For a startup selling into a large contractor for the first time, especially a defense prime like Lockheed Martin, RTX, Northrop Grumman, or GE Aerospace, that section is often the last obstacle between signing and starting. This guide explains what those requirements are, what each one means, and why the prime insists on it.
Every "typical requirement" below reflects RiskCube's own analysis of the actual supplier terms published by 50 large US contractors. The specifics on your contract will vary; always read your own insurance exhibit. But the pattern is remarkably consistent.
Key takeaways
- Nearly every prime requires the same core stack: Workers' Comp, Employer's Liability, Commercial General Liability, and Automobile Liability.
- It is not the policy alone that matters. You also need three contractual endorsements: Additional Insured, Primary & Non-Contributory, and Waiver of Subrogation.
- Most primes require a carrier that meets an AM Best rating floor, commonly A- VII or A- VIII.
- The requirements are case by case and vary by contract, so always read your own insurance exhibit before you apply for coverage.
1. The Core Coverage Stack
Four coverages show up in almost every large-contractor supplier agreement. Across the 50 companies in RiskCube's own vendor-insurance research, these are the near-universal baseline:
Workers' Compensation
Statutory coverage for employee injury, required by law in almost every state and by nearly every prime. Non-negotiable if you have employees.
Employer's Liability
The companion to Workers' Comp; covers employee-injury lawsuits that fall outside the workers' comp system. Typically required at a $1,000,000 limit.
Commercial General Liability (CGL)
Covers third-party bodily injury and property damage, including products and completed operations (harm your product causes after it's delivered). Limits typically run $1M per occurrence / $2M aggregate, though some primes require higher: GE Aerospace and Honeywell require $5M. See the full general liability glossary entry.
Automobile Liability
Covers owned, hired, and non-owned vehicles; usually required at $1M-$2M combined single limit, often triggered when your team drives onto the prime's facility.
Why it matters: these four are the floor. If your contract's insurance exhibit lists nothing else, it will list these. Carry them at the limits the contract specifies before you request a certificate of insurance.
2. The Four "Hard" Contractual Requirements
Beyond simply buying a policy, large contractors require specific contractual features on that policy. A certificate that shows the right limits but omits these is routinely rejected at compliance review. These are the four that matter most, and the ones your contract will name explicitly.
What it is: An endorsement that adds the prime contractor (and often its parent, affiliates, and customers) as an insured party on your liability policy.
Why they require it: If your work causes a claim, the prime wants to be defended and covered under your policy, not left to rely on its own.
What you must do: Ask your broker to add an additional insured endorsement to your CGL (and often Auto) policy. Being listed as a certificate holder is not the same thing and will not satisfy the clause.
What it is: Wording that makes your policy pay first, with the prime's own insurance treated as excess that does not contribute.
Why they require it: The prime does not want its insurance drawn into, or its loss history affected by, a claim arising from your work.
What you must do: Confirm your policy carries primary and non-contributory wording via endorsement. It is the third leg of the standard endorsement trio, alongside Additional Insured and Waiver of Subrogation.
What it is: Your insurer gives up its right to "subrogate" (to pursue the prime to recover money it paid on a claim).
Why they require it: It protects the prime from being chased by your insurance company after a loss.
What you must do: Add a waiver of subrogation endorsement. The scope varies; some primes require it on all liability lines, others only on Workers' Comp, so match the endorsement to what the contract asks for.
What it is: A minimum financial-strength rating your insurance carrier must hold, published by AM Best. It isn't universal, but most primes require carriers rated A- VII or A- VIII or better, and a rated carrier is strongly recommended even where a floor isn't spelled out.
Why they require it: A certificate is worthless if the carrier behind it can't pay a claim.
What you must do: Make sure your coverage is placed with a carrier meeting the AM Best rating floor in your contract. Where a floor applies, a flawless certificate placed with a non-rated carrier will typically be rejected. A practical floor that satisfies almost every prime: A- VIII.
3. The Certificate of Insurance and Cancellation Notice
Once your coverage and endorsements are in place, you prove it with a certificate of insurance, using the standard ACORD 25 form. Two things primes almost always require:
-
A COI before work begins: naming the prime as certificate holder (and additional insured, per §2.1 above).
-
Advance cancellation notice: commonly 30 days written notice before your policy can be cancelled or materially changed.
Important: the COI itself does not grant coverage or amend your policy. It is evidence. The endorsements from Section 2 are what actually satisfy the contract; the certificate just documents them.
4. The Upsell Tier: Coverages Triggered by What You Do
Beyond the core stack, certain scopes of work trigger additional requirements. Across the 50-company dataset these appear on a meaningful minority of contracts, especially for services, software, and engineering vendors:
Umbrella / Excess Liability
The practical way to reach higher limits a prime demands (e.g., $5M+ combined single limit) without rewriting your primary policy.
Professional Liability / Technology E&O
Required when you provide software, engineering, or professional services. RTX requires up to $10M; L3Harris $3M. Covers financial loss your work causes the prime, which CGL excludes. See tech insurance.
Cyber / Network-Security & Privacy
Required (up to $10M at some primes) when you touch the prime's network or data. Where it is not an insurance requirement, it shows up as a compliance flow-down instead (see Section 6).
5. The Specialty Tier: Scope-Specific Coverages
These are required only when your specific work triggers them, but they are deal-breakers when they apply:
Aviation / Aircraft / UAS / Hangarkeepers
For drone, aircraft, or spacecraft work. A drone is legally an "aircraft," and standard CGL excludes it; primes doing aviation work require large aviation-liability limits ($50M+).
Defense Base Act (DBA)
Federally required workers' comp-type coverage for employees working outside the U.S. on a U.S. government contract. Your ordinary state Workers' Comp policy will not respond; this is a separate policy. See the Defense Base Act glossary entry.
Marine / Cargo / All-Risk Property and Contractors Pollution / Environmental
Triggered by shipping, holding the prime's property, or hazardous-materials exposure.
6. Compliance Flow-Downs That Ride With the Insurance
Large defense contracts flow down obligations that are not insurance policies but sit right next to the insurance clause. A startup must be able to accept them before signing:
| Requirement | What it means |
|---|---|
| ITAR / EAR | U.S. International Traffic in Arms Regulations and Export Administration Regulations: export controls on defense articles and dual-use technology. |
| DFARS 252.204-7012 | The DoD cyber clause: safeguarding covered defense information, implementing NIST SP 800-171, with a 72-hour cyber-incident reporting duty. |
| CMMC | Cybersecurity Maturity Model Certification: the DoD's framework that verifies NIST 800-171 controls are actually in place. |
| Section 889 | Section 889 of the NDAA: prohibition on certain Chinese-made telecom and surveillance equipment in your systems. |
| Flow-down clauses | Flow-down clauses are the mechanism by which the prime passes all of the above (and the insurance terms) down to you. Reading them is how you learn what you actually have to carry before you sign. |
These aren't insurance, but they decide whether you can take the contract at all. Two run deep enough to warrant their own guides: see ITAR Compliance for Startups and CMMC Compliance and Cyber Insurance for the full detail on each.
7. How to Read Your Contract's Insurance Exhibit
Before you apply for coverage, pull the insurance section (often labeled "Insurance," an exhibit, or "Section H") from your contract and check for these six things:
Required coverage types and minimum limits: per occurrence and aggregate, for each line.
Additional insured: who must be named, and on which policies.
Primary & non-contributory: is the exact wording required?
Waiver of subrogation: on which lines?
Carrier AM Best rating floor: e.g., A- VII or A- VIII.
COI and cancellation notice: when it's due and how many days' notice is required.
Most common rejection reasons
Missing additional-insured endorsement · Wrong certificate-holder legal name · Carrier below the rating floor · Missing primary-&-non-contributory or waiver wording
Frequently Asked Questions
What insurance do I need to sell to a large defense contractor?
It is case by case, and the exact requirements vary from one contract to the next, so always confirm against your own insurance exhibit. That said, the typical baseline is: Workers' Compensation, Employer's Liability, Commercial General Liability (including products/completed operations), and Automobile Liability, plus the contractual endorsements (additional insured, primary & non-contributory, waiver of subrogation) and a carrier meeting the contract's AM Best rating floor. Your specific contract may add Professional/Tech E&O, Cyber, Aviation, or Defense Base Act depending on your scope.
What limits do defense primes typically require?
Commonly $1M per occurrence / $2M aggregate for General Liability, $1M for Employer's Liability, and $1M-$2M for Auto, though some primes require $5M CGL, and higher limits are reached with an umbrella. Always confirm the exact figures in your contract's insurance exhibit.
What is the difference between a certificate holder and an additional insured?
A certificate holder only receives proof that your coverage exists. An additional insured is actually covered under your policy via an endorsement. Most contracts require additional insured status; being listed as certificate holder alone will not satisfy the clause.
What AM Best rating do defense contractors require?
It is not always a stated requirement, but most primes require carriers rated A- VII or A- VIII or better, and a rated carrier is strongly recommended regardless. A practical floor that satisfies nearly every large prime is A- VIII. You can check any carrier's rating free at ratings.ambest.com.
Do I need Defense Base Act coverage?
Only if your employees work outside the U.S. on a U.S. government contract, but if they do, it is mandatory and a standard state Workers' Comp policy will not respond. It is placed as a separate policy.
Get Coverage That Matches Your Contract
If you've won a subcontract and need coverage (and a certificate) that satisfies the insurance exhibit exactly, RiskCube can help. We review your contract's requirements, compare 40+ AM Best-rated carriers in one application, add the endorsements the prime requires, and issue your COI in as little as 24-48 hours.
Apply for a quoteKeep reading
Certificate of Insurance (COI): The Complete Guide for Startups
What a COI is, what goes on the ACORD 25 form, certificate holder vs. additional insured, and how to get one in 24 hours.
What Is an AM Best Rating? A Startup Founder's Guide
What the AM Best rating scale means, why enterprise vendors require A-rated carriers, and the 6 mistakes founders make buying from non-rated companies.
About the author
Andrei Craciunescu
Founder & CEO, RiskCube · CA License #4467994
LinkedIn ProfileAndrei previously worked in the Risk & Analytics division of WTW (Willis Towers Watson), one of the world's largest insurance brokers and a recognized leader in space and defense risk. He holds an M.Sc. in Mathematics from LMU Munich and conducted PhD-level research in financial mathematics at the Technical University of Munich (TUM). His work focuses on translating risk data into actionable insurance coverage decisions for VC-backed startups and small-to-medium businesses across the U.S.