by Brian Thompson | Oct 13, 2026 | SMB
When an employee calls to say their identity was stolen, or a phished mailbox exposes staff records, the first question is simple: who picks up the phone? For a 30-person firm with no security team, that answer is part of the incident plan whether anyone wrote it down or not. defend-id publishes the service numbers of our identity theft recovery advocates every quarter so owners and operations leads can check the answer instead of taking our word for it.
Last Updated: October 2026
Q3 2026 Snapshot: Every Service Goal Met
| Metric |
Q3 2026 |
Q2 2026 |
Goal |
| Abandon Rate |
2.2% |
3.0% |
3% max |
| Average Speed to Answer |
0:15 |
0:15 |
0:20 max |
| Calls Answered in 20 Seconds or Less |
83.5% |
82.6% |
80% min |
Abandon rate fell from 3.0% in Q2 to 2.2% in Q3, a full 0.8 points under our ceiling. Average speed to answer held at 15 seconds, five seconds better than our maximum. And 83.5% of callers reached a live advocate within 20 seconds, up from 82.6% last quarter.
In plain terms: fewer people hung up before reaching someone, and more of them got a person on the line almost immediately.
What Members Said in Q3
A call center number tells you how fast the phone gets answered. It does not tell you what happens next. These comments came from members our identity theft recovery advocates worked with this quarter.
“My Advocate was very knowledgeable and helpful, in my time of need. Her experience and practical recommendations are priceless!” Shirrell H.
“My assigned Resolution Specialist was awesome and has been extremely helpful during a stressful situation.” Ronald K.
“The overall experience was good. Thank you. I appreciate that my Advocate assisted me in locking my credit and I will do everything possible to keep these thugs away and to not disrupt my life any further.” Helen K.
“My advocate is very good and I continue to look to her for support as issues come up.” Kathleen P.
Why an Owner Should Care About a Call Center Number
When an employee’s identity is compromised, their problem lands on your operation. Hours go to phone trees, bureau disputes, and paperwork. Questions go to the office manager or straight to you. A recovery advocate who answers in 15 seconds and owns the case to the end takes that work off your desk.
There is a second reason. Carriers, clients, and examiners increasingly ask small firms to show evidence, not describe intentions. Hold the vendors who support your people to the same standard. Before you sign, ask:
- What is your abandon rate, and what is your goal?
- How fast does a live person answer, on average?
- Does one person own the case from first call to resolution?
- Will you show me those numbers in writing, every quarter?
If a vendor cannot answer the first two with actual figures, that tells you something.
How Our Identity Theft Recovery Advocates Work
Our U.S.-based advocates handle each case personally, from the first call to final resolution. Each one is trained to:
- Answer live, without sending callers through automated menus
- Coordinate with credit bureaus and financial institutions on the member’s behalf
- Explain every step in plain language, not jargon
Fully managed recovery is part of Business Comprehensive, alongside employee identity monitoring and fraud recovery support for every employee.
Proof, Every Quarter
We publish results for our identity theft recovery advocates every quarter because a firm deciding who supports its people after an incident deserves proof, not promises. If you are building out your incident plan or reviewing the vendors behind it, see how defend-id helps your firm organize, assign, and document that work at defend-id.com.
Related Articles
by Brian Thompson | Oct 7, 2026 | Mortgage, Real Estate, Scams, SMB
Mortgage wire fraud prevention usually gets treated as the title company’s job. The title company holds the escrow account, so the title company should worry about the wire. That logic breaks the moment a criminal gets into a loan officer’s mailbox. From there, they can see the closing date, the borrower’s name, the cash-to-close figure, and the tone your team uses with clients. Then they send the borrower “updated” wire instructions that look like they came from you.
Last Updated: October 2026
This guide is for owners, operations managers, and compliance leads at mortgage brokerages and independent lenders with roughly 10 to 150 employees. It covers what the numbers show, what the FTC Safeguards Rule may expect of your shop, and a mortgage wire fraud prevention plan your team can run without a full-time security hire.
Why mortgage wire fraud prevention starts with your shop
The FBI’s Internet Crime Complaint Center (IC3) logged 12,368 real estate fraud complaints in 2025, with $275.1 million in reported losses. That is up from $173.6 million in 2024, an increase of about 58% in one year. Source: the FBI IC3 2025 Internet Crime Report.
The broader category matters even more. Business email compromise (BEC), the scheme behind much of closing-day wire fraud, drew 24,768 complaints and more than $3 billion in reported losses in 2025. IC3 defines BEC as fraud against people who regularly make wire transfers, carried out by compromising email, phone numbers, or meeting apps. That describes a mortgage workflow almost exactly.
Real estate transactions give criminals three things they want:
- Large, predictable wires. Earnest money, cash to close, and payoffs all move on a known schedule.
- Many parties on one thread. Borrower, loan officer, processor, agent, title, and attorney all email each other. One weak mailbox exposes everyone.
- Time pressure. Nobody wants to delay a closing. Urgency makes people skip the callback.
AI is making the impersonation better. IC3 notes that chat tools can quickly produce official-sounding emails, and voice cloning can be used to request a wire. Businesses reported more than $30 million in 2025 losses to BEC scams involving AI. The old advice to “look for typos” no longer holds.
Here is the uncomfortable part for a broker or lender. Your shop may never touch the closing funds. But your inbox holds the details that make a fake instruction convincing. If the breach starts with you, the borrower will remember whose email it came from. That is why mortgage wire fraud prevention has to start inside your own shop.
What the FTC Safeguards Rule may expect from your shop
Whether the FTC Safeguards Rule applies to you depends on your entity and your regulator. Confirm it with counsel. That said, the FTC’s own guidance names mortgage lenders and mortgage brokers among its examples of covered financial institutions. Lenders owned by or supervised as banks generally answer to their banking regulator instead. State mortgage regulators may add their own requirements on top.
For covered firms, the rule requires a written information security program. The FTC lists nine elements. Several map directly to mortgage wire fraud prevention:
- A Qualified Individual who implements and supervises the program. This person needs real-world know-how, not a specific degree or title.
- Multi-factor authentication for anyone accessing customer information on your systems.
- Staff training, with regular refreshers.
- Service provider oversight, including contracts that spell out security expectations and periodic reassessment.
- A written incident response plan with clear roles, decision authority, and documentation steps.
There is also a reporting duty. If a security event involves the unauthorized acquisition of unencrypted information about at least 500 consumers, the rule requires notice to the FTC no later than 30 days after discovery. A compromised loan officer mailbox can hold far more borrower files than most owners expect.
Firms that keep customer information on fewer than 5,000 consumers are exempt from certain provisions, not the whole rule. Read the full guidance at the FTC’s Safeguards Rule page.
The practical point: the controls behind mortgage wire fraud prevention are largely the same controls the rule describes. You are not building two programs. You are building one and documenting it.
The mortgage wire fraud prevention control plan
None of these controls requires new software to start. Each one needs an owner and a record that it happened.
1. Name one owner for wire safety
Pick the person who decides what happens when something looks wrong. In a 25-person brokerage, that is often the operations manager or compliance lead. If the Safeguards Rule applies to you, this may be the same person as your Qualified Individual. Write the name down. When a suspicious email lands at 4:45 on a Friday, nobody should wonder whose call it is.
2. Set a callback rule your team cannot skip
Any change to payment instructions gets verified by phone, using a number from your file or a known directory. Never use the number in the email that requested the change. This applies to borrower payoffs, vendor invoices, and broker compensation. This one rule is the core of mortgage wire fraud prevention. Make it a written procedure, then train on it. A rule that lives only in someone’s head disappears during a rush close.
3. Warn borrowers early and more than once
Tell borrowers at application, again with disclosures, and again in the closing week. The message is short: your firm will never send new wire instructions by email alone, and they should call a known number before sending money. Put it in your email signatures and your portal. A borrower who expects the warning is far more likely to pause.
4. Review the title and settlement partners you send borrowers to
Your borrower’s money moves through partners you recommend. Ask each title, escrow, or settlement partner how they verify wire instructions and protect their own email. Record the answers and review them at least once a year. If the Safeguards Rule covers you and a partner receives borrower information from your firm, this also supports your service provider oversight requirement.
5. Lock down the mailboxes criminals want most
Loan officers, processors, and closers hold the most useful details. Require multi-factor authentication on every account. Check regularly for hidden forwarding rules, a common sign of a compromised mailbox. Remove access quickly when people leave. Then have staff practice spotting a spoofed closing email before a real one arrives.
The first hour after a misdirected wire
Speed decides how much money comes back. In 2025, the IC3 Recovery Asset Team ran its Financial Fraud Kill Chain on 3,900 incidents involving $1.16 billion in attempted theft. It helped freeze $679 million, a 58% success rate. One case involved a couple closing on a home who got an email impersonating their attorneys. They wired more than $449,000. After they filed with IC3, the receiving bank confirmed the full amount was still on hold.
Your written incident response plan should cover these steps in order:
- Call the sending bank immediately. The borrower (or your firm, if your wire went out) requests a recall and asks the bank to contact the receiving bank.
- File at ic3.gov regardless of the amount. Include full transaction details. IC3 states that time is of the essence.
- Alert the title or settlement company using a known phone number, so they can stop any related disbursements.
- Preserve the evidence. Do not delete the fraudulent email or wipe the affected account. Capture headers, forwarding rules, and login history.
- Contain the mailbox. Reset credentials, revoke sessions, and confirm MFA on the affected account.
- Decide on notifications. Your owner, with counsel, determines whether borrower information was exposed and whether FTC or state notice duties apply.
- Write it down. Record what happened, who decided what, and what you changed afterward.
Most small shops lose the first hour to guessing. Who calls the bank? Does anyone call the borrower? Which person decides whether this is reportable? A plan written on a quiet afternoon answers those questions before anyone is panicking.
Turning mortgage wire fraud prevention into an operating rhythm
A one-time policy fades. A rhythm holds. Here is a simple cadence a 10 to 150 person shop can run:
- Assess (annually): Inventory where borrower information lives, who can reach it, and which partners receive it.
- Prioritize (annually): Rank the gaps. For most mortgage shops, missing MFA and an unwritten callback rule top the list.
- Train (quarterly): Short refreshers on spoofed closing emails, payment changes, and phone impersonation.
- Review vendors (annually, and at onboarding): Re-ask your title and settlement partners how they protect wires and email.
- Prepare for an incident (twice a year): Walk through the first-hour steps as a tabletop exercise. Update the plan after each one.
Keep records of each step. When a lender partner, auditor, or examiner asks how you protect borrower information, you can show the work instead of describing it.
Mortgage wire fraud prevention FAQ
Does the FTC Safeguards Rule apply to mortgage brokers?
The FTC lists mortgage brokers and mortgage lenders among its examples of covered financial institutions. Coverage still depends on your activities and whether another regulator, such as a banking agency, supervises you. Confirm your status with counsel.
Who is responsible when a borrower wires money to a fraudster?
It depends on the facts, the contracts, and state law. Liability disputes can involve the lender, broker, agent, and title company. The safer question is whether your firm can show it trained staff, warned borrowers, and responded quickly.
Mortgage wire fraud prevention in practice
How fast do we need to act after a fraudulent wire?
Immediately. The FBI advises contacting your financial institution to request a recall and filing at ic3.gov regardless of the amount. Recovery odds fall as funds move to additional accounts.
What is the single most effective wire fraud control?
A mandatory callback to a known phone number before acting on any changed payment instructions. It is cheap, simple, and stops many email-based schemes. It only works if everyone follows it every time.
Do we have to report a compromised email account to the FTC?
Only if you are covered by the Safeguards Rule and the event involves unauthorized acquisition of unencrypted information about at least 500 consumers. Then notice is due within 30 days of discovery. State breach laws may also apply.
Does a small brokerage really need a written incident response plan?
If the Safeguards Rule covers you, a written plan is one of its required elements. Even if it does not, a short plan saves the first hour of a crisis, which is when recovery odds are highest.
What does mortgage wire fraud prevention look like for a small brokerage?
A named owner, a mandatory callback rule for changed payment instructions, repeated borrower warnings, documented reviews of title and settlement partners, multi-factor authentication on every mailbox, and a written incident response plan your team has practiced.
Put an owner and a record behind the plan
Most mortgage shops already know wire fraud is a risk. What they lack for real mortgage wire fraud prevention is a named owner, a training schedule, partner reviews on file, and an incident plan someone has actually practiced. defend-id gives smaller firms one place to assign that work and document it, with employee security training, vendor management, and 24/7 incident response and breach support. Your firm still owns its program. We help you run it and show the records when a lender, auditor, or examiner asks.
Related articles
by Brian Thompson | Sep 30, 2026 | Insurance, Mortgage, SMB
Cybersecurity Awareness Month for small business has always had a mismatch. The campaign’s advice assumes someone on staff owns security. At a 30-person tax firm, insurance agency, or mortgage shop, nobody does.
Last Updated: September 2026
Key takeaways
- Train staff in week one with a live, 30-minute session on the attacks your industry actually sees, and record who attended.
- Review every vendor that holds client data in week two, including its breach notice terms and whether MFA is enforced.
- Scan for vulnerabilities in week three, give each fix an owner and a date, and test one backup restore.
- Rehearse the first hour of an incident in week four with a 45-minute tabletop and a one-page contact sheet.
- Finally, keep the records. By November 1, that evidence is what clients, carriers, and examiners ask to see.
However, that does not make the month useless. It changes what the month is for. If your firm handles client Social Security numbers, policy data, or loan files, October is a built-in deadline. It is the month to do the security work you already owe clients, carriers, and regulators, and to write down that you did it.
This year the campaign runs two official themes. The Cybersecurity and Infrastructure Security Agency is running “Securing the Next 250,” aimed mostly at critical infrastructure operators. The National Cybersecurity Alliance is running “Don’t Make It Easy for Them,” which focuses on everyday habits. In fact, neither was written for a firm with one office manager and an outsourced IT provider.
So this guide turns Cybersecurity Awareness Month for small business into four weeks of work. Each week covers one part of a security operating rhythm: train, review vendors, find and fix gaps, and prepare for an incident.
Why Cybersecurity Awareness Month for Small Business Should End With Evidence
Most professional firms do not need convincing that client data is valuable. They need a way to assign security work and prove it happened. The pressure usually comes from outside. A carrier sends a cyber insurance application. A client sends a vendor security questionnaire. A lender, auditor, or examiner asks for documentation. Each one asks some version of the same question: show me.
The threat data explains why those questions keep getting harder. Verizon’s 2026 Data Breach Investigations Report found third-party involvement in 48 percent of breaches, a 60 percent jump in one year. Exploiting unpatched vulnerabilities also overtook stolen credentials as the top way attackers get in, at 31 percent of breaches versus 13 percent. The FBI’s 2025 Internet Crime Report logged $20.877 billion in reported losses, up 26 percent. Business email compromise alone accounted for about $3.05 billion.
The Small Business Obligations Cybersecurity Awareness Month Should Surface
The threat describes the risk. Your obligations, however, describe the response. Depending on what your firm does, they may include:
- The FTC Safeguards Rule, which applies to non-bank financial institutions under FTC jurisdiction. That can include mortgage brokers and many tax preparers. See the FTC’s guidance.
- The IRS expectation of a written information security plan for tax professionals, with a template in IRS Publication 5708.
- State insurance data security laws, many based on the NAIC model law. Requirements vary by state.
- State breach notification laws, which follow the residence of the people affected, not the location of your office.
Which of these apply depends on your activities, your regulator, your state, and your contracts. Therefore, confirm yours with counsel rather than assuming. Before week one, answer five questions in writing:
- What sensitive information do we handle?
- Who can access it, including vendors?
- Which rules, contracts, or carrier requirements apply to us?
- What evidence would we need to show if someone asked?
- Who owns this work, by name?
Week 1: Train Staff on the Attacks Your Firm Actually Sees
Generic phishing training fails because the examples do not look like your inbox. Run one live, 30-minute session with examples from your own line of work.
- Tax and accounting firms: On September 16, the IRS and Security Summit warned tax professionals about fraudsters posing as new clients. These messages carry malicious links or attachments disguised as tax documents. The same release flagged phishing aimed at EFIN, PTIN, and CAF numbers. Train on both before the October 15 extension deadline fills everyone’s inbox.
- Independent insurance agencies: Show what a compromised producer mailbox looks like from the client side. Fake invoices and payment change requests go out under a trusted name.
- Mortgage brokers and lenders: Walk through a spoofed closing email with altered wire instructions. Make one rule non-negotiable: verify every wire change by phone, using a number you already had.
In addition, add one voice example. Attackers now call staff and executives while posing as internal IT, as we covered in our help desk impersonation guide.
Then record who attended and when. A dated attendance record beats a forwarded link. It is also one of the first things a security questionnaire asks for.
Week 2: Review the Vendors Who Hold Your Clients’ Data
Your client data does not live only on your computers. It lives in tax software, agency management systems, loan origination platforms, cloud storage, payroll, and your IT provider’s tools. That is why third-party involvement now shows up in nearly half of breaches.
First, build a simple vendor list this week. For each vendor, note four things:
- What client or employee data the vendor holds
- Who at your firm owns the relationship
- How quickly the vendor must notify you of an incident, per the contract
- Whether multifactor authentication is enforced on your firm’s accounts
In fact, the last item matters more than it looks. Verizon found that only 23 percent of third-party organizations fully fixed their MFA gaps. In other words, a strong password on your side does little if the vendor account behind it is exposed.
If your firm is covered by the Safeguards Rule, vendor oversight is part of the rule itself. For example, covered firms must select capable service providers, require safeguards by contract, and assess them periodically. Our third-party data breach guide covers what to do when a vendor gets hit. Our vendor payment fraud post shows how one redirected email cost a small town $189,199.
Week 3: Find and Fix the Gaps Attackers Use First
Attackers now get in through unpatched systems more often than through stolen passwords. The usual suspects are a firewall, VPN, or remote access tool nobody has updated. Similarly, an old workstation still running an unsupported operating system is another.
Credentials still matter, though. Verizon’s data shows half of ransomware victims had a credential or infostealer event within 95 days before the attack. In short, stolen logins are often the setup, not the finish.
This week’s work:
- Run a vulnerability scan on internet-facing systems and staff devices.
- Give every finding an owner and a fix-by date. A scan nobody acts on is just a list of liabilities.
- Turn on MFA for email, remote access, and your core client software.
- Test one backup restore. A backup you have never restored is a hope, not a control.
Tax firms can map this week to the IRS “Security Six”: antivirus, firewalls, backups, encrypted drives, MFA, and virtual private networks. Our ransomware guide for small business covers how an attack unfolds once someone gets in.
Week 4: Rehearse the First Hour of an Incident
The first hour of an incident decides the rest of the week. However, in most small firms, that hour goes to guessing. Who decides whether to shut down email? Who calls the IT provider and the carrier? And when does the notification clock start?
Those clocks are real, and some are short. Examples, depending on who you are:
- FTC Safeguards Rule: Covered firms must notify the FTC within 30 days of discovering an event involving unencrypted information of at least 500 consumers.
- State insurance data security laws: In states that follow the NAIC model, licensees generally must notify the insurance commissioner within 72 hours of determining a cybersecurity event occurred. Check your state’s version.
- Tax professionals: The IRS directs firms to contact their local IRS Stakeholder Liaison and report the breach to the state tax agency.
- State breach notification laws: Deadlines vary. California, for example, now requires individual notice within 30 days of discovery.
Run a 45-minute tabletop exercise with your leadership and your IT provider. Pick one realistic scenario, such as a compromised mailbox sending wire instructions to clients. Then walk through the first hour, minute by minute.
Finally, the output is a one-page contact sheet. It names the decision owner, the IT provider, the cyber insurance claims line, outside counsel, and your bank’s fraud line. Insurance agencies can build from our 72-hour incident response plan. Every firm can use the post-breach playbook for the steps after that first hour.
What Cybersecurity Awareness Month for Small Business Should Leave Behind
The point of Cybersecurity Awareness Month for small business is a file, not a feeling. By November 1, your firm should be able to pull up five things:
- A dated training record showing who attended
- A vendor list with data held, contract notice terms, and MFA status
- Scan results with an owner and a date for each fix
- A one-page incident contact sheet and a note on the tabletop exercise
- One named person who owns the security program
That is the evidence clients, carriers, and examiners ask to see. It also becomes next October’s starting point, so the month gets easier every year instead of starting from zero.
Cybersecurity Awareness Month for Small Business: FAQ
What is Cybersecurity Awareness Month?
Cybersecurity Awareness Month is a national campaign held every October. The Cybersecurity and Infrastructure Security Agency and the National Cybersecurity Alliance lead it jointly. It promotes practical security habits for individuals and organizations.
What is the 2026 Cybersecurity Awareness Month theme?
There are two. CISA’s theme is “Securing the Next 250,” focused on long-term resilience for critical infrastructure. The National Cybersecurity Alliance’s theme is “Don’t Make It Easy for Them,” focused on everyday security habits.
What should a small business do for Cybersecurity Awareness Month?
Treat the month as a four-week work plan rather than an awareness campaign. Train staff on real attacks in week one, review vendors in week two, scan and fix gaps in week three, and rehearse an incident in week four. Then keep the records, because clients, carriers, and examiners ask for evidence.
Does the FTC Safeguards Rule apply to my firm?
It applies to non-bank financial institutions under FTC jurisdiction. That can include mortgage brokers, many tax preparers, and other firms engaged in financial activities. However, coverage depends on what your firm actually does. Review the FTC’s guidance and confirm with counsel.
Do tax preparers need a written information security plan?
The IRS expects professional tax preparers to maintain a written information security plan. In addition, it publishes a template in Publication 5708. Each firm must tailor its plan to its own size, systems, and risks.
How much time does the Cybersecurity Awareness Month plan take a small business?
Plan on a few hours per week for the person who owns the work, plus about 30 minutes of staff time for training. The tabletop exercise needs 45 minutes from leadership and your IT provider.
If we only do one week, which should it be?
Week four. Naming a decision owner and building an incident contact sheet costs little. It also removes the most expensive delay in a real incident: the first hour spent figuring out who is in charge.
Make Cybersecurity Awareness Month for Small Business a Routine
If Cybersecurity Awareness Month for small business surfaces more open items than one person can track, that is the gap defend-id Business Essentials is built for. It gives a firm without a security leader one place to run staff training, review vendors, scan for vulnerabilities, and reach 24/7 incident response support, and it keeps a record of what was done. The platform does not replace your program or make any rule go away. Instead, it makes the work easier to assign, finish, and show. See how it works at defend-id.com.
Related Articles
by Brian Thompson | Sep 23, 2026 | Breach, Insurance, SMB
An insurance agency incident response plan gets written in one of two moments. Some agencies write it on a quiet afternoon, with time to think. Others write it in the first hour of a cybersecurity event, while a producer’s mailbox sends fake invoices to clients. The second version costs far more, and it starts a legal clock the agency may not know about.
Last Updated: September 2026
Here is how that hour usually looks at a 25-person agency. A client calls to ask why your office emailed new wire instructions. Nobody sent them. The account manager assumes it is spam. The owner is at a carrier meeting. By the time anyone asks who is in charge, half a day is gone. Under the insurance data security law in many states, that half day may count against a 72-hour deadline to notify the insurance commissioner.
This guide covers what that deadline is, what the model law expects your plan to include, how the first 72 hours should run, and what changes when the breach happens at a vendor. One note before we start: state versions of this law differ, and this is not legal advice. Check your own state’s statute and talk with counsel before you finalize anything.
The 72-hour clock: what the NAIC model law says
In 2017, the National Association of Insurance Commissioners adopted the Insurance Data Security Model Law, known as Model #668. It applies to licensees. That includes insurers, agencies, and producers licensed by a state insurance department. A growing number of states have adopted their own versions. The NAIC state adoption chart lists where each state stands. Your state may differ from the model in timing, thresholds, or exemptions.
Section 6 of the model sets the clock. A licensee must notify the commissioner as promptly as possible, and no later than 72 hours after it determines a cybersecurity event has occurred. For a producer, the duty applies when the state is the producer’s home state. It also applies in other states when the event involves 250 or more of that state’s residents and meets certain harm or reporting tests.
Notice the trigger. The clock starts at determination, not at discovery of a suspicious email. That is why the first hours matter so much. An agency with no process can spend a day deciding whether anything happened at all. An agency with a written insurance agency incident response plan knows who makes that call and how.
The exemption most small agencies misread
The model exempts licensees with fewer than ten employees, including independent contractors. But the exemption covers Section 4 only. Section 4 is the written information security program. Sections 5 and 6 still apply. So a nine-person agency may not need a full written program under the model. It still has to investigate a cybersecurity event and notify the commissioner on time. A small agency without an incident response process carries the same deadline with fewer people to meet it.
What the model law expects an insurance agency incident response plan to cover
Section 4H requires a written incident response plan as part of the information security program. The plan has to help the agency respond promptly and recover. The model lists seven areas it must address:
- An internal response process. What happens, in what order, when someone suspects an event.
- Goals. What the plan is trying to protect and restore.
- Roles and decision authority. Who leads, who decides, and who can act when the owner is unreachable.
- Communications. How the agency talks to staff, clients, carriers, and regulators, internally and externally.
- Remediation requirements. How the agency identifies and fixes the weakness that allowed the event.
- Documentation and reporting. How the agency records the event and its response.
- Review after an event. How the agency evaluates and revises the plan once things settle.
Read that list as an agency owner, and one item stands out. Roles and decision authority. In a small agency, the owner often holds every decision. If the owner is on a plane, the plan stalls. A useful insurance agency incident response plan names a backup decision maker in writing.
Section 5 adds the investigation duties. The agency, or a vendor acting for it, must determine whether an event occurred, assess its scope, identify the nonpublic information involved, and restore security. Section 5D requires the agency to keep records of every cybersecurity event for at least five years. Those records must be available if the commissioner asks.
How an insurance agency incident response plan runs in the first 72 hours
An insurance agency incident response plan on paper helps only if your team can run it under stress. Here is a practical sequence for a small agency. Adjust it to your state’s law and your own systems.
Hour zero to hour four: contain and call
Whoever spots the problem reports it to the named incident lead right away. The lead starts a written log with the time, the first report, and every action taken. Next, the team contains the damage. That can mean resetting a compromised password, disconnecting an infected machine, or suspending a mailbox rule that forwards client email. The lead then calls the agency’s outside response resources. That may include a breach response provider, counsel, and the agency’s cyber insurance carrier if the policy has notice terms.
Preserve evidence as you go. Do not wipe a laptop or delete suspicious emails before someone reviews them. The investigation needs them, and so may the commissioner.
Hours four to 24: investigate and decide
The investigation answers the Section 5 questions. What happened? Which systems were involved? Whose information was exposed? Is the attacker still inside? The goal of this window is a clear determination. Once the agency determines that a cybersecurity event occurred, the 72-hour clock is running. Write down the time of that determination. It anchors every deadline that follows.
Hours 24 to 72: notify with what you know
Section 6B lists up to 13 items the commissioner may expect. They include the date of the event, how it was discovered, the types of information involved, the number of affected residents, and a named contact person. The model says to provide as much as possible, and it creates a continuing duty to update. So the first notice does not need every answer. It needs to arrive on time.
Consumer notice follows your state’s breach notification law. Those deadlines are separate, and many states have tightened them. Our guide to business data protection practices covers how several states shortened consumer notice windows in 2026.
After 72 hours: fix, record, and review
Once notices go out, the work shifts to remediation and records. Close the gap that let the attacker in. Update the notice to the commissioner as facts change. File the event log where you can find it for five years. Then hold a short review. What slowed the team down? What would you change? Section 4H expects that review, and it is the step most teams skip.
Vendor breaches and your insurance agency incident response plan
Many agency breaches never touch the agency’s own systems. They start at a comparative rater, an agency management system, a payment processor, or an outsourced IT provider. Verizon’s 2026 Data Breach Investigations Report found that breaches involving a third party rose 60% in a year. They now account for 48% of all breaches in its dataset.
The model law does not let an agency hand that problem off. Under Section 6D, a vendor event gets the same treatment as an event on the agency’s own systems. The agency’s deadline begins the day after the vendor notifies it, or the day it otherwise learns of the event, whichever comes first. Under Section 5C, the agency must complete the investigation steps itself or confirm and document that the vendor did.
That makes vendor oversight part of incident response, not a separate checklist. Section 4F requires due diligence in selecting vendors and requires vendors to protect the information they hold. In practice, an insurance agency incident response plan should list:
- Every vendor that stores or can access client nonpublic information
- Each vendor’s breach contact and how fast its contract requires it to notify you
- Who at the agency receives vendor breach notices and logs the date
- What records you will need from the vendor to answer the commissioner
Our third-party data breach guide walks through what small businesses should ask vendors before something goes wrong.
What these events cost a small agency
The legal deadline is only part of the exposure. The larger cost usually comes from lost time. Verizon’s 2026 Breach Impact Study analyzed roughly 70,000 U.S. cyber insurance claims. It put the median impact for small and midsize businesses at about $38,000, and it named business interruption as the fastest-growing source of loss.
The attack types that drive those losses are familiar to agencies. Ransomware appeared in 48% of breaches in the 2026 DBIR, up from 44% the year before. The FBI’s 2025 Internet Crime Report put business email compromise losses at about $3 billion, the second-largest category of reported loss. Agencies move premium payments, claim checks, and client banking details every day. That makes them a natural target for payment redirection schemes like the one in our help desk impersonation guide.
An insurance agency incident response plan does not stop these attacks. It shortens the time between the first report and a controlled response. For a small agency, that time is where most of the cost lives.
Building an insurance agency incident response plan your team can run
An insurance agency incident response plan does not need to be a thick binder. It needs to be a short document your team has read, backed by people who know their roles. Start with these pieces:
- A named incident lead and a backup. Put both names in writing, with phone numbers that work after hours.
- A one-page call list. Include your breach response provider, counsel, your cyber insurance carrier’s notice line, key vendors, and your state insurance department’s reporting contact.
- A determination rule. Decide in advance who declares that a cybersecurity event occurred, and how that time gets recorded.
- A notification worksheet. Pre-build a form with the Section 6B items so the team fills in blanks instead of starting from scratch.
- A vendor section. List vendors that hold client data and how each will notify you.
- Staff training. Teach every employee how to report a suspicious email, call, or login right away. The report starts the clock on your response, not the attacker’s.
- An annual tabletop exercise. Walk through one realistic scenario for 45 minutes. Fix whatever breaks.
Then keep records of the work: training completion, vendor reviews, and exercise notes. If a commissioner, carrier, or client ever asks what your agency does to protect its data, those records answer faster than any policy statement. Our four-week Cybersecurity Awareness Month plan schedules that training, vendor review, and a tabletop exercise across October.
Insurance agency incident response plan FAQ
Does the NAIC Insurance Data Security Model Law apply to independent agencies?
The model applies to licensees, which include agencies and producers licensed by a state insurance department. Whether it applies to your agency depends on whether your state adopted a version of it and how that version reads. Check your state statute and the NAIC adoption chart.
How long does an agency have to notify the insurance commissioner?
Under the model law, no later than 72 hours after the agency determines that a cybersecurity event has occurred. Some states changed that timing or the triggers in their own versions, so confirm your state’s rule.
Is an agency with fewer than ten employees exempt?
Under the model, an agency with fewer than ten employees, including independent contractors, is exempt from Section 4, the written information security program. It is not exempt from the investigation and notification duties in Sections 5 and 6.
Does a breach at our agency management system vendor count?
Yes. Under the model, a cybersecurity event at a third-party service provider gets the same treatment as one on your own systems. Your deadline starts the day after the vendor notifies you or you otherwise learn of it, whichever comes first.
What does an insurance agency incident response plan need to include?
The model lists seven areas: an internal response process, goals, roles and decision authority, communications, remediation, documentation and reporting, and review after an event. A practical plan adds a call list, a vendor section, and a notification worksheet.
How long must we keep records of a cybersecurity event?
The model requires licensees to keep records of all cybersecurity events for at least five years and produce them on the commissioner’s request. Your state’s version may set different terms.
Is consumer notification the same as notifying the commissioner?
No. Consumer notice follows your state’s general breach notification law, which has its own deadlines and triggers. Under the model, the agency also sends the commissioner a copy of the consumer notice when commissioner notice is required.
Put people and records behind the plan
A plan only works when someone answers the phone at hour one and the records exist at hour 72. defend-id Business Essentials gives agencies 24/7 incident response and breach support, short employee security training, vendor management, and vulnerability scanning in one place. It helps your team organize, assign, and document the work behind your plan. Your agency still owns its plan and its obligations under your state’s law. See how defend-id supports insurance agencies.
Related articles
by Brian Thompson | Sep 9, 2026 | Breach, SMB
Data breach notification requirements for small businesses changed in more states than most owners realize this year. California shortened its notice deadline to a hard 30 days. Oklahoma expanded what counts as reportable data and attached six-figure penalties to businesses that cannot show they had reasonable safeguards in place. Virtually every small business handles customer or employee data. If yours does, the rules you followed in 2025 are already out of date.
Last Updated: September 2026
Most small business owners think of a data breach as an IT problem. It is also a legal deadline, and in 2026 that deadline got shorter, stricter, and more expensive to miss. The businesses least prepared for that shift are not the ones getting breached. They are the ones who get breached and then find out, in the middle of the worst week of their year, that they had 30 days to notify customers. They had no idea the clock had already started.
What Changed in 2026: New Data Breach Notification Requirements in California and Oklahoma
Two states moved first, and both took effect January 1, 2026.
California’s New 30-Day Deadline
California (SB 446) replaced its old standard, “the most expedient time possible,” with a specific number. Businesses must now notify affected California residents within 30 calendar days of discovering or learning of a reportable breach. Narrow exceptions remain for active law enforcement investigations, but the default is now a countdown, not a judgment call. If a breach affects more than 500 residents, you must also notify the state Attorney General, within 15 calendar days of notifying individuals.
Oklahoma’s Bigger Overhaul
Oklahoma (SB 626) went further. It expanded what counts as reportable data. On top of the usual Social Security and payment card numbers, the list now includes government-issued IDs, electronic credentials that enable access to financial accounts, and biometric information. Breaches affecting 500 or more residents require Attorney General notification within 60 days. That notice must cover what happened, what data the breach involved, how many residents it affected, what safeguards the business had in place, and the estimated financial impact.
Oklahoma also attached real numbers to non-compliance: businesses without reasonable safeguards in place face penalties up to $150,000 per breach. Businesses that had safeguards but failed to meet the notice requirements face $75,000 plus actual damages. Sector exemptions exist for entities already regulated under HIPAA, GLBA, or Oklahoma’s Hospital Cybersecurity Protection Act, but even those businesses still have to notify the Attorney General.
This Is Now the National Trend
Neither law applies only to large companies. Both apply to any business handling the data of state residents. A five-person shop in Tulsa with customers in Oklahoma is on the hook exactly the same as a regional retailer.
California and Oklahoma are not outliers, they are the leading edge of a pattern. More than 20 states have moved toward specific, shorter notification windows over the past few years. That replaces the old “reasonable time” language that gave businesses room to interpret their own obligations. Most small businesses with any online presence effectively operate in multiple states. If yours does, assume a 30-day clock, not a vague one, is already the standard that applies to you.
Why “Reasonable Safeguards” Is Now the Legal Standard
Oklahoma built its penalty structure around a phrase that used to be vague: reasonable safeguards. It is not vague anymore. The FTC Safeguards Rule already applies to a wide range of businesses that handle consumer financial data. It spells out exactly what a reasonable information security program has to include:
- A designated person responsible for the program
- A written risk assessment, reviewed periodically
- Access controls, data encryption, and multi-factor authentication
- Continuous monitoring, or annual penetration testing plus vulnerability scans every six months
- Regular employee security training
- Oversight of vendors and service providers who touch your data
- A written incident response plan
- At least annual reporting on how the program is performing
That list is no longer just an FTC requirement for financial-adjacent businesses. It is quickly becoming the practical definition of “reasonable safeguards.” State Attorneys General, courts, and cyber insurers point to this list when they decide whether a breached business gets the lighter penalty or the six-figure one.
The Six Pillars of a 2026 Data Protection Program
Strip away the legal language and the FTC’s list collapses into six practices every small business needs. That holds regardless of which state’s law technically applies to you.
Pillars One Through Three
1. Vulnerability scanning. You cannot fix what you cannot see. Regular scanning of your network and systems for exploitable weaknesses is the baseline every regulator now expects. It is also the single fastest way to catch a problem before it becomes a breach instead of after.
2. Written, current policies. A security policy you have not reviewed since you wrote it is not a policy, it is a liability. Regulators and courts increasingly ask not just whether you had a policy, but when you last updated it.
3. An incident response plan you have actually tested. When a breach happens, the businesses that meet their notification deadlines are the ones that already know who does what. Figuring out your response plan during the breach itself is how 30-day deadlines get missed.
Pillars Four Through Six
4. Employee training that keeps up. Human error is still the leading cause of breaches. A once-a-year slideshow does not meet the bar anymore; regulators are looking for ongoing, practical training that reflects current threats like AI-generated phishing.
5. Vendor and third-party oversight. Your obligations do not stop at your own systems. If a vendor with access to your customer data gets breached, you can still be the one who has to notify. Knowing who has access to what, and holding vendors to a written standard, is now a documented requirement, not a nice-to-have.
6. A policy center you can actually produce on demand. When an Attorney General, an auditor, or a cyber insurance underwriter asks for proof of your safeguards, “we have a guy who handles that” is not an answer. You need documentation you can hand over the same day someone asks for it.
What Unprepared SMBs Are Actually Losing
The cost of getting this wrong is not hypothetical, and it is not shrinking.
The average cost of a data breach globally reached $4.44 million in IBM’s 2025 Cost of a Data Breach Report. Breached organizations took an average of 241 days to identify and contain an incident. That is the fastest that number has been in nine years, and still the better part of a full year. Organizations using unsanctioned “shadow AI” tools tacked an additional $670,000 onto their average breach cost, and 63% of organizations still have no AI governance policy at all.
Small businesses are not sitting this out. VikingCloud’s 2025 SMB Threat Landscape Report found that a successful cyberattack hit 1 in 3 small and mid-sized businesses in the past year. One in 5 said damages of just $10,000 would be enough to force them to close. Seventy-one percent admit their own defenses are inadequate, and 74% manage cybersecurity themselves, without dedicated training, because that is what their budget allows.
The FBI’s Internet Crime Complaint Center recorded nearly $21 billion in reported cybercrime losses in 2025, a 26% jump from the previous year’s record. Business email compromise alone accounted for more than $3 billion of that total. None of this is theoretical risk. Unprepared businesses are receiving that bill right now, and states are writing penalties into law for the ones that cannot show they tried.
Building a Program That Meets Data Breach Notification Standards
None of this requires an in-house security team or an enterprise budget. It requires the six pillars above, implemented consistently and documented in a way you can produce on short notice. Start by identifying which of the six your business is missing today. That gap is exactly where a breach turns into a six-figure problem instead of a bad week.
If your current program is a folder of documents nobody has opened since last year, the deadlines above are the moment to change that. Do it before a regulator or a breach forces the timeline. The businesses that come through a breach in the best shape are rarely the ones with the fewest incidents. They are the ones who could already answer “what are your safeguards” before anyone asked. They had already written the answer down, kept it current, and could point an employee straight to it without a scramble.
Frequently Asked Questions
What is the FTC Safeguards Rule, and does it apply to my small business?
The FTC Safeguards Rule applies to businesses that handle consumer financial information. That includes many auto dealers, mortgage brokers, tax preparers, and retailers offering financing. It requires a written information security program covering risk assessment, access controls, employee training, vendor oversight, and incident response. If you are unsure whether it applies to you, assume the underlying practices apply anyway; most state breach notification laws now reference similar standards.
State Deadlines and Penalties
What is the deadline to notify customers after a data breach in California in 2026?
Under SB 446, California businesses must notify affected residents within 30 calendar days of discovering or learning of a reportable breach. If a breach affects 500 or more residents, you must notify the Attorney General within 15 calendar days of notifying individuals.
What changed under Oklahoma’s new breach notification law, SB 626?
Oklahoma expanded reportable data to include government-issued IDs, financial account credentials, and biometric data. Breaches affecting 500 or more residents require Attorney General notification within 60 days. Penalties range up to $150,000 per breach for businesses without reasonable safeguards, or $75,000 plus damages for businesses that had safeguards but failed to meet notice requirements.
What counts as “reasonable safeguards” under these laws?
There is no single legal checklist that applies everywhere. The FTC Safeguards Rule lists nine elements: risk assessments, access controls, vulnerability testing, employee training, vendor oversight, and a written incident response plan among them. Regulators and insurers increasingly treat that list as the practical standard.
Cost, Planning, and Compliance Overlap
How much does a data breach actually cost a small business?
There is no single small-business-specific figure, but the signals are consistent. The global average breach cost was $4.44 million in 2025. According to VikingCloud’s 2025 research, 1 in 5 small and mid-sized businesses say damages of just $10,000 would be enough to force them to close.
Do I need a written incident response plan even if I have never had a breach?
Yes. Both the FTC Safeguards Rule and Oklahoma’s new law expect one to already exist. You should not be writing it for the first time after an incident occurs. A tested plan is also what makes hitting a 30-day notification deadline realistic instead of theoretical.
What is the difference between HIPAA, GLBA, and FTC Safeguards Rule compliance?
HIPAA governs health information and applies to healthcare providers and their business associates. GLBA governs financial information and applies to financial institutions broadly defined. The FTC Safeguards Rule implements GLBA’s security requirements specifically. Many small businesses, particularly those handling any kind of financing, fall under more than one of these at the same time.
Related Articles
