You Underwrite Cyber Risk All Day. Who's Managing Yours?
Your agency has spent the last three years telling clients they need multi-factor authentication before a carrier will write them. You've walked business owners through applications, explained why "we have antivirus" is no longer an answer, and watched premiums climb for the ones who couldn't check the boxes.
Here's the uncomfortable question. If your own agency filled out that application honestly, how would it score?
We ask because insurance licensees in Alabama now carry a legal obligation that most agency principals we talk to are only partly aware of, and because the data sitting on an agency network is some of the most attractive material a criminal can find.
Your Agency Is a High-Value Target, Not a Small One
Attackers don't size a target by headcount. They size it by what's on the network.
An independent agency holds Social Security numbers, dates of birth, driver's license numbers, bank account and payment details, and in life and health lines, medical history. On the commercial side, you're holding loss runs, financial statements, employee rosters, and payroll figures for dozens or hundreds of other businesses. That's a concentration of sensitive data most companies your size never touch.
Agencies also tend to run lean on IT. One part-time person, a nephew who's good with computers, or a break-fix shop that answers when something stops working. That combination, high-value data and thin technical coverage, is exactly the profile ransomware operators look for.
Alabama Law Already Requires You to Have a Program
In May 2019, Governor Ivey signed the Insurance Data Security Law, Alabama's adoption of the NAIC Insurance Data Security Model Law, codified at Alabama Code sections 27-62-1 through 27-62-11. It requires insurance licensees to develop, implement, and maintain a comprehensive written information security program built on a risk assessment. manageditservices
Two details matter for agencies specifically.
First, this is not a carrier-only statute. The law reaches all "licensees," meaning entities that are or should be licensed by the Alabama Department of Insurance, and unlike the version Mississippi passed, Alabama's does apply to agents and brokers. piaadvocacy
Second, there are teeth. Alabama's version provides for civil penalties, and the commissioner can suspend or revoke a license where a licensee is found in violation. For an agency, that's not an IT problem. That's an existential one. piaadvocacy
What the program has to contain is more specific than "be reasonable." The statute calls for administrative, technical, and physical safeguards, annual risk assessments, periodic review of the program, employee training, business continuity planning, and breach response. It also requires licensees to evaluate whether a named set of controls is appropriate, including access controls, encryption, audit trails for information access, penetration testing, and multi-factor authentication. Third-party service providers have to be folded into the risk assessment, and executive management is expected to be actively involved rather than delegating the whole thing downward. All of it has to be documented and reviewed on an ongoing basis. Alabama Passes Insurance Data Security Law +2
There is a small-licensee exemption tied to employee count and revenue thresholds, and whether your agency falls under it is a question for your counsel rather than your IT provider. We'd note two things anyway. The exemption addresses certain written policy obligations, not your breach notification exposure. And your carriers, your E&O underwriter, and your larger commercial clients will ask about these controls regardless of what the statute requires of you.
The 72-Hour Clock You Can't Beat After the Fact
Reporting obligations under the law run on a short fuse. A cybersecurity event affecting 250 or more Alabama consumers has to be reported to the Commissioner of Insurance within 72 hours. manageditservices
Think about what meeting that deadline actually requires. You need to know which systems were touched, whose records were in them, when access occurred, and whether data left the building. If you don't have centralized logging, endpoint detection with retained telemetry, and an incident response plan that names who calls whom, you will spend those 72 hours guessing. Regulators and plaintiffs' attorneys both read guesswork the same way.
This is the part of compliance that cannot be built retroactively. The evidence either exists when you need it or it doesn't.
And Then There's the Conversation With Your Clients
Every other business that suffers a breach has a bad month. An insurance agency that suffers a breach has to call clients it personally sold cyber coverage to and explain that the agency itself got hit.
That conversation costs renewals. It reaches your competitors. In a market like Birmingham or Dothan, where commercial business moves on reputation and relationships, it's the kind of story that follows an agency for years.
What We Actually Do for Insurance Licensees
AllTech IT Solutions has supported Alabama businesses in regulated industries for years, including insurance agencies, and our work maps directly to what Section 4 asks for.
A documented risk assessment.
Our Cybersecurity Risk Assessment produces the written findings and remediation plan the statute expects as the foundation of your program, not a sales report.
The technical controls, implemented and evidenced.
MFA across email and remote access, endpoint detection and response, encryption at rest and in transit, role-based access controls, email filtering, and audit logging that retains what you'd need during an investigation. This is the substance of our Advanced Cyber Protections work.
Backups that have been tested.
Automated, isolated, and restore-verified, because a backup nobody has tested is an assumption. See Data Backup & Disaster Recovery.
A real incident response plan.
Our Incident Response Handbook gives your staff a written sequence for the first hour, which is what makes a 72-hour reporting window survivable.
Annual review and executive reporting.
Our vCIO engagement delivers quarterly reviews, budget forecasting, and the documentation trail that shows your program is being maintained and that leadership is engaged.
Vendor oversight, including ourselves.
The law expects you to assess your third-party providers. We provide the attestations and documentation that let your IT vendor be a line item you've satisfied rather than a gap you have to explain.
Where to Start
If you can't produce a current written information security program, a documented risk assessment, and evidence that MFA is enforced across your tenant, that's the starting point, and it's a shorter project than most principals expect.
Call us at (205) 290-0215 in Birmingham or (334) 794-8705 in Dothan, or book a 20-minute consultation. We'll tell you where your agency stands against what the law asks for, in plain language, before you commit to anything.
You've built a career helping other people transfer risk they can't absorb. This is one worth managing directly.
This article is general information about Alabama's Insurance Data Security Law and is not legal advice. Consult your attorney regarding how the statute and its exemptions apply to your agency.
