Data Security Checklist

NYDFS 23 NYCRR 500.4 requires a designated CISO accountable for the cybersecurity program; the role can be in-house or a qualified third party but accountability stays with the Covered Entity. Confirm the named CISO and whether a written delegation exists if outsourced to an MSSP or virtual CISO.

The GLBA Safeguards Rule and the NAIC Insurance Data Security Model Law each require a written program covering administrative, technical, and physical safeguards over NPI. Pull the current WISP, mark redlines for the past year's material changes (new products, acquisitions, vendor swaps), and route for executive approval.

NYDFS Part 500.9 expects a risk assessment that drives the controls in the program; HIPAA Security Rule expects the same on the PHI side for stop-loss and group health writers. Re-run if there has been a material change mid-year — biennial-only programs after a new product launch or major vendor swap fail exam.

Part 500.12(b) requires MFA for any individual accessing internal networks from an external network — including TPAs, wholesalers, and IT contractors with VPN credentials. Pull the IdP report (Okta, Entra, Duo) and reconcile against the contractor roster; treating MFA as employee-only is a common finding.

Part 500.15 requires encryption of NPI in transit over external networks and at rest, or a CISO-approved compensating control. Spot-check the AMS database, document repositories (ImageRight, ePolicy), claim-file shares, and any SFTP feeds to wholesalers and reinsurers.

Part 500.5 requires annual penetration testing and bi-annual vulnerability assessments based on the risk assessment. Confirm scope covers PolicyCenter, ClaimCenter, the AMS, and any insured-facing portals. Pen-tests scoped only to the corporate network miss the policy and claims surface.

Part 500.6 requires audit trails sufficient to detect and respond to a cybersecurity event, retained for at least three years for material events and five years for financial transactions. Confirm SIEM ingestion from the AMS, policy admin, claims, and email gateway.

The GLBA Privacy Rule requires an annual notice with opt-out for non-affiliate sharing. Vermont requires opt-in; California personal-lines insureds need CCPA/CPRA-aligned disclosures. Don't reuse a national form letter without state overlays.

Most states require 5–7 years of policy and claim file retention; workers comp often 10+ years given lifetime medical on occurrence-based coverage. Premature destruction creates discoverable spoliation risk; over-retention expands breach exposure. Reconcile the schedule against ImageRight and any legacy archive.

Many carriers screen at policy issuance but not at every claim payment, missing names added to the SDN list mid-policy. Pull a sample of recent claim payments and confirm each was OFAC-cleared at disbursement, not just at FNOL.

Part 500.14 requires regular cybersecurity awareness training for all personnel, updated to reflect risks identified in the risk assessment. Cover phishing, social engineering targeted at producers (fake binding requests), and recorded-statement consent rules for adjusters.

Use KnowBe4, Proofpoint, or equivalent. Tailor lures to the agency's actual workflow — fake ACORD 25 requests, spoofed wholesaler emails, fake premium-finance notices. Track click and report rates by team.

Plan must address the NAIC Insurance Data Security Model Law 72-hour DOI notification window — shorter than HIPAA's 60 days and shorter than most state breach laws. Many IR plans default to the longest window and miss the DOI clock. Name the DOI contact in every state of operation.

Walk through who drafts the DOI notice, who signs it, and how it gets filed in each state's portal. Confirm parallel tracks for state attorneys general, affected individuals, and HHS for any health-insurance lines. Capture timing benchmarks against the 72-hour clock.

Scenario should hit a realistic insurance-specific vector: ransomware on the AMS, BEC against a producer binding an account, or NPI exfiltration from a TPA. Include underwriting, claims, IT, legal, and the CISO.

For each gap, name an owner, a target date, and the control framework reference (Part 500 section, NAIC Model section, or NIST CSF subcategory). Route to the CISO and capture in the next board report.