For insurance agencies
Cyber insurance for insurance agencies: what you'll be asked
The short answer
Agencies get asked the standard cyber insurance questions and then held to a higher standard, because many states have adopted a version of the NAIC Insurance Data Security Model Law. Where it applies you must maintain a written information security program and notify your regulator of a cybersecurity event, which is most of what the application wants to see anyway.
What's different about insurance agencies
You hold more sensitive data per client than almost any business your size: dates of birth, Social Security numbers, driver's license numbers, loss histories, sometimes health details. An agency management system is a rich target, and underwriters who sell to agencies know exactly what's in one.
Timing is the practical problem. Nobody sends an agency its own supplemental until renewal season, which is the same season you are buried in everyone else's. Agencies that come out of this well tend to be the ones that treated their own application as a project in a quiet month, not a form to fill in the week it is due.
There's also an awkward truth about being in the industry. Your carriers and your errors-and-omissions underwriter both expect you to model the behavior you advise clients on, and a declination on your own cyber application is a difficult conversation. Agencies tend to discover their gaps late because nobody sends them their own supplemental until renewal.
The overlooked exposure is other people's paperwork. An agency mailbox holds applications, loss runs and supplementals for hundreds of insureds, which means a compromise there exposes data belonging to clients and to the carriers you represent. That combination invites questions from your own errors-and-omissions underwriter as well as your cyber one, and they will not be satisfied by the same answer twice.
The regulatory overlay is the real difference. Many states now require licensees to run a written information security program, designate someone accountable, assess risk, and report a cybersecurity event to the insurance commissioner within a set window. Once that program exists, the cyber application is largely a matter of attaching it.
What already applies to you, before any insurer asks
These aren't insurance requirements. They're obligations that exist whether you buy a policy or not, and the paperwork they call for is most of what an application wants to see.
NAIC Insurance Data Security Model Law (#668)
Many states have adopted a version of it. Where it applies, licensees must maintain a written information security program proportionate to their size, designate someone responsible, perform risk assessments, oversee third-party providers, and notify the insurance commissioner of a cybersecurity event within a defined period. Check your own state's adopted text, because the details vary.
Gramm-Leach-Bliley Act and the FTC Safeguards Rule
Agencies handle nonpublic personal financial information, which brings privacy and safeguards obligations alongside state insurance requirements. In practice the two overlap heavily: one written program, one named owner, one documented risk assessment, and you have answered both.
Carrier and market-access agreements
Appointments, cluster memberships and market-access arrangements increasingly carry their own security language, including breach-notification timelines to the carrier. Those come from contracts you signed rather than from your state, and they are easy to forget until something happens.
General information, not legal advice. Whether a rule applies to your business turns on facts we don't know about it, so confirm with your own advisor.
The questions carriers weight hardest here
Every application covers the same ten control areas. All of them are written out here. These are the ones an underwriter reads twice for insurance agencies.
Is MFA required for remote access (VPN, remote desktop) and administrator accounts?
Why it's weighted here: Remote access to an agency management system is the crown-jewel path, and carriers treat unprotected remote access as close to uninsurable.
If the answer is no: Inventory every remote entry point (VPN, RDP, remote-support tools) and privileged account; enforce MFA on each or shut it off.
Your written evidence: Remote Work Policy §2 Approved remote access methods + Access Control & Account Management Policy §4 Administrative access
When someone leaves the company, how quickly is their access removed?
Why it's weighted here: Producer turnover is normal, and a departed producer with live credentials is both a breach risk and a regulatory problem.
If the answer is no: List every system a departing employee touches; turn it into a checklist; assign an owner. Two hours, permanent fix.
Your written evidence: Access Control & Account Management Policy §2 Account lifecycle
Do you review the security of vendors who access your systems or data?
Why it's weighted here: Your management system, comparative rater and CRM all hold client data, and the model law expects you to oversee them.
If the answer is no: Start with the inventory: every vendor with system or data access, what they touch, and whether they have MFA. Ten vendors, one page, one hour.
Your written evidence: Vendor & Third-Party Risk Policy §3 Before we sign: proportionate diligence
Do you have a written incident response plan?
Why it's weighted here: Regulator notification runs on a clock, so the plan has to name who files and where.
If the answer is no: Write the one-page version today (who to call, how to isolate, where backups are), then grow it into a full plan with the template.
Your written evidence: Incident Response Plan (Fill-in-the-Blank) §2 Roles + Incident Response Plan (Fill-in-the-Blank) §4 The first 24 hours
Evidence to have ready
- Your written information security program, with the name of the person accountable and the date of the last risk assessment
- The notification steps and contact for your state insurance department, written into your incident plan
- A vendor inventory covering your management system, rater, CRM and anyone else holding client data
- Access removal records for producers and staff who have left
The written half of that list is what the Readiness Pack is: Access Control & Account Management Policy, Vendor & Third-Party Risk Policy, Incident Response Plan (Fill-in-the-Blank), Data Protection & Classification Policy, each personalized to your business and mapped to the question it answers.
Common questions
We're small. Does the model law still apply to us?+
Most adopted versions scale the program to the size and complexity of the licensee, and many include an exemption below a staff or revenue threshold. Small does not usually mean exempt from having something in writing, and the exemptions differ by state, so check your state's adopted text rather than assuming.
Our agency management system vendor is SOC 2 audited. Does that cover us?+
It covers their platform and it's worth citing. It doesn't cover your accounts, your MFA enforcement, your offboarding, or the laptop a producer left in a car. Keep their report, and answer the application about the parts you control.
What do we tell our carriers about our own controls?+
The same thing you tell your cyber underwriter, which is the point. Appointments and market access increasingly come with security expectations, and a written information security program you can attach satisfies several askers at once. Keep one current document rather than answering each request from memory.
Can we use this with our own clients?+
Yes, and a lot of agencies do. There's a free pre-check link you can send with any supplemental questionnaire, plus a one-page handout of what carriers ask. It costs nothing, we don't sell insurance, and there's no commission split in either direction.
Sources
- NAIC Insurance Data Security Model Law (#668)
- Gramm-Leach-Bliley Act privacy and safeguards (FTC)
- CIS Critical Security Controls v8.1, Implementation Group 1
- Carrier applications and supplemental questionnaires, 2026 forms
See where your practice stands, free
Sixteen questions, five minutes, a score across the ten control areas underwriters probe, and your three biggest gaps with the fix for each. No email needed for the score.