Skip to content

For Insurance Agencies

Your agency management system is an NPI goldmine and NAIC Model Law 668 says you are responsible for it.

Every client SSN, DOB, driver license, and bank account lives in your AMS and your email archive. One compromised producer account is a reportable breach under most state adoptions of NAIC Model Law 668. Many agencies your size have no monitoring on that layer.

Ask about monitoring Run a free scan first
  • Month to month
  • No setup fees
  • Cancel anytime
28 jurisdictions

US jurisdictions, including Puerto Rico, that have adopted the NAIC Insurance Data Security Model Law (#668)

Source: NAIC Model Law 668 adoption map, October 2026

Credentialed, insured, operational

  • RegisteredND LLC
  • IRS registeredEIN on file
  • E&O insured$1M per claim, $2M total
  • EncryptedYour data, at rest and in transit
  • Sign-inAlways a second step
  • Audit trail365-day retention

Threats we catch

Three attacks aimed at insurance agencies.

36 detection engines check your Microsoft 365, Google Workspace, AWS and Cloudflare accounts every five minutes. Critical threats surface instantly. Normal activity gets filed away.

NPI theft at scale

A producer inbox holds quotes with full SSNs, DOBs, driver license numbers, and prior-claim history. One account takeover exfiltrates the entire book of business — and every state you write in imposes notification obligations.

Carrier credential harvesting

Phishing targeted at producers to steal carrier-portal logins. The attacker binds fraudulent policies, cancels real ones, or rebates commissions to their own accounts before you notice.

Client bank-account rerouting

Auto-pay setup emails intercepted in a hijacked inbox, then replayed with new routing numbers. Clients think they are paying their premium; the money goes to the attacker and the policy lapses.

36 detection engines Every five minutes
NPI theft at scaleFlagged. You get a text with the steps to fix it.

Example alert for a made-up business.

Your blind spot

What a typical IT setup does not watch.

  1. Producers work from home, from their car between appointments, and from the carrier's office — and every new sign-in pattern looks similar to an attacker.
  2. Most agency management systems (AMS360, Applied, HawkSoft) integrate with email via OAuth apps that nobody audits — a malicious OAuth grant reads every client file.
  3. When the state insurance commissioner asks for your cyber-event timeline, a binder of written policies is not the same as actual detection logs.
  4. A single commission check rerouted to an attacker can also trigger carrier appointment-termination clauses.

The screen is an example for a made-up business, not real customer data.

Compliance alignment

The rules and frameworks we line up to.

SentinelSMB provides the continuous-monitoring, access-control, and incident-response controls these frameworks require. Pro subscribers get the audit-ready evidence package.

  1. NAIC Model Law 668

    Insurance Data Security Model Law

    Adopted as state law in 28 jurisdictions (more than half the states), Model Law 668 requires licensees to implement a written information security program with ongoing risk assessment, access controls, and regular testing and monitoring of systems holding NPI.

  2. GLBA Safeguards Rule

    Non-public personal information

    Insurance producers are financial institutions under GLBA. The amended FTC Safeguards Rule (effective June 2023) requires a designated qualified individual, an incident response plan, and either continuous monitoring or periodic penetration testing.

  3. State insurance department regs

    Cyber-event notification windows

    Model Law 668 requires notice to the insurance commissioner no later than 72 hours after determining a cybersecurity event occurred. SentinelSMB provides the exact detection timestamps and evidence you need to meet those windows.

  4. NY DFS 23 NYCRR 500

    Financial services cybersecurity

    If you are licensed in New York, 23 NYCRR 500 imposes specific access-control, audit-trail (500.6), and user-activity monitoring (500.14) requirements. SentinelSMB supports the monitoring and logging controls.

Questions

Questions insurance agencies ask.

Text Cole at (701) 391-5973
Does SentinelSMB make us NAIC Model Law 668 compliant?

SentinelSMB provides the continuous-monitoring, access-logging, and incident-response components Model Law 668 requires. You still need a written information security program, designated qualified individual, and documented risk assessment. Pro subscribers get the policy-template foundation for the written program.

How does this fit with our carrier appointment requirements?

If a carrier asks about your security controls, a monitoring record gives you a real answer. Pro subscribers get a quarterly evidence report built from real monitoring data.

What if we write in multiple states with different requirements?

SentinelSMB maps your monitoring to NAIC Model Law 668, GLBA, NY DFS 23 NYCRR 500, and the patchwork of state insurance department regs. The compliance page in your dashboard shows framework-by-framework status.

Can you help with our cyber-event notification window?

Yes. When we detect a threat, you get an exact timestamp, the affected accounts, and the evidence we saw — which is what the commissioner will ask for. For Pro subscribers, Incident Response Access is included.

Every producer, every carrier portal, every AMS login — watched around the clock.

NAIC 668 compliance is not a binder of policies. It is actual monitoring. Get live in under 10 minutes. Cancel anytime.

Ask about monitoring See pricing