Insurance
We test whether the systems that hold policyholder and claims data, including your portals and APIs, are safe from attackers, and fix what we find. Insurers hold health records, financial data and claims files for millions of policyholders. We run the controls, the monitoring and the evidence that regulators and boards expect to see.
Insurers, agencies and managing general agents hold some of the most sensitive data there is: health information, bank details, claims narratives and identity documents. Regulators have turned that into explicit duties. Most states have adopted laws based on the NAIC Insurance Data Security Model Law, and New York's Department of Financial Services applies 23 NYCRR Part 500 to the entities it licenses.
Our team runs the work those laws describe: a written information security program, a risk assessment, monitoring and response around the clock, oversight of vendors and a report the board can read. We do not file certifications for clients. We build the controls and the evidence behind them.
What we see in your industry
- State insurance data security laws based on the NAIC Insurance Data Security Model Law (#668) require a written information security program, a risk assessment, an incident response plan and oversight of third-party service providers.
- Notice clocks are short: the model law asks a licensee to notify the commissioner within 72 hours of determining that a cybersecurity event occurred, and New York's Part 500 uses the same 72 hours.
- Agencies, MGAs, adjusters and claims vendors share policyholder data, so one weak partner can become the insurer's incident.
- Boards ask for a plain, current view of risk, and annual filings need data and documentation behind them.
Program first. The model law asks a licensee to designate someone responsible for its information security program, identify foreseeable threats, assess the controls against them and test them. Exceptions apply to very small licensees, and each state's version differs, so we check the statute that applies to you.
Monitoring second. A managed security operations center with endpoint detection and response turns alerts into decisions at any hour, and gives you the timeline you need when the clock starts. The model law sets a 72‑hour notice to the commissioner of the state of domicile, and New York requires notice to the superintendent within 72 hours of determining that a cybersecurity incident occurred.
Vendors third. Section 4 of the model law asks for due diligence in selecting a third-party service provider and a contract that requires appropriate safeguards. We keep a vendor register, send tiered questionnaires and review the answers.
Board reporting last. The model law asks for written reports to the board at least annually on the status of the program, and New York requires an annual certification or acknowledgment by April 15, signed by the highest-ranking executive and the CISO. See our guidance on cyber insurance readiness and our ransomware checklist.
Every insurer's claims library, forms and routine can run offline. Our Apocalypse IT Package is an on-premises continuity kit with a local reference library, document scanning, a private AI desk, chat and battery backup, offered to every customer.
Related work on our track record: a managed security operations center and EDR rollout for a 1,200‑endpoint insurer (illustrative), an on-premises language model for a regional bank (illustrative) and in-house ALM and CECL models for a bank (illustrative).
Cyber Insurance Readiness: What Underwriters Ask About MFA, EDR and Backups, and How to Prepare
Insurers do not guess at your security. They ask. Published application forms from two large carriers show which controls matter most: MFA, endpoint detection, tested and protected backups, privileged access, patching and a tested incident response plan. This article walks through the questions and how to answer them truthfully.
Work like yours
A managed SOC and EDR rollout for a 1,200‑endpoint insurer: from alert noise to a clock it can meet
A regional property and casualty insurer in the United States, a leader in its segment.
About 1,200 endpoints, 150 servers, 24x7 monitoring, phased EDR rollout, weekly patch cycle for exploited vulnerabilitiesRead the case
An Agent Security Review before a wealth manager rolls out Copilot Studio agents
A registered investment adviser in Connecticut with about 90 staff, a leader in its segment.
About 90 staff, 14 Copilot Studio agents planned, 6 MCP servers, 3 approval tiers, 1 Microsoft 365 tenantRead the case
An AI evidence pack for a healthcare group's insurer renewal and a hospital customer's vendor questionnaire
An outpatient medical group in Arizona with six clinics and about 140 clinicians, a leader in its segment.
6 clinics, about 140 clinicians, 9 AI tools in use, 12 evidence artifacts, 1 insurer renewal, 1 hospital questionnaireRead the caseHow we help
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreClayton Secure
One view of your entire cybersecurity program, in near real time.
Learn moreManaged IT Services
Your entire IT operation, run by engineers who have operated infrastructure for global enterprises.
Learn moreSuper Intelligence
American‑made Super Intelligence: AI your team can learn, trust and deploy.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhich laws set security requirements for insurers?
State insurance data security laws based on the NAIC Insurance Data Security Model Law (#668) require a written information security program, a risk assessment, an incident response plan and oversight of third-party service providers. New York's Part 500 adds its own rules. Confirm your obligations with counsel.
How quickly must an insurer report a cybersecurity event?
The NAIC model law asks a licensee to notify the commissioner within 72 hours of determining that a cybersecurity event occurred, and New York's Part 500 uses the same 72 hours. We build the detection, decision tree and contact list that make that clock realistic. Counsel decides what is reportable.
Can you run security monitoring for a carrier, agency or MGA?
Yes. We design and operate endpoint detection, log collection and monitoring, with named escalation paths and evidence for your program. Scope is agreed with you during scoping.
How do you handle risk from agencies, MGAs and claims vendors?
We inventory the partners that touch policyholder data, review their security, put incident-notice terms and contacts into contracts, and keep the evidence file. One weak partner can become your incident, so oversight is a process, not a one-time questionnaire.
Can you help with board reporting and annual filings?
Yes. Through Clayton Secure we give boards a plain, current view of risk and keep the data and documentation behind annual filings. Your compliance officer and counsel own the filing decisions.
What do cyber insurance underwriters ask about?
Typically multi-factor authentication, endpoint detection, backups, email security and incident response. We help you meet and document those controls. See our article on what underwriters ask.