NAIC Insurance Data Security Model Law (#668) Guide

US insurers, agencies and brokers now face a state-by-state cybersecurity regime built on one NAIC template, and the details that catch teams out (who counts as a licensee, when the 72-hour clock starts, what the board must see) change from state to state. The NAIC Insurance Data Security Model Law (Model #668) was adopted in 2017 and, according to the NAIC's own government affairs brief, had been implemented by 28 jurisdictions as of 8 October 2026. This guide explains who the model covers, the written programme it demands, the investigation and commissioner notice rules, how enforcement works, what it means for service accounts, API keys and AI agents that touch nonpublic information, and a practical compliance sequence. It is written for security, risk and compliance leads at carriers, producers and the service providers that support them. Status line: checked against NAIC sources on 27 October 2026; state enactments differ from the model, so always read your state's statute.

Key takeaways

It is a template, not a federal law: Model #668 only binds licensees once a state enacts it, and states may change thresholds, deadlines and exemptions (Ohio, for example, uses three business days rather than 72 hours).
A written, risk-based programme is the core duty: Section 4 requires a risk assessment, risk-based controls, an incident response plan, third-party oversight and at least an annual written report to the board.
The commissioner clock is short: Section 6 requires notice to the commissioner as promptly as possible and no later than 72 hours after determining a cybersecurity event occurred, where the state's triggers are met.
Domestic insurers certify every year: each insurer domiciled in an adopting state files a written certification of compliance by 15 February and keeps supporting records for five years.
Machine access is in scope even if the text never says so: the model's access control, audit trail and third-party duties apply to every account that can reach nonpublic information, including service accounts, integration tokens and AI agents.

Scope: who and what is covered

The model applies to a "Licensee": any person licensed, authorised or registered, or required to be, under the state's insurance laws. That includes insurers, producers (agents and brokers) and other licensed entities. Certain purchasing groups and risk retention groups chartered elsewhere, and assuming insurers domiciled in another state, are excluded from the definition.

Term	What the model says	Practical reading
Licensee (s3)	Licensed, authorised or registered, or required to be, under state insurance law	Carriers, agencies, brokers, adjusters and other licence holders
Nonpublic Information (s3)	Non-public business information, consumer identifiers combined with data elements such as Social Security, driver's licence or account numbers or biometric records, and health information	Policy, claims, underwriting and medical data; also confidential business data whose loss would harm the licensee
Cybersecurity Event (s3)	Unauthorised access to, disruption of or misuse of an information system or the information on it	Excludes acquisition of encrypted data where the key was not also compromised, and events where data was returned or destroyed unused
Third-Party Service Provider (s3)	A non-licensee that maintains, processes or stores nonpublic information for a licensee, or has permitted access to it	Claims platforms, TPAs, MGA systems, cloud and SaaS providers, managed service providers
Multi-Factor Authentication (s3)	At least two of knowledge, possession and inherence factors	Defined, but listed as a control the programme "may include", not a mandate

Exceptions

Small licensees: fewer than ten employees, including independent contractors, are exempt from Section 4 in the model. States vary: Ohio's Chapter 3965 exempts licensees with fewer than 20 employees, less than five million dollars in gross annual revenue or less than ten million dollars in year-end assets.
HIPAA: a licensee subject to HIPAA that maintains a HIPAA-compliant information security programme is treated as meeting Section 4 if it certifies that in writing. The notification duties in Section 6 still apply.
Covered by another licensee: employees and agents covered by another licensee's programme need not run their own.
Losing an exception: a licensee that stops qualifying has 180 days to comply.

The model does not create a private right of action (Section 2). Information supplied to the commissioner under the law is confidential and privileged (Section 8). For the wider sector picture, see the Insurance Sector Cybersecurity Programme Guide.

Key obligations

Section	Obligation	Evidence a regulator will expect
4A	Written information security programme, scaled to size, complexity and sensitivity of data	Approved policy set, scope statement, owner
4C	Designate a responsible person; identify internal and external threats, including at third parties; assess likelihood, damage and safeguards; assess key controls at least annually	Risk register, annual control effectiveness results
4D	Risk management measures: access controls, encryption of nonpublic information over external networks and on portable devices (or other appropriate means), secure development, audit trails, secure disposal, training; cybersecurity in enterprise risk management	Access reviews, encryption standards, log retention, training records
4E	If there is a board, it requires executive management to maintain the programme and receives a written report at least annually	Board minutes and the annual report itself
4F	Due diligence in selecting third-party service providers and requiring appropriate safeguards	Vendor assessments, contract clauses, monitoring records
4H	Written incident response plan: process, roles, communications, remediation, documentation, post-event revision	Plan, exercise reports, lessons learned
4I	Domestic insurers certify compliance by 15 February each year; keep records for five years	Signed certification and the file behind it
5	Prompt investigation of a known or possible event; confirm third-party investigations; keep event records for at least five years	Investigation file per event
6	Notify the commissioner within 72 hours where triggers apply; update on a continuing basis; consumer notice under the state breach law with a copy to the commissioner	Notice copies, timestamps, decision log

The 72-hour notice in detail

Section 6A requires notice to the commissioner as promptly as possible, and no later than 72 hours from a determination that a cybersecurity event has occurred, when either:

Home state: the state is the insurer's state of domicile, or the producer's home state; or
250-consumer test: the licensee reasonably believes the nonpublic information of 250 or more consumers resident in the state is involved, and either notice must be given to another government body or regulator, or the event has a reasonable likelihood of materially harming consumers in the state or a material part of the licensee's normal operations.

Section 6B lists what the notice contains, as far as the information is available: the date of the event, how it was discovered and how information was exposed, the source of the event, the types of information involved, the period during which systems were compromised, the estimated number of affected consumers in the state, remediation efforts, and a contact person. The licensee must update the commissioner as information changes.

Third-party events (6D): the clock starts the day after the provider notifies the licensee or the licensee has actual knowledge, whichever comes first. Contract notification terms therefore decide whether you can comply. See the Third-Party Incident Notification Clauses Guide.
Reinsurance (6E): an assuming insurer notifies affected ceding insurers and its domiciliary commissioner within 72 hours; ceding insurers then handle consumer and commissioner notice.
Producers (6F): insurers notify the producers of record of affected consumers as soon as practicable, as the commissioner directs.

Timeline and current status

Status as of 27 October 2026, from NAIC sources dated 8 October 2026. The NAIC notes its adoption map does not determine whether an enactment contains every element of the model. NAIC's cybersecurity topic page still shows an older count (21 states, background last updated May 2024), so rely on the dated brief.

Date	Event
March 2017	New York DFS adopts 23 NYCRR Part 500, a separate, non-model regime for New York licensees
October 2017	US Treasury insurance report urges states to adopt the model and suggests Congress act if uniformity is not achieved within five years
4th quarter 2017	NAIC adopts Model #668
20 March 2019	Ohio Chapter 3965 takes effect (an example of a state variant)
2025	Technical edit to the model text
8 October 2026	28 jurisdictions listed as having implemented it: AL, AK, CT, DE, HI, IL, IN, IA, KY, LA, ME, MD, MI, MN, MS, MO, NH, ND, OH, OK, PA, PR, RI, SC, TN, VT, VA, WI

In each adopting state the model gives licensees one year from the state's effective date to implement Section 4, and two years for the third-party provisions in Section 4F. New York licensees follow Part 500 instead; see the NYDFS Part 500 Guide. Licensees in non-adopting states still have GLBA-based and state breach law duties; see the GLBA Safeguards Rule Guide.

Common state variations to check

Notice deadline: 72 hours in the model; Ohio uses three business days.
Exemption thresholds: ten employees in the model; Ohio adds revenue and asset tests.
Certification route: Ohio lets single-state domestic insurers include the certification in the corporate governance annual disclosure.
Safe harbour links: Ohio deems a compliant licensee to have a programme that reasonably conforms to an industry-recognised framework for its Chapter 1354 data protection safe harbour.

Enforcement and penalties

Section 7 gives the commissioner power to examine and investigate any licensee and take necessary or appropriate enforcement action. Section 10 does not set fine amounts: it points to the state's existing general insurance penalty statute, so the level and form of penalties (per-violation fines, licence action, corrective orders) depend on the state. Enforcement usually surfaces in three ways:

Market conduct and financial examinations: examiners request the programme, risk assessment, board report and certification file.
Event notices: a 72-hour notice is often followed by information requests and updates that test the investigation record required by Section 5.
Certification accuracy: an annual certification that the file cannot support is a governance failure in its own right.

Because there is no private right of action under the model, civil exposure comes from other laws, such as state breach notification statutes and general negligence claims, which this guide does not cover.

What it means for AI agents and non-human identities

Model #668 is technology-neutral and never mentions service accounts or AI. Its duties still land on them, because most nonpublic information in an insurer moves through integrations: rating engines calling third-party data, claims platforms pulling documents, policy administration systems feeding data warehouses, and increasingly AI agents summarising claims or answering producers.

Model requirement	Non-human identity implication	Control to show
4C risk assessment of threats, including at third parties	Integration credentials held by TPAs, MGAs and SaaS vendors are a primary path to nonpublic information	Inventory of machine identities with access to nonpublic information, mapped to owner and provider
4D access controls to limit access to authorised individuals	Service accounts and API keys often hold broad, standing read access to policy and claims stores	Least-privilege scopes, short-lived tokens, quarterly entitlement review that includes machine accounts
4D audit trails to detect and respond to events	Without per-identity logging an agent's bulk export looks like normal batch traffic	Per-identity logging on data stores and APIs, alerting on volume and new destinations
4D MFA "may include"	Machines cannot use MFA; the equivalent is strong workload authentication	Workload identity federation, certificate-based authentication, vaulted and rotated secrets
4F third-party safeguards	Vendor-held keys and OAuth grants outlive contracts	Contract clauses on credential handling, revocation at offboarding, notification timing that supports 6D
5 and 6 investigation and notice	Scoping an event needs to know what each compromised credential could reach	Credential-to-data mapping ready before an incident

The third-party pattern is not hypothetical. In the Scania Insurance Portal Breach 2025, a legitimate external user's login, believed captured by infostealer malware, was used to download claim documents from a portal run by an IT partner. That is exactly the scenario Section 4C asks licensees to assess and Section 6D times. For AI deployments, treat each agent as a licensee-controlled identity with its own scoped credentials and logs; see the Insurance Sector Identity Security Guide and the Service Account Security Guide.

Compliance steps

Map your states: list every state where you hold a licence, mark which have enacted the model or a variant, and record each state's deadline, exemptions and certification route from the statute, not the model.
Confirm exceptions in writing: document employee counts (and any revenue or asset tests), HIPAA status, or coverage under another licensee's programme. Diarise the 180-day window if you could lose an exception.
Run the risk assessment: name the responsible person, inventory systems holding nonpublic information, include third-party and machine access paths, and assess key controls at least annually.
Close control gaps: prioritise access control for human and machine accounts, encryption on external transmission and portable devices, audit trails and secure disposal. Decide where MFA applies and record why.
Fix third-party oversight: tier providers by access to nonpublic information, add notification and credential clauses, and confirm providers can notify you fast enough for the commissioner clock.
Build the notice runbook: a decision tree for the domicile and 250-consumer tests, a Section 6B data template, named approvers, and a log of when the event was "determined". Exercise it with a tabletop that includes a vendor-originated event.
Report to the board: a written annual report covering programme status, material risks, third-party arrangements, events and recommendations. See the Board Cyber Report Template.
Certify and retain: assemble the evidence file before signing the 15 February certification and keep it, with event records, for five years.

Choosing your baseline

Multi-state carrier: build to the strictest combination (shortest notice deadline, widest scope, Part 500 where New York applies) and document state deltas.
Small agency: check exemptions first; if exempt from Section 4, the notification duties may still apply under the state's text and its breach law.
Service provider: you are not a licensee, but your clients must pass the model's requirements down to you; expect assessments and notification clauses.

Detection, measurement and framework mapping

Measure whether the programme works, not only whether it exists:

Time to determination: hours from first alert to a documented "event occurred" decision.
Notice timeliness: percentage of notifiable events reported to the commissioner within the state deadline.
Machine identity coverage: share of service accounts and API keys with access to nonpublic information that have a named owner, scoped permissions and logging.
Third-party coverage: share of providers with nonpublic information access that have current assessments and a notification clause shorter than your commissioner deadline.
Control assessment completion: key controls assessed in the last 12 months.

Model section	NIST CSF 2.0	NIST SP 800-53 Rev. 5
4C risk assessment	ID.RA-05	RA-3
4D access control	PR.AA-05	AC-2, IA-2
4D encryption	PR.DS-01	SC-8, SC-28
4D audit trails	DE.CM-09	AU-6
4E board oversight	GV.RR-01, GV.OV-01	PM-9
4F third-party providers	GV.SC-04, GV.SC-05, GV.SC-07	SR-6
4H, 5 incident response and investigation	RS.MA-01	IR-4, IR-8
6 commissioner notice	RS.CO-02	IR-6

Common failure patterns

Using the model instead of the statute: teams plan to 72 hours and miss a state's business-day or other variant, or apply the ten-employee test where the state uses different thresholds.
No defined "determination" moment: the clock runs from determining an event occurred; without a recorded decision, regulators judge it from your own logs.
Vendor contracts slower than the law: a provider allowed five days to notify you makes Section 6D impossible to meet.
Machine accounts outside access reviews: service accounts and integration tokens with standing access to claims data are left out of the risk assessment and entitlement reviews.
Certification without a file: the 15 February certification is signed on assurance from IT rather than on evidence kept for five years.
Board report as a slide: Section 4E expects a written report at least annually; a verbal update without minutes is weak evidence.

Practitioner checklist

List licence states and record each enacted statute's deadline, exemptions and certification route.
Document your exception status and the 180-day trigger if it could change.
Complete a risk assessment that includes third-party and machine identity access paths.
Inventory service accounts, API keys and AI agents that can read nonpublic information, with owners.
Confirm encryption for external transmission and portable devices, or record the alternative.
Align provider notification clauses with your shortest commissioner deadline.
Maintain a notice runbook with the Section 6B template and a determination log.
Deliver a written board report at least annually and minute it.
Build the certification evidence file before 15 February and retain it for five years.

Standards and references

Related NHI Mgmt Group resources: Insurance Sector Identity Security Guide · NYDFS Part 500 Guide · Third-Party Risk Management Guide · Breach Notification Laws by Country Guide. This guide summarises the NAIC Insurance Data Security Model Law and selected state enactments as of October 2026 and is not legal advice.

NAIC Insurance Data Security Model Law Guide: Programme, Board Reporting and 72-Hour Notice