Insurance agency IT
IT for agencies that hold everyone’s details.
An agency keeps driver’s license numbers, dates of birth, bank details and claims history for most of its town. Alabama law speaks to how licensees protect that. This page lays out what it asks and how a small agency handles it.
Sample data · “Your Business”
Quick answer
What does Alabama’s insurance data security law require of an agency?
Alabama’s Insurance Data Security Law (Act 2019-98) applies to licensees of the Alabama Department of Insurance, which includes agencies and producers. It calls for a written information security program based on a risk assessment, investigation of any cybersecurity event and prompt notice to the Commissioner. Smaller licensees may be exempt from the written-program section, and exemptions are reported to the Department.
The law, in plain words
Four duties, scaled to your size.
- 01
A written information security program
Based on the agency’s own risk assessment and sized to the agency, with a named person or outside vendor responsible for it. The law lists measures to consider, including access controls, encryption of information sent over outside networks and stored on laptops and portable devices, multi-factor sign-in, testing and monitoring, secure disposal and staff training.
- 02
Care in choosing service providers
The licensee is to use due diligence in selecting third-party service providers and require them to protect the information and systems they can reach.
- 03
Investigate a cybersecurity event
If the agency learns an event has or may have occurred, it must investigate promptly, work out what happened and what information was involved, and keep records of the event.
- 04
Notify the Commissioner
The law requires notice to the Commissioner of Insurance as promptly as possible, within a short period counted in business days, when its conditions are met. Know the reporting route before you need it.
The law exempts licensees under certain size thresholds from the written-program section, and covers a producer who works under another licensee’s program. The Department says exemptions are reported annually. An exemption from the written program is not an exemption from investigating and reporting an event. Ask the Alabama Department of Insurance or your attorney what applies to your agency.
Handling it in a small agency
Where client data actually goes.
Carrier portals
Each carrier has its own sign-in, and most now require a second step. Give every producer and CSR their own login, never a shared one, and keep a list of who has access to which carrier so it can be closed when they leave.
The agency management system
It holds the whole book. Turn on multi-factor sign-in, set access by role, and ask the vendor how your data is backed up and how you would get a full copy out.
Email and attachments
Applications and ID photos arrive by email every day. Move them into the management system and out of inboxes, and send sensitive documents by an encrypted or expiring link.
Paper, scanners and copiers
Shred on a schedule. Office copiers store images on an internal drive, so have it wiped before a leased machine goes back.
Laptops and phones
Encrypt every laptop. Phones that carry agency email need a passcode and remote wipe.
People coming and going
A departing producer can leave with a book of business. Close carrier logins, email and the management system the same day, and keep a dated record.
Your own cyber policy
What the application will ask you.
- Is multi-factor sign-in required for email and for remote access?
- Is security software on every computer, and is it monitored?
- Are backups kept separate from the network, and has a restore been tested?
- Are updates applied on a regular schedule?
- Do staff receive security awareness and phishing training?
- Is there a written incident response plan?
- Are payment and bank-detail changes verified by a phone call to a known number?
You sell these policies, so you know an inaccurate application can cause trouble at claim time. Answer only what you can show, and keep the proof in one folder.
What it costs
One plan, in writing.
Managed IT is $175 per user, per month with a 5-user minimum. Producers and service staff each count as a user.
The same single plan every client gets. Microsoft 365 licenses billed separately at Microsoft’s price.
- Unlimited remote help desk (phone & email)
- 24/7 monitoring and alerting
- Patch management
- Microsoft 365 administration and support
- Multi-factor sign-in setup
- Backup monitoring and management
- Advanced security monitoring
- Network & firewall management
- Security awareness training
- Onboarding and same-day offboarding
- Quarterly on-site visits
- Vendor management
Priced in writing before any work starts.
- IT and security assessment with plain-English findings
- Help drafting a written information security program
- Written incident response plan
- Help answering carrier and cyber insurance questionnaires
- vCIO strategy sessions
This page is general information, not legal advice. We put security controls in place and document them; we do not certify anyone or make an organization compliant. Ask your attorney or your regulator what applies to you.
Questions
Insurance agency IT questions, plainly answered.
Does the Alabama law apply to a small independent agency?
The law defines a licensee broadly as anyone licensed or required to be licensed under Alabama’s insurance laws. Smaller licensees may be exempt from the written-program section, and the Department of Insurance says exemptions must be reported annually. Confirm your status with the Department.
If we are exempt, can we skip security?
No. The exemption covers the written-program section. The duties to investigate a cybersecurity event and notify the Commissioner still apply, your carriers have their own requirements, and your clients’ information is just as exposed.
Our carriers already require multi-factor sign-in. Is that enough?
It protects the carrier’s portal. Your own email, agency management system and file storage need it too, since that is where applications and ID documents sit.
How much does IT cost for an insurance agency?
$175 per user, per month with a 5-user minimum, covering the help desk, 24/7 monitoring, security, Microsoft 365 administration, backups and quarterly on-site visits. Microsoft 365 licenses are billed separately at Microsoft’s price.
Do you work with agency management systems?
Yes. We support the computers, sign-ins and network around the system you already use and handle calls with its vendor as part of vendor management.
Can you write our information security program?
We help you draft it and put the technical measures behind it, as quoted documentation work. It remains the agency’s program, with the agency’s named person responsible.
Does working with you make the agency compliant?
No provider can promise that. We put safeguards in place, document them and tell you plainly what is still open. The Department of Insurance decides what the law requires of you.
Contact
Request an IT assessment.
A hands-on review of your computers, network, security and backups, quoted up front, with findings in plain English.