Cyber and Employment Practices Liability for Colorado Contractors

Neither of these policies is required by anyone. No statute, no GC, almost no HOA. That’s the first thing to say. The second is that we still write both for small crews, because the losses they cover come out of the bank account with no other policy to catch them. Here’s when a dirt, landscape, or snow outfit typically needs cyber and employment practices liability (EPLI), and when it honestly doesn’t.

What it does on your job

Start with the email. A hardscape crew finishes a retaining wall for a GC in Castle Rock and sends the invoice. Two days later the GC’s accounts payable gets a second email, same logo, same invoice number, new bank routing. The GC pays it. The money is gone, the GC says it paid, and the crew is out a month of receivables. Under a cyber form that includes social engineering or funds transfer fraud, that’s the claim, subject to the sublimit and the policy language.

Same policy, different night. A residential plow operator runs routes off one laptop: customer list, schedule, books. A ransomware screen comes up at nine at night with a storm coming across the Front Range. Cyber typically pays for the response, the rebuild, and notifying the customers whose information was on that machine.

Now the other policy. A snow-and-landscape outfit in Colorado Springs lays off its plow crew in March, the way it does every year. One operator, hired in November, files a wrongful termination and discrimination claim in April. Merit or not, someone has to answer it, and EPLI typically pays the defense and any settlement. The third-party side shows up more than people think: a customer on a lawn route accuses a crew member of harassment, and the claim comes against the business.

Two things to keep separate: the loss and the defense. On cyber, the loss is the money or the data. On EPLI, the defense is usually the whole claim, because most never reach a verdict. A low defense limit can run out before the claim does.

What it does not do

• Your own employee stealing. That’s a crime policy (employee dishonesty), not cyber. What cyber covers is the outsider who tricked you.
• Wage-and-hour claims. Excluded under most EPLI forms, or defense-only under a sublimit. What is covered is the wrongful termination, discrimination, harassment, and retaliation side.
• Injuries. An operator hurt on the job is workers’ compensation. A customer hurt on a lot you plowed is general liability.
• Proven intentional acts. The policy defends until the conduct is established, then it stops, under most forms.
• Fines. Regulatory fines and penalties are excluded. The defense of the matter that produced them is typically covered.
• Old claims. Both policies are usually claims-made with a retroactive date. A claim from before that date is not covered. Keep the policy continuous.

Who needs it

The honest answer, by size. A one-person outfit with a Yanmar mini skid steer, no employees, and a personal phone: cyber only if you invoice GCs by email and move money by ACH, and even then the second-approver habit does most of the work. EPLI, no. A three-person crew that hires and lays off with the seasons under our snow removal and landscaping hubs: EPLI is a real question, and turnover matters more than headcount. A six-person crew under the excavation hub billing GCs by email: both, with the fraud limit sized to your biggest invoice.

Colorado employers must carry workers' compensation insurance as soon as they have one or more employees, whether part-time, full-time, or family members (C.R.S. 8-40-203(1)(b), 8-44-101); the state can fine an uninsured employer up to $500 for every day without coverage. (C.R.S. 8-40-203(1)(b); 8-44-101; 8-43-409) That’s the rule for workers’ comp, and it’s a useful yardstick here. The day you have an employee, you have EPLI exposure. Whether you buy the policy that day is a judgment call. Whether you have the exposure isn’t.

How it’s rated

No premium figures here. What moves the number:

1. Headcount and turnover. Seasonal hiring cycles rate higher than a steady crew of the same size.
2. Revenue. The base for cyber, and a proxy for how much money moves by email.
3. Controls. Multi-factor login, offline backups, a second approver on bank changes. Some carriers won’t write the fraud coverage without them.
4. HR practices. A written handbook, documented layoffs, and a hiring process. Carriers ask.
5. Prior claims and demand letters. A letter from a state agency counts even if nothing was filed.
6. Limits and the fraud sublimit. The social engineering limit is often a fraction of the policy limit. Size it to your receivables.

Colorado notes

Wage rules are separate from EPLI. Colorado has its own wage and hour rules and its own state enforcement, and a wage claim can start with a letter from the state rather than a lawsuit. Under most EPLI forms that claim is excluded or defense-only. We can tell you what the policy does. What the rules require is a question for an employment attorney, before the first seasonal layoff.

Seasonal crews are the pattern. Landscape in summer, plow in winter, a layoff between. That cycle is normal in this business and it’s where most small-crew employment claims start. Handle every layoff the same way, in writing.

Winter is when the laptop matters. A locked screen during a Front Range storm is a missed-route problem, and the HOA contract has something to say about missed routes. The backup is the first control. The policy is the second.

Contract language you’ll see

• “Cyber liability, $1,000,000 per claim.” Showing up on larger public and national snow-management subcontracts. Rare on residential and HOA work.
• “Employment practices liability including third-party coverage.” Occasionally in HOA and property management contracts where your crew works around residents.
• “Vendor shall notify Owner of any data security incident.” Common where you hold gate codes, resident lists, or building access. Your cyber policy’s breach response is how you meet it.
• “Wire instructions will only be changed by phone confirmation.” Not insurance language, but the most useful clause on the page. Put it in your own invoices too.

Where to go from here

If you want to talk through whether your crew is on the “not yet” side or the “this year” side, call Phil. It’s a ten-minute conversation about headcount, turnover, and how you get paid. If you already have a package policy, send it in for a policy review and we’ll look for an EPLI endorsement that may already be on it, and for the sublimit on whatever cyber is there.

Serving businesses located in Colorado. Coverage is determined by the policy language and the carrier.

Terms on this page: employment practices liability, cyber liability, social engineering fraud, funds transfer fraud, third party epli, claims made, retroactive date, wage and hour exclusion, breach response, crime coverage. Full glossary.