Do You Have a Data Protection Plan?

It is renewal season, and your agency's cyber insurance application is sitting in your inbox. Most of the questions are easy. Do you use MFA? Yes. Do you back up your data? Of course.

Then you hit the one that makes you pause. Does your organization maintain a written information security program?

If your honest answer is "sort of" or "I think it's in a binder somewhere," you are in good company. Plenty of independent agencies protect client data well in practice but have never written the plan down. The good news is that a written information security program (WISP) is very doable for an agency of any size.  

What Is the NAIC Model Law?

The National Association of Insurance Commissioners approved the Insurance Data Security Model Law (also called Model Law #668) in October 2017 to set cybersecurity expectations for the insurance industry (IA Magazine). It was built to bring more consistency to how insurers and agencies protect data, investigate incidents, and report breaches.

The NAIC cannot require anything on its own. The model only becomes law in a state once that state's legislature enacts it. Where it has been adopted, it applies to insurers, agents, and other licensed entities, and requires each one to build a written security program based on a risk assessment, investigate any cybersecurity event, and notify the state insurance commissioner when one happens.

North Carolina Requirements

As of this writing, North Carolina does not appear on the list of states that have adopted the NAIC model. Does that mean NC agencies are off the hook? Not quite.

North Carolina has had its own rule on the books since 2003. Under G.S. 58-39-145, every licensee must implement a comprehensive written information security program (WISP) with administrative, technical, and physical safeguards that fit the size and complexity of the business. The law's definition of licensee specifically includes producers, which means independent agencies (S.L. 2003-262).

The goal is to keep customer information secure and confidential, guard against anticipated threats to that information, and prevent unauthorized access that could seriously harm or inconvenience a customer. It even gives the Commissioner authority to write rules about how licensees oversee their service providers, which is a good reminder that your vendors are part of the picture too.

One more NC wrinkle worth knowing is that the state's Identity Theft Protection Act requires businesses of every kind to notify affected people when a breach puts their personal information at risk. A WISP with a solid incident response section makes that process far less chaotic.

What a Solid WISP Includes

North Carolina's law is flexible, so the NAIC model makes a handy blueprint. A WISP that would hold up to a regulator, a carrier, or a cyber underwriter usually covers these areas.

None of these requires a giant budget. Most agencies already do most of it and just need to create the documents.

Small Agency? Read the Fine Print

You may have heard that small agencies are exempt.  

North Carolina's rule works differently. Instead of a headcount cutoff, it asks every licensee to scale its safeguards to its size and complexity (G.S. 58-39-145). A five-person agency can have a lean plan.

Cybersecurity Insurance

You know better than anyone that an application is only as good as the answers behind it. When your agency checks "yes" on a security question, you are making a representation. If a claim later reveals that the control didn't exist or the plan was never written, your claims may be denied.

A current WISP gives you a single place to point to when an underwriter, a carrier partner, or a regulator asks how you protect client data. It also makes renewals faster, because the answers are already written down.  

Five Steps to Create a WISP

1. Map your client data. List every place policyholder information lives, from Applied Epic or your AMS to carrier portals, shared drives, and the filing cabinet. An IT infrastructure assessment is a fast way to get this picture. ‍
2. Lock down logins. Turn on MFA everywhere it's offered and tighten who can reach what. Our breakdown of what happens when phishing works shows why one stolen CSR password can open the whole agency. ‍
3. Write your offboarding checklist. Producers and CSRs move on, and their access should leave with them. Our guide for when a top producer resigns walks through every account to close. ‍
4. Put your incident plan on paper. Decide who to call, who makes decisions, and who gets notified. Start with our incident response plan template. ‍
5. Set a review date. Put your annual WISP review on the calendar, ideally a month before your cyber renewal, so your answers are always fresh. If AI tools are part of your workflow, fold in the guardrails from our AI in the Agency article too.

Keep Your Security Program Current

You would never let a client's policy lapse without a conversation. Your agency's security program deserves the same care.

Want a second set of eyes? Net Friends has helped North Carolina businesses protect sensitive data since 1997, and we would be glad to review where your agency stands. Book a free, no obligation assessment and we will help you build a program that's audit ready and renewal ready.

Follow Us on LInkedIn

More Reading

What Happens When Phishing Works?
Your Top Producer Just Resigned. What Now?
The Plan That Could Save Your Business
Why Your Business Needs an IT Infrastructure Assessment
AI in the Agency

This article is for general information and is not legal advice. Requirements can change, so check with the North Carolina Department of Insurance or your attorney about your agency's specific obligations.