by Brian Thompson | Sep 30, 2026 | Insurance, Mortgage, SMB
Cybersecurity Awareness Month for small business has always had a mismatch. The campaign’s advice assumes someone on staff owns security. At a 30-person tax firm, insurance agency, or mortgage shop, nobody does.
Last Updated: September 2026
Key takeaways
- Train staff in week one with a live, 30-minute session on the attacks your industry actually sees, and record who attended.
- Review every vendor that holds client data in week two, including its breach notice terms and whether MFA is enforced.
- Scan for vulnerabilities in week three, give each fix an owner and a date, and test one backup restore.
- Rehearse the first hour of an incident in week four with a 45-minute tabletop and a one-page contact sheet.
- Finally, keep the records. By November 1, that evidence is what clients, carriers, and examiners ask to see.
However, that does not make the month useless. It changes what the month is for. If your firm handles client Social Security numbers, policy data, or loan files, October is a built-in deadline. It is the month to do the security work you already owe clients, carriers, and regulators, and to write down that you did it.
This year the campaign runs two official themes. The Cybersecurity and Infrastructure Security Agency is running “Securing the Next 250,” aimed mostly at critical infrastructure operators. The National Cybersecurity Alliance is running “Don’t Make It Easy for Them,” which focuses on everyday habits. In fact, neither was written for a firm with one office manager and an outsourced IT provider.
So this guide turns Cybersecurity Awareness Month for small business into four weeks of work. Each week covers one part of a security operating rhythm: train, review vendors, find and fix gaps, and prepare for an incident.
Why Cybersecurity Awareness Month for Small Business Should End With Evidence
Most professional firms do not need convincing that client data is valuable. They need a way to assign security work and prove it happened. The pressure usually comes from outside. A carrier sends a cyber insurance application. A client sends a vendor security questionnaire. A lender, auditor, or examiner asks for documentation. Each one asks some version of the same question: show me.
The threat data explains why those questions keep getting harder. Verizon’s 2026 Data Breach Investigations Report found third-party involvement in 48 percent of breaches, a 60 percent jump in one year. Exploiting unpatched vulnerabilities also overtook stolen credentials as the top way attackers get in, at 31 percent of breaches versus 13 percent. The FBI’s 2025 Internet Crime Report logged $20.877 billion in reported losses, up 26 percent. Business email compromise alone accounted for about $3.05 billion.
The Small Business Obligations Cybersecurity Awareness Month Should Surface
The threat describes the risk. Your obligations, however, describe the response. Depending on what your firm does, they may include:
- The FTC Safeguards Rule, which applies to non-bank financial institutions under FTC jurisdiction. That can include mortgage brokers and many tax preparers. See the FTC’s guidance.
- The IRS expectation of a written information security plan for tax professionals, with a template in IRS Publication 5708.
- State insurance data security laws, many based on the NAIC model law. Requirements vary by state.
- State breach notification laws, which follow the residence of the people affected, not the location of your office.
Which of these apply depends on your activities, your regulator, your state, and your contracts. Therefore, confirm yours with counsel rather than assuming. Before week one, answer five questions in writing:
- What sensitive information do we handle?
- Who can access it, including vendors?
- Which rules, contracts, or carrier requirements apply to us?
- What evidence would we need to show if someone asked?
- Who owns this work, by name?
Week 1: Train Staff on the Attacks Your Firm Actually Sees
Generic phishing training fails because the examples do not look like your inbox. Run one live, 30-minute session with examples from your own line of work.
- Tax and accounting firms: On September 16, the IRS and Security Summit warned tax professionals about fraudsters posing as new clients. These messages carry malicious links or attachments disguised as tax documents. The same release flagged phishing aimed at EFIN, PTIN, and CAF numbers. Train on both before the October 15 extension deadline fills everyone’s inbox.
- Independent insurance agencies: Show what a compromised producer mailbox looks like from the client side. Fake invoices and payment change requests go out under a trusted name.
- Mortgage brokers and lenders: Walk through a spoofed closing email with altered wire instructions. Make one rule non-negotiable: verify every wire change by phone, using a number you already had.
In addition, add one voice example. Attackers now call staff and executives while posing as internal IT, as we covered in our help desk impersonation guide.
Then record who attended and when. A dated attendance record beats a forwarded link. It is also one of the first things a security questionnaire asks for.
Week 2: Review the Vendors Who Hold Your Clients’ Data
Your client data does not live only on your computers. It lives in tax software, agency management systems, loan origination platforms, cloud storage, payroll, and your IT provider’s tools. That is why third-party involvement now shows up in nearly half of breaches.
First, build a simple vendor list this week. For each vendor, note four things:
- What client or employee data the vendor holds
- Who at your firm owns the relationship
- How quickly the vendor must notify you of an incident, per the contract
- Whether multifactor authentication is enforced on your firm’s accounts
In fact, the last item matters more than it looks. Verizon found that only 23 percent of third-party organizations fully fixed their MFA gaps. In other words, a strong password on your side does little if the vendor account behind it is exposed.
If your firm is covered by the Safeguards Rule, vendor oversight is part of the rule itself. For example, covered firms must select capable service providers, require safeguards by contract, and assess them periodically. Our third-party data breach guide covers what to do when a vendor gets hit. Our vendor payment fraud post shows how one redirected email cost a small town $189,199.
Week 3: Find and Fix the Gaps Attackers Use First
Attackers now get in through unpatched systems more often than through stolen passwords. The usual suspects are a firewall, VPN, or remote access tool nobody has updated. Similarly, an old workstation still running an unsupported operating system is another.
Credentials still matter, though. Verizon’s data shows half of ransomware victims had a credential or infostealer event within 95 days before the attack. In short, stolen logins are often the setup, not the finish.
This week’s work:
- Run a vulnerability scan on internet-facing systems and staff devices.
- Give every finding an owner and a fix-by date. A scan nobody acts on is just a list of liabilities.
- Turn on MFA for email, remote access, and your core client software.
- Test one backup restore. A backup you have never restored is a hope, not a control.
Tax firms can map this week to the IRS “Security Six”: antivirus, firewalls, backups, encrypted drives, MFA, and virtual private networks. Our ransomware guide for small business covers how an attack unfolds once someone gets in.
Week 4: Rehearse the First Hour of an Incident
The first hour of an incident decides the rest of the week. However, in most small firms, that hour goes to guessing. Who decides whether to shut down email? Who calls the IT provider and the carrier? And when does the notification clock start?
Those clocks are real, and some are short. Examples, depending on who you are:
- FTC Safeguards Rule: Covered firms must notify the FTC within 30 days of discovering an event involving unencrypted information of at least 500 consumers.
- State insurance data security laws: In states that follow the NAIC model, licensees generally must notify the insurance commissioner within 72 hours of determining a cybersecurity event occurred. Check your state’s version.
- Tax professionals: The IRS directs firms to contact their local IRS Stakeholder Liaison and report the breach to the state tax agency.
- State breach notification laws: Deadlines vary. California, for example, now requires individual notice within 30 days of discovery.
Run a 45-minute tabletop exercise with your leadership and your IT provider. Pick one realistic scenario, such as a compromised mailbox sending wire instructions to clients. Then walk through the first hour, minute by minute.
Finally, the output is a one-page contact sheet. It names the decision owner, the IT provider, the cyber insurance claims line, outside counsel, and your bank’s fraud line. Insurance agencies can build from our 72-hour incident response plan. Every firm can use the post-breach playbook for the steps after that first hour.
What Cybersecurity Awareness Month for Small Business Should Leave Behind
The point of Cybersecurity Awareness Month for small business is a file, not a feeling. By November 1, your firm should be able to pull up five things:
- A dated training record showing who attended
- A vendor list with data held, contract notice terms, and MFA status
- Scan results with an owner and a date for each fix
- A one-page incident contact sheet and a note on the tabletop exercise
- One named person who owns the security program
That is the evidence clients, carriers, and examiners ask to see. It also becomes next October’s starting point, so the month gets easier every year instead of starting from zero.
Cybersecurity Awareness Month for Small Business: FAQ
What is Cybersecurity Awareness Month?
Cybersecurity Awareness Month is a national campaign held every October. The Cybersecurity and Infrastructure Security Agency and the National Cybersecurity Alliance lead it jointly. It promotes practical security habits for individuals and organizations.
What is the 2026 Cybersecurity Awareness Month theme?
There are two. CISA’s theme is “Securing the Next 250,” focused on long-term resilience for critical infrastructure. The National Cybersecurity Alliance’s theme is “Don’t Make It Easy for Them,” focused on everyday security habits.
What should a small business do for Cybersecurity Awareness Month?
Treat the month as a four-week work plan rather than an awareness campaign. Train staff on real attacks in week one, review vendors in week two, scan and fix gaps in week three, and rehearse an incident in week four. Then keep the records, because clients, carriers, and examiners ask for evidence.
Does the FTC Safeguards Rule apply to my firm?
It applies to non-bank financial institutions under FTC jurisdiction. That can include mortgage brokers, many tax preparers, and other firms engaged in financial activities. However, coverage depends on what your firm actually does. Review the FTC’s guidance and confirm with counsel.
Do tax preparers need a written information security plan?
The IRS expects professional tax preparers to maintain a written information security plan. In addition, it publishes a template in Publication 5708. Each firm must tailor its plan to its own size, systems, and risks.
How much time does the Cybersecurity Awareness Month plan take a small business?
Plan on a few hours per week for the person who owns the work, plus about 30 minutes of staff time for training. The tabletop exercise needs 45 minutes from leadership and your IT provider.
If we only do one week, which should it be?
Week four. Naming a decision owner and building an incident contact sheet costs little. It also removes the most expensive delay in a real incident: the first hour spent figuring out who is in charge.
Make Cybersecurity Awareness Month for Small Business a Routine
If Cybersecurity Awareness Month for small business surfaces more open items than one person can track, that is the gap defend-id Business Essentials is built for. It gives a firm without a security leader one place to run staff training, review vendors, scan for vulnerabilities, and reach 24/7 incident response support, and it keeps a record of what was done. The platform does not replace your program or make any rule go away. Instead, it makes the work easier to assign, finish, and show. See how it works at defend-id.com.
Related Articles
by Brian Thompson | Sep 23, 2026 | Breach, Insurance, SMB
An insurance agency incident response plan gets written in one of two moments. Some agencies write it on a quiet afternoon, with time to think. Others write it in the first hour of a cybersecurity event, while a producer’s mailbox sends fake invoices to clients. The second version costs far more, and it starts a legal clock the agency may not know about.
Last Updated: September 2026
Here is how that hour usually looks at a 25-person agency. A client calls to ask why your office emailed new wire instructions. Nobody sent them. The account manager assumes it is spam. The owner is at a carrier meeting. By the time anyone asks who is in charge, half a day is gone. Under the insurance data security law in many states, that half day may count against a 72-hour deadline to notify the insurance commissioner.
This guide covers what that deadline is, what the model law expects your plan to include, how the first 72 hours should run, and what changes when the breach happens at a vendor. One note before we start: state versions of this law differ, and this is not legal advice. Check your own state’s statute and talk with counsel before you finalize anything.
The 72-hour clock: what the NAIC model law says
In 2017, the National Association of Insurance Commissioners adopted the Insurance Data Security Model Law, known as Model #668. It applies to licensees. That includes insurers, agencies, and producers licensed by a state insurance department. A growing number of states have adopted their own versions. The NAIC state adoption chart lists where each state stands. Your state may differ from the model in timing, thresholds, or exemptions.
Section 6 of the model sets the clock. A licensee must notify the commissioner as promptly as possible, and no later than 72 hours after it determines a cybersecurity event has occurred. For a producer, the duty applies when the state is the producer’s home state. It also applies in other states when the event involves 250 or more of that state’s residents and meets certain harm or reporting tests.
Notice the trigger. The clock starts at determination, not at discovery of a suspicious email. That is why the first hours matter so much. An agency with no process can spend a day deciding whether anything happened at all. An agency with a written insurance agency incident response plan knows who makes that call and how.
The exemption most small agencies misread
The model exempts licensees with fewer than ten employees, including independent contractors. But the exemption covers Section 4 only. Section 4 is the written information security program. Sections 5 and 6 still apply. So a nine-person agency may not need a full written program under the model. It still has to investigate a cybersecurity event and notify the commissioner on time. A small agency without an incident response process carries the same deadline with fewer people to meet it.
What the model law expects an insurance agency incident response plan to cover
Section 4H requires a written incident response plan as part of the information security program. The plan has to help the agency respond promptly and recover. The model lists seven areas it must address:
- An internal response process. What happens, in what order, when someone suspects an event.
- Goals. What the plan is trying to protect and restore.
- Roles and decision authority. Who leads, who decides, and who can act when the owner is unreachable.
- Communications. How the agency talks to staff, clients, carriers, and regulators, internally and externally.
- Remediation requirements. How the agency identifies and fixes the weakness that allowed the event.
- Documentation and reporting. How the agency records the event and its response.
- Review after an event. How the agency evaluates and revises the plan once things settle.
Read that list as an agency owner, and one item stands out. Roles and decision authority. In a small agency, the owner often holds every decision. If the owner is on a plane, the plan stalls. A useful insurance agency incident response plan names a backup decision maker in writing.
Section 5 adds the investigation duties. The agency, or a vendor acting for it, must determine whether an event occurred, assess its scope, identify the nonpublic information involved, and restore security. Section 5D requires the agency to keep records of every cybersecurity event for at least five years. Those records must be available if the commissioner asks.
How an insurance agency incident response plan runs in the first 72 hours
An insurance agency incident response plan on paper helps only if your team can run it under stress. Here is a practical sequence for a small agency. Adjust it to your state’s law and your own systems.
Hour zero to hour four: contain and call
Whoever spots the problem reports it to the named incident lead right away. The lead starts a written log with the time, the first report, and every action taken. Next, the team contains the damage. That can mean resetting a compromised password, disconnecting an infected machine, or suspending a mailbox rule that forwards client email. The lead then calls the agency’s outside response resources. That may include a breach response provider, counsel, and the agency’s cyber insurance carrier if the policy has notice terms.
Preserve evidence as you go. Do not wipe a laptop or delete suspicious emails before someone reviews them. The investigation needs them, and so may the commissioner.
Hours four to 24: investigate and decide
The investigation answers the Section 5 questions. What happened? Which systems were involved? Whose information was exposed? Is the attacker still inside? The goal of this window is a clear determination. Once the agency determines that a cybersecurity event occurred, the 72-hour clock is running. Write down the time of that determination. It anchors every deadline that follows.
Hours 24 to 72: notify with what you know
Section 6B lists up to 13 items the commissioner may expect. They include the date of the event, how it was discovered, the types of information involved, the number of affected residents, and a named contact person. The model says to provide as much as possible, and it creates a continuing duty to update. So the first notice does not need every answer. It needs to arrive on time.
Consumer notice follows your state’s breach notification law. Those deadlines are separate, and many states have tightened them. Our guide to business data protection practices covers how several states shortened consumer notice windows in 2026.
After 72 hours: fix, record, and review
Once notices go out, the work shifts to remediation and records. Close the gap that let the attacker in. Update the notice to the commissioner as facts change. File the event log where you can find it for five years. Then hold a short review. What slowed the team down? What would you change? Section 4H expects that review, and it is the step most teams skip.
Vendor breaches and your insurance agency incident response plan
Many agency breaches never touch the agency’s own systems. They start at a comparative rater, an agency management system, a payment processor, or an outsourced IT provider. Verizon’s 2026 Data Breach Investigations Report found that breaches involving a third party rose 60% in a year. They now account for 48% of all breaches in its dataset.
The model law does not let an agency hand that problem off. Under Section 6D, a vendor event gets the same treatment as an event on the agency’s own systems. The agency’s deadline begins the day after the vendor notifies it, or the day it otherwise learns of the event, whichever comes first. Under Section 5C, the agency must complete the investigation steps itself or confirm and document that the vendor did.
That makes vendor oversight part of incident response, not a separate checklist. Section 4F requires due diligence in selecting vendors and requires vendors to protect the information they hold. In practice, an insurance agency incident response plan should list:
- Every vendor that stores or can access client nonpublic information
- Each vendor’s breach contact and how fast its contract requires it to notify you
- Who at the agency receives vendor breach notices and logs the date
- What records you will need from the vendor to answer the commissioner
Our third-party data breach guide walks through what small businesses should ask vendors before something goes wrong.
What these events cost a small agency
The legal deadline is only part of the exposure. The larger cost usually comes from lost time. Verizon’s 2026 Breach Impact Study analyzed roughly 70,000 U.S. cyber insurance claims. It put the median impact for small and midsize businesses at about $38,000, and it named business interruption as the fastest-growing source of loss.
The attack types that drive those losses are familiar to agencies. Ransomware appeared in 48% of breaches in the 2026 DBIR, up from 44% the year before. The FBI’s 2025 Internet Crime Report put business email compromise losses at about $3 billion, the second-largest category of reported loss. Agencies move premium payments, claim checks, and client banking details every day. That makes them a natural target for payment redirection schemes like the one in our help desk impersonation guide.
An insurance agency incident response plan does not stop these attacks. It shortens the time between the first report and a controlled response. For a small agency, that time is where most of the cost lives.
Building an insurance agency incident response plan your team can run
An insurance agency incident response plan does not need to be a thick binder. It needs to be a short document your team has read, backed by people who know their roles. Start with these pieces:
- A named incident lead and a backup. Put both names in writing, with phone numbers that work after hours.
- A one-page call list. Include your breach response provider, counsel, your cyber insurance carrier’s notice line, key vendors, and your state insurance department’s reporting contact.
- A determination rule. Decide in advance who declares that a cybersecurity event occurred, and how that time gets recorded.
- A notification worksheet. Pre-build a form with the Section 6B items so the team fills in blanks instead of starting from scratch.
- A vendor section. List vendors that hold client data and how each will notify you.
- Staff training. Teach every employee how to report a suspicious email, call, or login right away. The report starts the clock on your response, not the attacker’s.
- An annual tabletop exercise. Walk through one realistic scenario for 45 minutes. Fix whatever breaks.
Then keep records of the work: training completion, vendor reviews, and exercise notes. If a commissioner, carrier, or client ever asks what your agency does to protect its data, those records answer faster than any policy statement. Our four-week Cybersecurity Awareness Month plan schedules that training, vendor review, and a tabletop exercise across October.
Insurance agency incident response plan FAQ
Does the NAIC Insurance Data Security Model Law apply to independent agencies?
The model applies to licensees, which include agencies and producers licensed by a state insurance department. Whether it applies to your agency depends on whether your state adopted a version of it and how that version reads. Check your state statute and the NAIC adoption chart.
How long does an agency have to notify the insurance commissioner?
Under the model law, no later than 72 hours after the agency determines that a cybersecurity event has occurred. Some states changed that timing or the triggers in their own versions, so confirm your state’s rule.
Is an agency with fewer than ten employees exempt?
Under the model, an agency with fewer than ten employees, including independent contractors, is exempt from Section 4, the written information security program. It is not exempt from the investigation and notification duties in Sections 5 and 6.
Does a breach at our agency management system vendor count?
Yes. Under the model, a cybersecurity event at a third-party service provider gets the same treatment as one on your own systems. Your deadline starts the day after the vendor notifies you or you otherwise learn of it, whichever comes first.
What does an insurance agency incident response plan need to include?
The model lists seven areas: an internal response process, goals, roles and decision authority, communications, remediation, documentation and reporting, and review after an event. A practical plan adds a call list, a vendor section, and a notification worksheet.
How long must we keep records of a cybersecurity event?
The model requires licensees to keep records of all cybersecurity events for at least five years and produce them on the commissioner’s request. Your state’s version may set different terms.
Is consumer notification the same as notifying the commissioner?
No. Consumer notice follows your state’s general breach notification law, which has its own deadlines and triggers. Under the model, the agency also sends the commissioner a copy of the consumer notice when commissioner notice is required.
Put people and records behind the plan
A plan only works when someone answers the phone at hour one and the records exist at hour 72. defend-id Business Essentials gives agencies 24/7 incident response and breach support, short employee security training, vendor management, and vulnerability scanning in one place. It helps your team organize, assign, and document the work behind your plan. Your agency still owns its plan and its obligations under your state’s law. See how defend-id supports insurance agencies.
Related articles
