Question 1

Does the NAIC Model Law apply to my insurance agency?

Accepted Answer

The NAIC Insurance Data Security Model Law has been adopted by 25+ states and generally applies to licensees — agencies, producers, and adjusters — that handle consumer non-public information, subject to each state's size thresholds. If your agency holds client NPI in an adopting state, it likely applies. Check your own state's adopted version for the exact thresholds and deadlines.

Question 2

What does the NAIC Model Law require?

Accepted Answer

A written information security program, an annual risk assessment, a designated security officer, access controls, encryption of non-public information, multi-factor authentication for remote and privileged access, third-party vendor due diligence, an incident response plan and training, breach notification to the state commissioner (commonly within 72 hours), and an annual certification of compliance to the insurance department. This check maps to those elements.

Question 3

Is this check free?

Accepted Answer

Yes — it's completely free with no signup. It's a self-assessment of your own answers against the Model Law's elements; it does not test or access your systems. Adoption and exact requirements vary by state, and this is general information, not legal advice.

Is your agency NAIC Model Law-ready?

Have you designated someone responsible for your information security program?