Key takeaways
- Federal contracts require insurance through FAR Subpart 28.3, and the requirement flows down to subcontractors too.
- The FAR limits are floors, not targets. Most solicitations, contracting officers, and primes require far more (commonly $1M per occurrence / $2M aggregate or higher).
- Coverage alone is not enough. You need three endorsements: Additional Insured, Primary and Non-Contributory, and Waiver of Subrogation.
- Buying coverage after you win, during the September rush, is the most common cause of a delayed contract start. Line it up before award.
1. Why the September Window Matters
The US government runs on a fiscal year that ends September 30. Appropriated funds that an agency does not obligate by that date are generally lost, so contracting officers rush to place awards in the final weeks. For defense, space, and frontier-tech startups, August and September are when a pipeline that has been quiet all year suddenly closes.
That urgency is exactly where founders get caught. A solicitation you have been tracking converts to an award, and the award carries an insurance clause with specific coverages, limits, endorsements, and a carrier rating floor. You cannot begin performance, and often cannot even accept award, until you produce a compliant certificate of insurance. Placing new coverage and adding endorsements takes days, sometimes longer for specialty lines, and every one of those days is a day the clock is running against you.
The fix is simple: understand the requirement now, so that when the award lands in September the insurance is a formality rather than a fire drill. That is what the rest of this checklist is for.
2. Do You Actually Need Insurance to Win a Federal Contract?
In most cases, yes. Insurance for federal contracts is governed by FAR Subpart 28.3, the Insurance section of the Federal Acquisition Regulation. It requires contractors to carry certain coverages, and the individual insurance clauses (the FAR 52.228 series) are inserted into solicitations and contracts that meet their conditions.
Two points founders miss. First, the requirement is not only for prime bidders: through flow-down clauses, a prime passes its insurance obligations to you when you subcontract, so you carry the same weight without ever signing a contract directly with the government. Second, the FAR minimums are only a starting point. The contracting officer, the solicitation, or the prime routinely requires higher limits and additional coverages than the FAR floor.
Bottom line: if there is an insurance clause in your solicitation or subcontract, it is a condition of the award, not a suggestion. Read your own clause and match it exactly. If you are selling into a defense prime specifically, our companion guide on subcontractor insurance requirements covers that path in depth.
3. Required Coverages
FAR Subpart 28.3 names a core set of coverages. On top of that, most agency and prime requirements add commercial lines that reflect how modern tech and services vendors actually work. Here is the full stack a government contractor typically needs:
Workers' Compensation and Employer's Liability
Required whenever you have employees, and required by FAR 52.228-3 for public-work contracts. Workers' Comp is statutory in almost every state; Employer's Liability is its companion, covering injury lawsuits outside the workers' comp system.
Commercial General Liability (CGL)
Covers third-party bodily injury and property damage, including products and completed operations. This is the workhorse liability policy and the one every insurance clause names. See the general liability coverage page.
Automobile Liability
Covers owned, hired, and non-owned vehicles. Triggered whenever your team drives on government or prime facilities, or transports goods under the contract. Required by the FAR 52.228 transportation clauses in the relevant cases.
Professional Liability / Technology E&O
Required for software, engineering, and professional-services contracts. Covers financial loss your work causes the government or prime, which CGL excludes. See the technology E&O definition and the Tech E&O coverage page.
Cyber Liability
Increasingly required, especially for DoD work that touches covered defense information. Where it is not named as insurance, it shows up as a safeguarding obligation under DFARS 252.204-7012 and CMMC. See the cyber coverage page.
Specialty lines when your scope triggers them
Aircraft and Aviation liability (a drone counts as an aircraft, and CGL excludes it), Vessel liability for marine work, and the Defense Base Act when employees work outside the US on a government contract.
How to know which apply to you: the coverages named in your solicitation control. Pull the insurance clause and the list of FAR 52.228 clauses referenced in it, then map each one to the coverages above. Anything not named by the contract but triggered by your scope (drones, overseas staff, software delivery) you should carry anyway.
4. Typical Limits: FAR Minimums vs What Contracts Really Ask For
This is the single most misunderstood part of federal contract insurance. The FAR sets minimum limits, and they are low. Reading the FAR floor and assuming it is enough is a mistake, because most solicitations and primes require materially higher limits. Both are shown below.
| Coverage | FAR minimum | Commonly required |
|---|---|---|
| Employer's Liability | $100,000 (FAR 52.228-3) | $1,000,000 |
| General Liability (bodily injury) | $500,000 per occurrence (FAR 52.228-7) | $1M per occurrence / $2M aggregate, often $5M |
| Automobile Liability | $200,000 per person, $500,000 per occurrence; $20,000 property damage | $1,000,000 combined single limit |
| Aircraft Liability | $200,000 per person / $500,000 per occurrence bodily injury; $200,000 per occurrence property damage; passenger limit scaled to seats | Contract-specific, often $50M+ for aviation work |
| Professional / Tech E&O | Not set by FAR 28.3 | $1M to $10M depending on scope |
| Cyber Liability | Not set by FAR 28.3 | $1M to $10M for DoD data work |
Two mechanics worth understanding. First, most liability policies carry both a per-occurrence and an aggregate limit, and contracts specify both. Read the difference in our note on aggregate vs per occurrence. Second, when a contract demands limits higher than your primary policy carries, the practical way to reach them is an umbrella or excess liability policy stacked on top, rather than rewriting the primary.
Always confirm the exact figures in your own contract. The FAR minimums above are national floors. Your solicitation, contracting officer, or prime will state the limits that actually apply to you, and those are the numbers your certificate has to meet.
5. Required Endorsements
Buying the policy is only half the job. Government and prime contracts require specific contractual features on that policy, added by endorsement. A certificate that shows the right limits but omits these is routinely rejected at compliance review, and that rejection is what stalls a September start.
What it is: An endorsement that adds the government entity or prime contractor (and often its parent and affiliates) as an insured party on your liability policy.
Why it is required: If your work causes a claim, they want to be defended and covered under your policy. Being listed only as a certificate holder is not the same thing and will not satisfy the clause.
What you must do: Ask your broker to add an additional insured endorsement to your CGL (and often Auto) policy.
What it is: Wording that makes your policy pay first, with the other party's insurance treated as excess that does not contribute.
Why it is required: The government or prime does not want its own insurance, or its loss history, drawn into a claim that arose from your work.
What you must do: Confirm your policy carries primary and non-contributory wording via endorsement.
What it is: Your insurer gives up its right to pursue the other party to recover money it paid on a claim.
Why it is required: It protects the government or prime from being chased by your insurance company after a loss. Some contracts require it on all liability lines, others only on Workers' Comp, so match the endorsement to what the contract asks for.
What you must do: Add a waiver of subrogation endorsement on the lines the contract names.
You prove all of the above with a certificate of insurance on the standard ACORD 25 form, plus copies of the endorsement pages. The certificate documents the coverage; the endorsements are what actually satisfy the contract. Our complete COI guide walks through the form field by field.
6. AM Best Guidance
FAR Subpart 28.3 does not name a specific carrier rating, but agencies and primes almost always do. The standard requirement is a carrier rated A- VII or A- VIII or better by AM Best, the rating agency for insurance-company financial strength. The letter grade measures balance-sheet strength; the Roman numeral measures the size of the insurer's surplus.
The reason is straightforward: a certificate is only worth as much as the company standing behind it. On a multi-year federal contract, the government wants confidence that the carrier will still be solvent and able to pay a claim years from now. A flawless certificate placed with a non-rated carrier will typically be rejected wherever a rating floor applies, and a rated carrier is the safer choice even where no floor is written down.
You can verify any carrier's rating for free at ratings.ambest.com. For the full scale and how to read it, see our AM Best rating guide.
A practical floor: a carrier rated A- VIII or better satisfies nearly every federal agency and prime contractor. Confirm your coverage is placed there before you request your certificate.
7. Common Procurement Mistakes
These are the errors that turn an insurance requirement into a missed start date. Each one is avoidable if you plan ahead of the September rush.
Waiting until after award to buy coverage.
Placing new policies and adding endorsements takes days, and specialty lines take longer. Founders who start the day the award lands lose the first week of a contract to paperwork. Line up coverage before the award.
Treating the FAR minimum as the target.
The FAR floors ($100K Employer's Liability, $500K CGL) are far below what most solicitations require. Buying to the FAR minimum and then discovering the contract wants $1M per occurrence / $2M aggregate means re-issuing everything under time pressure.
Certificate holder instead of additional insured.
Naming the government or prime as certificate holder is not the same as adding them as an additional insured. This is the number one reason a certificate is bounced at compliance review.
Missing the endorsements entirely.
Right limits, right carrier, but no Primary and Non-Contributory or Waiver of Subrogation wording. The certificate looks complete and is still rejected.
Using a non-rated or under-rated carrier.
A cheap policy from a carrier below the AM Best floor will not clear review. Confirm the rating before you bind, not after.
Ignoring flow-downs and compliance clauses.
On DoD work, the insurance clause sits next to DFARS 252.204-7012, CMMC, ITAR, and Section 889 obligations. They are not insurance, but they decide whether you can take the contract at all.
8. Sector Notes: Defense and Space Startups
The core checklist above applies to every government contractor. Two sectors that dominate the September award cycle, defense and space, carry exposures a generalist insurance review misses. If you are in either, read this section alongside the checklist.
Defense startups
For a defense startup, the insurance clause almost never travels alone. It arrives bundled with a stack of compliance flow-downs that decide whether you can hold the contract at all:
DFARS 252.204-7012 and CMMC: safeguarding covered defense information and proving it, with a 72-hour cyber-incident reporting duty. This is where cyber coverage and the compliance obligation meet.
ITAR and EAR: export controls on defense articles and dual-use technology. A foreign-person engineer viewing controlled technical data can be a "deemed export," a violation that no policy pays for but that liability coverage may fund the defense of.
Section 889: a prohibition on certain Chinese-made telecom and surveillance equipment anywhere in your systems.
Defense Base Act: mandatory workers'-comp-type coverage the moment you place an employee outside the US on a government contract. Your state Workers' Comp policy will not respond; it is a separate policy.
If you are pursuing defense-prime subcontracts as well as direct government work, our subcontractor insurance requirements guide and the defense industry page cover the prime-facing requirements in more depth.
Space startups
Space companies selling to the US government (a US Space Force launch contract, a NASA payload, a satellite services award) face exposures that standard commercial liability excludes outright:
Aviation and UAS liability: a drone or unmanned aerial system is legally an aircraft, and standard CGL excludes aircraft claims. If your scope includes UAS, you need dedicated aviation or UAS coverage.
Pre-launch and launch liability: damage to the vehicle or payload on the pad and during ascent. Launch is a distinct, high-value exposure that general liability does not touch.
In-orbit and satellite coverage: loss or malfunction of the satellite once on orbit.
Third-party launch liability: federally licensed launches carry their own third-party liability requirements set by the launch license, on top of anything the contract specifies.
These are specialty placements with a small set of carriers, and lead times are longer than for standard lines, so start early. Our space industry page covers the full coverage picture for launch, satellite, and space-hardware companies.
Bottom line for both sectors: the FAR core stack is the floor, the compliance flow-downs (defense) and specialty aerospace lines (space) are what actually make or break the award, and both take longer to arrange than founders expect. Start before the September rush, not during it.
9. Working Overseas: Defense Base Act and OCONUS Coverage
If your government contract sends employees outside the United States, a separate insurance requirement applies, and it is one founders discover late and at a premium. The moment you place an employee overseas on a US government contract, the Defense Base Act (DBA) requires a specific workers' compensation policy. Your domestic Workers' Compensation policy will not respond to an overseas claim, so this is a separate placement, not an extension of what you already carry.
Defense Base Act (DBA) insurance. The DBA is a federal law that extends workers'-compensation-style benefits to employees working outside the US on government contracts and subcontracts. It is mandatory when it applies, it flows down to subcontractors through FAR 52.228-3, and a contracting officer will not authorize overseas performance without it. DBA is a specialty line placed with a small set of carriers, so it takes longer to arrange than a standard policy.
The coverages that travel with it. DBA rarely stands alone. Contracts and prudent risk management usually pair it with a cluster of overseas lines:
Foreign voluntary workers' compensation: fills gaps the DBA does not reach, such as endemic illness or locally hired staff, and coordinates with home-country benefits.
War risk and terrorism cover: for work in higher-risk regions, responding to injury from war, insurrection, or terrorism that standard policies exclude.
Kidnap and ransom (K&R) and emergency evacuation: covers ransom, crisis response, and getting your people out when a situation deteriorates.
International medical and travel: out-of-country treatment and medical repatriation for staff who fall ill or are injured abroad.
What you must do: if any part of your scope is performed outside the US, flag it to your broker before award and ask specifically for DBA coverage plus the companion overseas lines your deployment location calls for. These placements carry longer lead times than domestic coverage, so lining them up during the September rush is a common way a start date slips.
10. How Much Does Government Contractor Insurance Cost?
There is no single price, because premium depends on the coverages your contract names, the limits it requires, your revenue and headcount, your claims history, and your risk profile. That said, founders planning a budget usually want a starting range. The figures below are typical annual premiums for an early-stage US startup buying each line on its own. Your actual quote can land above or below them.
| Coverage | Typical annual premium | What moves the price |
|---|---|---|
| Commercial General Liability | $500 to $2,000 | Revenue, headcount, operations, required limit |
| Workers' Compensation | Varies by payroll and state | Payroll size, state rates, job classifications |
| Professional Liability / Tech E&O | $1,500 to $5,000 | Scope of services, contract value, required limit |
| Cyber Liability | $1,500 to $8,000+ | Data volume, security controls (MFA, backups), required limit |
| Umbrella / Excess | $1,000 to $5,000 per $1M of extra limit | How much extra limit the contract demands |
A few things that drive the total on a government contract specifically:
Higher required limits cost more. A contract that wants $5M CGL instead of the FAR $500K floor, or $10M Tech E&O, raises the premium. Reaching those higher limits with an umbrella is usually cheaper than rewriting the primary policy.
The endorsements are usually free or low cost. Additional insured, primary and non-contributory, and waiver of subrogation are typically added at little or no extra premium, but they must be requested. The cost of leaving them off is a rejected certificate and a delayed start, not a bigger bill.
Specialty lines are the expensive part. Aviation, launch, and Defense Base Act coverage are specialty placements and cost materially more than the core stack. If your scope triggers them, budget early.
Bundling helps. Buying the core lines together, rather than one at a time from different carriers, usually lowers the blended cost and speeds up the certificate.
How to get a real number: the ranges above are for planning only. The fastest way to a firm figure is to send your contract's insurance exhibit to a broker who can map the required coverages and limits to live quotes. RiskCube compares 40+ AM Best-rated carriers in one application and can return a quote within 24 hours.
The Checklist
Before your next federal award, run through these. If you can check every box, your certificate should clear compliance the first time.
- Pulled the insurance clause and every FAR 52.228 clause referenced in the solicitation
- Confirmed the required coverages, and the limits (per occurrence and aggregate) for each
- Workers' Comp and Employer's Liability in place at the required limits
- Commercial General Liability at the required limits, including products and completed operations
- Automobile Liability, and any specialty line your scope triggers (Aviation, Vessel)
- Defense Base Act coverage (plus companion overseas lines) if any employee works outside the US
- Professional / Tech E&O and Cyber where the contract or your scope requires them
- Additional Insured endorsement naming the government or prime
- Primary and Non-Contributory wording added
- Waiver of Subrogation on the lines the contract requires
- Carrier rated A- VIII or better by AM Best
- Certificate of insurance on ACORD 25, with endorsement pages attached, matching the exact legal name in the contract
Frequently Asked Questions
What insurance is required for a US government contract?
FAR Subpart 28.3 sets the baseline: Workers' Compensation and Employer's Liability, Commercial General Liability, and Automobile Liability, plus Aircraft or Vessel liability where the work involves them. The FAR minimums are floors, not targets. Your solicitation, contracting officer, or prime usually requires higher limits, and DoD contracts add cyber and safeguarding obligations through DFARS 252.204-7012 and CMMC. Always read the insurance clause in your own solicitation.
What are the FAR minimum insurance limits?
Under FAR 28.307-2, the stated minimums are: Employer's Liability at least $100,000; Comprehensive General Liability at least $500,000 per occurrence for bodily injury; and Automobile Liability at $200,000 per person and $500,000 per occurrence for bodily injury, with $20,000 per occurrence for property damage. Aircraft liability is $200,000 per person and $500,000 per occurrence for bodily injury (other than passengers), $200,000 per occurrence for property damage, and passenger bodily injury of at least $200,000 multiplied by the number of seats. These are minimums only; most real contracts require $1M per occurrence / $2M aggregate or more.
Do small businesses and startups need insurance to win federal contracts?
Yes. Whether you bid directly or subcontract to a prime, the insurance clause flows down to you. Most solicitations will not let you begin performance, and many will not let you receive award, until you show a certificate of insurance meeting the contract's requirements. Buying coverage after you win, during the September fiscal year-end rush, is the single most common cause of delayed contract starts.
What AM Best rating do federal contracts require?
The FAR itself does not name a rating, but agencies and primes commonly require carriers rated A- VII or A- VIII or better by AM Best. A rated carrier is strongly recommended regardless, because a certificate is worthless if the insurer behind it cannot pay a claim. You can check any carrier's rating free at ratings.ambest.com.
What endorsements do federal and prime contracts require?
The common trio is Additional Insured (naming the government or prime as insured on your policy), Primary and Non-Contributory (your policy pays first), and Waiver of Subrogation (your insurer gives up its right to pursue the other party). A certificate that shows the right limits but omits these endorsements is routinely rejected at compliance review.
What is DBA insurance, and is it required for government contracts?
DBA insurance is Defense Base Act coverage: a workers'-compensation-type policy required whenever your employees work outside the United States on a US government contract. When it applies it is mandatory under the Defense Base Act, and an ordinary state Workers' Compensation policy will not respond to an overseas claim. It is placed as a separate specialty policy, FAR 52.228-3 is the clause that flows it down, and a contracting officer will not authorize overseas performance without it.
What other insurance do overseas government contractors need?
Beyond Defense Base Act coverage, contractors with staff working abroad commonly add a cluster of overseas lines: foreign voluntary workers' compensation (to fill gaps the DBA does not reach and coordinate home-country benefits), war risk and terrorism cover (for higher-risk regions), kidnap and ransom with emergency evacuation, and international medical and travel coverage. Which of these apply depends on where your people are deployed, so flag any overseas scope to your broker before award. These are specialty placements with longer lead times than domestic coverage.
What insurance does a defense startup need for a government contract?
The FAR core stack (Workers' Comp and Employer's Liability, General Liability, Auto), plus the coverages your scope triggers such as Tech E&O and Cyber. What sets defense apart is the compliance stack that rides alongside the insurance clause: DFARS 252.204-7012 and CMMC for safeguarding data, ITAR and EAR for export control, Section 889 for prohibited equipment, and the Defense Base Act if any employee works overseas. The insurance and the compliance flow-downs are checked together, so plan for both before award.
What insurance does a space company need for a government contract?
Beyond the FAR core stack, space contractors face exposures standard commercial liability excludes: aviation or UAS liability (a drone is legally an aircraft), pre-launch and launch liability, in-orbit or satellite coverage, and third-party launch liability required by a federal launch license. These are specialty placements with a small set of carriers and longer lead times, so a space startup should start the insurance conversation well before a September award.
How much does government contractor insurance cost?
It depends on the coverages and limits your contract requires, plus your revenue, headcount, and claims history. As a planning range for an early-stage startup buying each line on its own: General Liability often runs $500 to $2,000 a year, Tech E&O $1,500 to $5,000, and Cyber $1,500 to $8,000 or more, with Workers' Comp priced off payroll. Higher required limits and specialty lines (aviation, launch, Defense Base Act) raise the total, while the required endorsements usually add little or nothing. The fastest way to a firm number is to send your contract's insurance exhibit to a broker for live quotes.
Winning a Federal Contract This September?
Do not let insurance delay your start. Send us your solicitation's insurance clause and RiskCube will map the exact coverages, limits, and endorsements you need, compare 40+ AM Best-rated carriers in one application, and issue a compliant certificate in as little as 24 to 48 hours.
Apply for a quoteKeep reading
Subcontractor Insurance Requirements: The Complete Guide
Subcontractor insurance requirements explained: the core coverages, endorsements, and AM Best carrier rating you need to sell to a large contractor.
Certificate of Insurance (COI): The Complete Guide for Startups
What a COI is, what goes on the ACORD 25 form, certificate holder vs. additional insured, and how to get one in 24 hours.
About the author
Andrei Craciunescu
Founder & CEO, RiskCube · CA License #4467994
LinkedIn ProfileAndrei previously worked in the Risk & Analytics division of WTW (Willis Towers Watson), one of the world's largest insurance brokers and a recognized leader in AI, space, and defense risk. He holds an M.Sc. in Mathematics from LMU Munich and conducted PhD-level research in financial mathematics, including directors and officers (D&O) insurance, at the Technical University of Munich (TUM). His work applies AI and risk analytics to translate complex exposures into actionable insurance coverage decisions for VC-backed startups and small-to-medium businesses across the U.S.