Another form of "insurance" that shouldn't be overlooked is a formal contract of some kind that spells out exactly what you will be doing for the customer. That avoids (some of) the finger pointing that will occur when/if something goes wrong. If you're only supporting the XYZ system, state that. If you're not touching the production system, state that. It could keep the lawyers at bay later.