Insurance Data Security Model Law Compliance Software

Insurance Data Security Model Law compliance software has to do five things: hold a written information security program built on a risk assessment, track third-party service providers, run an incident response plan with a 72-hour notice to the commissioner, produce an annual written report to the board, and keep five years of records behind the February 15 certification. Most insurers and agencies in the 28 jurisdictions that have adopted NAIC Model #668 can do all of that in a compliance platform priced for a small team. Complies runs it from $119 a month billed yearly, using its NYDFS Part 500 pack, which the NAIC drafters wrote the model law to line up with.

The buyers who read this are usually a compliance officer at a regional carrier, the operations lead at an MGA or a large independent agency, or the CTO of an insurtech that just got its first market conduct questionnaire. They do not need an enterprise GRC suite. They need the program written down, assigned to people, and provable when the department asks. This guide compares the options by what the law actually requires, with prices where anyone publishes them.

What the model law requires, section by section

Model #668 is short, and the software question gets easier once you see how little of it is technology and how much of it is records. We read the NAIC text directly; the section numbers below are the model's, and your state's statute may renumber them.

Notice the pattern. Section 4D lists technical measures such as access controls, encryption, multi-factor authentication and audit trails, but it asks the licensee to determine which are appropriate. Everything else is a document, an owner, a date or a record. That is why a compliance platform, not a security product, is the purchase that closes most of the gap.

Insurance data security compliance software compared

We checked each vendor's own page on October 14, 2026, and used Vendr, which brokers real software contracts, for the two products that publish nothing. Where nothing is published anywhere, the table says so.

Two honest limits on our own row. Complies does not ship a template labeled "NAIC Model #668", and it does not monitor your network, scan endpoints or provide awareness training. What it gives you is the record keeping the law is mostly made of, with owners and due dates, at a price you can read before a call.

Why a NYDFS Part 500 pack covers the model law

The NAIC wrote this alignment into the model itself. A drafting note under Section 2 says the drafters intend that a licensee in compliance with New York's 23 NYCRR 500 is also in compliance with the Act. New York appears on the NAIC adoption map as a state with its own insurance data security provisions for exactly that reason.

Part 500 has since been amended and now asks for more than the 2017 model does, including annual certification by April 15 and multi-factor authentication for remote access. So running your program on a Part 500 control set is the conservative choice: you will meet the model's requirements and a few stricter ones. The differences you do need to set by hand are the dates. Your domiciliary state's certification is due February 15 under the model, not April 15, and the 72-hour notice goes to the commissioner of your state of domicile or home state, or to any state where 250 or more affected consumers live when the event also has to be reported elsewhere or is reasonably likely to cause material harm. Our NYDFS compliance software page shows the full Part 500 pack, and the same policies and obligations load into any workspace.

Who does the NAIC Insurance Data Security Model Law apply to?

It applies to licensees, meaning anyone licensed or authorized under the state's insurance laws, which covers insurers, agencies and individual producers. Section 9 exempts licensees with fewer than ten employees, counting independent contractors, from the Section 4 program requirements, though not from investigation and notice. An employee or agent covered by another licensee's program is also exempt from building their own.

The exemption is the line that decides whether an agency buys software at all. A seven-person agency is exempt from Section 4 but still owes the commissioner notice of a qualifying event, so it needs an incident record and little else. Cross ten people, contractors included, and Section 9B gives you 180 days to comply. Agencies that are growing past that line are the ones that should set the program up before the deadline, not after it.

What states have adopted the NAIC Insurance Data Security Model Law?

The NAIC's implementation map for Model #668, dated October 8, 2026, shows 28 jurisdictions as adopted, one as pending, and New York with other insurance data security provisions. Adopters on that map include Alabama, Connecticut, Indiana, Iowa, Louisiana, Michigan, Minnesota, Mississippi, Ohio, Pennsylvania, South Carolina, Tennessee, Virginia and Wisconsin. The NAIC notes that the map does not judge whether each statute contains every element of the model, so check your own state's text for dates and thresholds.

Adoption is not uniform. States have changed the notice window, the certification date and the employee threshold, and some apply the law only to insurers for the certification step. A tool that lets you change an obligation's due date and owner without rebuilding the program handles that. A tool with the dates hard-coded to one state does not.

Is a HIPAA program enough for a health insurer?

Often, yes. Section 9A(2) says a licensee subject to HIPAA that maintains an information security program under it is considered to meet Section 4, provided it is compliant with HIPAA and submits a written statement certifying that. You still owe the investigation and notice duties in Sections 5 and 6. If you already run HIPAA in a compliance tool, the work is the certification statement and the 72-hour notice process, not a second program.

Third-party service providers are where examiners find gaps

Section 4F asks for two things: due diligence when you select a provider, and a requirement that the provider protect the systems and nonpublic information it can reach. The second one lives in the contract. A rating platform, a policy administration system, a claims vendor and a payment processor each hold data the law covers, and the security clause, breach notice window and right to audit in each agreement are what the department will ask about. If those agreements still sit in email attachments, pull the security clause, the notice window and the renewal date for each critical provider into one list before the review, because that list is what you will be asked for.

Section 5C adds a timing problem. If the cybersecurity event happens at a provider, you either complete the investigation steps yourself or confirm and document that the provider did. Your 72-hour clock does not wait for their report to be convenient. In Complies each provider carries a tier, its SOC 2 report or questionnaire with an expiry date, an owner and a review date, and the vendor risk management software page explains how that register is built.

How much does insurance data security compliance software cost?

Expect between about $1,400 and $25,000 a year for the software, depending on whether you buy a published-price tool or an enterprise compliance platform. Complies publishes $1,428 a year for Growth, which includes the risk register, vendor register and evidence collection. Vanta and Drata publish nothing, and Vendr reports medians of about $20,000 and $24,868 a year. Managed services price by agency size and scope.

The software is rarely the largest line. A penetration test, an outside risk assessment and staff training usually cost more in the first year. Our breakdown of what NYDFS Part 500 compliance costs works through a 15-person agency and a 60-person firm line by line, and the same budget logic applies under the model law because the requirements overlap so closely.

The 72-hour notice is the part to rehearse

The clock starts at the determination that a cybersecurity event has occurred, not at discovery of something odd, and the notice has to reach the commissioner as promptly as possible within 72 hours. Section 6B lists what the notice should contain, from the date and how it was discovered to the number of affected consumers and the remediation underway. Agencies lose time collecting those facts, not writing the letter.

Write the facts into the incident response plan as a fill-in record before anything happens, name who makes the determination, and keep a copy of the provider contacts you will need. If your team already uses incident management software to page people for outages, add the insurance notice as a step in the security runbook so the clock is visible from the first page. Then keep the investigation file for five years, because Section 5D requires it.

How to choose in one afternoon

1. Count your people, contractors included. Under ten, you are exempt from Section 4 and need an incident record. At ten or more, you need the whole program.
2. Check your HIPAA status. If you are a covered entity with a working HIPAA program, you need the certification statement and the notice process, not a new framework.
3. List every provider that touches nonpublic information. If the list is longer than ten, a vendor register with expiry dates is the module you will use most.
4. Set your state's dates. Certification date, notice window and employee threshold, from your statute rather than the model.
5. Ask for the examiner view. Have each vendor show the export you would hand the department for the program, the vendor file and the board report. If it takes more than a minute to find, it will take you longer.

If the answer is a staffed security team with continuous monitoring across hundreds of systems, an enterprise platform earns its price. If it is a carrier or agency that needs the program written, owned and provable, you can put a number on it today and load the Part 500 pack this week.