Insurance NAIC WISP in 28 days, carrier appointment re-affirmed
Evolv Technology Solutions · April 2026
Composite engagement disclosure
This case study is an anonymized composite drawn from Evolv's engagement patterns with independent insurance agencies in West Michigan. Specific control counts, carrier names, premium-reduction percentages, and AMS vendor are generalized to protect client confidentiality. Timelines, costs, and outcome patterns are characteristic of how these engagements actually run.
Engagement at a glance
Industry: Property and casualty insurance, multi-line agency. Size: 45 employees, 12 producers, $3.8M revenue. Trigger: Carrier appointment review questionnaire asking for proof of NAIC MDL-668 WISP. Engagement type: NAIC WISP program ($7,500 starting). Duration: 28 days. Status: Delivered, two carrier appointments re-affirmed.
The situation
A 45-employee independent P&C agency in Lansing, Michigan operates as an MGA for several specialty carriers in addition to its retail book. The principal carrier's annual appointment review questionnaire, which the agency has filled out for six years without issue, now includes a new section asking for the agency's NAIC Model Law MDL-668 Written Information Security Program, the designated security coordinator, the date of the most recent risk assessment, and a list of third-party service providers with documented vendor risk reviews.
The agency does not have a WISP. The owner's first call is to their attorney, who says yes, you need one, and bills two hours to confirm the obvious. The second call is to their existing MSP, who proposes a $25,000 / 6-month engagement to "do compliance work." The third call is to Evolv after a producer at the agency runs the Scorecard.
What we did
Engagement structure: a 28-day fixed-scope NAIC WISP delivery program, $7,500 starting. This is the agency's first formal cybersecurity program; existing tools (EDR, MFA, encrypted email) were largely in place, but documentation and governance were not.
Days 1-7, assessment and scoping. We ran a focused risk assessment against the NAIC MDL-668 control set. The output was a list of: existing controls (with evidence), gaps requiring policy work, gaps requiring new technical controls, and the documentation artifacts the WISP would reference. Of the agency's 47 mapped controls, 28 were operationally in place but undocumented; 12 required policy work; 7 required new implementations.
Days 8-18, policy and documentation drafting. We drafted the WISP itself (a 22-page document for this agency size), the security policy, the incident response plan, the third-party service provider risk template, the annual training plan, and the board reporting cadence. Each policy was reviewed with the agency owner and the operations manager.
Days 19-25, implementation of new technical controls. The seven new technical implementations rolled out: MFA enforcement on remote access for the producer workstations that didn't yet have it, encrypted backups for the AMS server, conditional access policies in Microsoft Entra, audit logging for the AMS and email tenant, written vendor agreements with the agency's three principal SaaS vendors (AMS, accounting, e-signature).
Days 26-28, training and finalization. Two 30-minute training sessions delivered to the full staff. WISP acknowledgment forms signed by every employee. Documentation package compiled and delivered.
Outcomes
WISP delivered in 28 days. Industry typical for a firm starting from this baseline is 90-180 days through traditional MSP or compliance-consultant engagements.
Carrier appointment re-affirmed within 45 days of WISP submission. A second specialty-carrier appointment was also re-affirmed in the same renewal cycle.
Total engagement cost: $9,200 ($7,500 base WISP program + $1,700 in scope expansion for the seven new technical controls). Below the existing MSP's $25,000 quote by roughly 2.7x.
Cyber-insurance renewal premium decreased 11% at the following renewal, attributable to the documented WISP and the controls evidence.
One AMS vendor relationship transitioned from no contract to a written service agreement with appropriate data-handling terms, addressing a vendor-risk finding the principal carrier had flagged.
What to do next
If your agency is licensed in any NAIC-adopted state and you're 10+ employees, NAIC Model Law MDL-668 applies. The Scorecard's insurance variant maps your agency against MDL-668 requirements and produces a WISP scoping estimate in 5 minutes.
Run the Scorecard →, 5 minutes.
Book a WISP scoping call →, 20 minutes with a named human within four business hours.
For the full engagement details: /naic-compliance.