A model law published by the National Association of Insurance Commissioners (NAIC) that requires licensed insurance entities — including independent agencies and brokers — to build and maintain a written information security program (WISP), perform annual risk assessments, enforce multi-factor authentication, conduct vendor due diligence, document an incident response plan, and notify the state insurance commissioner of any cybersecurity event within 72 hours. As of 2026, 25+ states have adopted it in some form.

Ten elements: a written program document, a designated qualified individual (security officer), an annual documented risk assessment, access controls and identity management, encryption of non-public information (NPI) in transit and at rest, multi-factor authentication on all systems holding NPI, written vendor due diligence and contracts, an incident response plan, ongoing employee security training, and the breach notification workflow to meet your state's 72-hour clock.

Yes. The NAIC Model Law explicitly requires MFA for any individual accessing information systems containing non-public information — which is every agency management system in use today. The same applies to carrier portals, M365 / Google Workspace, and any third-party tool storing client data.

A named, accountable person responsible for overseeing the agency's information security program. For most independent agencies, this role is outsourced to a managed security partner that acts as the virtual security officer — building and maintaining the WISP, reporting to the principal, and signing off on the annual compliance certification.

GLBA Safeguards (federal, FTC-enforced) is the baseline data-protection requirement for financial institutions, including insurance. The NAIC Model Law (state-by-state adoption) is stricter and insurance-specific: it adds mandatory MFA, 72-hour breach notification to the state commissioner, annual compliance certification, and explicit vendor due diligence. If your state has adopted the Model Law, you must satisfy both.

Three layers of fallout: (1) state-level fines up to $10,000 per violation in most NAIC-aligned states plus state attorney general action; (2) loss of carrier appointments — carriers increasingly require attestation to cyber controls and will deappoint after a breach if the controls weren't in place; (3) E&O claim denial — your professional-liability carrier may refuse to pay a breach claim if you can't produce a compliant WISP and evidence of the controls you attested to on renewal.

For a 10–25 producer agency, expect $800–$1,500/month for ongoing managed security including the WISP build, MFA enforcement, EDR on all devices, email security, 24/7 monitoring, and incident response. Smaller agencies (under 10 producers) sit at $375–$600/month. Wholesale brokers and specialty firms with higher complexity typically land in the $1,500–$3,000/month range.

Most national carriers (Travelers, Chubb, Liberty Mutual, Hartford, Nationwide, etc.) now include a cyber-controls attestation in their annual appointment review. They ask about MFA, encryption, backup procedures, training programs, vendor controls, and incident response. The questions get longer every year and the answers get verified. We pre-build standard responses mapped to your actual environment so you can complete each carrier's form in under an hour instead of three days.

Yes — and this is now common. Hub International, Acrisure, BroadStreet Partners, Patriot Growth, and most other roll-up acquirers run cyber-posture diligence as part of their standard checklist. Findings include lack of a WISP, no MFA on AMS / carrier portals, no documented vendor due diligence, and no tested incident response plan. We've seen multiples adjusted downward and deals walked over each of these.

Under the NAIC Model Law, NPI includes any information identifying a consumer that's not publicly available — Social Security numbers, driver's licence numbers, financial account information, medical/health information collected for policy underwriting, claim history, beneficiary details, and biometric data. Effectively every client record in your AMS contains NPI.

Under the NAIC Model Law, you must notify your state insurance commissioner within 72 hours of determining that a cybersecurity event affecting NPI has occurred. The clock starts at determination, not at attack. Most agencies aren't equipped to investigate, scope, and report inside 72 hours without a pre-built playbook — which is one of the reasons the requirement was written that way.

Depends on your state's specific version. Some states include exemptions for agencies with fewer than 10 employees or under a revenue threshold. Many states do not exempt small agencies, and several use 'handles consumer NPI' as the trigger — which every agency does. Even where the exemption applies, your carriers and E&O insurer often require similar controls regardless.