Insurance
Security monitoring and signed records for insurers.
Security built for insurers and their data
Policyholders entrust insurers with sensitive information across agents, claims teams and service providers. A connected security record helps the insurer explain access, investigate concerns and document its response.
Regulators
| Rule | What it asks | Supporting record |
|---|---|---|
| NAIC Model 668 §4D(2)(h) | Test and monitor systems to detect attacks. | Correlation rules, plus alerts on silent sources. → |
| NAIC Model 668 §4D(2)(i) | Audit trails that reconstruct material transactions. | Database logs collected, signed and chained. → |
| NYDFS 500.14(a) | Monitor the activity of authorized users. | A risk score per user on a timeline. → |
| NYDFS 500.14(b) | Centralized logging and security event alerting. | One SIEM for every source, with alerts. → |
| NYDFS 500.17 | Notice within 72 hours. | A case timeline from the opening alert. → |
| NAIC AI Model Bulletin | Documentation of model validation and drift. | Each detector’s promotion and rollback, on record. → |
| DORA | Detection for insurers and intermediaries. | Correlation alerts, plus near-hourly behavior baselines. → |
Agent portals
Portal, application and database records show different parts of a user’s activity. Correlating them in a SIEM helps investigators examine unusual downloads or access across an agent’s relationship with the insurer.
NYDFS 500.6
NYDFS 500.6 includes a five-year retention requirement for records supporting reconstruction of material financial transactions. Define the records in scope and preserve them with appropriate access and integrity controls.
NAIC Model 668
A dated incident timeline supports notice decisions under applicable state insurance law. Keep discovery, assessment and reporting decisions together so the responsible team can apply the relevant trigger and deadline.
NAIC AI Model Bulletin
Model governance needs evidence of how a detector was evaluated and why it entered production. Retain the test conditions, findings and promotion or rollback decisions for later review.
By rule
DORA
Detection for insurers and intermediaries. UEBA baselines in AI Detection add historical context to account and host activity for analyst review.
Questions
Can claims data leave by email?
DLP content policies can identify protected claims information on covered email paths and block or request approval for a transfer. Legitimate sharing should have a documented exception process.
Is our detection testing documented?
Evaluation records can show the data used, results reviewed and decision to promote a detector. Those records help explain later changes in its behavior.
Who approves an action?
The organization defines who may approve each response. A SOAR workflow presents the decision to that person and retains the approval, action and outcome.
What stays with the insurer?
The insurer owns regulatory reporting, underwriting-model governance and the wider application-security program. Monitoring supplies evidence for the parts of that program it covers.
Guide
What is NAIC Model 668?
The NAIC Insurance Data Security Model Law provides a model for information-security, investigation and notification requirements. The enacted law in the relevant state determines an insurer’s obligations.
What does NYDFS Part 500 require of insurers?
Covered entities have cybersecurity-program, monitoring, audit-trail and reporting duties, among others. The applicable requirements and exemptions follow the entity’s circumstances.
How do insurers protect agent portals?
Combine appropriate access and application controls with portal, identity and database monitoring. Investigators need the related records to distinguish legitimate agent work from misuse.
How ARRTECH takes care of insurance security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
