GLBA & Insurance Data Security Compliance for Insurance Agencies

In practice, yes, most agencies need a written information security program. The Gramm-Leach-Bliley Act set the expectation that financial institutions, including insurance providers, protect nonpublic personal information. For insurance, that expectation reaches licensees through state law rather than through the FTC. Under the McCarran-Ferguson Act, the business of insurance is generally left to the states, so it is your state insurance department, not the FTC, that regulates how you protect policyholder data. The standard most states follow is the NAIC Insurance Data Security Model Law, which a majority of states have adopted in some form and which requires a written information security program. Whether and exactly how it applies depends on the states where you are licensed, and some smaller agencies qualify for limited exemptions under specific state statutes. We assess your licensing footprint during onboarding and document which requirements apply to you.

The model requires a licensee to develop and maintain a written information security program based on a risk assessment. Its core elements are a written risk assessment of the threats to nonpublic information, a designated responsible individual overseeing the program, access controls with multi-factor authentication and encryption of nonpublic information, secure disposal, and regular testing and monitoring of the controls. It also requires due diligence and oversight of third-party service providers, a written incident response plan, and investigation of cybersecurity events. When a reportable event occurs, the licensee must notify the state insurance commissioner within a defined window, commonly 72 hours in states that follow the model closely. States that have adopted the model may modify these elements, and a few have their own statutes, so we map the specific obligations to the states where your agency operates.

No. This is a common point of confusion, and getting it right matters. The FTC Safeguards Rule (16 CFR Part 314) applies to non-bank financial institutions under FTC jurisdiction. The business of insurance is generally not one of them. Under the McCarran-Ferguson Act, insurance is regulated by the states, so the FTC does not enforce a Safeguards Rule against insurance licensees for their insurance activities. Instead, GLBA-style data security requirements reach insurance agencies through state insurance law, most often the NAIC Insurance Data Security Model Law that a majority of states have adopted in some form, and in some states a standalone insurance data security statute. The obligations are similar in substance to the Safeguards Rule, but the source of authority, the regulator, and the notification rules are the states, not the FTC. We build the program to the state requirements that actually apply to your agency.

Under the NAIC model, when you determine that a reportable cybersecurity event has occurred, you must notify the commissioner of the state where you are licensed within a defined window, commonly 72 hours in states that follow the model closely. What counts as a reportable event, the notification threshold, and the exact timeline vary by state, and this insurance-specific duty is separate from any general state data-breach notification law that may also require notice to affected consumers or the state attorney general. Because an agency licensed in several states may owe notice to several commissioners, timing and content matter. We build the incident response plan, define the reportable-event trigger across the states where you operate, and prepare the notification workflow so a real event is handled inside the applicable window.

We deliver the program end to end. It starts with assessing the states where you are licensed and doing business, then a gap analysis against the NAIC model and the applicable state statutes, and a written risk assessment. From there we build the WISP and supporting policies and implement the technical controls: MFA, encryption, access controls, logging, and endpoint and email security. We also handle testing and monitoring, third-party and carrier-connection oversight, security awareness training, the incident response plan, and the commissioner-notification workflow. We then manage the program on an ongoing basis so it stays current as your footprint, the model, and state law change. We serve commercial clients across Texas, Tennessee, and the United States.

No. A secure agency management system is helpful, but insurance data security law applies to your agency as a whole, not just one application. You are still responsible for your own written program, your designated responsible individual, your risk assessment, your access controls and MFA, your incident response plan, and your training. You must also exercise due diligence over every third-party service provider that touches your policyholder information, including that AMS vendor and the carrier portals you connect to. We build the program around your full environment and document third-party oversight as part of it.

Sometimes, in part. Several states that adopted the NAIC model include limited exemptions, often tied to headcount, gross revenue, or total assets, that relieve a smaller licensee from certain program elements. The specifics differ by state, and an exemption from building parts of the program does not necessarily relieve you of the duty to investigate and report a cybersecurity event. We confirm your size and licensing footprint during onboarding and scope the program to what actually applies to you, rather than assuming an exemption or building elements you do not need.

They reinforce each other. Carriers and MGAs increasingly require appointed agencies to attest to specific security controls before granting or renewing access to their portals, and cyber-insurance underwriters ask the same kinds of questions before binding a policy: MFA, encryption, access controls, backups, email security, and an incident response plan. Those are the same controls the NAIC model requires. A well-built information security program satisfies the state requirement, supports your carrier attestations, and answers the underwriting questionnaire from one coherent set of controls and evidence. We build and document that program so the same work answers multiple requirements rather than duplicating effort for each.