NAIC WISP, HIPAA, IRS Pub 4557, CMMC L2: which one applies to your firm, and by when

The 5-minute answer

Most small and mid-size firms in West Michigan are subject to one — sometimes two — of four cybersecurity-compliance regimes: NAIC WISP if you're licensed in insurance, HIPAA if you touch protected health information, IRS Pub 4557 if you prepare tax returns, and CMMC if you're in the DoD supply chain. The deadline for each is real, the penalty for missing it is documented, and a single Written Information Security Program (WISP) written correctly can satisfy three of the four with the same core controls. This article tells you which framework applies, by when, what the penalty looks like, and how the four overlap.

The fast filter: if you're a state-licensed insurance producer with 10 or more employees, NAIC Model Law MDL-668 applies in any state that has adopted it — 28+ jurisdictions as of early 2026. If you're a HIPAA-covered entity or business associate, HIPAA applies. If you're a CPA or tax-prep firm subject to IRS authority, Pub 4557 applies. If you're in the DoD supply chain — directly or as a subcontractor — CMMC L1 or L2 applies depending on the data you handle.

If more than one applies, the right move is almost always to write one cybersecurity program that satisfies the most demanding of them. We cover that consolidation pattern at the bottom.

Score your compliance posture in 5 minutes → — the output maps your firm against every framework that applies.

The four frameworks at a glance

| Framework | Who it applies to | When it kicks in | Typical first-year cost | Penalty for non-compliance | |---|---|---|---|---| | NAIC WISP (Model Law MDL-668) | State-licensed insurance producers, agencies, MGAs in adopted states, 10+ employees | When you are licensed in an adopted state; ongoing | $5K–$25K (small agency) | DOI fines, appointment review, license risk | | HIPAA Security Rule | Covered entities (providers, plans, clearinghouses) and Business Associates | When you create, receive, maintain, or transmit ePHI | $10K–$50K (small practice) | OCR fines up to $2M+ per violation tier, mandatory breach notification | | IRS Pub 4557 (Safeguards) | Tax-return preparers subject to IRC §7216 and FTC Safeguards Rule | When you prepare returns for compensation | $5K–$30K (small firm) | Tax practitioner sanctions, FTC penalties, business loss | | CMMC L1 / L2 | DoD contractors and subcontractors handling FCI (L1) or CUI (L2) | Phased rollout starting 2025; in contract clauses now | $50K–$200K (L2 small/midsize) | Loss of DoD contracts, primary contractor pass-through risk |

If you appear in any row, the framework applies to you. If you appear in multiple rows, write one program that covers all of them.

NAIC WISP (Model Law MDL-668)

Who it applies to: every entity licensed by a state department of insurance — producers, agents, agencies, MGAs, third-party administrators — in any state that has adopted the model law. As of early 2026, at least 28 jurisdictions have adopted some version of NAIC MDL-668. The 10-employee exemption applies in most adopting states; HIPAA-covered licensees are exempt in many of them. The safe default is that if you're a 10+-employee insurance entity in Michigan, Ohio, Illinois, Indiana, or most other adopted states, you're in scope.

What it requires: a Written Information Security Program (WISP) commensurate with the size and complexity of the licensee, the nature of activities, third-party service provider use, and the sensitivity of nonpublic information. In practice this means documented information security policy, designated security coordinator, risk assessment, technical safeguards (access controls, encryption, MFA, secure development), incident response plan, third-party vendor risk program, board reporting cadence, employee training, and annual review.

When it kicks in: the moment you're licensed in an adopted state, with state-specific implementation grace periods that have largely lapsed. In 2026, an in-scope licensee without a WISP is operating in violation.

What the penalty looks like: state DOI fines (typically $500–$50,000 per violation, varies by state), appointment-review actions where carriers re-evaluate your appointment, and in worst cases producer-license review. Carriers themselves increasingly require proof of WISP for new appointments and renewals — the practical penalty often arrives through your carrier book before the DOI gets involved.

How to satisfy it: Evolv delivers a NAIC-compliant WISP for agencies of 10–100 employees in 28 days. The deliverable includes the policy, training materials, incident response plan, vendor risk template, and documentation package ready for DOI audit or carrier appointment review. See /naic-compliance.

HIPAA Security Rule

Who it applies to: HIPAA-covered entities (healthcare providers, health plans, healthcare clearinghouses) and any Business Associate that creates, receives, maintains, or transmits Protected Health Information on their behalf. Your firm is a covered entity if it bills Medicare or Medicaid, accepts most commercial insurance for clinical services, or operates a self-funded employer health plan. Your firm is a Business Associate if you provide services to a covered entity that involve PHI — including IT services, billing, transcription, cloud storage, and increasingly AI tooling vendors.

What it requires: Administrative, Physical, and Technical Safeguards as defined in 45 CFR §164.308–§164.312, plus organizational requirements (BAAs), policies and procedures (§164.316), and breach notification obligations (§164.400 et seq.). Practically: documented security policy, risk analysis, MFA, encryption at rest and in transit (or documented compensating controls), access controls, audit logs, contingency plan including backup and disaster recovery, signed BAAs with every vendor that touches PHI, workforce training, and incident response.

When it kicks in: the moment your firm creates, receives, maintains, or transmits PHI. There is no "small entity" exemption — solo physicians are subject to HIPAA on day one. The 2025-2026 HHS proposed updates strengthen technical safeguards and explicitly call out MFA, encryption, and timely patching as required rather than addressable.

What the penalty looks like: Office for Civil Rights civil money penalties run from approximately $137 per violation (lowest tier) to $2,134,831 per violation per year (highest tier) as of 2026 indexed amounts. Multiple violations per incident multiply. Mandatory breach notification to HHS, affected individuals, and (for breaches of 500+ records) the local media adds reputational cost. State Attorneys General also enforce.

How to satisfy it: a HIPAA-compliant security program covering all three safeguard categories, plus a BAA template and process for every vendor relationship that involves PHI. Evolv delivers this as a CaaS engagement, typically combined with a vCISO retainer for covered entities of 30+ employees. See /caas and /vciso.

IRS Publication 4557 (Safeguarding Taxpayer Data)

Who it applies to: tax return preparers — CPAs, Enrolled Agents, attorneys, and other persons subject to IRC §7216 and the FTC Safeguards Rule (Gramm-Leach-Bliley) as applied to tax practitioners. Any firm that prepares returns for compensation is in scope, regardless of size. Solo practitioners are subject.

What it requires: a written data security plan, designation of a Qualified Individual to oversee the program, risk assessment, employee training, vendor oversight, encryption of customer information at rest and in transit, MFA on systems containing customer information, regular monitoring and testing, written incident response plan, and annual reporting. Pub 4557 is the IRS's plain-English summary of the underlying FTC Safeguards Rule (16 CFR Part 314). The 2023 updates added MFA, encryption, vendor oversight, and incident response as explicit requirements rather than recommendations.

When it kicks in: the moment you begin preparing returns for compensation. The 2023 update to the FTC Safeguards Rule applied universally; subsequent IRS clarifications make clear that tax practitioners cannot rely on partial compliance.

What the penalty looks like: practitioner sanctions under IRC §7216 (criminal misdemeanor for unauthorized disclosure, up to one year imprisonment and $1,000 per violation), FTC civil penalties under the Safeguards Rule, suspension or revocation of Preparer Tax Identification Number, and the operational reality of being unable to e-file. Many state boards of accountancy also incorporate these standards into ethics rules.

How to satisfy it: Evolv delivers a Pub 4557-aligned security program for CPA and tax-prep firms as a CaaS engagement, including the written data security plan, MFA rollout, encryption attestation, vendor oversight template, and training materials.

CMMC Levels 1 and 2

Who it applies to: Defense Department contractors and subcontractors. Level 1 (foundational) applies to any entity handling Federal Contract Information (FCI). Level 2 (advanced) applies to any entity handling Controlled Unclassified Information (CUI). The DOD estimates 118,000+ companies will need CMMC L2 certification; CMMC affects an estimated 300,000+ organizations across the supply chain.

What it requires: Level 1 is 17 FAR 52.204-21 basic safeguarding controls, self-attested. Level 2 is the full set of 110 NIST SP 800-171 controls — every one of which must be fully implemented and operational, with no partial credit, assessed by a CMMC Third-Party Assessment Organization. Controls span access management, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.

When it kicks in: phased rollout beginning 2025 with full implementation through 2028. CMMC clauses are appearing in DOD contracts now. If your prime contractor's contract includes a CMMC clause, the requirement flows down to you. Many primes are auditing their supply chain in advance of formal assessment requirements.

What the penalty looks like: loss of DoD contracts and subcontracts. For CMMC L2, typical certification cost is $100,000–$200,000 for small and mid-size contractors requiring third-party assessment. The penalty for non-compliance is binary: you don't bid, you don't win, you don't keep existing CUI-handling contracts.

How to satisfy it: Evolv delivers CMMC L1 self-attestation programs and L2 readiness programs as CaaS engagements, typically scoped over 6–12 months. For manufacturers and DoD-supply-chain entities, this is often combined with a vCISO retainer to attend the C3PAO assessment.

The cyber-insurance link

All four frameworks intersect with cyber-insurance underwriting in 2026. Underwriters increasingly demand evidence of compliance with whichever framework applies, plus a baseline of common controls. The intersection works in three ways.

First, framework compliance is increasingly a precondition for coverage. A HIPAA-covered entity without documented HIPAA safeguards may be excluded entirely, or covered only at a sub-limit that won't pay out on a meaningful incident. An insurance agency without a WISP may face the same outcome from a cyber underwriter that sells to peers.

Second, premiums are explicitly priced against framework compliance. Underwriters offering 10–25% premium reductions to firms with documented programs are now common. The reduction usually exceeds the marginal cost of maintaining the program, which inverts the conventional "compliance is a cost" framing.

Third, claim payout depends on it. Insurers increasingly deny ransomware and data-breach claims where the insured failed to maintain controls they represented as in place on the application. A firm that attested to MFA on the application and didn't have full MFA coverage at the time of incident may find the policy doesn't pay out — at all.

Net effect: writing the WISP, HIPAA plan, or Pub 4557 plan isn't only about regulatory compliance. It's about whether your cyber policy is real.

What to do if more than one framework applies

This is the most common case among Evolv's clients. A CPA firm that handles tax returns for healthcare practices is subject to both IRS Pub 4557 and (as a Business Associate) HIPAA. An insurance agency that prepares retirement-plan documents for advisors may touch IRS-relevant data. A manufacturer subject to CMMC may also have HIPAA exposure through its self-funded employer health plan.

The right move is consolidation: write one cybersecurity program that satisfies the most demanding framework that applies to you. The common core across all four — risk assessment, written policy, MFA, encryption, access controls, audit logs, incident response, vendor oversight, training, annual review — accounts for 70–80% of the controls in any individual framework. Adding the framework-specific items (BAAs for HIPAA, vendor risk template for NAIC WISP, Pub 4557 written plan attestation, 110 CMMC L2 controls) is meaningfully cheaper than maintaining four parallel programs.

A vCISO engagement is the right vehicle when more than one framework applies. The vCISO maps your firm against each framework, identifies the consolidated control set, manages the gaps, and produces the documentation package each framework expects. See /vciso.

How Evolv handles compliance

We deliver compliance programs as CaaS engagements, optionally combined with vCISO retainers for firms subject to multiple frameworks or requiring board-level reporting. Every engagement starts with the Scorecard, which maps your current state against every framework that applies — not just one. The deliverable per framework is a documented program your firm owns, ready for DOI audit, OCR inquiry, IRS examination, or CMMC assessment.

Two ways to start.

Option 1: Run the Cyber Scorecard. Five minutes. The output maps your firm against NAIC WISP, HIPAA, IRS Pub 4557, and CMMC — whichever apply — and produces a tailored estimate of what consolidation would look like.

Option 2: Book a 20-minute scoping call. A named member of our team responds within four business hours. We walk through which frameworks apply to your firm, your current state on each, and what a consolidated program would deliver.

If insurance compliance is your specific need, /naic-compliance covers the NAIC WISP engagement in detail — including the 28-day delivery guarantee for agencies of 10–100 employees.