The NAIC Guidance

The Principles for Effective Cybersecurity: Insurance Regulatory Guidance[1] looks to state insurance regulators “to ensure that personally identifiable consumer information held by insurers, producers and other regulated entities is protected from cybersecurity risks.”The guidance encourages insurers, agencies, and producers to secure data and maintain security with nationally recognized efforts such as those embodied in the National Institute of Standards and Technology (“NIST”) framework. While the NIST framework provides guidance to organizations of all sizes on managing and reducing cybersecurity risk, individual producers also should be taking security precautions as they also are at risk for losing personally identifiable information (“PII”) of prospects and clients.

Although there currently are no regulations stipulating that insurers must take certain steps to ensure the security of their data, that often follows “guidance” for organizations, such as in the Payment Card Industry Data Security Standards (“PCI DSS”). The guidance provides best practices, and even though it is not yet a requirement, it could set insurance agents, brokers, agencies and insurance companies up for lawsuits if they do not comply with the guidance. If the guidance ever becomes a requirement, fines could be imposed upon those who do not comply.

NIST Framework

The NIST Framework is written in language that is easy to understand and includes practices that have been developed by SANS, Information Systems Audit and Control Association, and the International Standardization Organization (“ISO”), among the most respected organizations in cybersecurity. Although NAIC specifically called out the NIST Framework, there is no single one “best” framework to follow. Based on the industry and goals of a company, security consultants may recommend a mix of recommendations from the aforementioned organizations in order to protect prospects' and clients' protected health information (“PHI”) or personally identifiable information (“PII”) (a person's full name, date of birth, address, and Social Security number).

The NIST Framework provides a set of activities to achieve desired specified cybersecurity outcomes. The framework is written in simple language, to help companies protect their data, and to detect and respond to and recover from possible breaches in a timely manner.

A security consultant who specializes in threats and cybersecurity can assess networks and help insurance companies secure them using the NIST Framework and other standards. Consultants for the insurance industry should be familiar with common threats targeting the industry, as well as the tactics, techniques, and procedures attackers are using around the globe.

Conclusion

Although independent agents and brokers may not have a network to protect, at the very least they should take applicable steps to secure their computers that contain information on prospects and clients. Insurers, brokers, and agents should ensure their computers are password protected so an intruder would be unable to access data on it. They should also use a private network at home and a virtual private network (“VPN”) whenever connecting to a public network. Using a public network at a coffee shop or restaurant makes one easy prey for attackers to snoop and see everything one is doing on the computer. Attackers on public networks can see all the sites people visit and everything they type on an online site, such as their login credentials. The right VPN will encrypt all traffic so even if attackers manage to snoop on a user's online activity, all they would see would be intelligible gibberish.

Note

About the Author

Dan Bonnet is the director of Small & Medium Business in North America at Dell SecureWorks, a global information services security company. He may be contacted at [email protected].