IT Support for Insurance Agencies That Protect What Clients Share

Carrier portals and logins everywhere. Every carrier has its own site and its own login, and staff share or forget them.

Email full of personal data. Applications, claims and renewals move by email, often with sensitive attachments.

New York requirements for New Jersey agents. Many agents licensed in New York are covered by NYDFS Part 500, with yearly filings.

Phishing and payment fraud. Fake carrier emails and fake premium payment instructions are common tricks.

Staff changes. When a producer or CSR leaves, every portal and system login needs to be shut off.

We keep your agency running. Ongoing care for computers, network and email, with a real person to call.

We help get logins under control. MFA and a safer way to manage passwords, plus a clean checklist for when people leave.

We help protect client data. Encryption for email and devices, and sensible access to client files.

We support the technical side of Part 500. We help put controls like MFA in place and document how your systems are protected.

We help your team spot fakes. Plain English phishing training.

This section is a plain English overview to help you understand what the rules ask for. It isn’t legal advice. For questions about what applies to your agency, talk with your attorney. Our role is to help you meet these requirements on the technology side and document the work. The responsibility for your program stays with your agency, and we don’t promise or guarantee compliance.

NYDFS Cybersecurity Regulation (23 NYCRR Part 500)

If your firm is licensed or registered by the New York State Department of Financial Services (NYDFS), Part 500 likely applies, even if your office is in New Jersey. Many New Jersey insurance agents and financial firms hold New York licenses. In plain terms, it asks for a written cybersecurity program and policies, a risk assessment, MFA, a plan for responding to incidents, and notice to NYDFS within 72 hours of certain cybersecurity events. Each year, by April 15, covered entities file a certification of compliance or an acknowledgment of noncompliance. As of November 1, 2025, MFA is generally required for all access to information systems. Smaller firms may qualify for a limited exemption under section 500.19, which reduces some requirements but not all of them.

Insurance data security laws in other states

The NAIC (National Association of Insurance Commissioners) Insurance Data Security Model Law (#668) has been adopted in many states, but the NAIC’s own adoption chart does not list New Jersey as having adopted it. If you’re licensed in other states, check those states’ rules too.

New Jersey’s data breach law (N.J.S.A. 56:8-161 to 56:8-166)

New Jersey’s Identity Theft Prevention Act covers any business that does business in New Jersey, and any public entity, that keeps computerized records with personal information. If there’s a breach of New Jersey residents’ personal information, you have to tell the affected people in the most expedient time possible and without unreasonable delay. Before you tell them, the law says you must report the breach to the New Jersey State Police. The State Police and the NJCCIC (New Jersey Cybersecurity and Communications Integration Cell) provide an online form for that report. If you decide misuse of the information isn’t reasonably possible, the law says to document that decision in writing and keep it for five years.

Wire fraud and business email compromise

This isn’t a regulation, but it’s the risk we hear about most. The FBI calls it business email compromise: a criminal gets into, or imitates, an email account and sends convincing payment instructions. The FBI asks victims to report it right away at ic3.gov (the Internet Crime Complaint Center) and to contact their bank to try to stop the transfer. The simplest protection is a habit: confirm any new or changed payment instructions with a phone call to a number you already have, never one from the email.