while CG 20 37 covers completed operations. Best practice is to require both.

---

2. Workers' Compensation and Employers' Liability

Workers' Compensation is a statutory requirement in every U.S. state for businesses with employees. It covers medical expenses, lost wages, rehabilitation, and death benefits for employees who are injured or become ill on the job. Employers' Liability is Part B of the same policy and covers the employer's legal liability for employee injuries that fall outside the workers' compensation statute.

Per Statute Requirement

Unlike other coverages, Workers' Compensation limits are not expressed as dollar amounts on a COI. Instead, the certificate states coverage is provided "per statute" — meaning the policy pays whatever benefits the applicable state law requires. The limits are defined by the state, not by the policy.

This makes WC verification different from other coverages. You are not checking whether a limit meets your requirement; you are checking that the coverage exists, that it covers the correct state(s), and that it is in force.

Employers' Liability Limits

Employers' Liability (EL) does have specific limits, structured as three sublimits:

The standard EL limits are $500,000/$500,000/$500,000 for smaller contractors and $1,000,000/$1,000,000/$1,000,000 for higher-risk or higher-value work. Some compliance programs accept the $500K level and allow the umbrella/excess policy to provide excess EL coverage.

Monopolistic State Funds

Four states operate monopolistic state fund workers' compensation systems: Ohio, Washington, Wyoming, and North Dakota. In these states, employers must purchase workers' compensation coverage from the state fund rather than from a private insurer. The state fund does not include Employers' Liability coverage.

This creates a compliance gap. When a vendor based in a monopolistic state provides a COI, the WC line will show the state fund, but there will be no EL limits listed. To close this gap, require vendors in these states to carry a Stop Gap Endorsement on their CGL policy. The stop gap endorsement adds employers' liability coverage to the CGL, filling the gap left by the state fund.

When verifying COIs from monopolistic-state vendors, check for:

1. Workers' Compensation from the state fund (OH BWC, WA L&I, WY WSC, or ND WSI)
2. A stop gap endorsement noted on the CGL line or in the Description of Operations
3. EL limits on the CGL that match your requirement

Sole Proprietors and Exemptions

Many states allow sole proprietors, partners, and corporate officers to exempt themselves from workers' compensation requirements. A sole proprietor with no employees may provide a WC exemption affidavit instead of a WC policy. Your program should have a clear policy on whether you accept exemptions. If you do, require written proof of the exemption and have the vendor acknowledge in writing that they are personally responsible for any work-related injury.

Be cautious: a vendor who claims an exemption but actually has employees is exposing you to significant risk. If their uninsured employee is injured on your property, you may face a workers' compensation claim against your own policy.

Waiver of Subrogation

A Waiver of Subrogation endorsement on the WC policy prevents the workers' compensation insurer from seeking reimbursement from your organization after paying a claim. Without this waiver, if a vendor's employee is injured on your property and the vendor's WC insurer pays the claim, the insurer could turn around and sue you to recover its costs. Always require WoS on Workers' Compensation for vendors working on your premises.

---

3. Commercial Auto Liability

Commercial Auto Liability covers bodily injury and property damage arising from the use of vehicles in the insured's business operations. If vendors drive to your property, deliver materials, or operate vehicles as part of their work, auto liability coverage is essential.

Coverage Symbols: Which Vehicles Are Covered

Auto policies use coverage symbols (numbered 1 through 9) to define which vehicles are covered. The three most relevant to COI compliance are:

Symbol 1 — Any Auto: The broadest coverage. Covers all vehicles, including owned, hired, leased, borrowed, and non-owned vehicles. This is the gold standard for compliance requirements. When you see "Any Auto" checked on a COI, the vendor has the broadest auto coverage available.

Symbol 2 — Owned Autos Only: Covers only vehicles the insured owns. This leaves a gap for rented, borrowed, or employee-owned vehicles used for business.

Symbol 8 — Hired Autos: Covers vehicles the insured rents or borrows. Important for vendors who do not own vehicles but rent them for specific jobs.

Symbol 9 — Non-Owned Autos: Covers vehicles the insured does not own but that are used in its business — typically employees' personal vehicles used for work purposes.

For most compliance programs, require either Symbol 1 (Any Auto) or the combination of Symbols 2, 8, and 9 (Owned, Hired, and Non-Owned). If a vendor does not own any vehicles, they should still carry Hired and Non-Owned auto coverage — employees driving their personal cars to your site represent a real exposure.

Combined Single Limit vs. Split Limits

Auto liability can be written with either a Combined Single Limit (CSL) or split limits.

Combined Single Limit provides one limit that applies to both bodily injury and property damage per accident. The standard CSL is $1,000,000. This is simpler to verify and more commonly required in COI programs.

Split limits break coverage into three sublimits:

• Bodily Injury per Person (e.g., $250,000)
• Bodily Injury per Accident (e.g., $500,000)
• Property Damage per Accident (e.g., $100,000)

Split limits are harder to compare against requirements and can leave gaps in coverage. Best practice is to require a CSL. If a vendor's policy uses split limits, you need to evaluate whether the individual sublimits are adequate for your risk profile.

MCS-90 and Motor Carrier Endorsements

If your vendors include trucking companies or motor carriers, you may encounter the MCS-90 endorsement. This is a federal requirement for motor carriers transporting property in interstate commerce. The MCS-90 guarantees that the insurer will pay up to the required minimum financial responsibility limits ($750,000 to $5,000,000, depending on cargo type) for public liability claims — even if the underlying policy would not otherwise cover the claim. It is not a coverage endorsement; it is a financial guarantee to the public. If a vendor's auto policy includes MCS-90, it confirms they meet federal motor carrier financial responsibility requirements.

---

4. Umbrella and Excess Liability

Umbrella and Excess Liability policies provide additional limits above the insured's primary policies (CGL, Auto, and Employers' Liability). They are the mechanism that allows a vendor to meet high limit requirements without purchasing high primary limits on each individual policy.

Umbrella vs. Excess: The Critical Difference

These terms are often used interchangeably, but they describe different products with different scopes.

An Umbrella policy provides excess limits above underlying policies and also drops down to provide coverage for claims that the underlying policies exclude — subject to the umbrella's own terms and a self-insured retention (SIR). An umbrella may cover exposures that the CGL, auto, or EL policies do not, such as certain international liabilities or personal injury claims not covered by the primary CGL.

An Excess policy is strictly follow-form, meaning it provides additional limits but only for claims that the underlying policy would cover. It does not broaden coverage. If the primary policy excludes a claim, the excess policy excludes it too.

For COI compliance purposes, this distinction matters in edge cases. An umbrella policy provides broader protection because it can fill gaps in underlying coverage. An excess policy is simpler and cheaper but leaves those gaps uncovered.

On an ACORD 25, look at the Umbrella/Excess Liability section. The form has a checkbox for "Umbrella" or "Excess." If a certificate lists only "Excess," be aware that the vendor does not have drop-down coverage.

Self-Insured Retention (SIR)

Most umbrella and some excess policies include a Self-Insured Retention — a dollar amount the insured must pay out of pocket before the umbrella/excess policy responds. Common SIR amounts range from $0 to $25,000, though they can be much higher for large commercial risks.

From a compliance perspective, the SIR matters because:

• A high SIR means the insured is self-funding the initial portion of any claim that falls within the umbrella's drop-down coverage.
• If the insured cannot pay the SIR, the umbrella insurer has no obligation to pay either.
• Best practice: require a maximum SIR of $10,000 unless the vendor can demonstrate financial capacity to absorb a higher retention.

The SIR is shown on the ACORD 25 in the Umbrella/Excess section. If it is blank, the SIR is typically $0 — but always verify.

Supplementation Rules

One of the most practical applications of umbrella/excess coverage is supplementation — using the umbrella to satisfy primary limit requirements that exceed the insured's primary policy limits.

Example: Your requirement calls for $1,000,000 each occurrence CGL. A vendor has $500,000 each occurrence CGL with a $5,000,000 umbrella that sits excess of the CGL. Does this vendor meet your requirement?

The answer depends on your program's supplementation policy:

• Strict programs require primary policy limits to independently meet the requirement. The vendor's $500K primary CGL fails the $1M requirement regardless of the umbrella.
• Flexible programs allow the combination of primary + umbrella/excess to satisfy the requirement. The vendor's $500K primary + $5M umbrella = $5.5M effective limit, which exceeds the $1M requirement.

Most modern compliance programs accept supplementation for practical reasons. Requiring every vendor to carry high primary limits eliminates many otherwise qualified vendors, particularly smaller businesses. If you accept supplementation, document the rules clearly:

1. The umbrella/excess must sit directly excess of the deficient primary policy.
2. The umbrella/excess must list the certificate holder as additional insured (if required on the underlying policy).
3. The combined primary + umbrella/excess limits must meet or exceed the requirement.
4. The SIR must be within your acceptable threshold.

Standard Umbrella/Excess Limits by Risk Level

---

Specialty Coverages

The following 13 coverage types appear in COI requirements for specific industries, trades, or risk profiles. While not universal, each one addresses an exposure that the four core coverages do not.

---

5. Professional Liability (Errors & Omissions)

Professional Liability, commonly called Errors & Omissions (E&O), covers claims arising from professional services — specifically allegations of negligence, errors, omissions, or failure to perform. It is essential for architects, engineers, consultants, IT service providers, attorneys, accountants, and any vendor whose work product involves professional judgment.

CGL policies specifically exclude professional services claims. If an architect's design error causes a structural failure, CGL will not respond — only a Professional Liability policy will.

E&O policies are almost always claims-made, meaning the policy in force when the claim is made (not when the error occurred) responds. Require a retroactive date that precedes the start of the vendor's work and consider requiring a two-to-three year extended reporting period (tail) after the engagement ends. Standard limits range from $1,000,000 to $5,000,000 depending on the scope and value of the professional engagement.

6. Cyber Liability

Cyber Liability insurance covers losses arising from data breaches, cyberattacks, network security failures, and privacy violations. As more vendors handle sensitive data — building management systems, tenant information, financial records — cyber coverage has become a standard requirement for technology vendors and any vendor with access to your systems or data.

Typical cyber policies cover first-party losses (forensic investigation, notification costs, business interruption, data restoration) and third-party claims (regulatory fines, lawsuits from affected individuals, PCI-DSS penalties). Standard limits range from $1,000,000 to $5,000,000 for most vendor relationships. For vendors with access to large databases of PII or PHI, consider $10M+.

Cyber policies are claims-made. Verify the retroactive date and require tail coverage.

7. Pollution Liability

Pollution Liability covers claims arising from the release of pollutants — including bodily injury, property damage, and cleanup costs. Standard CGL policies contain an absolute pollution exclusion that eliminates coverage for virtually all pollution-related claims.

This coverage is essential for environmental contractors, remediation firms, HVAC companies (refrigerant releases), painting contractors (lead paint), asbestos abatement firms, and any vendor whose operations may involve hazardous substances. Pollution policies can be written on an occurrence or claims-made basis. Standard limits range from $1,000,000 to $5,000,000. For environmental remediation work, $10M+ is common.

8. Builders Risk

Builders Risk (also called Course of Construction) covers physical damage to a building or structure while it is under construction, renovation, or repair. It covers the structure itself, materials, fixtures, and equipment that will become part of the finished building.

Builders Risk is typically purchased by the project owner or general contractor and covers all parties working on the project. It is a first-party property policy, not a liability policy. Verify who is responsible for purchasing Builders Risk in the construction contract — if the GC is responsible, you should see it on their COI. Coverage amounts should equal the completed value of the project.

9. Property Insurance

Property Insurance (also called Commercial Property or Business Owners Property) covers damage to the insured's own physical assets — buildings, equipment, inventory, and business personal property. While this is a first-party coverage (the insured protecting its own assets), it appears in COI requirements when a vendor occupies space in your building, stores equipment on your property, or is responsible for property in their care, custody, or control.

For tenants, require property insurance sufficient to cover their tenant improvements and business personal property. This prevents the tenant from making claims against your building policy for losses to their own property.

10. Liquor Liability

Liquor Liability covers claims arising from the sale, serving, or distribution of alcoholic beverages. It is essential for bars, restaurants, caterers, and event venues — and for any vendor providing alcohol service at events on your property. Standard CGL policies exclude liquor liability for businesses in the business of selling or serving alcohol. Limits typically match CGL limits at $1,000,000 per occurrence / $2,000,000 aggregate.

11. Directors & Officers (D&O) Liability

D&O insurance protects the personal assets of corporate directors and officers against lawsuits alleging wrongful acts in their management capacity. While D&O is not a standard COI requirement for vendors, it appears in requirements for property management companies, investment advisors, and fiduciaries who make decisions that affect your organization's interests. D&O is claims-made with limits typically ranging from $1,000,000 to $10,000,000.

12. Employment Practices Liability (EPLI)

EPLI covers claims by employees alleging discrimination, harassment, wrongful termination, retaliation, and other employment-related torts. It is not a standard vendor COI requirement but may be required for staffing agencies, property management firms, and vendors who place personnel at your sites for extended periods. The risk is that a vendor's employee alleges harassment by your personnel, and the claim implicates both organizations. Standard limits range from $1,000,000 to $5,000,000.

13. Crime / Fidelity Insurance

Crime insurance (also called Fidelity Bond or Employee Dishonesty coverage) covers losses caused by criminal acts of the insured's employees — theft, embezzlement, forgery, and fraud. Require this from vendors who have access to your financial systems, handle cash or checks, manage procurement, or have keys and access codes to your property. Standard limits range from $250,000 to $1,000,000 depending on the value of assets the vendor can access.

14. Garage Keepers Liability

Garage Keepers covers damage to vehicles in the insured's care, custody, or control — specifically for businesses that park, service, or store customers' vehicles. Require this from valet services, parking garage operators, and auto repair shops working on your property. Coverage can be written on a direct primary, direct excess, or legal liability basis. Direct primary is the broadest and most vendor-friendly. Limits should reflect the maximum value of vehicles likely to be in the insured's care at any time.

15. Inland Marine

Inland Marine covers property in transit, at temporary locations, or that is mobile by nature — tools, equipment, artwork, electronics, and specialized machinery. For compliance purposes, Inland Marine appears when a vendor brings valuable equipment to your property and you want assurance that their equipment is covered. If the vendor's equipment is damaged on your premises and they are uninsured, they may attempt to claim against your property policy. Standard limits are based on the total replacement value of the covered property.

16. Business Interruption

Business Interruption insurance covers lost income and continuing expenses when the insured's operations are disrupted by a covered peril (typically tied to a property loss). While this is a first-party coverage that protects the insured's own income, it may appear in requirements for critical vendors whose disruption would affect your operations — data center operators, sole-source suppliers, and key service providers. Limits are typically expressed as a 12-month income value or a specific dollar amount.

17. Installation Floater

Installation Floater covers materials and equipment during transit to a job site and during installation, until the work is completed and accepted by the owner. It fills the gap between the vendor's Inland Marine coverage (which covers their own equipment) and the project's Builders Risk policy (which covers the structure). This coverage is particularly relevant for HVAC installation, elevator installation, and specialty equipment contractors. Coverage amounts should equal the contract value of the materials being installed.

---

Putting It All Together

No vendor needs all 17 coverages. The art of compliance is matching the right coverages to the right risk profile. A janitorial vendor needs CGL, WC, and Auto. An environmental remediation firm needs those three plus Pollution Liability and possibly an Umbrella. A technology consultant needs CGL, Cyber, and Professional Liability.

The key is building a requirement framework that tiers coverages by vendor type and risk level — and then having the systems and processes to verify compliance consistently across your entire vendor portfolio.

---

Start Building Your Requirements

Inori makes it simple to define coverage requirements for every vendor tier, automatically verify COIs against those requirements, and track compliance in real time.

Get started with Inori and see how automated COI compliance eliminates the spreadsheet chaos — so you can focus on the risks that actually matter.