Cyber Insurance for Contractors: What GCs Are Now Requiring

A subcontractor in Doral won a $2.3 million mechanical scope last spring. A week before mobilization, the GC's project executive sent a new requirement: $1 million in cyber liability coverage, effective before the first NTP. The sub had never heard of cyber insurance. Their broker scrambled for two weeks and found a policy, but the premium was 40% higher than it should have been because they had no documentation of basic security controls. They nearly lost the job.

That situation is happening across South Florida's construction market right now. General contractors, particularly those working on commercial, healthcare, and government projects, are updating their subcontractor prequalification requirements to include cyber insurance and basic security attestations. Some are doing it because their own insurance carriers require it. Others are doing it because a breach on one sub's laptop cost the GC $800,000 in project delays and legal fees in 2024. Either way, the standard is moving, and subs who aren't ready are losing work.

I sat with a mechanical contractor in Hialeah last month who had just lost a bid on a county infrastructure project because he couldn't produce a cyber insurance certificate. His company had 22 employees and had been in business for 18 years. He'd never needed cyber coverage before. Now he needed it, and he had no idea where to start.

Key Takeaways

• General contractors are adding cyber insurance minimums, typically $1 million per occurrence, to subcontractor prequalification and contract requirements.
• Bonding companies and surety underwriters are now asking for cyber security attestations alongside financial statements for bonds over $500,000.
• A sub without documented security controls will pay 25–50% more in cyber insurance premiums than one who has basic controls in place.
• Most construction firms qualify for a standard cyber policy if they can demonstrate endpoint protection, multi-factor authentication, and a written backup process.
• A GC's cyber incident caused by a sub's compromised credentials can void the sub's policy and leave both parties uninsured for that event.

Why GCs Started Requiring Cyber Insurance from Subs

The Shared Network Problem

On any mid-size commercial project, the general contractor, five to twenty subcontractors, the owner's rep, and the design team are sharing a common data environment. Files move through Procore or Buildertrend. RFIs and submittals travel by email. Change orders get approved through a project management portal. Every one of those touchpoints is a potential entry point.

When a ransomware group compromised a plumbing sub's laptop in Atlanta in 2024, they used that connection to reach the GC's Procore environment. They didn't encrypt the plumbing sub's files. They went after the owner's project budget documents and the GC's billing records. The attack cost the GC $820,000 in response costs, project delays, and claims. The plumbing sub had no cyber insurance. The GC's carrier paid the claim but then sued the sub for contribution. That lawsuit is still active.

GCs have taken notice. If a sub's compromised device or credential can create a multi-million dollar exposure, the GC wants to know that sub has the coverage to contribute to a loss.

The Insurance Carrier Push

GCs' own cyber policies now routinely include vendor management requirements. When a GC renews their cyber coverage, their carrier asks: do you have minimum cybersecurity requirements for the contractors who access your systems? If the GC can't say yes, the carrier either raises the premium or reduces the coverage limit for third-party incidents. So when a GC puts cyber requirements in their sub agreements, they're often doing it to satisfy their own carrier as much as to protect themselves.

Bonding companies have followed the same path. For contract bonds over $500,000, surety underwriters at several major companies now include a cyber section in their prequalification questionnaire. They want to know if you have cyber insurance, what the limit is, and whether you've had a cyber incident in the last three years.

Actionable tip: Before your next bid cycle, call your bonding company and ask what cyber security questions they're including in their prequalification. Get a copy of the questionnaire now, before you're filling it out under deadline pressure.

What Underwriters Check Before They Quote You

The Security Controls That Move the Premium

Cyber insurance underwriters don't care how long you've been in business or how clean your safety record is. They care about one thing: how hard is it to breach your systems? The controls that reduce your premium and improve your ability to get coverage at all are:

Multi-factor authentication (MFA) on email, remote access, and project management platforms. This single control can move a policy from a standard tier to a preferred tier with some carriers. If your team uses Office 365 and Procore, turning on MFA takes about two hours and costs nothing extra on most plans.

Endpoint detection and response (EDR) on laptops and desktops. A traditional antivirus doesn't meet the bar anymore. Underwriters want to see an EDR tool that can detect and contain an attack, not just flag a virus after the fact. For a 20-person construction firm, this runs about $12–18 per device per month.

Regular, tested backups stored in a location that ransomware can't reach. Specifically, underwriters ask whether backups are stored offline or in a separate cloud tenant from your primary systems. A backup on the same Google Drive your employees use doesn't count.

Written security policies, even simple ones. A one-page document that says who manages your IT, what happens when an employee leaves, and how you handle project data is enough to check the box. Most firms don't have this. It takes an afternoon to write.

Actionable tip: Pull your most recent cyber insurance renewal application or ask your broker to send you a blank application. Read through the security controls section and mark every question where your honest answer is "no." Those are your premium reduction opportunities.

What Gets You Declined

Underwriters decline or non-renew construction firms for a short list of reasons. The most common in the South Florida market right now:

• No MFA on email. This alone can get you declined by several carriers.
• An unpatched remote desktop protocol (RDP) port. If your IT setup lets employees connect to the office network via Windows Remote Desktop without a VPN or MFA in front of it, that port shows up in a carrier's automated scan and can get you declined at application.
• A prior claim you didn't disclose. Ransomware hits that firms handled quietly without filing a claim still show up in underwriting databases. Carriers ask, and they verify.
• Employees using personal devices for project work with no MDM policy. When a field supervisor uses their personal phone to access Procore and that phone gets compromised, the firm has no visibility into the incident and no way to prove it wasn't a covered system. Carriers don't like that exposure.

If you can answer yes to MFA, yes to tested backups, and yes to a basic security policy, you'll qualify for coverage at most carriers. The premium range for a $1 million/$2 million policy for a 15-40 person construction firm runs $1,800-$4,500 per year.

How to Get Ready Before the Next Bid

Start with Your Current Coverage

Before you call a broker, check what you already have. Some commercial general liability and professional liability policies include a small cyber endorsement, typically $250,000 or less. That's not enough to satisfy most GC requirements, but it tells you that you've already cleared the underwriting baseline at least once. Pull your current policy documents and look for language about "network security," "data breach," or "cyber liability." Your broker can confirm what's there.

If you have no cyber coverage at all, don't wait for a bid requirement to force the issue. The firms that buy coverage proactively get better rates, more carrier options, and a longer application window than the ones who call a broker five days before a contract signing.

Build the Documentation Before You Apply

The firms that move through the application process fastest are the ones with a folder ready: their current antivirus or EDR vendor, their backup solution and the last restore test date, their IT contact or MSP name, and a one-page security policy. You don't need a SOC 2 audit. You don't need a formal risk assessment. You need enough documentation to show an underwriter that someone is paying attention to your security.

If you work with an MSP or IT provider, ask them for a one-page summary of the security tools they manage for you. Most can produce this in a day. If they can't, that's a different problem.

Actionable tip: Create a shared folder in your project management system labeled "Insurance & Compliance." Put your current certificates, your last security policy document, and your backup documentation there. When a GC asks for proof of coverage or a security attestation, you pull from one place instead of scrambling.

Looking to get your security documentation in order before your next bid cycle? GDS offers a free assessment for South Florida construction firms that walks through exactly what underwriters and GCs are checking for.

What Happens When a GC's Requirements Exceed Your Coverage

The Additional Insured Gap

The most common mismatch between what a sub has and what a GC requires isn't the coverage limit. It's the additional insured requirement. A GC who wants to be named as additional insured on your cyber policy is asking for something specific: if a breach originates from your systems and causes a loss to the GC, their insured status gives them a direct claim under your policy without needing to sue you first.

Not all cyber policies offer additional insured endorsements. Those that do charge an extra fee, typically $150–$500 per year. If your broker didn't include this endorsement when they wrote the policy, you need to add it before submitting the certificate to the GC. This takes a few days and may require the GC to submit their entity information to your carrier.

Scope Exclusions That Can Void Your Claim

Read the exclusions section of any cyber policy before you sign the sub agreement. Two exclusions are common in construction-specific policies that can eliminate your coverage exactly when you need it:

The professional services exclusion. Some cyber policies exclude incidents arising from the delivery of professional services. For a subcontractor who also provides design-assist work or who creates specifications for their scope, this can be a problem. Make sure your broker understands the full scope of what your firm delivers, not just what your license category says.

The war and terrorism exclusion. This sounds irrelevant until you know that several cyber insurance carriers applied this exclusion to claims from the NotPetya ransomware attack in 2017, which affected construction and infrastructure firms. The language has been narrowed since then, but check that your policy uses the "acts of a nation-state" definition rather than a broader war exclusion.

Your compliance management setup should track certificate renewals, required endorsements, and GC-specific requirements alongside your safety and license documentation. Those obligations have the same consequence as an expired safety certification: you don't get on the job.

Actionable tip: When you receive a new subcontract agreement, send the cyber insurance requirements section to your broker before you sign. Ask them to confirm your current policy satisfies each requirement and flag any gaps. A five-minute email can prevent a three-week scramble.

The cyber insurance requirement from a GC is often the first signal that your security posture needs attention. The same controls that satisfy an underwriter, MFA, endpoint protection, tested backups, and written policies, are also what satisfy a bonding questionnaire and the growing number of owner-mandated requirements on healthcare and government projects. GDS works with South Florida construction firms through our managed IT and cybersecurity programs to get that documentation ready. See also: managing former employee and sub access and vendor fraud protection for contractors.

Frequently Asked Questions

How much does cyber insurance cost for a construction subcontractor?

For a South Florida construction firm with 10–40 employees and under $10 million in annual revenue, expect $1,800–$4,500 per year for a $1 million/$2 million policy. Firms with MFA deployed and documented backup processes typically land at the lower end. Firms with no security controls or a prior claim pay more, or may only qualify for higher-deductible policies.

Does my general liability policy cover cyber incidents?

Standard CGL policies do not cover cyber incidents. Some policies include a small cyber endorsement, usually $100,000–$250,000, as part of a package. That's enough to pay for breach notification costs but not enough to cover a ransomware recovery, a GC's project delay claim, or a client data breach. Check your policy documents and ask your broker specifically about cyber sublimits.

What if the GC's requirement is higher than what I can afford?

Talk to the GC's project manager directly. Some GCs will accept a lower limit with a letter of explanation if you're working a smaller scope or have a strong safety and financial track record. Others are firm. If the requirement is non-negotiable, structuring the work through a joint venture with a larger sub who carries the required limits is an option, though it has its own contract implications.

Do I need cyber insurance if I don't store client data?

Yes, for two reasons. First, you store your own business data, including payroll, billing, and banking information, which is a target regardless of whether you hold client records. Second, the GC requirement is about protecting the shared project environment, not just your own data. A ransomware attack that starts on your laptop and reaches a GC's Procore account creates liability for you whether or not you held any client information.

How long does it take to get a cyber insurance policy?

A straightforward application with no prior claims can be quoted in 24-48 hours and bound within a week. Add three to five business days if you need an additional insured endorsement. A prior claim or significant security gaps can stretch the timeline to three to four weeks.

Ready to Get Your Firm Covered Before the Next Bid?

Cyber insurance is no longer optional for construction subcontractors in the South Florida market. GCs are requiring it, bonding companies are asking about it, and the firms that wait until a contract signing to get it are paying more and getting less coverage than the ones who move proactively.

GDS can help you close the coverage gap, build the security documentation you need for the application, and put the controls in place that keep your premiums low year over year. Start with a free assessment at gradientdata.com/free-assessment and we'll walk through exactly what your firm needs.