IT Support for Insurance Agencies: Security, Compliance, and the Systems You Rely On

Insurance agencies are a favorite target for cybercriminals, and it’s easy to see why. A typical agency holds Social Security numbers, driver’s license numbers, bank details, health information, and policy data for thousands of clients — and moves money and documents by email all day long.

At the same time, agencies run on a specific stack of systems — agency management software, carrier portals, comparative raters, e-signature tools — and face a growing set of state data security regulations. Generic IT support often misses both. This guide covers what insurance agencies actually need from their IT.

Why insurance agencies are high-value targets

• Rich personal data. Client files contain everything needed for identity theft.
• Money movement. Premium payments, commissions, and claim disbursements make agencies prime targets for wire fraud and invoice scams.
• Email-driven workflows. Quotes, applications, and loss runs fly back and forth by email — the most common entry point for attacks.
• Access to carriers. A compromised agent login can be a stepping stone into carrier systems.

The most common attack isn’t sophisticated hacking. It’s business email compromise: an attacker phishes one employee’s mailbox, quietly watches conversations, then sends a convincing request to change payment details. Without MFA and email security, it’s alarmingly easy.

The regulations that apply to agencies

State insurance data security laws (NAIC Model Law #668)

The NAIC Insurance Data Security Model Law sets cybersecurity requirements for licensed insurance entities, including agencies and producers. Roughly half of U.S. jurisdictions have adopted a version of it, and the list keeps growing. Where it applies, licensees generally must:

• Maintain a written information security program based on a risk assessment
• Designate someone responsible for the program
• Oversee third-party service providers that handle nonpublic information
• Investigate cybersecurity events and notify the state insurance commissioner within set timeframes
• In many states, certify compliance annually

Most state versions include exemptions for smaller licensees based on employee count or revenue, but the thresholds vary — and exempt agencies still face breach notification duties and carrier expectations. Check your state insurance department’s guidance for the exact rules.

New York: NYDFS Cybersecurity Regulation (23 NYCRR Part 500)

Agents and brokers licensed in New York fall under the Department of Financial Services cybersecurity regulation, one of the strictest in the country. Its final amended requirements took effect on November 1, 2025, expanding multi-factor authentication for anyone accessing agency systems and requiring a written asset inventory. Limited exemptions exist for small licensees, so confirm exactly which sections apply to you.

Other overlapping rules

Depending on your lines of business, other requirements may apply — for example, HIPAA for agencies handling health insurance data, and state breach notification laws for every agency that holds personal information. If you work with health plans, our HIPAA IT compliance checklist covers the technical safeguards in detail.

The IT foundations every agency needs

• Multi-factor authentication everywhereEmail, agency management system, carrier portals, remote access, and banking. This single control stops most account takeovers.
• Advanced email securityFiltering that catches phishing, impersonation, and malicious attachments — plus banners that flag external senders.
• Endpoint detection and response (EDR)Modern protection that detects ransomware behavior, not just known viruses.
• Encrypted devicesEvery laptop and phone that touches client data should be encrypted and remotely wipeable.
• Tested, ransomware-resistant backupsIncluding Microsoft 365 mailboxes and OneDrive, which aren’t fully protected by default.
• Security awareness trainingRegular phishing simulations so staff recognize a fake payment-change request.
• A written verification process for paymentsAlways confirm changes to banking details by phone using a known number — never by replying to the email.
• Documented policies and an incident response planWhat your state’s data security law expects — and what you’ll want on hand if something happens.

Supporting the systems agencies run on

Good agency IT goes beyond security. Your team lives inside a handful of business-critical applications, and downtime there means lost quotes and frustrated clients. An IT partner should know how to support:

• Agency management systems such as Applied Epic and AMS360 — user setup, integrations, performance, and access controls
• Carrier portals and download connections, plus clearinghouses like Availity for agencies in health lines
• Comparative raters and e-signature tools used every day in the quoting process
• Microsoft 365: secure email, Teams, and file sharing configured for regulated data
• VoIP phones and call recording that clients and compliance teams rely on

Cyber insurance: practice what you sell

Agencies understand cyber insurance better than anyone — and carriers now hold them to the same standard as other insureds. Applications routinely ask about MFA, EDR, backups, email security, and employee training. Weak answers can mean higher premiums, exclusions, or a declined application. Strong IT controls make your own renewal easier and give you first-hand credibility when you advise clients on cyber coverage.

What to look for in an IT provider for your agency

1. Experience with insurance agencies and the systems you use
2. Familiarity with state data security laws and the documentation they require
3. Security included by default, not sold piecemeal
4. 24/7 monitoring, since attacks rarely happen during business hours
5. Fast, friendly help desk support so producers and CSRs aren’t stuck waiting
6. Help with carrier and cyber insurance questionnaires

How Cyborpixel helps agencies

Cyborpixel works with insurance agencies on exactly this stack — from Applied Epic and AMS360 support to email security, MFA rollouts, and the written security program state laws expect. Our managed IT plans bundle 24/7 monitoring, security tooling, and help desk support in one predictable package.

Book a free IT assessment and we’ll review your agency’s setup against these requirements and show you what we’d fix first. Weighing your options? Read managed IT vs. in-house IT.

Last updated October 12, 2026