State Insurance Data Security Laws: What Agencies Need to Know

The rules are catching up

Many states have adopted insurance data security laws based on the NAIC Insurance Data Security Model Law, and New York has its own cybersecurity regulation for financial services companies. Requirements vary by state and agency size, so confirm what applies to you with counsel.

Common requirements

• A written information security program based on a risk assessment
• A designated person responsible for the program
• Access controls, including multi-factor authentication
• Oversight of third-party service providers
• An incident response plan and breach notification procedures

Start with a risk assessment

Inventory where client data lives, who can access it, and which vendors touch it. The findings become the basis for your written program.

Keep evidence current

Carriers and regulators may ask for proof. Keep policies, training records, and control documentation up to date.

How WEBIT helps

WEBIT implements and documents the technical safeguards these laws expect and supports your written program. Your compliance lead and counsel keep final say.