28 States Now Require Insurers to Name a Security Officer. Most Agencies Still Haven't Picked One.
October 14, 2026
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
Insurance licensees in at least 28 states and Puerto Rico are already bound by a law requiring a designated employee to run their information security program, whether they realized it or not. The answer to who that person should be is not left open to guesswork. Regulators expect a named individual with documented security expertise, and a credential is the fastest way to prove it.
What Does the NAIC Insurance Data Security Model Law Actually Require?
The National Association of Insurance Commissioners built Model Law #668 after a string of major insurer breaches exposed how uneven data protection was across the industry. The model requires insurers and other entities licensed by a state department of insurance to develop, implement, and maintain an information security program based on its own risk assessment, with a designated employee in charge of the program. That single clause is the part most agencies miss. The law does not just ask for a written policy. It asks for a person.
This is not a hypothetical state-by-state curiosity anymore. As of early 2026, at least 28 jurisdictions have enacted some version of this law, and the coverage extends well past the large national carriers that get named in breach headlines. Independent agencies, general agents, and individual adjusters licensed in an adopting state fall under the same obligation. If your agency holds a state insurance license and you have more than a handful of employees, you are very likely already a covered licensee, even if nobody in your office has read the statute.
Does This Law Apply to My Agency If We Are Not a Large Carrier?
Yes, in most cases. The model law covers anyone the statute calls a licensee, which includes independent agencies and individual adjusters, not just underwriting carriers. The exemptions are narrower than people assume: licensees with fewer than 10 employees, those already certifying HIPAA security rule compliance in writing, and agents already covered under another licensee's existing program.
Those exemptions are not permanent protections. Growth past the employee threshold, a change in HIPAA status, or a shift in how a carrier delegates program responsibility to its appointed agents can all pull a previously exempt business back into scope. States are also layering their own variations on top of the model text. Oklahoma's version, for example, now requires licensees with a board of directors to file an annual report on the status of the information security program, with the first submission deadline already passed. Pennsylvania adopted its own version as the 22nd state to enact a law based on the NAIC model, with risk assessment and program requirements that were already due by the end of 2024.
Who Counts as the Designated Employee, and What Are Regulators Actually Expecting?
The model law itself does not hand out a job title or a certification checklist. It says the licensee must designate an employee responsible for the program, and leaves the qualification bar to the licensee's own judgment, which is exactly the gap that creates risk during an examination or a post-breach investigation. Vague answers do not hold up well when a regulator asks why a particular person was trusted with the role.
The clearest template for what "qualified" looks like in practice comes from New York, which the NAIC model used as its blueprint. Under 23 NYCRR 500, the state's financial services cybersecurity regulation, covered entities must designate a qualified individual responsible for overseeing and implementing the cybersecurity program and enforcing its cybersecurity policy. New York's regulators have shown they will enforce that standard with real money. In October 2025, the state's Department of Financial Services and Attorney General secured more than 19 million dollars in combined settlements from eight auto insurers over cybersecurity violations tied to data breaches, a reminder that program ownership questions surface fastest after an incident, not before one.
State insurance regulators can reach for lighter tools than New York's, but they are not toothless. Pennsylvania's data security act allows the insurance commissioner to assess penalties up to 5,000 dollars per violation, capped at 100,000 dollars in a calendar year, for violations the licensee knew or should have known about, on top of the power to suspend or revoke a license entirely. A written information security program with nobody clearly accountable for it does not satisfy an examiner working through either standard.
Why a Credential Is the Cleanest Way to Answer the Qualification Question
An agency's general counsel or compliance officer should not have to improvise an answer when a regulator asks what makes the named security lead qualified. A current certification from a recognized body gives you a documented, third-party-verified answer instead of an internal judgment call that looks weaker with every passing year.
ISACA's Certified Information Security Manager credential was built for exactly this kind of accountability. The CISM designation is the standard achievement certification for expert knowledge and experience in information security and control, and it affirms a holder's ability to assess risk, implement governance, and respond to incidents, which maps directly onto the designated-employee language in the NAIC model law. It is a leadership-focused credential rather than a pure technical one, which matters because the role the statute describes is a program owner, not a systems administrator.
A few practical markers consistently separate agencies that can answer a regulator's qualification question cleanly from those that cannot.
- The named individual holds a current, verifiable security credential rather than an informal "handles IT" designation.
- The board or senior management receives a documented annual report from that individual, matching the oversight pattern regulators in states like Oklahoma now require in writing.
- Reappointment or departure of the designated employee triggers a formal handoff, so the named role never sits vacant during an exam window.
| Compliance Gap | Regulatory Exposure |
|---|---|
| No named individual for the information security program | Program treated as undocumented under NAIC model law Section 4 |
| Named individual has no verifiable credential | Weak defense during examination or post-breach review |
| No annual report to board or senior management | Governance failure separate from any technical control gap |
None of this replaces a genuine risk assessment or technical controls. But it closes the specific gap regulators keep finding: a written policy that nobody can point to a qualified, accountable owner for. If your compliance team is building out that documentation now, Forge University's CISM certification prep is built around the governance, risk, and incident response domains that map directly onto what state insurance regulators are asking for in a program owner. The resources hub walks through how the exam domains line up against real job responsibilities if you want to see the fit before committing. If you want a study plan built around this specific compliance deadline, you can start training whenever you're ready.
What Should an Agency Do Before Its Next Renewal or Attestation Filing
Start by confirming whether your state has adopted a version of the model law and what its specific attestation deadline is, since the filing dates and penalty structures differ meaningfully between Pennsylvania, Oklahoma, and the other adopting states. Then document, in writing, who your designated employee is and what makes them qualified for that role.
If the honest answer right now is "whoever happens to handle IT," that is the gap to close first. A named, credentialed program owner is not a formality. It is the specific piece of evidence the law asks for, and the piece most likely to be missing when an examiner or a breach investigator finally asks for it.