An insurance agency incident response plan gets written in one of two moments. Some agencies write it on a quiet afternoon, with time to think. Others write it in the first hour of a cybersecurity event, while a producer’s mailbox sends fake invoices to clients. The second version costs far more, and it starts a legal clock the agency may not know about.
Last Updated: September 2026
Here is how that hour usually looks at a 25-person agency. A client calls to ask why your office emailed new wire instructions. Nobody sent them. The account manager assumes it is spam. The owner is at a carrier meeting. By the time anyone asks who is in charge, half a day is gone. Under the insurance data security law in many states, that half day may count against a 72-hour deadline to notify the insurance commissioner.
This guide covers what that deadline is, what the model law expects your plan to include, how the first 72 hours should run, and what changes when the breach happens at a vendor. One note before we start: state versions of this law differ, and this is not legal advice. Check your own state’s statute and talk with counsel before you finalize anything.
The 72-hour clock: what the NAIC model law says
In 2017, the National Association of Insurance Commissioners adopted the Insurance Data Security Model Law, known as Model #668. It applies to licensees. That includes insurers, agencies, and producers licensed by a state insurance department. A growing number of states have adopted their own versions. The NAIC state adoption chart lists where each state stands. Your state may differ from the model in timing, thresholds, or exemptions.
Section 6 of the model sets the clock. A licensee must notify the commissioner as promptly as possible, and no later than 72 hours after it determines a cybersecurity event has occurred. For a producer, the duty applies when the state is the producer’s home state. It also applies in other states when the event involves 250 or more of that state’s residents and meets certain harm or reporting tests.
Notice the trigger. The clock starts at determination, not at discovery of a suspicious email. That is why the first hours matter so much. An agency with no process can spend a day deciding whether anything happened at all. An agency with a written insurance agency incident response plan knows who makes that call and how.
The exemption most small agencies misread
The model exempts licensees with fewer than ten employees, including independent contractors. But the exemption covers Section 4 only. Section 4 is the written information security program. Sections 5 and 6 still apply. So a nine-person agency may not need a full written program under the model. It still has to investigate a cybersecurity event and notify the commissioner on time. A small agency without an incident response process carries the same deadline with fewer people to meet it.
What the model law expects an insurance agency incident response plan to cover
Section 4H requires a written incident response plan as part of the information security program. The plan has to help the agency respond promptly and recover. The model lists seven areas it must address:
- An internal response process. What happens, in what order, when someone suspects an event.
- Goals. What the plan is trying to protect and restore.
- Roles and decision authority. Who leads, who decides, and who can act when the owner is unreachable.
- Communications. How the agency talks to staff, clients, carriers, and regulators, internally and externally.
- Remediation requirements. How the agency identifies and fixes the weakness that allowed the event.
- Documentation and reporting. How the agency records the event and its response.
- Review after an event. How the agency evaluates and revises the plan once things settle.
Read that list as an agency owner, and one item stands out. Roles and decision authority. In a small agency, the owner often holds every decision. If the owner is on a plane, the plan stalls. A useful insurance agency incident response plan names a backup decision maker in writing.
Section 5 adds the investigation duties. The agency, or a vendor acting for it, must determine whether an event occurred, assess its scope, identify the nonpublic information involved, and restore security. Section 5D requires the agency to keep records of every cybersecurity event for at least five years. Those records must be available if the commissioner asks.
How an insurance agency incident response plan runs in the first 72 hours
An insurance agency incident response plan on paper helps only if your team can run it under stress. Here is a practical sequence for a small agency. Adjust it to your state’s law and your own systems.
Hour zero to hour four: contain and call
Whoever spots the problem reports it to the named incident lead right away. The lead starts a written log with the time, the first report, and every action taken. Next, the team contains the damage. That can mean resetting a compromised password, disconnecting an infected machine, or suspending a mailbox rule that forwards client email. The lead then calls the agency’s outside response resources. That may include a breach response provider, counsel, and the agency’s cyber insurance carrier if the policy has notice terms.
Preserve evidence as you go. Do not wipe a laptop or delete suspicious emails before someone reviews them. The investigation needs them, and so may the commissioner.
Hours four to 24: investigate and decide
The investigation answers the Section 5 questions. What happened? Which systems were involved? Whose information was exposed? Is the attacker still inside? The goal of this window is a clear determination. Once the agency determines that a cybersecurity event occurred, the 72-hour clock is running. Write down the time of that determination. It anchors every deadline that follows.
Hours 24 to 72: notify with what you know
Section 6B lists up to 13 items the commissioner may expect. They include the date of the event, how it was discovered, the types of information involved, the number of affected residents, and a named contact person. The model says to provide as much as possible, and it creates a continuing duty to update. So the first notice does not need every answer. It needs to arrive on time.
Consumer notice follows your state’s breach notification law. Those deadlines are separate, and many states have tightened them. Our guide to business data protection practices covers how several states shortened consumer notice windows in 2026.
After 72 hours: fix, record, and review
Once notices go out, the work shifts to remediation and records. Close the gap that let the attacker in. Update the notice to the commissioner as facts change. File the event log where you can find it for five years. Then hold a short review. What slowed the team down? What would you change? Section 4H expects that review, and it is the step most teams skip.
Vendor breaches and your insurance agency incident response plan
Many agency breaches never touch the agency’s own systems. They start at a comparative rater, an agency management system, a payment processor, or an outsourced IT provider. Verizon’s 2026 Data Breach Investigations Report found that breaches involving a third party rose 60% in a year. They now account for 48% of all breaches in its dataset.
The model law does not let an agency hand that problem off. Under Section 6D, a vendor event gets the same treatment as an event on the agency’s own systems. The agency’s deadline begins the day after the vendor notifies it, or the day it otherwise learns of the event, whichever comes first. Under Section 5C, the agency must complete the investigation steps itself or confirm and document that the vendor did.
That makes vendor oversight part of incident response, not a separate checklist. Section 4F requires due diligence in selecting vendors and requires vendors to protect the information they hold. In practice, an insurance agency incident response plan should list:
- Every vendor that stores or can access client nonpublic information
- Each vendor’s breach contact and how fast its contract requires it to notify you
- Who at the agency receives vendor breach notices and logs the date
- What records you will need from the vendor to answer the commissioner
Our third-party data breach guide walks through what small businesses should ask vendors before something goes wrong.
What these events cost a small agency
The legal deadline is only part of the exposure. The larger cost usually comes from lost time. Verizon’s 2026 Breach Impact Study analyzed roughly 70,000 U.S. cyber insurance claims. It put the median impact for small and midsize businesses at about $38,000, and it named business interruption as the fastest-growing source of loss.
The attack types that drive those losses are familiar to agencies. Ransomware appeared in 48% of breaches in the 2026 DBIR, up from 44% the year before. The FBI’s 2025 Internet Crime Report put business email compromise losses at about $3 billion, the second-largest category of reported loss. Agencies move premium payments, claim checks, and client banking details every day. That makes them a natural target for payment redirection schemes like the one in our help desk impersonation guide.
An insurance agency incident response plan does not stop these attacks. It shortens the time between the first report and a controlled response. For a small agency, that time is where most of the cost lives.
Building an insurance agency incident response plan your team can run
An insurance agency incident response plan does not need to be a thick binder. It needs to be a short document your team has read, backed by people who know their roles. Start with these pieces:
- A named incident lead and a backup. Put both names in writing, with phone numbers that work after hours.
- A one-page call list. Include your breach response provider, counsel, your cyber insurance carrier’s notice line, key vendors, and your state insurance department’s reporting contact.
- A determination rule. Decide in advance who declares that a cybersecurity event occurred, and how that time gets recorded.
- A notification worksheet. Pre-build a form with the Section 6B items so the team fills in blanks instead of starting from scratch.
- A vendor section. List vendors that hold client data and how each will notify you.
- Staff training. Teach every employee how to report a suspicious email, call, or login right away. The report starts the clock on your response, not the attacker’s.
- An annual tabletop exercise. Walk through one realistic scenario for 45 minutes. Fix whatever breaks.
Then keep records of the work: training completion, vendor reviews, and exercise notes. If a commissioner, carrier, or client ever asks what your agency does to protect its data, those records answer faster than any policy statement. Our four-week Cybersecurity Awareness Month plan schedules that training, vendor review, and a tabletop exercise across October.
Insurance agency incident response plan FAQ
Does the NAIC Insurance Data Security Model Law apply to independent agencies?
The model applies to licensees, which include agencies and producers licensed by a state insurance department. Whether it applies to your agency depends on whether your state adopted a version of it and how that version reads. Check your state statute and the NAIC adoption chart.
How long does an agency have to notify the insurance commissioner?
Under the model law, no later than 72 hours after the agency determines that a cybersecurity event has occurred. Some states changed that timing or the triggers in their own versions, so confirm your state’s rule.
Is an agency with fewer than ten employees exempt?
Under the model, an agency with fewer than ten employees, including independent contractors, is exempt from Section 4, the written information security program. It is not exempt from the investigation and notification duties in Sections 5 and 6.
Does a breach at our agency management system vendor count?
Yes. Under the model, a cybersecurity event at a third-party service provider gets the same treatment as one on your own systems. Your deadline starts the day after the vendor notifies you or you otherwise learn of it, whichever comes first.
What does an insurance agency incident response plan need to include?
The model lists seven areas: an internal response process, goals, roles and decision authority, communications, remediation, documentation and reporting, and review after an event. A practical plan adds a call list, a vendor section, and a notification worksheet.
How long must we keep records of a cybersecurity event?
The model requires licensees to keep records of all cybersecurity events for at least five years and produce them on the commissioner’s request. Your state’s version may set different terms.
Is consumer notification the same as notifying the commissioner?
No. Consumer notice follows your state’s general breach notification law, which has its own deadlines and triggers. Under the model, the agency also sends the commissioner a copy of the consumer notice when commissioner notice is required.
Put people and records behind the plan
A plan only works when someone answers the phone at hour one and the records exist at hour 72. defend-id Business Essentials gives agencies 24/7 incident response and breach support, short employee security training, vendor management, and vulnerability scanning in one place. It helps your team organize, assign, and document the work behind your plan. Your agency still owns its plan and its obligations under your state’s law. See how defend-id supports insurance agencies.
Related articles
- Cybersecurity Awareness Month 2026: A Four-Week Plan for Firms Without a Security Team
- Business Data Protection Practices: Six Pillars Every Company Needs in 2026
- Third-Party Data Breach: SMB Survival Guide for 2026
- Help Desk Impersonation Scam: What SMBs Should Know (2026)
- Security Policies for Small Businesses: 10 Must-Have Rules
