What is a cybersecurity risk assessment for an insurance agency?

It is a structured review that identifies the threats to the nonpublic information an agency holds, judges how likely each one is and how badly it would hurt, evaluates whether current safeguards are adequate, and produces a prioritized plan to close the gaps. The output is a document, not a piece of software.

Agency-specific scope makes the difference between a useful assessment and a generic one. A proper review follows the data through the way an agency actually works: the quote request that arrives by email, the application scanned at the front desk, the record keyed into the agency management system, the download that syncs from the carrier, the certificate emailed to a lienholder, and the file that sits in the system for years after the policy lapses.

Example: for a general overview of the process itself, see our companion guide, What is a Cybersecurity Risk Assessment? — this page covers what changes when the organization is an insurance licensee.

Does Alabama law require my agency to do a risk assessment?

If the written-program requirement applies to your agency, then yes — the risk assessment is what the program must be built on. Alabama enacted the Insurance Data Security Law as Act No. 2019-98, codified at Ala. Code § 27-62-1 and following, adopting the framework of the NAIC Insurance Data Security Model Law (#668). Roughly 28 jurisdictions have now adopted some version of that model.

A “licensee” under the Alabama law is broadly defined — it reaches persons and entities licensed or authorized to operate under Alabama's insurance code, which includes producers and agencies, not only carriers. The core obligations the law places on a non-exempt licensee are:

• Conduct a risk assessment identifying reasonably foreseeable threats to nonpublic information.
• Develop and maintain a written information security program with administrative, technical, and physical safeguards, sized to the agency.
• Consider specific security measures — access controls, encryption, multi-factor authentication, audit trails, and testing among them.
• Designate someone responsible for the program, and provide for oversight by the board or senior management.
• Exercise due diligence over third-party service providers.
• Maintain a written incident response plan.
• Investigate cybersecurity events and notify the Commissioner as required.

This page summarizes general requirements and is not legal advice. Confirm current obligations with the Alabama Department of Insurance or your own counsel — and note that agencies licensed in more than one state may face a different adopting statute in each.

Example: an agency writing across the Alabama–Florida line near Dothan is subject to Alabama's statute at home, and to whatever Florida requires of a nonresident licensee — two sets of rules, one set of systems.

Our agency has fewer than 25 employees — are we exempt?

Partly, and the part that survives is the part most agencies misunderstand. Ala. Code § 27-62-9 exempts a licensee from the information security program requirement in § 27-62-4 if it has fewer than 25 employees, or less than $5 million in gross annual revenue, or less than $10 million in year-end total assets. Most independent agencies in Alabama clear at least one of those thresholds.

What the exemption does not do is excuse the agency from everything else. Read carefully, it exempts you from § 27-62-4 — the written program section. The obligations to investigate a cybersecurity event and to notify the Commissioner sit in different sections and are not swept away with it. So a small exempt agency can still owe a report to the Department within three business days of determining an event occurred, while having no program in place to detect the event in the first place.

Three more things exempt agencies should know:

• The exemption is claimed, not automatic — the Department expects exempt licensees to file annually and to report when their status changes.
• If the agency grows past a threshold, the statute provides a transition period — 180 days — to come into compliance. That is not long to build a program from nothing.
• Exemption from a state statute is not exemption from a carrier's appointment agreement, a cyber insurer's application, or the Alabama Data Breach Notification Act, all of which apply on their own terms.

Confirm your agency's exemption status and filing obligations with the Alabama Department of Insurance or counsel rather than assuming it from headcount alone.

Example: a nineteen-employee agency treated “we're exempt” as the end of the conversation. Then it acquired a six-person book, crossed 25, and had 180 days to produce a written program, a designated owner, vendor due diligence, and an incident response plan — during the same six months it was integrating the acquisition.

How is a risk assessment different from a penetration test or a vulnerability scan?

They answer different questions, and an agency that buys one thinking it bought another ends up with a compliance gap. A risk assessment asks what could go wrong and what it would cost you. A penetration test asks whether a specific attacker could get in. A vulnerability scan asks which systems are missing patches.

• Risk assessment — broad, includes people, process, and vendors as well as technology; produces a prioritized, business-context plan. This is what the statute points to.
• Penetration test — narrow and technical; authorized attackers attempt to reach specific systems. Excellent evidence, but it will not tell you that your former producer still has agency-management-system access.
• Vulnerability scan — automated and recurring; lists known technical weaknesses. Useful input to an assessment, not a substitute for one.
• Compliance audit — measures you against a standard's checklist; says whether you conform, not whether you are actually at risk.

Sequence matters. Assess first so you know what deserves testing, then test the things that turned out to matter.

Example: an agency proudly produced a clean vulnerability scan for its carrier. The scan covered the office network. The agency's actual exposure was a cloud-hosted management system reached from producers' home laptops, none of which the scan had ever touched.

What does the assessment actually examine in an agency?

It examines every place policyholder data is created, moved, stored, or reachable — which in a modern agency is a longer list than most principals expect. The agency management system is the obvious one; it is rarely the whole answer.

A thorough agency assessment covers:

• The agency management system — who has access, what they can export, whether audit logging is enabled and retained.
• Carrier portals and download connections, including how credentials are stored and shared among staff.
• Comparative raters and quoting platforms, which touch full applicant data.
• Email — the single largest uncontrolled store of nonpublic information in most agencies, full of scanned applications and attachments going back years.
• E-signature, document storage, and any shared drive holding scanned files.
• Payment handling, premium finance, and anywhere bank or card data is keyed or stored.
• Endpoints — office workstations, producers' laptops, personal phones with agency email on them.
• Remote access, VPN, and any lingering remote-desktop connection set up during a hurricane or a move.
• Backups — whether they exist, whether they are separated from the live environment, and whether a restore has ever been tested.
• People and process — onboarding and offboarding, training, and the procedure for verifying a request to change payment or banking details.
• Paper. Filing cabinets, the scanning backlog, and what happens to applications left in a producer's car.

Example: the finding that surprises agencies most often is email retention. A twelve-person agency discovered roughly nine years of mailbox history containing thousands of attached applications, each with a Social Security number, none of it encrypted and all of it reachable with one stolen password.

What counts as nonpublic information, and where does it live in an agency?

Under the insurance data security framework, nonpublic information covers business information whose exposure would materially harm the licensee, plus consumer information tied to an identifiable person — including Social Security number, driver's license or state ID number, financial account or card number, security codes and passwords that would permit account access, and health or medical information. In an agency, that is most of what crosses the desk.

Personal lines applications carry SSNs, dates of birth, driver's license numbers, and household detail. Life and health applications add medical history. Commercial lines add employee census data and, on workers' compensation, payroll and injury records. Claims files add everything again, plus bank details for payment.

The assessment's job is to map that data rather than assume it. Agencies routinely find nonpublic information in places with no controls at all: a spreadsheet a producer built for a marketing campaign, an export from a carrier the agency no longer represents, or a shared folder created for one project in 2019 and never removed.

Example: during one review, the largest single concentration of Social Security numbers in the agency was not the management system. It was a folder of scanned commercial applications on a desktop PC under the receptionist's counter, which was also the machine no one had ever patched.

How does the assessment feed a written information security program?

The assessment supplies the findings; the program is the agency's documented answer to them. The statute expects the program to be commensurate with the size and complexity of the licensee, which is why a nine-person agency's program should not read like a carrier's — but it does have to exist, be written, and be maintained.

A program built from a real assessment typically documents:

• Who owns the program, and how the board or senior management oversees it.
• Administrative, technical, and physical safeguards selected in response to identified risks.
• Access control — who can reach which data, reviewed on a schedule rather than at hire.
• Encryption of nonpublic information in transit and at rest, or a documented reason an equivalent control was chosen instead.
• Multi-factor authentication on email, remote access, and the management system.
• Audit trails sufficient to reconstruct a cybersecurity event afterward.
• Staff training, and testing of key controls.
• Secure disposal of nonpublic information no longer needed for business or legal purposes.
• A written incident response plan with named roles.

Programs also have to be revisited. Risks change when the agency adds a carrier, adopts a new rater, acquires a book, or moves staff to remote work — each of which is a reason to revisit the assessment rather than wait for the annual cycle.

Example: the shortest useful program we have helped an Alabama agency produce ran nine pages. The longest was forty-one, and the agency could not follow it. Length is not the measure; whether the staff can actually do what it says is.

What about carrier connections and third-party vendors?

Vendor risk is the dominant risk in this sector, and the assessment has to treat it that way. SecurityScorecard's 2025 research found that 59% of breaches affecting the insurance sector originated with a third party — roughly double the 29% cross-industry rate. An agency can secure its own office perfectly and still be breached through a platform it does not control.

Alabama's statute requires a non-exempt licensee to exercise due diligence in selecting third-party service providers and to require them to implement appropriate safeguards. Practically, the assessment should produce a vendor inventory that captures, for each one:

• What agency or policyholder data the vendor can reach, and whether that access is still needed.
• Whether a security review, SOC 2 report, or equivalent assurance was obtained — and when it was last refreshed.
• What the contract says about safeguards, breach notification, and data return or destruction at termination.
• Whether the vendor's own access credentials are individually assigned and multi-factor protected.

The overlooked category is nearly always the small one: the local scanning service, the marketing contractor with a mailing list, the bookkeeper with remote access to the accounting system, the former IT provider whose admin account was never disabled.

Example: an agency's vendor inventory came back with eleven names on it. The principal had estimated four. Two of the seven he had forgotten still held live administrative access.

What happens after a cybersecurity event, and how fast must we report it?

Fast. Under Ala. Code § 27-62-6, a licensee must notify the Commissioner as promptly as possible and in no event later than three business days from determining that a cybersecurity event has occurred. That is one of the tightest reporting clocks a small Alabama business will encounter.

The obligation is triggered when Alabama is the licensee's home state and the event has a reasonable likelihood of materially harming a consumer or disrupting normal operations, or when the licensee reasonably believes at least 250 Alabama residents are involved and the event meets the accompanying conditions. The report itself asks for detail — the statute lists more than a dozen categories, including when the event happened, how it was discovered, what specific types of information were acquired, the period of compromise, what internal control lapses contributed, and what the agency has done since.

Two things follow from that list. First, an agency that has not been logging cannot answer most of it. Second, the insurance report is not the only one — the Alabama Data Breach Notification Act separately governs notice to affected individuals, generally within 45 days, with notice to the Attorney General when more than 1,000 residents are notified. Carriers frequently impose their own notification terms on top.

Reporting decisions should be made with counsel and your carrier, not from a web page — but the preparation that makes those decisions possible is ordinary security work done in advance.

Example: three business days is not three days of investigation. The clock starts at determination, and an agency that spends the first two days deciding who to call has already spent most of it.

What does a risk assessment cost, and how often should we do one?

For a small or mid-sized agency, a risk assessment is typically a defined, one-time engagement priced on scope — how many people and locations, how many systems and vendors, and whether the deliverable includes a written information security program alongside the findings. It costs meaningfully less than the security tooling it will recommend, which is the point of doing it first.

On cadence, annually is the working standard, with an out-of-cycle reassessment whenever something material changes: an acquisition, a new agency management system, a move to remote or hybrid work, a new carrier relationship with its own access requirements, or an actual incident.

Two cost factors specific to agencies are worth naming. Cyber liability applications now ask detailed control questions, and an agency that cannot attest to multi-factor authentication and tested backups will face higher premiums or narrowed coverage — a conversation agency principals have on the other side of the desk every day. And errors and omissions exposure is real: a client whose data is exposed through the agency is a client the agency advised on risk.

Example: an agency that had been quoting cyber coverage to its own commercial clients for years discovered during its first assessment that it could not have answered its own carrier's application truthfully. It fixed four controls before renewal.

How do we choose someone to run the assessment?

Choose on the deliverable and the independence of the advice, not on the length of the report. The assessment is worth what the agency can actually do with it, and a document written to justify a product bundle is worth very little.

Questions worth asking every candidate:

• Have you assessed insurance agencies specifically, and do you know how agency management systems and carrier downloads work?
• Will the report map to Alabama's Insurance Data Security Law by section, so we can show which finding satisfies which obligation?
• Does the deliverable include a written information security program, or only findings?
• Will you inventory our third-party vendors and carrier connections, not just our network?
• Are findings prioritized by risk to us, with a realistic sequence and cost range for each?
• Will you tell us which controls we do not need yet?
• Can we hand this report to a carrier or a cyber underwriter as it stands?
• Who owns the findings afterward, and what does remediation cost if we engage you for it?

A provider who scopes before quoting, and who is willing to say a recommendation is optional, is generally the one to work with.

Example: the most useful thing one agency principal did was ask two finalists to show a sample report with the client details removed. One produced a tailored twenty-page document. The other produced a scan export with a cover page.