Illustrative scenario. This is a composite example built from common engagement patterns we expect to encounter — not a real client. The business name and people are fictional and presented for educational purposes. Actual results vary based on environment, scope, and risk profile.
An Agency WISP Built to the NAIC Model Law — and an Intercepted Carrier-Payment Redirection
An 18-person independent insurance agency had no WISP, no MFA on any carrier portal, and client NPI scattered across unencrypted spreadsheets. This is the programme: a WISP documented against the Model Law's required elements, MFA enforced across every carrier portal, and a business email compromise attempt blocked automatically.
The Background
Highland Grove Insurance is an illustrative composite based on a pattern we see repeatedly among independent agencies in NAIC-adopted states. The agency in this scenario has been operating for 14 years, writes personal and commercial lines across three carriers, and employs 18 people across two offices. Like most agencies their size, their security posture was built around trust and convenience rather than controls — an approach that was adequate in 2015 and dangerously inadequate by 2025.
Their state had adopted the NAIC Insurance Data Security Model Law 18 months earlier, with a compliance deadline approaching. Their E&O carrier had also added a new questionnaire at renewal — one that asked specifically about MFA, written security programs, and incident response plans. The principal answered honestly, realised how exposed they were, and called us.
What We Found
The risk assessment took three days. Every finding was common in agencies this size. None were acceptable given the regulatory environment they were operating in.
- No written Information Security Program (WISP) — a direct NAIC Model Law violation in their state
- No MFA on any carrier portal (Travelers, Chubb, Liberty Mutual) — shared login credentials on a shared PC
- AMS360 accessible from home computers with no VPN or conditional access
- Client NPI (SSNs, driver's licences, financial details) stored in unencrypted local spreadsheets
- No formal vendor due-diligence process for three SaaS tools that touched client data
- E&O renewal questionnaire partially incorrect — the agency checked boxes they hadn't actually implemented
The most concerning finding was the E&O questionnaire. The principal had marked several controls as "in place" — MFA, encryption, incident response — because they assumed their IT person or their software vendor handled these. In every case, the control was either not implemented or not documented. Filing an inaccurate E&O questionnaire creates its own legal exposure on top of the regulatory gap.
The Plan We Built
We scoped a phased engagement with a single objective: get the agency to a defensible NAIC-aligned posture — WISP documented, controls implemented, staff trained, and E&O renewal submitted accurately. Secondary objective: reduce their cyber insurance premium.
Risk Assessment & WISP Gap Analysis
Documented all data flows, identified WISP gaps, and mapped 11 carrier portals and AMS access points.
MFA Rollout Across All Portals
Enforced MFA for every staff member on every carrier portal. Resistance from one producer — resolved with a 20-minute walkthrough.
AMS Hardening & Access Controls
Applied conditional access to AMS360, removed shared credentials, and set per-user permissions for each role.
WISP Drafting & Vendor Review
Completed the written WISP, performed vendor due diligence on three SaaS tools, and terminated one that couldn't meet requirements.
Training, Testing & E&O Submission
Staff phishing simulation, targeted training, and final E&O questionnaire submitted with accurate attestations.
BEC Attack Intercepted
Email security gateway flagged a spoofed carrier email requesting a premium payment redirect. Stopped automatically. No human error required.
The BEC Attack
Three days before the engagement formally closed, our email security gateway caught an inbound message impersonating Travelers Insurance. The email — sent from a lookalike domain registered 11 days earlier — instructed the agency's finance contact to redirect a premium payment to a new bank account, citing a routine banking update.
The email looked legitimate. The letterhead matched. The sender name matched the agency's actual Travelers rep. The only thing that gave it away: the domain was travelers-billing.com rather than travelers.com — and our gateway caught it on the domain-age check before it reached the inbox.
The principal saw the quarantine alert, confirmed with Travelers directly, and the attempt was reported. No money moved. Without the email security controls we'd deployed, this would likely have succeeded — this exact attack type has a documented 70%+ success rate when landing in an unprotected inbox.
"I was embarrassed by how exposed we were. Fourteen years in business, and we'd been operating on the assumption that nothing would happen to us. The BEC attempt was the proof that the assumption was wrong — and the proof that fixing it was worth every dollar."
Principal — Highland Grove Insurance (illustrative composite)
Where They Stand
- WISP completed, documented, and board-acknowledged — 10 NAIC required elements addressed
- MFA enforced on all 11 carrier portals and on AMS360
- Conditional access policy blocking access from unmanaged devices
- NPI encrypted at rest; unencrypted spreadsheets purged and replaced with AMS records
- Vendor due-diligence checklist implemented for all third-party SaaS touching client data
- E&O renewal submitted with accurate attestations
- BEC wire-fraud attempt intercepted during the engagement
What the E&O Questionnaire Now Shows
At renewal, every question was answered accurately and affirmatively. The carrier asked for a copy of the WISP and the MFA policy. Both were ready and on file. Carrier confirmed the agency met their preferred-risk criteria for the first time.
The Lesson for Insurance Agencies
The NAIC Insurance Data Security Model Law isn't coming — it's here, and in 25+ states it has been for two or more years. The question is not whether to comply, but whether to do it before or after a breach or regulatory action.
The agencies that wait are betting on two things simultaneously: that they won't be attacked, and that their state regulator won't audit them. The first is wrong — independent agencies are consistently in the top 10 industry targets for BEC, because they hold client financial data and process large premium payments. The second is increasingly wrong — state insurance departments are actively issuing market conduct examinations that include cyber controls.
The good news: for an agency in the 10–30 person range, a defensible NAIC compliance posture can be built without overhauling your workflow. The controls that matter most — MFA, a documented WISP, email security, and access controls on your AMS — are operational within weeks.
Related reading: The NAIC Insurance Data Security Model Law — A Plain-English Guide, Business Email Compromise: The $50 Billion SMB Threat and How to Stop It, Third-Party Risk: Why Your Vendors Could Be Your Biggest Security Blind Spot.
Outcome Summary
No WISP, no documented security program
WISP documented against the Model Law’s 10 required elements
Shared credentials on 11 carrier portals
MFA enforced for all staff, all portals
AMS accessible from unmanaged home devices
Conditional access — managed devices only
NPI in unencrypted spreadsheets
Encrypted at rest, stored in AMS records
No vendor due diligence process
Due-diligence checklist; one vendor terminated
E&O questionnaire inaccurately completed
Completed accurately, with evidence on file
Is Your Agency NAIC-Ready?
We'll audit your current posture against the 10 NAIC Model Law elements and tell you exactly where you stand — no obligation, no pressure.