Toolkit · Insurance

The Business Insurance and Coverage Toolkit

15 U.S.C. §§ 1011

Type
Toolkit
Jurisdiction
National
Date
2026-06-09
Topic
Insurance

Business insurance is the risk-transfer layer that sits underneath every contract, lease, board seat, and data set a company touches — and most companies buy it without ever reading it. This toolkit is a resource map: it walks the ten pillars of a commercial insurance program, from matching lines of coverage to actual risks, through reading a policy in the right order, the occurrence/claims-made divide and the tail, the duty to defend versus the duty to indemnify, the notice and cooperation conditions that quietly forfeit coverage, the mechanics of tendering a claim, contractual risk transfer through indemnity and additional-insured status, coverage for cyber, employment, IP, and regulatory exposure, D&O coverage and the director's personal risk, and finally bad faith and coverage litigation. Insurance is overwhelmingly state law — the McCarran-Ferguson Act leaves it there — so this toolkit teaches the framework, the majority rule, and the places where states genuinely split, rather than pretending there is one national answer. Each pillar links to the UpLaw guides and checklists that go deep. A running worked example follows a growing robotics manufacturer as it assembles its program line by line, and the toolkit closes with a consolidated gated checklist you can run before renewal, before signing a contract, and on the day a claim arrives.

The Business Insurance and Coverage Toolkit

Insurance > Coverage | Published 9 June 2026 - Updated 7 July 2026 | UpLaw - uplaw.us

Every business buys insurance twice: once when it signs the application, and once when it reads the policy for the first time — usually on the day it needs it. This toolkit is about doing the reading first.

Keywords: business insurance, insurance coverage, CGL policy, duty to defend, duty to indemnify, claims-made, tail coverage, notice, tender, additional insured, waiver of subrogation, cyber insurance, D&O, EPLI, bad faith, coverage litigation

How to read this toolkit

This is a map, not a treatise. It is organized into ten pillars, each of which corresponds to a decision a business actually has to make — what to buy, how to read it, when to tell the carrier, what to demand from a counterparty, and what to do when the carrier says no. Each pillar gives you the doctrine in plain English, the anchor authority, and links into the UpLaw documents that go deep on the subject.

Three ways to use it:

One structural warning before you start. Insurance is state law. The McCarran-Ferguson Act, 15 U.S.C. §§ 1011–1015, expressly leaves the business of insurance to state regulation, and the states have taken the invitation. Policy interpretation, the notice-prejudice rule, the availability of extracontractual damages, and the very existence of a bad-faith tort all vary — sometimes dramatically — from state to state. This toolkit teaches the framework, identifies the majority rule, and names representative states. It does not, and cannot, give you a nationwide answer. Confirm your state's rule, and confirm the choice-of-law clause in the policy, before you rely on anything here.

Throughout, we follow Thistledown Robotics, Inc., a fictional company that designs and manufactures warehouse-automation robots, sells a software subscription that runs them, leases a 40,000-square-foot facility, employs 60 people, and has just closed a Series B with two investor directors on the board. Thistledown is a useful test case precisely because it is ordinary: it has all the exposures, and none of them are exotic.

The insurance landscape at a glance

Line of coverage What it actually insures Trigger Typical form
Commercial general liability (CGL) Third-party bodily injury, property damage, and "personal and advertising injury" Occurrence ISO CG 00 01
Commercial property / business interruption Damage to your property; lost income from that damage Occurrence Property form + BI endorsement
Directors & officers (D&O) Claims against individuals for wrongful acts in their corporate capacity; entity securities claims Claims-made Manuscript
Errors & omissions / professional liability (tech E&O) Failure of the product or service to perform; negligent professional services Claims-made Manuscript
Cyber / privacy liability Breach response costs, notification, regulatory defense, third-party privacy claims, sometimes extortion and business interruption Claims-made Manuscript
Employment practices liability (EPLI) Discrimination, harassment, retaliation, wrongful termination Claims-made Manuscript
Crime / fidelity Employee theft, forgery, funds-transfer fraud, social-engineering loss Discovery or loss-sustained ISO crime forms
Workers' compensation Employee injury, on a no-fault basis; the employer's exclusive-remedy shield Occurrence State-mandated
Commercial auto Owned, hired, and non-owned vehicle liability Occurrence ISO CA forms
Umbrella / excess Sits above scheduled underlying limits; may "drop down" or follow form Follows underlying Manuscript

Two structural facts explain most coverage fights. First, the CGL is a third-party liability policy: it pays when someone sues you, not when you lose money. Second, the CGL is deliberately not a warranty of your own work — the "your work," "your product," and "impaired property" exclusions exist precisely to keep the carrier from becoming the guarantor of Thistledown's welds. Businesses that expect the CGL to pay for a defective robot are reading it as a performance bond. It is not one.

Pillar 1 — Building the program: matching lines of coverage to actual risks

The right way to build a program is to inventory the exposures and then map coverage onto them, not to buy a package and hope it fits.

Walk the business and ask, for each activity, who could sue us, and for what?

  • Thistledown ships a robot that pinches a warehouse worker's hand. Bodily injury caused by an occurrence, arising out of the product. That is CGL Coverage A, and specifically products/completed operations — check that the products-completed operations aggregate is not exhausted or, worse, endorsed away.
  • A sprinkler head fails and floods the assembly floor. That is first-party property, plus business interruption for the six weeks the line is down. BI is where undervaluation kills companies: the limit is usually a function of a worksheet the CFO filled out in twenty minutes.
  • The robot's control software mis-routes pallets and a customer loses a season. No bodily injury, no physical damage to third-party property — the CGL will very likely decline. This is technology E&O, and Thistledown does not have it. This is the single most common gap in a product-plus-software company.
  • An engineer alleges her promotion was blocked because of her pregnancy. EPLI, and only EPLI. The CGL "employment-related practices" exclusion is there specifically to push this claim out of the general liability tower. Read Employment Discrimination Law: A Comprehensive Guide and The Employment Law Toolkit: From Hiring to Separation with the EPLI application in hand — the underwriting questions are, in effect, an HR audit.
  • A controller wires $310,000 to a vendor account that turns out to be a spoofed email. That is not cyber liability in most towers; it is crime, under a funds-transfer-fraud or social-engineering endorsement, and it is frequently sublimited to a fraction of the policy limit. Two federal courts of appeals — the Second Circuit in Medidata Solutions v. Federal Insurance Co. (2018) and the Sixth Circuit in American Tooling Center v. Travelers Casualty & Surety Co. (2018) — found coverage for spoofed-email losses under computer-fraud wording, but carriers responded by writing narrower social-engineering endorsements with express sublimits. Do not assume the appellate wins of 2018 describe the policy you bought in 2026.
  • An investor director is sued derivatively after a recall. D&O — see Pillar 9.

Entity structure matters more than people expect. If Thistledown has spun its European sales arm into a subsidiary, the named insured schedule must reach it, and newly acquired or formed entities are typically covered only for a limited window (often 90 days) unless reported. Companies that run several businesses under a holding structure — see Running Multiple Businesses Under One Structure: A Deep Dive into Holding, Operating, and Parent Companies — routinely discover that the operating entity that got sued is not on the policy. Reconcile the named-insured schedule against the corporate org chart at every renewal, and against the formation record described in Incorporating a Startup the Right Way: A Founder's Legal Checklist.

Trap: the certificate of insurance is not the policy. It is an informational document that expressly disclaims conferring rights. A COI showing "additional insured" status proves nothing; only the endorsement does.

Pillar 2 — Reading a policy: the four parts and the order to read them

A commercial policy has four functional parts, and there is a correct order to read them — which is not front to back.

  1. The declarations. Named insureds, policy period, limits (per occurrence, aggregate, and any sublimits), retentions/deductibles, and the schedule of forms and endorsements. Start here, because the endorsement schedule tells you which of the printed words in the body of the policy are still true.
  2. The insuring agreement. The grant of coverage. Everything downstream is subtraction from this sentence. If the loss does not fit the insuring agreement, no amount of arguing about exclusions helps.
  3. The exclusions. The carrier bears the burden of proving an exclusion applies — that is the majority rule in essentially every jurisdiction — and exclusions are construed narrowly against the drafter.
  4. The definitions and conditions. The definitions are where the fight usually is ("occurrence," "property damage," "your work," "claim," "wrongful act," "loss"). The conditions are where coverage is lost (notice, cooperation, consent-to-settle, no-voluntary-payments). Read them last but do not read them least.

The interpretive rules are stable across most states and are collected in the Restatement of the Law, Liability Insurance (ALI 2019) and in the standard treatises, Couch on Insurance and Appleman on Insurance:

  • Plain meaning first. Undefined terms get their ordinary meaning, read in the context of the policy as a whole.
  • Ambiguity is construed against the insurer (contra proferentem), on the theory that the carrier drafted the form. A minority of states soften this for sophisticated commercial insureds who negotiated the wording — a real and growing exception in manuscript D&O and cyber forms.
  • Reasonable expectations. A significant group of states will honor the objectively reasonable expectations of the insured even where technical policy language, read closely, would defeat them. Other states have expressly rejected the doctrine. This is a genuine split; check yours.
  • The endorsement wins. Where an endorsement conflicts with the printed form, the endorsement controls. Most catastrophic coverage surprises are endorsement surprises.

Thistledown's broker sends a 214-page PDF. The two pages that matter most are the endorsement schedule and the definition of "occurrence."

Pillar 3 — Occurrence vs claims-made, and the tail

This is the distinction that most often destroys coverage silently.

An occurrence policy responds to injury or damage that happens during the policy period, no matter when the claim is made. The 2019 CGL still answers for the 2019 accident even if suit is filed in 2027.

A claims-made policy responds only to a claim first made against the insured during the policy period (and, in a claims-made-and-reported policy, reported to the carrier during the policy period or a short extension). D&O, E&O, EPLI, and cyber are almost universally claims-made.

Three consequences follow, and each is a trap:

  • The retroactive date. A claims-made policy typically covers only wrongful acts occurring after a stated retroactive date. Switch carriers and let the retro date reset to inception, and you have just uninsured every act your company committed before the switch. Preserving a "full prior acts" or original retro date is one of the highest-value things a broker does.
  • Reporting is a condition, not a technicality. In most jurisdictions, late reporting under a claims-made-and-reported policy defeats coverage without any showing of prejudice, because timely reporting defines the scope of the risk the carrier priced rather than merely protecting its investigation. That is a sharp break from the occurrence-policy notice rule discussed in Pillar 5, and courts across many states have enforced it strictly.
  • The tail. When a claims-made policy is cancelled or non-renewed — on a sale of the company, on a wind-down, on a switch to a new carrier with a new retro date — coverage for past acts evaporates unless you buy an extended reporting period ("tail"), typically one to six years, priced as a multiple of the expiring premium. In an M&A transaction the six-year "Side A" run-off tail for the target's directors is a standard closing deliverable; see The Mergers and Acquisitions Toolkit and Conducting Merger and Acquisition Due Diligence: A Practical Checklist.

Notice of circumstances. Most claims-made forms let an insured report facts that may give rise to a claim before a claim exists. Doing so locks the future claim into the current policy year. When Thistledown's general counsel receives a lawyer's letter complaining about the robot's safety interlocks — not yet a demand for money, so arguably not yet a "claim" — the correct move is a circumstance notice. It costs nothing and it moves a future eight-figure suit into a policy that is currently in force.

Pillar 4 — The duty to defend vs the duty to indemnify

These are two different duties, and confusing them is the single most common error in coverage analysis.

The duty to defend is broader than the duty to indemnify. It is triggered by the potential for coverage, measured against the allegations of the complaint (and, in most states, extrinsic facts known to the insurer), not by the ultimate truth of those allegations. The classic articulations are Gray v. Zurich Insurance Co., 65 Cal. 2d 263 (1966), and Montrose Chemical Corp. v. Superior Court, 6 Cal. 4th 287 (1993). The Restatement of the Law, Liability Insurance § 13 (ALI 2019) states the rule the same way: the insurer must defend when the allegations, fairly read, state a claim that would be covered.

Practical corollaries:

  • One covered allegation drags the whole case in. In a "mixed" action pleading both covered and uncovered counts, the carrier must defend the entire action — Buss v. Superior Court, 16 Cal. 4th 35 (1997) — though Buss also allowed the insurer to seek reimbursement of defense costs attributable solely to uncovered claims. States split on that reimbursement right; several reject it outright.
  • The four-corners (or "eight-corners") rule. Texas is the leading strict-pleadings jurisdiction: the duty to defend is determined by comparing the four corners of the pleading with the four corners of the policy, with narrow exceptions. See GuideOne Elite Insurance Co. v. Fielder Road Baptist Church (Tex. 2006). Many other states, including California and New York, permit consideration of extrinsic facts. Know which regime you are in before you argue about facts outside the complaint.
  • A groundless suit is still a defended suit. The CGL says so expressly; the carrier defends even suits that are "false or fraudulent."
  • The duty to indemnify is narrower and later. It attaches only to a judgment or settlement that is in fact covered. A carrier can owe a full defense and owe nothing on the judgment — and that is not bad faith, it is the policy working as written.

The reservation of rights, and independent counsel. Carriers typically agree to defend "under a reservation of rights," preserving the argument that they need not indemnify. That reservation can create a conflict: appointed defense counsel may be able to steer the case toward an uncovered theory. In California, San Diego Navy Federal Credit Union v. Cumis Insurance Society, 162 Cal. App. 3d 358 (1984), gave the insured a right to independent counsel at the carrier's expense when the conflict is genuine (now codified with rate and qualification limits at Cal. Civ. Code § 2860). Many states recognize a comparable right; the contours vary. When a reservation of rights letter arrives, the two questions are: what exactly is reserved, and does that reservation create a conflict entitling us to our own counsel?

Pillar 5 — Notice, conditions, and the ways coverage is forfeited

A policy is not just a promise; it is a promise burdened with conditions. Most coverage is lost here, quietly, before anyone reaches the merits.

Notice. The forms require notice "as soon as practicable" (occurrence policies) or within the policy period/reporting window (claims-made). The doctrinal question is what happens when notice is late.

  • Majority rule (occurrence policies): the insurer must show it was prejudiced by the late notice to forfeit coverage. A large majority of states now follow the notice-prejudice rule for occurrence-based liability policies.
  • Minority / historical rule: timely notice is a condition precedent and late notice defeats coverage without prejudice. New York was the leading no-prejudice jurisdiction until the legislature changed the rule for liability policies issued or delivered in New York; see N.Y. Ins. Law § 3420.
  • Claims-made-and-reported: as noted in Pillar 3, the reporting requirement is generally enforced strictly, prejudice or no prejudice.

The other conditions that forfeit coverage:

  • Cooperation. The insured must cooperate in the defense — sit for the interview, produce the documents, appear at trial. A material, prejudicial failure to cooperate is a defense to coverage. It is also, in practice, rarely a winner for carriers, because they must show substantial prejudice.
  • No voluntary payments. Do not settle, pay, or assume an obligation without the carrier's consent. Businesses that "handle it quietly" and then tender the bill routinely lose. The exception in most states is for immediate medical care and for insureds abandoned by a carrier that has denied a defense.
  • Consent to settle. Claims-made professional and D&O forms often require the insurer's consent to any settlement — and, in some professional forms, contain a "hammer clause" that caps the carrier's exposure if the insured refuses a settlement the carrier is willing to fund.
  • The "known loss" / prior-knowledge condition. A claim you already knew about when you signed the application is not covered. This is where the insurance application becomes load-bearing.
  • Rescission and the application. A material misrepresentation in the application can void the policy ab initio under most state insurance codes. The application is a legal document; treat it like one. Thistledown's CFO who answers "no" to "are you aware of any circumstance that could give rise to a claim?" one week after receiving that safety-interlock letter has handed the carrier a rescission defense.

Spoliation runs in parallel. The moment litigation is reasonably anticipated, the duty to preserve attaches independently of anything the carrier says. Work Issuing a Litigation Hold and Preserving ESI: A Practical Checklist on the same day you send the tender letter.

Pillar 6 — Tendering claims and managing the carrier relationship

Tender is a discipline, not an email. The mechanics are set out in full in Tendering a Claim and Preserving Coverage: A Policyholder's Checklist; the strategy is here.

Tender everything, everywhere, immediately. Tender to every policy that could conceivably respond — the CGL and the E&O and the cyber and the umbrella — and to every policy year that could be triggered. Over-tendering costs a stamp. Under-tendering costs the claim. A demand letter, a subpoena, an EEOC charge, a regulator's civil investigative demand, and a draft complaint sent "for settlement purposes" may each be a "claim" under one policy and not another; send them all to all carriers and let the carriers sort out priority.

Tender to other people's policies too. If Thistledown is sued because a component supplier's motor overheated, Thistledown is likely an additional insured on the supplier's CGL and is likely owed indemnity under the supply agreement. That tender goes to the supplier and the supplier's carrier — see Pillar 7. Companies that tender only to their own carrier are paying their own retention for someone else's loss.

Then manage the file. Respond to the reservation of rights in writing, point by point. Ask for the complete certified policy, including all endorsements — you are entitled to it, and you cannot analyze what you have not seen. Track defense costs against the retention. Insist on being consulted before the carrier's counsel makes strategy decisions with coverage consequences. And keep a coverage file that is separate from the liability defense file: communications with the carrier are not privileged as against the carrier in later coverage litigation in many jurisdictions, and the common-interest privilege between insured and insurer is exactly the thing that evaporates when the carrier denies.

Deadlines to calendar the day the claim arrives: the reporting deadline; the extended reporting period election window (often 30–60 days after expiration, and strictly enforced); the answer date in the underlying suit; the contractual indemnity tender deadline in any relevant vendor or customer agreement; and any statutory pre-suit notice period for a bad-faith claim (see Pillar 10).

Pillar 7 — Contractual risk transfer: indemnity, additional insured, waiver of subrogation

Insurance is only half the risk-transfer system. The other half lives in your contracts, and it is usually drafted by whoever cared more.

The three-part package — and all three parts are needed, because each does something the others cannot:

1. The indemnity clause. A contractual promise by the counterparty to hold you harmless. In most states an indemnity obligation, if drafted to include defense, triggers a duty to defend on tender — California's Crawford v. Weather Shield Manufacturing, 44 Cal. 4th 541 (2008), is the leading statement. But indemnity is only as good as the indemnitor's balance sheet, and it is heavily regulated: anti-indemnity statutes in most states limit or void agreements requiring one party to indemnify another for the other's own negligence, especially in construction. See Cal. Civ. Code § 2782 and the Texas Anti-Indemnity Act, Tex. Ins. Code ch. 151, as representative examples. These statutes vary enormously. Drafting guidance lives in The Commercial Contracts Toolkit: Drafting, Reviewing, and Enforcing Business Agreements.

2. Additional insured status. This gives you rights directly against the counterparty's carrier — a defense from a solvent insurer, not a promise from a vendor. It is created only by endorsement (the ISO CG 20 10 family for ongoing operations, CG 20 37 for completed operations), never by a certificate of insurance. Two drafting points do most of the work:

  • Require both ongoing-operations and completed-operations additional insured endorsements. A vendor that gives you only CG 20 10 has given you nothing for the claim that arrives after the work is done, which is when product claims arrive.
  • Require the counterparty's coverage to be primary and non-contributory, and require the umbrella to follow. Otherwise your carrier and theirs will spend a year arguing about "other insurance" clauses while you fund the defense.

3. Waiver of subrogation. Without it, the counterparty's carrier pays its insured and then sues you to get the money back, and you are litigating a claim you thought you had transferred. A mutual waiver of subrogation, backed by a policy endorsement permitting it (many policies void coverage if the insured waives recovery rights after a loss), closes the loop.

Leases are where this shows up most often. A commercial landlord will demand additional insured status, waiver of subrogation, a broad indemnity, and specified limits — and will often demand the tenant insure the landlord's own negligence, which the anti-indemnity statutes may or may not permit. Run the insurance article of the lease against Reviewing a Commercial Lease: A Practical Checklist and Commercial Leases: A Comprehensive Guide to Negotiating and Drafting before signing. Thistledown's landlord asked for $5 million per occurrence, additional insured status for the landlord and its lender and property manager, and a waiver of subrogation — all reasonable, all requiring endorsements Thistledown did not have, and all discovered eleven days before the lease was to be signed.

The rule to internalize: every time your company signs a contract with an insurance article, it has just amended its insurance program. Send the article to the broker before signature, not after.

Pillar 8 — Coverage for modern risks: cyber/data breach, employment, IP, and regulatory

The legacy forms were written for a world of forklifts and fires. Four modern exposures fit them badly.

Cyber and data breach. A cyber policy is really two policies stapled together: first-party (forensics, notification, credit monitoring, PR, extortion payments, and — critically — business interruption from a network outage) and third-party (defense of privacy class actions and regulatory proceedings). The CGL will not fill the gap: the ISO forms carry a broad electronic-data exclusion, and Coverage B's "publication" of private information language has been narrowed by exclusion in most current forms. Watch three things: (i) the war/hostile-act exclusion, which carriers invoked against NotPetya losses and which the New Jersey Appellate Division rejected on the facts in Merck & Co. v. ACE American Insurance Co. (N.J. Super. Ct. App. Div. 2023) — leading the market to write far more explicit cyberwar exclusions; (ii) sublimits, particularly on extortion and business interruption, which are often a fraction of the headline limit; and (iii) the panel counsel and vendor list, because most cyber policies require you to use the carrier's forensics firm and breach coach, and using your own without consent can forfeit reimbursement. Coordinate the policy with the notification obligations in Data Breach Notification Law: A Comprehensive Guide and the operational sequence in Responding to a Data Breach: A Notification and Incident Response Checklist, and build the underlying program per The Privacy and Data Protection Toolkit: Building and Operating a Compliance Program.

Employment claims. EPLI covers discrimination, harassment, retaliation, and wrongful termination — and generally excludes wage-and-hour claims (sometimes offering a small defense-costs-only sublimit), which is a serious gap given FLSA and state wage-law exposure. It also typically excludes claims arising from breach of an employment contract and from an insured's intentional acts. Underwriters price EPLI on your HR hygiene: a defensible handbook, documented performance management, and a real complaint procedure lower the premium and, more importantly, win the case. See Building a Legally Sound Employee Handbook and Drafting an Employee Handbook That Holds Up: A Practical Checklist. Separately, misclassifying workers as contractors does not just create tax and wage liability — it can leave those workers outside the workers' compensation system and therefore outside its exclusive-remedy shield. See Worker Classification: A Comprehensive Guide to Employee and Independent Contractor Status.

Intellectual property claims. The CGL's Coverage B ("personal and advertising injury") reaches infringement of copyright, trade dress, or slogan in the insured's advertisement — and nothing else. Patent and trade secret claims are expressly excluded from the standard form, and courts have generally read the "in your advertisement" limitation seriously. So: a competitor's trade dress claim about Thistledown's marketing campaign may be defended; a patent suit over its gripper mechanism will not be, absent a specialty IP policy. Trade secret exposure similarly sits outside the CGL — see Trade Secret Litigation Under the DTSA: A Comprehensive Guide. Media liability and specialty IP defense policies exist and are worth pricing for content-heavy and patent-exposed businesses.

Regulatory investigations. The hardest coverage question of the modern era: when is a subpoena a "claim"? Under most D&O forms, a formal order of investigation or a subpoena served on an individual insured is a claim; an informal inquiry directed at the entity often is not, and pre-claim inquiry costs are covered only if the form says so. Negotiate express "pre-claim inquiry" and "informal investigation" coverage at renewal — it is available, and it is where the money actually goes. When the CID or grand jury subpoena lands, run Responding to a Government Subpoena or Investigation: A Practical Checklist and read White-Collar Crime and Corporate Criminal Liability: A Comprehensive Guide — and tender the subpoena to the D&O carrier the same day, even if you are confident it is not a "claim." Notice costs nothing; silence costs coverage.

Pillar 9 — D&O coverage and the director's personal exposure

Directors and officers face personal liability for breaches of fiduciary duty, and the protection comes in three layers that must be read together.

Before the layers: corporate law here is state law, and Delaware is the reference point used throughout this pillar — not a national rule. Delaware is where most venture-backed and public companies are incorporated, and its case law is the most developed, so it is the sensible default vocabulary. But your company is governed by the law of its state of incorporation. Many states track Delaware closely; some diverge on exculpation scope, advancement, and the standard for oversight claims. Read the statutes and cases below as the Delaware framework, then confirm your own state.

Layer 1: Exculpation. Delaware's 8 Del. C. § 102(b)(7) lets a certificate of incorporation eliminate personal monetary liability of directors for duty-of-care breaches (not for loyalty, bad faith, or improper personal benefit), and a 2022 amendment extended similar protection to certain officers. Check that the charter actually contains the provision — it is not automatic, and states outside Delaware vary in what they permit a charter to exculpate.

Layer 2: Indemnification and advancement. 8 Del. C. § 145 permits (and, for a director who succeeds on the merits, requires) indemnification, and permits advancement of defense costs. Most companies also sign separate indemnification agreements with directors, because bylaws can be amended and agreements cannot. Section 145(g) expressly authorizes the corporation to purchase D&O insurance covering liabilities it could not itself indemnify — which is exactly the point of Side A.

Layer 3: D&O insurance, in three sides.

  • Side A pays the individual directly when the company cannot or will not indemnify — insolvency, or a derivative settlement, where indemnification is unavailable. This is the coverage a director should care about personally, and it should be backed by a dedicated Side A DIC (difference-in-conditions) excess policy that cannot be eroded by entity claims or captured by a bankruptcy estate.
  • Side B reimburses the company for indemnification it provides.
  • Side C covers the entity itself, usually only for securities claims.

Three fights recur: whether the insured-vs-insured exclusion bars a claim brought by a bankruptcy trustee or a creditors' committee standing in the company's shoes (carve-outs for trustees and for derivative suits are essential and negotiable); whether a conduct exclusion for fraud or personal profit applies before there is a final adjudication in the underlying action (insist on "final, non-appealable adjudication in the underlying proceeding," not "in fact"); and whether a given proceeding is a covered "Securities Claim" — a definitional question the Delaware Supreme Court addressed in the Solera D&O coverage appeal (Del. 2020), concluding that a statutory appraisal proceeding did not fall within the "Securities Claim" definition in the policy before it. The lesson is definitional, not universal: what counts as a "Claim" or a "Securities Claim" is whatever the form you signed says it is.

The exposure this insures is real and rising. In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), established that a sustained failure of board oversight can breach the duty of loyalty, and Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), showed that Delaware courts will let such claims proceed where the board had no monitoring system for a mission-critical risk. Because corporate governance is state law and Delaware is the reference point — not a national rule, though most states track it — read Corporate Governance and Fiduciary Duties: A Comprehensive Guide for Directors and Officers alongside the policy, and build the record with Board Governance, Minutes, and Corporate Formalities: A Practical Checklist. Minutes that show a board actually monitoring the risk are, in a real sense, part of the insurance program. Founders raising money should read this pillar together with Raising Capital: A Startup Securities Toolkit: the Series B that puts two investors on Thistledown's board is also the event that makes D&O coverage non-optional.

Pillar 10 — Bad faith and coverage litigation

When the carrier says no, the policyholder has two theories, and they are very different animals.

Breach of contract. The carrier owed a defense or an indemnity and did not provide it. Damages are contract damages: the defense costs the insured had to fund, the covered judgment or settlement, and (in many states) attorney's fees for the coverage action — often by statute, sometimes only for the insured, reflecting a deliberate legislative thumb on the scale. Valuation principles are in The Litigation Damages Toolkit: Valuing and Proving Money Awards and Contract Damages: How Courts Make the Injured Party Whole.

Bad faith. Every insurance contract carries an implied covenant of good faith and fair dealing. In a majority of states, an insurer's unreasonable denial or unreasonable delay is not merely a breach but an independent tort, exposing the carrier to consequential and emotional-distress damages and, in egregious cases, punitive damages. Gruenberg v. Aetna Insurance Co., 9 Cal. 3d 566 (1973), is the canonical first-party statement. A significant minority of states — and this genuinely matters — confine the policyholder to contract remedies, or recognize the tort only in narrow circumstances. Confirm your state.

The failure-to-settle case. This is the most dangerous exposure a carrier has, and the most valuable right a policyholder has. When a claimant offers to settle within policy limits and the carrier unreasonably refuses, and a judgment then exceeds the limits, most states hold the carrier liable for the entire excess judgment — not just the policy limit. Comunale v. Traders & General Insurance Co., 50 Cal. 2d 654 (1958), and Crisci v. Security Insurance Co., 66 Cal. 2d 425 (1967), in California; the Stowers doctrine in Texas, from G.A. Stowers Furniture Co. v. American Indemnity Co., 15 S.W.2d 544 (Tex. Comm'n App. 1929). The Restatement of the Law, Liability Insurance (ALI 2019) frames it as a duty to make reasonable settlement decisions, treating the insured's interests as if the carrier bore the whole risk itself. Practical move: when a within-limits demand arrives, put the carrier on written notice of its settlement obligation and of the insured's exposure above the limits. That letter is the foundation of every excess-judgment bad-faith case ever won.

The statutory overlay. Every state has an unfair claims settlement practices statute, most modeled on the NAIC's Unfair Claims Settlement Practices Act (e.g., Cal. Ins. Code § 790.03(h)). Whether these create a private right of action is the key question and the answer varies sharply: California's Supreme Court held in Moradi-Shalal v. Fireman's Fund Insurance Co. (Cal. 1988) that § 790.03 does not, leaving the common-law tort intact; Florida (Fla. Stat. § 624.155) and Washington (the Insurance Fair Conduct Act, RCW 48.30.015) do create statutory civil remedies, with fee-shifting and, in Washington, trebling. Several of these statutes carry pre-suit notice requirements with hard deadlines. Miss the notice and you lose the statutory claim, even if the carrier's conduct was indefensible.

Litigating the coverage case. Coverage actions are usually declaratory-judgment actions, frequently filed by the carrier as a preemptive strike, and often in a forum of the carrier's choosing — so watch the race to the courthouse and the anti-suit considerations. Expect fights over the attorney-client privilege as between insured and insurer, over the "genuine dispute" doctrine (which several states use to defeat bad faith where the coverage question was fairly debatable), and over whether the coverage case should be stayed pending the underlying liability case. Many commercial policies now contain arbitration clauses — see Arbitration and ADR: A Toolkit for Choosing a Forum, Drafting Clauses, and Running a Case — and the procedural map for a federal coverage suit is in Federal Civil Litigation: A Roadmap and Resource Guide. Before suing, send the demand described in Writing an Effective Demand Letter: A Practical Checklist; a well-built coverage demand, with the policy language quoted and the authority cited, reverses more denials than most litigators expect. And note the ceiling on the upside: punitive damages against a carrier are constrained by State Farm Mutual Automobile Insurance Co. v. Campbell, 538 U.S. 408 (2003), which held that few awards exceeding a single-digit ratio to compensatory damages will satisfy due process.

Worked example: one bad quarter at Thistledown Robotics

Doctrine is easier to hold onto when you watch it hit a real balance sheet. Here is Thistledown's Q3, compressed.

Week 1 — the letter. A plaintiff's firm writes to Thistledown's GC: a warehouse worker at a customer site had two fingers crushed by a Thistledown palletizing arm; the firm says the safety interlock was defective; it demands preservation of documents but makes no demand for money. The GC's instinct is to wait and see. That instinct is wrong, and it is wrong in three separate directions at once.

  • Is this a "claim"? Under the CGL (occurrence-based), it does not matter much — the CGL responds to the injury, which happened during the policy period, whenever suit is filed. Notice is still owed "as soon as practicable," and in most states late notice forfeits coverage only if the carrier shows prejudice — but "most states" is not a plan. Notice goes out this week.
  • Under the tech E&O and the D&O, both claims-made, the letter may or may not be a "claim." It does not need to be. Thistledown gives a circumstance notice under both, describing the interlock allegations. That locks any future suit into the policy year now in force, which matters enormously because Thistledown is switching E&O carriers at renewal in ten weeks.
  • The litigation hold issues the same day — the duty to preserve attaches when litigation is reasonably anticipated, and it attaches independently of anything the carrier does.

Week 3 — the renewal application. The new E&O carrier's application asks whether Thistledown is "aware of any act, error, omission, fact, or circumstance that may give rise to a claim." The CFO, who has not been copied on the GC's file, is about to answer "no." That single word would be a material misrepresentation supporting rescission under most state insurance codes, and it would trigger the prior-knowledge condition in the new form, gutting coverage for exactly the claim Thistledown is most likely to face. The GC catches it. The answer is "yes," with an attachment. The premium goes up 12%. That 12% is the cheapest money Thistledown spends all year.

Week 6 — the suit, and the tenders. The worker sues Thistledown and its customer, pleading (i) negligent design of the arm, (ii) failure to warn, and (iii) negligent misrepresentation about the software's obstacle-detection accuracy. Thistledown tenders to everything: the CGL (bodily injury from an occurrence, products/completed operations), the tech E&O (the misrepresentation count sounds in professional services), and the umbrella. It also tenders outward — to the interlock component supplier, whose supply agreement contains an indemnity, and to the supplier's CGL carrier, on which Thistledown is (it turns out, after pulling the actual endorsement rather than the certificate) an additional insured for ongoing operations only. The completed-operations endorsement was never obtained. The product shipped eighteen months ago. That gap is worth seven figures and it exists because someone accepted a certificate of insurance as proof of coverage.

Week 7 — the reservation of rights. The CGL carrier agrees to defend but reserves on the "your product" and "impaired property" exclusions and on the negligent-misrepresentation count. Note what has and has not happened: the carrier owes a defense of the entire action, because at least one allegation is potentially covered, even though two of the three counts may never be indemnified. That is not bad faith; that is Pillar 4 working correctly. But the reservation targets the very theory on which appointed counsel could steer the case — toward pure product defect (covered) or toward pure software underperformance (arguably not) — and in a state recognizing an independent-counsel right, that conflict may entitle Thistledown to its own lawyer at the carrier's expense. The GC answers the reservation letter in writing, point by point, and asks for a complete certified copy of the policy with every endorsement.

Week 11 — the within-limits demand. Plaintiff offers to settle for $900,000 against a $1 million per-occurrence limit. The carrier, valuing the case at $400,000, refuses. Thistledown's exposure above the limit is now live. The GC sends the letter that every excess-judgment bad-faith case is built on: a written demand that the carrier accept the within-limits offer, an express statement that Thistledown's assets are exposed above the limits, and an offer to fund any gap the carrier identifies. If a $2.4 million verdict follows, most states will hold the carrier answerable for the entire excess judgment, not merely the policy limit — the rule of Comunale and Crisci in California and the Stowers doctrine in Texas. If the carrier accepts, Thistledown paid its retention and went back to work. Either way, the letter was free.

What the quarter cost, and what it did not. Thistledown funded a $100,000 retention and a 12% premium increase. It did not lose the E&O tower to a retro-date reset, did not hand the carrier a rescission defense, did not forfeit a defense to a late-notice argument, and did not eat a $900,000 settlement it could have transferred. Four decisions, none of which took more than an afternoon, and every one of them had to be made before anyone knew whether it mattered.

The landscape as a working checklist

Gate 1 — The program (annually, 90 days before renewal)

  • [ ] Exposure inventory refreshed: products, services, software, premises, vehicles, employees, data, board.
  • [ ] Named insured schedule reconciled against the current corporate org chart, including every new entity.
  • [ ] Every line mapped to a real exposure; every material exposure mapped to a line (or consciously retained).
  • [ ] Limits and sublimits tested against a worst realistic case, not last year's number. BI worksheet rebuilt.
  • [ ] Retro dates and prior-acts coverage confirmed on every claims-made policy; no silent reset.
  • [ ] Complete certified copies of all policies, with all endorsements, on file — not just certificates.

Gate 2 — Before signing any contract or lease

  • [ ] Insurance article sent to the broker before signature.
  • [ ] Indemnity scope reviewed against the applicable state anti-indemnity statute.
  • [ ] Additional insured endorsements required by form number — ongoing and completed operations.
  • [ ] Primary and non-contributory wording, and umbrella follow-form, required.
  • [ ] Mutual waiver of subrogation, and a policy endorsement permitting it.
  • [ ] Certificates collected and the underlying endorsements actually obtained.

Gate 3 — The day a claim, demand, subpoena, or charge arrives

  • [ ] Tender to every possibly responsive policy and policy year, in writing, same day.
  • [ ] Tender to every counterparty owing indemnity or additional insured status.
  • [ ] Circumstance notice given under every claims-made policy that could be triggered later.
  • [ ] Litigation hold issued; ESI preserved.
  • [ ] No voluntary payments; no settlement without carrier consent.
  • [ ] Reservation-of-rights letter answered in writing, point by point; independent-counsel right assessed.
  • [ ] Extended reporting period election window calendared if any policy is expiring.

Gate 4 — On denial

  • [ ] Denial letter analyzed against the actual policy language and the endorsement schedule.
  • [ ] Burden allocated: insuring agreement (insured) vs. exclusion (insurer).
  • [ ] State's notice-prejudice rule, reasonable-expectations doctrine, and bad-faith regime confirmed.
  • [ ] Any statutory pre-suit notice under the state unfair-claims statute served, on time.
  • [ ] Within-limits settlement demands documented, with written notice to the carrier of excess exposure.
  • [ ] Coverage counsel engaged, separate from underlying defense counsel.

Primary Authority

The backbone. Four sources carry most of the weight in this field, and they should be the first four things on a coverage lawyer's desk:

  1. Restatement of the Law, Liability Insurance (ALI 2019) — the ALI's synthesis of liability-insurance doctrine, including the duty to defend, the duty to make reasonable settlement decisions, and policy interpretation. It is persuasive authority only; some courts and several state legislatures have expressly declined to adopt parts of it. Cite it for the framework, not as binding law.
  2. ISO standard-form CGL policy structure — declarations, insuring agreement, exclusions, definitions, conditions; Coverage A (bodily injury and property damage), Coverage B (personal and advertising injury), Coverage C (medical payments). These are industry forms, and terms vary by carrier, edition year, and endorsement. Nothing in this toolkit substitutes for reading the policy actually issued to you.
  3. State insurance codes and unfair claims settlement practices acts — the operative law of insurance in the United States. These vary substantially by state, including on whether a private right of action exists at all.
  4. Couch on Insurance and Appleman on Insurance — the two standard American treatises; the place to start on any question this toolkit only frames.

Statutes

  • McCarran-Ferguson Act, 15 U.S.C. §§ 1011–1015 (regulation of the business of insurance reserved to the states).
  • State insurance codes and unfair claims settlement practices acts — most modeled on the NAIC Unfair Claims Settlement Practices Act. Representative examples: Cal. Ins. Code § 790.03(h); Fla. Stat. § 624.155; Wash. Insurance Fair Conduct Act, RCW 48.30.015; N.Y. Ins. Law § 3420 (notice and direct-action provisions). These vary substantially by state.
  • Anti-indemnity statutes — e.g., Cal. Civ. Code § 2782; Texas Anti-Indemnity Act, Tex. Ins. Code ch. 151. Independent-counsel statute: Cal. Civ. Code § 2860.
  • Delaware General Corporation Law, 8 Del. C. § 102(b)(7) (exculpation); § 145 (indemnification, advancement, and authority to purchase D&O insurance). Delaware is the reference point for corporate governance in this toolkit because most venture-backed and public companies incorporate there — it is not a national rule. Corporate law is the law of the state of incorporation; confirm yours.

Cases — note that the leading coverage decisions below are state decisions. They state the majority rule or the leading articulation of it; they do not bind other states, and several of the doctrines they announce are genuinely contested.

  • Gray v. Zurich Insurance Co., 65 Cal. 2d 263 (1966) (duty to defend triggered by potential for coverage).
  • Montrose Chemical Corp. v. Superior Court, 6 Cal. 4th 287 (1993) (duty to defend broader than duty to indemnify).
  • Buss v. Superior Court, 16 Cal. 4th 35 (1997) (mixed actions; reimbursement of defense costs for uncovered claims).
  • San Diego Navy Federal Credit Union v. Cumis Insurance Society, 162 Cal. App. 3d 358 (1984) (independent counsel on conflict-creating reservation of rights).
  • GuideOne Elite Insurance Co. v. Fielder Road Baptist Church (Tex. 2006) (eight-corners rule).
  • Comunale v. Traders & General Insurance Co., 50 Cal. 2d 654 (1958), and Crisci v. Security Insurance Co., 66 Cal. 2d 425 (1967) (insurer liability for the full excess judgment after unreasonable refusal to settle within limits).
  • G.A. Stowers Furniture Co. v. American Indemnity Co., 15 S.W.2d 544 (Tex. Comm'n App. 1929) (the Stowers duty).
  • Gruenberg v. Aetna Insurance Co., 9 Cal. 3d 566 (1973) (tort of insurance bad faith).
  • Moradi-Shalal v. Fireman's Fund Insurance Co. (Cal. 1988) (no private right of action under the unfair claims practices statute).
  • State Farm Mutual Automobile Insurance Co. v. Campbell, 538 U.S. 408 (2003) (due-process limits on punitive damages against insurers).
  • In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), and Marchand v. Barnhill, 212 A.3d 805 (Del. 2019) (board oversight liability — the risk D&O insures).
  • Crawford v. Weather Shield Manufacturing, Inc., 44 Cal. 4th 541 (2008) (contractual indemnity including defense obligates the indemnitor to defend on tender — California's leading statement; anti-indemnity statutes constrain the result and vary by state).
  • In re Solera Insurance Coverage Appeals (Del. 2020) (statutory appraisal proceeding held outside the "Securities Claim" definition in the D&O policy at issue — a decision about that policy's wording).
  • Merck & Co. v. ACE American Insurance Co. (N.J. Super. Ct. App. Div. 2023) (war/hostile-act exclusion held inapplicable to the NotPetya cyberattack on the wording at issue; the market responded with far more explicit cyberwar exclusions, so do not read this as coverage for your policy).
  • Medidata Solutions, Inc. v. Federal Insurance Co. (2d Cir. 2018) and American Tooling Center, Inc. v. Travelers Casualty & Surety Co. of America (6th Cir. 2018) (spoofed-email losses covered under the computer-fraud wording then in use). Both decisions turned on wording that carriers have since narrowed; current social-engineering endorsements typically carry express sublimits. Do not rely on these as a statement of what a 2026 crime policy covers.
  • ISO standard forms — CGL Coverage Form CG 00 01; additional insured endorsements CG 20 10 (ongoing operations) and CG 20 37 (completed operations); ISO crime forms. Industry forms; terms vary by carrier, edition, and endorsement — always read the policy you actually bought. Form numbers cited here are the common families, not a guarantee of what is in your tower.

Secondary Sources

  • Restatement of the Law, Liability Insurance (ALI 2019) — including § 13 (conditions under which the insurer must defend) and its treatment of the insurer's duty to make reasonable settlement decisions.
  • Couch on Insurance (3d ed.) — the standard American treatise.
  • Appleman on Insurance / New Appleman on Insurance Law Library Edition.
  • NAIC model acts and state departments of insurance bulletins and market-conduct guidance.

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This toolkit is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Insurance law is overwhelmingly state law and varies substantially by jurisdiction, policy form, and endorsement; laws and forms change over time. Verify current requirements, read the policy you actually purchased, and consult qualified counsel before acting.