The National Association of Insurance Commissioners (NAIC) Insurance Data Security Model Law (#668) represents the definitive regulatory benchmark for cybersecurity governance in the United States insurance sector. Enacted to counter the escalation of supply chain attacks, ransomware incidents, and corporate data breaches, Model #668 mandates that all Covered Entities establish a comprehensive, risk-based Information Security Program (ISP).
As state insurance departments throughout the nation enforce these statutory provisions, insurance carriers, agencies, brokerages, third-party administrators (TPAs), and InsurTech entities face strict oversight. Non-compliance exposes firms to severe regulatory enforcement, license suspensions, operational freeze, and steep financial penalties.
This guide details the administrative mandates, technical architectures, physical controls, and auditing workflows required to establish total NAIC compliance and defend enterprise infrastructure.
1. Statutory Scope and Jurisdictional Adoption
Understanding the legal footprint of NAIC Model #668 is critical for legal, compliance, and IT leadership.
What Is a Covered Entity?
Under the Model Law, a Covered Entity is defined as any individual or nongovernmental entity operating under a license, authorization, or registration pursuant to state insurance laws. This scope encompasses:
Primary Insurance Carriers: Property & Casualty (P&C), Life, Health, Title, and Excess Lines insurers.
Intermediaries: Independent agencies, national brokerages, Managing General Agents (MGAs), and Managing General Underwriters (MGUs).
Service Providers: Third-Party Administrators (TPAs), claims handling firms, and actuarial platform providers handling nonpublic information.
InsurTech Organizations: Software vendors operating customer-facing portals, policy administration systems, or quotation engines.
What Constitutes Nonpublic Information (NPI)?
NAIC compliance centers on protecting Nonpublic Information (NPI), classified into three primary categories:
Business-Sensitive Data: Information that, if tampered with or disclosed, would materially disrupt the operations, security, or solvency of a Licensee.
Personally Identifiable Customer Records: Any information containing name, number, personal mark, or identifier in combination with Social Security Numbers (SSN), driver’s license or state ID numbers, financial account details, or security codes.
Protected Health Information (PHI): Any data regarding the past, present, or future physical, mental, or behavioral health status of an individual or their family members, including medical history and care provision details.
State-Level Statutory Frameworks
While the NAIC formulates model laws, enforcement occurs at the state level. Over 20 states have formally adopted legislation directly derived from Model #668, with others incorporating equivalent mandates into existing privacy codes:
New York (23 NYCRR 500): Predating and serving as the primary blueprint for Model #668, the NYDFS Cybersecurity Regulation sets stringent mandates, including senior officer certification and strict CISO oversight.
South Carolina (S.C. Code Ann. § 38-99-10 et seq.): The first state to officially pass Model #668, establishing mandatory reporting protocols to the Department of Insurance.
Michigan, Ohio, Indiana, and Texas: Fully operational enforcement regimes with active audit cycles.
Unsure About Your Jurisdiction’s Specific NAIC & State Mandates? State insurance departments are ramping up enforcement and audits. Discover how regional state laws impact your specific entity and license status. Request a Regulatory Jurisdictional Audit for Your Firm.
2. Executive Governance, Board Oversight, and Risk Management
NAIC Model Law #668 establishes that cybersecurity is a board-level governance duty rather than an isolated IT operational concern.
+---------------------------------------+
| Board of Directors / Senior Execs |
+------------------+--------------------+
|
Approves Policies & Receives Annual Reports
|
v
+---------------------------------------+
| Designated CISO / Compliance Officer |
+------------------+--------------------+
|
Executes Continuous Threat Audits & Vendor Oversight
|
v
+---------------------------------------+
| Technical & Operational Safeguards |
| (MFA, Encryption, VAPT, 24/7 MDR) |
+---------------------------------------+
Board and Executive Mandates
Formal Written Oversight: The Board of Directors or an appropriate committee of executive officers must formally approve the written Information Security Program (ISP).
Annual Written Reporting: Executive leadership must receive, at least annually, a formal written report detailing:
The overall status of the Information Security Program and compliance with statutory mandates.
Material cybersecurity risks and exposure vulnerabilities identified during assessment cycles.
Risk management decisions regarding third-party vendor oversight and infrastructure upgrades.
Material security events, breach attempts, and remediation measures undertaken during the preceding 12 months.
Comprehensive Risk Assessment Framework
Covered entities must conduct and document risk assessments that follow established frameworks like NIST SP 800-53 or ISO/IEC 27001. Risk assessments must evaluate:
Threat vectors targeting internal and external networks, wireless access points, and remote worker endpoints.
Hardware, software, and cloud storage assets processing or archiving NPI.
Vulnerabilities in operational workflows, customer portals, and database access routes.
Organizational policies regarding data destruction, system modifications, and employee access.
Is Your Board Prepared for Annual NAIC Compliance Certification? Board oversight requires documented risk evaluations and formal security programs. Let our experts help you draft, evaluate, and present your governance framework. Schedule an Executive Risk & Governance Review.
3. Mandatory Technical Safeguards & Controls Matrix
To achieve compliance, insurance entities must translate policy statements into verifiable technical controls across their infrastructure.
A. Identity & Access Management (IAM) and Multi-Factor Authentication
Universal MFA Enforcement: Multi-Factor Authentication (MFA) is mandatory for any individual accessing enterprise networks, remote desktop protocols (RDP), cloud environments, email platforms, and databases containing NPI. MFA implementation must use secure, cryptographically backed authenticators (FIDO2/WebAuthn, push-based TOTP) rather than SMS verification.
Principle of Least Privilege & RBAC: Implement Role-Based Access Control (RBAC) to ensure employees, contractors, and applications access only the minimum data required to fulfill operational duties. Privileged account credentials (domain admins, database roots) must be strictly controlled using Privileged Access Management (PAM) vaulting.
B. Cryptographic Data Protection Standards
Encryption in Transit: All NPI transmitted over open public networks, APIs, or cross-datacenter links must be encrypted using strong cryptographic protocols (TLS 1.3 or minimum TLS 1.2 with secure cipher suites).
Encryption at Rest: Nonpublic data residing in databases, cloud storage buckets (AWS S3, Azure Blobs), endpoint hard drives, mobile devices, and backup media must be encrypted using AES-256.
Key Management Security: Cryptographic keys must be rotated regularly and stored within dedicated Hardware Security Modules (HSMs) or managed key vaults, segregated from the underlying application data layer.
C. System Hardening and Patch Management
Endpoint Protection: Deploy Endpoint Detection and Response (EDR) or Managed Detection and Response (MDR) platforms across all workstations and servers.
Patch Cycle Requirements: Critical security patches addressing known exploitation routes must be evaluated and deployed within a documented timeframe (typically 14 to 30 days for critical CVEs).
Disabling Unnecessary Services: Unused network ports, legacy protocols (SMBv1, Telnet, HTTP), and unapproved software services must be systematically blocked and removed.
Ready to Fortify Your Infrastructure with NAIC-Compliant Controls? From enforced MFA to AES-256 data encryption and immutable backups, eliminate the technical gaps that attract regulatory fines. Deploy Enterprise Technical Safeguards Today
4. Technical Security Testing: DAST vs. VAPT
Proving compliance to state insurance examiners requires independent, empirical security testing to validate technical safeguards.
| Evaluation Metric | Dynamic Application Security Testing (DAST) | Vulnerability Assessment & Penetration Testing (VAPT) |
|---|---|---|
| Primary Target | Running customer portals, broker portals, web applications, and public APIs. | Internal and external network infrastructure, cloud tenants, Active Directory, and host servers. |
| Testing Methodology | Automated black-box testing that evaluates runtime application behavior without requiring access to source code. | Hybrid testing approach combining automated vulnerability scanning with manual ethical hacking and validation. |
| Exploit Discovery Focus | Input sanitization errors, SQL Injection (SQLi), Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and API security gaps. | Business logic flaws, privilege escalation paths, Active Directory misconfigurations, and lateral movement vectors. |
| Frequency Requirement | Continuous testing or direct integration into DevOps software development and release cycles. | Typically performed as an annual baseline assessment, with additional re-testing after major structural network changes. |
| Regulatory Audit Value | Helps demonstrate continuous application security assurance for customer-facing web platforms and APIs. | Provides validated evidence of network perimeter defenses, internal security controls, and network segmentation integrity. |
Can Your Portals and Network Withstand a Real-World Exploit?
Prove technical compliance to regulators and insurance underwriters with rigorous, independent vulnerability scanning and penetration testing. Book a Comprehensive DAST & VAPT Audit.
5. Incident Response & 72-Hour Breach Reporting Protocol
A central mandate of NAIC Model Law #668 is the requirement for a functional, rapid Incident Response Plan (IRP).
The Written Incident Response Plan (IRP)
Every Covered Entity must maintain a operational incident response plan designed to respond to, recover from, and mitigate cybersecurity events. The plan must define:
Internal Roles & Responsibilities: Clearly designated incident commanders, technical leads, legal counsel, and public relations representatives.
Containment Protocols: Step-by-step technical procedures to isolate compromised endpoints, sever rogue API integrations, and rotate enterprise credentials.
Data Recovery Objectives: Clear Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) backed by immutable, air-gapped backups.
Mandatory 72-Hour Regulatory Notification:
If a Cybersecurity Event occurs—defined as an event resulting in unauthorized access to, disruption of, or misuse of an Information System or NPI—the Licensee must notify the State Insurance Commissioner within 72 hours of confirming the incident if:
The Licensee is domiciled in the state, OR
The event involves NPI of 250 or more consumers residing in the state, AND either has a reasonable likelihood of causing material harm or triggers state consumer notification laws.
Information Required in State Filings:
Date and nature of the cybersecurity event.
Description of how the incident was discovered.
Assessment of whether NPI was accessed, exfiltrated, or modified.
Total estimated number of impacted consumers in each jurisdiction.
Technical remediation steps taken to contain and resolve the breach.
Could Your Team Detect and Contain a Breach Within 72 Hours?
State insurance notification windows leave zero room for delay. Secure 24/7 continuous monitoring and rapid threat containment to guarantee operational readiness. Protect Your Infrastructure with 24/7 Managed Detection & Response (MDR).
6. Third-Party Vendor Risk Management (TPRM)
Insurance entities rely heavily on complex supply chains, including cloud hosting vendors, billing gateways, claims software, and outsourced IT platforms. NAIC Model #668 holds Covered Entities responsible for third-party security posture.
Essential TPRM Steps:
Due Diligence Assessments: Conduct security evaluations before onboarding any third-party service provider that will store, process, or transmit NPI.
Mandatory Contractual Provisions: Contracts must mandate that third-party vendors:
Maintain appropriate administrative, physical, and technical safeguards.
Provide prompt notification in the event of a cybersecurity breach impacting the Licensee’s data.
Allow periodic audit reviews or submit independent SOC 2 Type II reports and ISO 27001 certifications.
Continuous Vendor Monitoring: Re-evaluate key vendors annually to account for infrastructure changes, acquisitions, or evolving threat landscapes.
Are Unsecured Third-Party Vendors Threatening Your Compliance Status?
A single vendor breach can make your firm legally liable. Streamline your vendor risk assessments and secure contractual compliance. Establish Vendor Governance and Privacy Controls.
7. Operational NAIC Audit Readiness Checklist
Use this checklist to evaluate your compliance readiness before an official state insurance department examination:
Executive Governance & Documentation
[ ] Written Information Security Program (ISP) formally approved by the Board of Directors.
[ ] Signed copies of the Annual Board Report on Cybersecurity maintained in legal archives.
[ ] Documented Risk Assessment Report updated within the last 12 calendar months.
Technical & Environmental Controls
[ ] Multi-Factor Authentication (MFA) enforced on all email, remote access solutions (VPN/Zero Trust), admin portals, and NPI databases.
[ ] Cryptographic protocols updated to enforce TLS 1.2+ for data in transit and AES-256 for data at rest.
[ ] Backup architecture upgraded to immutable, air-gapped storage with tested recovery runbooks.
[ ] Endpoint Detection and Response (EDR / MDR) deployed across all servers, endpoints, and cloud workloads.
Audit & Incident Readiness
[ ] Annual VAPT (Penetration Testing) report completed by a qualified cybersecurity provider, with documented remediation tracking.
[ ] Incident Response Plan (IRP) updated with explicit procedures for 72-hour state insurance commissioner notification.
[ ] Active Third-Party Vendor Risk Management Policy including executed contracts containing NAIC data security clauses.
Passing Your Next State Insurance Department Examination Starts Here
Don’t wait for an official audit notice to find out where your security posture stands. Audit your systems today and eliminate vulnerabilities. Schedule Your Confidential NAIC Security Assessment.
Achieve Full NAIC Compliance and Fortify Your Operations
Building and maintaining an enterprise security program that satisfies NAIC regulators requires deep technical capabilities, continuous system visibility, and specialized regulatory alignment. Relying on basic IT tools leaves your organization vulnerable to regulatory penalties, license suspensions, and disruptive cyber attacks.
Partner with Enterprise Security Specialists
Our cybersecurity team provides tailored security architectures, continuous monitoring, and compliance readiness programs specifically built for insurance carriers, brokerages, and financial institutions across the United States.
Validate Your Environment: Discover critical vulnerabilities across your internal networks, cloud tenants, and web portals before auditors or threat actors exploit them.
Deploy Technical Safeguards: Implement 24/7 Threat Detection and Response (MDR), immutable backup architectures, and enforced access policies that align directly with state insurance mandates.
Simplify Audit Reporting: Receive clear compliance reporting, penetration testing documentation, and executive risk summaries ready for state regulatory submission.
Schedule Your Confidential NAIC Security Assessment
FAQs:
1. What is the NAIC Insurance Data Security Model Law (#668)?
The NAIC Model Law #668 is a regulatory framework designed to establish data security standards for insurance license holders (“Covered Entities”). It requires organizations to create a written Information Security Program (ISP), enforce administrative and technical controls, protect Nonpublic Information (NPI), and adhere to a strict 72-hour breach notification mandate following a cyber incident.
2. Which businesses are required to comply with NAIC cybersecurity regulations?
The law applies to all licensed insurance entities operating within adopting states, including primary insurance carriers (P&C, Life, Health), independent insurance brokerages and agencies, Managing General Agents (MGAs), Managing General Underwriters (MGUs), Third-Party Administrators (TPAs), and InsurTech platforms handling consumer financial or health data.
3. What is the deadline to report a cyber breach under NAIC guidelines?
Covered entities must notify their state Insurance Commissioner within 72 hours of confirming that a cybersecurity event occurred that involves Nonpublic Information (NPI), impacts 250 or more residents in the state, or poses a reasonable likelihood of causing material harm.
4. What are the essential technical controls required for NAIC compliance?
Key technical mandates include enforcing Multi-Factor Authentication (MFA) across all networks and remote access routes, encrypting NPI both at rest (AES-256) and in transit (TLS 1.2/1.3), maintaining immutable/air-gapped backups, deploying Endpoint Detection and Response (EDR/MDR), and conducting regular vulnerability testing.
5. Do insurance agencies need VAPT or DAST testing to pass NAIC audits?
Yes. State insurance regulators and cyber insurance underwriters require verifiable, empirical proof that your administrative and technical controls are effective. Annual Vulnerability Assessments and Penetration Testing (VAPT) alongside continuous Dynamic Application Security Testing (DAST) validate that internal networks, cloud tenants, and customer portals are protected against exploits.
6. How does NAIC Model Law #668 impact third-party IT and software vendors?
Under NAIC rules, Covered Entities remain legally responsible for data breaches caused by their third-party service providers. Insurance entities are required to conduct due diligence, continuously monitor vendor security postures, and mandate contractual agreements that require vendors to implement equivalent security controls and report incidents immediately.
7. What are the penalties for non-compliance with NAIC Insurance Data Security Law?
Penalties vary by state but typically include steep financial fines, mandatory consent orders, regulatory oversight audits, public disclosure of non-compliance, and, in severe cases, the suspension or revocation of an entity’s state insurance license.
