Business insurance: a practical guide for every small firm

None of these policies overlap automatically. A slip-and-fall at your shop is a general liability matter, not a property claim. A fire that destroys your equipment triggers the property policy, not liability. The architecture matters because the space between policies is exactly where losses fall through without coverage.

Per the SBA Office of Advocacy, there are 36.2 million small businesses in the United States, representing 99.9% of all firms, but 82.3% of those have no employees at all. For the roughly 6.4 million that do employ people, the required policy mix expands considerably: workforce creates legal obligations around workers' compensation, employment practices, and benefits that solo operators typically do not carry.

In short: business insurance is a collection of distinct policies, not a single product, and the gap between them is where uninsured losses live.

General liability

General liability (GL) is the baseline. It covers bodily injury and property damage claims brought by third parties, advertising injury arising from your marketing, and the legal costs to defend those claims even when they turn out to be baseless. Most landlords require a GL certificate before signing a commercial lease, and many clients require proof of coverage before signing a contract.

Commercial property

If your business owns or leases physical space, or owns equipment that is central to operations, commercial property insurance covers loss or damage from fire, vandalism, storm, and certain other named perils. Read the policy for excluded perils: flood and earthquake are typically not included and require separate coverage. Items you add after binding the policy may not be automatically covered; review your schedule of covered property at least annually.

Business owner's policy

A business owner's policy (BOP) bundles GL and commercial property into a single contract, usually at a lower combined premium than buying each separately. Carriers offer BOPs to firms that meet specific eligibility criteria, typically smaller revenues, lower-risk industries, and standard premises. Higher-risk businesses often do not qualify and must build coverage individually.

Professional liability

Any firm that delivers advice, design, consulting, accounting, legal, medical, or technology services needs professional liability coverage. GL policies explicitly exclude professional errors. If a client claims your recommendation cost them money, or that your software introduced a vulnerability that exposed their records, professional liability is what responds. GL will not.

Commercial auto

If your business owns vehicles, personal auto policies will not cover them for business use. Commercial auto covers owned, leased, and in some cases employee-owned vehicles used for company purposes. Some carriers require a hired-and-non-owned auto endorsement when employees regularly drive their personal vehicles on company business.

In short: the core stack for most firms is GL, commercial property or a BOP, and professional liability if you deliver a service; commercial auto follows if vehicles are part of regular operations.

Workers' compensation is not optional for most employers. Nearly every state mandates it for firms with at least one employee, and some states extend the requirement to sole proprietors in the construction trades. The penalty for non-compliance is significant: uninsured employers can be held personally liable for injury costs, face state fines, and in some states face criminal charges.

According to data compiled by the National Academy of Social Insurance (NASI), employers paid an average of $0.98 in workers' compensation costs per $100 of covered payroll in 2023, across roughly 150 million covered jobs and $11 trillion in covered wages, with $64.1 billion in benefits paid to injured workers. The rate your firm pays depends heavily on your industry's injury risk classification, your state's rate schedule, and your individual claims history. These variables mean that two firms with identical payrolls can pay very different premiums if they operate in different industries.

The system is no-fault: an injured employee does not need to prove your firm was negligent to collect benefits, and in exchange, workers' compensation generally bars lawsuits against the employer for covered injuries. Benefits cover medical treatment, a portion of lost wages, rehabilitation, and in fatal cases, death benefits to surviving dependents.

In short: workers' compensation is a legal requirement tied to headcount and industry in nearly every state, with rates averaging $0.98 per $100 of payroll nationally, varying widely by state and risk class.

Cyber liability has moved from a specialty line for technology companies to a core consideration for any business that sends invoices, stores customer records, or accepts digital payments. In 2025, U.S. victims reported $20.877 billion in internet-crime losses across 1,008,597 complaints, according to the FBI's Internet Crime Complaint Center (IC3), up 26% year over year.

Business email compromise (BEC) is a particular threat to small and mid-size firms. In 2025, BEC generated $3.05 billion in reported losses from 24,768 complaints, averaging roughly $123,000 per incident. A successful BEC attack, where a fraudster impersonates an executive or vendor to redirect a wire transfer, can exceed what many small businesses hold in liquid reserves. The $3.05 billion figure covers only losses that were reported; actual losses are understood to be higher.

Cyber liability policies typically cover two categories of cost. First-party coverage pays for your own response: forensic investigation, customer notification, credit monitoring for affected individuals, and business interruption losses from a system outage. Third-party coverage pays claims from customers or partners whose data was exposed. These two components are sometimes sold as separate endorsements, so confirm what your policy includes before binding.

A general liability policy will not cover a data breach. Cyber liability is a separate, explicit purchase.

In short: cyber liability covers a class of risk that no other standard business policy touches, and at $3.05 billion in BEC losses alone in 2025, the exposure is not theoretical.

Coverage limits matter as much as coverage type. If a claim exceeds your limit, your firm pays the difference. Common guidance from risk consultants suggests setting GL limits to at least the value of your largest single contract, or the level required by your largest client, whichever is higher. For firms in professional services, professional liability limits should reflect the scope of the engagements you take on, not just the fee you charged.

Umbrella and excess liability policies extend coverage above the limits of your underlying GL, commercial auto, and employers' liability policies. They are typically cost-effective relative to the additional protection they provide, particularly for businesses that carry significant physical-traffic or contractual exposure.

Business interruption coverage deserves careful review. Policies replace lost income during the "period of restoration," the time estimated for repair or rebuilding. If your supply chain is complex, or if your industry takes months to rebuild clientele after a closure, the restoration period in a standard policy may underestimate actual recovery time. An extended period of indemnity endorsement can bridge that gap, and it is worth asking about when you bind.

In short: limits matter as much as coverage type; an underinsured policy leaves you personally liable for the difference between your limit and the actual claim amount.

Premiums are built from a profile of your specific firm, not pulled from a fixed industry schedule. The main factors carriers weigh are:

• Industry and risk classification. A roofing contractor pays far more than a bookkeeper for a similarly sized operation because the physical injury exposure is categorically different.
• Revenue and payroll. Many policies scale with revenue for GL and with payroll for workers' compensation. Growing businesses should update their estimates annually to avoid being underinsured mid-policy.
• Location. Property risk varies by local weather patterns, crime rates, and rebuilding costs. Workers' compensation rates are set at the state level and differ significantly across states.
• Claims history. A firm with prior claims pays more, and some carriers decline to quote firms with recent losses above a threshold. This creates an incentive to use insurance for large claims and absorb smaller losses directly.
• Coverage limits and deductibles. Higher deductibles reduce premiums but shift more cost to you at the time of an incident. Set deductibles at a level your firm's cash flow can absorb without disrupting operations.
• Documented risk management practices. Carriers ask about safety training programs, cybersecurity controls, and fleet management. Documented practices, particularly written safety manuals and employee training records, can lower your rate or improve your eligibility with preferred carriers.

In short: your premium is a function of your risk profile, not a category price; presenting your firm accurately and with documentation of safety practices improves your position at renewal.

Start with a written inventory of what you need to protect: physical assets, key revenue streams, employee headcount, contracts with liability exposure, and any professional or cyber risk your operations carry. That inventory drives every conversation with a broker or carrier and prevents you from buying coverage shaped by someone else's assumptions about your business.

Working with an independent broker who represents multiple carriers gives you access to more options than going direct to a single insurer. A broker is obligated to disclose compensation from carriers, which helps you evaluate whether a recommendation reflects your needs. Verify that any broker holds an active license in your state through your state's department of insurance.

Small business survival data from the SBA Office of Advocacy puts the stakes in context. Averaged across cohorts from 1994 to 2022, 67.7% of new businesses survive two years, 49.2% survive five years, and only 33.9% survive ten years. Insurance does not change those odds directly, but an uninsured loss event is among the most reliably firm-ending experiences a business can face: it converts what might have been a recoverable setback into personal liability that follows the owner beyond the business itself.

When you receive a quote, read the declarations page, the insuring agreement, and the exclusions section in that order. The declarations page tells you what you bought; the insuring agreement tells you what the carrier promises to do; the exclusions tell you where those promises end. The exclusions section is the most important. Review your coverage at least annually, and after any material change to your risk: a new product line, a new location, a significant hire, or a contract with a large client.

In short: treat insurance buying as a structured exercise in matching your specific risk inventory to coverage, not a commodity purchase where the lowest quote wins.