Security Guard Contracts & Insurance: What to Check Before You Sign (2026)

A security contract isn't just paperwork — it's the document that decides who pays when a guard is hurt, a visitor is injured, or coverage silently fails. A strong contract, backed by the right insurance, shifts those risks to the security company. A weak one quietly leaves them with you. This guide walks through exactly what to check before you sign — from certificates of insurance and liability limits to indemnification, post orders, and billing — and ends with a pre-signing checklist you can take to any bid, anywhere in the country.

Certificate of insurance (COI)

A COI — usually the standard ACORD 25 form — proves a policy exists, but it is not the policy and cannot itself add or increase coverage. Demand it directly from the insurer or broker, confirm it lists your entity as certificate holder, and verify the policy is active by policy number. If a certificate shows limits or additional-insured status that were never actually endorsed onto the policy, that coverage effectively doesn't exist. Re-request a fresh COI at each renewal and before work begins, and remember the certificate holder alone gains no right to file claims under the policy — that requires being named an additional insured.

How to read an ACORD 25, field by field

The ACORD 25 is designed to be skimmed and trusted — which is exactly why weak vendors count on you not reading it closely. A certificate is a snapshot of coverage that can lapse, erode, or misname you the day after it's issued. Walk it top to bottom and stop on every one of these red flags:

• Named insured mismatch. The "Insured" box must be the exact legal entity that will sign your contract and staff your site — not a d/b/a, a staffing affiliate, or a sister company. If the guards are payrolled through a different entity than the one on the COI, the policy may not respond to their conduct.
• Expired or near-term dates. Check the "Policy Eff" and "Policy Exp" dates on each line (GL, auto, workers' comp, umbrella). A certificate issued months ago may cover a policy that has since renewed on different terms — or lapsed. Anything expiring inside your contract term needs a renewal commitment in writing.
• Additional-insured box checked with no endorsement attached. The "Additional Insured" and "Subrogation Waived" boxes in the lower-left grid are just claims by the person who typed the form. They mean nothing without the actual endorsement pages (see below). A checked box with no CG 20 10 / CG 20 37 attached is the single most common way buyers think they're protected and aren't.
• Aggregate already partially eroded. The certificate shows the policy's stated limits, not what's left. On a shared/annual aggregate, a prior large claim may have already burned through most of it. Ask whether the aggregate is dedicated to your project (a "per-project aggregate" endorsement) or shared across every client the firm serves.
• Certificate holder isn't your legal entity. The "Certificate Holder" box in the lower right must name you — the entity signing the contract and, ideally, your address. A COI made out to a property manager, a parent company, or a prior tenant does not give your entity notice rights.
• "Description of Operations" that quietly narrows coverage. Read the free-text box. It sometimes limits additional-insured status to a specific job or excludes the armed/firearms operations you actually hired for.

Liability limits to require

The market baseline for a security contract is $1 million per occurrence / $2 million aggregate in commercial general liability — the standard chosen by the large majority of small businesses and common in commercial contracts and leases. For armed, high-value, enterprise, or government work, require $2M/$4M or add an umbrella/excess layer, typically stacked in $1M increments over the primary policy. Many states also make a minimum a licensing condition — so a properly licensed firm already carries at least this much. But state floors vary widely, and, just as important, they are not the same kind of instrument.

State insurance minimums: a properly-columned reference

Most "state minimum" lists are misleading because they stack three fundamentally different instruments into one column as if the dollar figures were comparable:

• Surety bonds (e.g., Michigan, Minnesota, New Jersey, Massachusetts) are not liability insurance. A bond is a fixed pool the state can draw on for regulatory or restitution purposes — once it's paid out, it's gone, and it does nothing for a third-party injury claim against you.
• General-liability limits (e.g., California, Florida, Ohio) are third-party insurance that actually responds to bodily-injury and property-damage claims — the coverage you care about.
• Split vs. combined limits. "$100,000 / $300,000" (per-person / per-occurrence) is not the same as "$300,000 combined single limit," and "$300,000 BI + $100,000 PD" is a third structure again. They cannot be lined up as one number.

The table below is broken out so you can compare like with like. Threshold notes matter too: several states only trigger their floor at a headcount (Maryland and the District of Columbia both kick in at 5+ officers), which older single-column lists inconsistently omit.

Read the "Instrument" column first. Note how little the low end buys: a $5,000 bond or a $25,000 policy is nowhere near enough to cover a serious injury claim, and a bond isn't third-party injury coverage at all. The state minimum tells you the firm is licensed — it does not tell you it carries enough coverage for your risk. That's why you specify $1M/$2M (or more) in the contract regardless of the state floor. Requirements — and the pool of firms that meet them — also vary by market, so compare licensed providers where you actually operate, whether that's Los Angeles under California's $1M rule or Chicago under Illinois and city licensing. Confirm the firm is licensed using our license-verification guide.

Additional insured

Being named an additional insured gives you a direct path to the security firm's insurer for claims arising out of its work. Insist on a current, standard endorsement — the ISO CG 20 10 for ongoing operations and CG 20 37 for completed operations — with the modern "caused, in whole or in part, by" wording, and get the actual endorsement, not just a checkbox on the COI. Under the current ISO forms (a change dating to the 2013 editions), additional-insured limits are capped at the lesser of the contract-required amount or the policy's available limits, so confirm the underlying limits are adequate. Also require "primary and non-contributory" language and a waiver of subrogation so the firm's insurer pays first and can't later come after you.

Workers' compensation

Workers' compensation is the coverage that keeps an injured guard's claim off your desk. Under the "exclusive remedy" doctrine, an employee injured on the job is generally limited to a workers' comp claim against their own employer — the security company — rather than suing the client. That protects you from liability for injuries to the firm's guards, who are its employees, not yours. Confirm the firm carries current workers' comp and employer's liability, and that the contract affirms the guards are the firm's employees. Watch for misclassification: a firm that treats guards as "independent contractors" to dodge workers' comp is a liability you don't want to inherit. (Exceptions to exclusivity, such as intentional acts, vary by state.)

Armed coverage: watch the exclusions

Standard commercial general-liability policies commonly exclude assault & battery and firearms/use-of-force — precisely the exposures that matter for security work. For armed guards, confirm a specific assault-and-battery and firearms-liability endorsement, and check its limit: these endorsements are often sublimited (illustratively $50,000–$100,000) with defense costs eroding the limit.

Why a $50,000 sublimit is a trap — a worked scenario

Say an armed guard's use of force triggers a lawsuit. Before a dollar of settlement is discussed, the firm's insurer spends $250,000 defending it — depositions, use-of-force experts, and motion practice are expensive. If the assault-and-battery endorsement carries a $50,000 defense-eroding sublimit, the math is brutal:

• The sublimit is exhausted by roughly the first $50,000 of defense costs — well before trial.
• The remaining ~$200,000 in defense costs plus the entire settlement or judgment now fall outside that endorsement.
• Because the base GL excludes assault/firearms, there's often nothing behind the sublimit — the umbrella typically follows the underlying exclusion, so it doesn't drop down either.
• Plaintiff's counsel then pleads negligent hiring, training, and supervision against the firm — a theory some A&B endorsements exclude even while covering the guard's conduct.
• Whatever the firm can't pay, a plaintiff will look to reach through your premises liability and your own GL/umbrella. The "coverage" you saw on the COI evaporated at $50,000.

See armed vs. unarmed guards, and compare armed security services when the post genuinely calls for a firearm.

Indemnification and liability caps

Indemnification (hold-harmless) clauses decide who covers third-party claims. They range from limited (the firm's own acts), to intermediate (comparative fault), to broad (even the client's own negligence). The safest for you is indemnity to the extent caused by the security firm's negligence. The single most important check: the indemnity must not be broader than the firm's insurance — any gap is self-insured and worthless if the firm can't pay. Watch limitation-of-liability caps too, and how they interact with the indemnity, since courts often carve third-party indemnities out of a general damages cap. For higher-risk engagements, have counsel review this language — indemnity enforceability is state-specific, and a number of states restrict or void "broad form" indemnities that make one party cover the other's sole negligence.

Sample clause language: what "good" actually reads like

You don't need to be a lawyer to pattern-match a contract against language that protects you. Here are annotated model paragraphs — read them against what the vendor sends and flag anything that drifts.

Indemnification (buyer-favorable):

The words that carry the weight: "to the extent caused by" ties the firm's obligation to its own share of fault (an intermediate/comparative standard, not you covering their whole loss and not them covering yours); "defend" forces them to fund your legal costs up front, not just reimburse a judgment; and the carve-out from the liability cap stops a $12-month-fees cap from swallowing the indemnity. Reject the mirror-image version — "each party indemnifies the other for its own negligence" reads fair but strips you of the defense obligation and the direct insurer path you're paying for.

Limitation of liability (buyer-favorable):

The tells: a cap tied to "fees paid in the prior twelve months" is a red flag — on a $10,000/month contract that's a $120,000 ceiling against a single serious-injury claim that can run into the millions. Anchor the cap to the insurance limits you required instead, and insist on the carve-outs above so the cap never applies to indemnity, gross negligence, or insured bodily-injury/property-damage claims. Watch for one-sided caps (limiting the provider while leaving you uncapped) and blanket exclusions of "consequential, indirect, or special damages," which — read broadly — can sweep in the business-interruption losses a security failure is most likely to cause.

Post orders and staffing SLAs

The scope of work defines what coverage means; post orders are the daily, per-post playbook. Specify who can change them and when a change triggers a price adjustment. Require a service-level agreement with measurable commitments: officers per shift, supervisor presence, fill-rate guarantees, and no-show/backup response times — ideally with financial remedies for failures. This is not theoretical: real contracts (for example, a major airport's guard-services SLA) deduct set amounts per occurrence — $500 for failing to supply required qualified personnel, $250 for failing to provide a timely replacement — when the vendor misses. Track "dark posts" (unstaffed shifts) and non-billable overtime as leading indicators of account health, and secure audit rights so you can verify performance.

The KPIs that actually predict performance

An SLA is only as good as the metrics behind it, so define each one precisely and require the provider to report it on a set cadence. The measures that separate a well-run account from a failing one:

• Fill rate — the percentage of scheduled hours actually staffed by a qualified officer. Define it against required hours (not the hours the vendor chose to bill), set a floor (many buyers hold providers to 98%+), and attach a credit per missed hour or shift so the number has consequences.
• Tour and patrol completion — for patrol and roving posts, require electronic verification (a guard-tour system or GPS-tagged checkpoints) rather than a paper log. The KPI is the share of scheduled tours completed on schedule, with exception reports for missed or late checkpoints. Paper-only patrol logs are unverifiable and easy to fabricate.
• Response time — how quickly an officer responds to an alarm, incident, or call, and how quickly a supervisor is reachable after hours. Put target windows in writing.
• Report timeliness and quality — daily activity reports and incident reports delivered within a defined window (often the same shift or the next morning) and complete enough to be useful in an investigation or claim.
• Officer turnover and continuity — high turnover on your account degrades site knowledge and signals underpayment. Ask for the account-level turnover rate and, for supervisory or specialized posts, named-officer continuity commitments.

Require these to arrive in a monthly service review, not on request, and pair them with the audit rights above — metrics the provider must report are metrics it manages. For a data-sensitive corporate site, tie the same discipline to your corporate security requirements: access-control and reporting standards belong in the SLA, not just the sales deck.

Billing and rate transparency

A bill rate is pay rate plus payroll burden plus overhead plus margin, with the guard's wage typically 55–65% of the total and margin around 10–15%. Demand a line-item breakdown — two identical-looking bids can hide very different pay rates and service levels — and remember that a suspiciously low pay rate is the mechanism behind the turnover and dark posts this guide keeps warning about. Our guide to what security actually costs breaks down where the money goes; this section shows you how to read the number on the invoice.

Bill-rate buildup: how two bids at the same rate hide a $16 vs. $22 wage

When two firms quote the same bill rate, the difference is almost always what the guard takes home — and the guard's wage is the single best predictor of who shows up and stays. Here's the same $28/hr bill rate built two ways. (Illustrative 2026 estimates for an unarmed post — not a quote; your market and burden will vary.)

Same $28. But Bid B pays the officer $6/hr less and pockets it as margin. That $16 wage is at or near the floor a guard can earn elsewhere for easier work, so Bid B's post churns — new faces every few weeks, gaps at 2 a.m., and the "dark posts" that show up as an incident right when you need coverage. The fix is the line-item breakdown above: ask each bidder for the base wage and payroll burden explicitly. A bill rate you can't decompose is a bill rate hiding something. (An unarmed post at a healthy wage lands in the $22–$35/hr range for 2026; armed runs $30–$48/hr — see the cost cornerstone for the full picture, including 24/7 coverage math.)

Beyond the wage, make sure the contract states:

• Overtime and holiday multipliers (commonly 1.5× / 2×) and who absorbs them when the gap is the vendor's fault.
• Minimum-hour rules (event and short-shift work often carries a 4-hour minimum).
• Annual escalation — how and when the rate rises, tied to a defined index or wage-law change, not open-ended.
• Pass-through vs. bundled costs — equipment, vehicles, and technology billed at cost or marked up.

Your pre-signing checklist + clause cheat-sheet

Take this to any bid, in any state. It condenses everything above into a one-page pass/fail you can run before you sign — and a cheat-sheet of the exact words to demand and reject.

Insurance & liability

• Current COI received directly from the insurer/broker, verified by policy number, with your exact legal entity as certificate holder.
• Commercial general liability at $1M/$2M minimum ($2M/$4M or umbrella for armed/high-value).
• You are named additional insured by actual endorsement (CG 20 10 + CG 20 37), with primary & non-contributory and waiver of subrogation.
• Current workers' compensation and employer's liability; contract affirms guards are the firm's employees.
• Armed posts: assault-and-battery/firearms endorsement at full limit, defense costs outside the limit, covering negligent use of force and negligent hiring/training/supervision.

Contract terms

• Indemnity is "to the extent caused by" the firm, includes a duty to defend, and is backed by (not broader than) its insurance.
• Liability cap is anchored to insurance limits, not "12 months' fees," with carve-outs for indemnity, gross negligence, confidentiality, and insured injury/property claims.
• Post orders attached; change-control and price-adjustment triggers defined.
• SLA with financial remedies: fill-rate floor (98%+), no-show/replacement credits, tour completion via electronic verification, response-time windows, monthly reporting, audit rights.
• Line-item billing: base wage + burden disclosed, OT/holiday multipliers, minimum-hour rules, escalation, pass-throughs.