Industry Guide
Insurance agencies handle non-public personal information (NPI) subject to state insurance data security laws and the NAIC Model Law. Agents work across carrier portals, agency management systems, and email — creating a broad attack surface. A phishing attack that compromises carrier credentials or client records can result in regulatory action and E&O liability.
State insurance data security law compliance (NAIC Model Law)
Agency management system (Applied Epic, Hawksoft, AMS360) support
Carrier portal security and credential management
Protecting customer NPI (non-public personal information)
Remote agent device management and security
Business Email Compromise targeting premium payments
Most states have adopted the NAIC Insurance Data Security Model Law, requiring licensed insurers and agents to implement an information security program, conduct risk assessments, and notify regulators of data breaches. New York's DFS Cybersecurity Regulation (23 NYCRR 500) has stricter requirements for NY-licensed entities.
An MSP experienced with insurance agencies will understand your AMS platform, carrier portal security requirements, and the NAIC Model Law documentation requirements. They can help you build the written information security program (WISP) the law requires.
Tell us your location, company size, and industry. We'll match you with vetted managed IT providers who have experience with insurance agencies.
Find local MSPs by city
The NAIC Insurance Data Security Model Law requires licensed insurance producers in adopting states to implement an information security program, conduct annual risk assessments, and report data breaches to state regulators. Most states have adopted it. Your MSP should be able to help you document compliance.
Insurance agencies face phishing targeting carrier credentials, Business Email Compromise (BEC) requesting fraudulent premium redirects, and ransomware targeting client policy and claims data. Agents working on personal devices or home networks add significant risk. Multi-factor authentication and email security are the highest-priority controls.
Common insurance AMS platforms include Applied Epic, HawkSoft, AMS360, EZLynx, Vertafore, and NowCerts. The MSP doesn't need to be the AMS vendor's support partner, but they should understand how to configure your network and devices for secure AMS access and integration.
Small insurance agencies (5–20 agents) typically pay $1,000–$3,000/month for managed IT. Per-user rates range from $125–$225. The compliance documentation requirements of the NAIC Model Law may increase cost slightly versus a standard small business plan.