--- title: "Which technology service lines are a significant part of the Applicant's revenue (consulting, MSP/MSSP, development, BPO, QA/testing, IT staffing/project management, telecom/ISP, e-recycling/data destruction, etc.)?" url: https://insuranceposture.com/questions/services-and-contracts/technology-service-lines-significant-part-applicant-s-revenue category: "Services and contracts" canonical_key: q_pro_003 evidence_state: attested updated: 2026-08-24 --- # Which technology service lines are a significant part of the Applicant's revenue (consulting, MSP/MSSP, development, BPO, QA/testing, IT staffing/project management, telecom/ISP, e-recycling/data destruction, etc.)? URL: https://insuranceposture.com/questions/services-and-contracts/technology-service-lines-significant-part-applicant-s-revenue Section: Services and contracts Evidence state: Attested, not tenant-verifiable Each service line on this list carries its own claim pattern, and carriers maintain appetite line by line. ## What the carrier is actually asking The carrier is asking which technology service lines make up a significant part of revenue: consulting, managed services, development, business process outsourcing, testing, staffing, telecommunications, electronics recycling and data destruction, and others. ## Why it is underwritten Managed services carry correlated exposure across clients. Development carries defect liability. Staffing carries vicarious liability for placed personnel. Data destruction carries a direct exposure if data is not actually destroyed. Underwriters treat these as distinct risks rather than as one technology category. ## Where the answer lives in Microsoft 365, Entra ID, and Azure This is a description of your services supported by revenue attribution. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Finance | Revenue by service line | A split identifying every line above a materiality threshold. Attested | | Managed services | Client count and the access held in client environments | The aggregation exposure, which underwriters focus on most | | Development | What is built and for whom | Whether software is delivered into safety-critical or high-consequence use | | Staffing | Personnel placed into client environments | Whether placed staff act under your direction or the client, which determines liability | | Data destruction | Chain of custody and certificates of destruction | A verifiable process, since undestroyed data is a direct and provable exposure | **Managed services changes the whole submission** Once a meaningful share of revenue comes from managing client environments, the underwriting shifts to aggregation. Expect questions about client count, privileged access, and remote management tooling, and expect a narrower market. Disclosing it early is far better than having it emerge later. ## What a defensible yes requires - Every material service line is disclosed with its revenue share. - Managed service client counts and access models are described. - Development output and its use context are described. - Staffing arrangements clarify direction and control. - Data destruction processes produce verifiable evidence. ## How this answer goes wrong Managed services are omitted because they are a small revenue line, while the access held in client environments is extensive. Exposure follows the access rather than the revenue, and this is the disclosure carriers most dislike discovering after a loss. ## If this answer turns out to be wrong Technology E&O questions describe what you promised your own clients, and the policy language decides how strictly your description of that is held. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [whether an answer is a warranty or a representation](https://insuranceposture.com/glossary/warranty). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Do we have to list small lines? List anything material and anything that carries access to third-party systems, regardless of size. Access is the exposure, not revenue. ### Why is data destruction on the list? Because failing to destroy data creates a direct breach exposure with a clear paper trail, and claims in that area are unusually well evidenced. ### What about staffing? Placed personnel can create liability for acts in a client environment. Whether they work under your direction or the client is the question that matters. ### How does this affect appetite? Some markets decline managed service providers or apply substantially different terms. Accurate disclosure gets you to the right market first time. ## Related questions - [Is the Applicant engaged in adult content, cryptocurrency, gambling, payment processing, or MSP/MSSP business?](https://insuranceposture.com/questions/business-profile/applicant-engaged-adult-content-cryptocurrency-gambling-payment-processing-msp) - [Is multi-factor authentication enforced for all access to clients' systems and remote monitoring and management (RMM) applications?](https://insuranceposture.com/questions/multi-factor-authentication/multi-factor-authentication-enforced-access-clients-systems-remote-monitoring) - [Does the Applicant provide data processing, storage, or hosting services to third parties?](https://insuranceposture.com/questions/business-profile/applicant-provide-data-processing-storage-hosting-services-third-parties) - [Do the Applicant's software products or services address any specific high-exposure activities (IT security, e-commerce, finance/banking, medical/healthcare, media broadcasting/streaming, ERP/CRM/SCM, custom programming)?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-software-products-services-address-specific-high-exposure) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.