Cybersecurity Compliance for US Insurance Carriers

Why US Insurance Carriers Face Unique Cybersecurity Pressure

The insurance sector operates at the intersection of vast data holdings and high regulatory expectations. Carriers manage sensitive personal identifiable information (PII), protected health information (PHI) for health insurers, financial account details, and proprietary underwriting models. This data concentration makes them a prime target for ransomware gangs and nation-state actors. In 2023, the insurance sector saw a 176% increase in ransomware attacks year-over-year, according to a report by Sophos. Beyond external threats, carriers must navigate a fragmented regulatory environment where state-level requirements (like NYDFS) coexist with federal mandates (GLBA) and, for health insurers, HIPAA. Failing to comply can result in fines reaching into the millions, mandatory corrective action plans, and reputational damage that erodes policyholder trust.

Which Regulations Apply to US Insurance Carriers?

The compliance landscape for US insurers is multi-layered. Understanding which laws apply to your organization depends on your line of business, state of domicile, and the data you handle. Below are the primary frameworks:

NYDFS 23 NYCRR Part 500

As the most prescriptive state-level regulation for financial services, NYDFS Part 500 applies to any entity regulated by the New York Department of Financial Services, including insurers, agents, and brokers. Key requirements include:

• Section 500.02: Maintain a written cybersecurity policy approved by the board or senior official.
• Section 500.05: Conduct annual penetration testing and bi-annual vulnerability assessments.
• Section 500.07: Implement access controls, including multi-factor authentication for privileged users.
• Section 500.09: Conduct risk assessments that inform the cybersecurity program.
• Section 500.11: Submit an annual compliance certification to the superintendent.

NYDFS has aggressively amended Part 500 (effective April 2024), adding stricter requirements for ransomware notifications (72 hours), stronger access controls, and enhanced governance for larger institutions.

NAIC Insurance Data Security Model Law

Adopted by over 20 states (including Alabama, Michigan, and Virginia), the NAIC Model Law imposes minimum cybersecurity requirements on all licensed insurers, regardless of size. It mandates:

• A formal incident response plan with notification to regulators within 72 hours of a determination.
• Risk assessments at least annually and upon significant system changes.
• Board-level oversight of cybersecurity programs.
• Third-party service provider risk management.

State insurance commissioners actively enforce this law, with recent fines against carriers for failing to detect and report breaches in a timely manner.

GLBA / FTC Safeguards Rule

The Gramm-Leach-Bliley Act requires financial institutions—including insurers—to protect customer financial information. The FTC Safeguards Rule, updated in 2021, now requires all covered entities to:

• Designate a qualified individual to oversee the security program.
• Conduct a written risk assessment addressing encryption, access controls, and secure disposal.
• Implement multi-factor authentication for any access to customer information.
• Oversee and monitor third-party service providers.
• Develop an incident response plan and report incidents to the FTC.

For health insurers, HIPAA compliance adds further layers, requiring administrative, physical, and technical safeguards for electronic PHI.

What Are the Hardest Compliance Controls for Insurers?

Based on our work with regional and national carriers, three areas consistently challenge even well-resourced compliance teams:

1. Continuous Multi-Factor Authentication Enforcement

NYDFS Part 500.07 and the FTC Safeguards Rule both mandate multi-factor authentication (MFA) for any individual accessing the carrier's internal networks, including agents, adjusters, and third-party administrators. However, legacy policy administration systems and agent portals often lack native MFA support, forcing carriers to layer on token-based solutions. Compliance requires not just deploying MFA but actively monitoring for authentication bypass attempts—a task that demands robust security event monitoring.

2. Supply Chain and Third-Party Risk Management

Insurers rely on extensive ecosystems: claims processors, data analytics firms, software vendors, and cloud-based underwriting platforms. NYDFS Section 500.14 and the NAIC Model Law require written vendor risk assessments, contractual security obligations, and periodic reassessments. Tracking hundreds of vendors, each with different access levels and data types, is a significant operational burden. Many carriers lack automated tools to continuously verify vendor compliance.

3. Incident Detection and 72-Hour Notification

Both NYDFS (amended) and the NAIC Model Law now require notification to regulators within 72 hours of determining a cybersecurity event. This compressed timeline demands real-time detection capabilities and an incident response plan that can be activated immediately. Carriers without a dedicated Security Operations Center (SOC) or a robust SIEM platform often struggle to meet this window, particularly when ransomware attacks encrypt logs and endpoints.

How CyberSilo's ThreatHawk SIEM + SOAR Addresses Insurance Compliance

Effective compliance is not about checking boxes once a year—it is about continuous monitoring and repeatable proof. CyberSilo's ThreatHawk SIEM + SOAR platform is purpose-built to help US insurers meet the most demanding controls across NYDFS, NAIC, and GLBA.

Automated Evidence Collection for Regulatory Audits

When an examiner asks for proof that multi-factor authentication is enforced across all privileged user accounts, ThreatHawk automates this. The platform collects log data from on-premises and cloud environments, normalizes it, and maps it directly to specific regulatory requirements. Reports for NYDFS Section 500.07 (access controls) or GLBA Section 314.4(b) (encryption) can be generated in minutes, not weeks.

Real-Time Threat Detection and 72-Hour Notification

ThreatHawk's integrated SIEM correlates events across your network, endpoints, and cloud workloads, identifying patterns indicative of ransomware, credential theft, or data exfiltration. Combined with the SOAR module, incident response playbooks are automatically triggered when a suspected event is detected. This allows your team to meet the 72-hour notification deadline with documented, timestamped evidence of the incident timeline.

Third-Party Vendor Risk Management Automation

Managing hundreds of vendors is simplified with ThreatHawk's vendor risk scoring and continuous monitoring. The platform ingests external threat intelligence and vendor security ratings, automatically alerting you when a high-risk vendor's posture changes. This supports NYDFS Section 500.14 and NAIC Model Law requirements without manual spreadsheet tracking.

Practical Checklist for US Insurance Compliance

Use this checklist to evaluate your current posture against the most critical controls. Each item maps to a specific NYDFS, NAIC, or GLBA requirement.

• Risk Assessment: Have you conducted a comprehensive risk assessment that addresses internal and external threats within the last 12 months? (NYDFS 500.09, NAIC §5)
• Access Controls: Is multi-factor authentication enforced for all privileged users, remote network access, and third-party connections? (NYDFS 500.07, FTC 314.4(d))
• Incident Response Plan: Is your plan tested at least annually and does it include a 72-hour notification process for regulators? (NYDFS 500.16, NAIC §6)
• Vendor Management: Do you have a current inventory of all third-party service providers, with documented risk assessments and contractual security clauses? (NYDFS 500.14, NAIC §7)
• Continuous Monitoring: Do you have a SIEM solution that provides real-time correlation and alerting for anomalous activity? (NYDFS 500.05, GLBA 314.4(c))
• Board Governance: Does your board or senior leadership receive a written report on cybersecurity posture at least quarterly? (NYDFS 500.02(b), NAIC §4)
• Data Encryption: Are all policyholder data sets encrypted at rest and in transit, with documented key management procedures? (NYDFS 500.15, FTC 314.4(b))

Why CyberSilo for US Insurance Carriers?

CyberSilo brings deep domain expertise across the insurance sector, with compliance specialists who understand the nuances of NYDFS examinations, NAIC filing requirements, and GLBA enforcement actions. Our platform is built to handle high-volume log ingestion from policy administration systems, claims platforms, and agent portals, and our team provides 24/7 SOC support that aligns with your regulatory notification obligations. We serve carriers ranging from regional Blue Cross Blue Shield plans to multiline property and casualty insurers, each with unique data footprints and regulatory exposures.

In addition to our core SIEM and SOAR capabilities, our US cybersecurity compliance services offer pre-built reporting packages tailored to each state's NAIC implementation, reducing the administrative burden on your compliance team.

Comparison: In-House vs. Managed Compliance Approach

Many mid-sized carriers struggle to decide whether to build compliance capabilities internally or partner with a managed services provider. The table below outlines key considerations.