What compliance do insurance companies need?
Insurers must protect policyholder data under state data-security laws based on the NAIC Insurance Data Security Model Law, plus the GLBA Safeguards Rule, the Model Audit Rule for financial-reporting controls, and PCI DSS for payments. Insurers in New York also fall under NYDFS 23 NYCRR 500. Compyl maps one control library to all of them.
How does Compyl handle different state adoptions of the NAIC model law?
Compyl maintains one control library and cross-maps it to each state’s adoption of the NAIC Insurance Data Security Model Law. Because the underlying controls overlap, evidence collected once satisfies every state where you operate, and new adoptions reuse controls you already have.
Does Compyl support the Model Audit Rule?
Yes. Compyl manages the IT general controls behind the Model Audit Rule, schedules and tracks control testing, and continuously collects evidence, so the annual MAR requirements are met with current proof instead of a year-end scramble.
Can one piece of evidence satisfy multiple insurance regulations?
Yes. With cross-mapping, evidence that MFA is enforced can satisfy the NAIC model law, GLBA Safeguards, NYDFS 500.12, the Model Audit Rule, SOC 2, and PCI DSS at once, collected a single time and counted everywhere it applies.
Does Compyl cover TPAs, brokers, and other vendors?
Yes. Compyl continuously assesses and monitors third-party administrators, brokers, and SaaS vendors that touch policyholder data, automates their security questionnaires, and quantifies exposure in dollars using the FAIR model.
Which states have adopted the NAIC Insurance Data Security Model Law?
Roughly half the states have adopted Model #668 or a close variant, while others rely on general breach and data security laws. In adopting states, domestic insurers typically certify compliance by February 15 and notify the commissioner of a cybersecurity event within 72 hours, so check NAIC’s current adoption chart for each state you operate in.
Does the FTC Safeguards Rule apply to insurance companies?
No. The FTC Safeguards Rule covers financial institutions under FTC jurisdiction that no other agency regulates. Insurers answer to state insurance regulators for GLBA, usually through data security laws modeled on NAIC Model #668, plus NYDFS Part 500 in New York.
Which states have adopted the NAIC AI Model Bulletin?
As of NAIC’s Spring 2026 meeting, 24 states and the District of Columbia had adopted the bulletin, and several more had their own insurance AI rules. It expects a written AI program with governance, risk controls and oversight of third-party AI vendors.
