NAIC Compliance Checklist for Insurance Agencies (2026)
Table of Contents
1. What Is the NAIC Data Security Model Law?
The NAIC Insurance Data Security Model Law (MDL-668) was developed by the National Association of Insurance Commissioners (NAIC) in 2017 in response to the growing threat of data breaches in the insurance industry. It establishes a baseline standard for how insurance licensees must protect consumer data.
The Model Law was modeled after New York's groundbreaking 23 NYCRR 500 regulation but broadened for the full insurance sector. It requires all insurance licensees to develop and implement a comprehensive Written Information Security Program (WISP), conduct regular risk assessments, implement technical safeguards, maintain an Incident Response Plan, and oversee the data security practices of their third-party vendors.
Unlike some compliance frameworks that offer voluntary adoption, MDL-668 is law in each state that has enacted it, with enforcement authority granted to state insurance commissioners who can investigate, fine, and take license action against non-compliant agencies.
2. Who Must Comply?
The NAIC Model Law applies to any individual or entity that holds an insurance license or certificate of authority in an enacted state. This is a broad definition that captures virtually every participant in the insurance distribution chain:
Some states provide limited exemptions for very small licensees (fewer than 10 employees in some jurisdictions), but these exemptions are narrow and do not waive all requirements. Do not assume your agency is exempt without confirming with your state's implementation language.
3. Which States Have Enacted It?
As of early 2026, more than 28 states have enacted versions of the NAIC Data Security Model Law. Additional states introduce legislation each session.
If you hold licenses in multiple states, you must comply with the requirements in each enacted state where you are licensed. In most cases, meeting the most stringent state's requirements will satisfy all others.
4. The 6 Core Requirements
1.Written Information Security Program (WISP)
The WISP is the foundation of NAIC compliance. It must be a written document, not a mental checklist, that describes your agency's overall approach to protecting nonpublic information (NPI). It must be tailored to the size, complexity, and nature of your operations, identify the types of NPI you collect and store, define employee responsibilities for data protection, and designate an Information Security Officer (ISO). The WISP must be reviewed and updated at least annually.
2.Risk Assessment
At least annually, you must conduct a formal risk assessment to identify reasonably foreseeable internal and external threats to NPI, assess the likelihood and potential damage of each threat, evaluate the sufficiency of existing safeguards, and document the results. The risk assessment drives your remediation priorities and must be retained for the 5-year record retention period.
3.Data Protection Safeguards
Based on the risk assessment results, you must implement and maintain appropriate technical, physical, and administrative safeguards. Specific technical controls required or strongly implied by the Model Law include: encryption of NPI at rest and in transit, multi-factor authentication on systems that access NPI, endpoint security controls, role-based access management, and regular security testing. The adequacy of safeguards is judged relative to the risk identified in the assessment.
4.Incident Response Plan (IRP)
You must have a written plan for responding to cybersecurity events. The IRP must define roles and responsibilities, outline containment and remediation procedures, establish timelines for notifying the state insurance commissioner (typically within 72 hours of determining a cybersecurity event has occurred), and define consumer notification procedures. The IRP should be tested via tabletop exercise at least annually.
5.Third-Party Vendor Oversight
You are responsible for the data security practices of vendors who access your NPI or systems on your behalf. The Model Law requires maintaining an inventory of all such vendors, conducting due diligence before engagement, including contractual security requirements, and periodically reviewing vendor security practices. This covers your AMS/CRM vendors, cloud storage providers, IT support firms, and any other third party touching your data.
6.5-Year Record Retention
All documentation related to your information security program must be retained for a minimum of five years. This includes risk assessment reports and remediation records, WISP versions and update history, audit logs, incident response records and breach notifications, vendor security agreements, and employee training records. Regulators may request these records during an examination or investigation.
Not sure if your agency meets these requirements?
Take our free 5-minute compliance assessment5. Compliance Checklist
Use this checklist to evaluate your agency's current compliance posture. For each item, mark whether it is fully in place, partially addressed, or not yet implemented.
Written Information Security Program
- Board or senior management approved WISP in writing
- WISP tailored to agency size, complexity, and data sensitivity
- Annual review and update process documented
- Designated Information Security Officer identified
- Employee roles and responsibilities defined
Risk Assessment
- Formal risk assessment conducted within the past 12 months
- Assessment identifies all systems containing nonpublic information
- Threats and vulnerabilities documented with risk ratings
- Remediation priorities and timelines assigned
- Results retained for minimum 5 years
Technical Safeguards
- Encryption of nonpublic information at rest and in transit
- Multi-factor authentication (MFA) on all systems with NPI access
- Endpoint detection and response (EDR) deployed
- Role-based access controls limiting data access to need-to-know
- Network monitoring / SIEM in place
- Tested, offsite backups with recovery procedures
Incident Response Plan
- Written IRP with clearly defined roles and escalation paths
- 72-hour regulatory notification procedure documented
- Consumer notification templates and procedures ready
- IRP tested via tabletop exercise within the past year
- Post-incident review and lessons-learned process defined
Third-Party Vendor Oversight
- Complete inventory of all vendors with NPI access
- Security due diligence process for new vendors
- Minimum security requirements written into vendor contracts
- Annual vendor security reviews conducted
- Process for offboarding vendors and revoking access
Record Retention
- All compliance documentation retained for minimum 5 years
- Risk assessment records and remediation logs archived
- Audit trails and access logs retained
- Incident records and breach notifications stored
- Vendor security agreements on file
6. Penalties for Non-Compliance
State insurance commissioners have broad enforcement authority under enacted versions of the NAIC Model Law. Penalties can be severe, particularly after a data breach reveals non-compliance.
Financial Fines
$10,000 or more per violation, per day, that the violation continues. Regulators have levied fines exceeding $1 million against insurers in the first years of enforcement.
License Actions
Suspension or revocation of your insurance license is possible for serious or willful violations, effectively shutting down your agency's ability to operate.
Breach-Related Costs
Without a compliant WISP and IRP, a data breach exposes your agency to $150,000-$500,000+ in notification costs, consumer litigation, and regulatory penalties on top of base fines.
Reputational Damage
Regulatory enforcement actions are public record. A publicized fine or license action can damage carrier relationships, referral sources, and client trust that took years to build.
7. How to Get Compliant Fast
Most agencies are not starting from zero, you likely have some informal practices that partially address these requirements. The challenge is formalizing, documenting, and maintaining them to satisfy a regulator's examination.
Evolv Technology Solutions has developed a proven 3-step process specifically for insurance agencies that delivers full initial compliance within 48 business hours:
Our 5-minute online assessment identifies your specific compliance gaps across all six NAIC requirement areas. This is free and takes less time than a coffee break.
Based on your assessment results, our team delivers a custom WISP, risk assessment, incident response plan, and vendor oversight documentation, all written for your agency specifically, not a generic template.
Compliance is not a one-time event. We provide ongoing annual reviews, policy updates, incident response support, and documentation updates as your agency grows and regulations evolve.
Ready to close your compliance gaps?
Take our free 5-minute compliance assessment and get a personalized gap report for your agency, no obligation.
TAKE THE FREE ASSESSMENTLegal Disclaimer: This article is provided for informational purposes only and does not constitute legal advice. Insurance compliance requirements vary by state, licensee type, and the specific version of the NAIC Model Law enacted in each jurisdiction. Consult qualified legal counsel and a licensed compliance professional before making decisions about your agency's information security program. Evolv Technology Solutions is a technology and cybersecurity firm, not a law firm.