By Patrick Turcotte, COO, Docutrax. Last reviewed: 10 September 2026.

A vendor insurance requirement set is the schedule of coverages, limits, endorsements and named entities a property manager requires from every third party working at a property, written into the contract before work starts. It works only when the lines match the exposure, the endorsements are actually on the vendor's policy, and the entities named are the ones that would be sued.

What should a vendor requirement set actually accomplish?

Three things, in order.

The vendor carries coverage that responds to the exposure it creates at the property. A landscaping crew, an elevator contractor and a security firm generate different claims, and a single requirement set applied to all three will be over-specified for one and under-specified for another.

The risk transfer mechanisms are on the policy, not just on the paperwork. Additional insured status, waiver of subrogation and primary and noncontributory treatment each arise from a specific endorsement on the vendor's policy. None of them follow from a contract clause or a checked box on a certificate.

The coverage reaches the entities that would actually be named in a suit. On a portfolio, that is rarely a single company. The property-owning entity, the management company and often a lender or ground lessor all appear in the chain, and an endorsement naming one of them does not reach the others.

Everything below is a way of getting those three right for the vendors a property actually uses.

Which coverage lines belong in a property management requirement set?

The baseline for most vendors is commercial general liability, business auto, workers compensation with employers liability, and umbrella or excess coverage above them. What varies is what gets added on top, and that is driven by what the vendor does on site, what it touches, and who it comes into contact with.

Two rules keep this from becoming a checklist that nobody reads. Require a line because a specific vendor category creates the exposure, not because it appeared on a template. And where a line is required, say what has to be true about it, since "cyber liability" as a bare requirement can be satisfied by a policy that excludes the exact data the vendor holds.

How should limits be set, and what does an additional insured actually recover?

This is the section most requirement sets get wrong, and the error is quiet.

The additional insured endorsements in general use cap what the insurer will pay on behalf of the additional insured. The CG 20 10 04 13, the CG 20 37 04 13 and the CG 20 38 12 19 all carry the same provision: where coverage for the additional insured is required by a contract, the most the insurer will pay on behalf of that additional insured is the amount of insurance "required by the contract or agreement" or the amount available under the applicable limits of insurance, whichever is less.

Read that in the direction it runs. The requirement is a ceiling as well as a floor. If the contract requires $1,000,000 and the vendor happens to carry $5,000,000, the additional insured's recovery under these endorsements is capped at the required $1,000,000. The extra limits the vendor bought are not reachable through the additional insured grant, whatever the certificate shows.

That changes how a limit gets set. It is not only a screening threshold for whether a vendor is acceptable. It is also the amount of the vendor's coverage the property can actually reach at claim time. Limits that were set once, across a whole vendor population, and never revisited against current claim severity in that asset class, are quietly setting the recovery ceiling for every relationship in the portfolio.

Two related points. Aggregate limits are shared across everything the vendor does for everyone, so a general aggregate that looks adequate on a certificate may already be substantially eroded by claims elsewhere. And umbrella limits only help if the umbrella actually sits above the policy in question, which a certificate cannot establish, because the form carries no schedule of underlying insurance.

Who should be named as an additional insured, and on which endorsement?

Two separate questions, and both get answered wrong routinely.

Who. The property-owning entity as it appears in the contract, the management company in its own name, and any other party the management agreement or loan documents require, which commonly includes the lender, the asset manager and a ground lessor. Each has to appear as a distinct entity. Naming "the owner and its property manager" without naming them is not something to rely on, because the scheduled forms look to the schedule entry, and a blanket entry covering whoever the contract requires has to be read on the endorsement rather than assumed. Entity accuracy is the defect most likely to survive every other check and surface at tender: a certificate naming the management company when the contract was signed by the property-owning LLC will look correct in a file for years.

Which endorsement. These are different forms doing different jobs, editions of each are in circulation side by side, and a vendor's broker will frequently send whichever one is on file.

The CG 20 11 is worth naming explicitly because it arrives constantly in property management submissions. It is written for a tenant adding its landlord, it is limited to the premises leased to the named insured, and it excludes any occurrence after the named insured ceases to be a tenant along with structural alterations, new construction and demolition operations performed by or on behalf of the additional insured. A janitorial contractor that leases nothing at the property produces a grant of coverage with nothing to attach to. On a certificate, that endorsement and the correct one look identical: a tick in the ADDL INSD column.

One more thing to check rather than assume. The automatic forms are titled around a written construction agreement, while the 12 19 grant language refers to a contract or agreement. Whether a routine janitorial or landscaping service agreement triggers a particular blanket endorsement depends on that endorsement's own wording, and carrier manuscript versions vary. On service contracts, reading the endorsement is the only way to know.

Which endorsements carry the risk transfer, and what does each require?

Three mechanisms, each on the vendor's policy, each with its own conditions.

Additional insured status comes from the endorsements above. It is not conferred by the certificate holder box and it is not implied by an indemnity clause. Indemnity and additional insured status are separate risk transfer mechanisms that interact; an indemnity clause obligates the vendor to answer for liability, it does not obligate the vendor to add anyone to its policy.

Waiver of subrogation runs in the direction that is easiest to state backwards. The vendor's insurer gives up its right to recover from your organization after it pays a claim. It is an endorsement on the vendor's policy. The general liability waiver and the workers compensation waiver are separate endorsements on separate policies and must never be treated as one. The CG 24 04 waives the general liability carrier's right of recovery against the scheduled person or organization, and the edition decides the scope: the 05 09 edition ties the waiver to injury or damage arising out of the named insured's ongoing operations, or its work done under a contract with that person or organization and falling within the products-completed operations hazard, while the 12 19 edition drops that limitation and instead applies only to the extent the named insured waived its own right of recovery, and only where it did so before the loss. The NCCI WC 00 03 13 waives the workers compensation carrier's right in narrower terms: "We will not enforce our right against the person or organization named in the Schedule," and it adds that "This agreement shall not operate directly or indirectly to benefit anyone not named in the Schedule," applying only to the extent the insured performs work under a written contract requiring it.

Primary and noncontributory treatment has two conditions, not one. Under the CG 20 01 04 13, the vendor's insurance is primary and will not seek contribution from other insurance available to the additional insured only where the additional insured "is a Named Insured under such other insurance" and the vendor "agreed in writing in a contract or agreement that this insurance would be primary and would not seek contribution from any other insurance available to the additional insured." Additional insured status alone does not produce it, and a contract clause alone does not produce it either.

How should requirements change by vendor category?

Applying one requirement set to an entire vendor population is the most common structural failure in property management compliance. It over-specifies for a window washer and under-specifies for the roofer working over an occupied lobby.

The practical version of this is a small number of requirement sets, one per category, rather than one universal set or a bespoke set per vendor. Both extremes fail: the universal set is wrong everywhere, and the bespoke set is impossible to govern across a portfolio.

Which exclusions quietly defeat a requirement set?

A vendor can satisfy every line, limit and endorsement in the requirement set and still carry a policy that will not respond to the claim the property is most likely to face. None of this appears on a certificate, because the ACORD 25 has no field for exclusions and no endorsement schedule.

The multi-unit and tract housing residential exclusion is the one that matters most on multifamily and mixed-use assets, it is far broader than its name suggests, and it is a proprietary carrier endorsement rather than an ISO standard form, so the form number varies. As described by the Big "I" Virtual University, one carrier version of it, the CG 77 44 02 15, excludes liability arising from construction operations involving housing tracts or multi-unit residential buildings, and defines construction operations to include "pre-construction, construction, post-construction, reconstruction, renovation, remodeling, conversion of the building to a condominium, townhouse, cooperative building or any other type of multiple unit residential structure, maintenance or repair." Maintenance and repair sit inside that definition. A contractor carrying it can be fully compliant with a requirement set on paper and excluded from the routine unit turnover work it was hired to do.

Injury to employee and action-over endorsements. The standard employer's liability exclusion carries its own insured contract exception, so the standard form does not bar an upstream party's indemnity claim arising from an injury to the vendor's employee. What bars it is a broadened action-over or employee injury endorsement, or wording that strips the exception out. On New York work this is the exclusion that most often decides whether the coverage sitting behind an indemnity clause is real, because Labor Law Sec. 240 and Sec. 241 impose non-delegable duties on owners and general contractors for elevation-related work and enumerated safety violations, so liability can attach without fault on their part, and Workers' Compensation Law Sec. 11 then bars the resulting third-party claim against the employer unless the injury is a grave injury or the employer signed a written indemnification agreement before the accident.

Subcontractor warranty endorsements set minimum insurance the vendor's own subcontractors must carry and can reduce or eliminate the vendor's coverage for work where that was not met. This matters most where the vendor subcontracts routinely, which in property management means snow, specialty trades and much of turnover work.

Classification limitation endorsements restrict coverage to the operations described in the policy classifications, so work outside the classification may be uncovered. A vendor classified for janitorial work that also does light maintenance is the everyday version of this.

Contractual limitation endorsements remove the contractual liability coverage that makes an assumed indemnity obligation insurable, which can hollow out the indemnity clause the requirement set was built around.

Abuse and molestation exclusions are worth a specific check for any vendor whose staff enter occupied residential units or work around minors. The perpetrator need not be an insured for the exclusion to apply, and the CG 21 46 form reaches negligent employment, investigation, supervision, retention, and reporting to the proper authorities or failure to report.

Checking for these is endorsement-level and sometimes policy-level work. It is not proportionate across an entire vendor population, and it is clearly proportionate for the categories where the exclusion maps directly onto what the vendor was hired to do.

Where does state law limit what a property manager can require?

Requirements are contract terms, and contract terms are subject to state law. Three areas come up repeatedly on property portfolios.

Snow and ice removal indemnity is void in some states, in both directions. Illinois is the clearest. Under 815 ILCS 675/10, a provision in a snow removal and ice control services contract is "against public policy and void" if it requires the service provider to indemnify the service receiver for damages resulting from the receiver's acts or omissions, and equally if it requires the service receiver to indemnify the service provider for the provider's own. The same section voids hold harmless and defense provisions running each way. Connecticut reaches a narrower result at Sec. 21a-433, voiding a provision requiring the provider to indemnify the receiver for acts the provider was not required to perform or was instructed not to perform, or to hold the receiver harmless for tort liability resulting from the receiver's own acts or omissions, in each case only where the contract prohibits the provider from mitigating a specific snow, ice or other mixed-precipitation event or risk, and excepting contracts performed on municipal or state-owned roadways or property. Colorado, at C.R.S. 13-21-129, voids indemnity, hold harmless and defense provisions in both directions on the same mitigation condition Connecticut applies, and other states have taken up the question. A requirement set that assumes a snow contractor's indemnity will hold, everywhere, is assuming something several states have expressly legislated against.

Anti-indemnity statutes reach building maintenance and repair, not only new construction. New York's General Obligations Law Sec. 5-322.1 voids an agreement, in connection with construction, alteration, repair or maintenance of a building, purporting to indemnify the promisee against liability "contributed to, caused by or resulting from the negligence of the promisee, his agents or employees, or indemnitee, whether such negligence be in whole or in part." The word maintenance is what makes this a property management issue rather than a capital projects issue. Enforceability of broad form, intermediate form and limited form indemnity varies substantially by state, and the requirement set should reflect the jurisdictions the portfolio actually sits in.

Workers compensation works differently in four states. Ohio, North Dakota, Washington and Wyoming are monopolistic: employers obtain workers compensation through the state fund, and the state fund does not provide employers liability coverage. Employers liability there comes from a stop gap endorsement, attached to the general liability policy where the employer operates only within the monopolistic state, or to the workers compensation policy where it also operates elsewhere. A requirement set asking for "workers compensation and employers liability" and a reviewer looking for both on the certificate in the usual place will produce a false deficiency in those states, or worse, accept a submission with no employers liability at all.

None of this is legal advice, and application turns on the specific contract, the facts and the jurisdiction. It is a reason for the requirement set to be reviewed against the states the portfolio operates in, rather than inherited from a template written for somewhere else.

What does the certificate establish, and where does it stop?

The certificate reports. It does not prove.

The ACORD 25 states on its face that it is issued as a matter of information only, confers no rights upon the certificate holder, and does not amend, extend or alter the coverage afforded by the policies listed. The IMPORTANT paragraph is explicit that where the holder is an additional insured, the policies must have additional insured provisions or be endorsed, and that "A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s)." The ADDL INSD and SUBR WVD columns are representations about what the producer understands the policy to contain.

The current 2025/12 edition also changed what the limits column can be read to establish. The certification block above the coverage grid now carries an asterisked passage stating that limits shown "MAY HAVE BEEN REDUCED BY PAID CLAIMS" and are "INCLUSIVE OF AMOUNTS REQUESTED BY THE CERTIFICATE HOLDER AND MAY NOT REFLECT POLICY LIMIT AMOUNTS IN EXCESS OF THOSE REQUESTED." If a requirement is $1,000,000 and the certificate shows $1,000,000, the form itself now discloses that this may be a reflection of the request rather than the policy. The asterisk carries a footnote marking that passage not applicable in Wyoming.

This is not an argument against certificates. Certificate review is the right level of review across a large share of a vendor population, where the approved requirements and the inherent exposure do not call for deeper analysis, and doing it properly is real work. The question is whether the depth of review matches the requirements and the exposure. Where scope, jurisdiction, completed-operations exposure or potential liability warrants closer scrutiny, the certificate may not reveal exclusions or endorsement language that matters at claim time, and the endorsement pages or the policy become the proportionate next step. Our guides on reading and verifying a certificate, the ACORD 25 itself and the endorsements that carry risk transfer go through each in detail.

What does this look like as an operation across a portfolio?

Requirements only work if something repeats them at scale, across properties, across entities, and across renewal cycles.

Requirement sets are built per vendor category rather than per vendor or per portfolio, and they name endorsement forms rather than describing outcomes, because "additional insured including completed operations" is not a document anyone can send. Collection asks for the endorsement pages alongside the certificate at first submission, since asking afterward means asking twice and waiting through a second broker cycle. Review confirms the named insured against the contracting entity exactly, and confirms that every entity the contract requires appears in the endorsement schedule rather than in the certificate holder box. Monitoring re-confirms at renewal and whenever scope, entity structure or the requirement set changes. And the record is retained, because completed operations claims at a property arrive years after the vendor finished and left.

Shared vendors are where a portfolio either gains or loses. The same landscaping company working at eleven properties owned by four entities should not generate eleven unconnected reviews, and it should not generate one review that quietly ignores the fact that four different entities need to appear in the endorsement schedule.

That is the work Docutrax does on behalf of its clients. Licensed insurance professionals and CRIS-certified Account Managers review what was submitted, coordinate remediation through the vendor's broker or agent, and maintain the record across the portfolio, with more than 300,000 forensic policy reviews completed since 2017. Docutrax surfaces what the documents establish and what they do not, and escalates within the rules the client has approved. The client sets the requirements and makes the decisions.