Your Client Data Is At Risk. Your License Could Be Too.

Insurance agencies handle deeply personal financial and health information every day. The Gramm-Leach-Bliley Act (GLBA), the Federal Trade Commission (FTC) Safeguards Rule, and your state insurance commissioner all require that information to be protected by a formal, documented cybersecurity program. Exceed Cybersecurity helps independent agencies and regional firms build those programs without disrupting the way they already work.

See what compliance actually requires for your agency

Your Client Data Is at Risk. Your License Could Be Too.

See what compliance actually requires for your agency

Insurance agencies handle deeply personal financial and health information every day. The Gramm-Leach-Bliley Act (GLBA), the Federal Trade Commission (FTC) Safeguards Rule, and your state insurance commissioner all require that information to be protected by a formal, documented cybersecurity program. Exceed Cybersecurity helps independent agencies and regional firms build those programs without disrupting the way they already work.

We Know Compliance. We Know Security.

We Know Compliance. We Know Security.

And We Know How to Deliver Both Without Disrupting Your Business.

And We Know How to Deliver Both Without Disrupting Your Business.

Most cybersecurity firms understand technology. Most compliance consultants understand regulations. Exceed Cybersecurity brings both together in a single engagement, giving insurance agencies a partner who can build your Written Information Security Program (WISP), conduct your required risk assessments, and address the security gaps those assessments uncover, all without replacing the IT relationships you already have in place.

Brian Guenther, CISSP, CCA, CCNA, MCSE

Certified Information Systems Security Professional | CMMC Certified Assessor | Cisco Certified Network Associate | Microsoft Certified Systems Engineer

25+ years of cybersecurity and compliance experience, with deep expertise in network architecture, infrastructure design, and the technical foundations that compliant security programs are built on.

Timothy Marley, CISSP, CISA, CISM, CPA, CFE, CCA (Pending)

Certified Information Systems Security Professional | Certified Information Systems Auditor | Certified Information Security Manager | Certified Public Accountant | Certified Fraud Examiner | CMMC Certified Assessor (exam passed, background verification in progress)

30+ years of cybersecurity, compliance, and audit experience.

We Understand the Regulatory Landscape You Operate In.

Insurance agencies answer to both federal regulators and the state commissioners that license them. From the Gramm-Leach-Bliley Act (GLBA) and FTC Safeguards Rule at the federal level to the National Association of Insurance Commissioners (NAIC) Cybersecurity Model Law requirements enforced at the state level, the compliance obligations are layered and specific. We know them all.

We Work Alongside Your Existing IT Provider.

If your agency already has an IT consultant or Managed IT Service Provider (MSP), we do not ask you to replace them. Exceed Cybersecurity delivers the compliance program, risk assessment, and managed security layer that most generalist IT providers are not equipped to provide. It is a co-managed model that works, and it is one we are already delivering for clients today.

We Start With a Risk Assessment for a Reason.

GLBA and the FTC Safeguards Rule do not just require a security program. They require one that is based on a documented risk assessment of your specific environment. That assessment is where every Exceed Cybersecurity engagement begins, because it tells us exactly where your gaps are and what needs to be built to close them.

The Compliance Obligations Are Real, They Are Specific, and They Apply to Your Agency Right Now.

The Compliance Obligations Are Real, They Are Specific, and They Apply to Your Agency Right Now.

Many insurance agency owners assume cybersecurity compliance is a large-firm problem. It is not. Whether you have 3 employees or 300, if your agency collects, stores, or transmits nonpublic personal information (NPI) on behalf of clients, you have legal obligations under federal law and the regulatory authority of your state insurance commissioner.

What Your Agency Is Actually Holding

What Your Agency Is Actually Holding

When regulators and federal law refer to nonpublic personal information (NPI), they are talking about the specific client data your agency collects, stores, and transmits every day, including:

  • Full legal names, home addresses, and dates of birth
  • Social Security numbers
  • Driver’s license and government-issued ID numbers
  • Bank account and financial information
  • Income and employment records
  • Health and medical information collected for life, health, or disability policies
  • Policy numbers, coverage details, and claims history

This is sensitive personal information that your clients have placed in your care. Handling it responsibly, with a documented and compliant security program, is both a legal requirement and a reflection of the trust your agency has earned.

Requirement 1: Gramm-Leach-Bliley Act (GLBA)

The Gramm-Leach-Bliley Act (GLBA) is the foundational federal law governing how financial institutions, including insurance agencies, handle nonpublic personal information (NPI). Under GLBA, your agency is required to develop, implement, and maintain a comprehensive information security program designed to protect client data. This is not optional and it is not limited to large carriers. It applies to independent agencies of every size.

Requirement 2: FTC Safeguards Rule

The Federal Trade Commission (FTC) Safeguards Rule operationalizes GLBA by specifying exactly what your information security program must include. Among other requirements, the Rule mandates a written risk assessment, designated information security personnel, employee training, oversight of service providers, an incident response plan, and periodic program testing and monitoring. Agencies that have not updated their programs since the Rule was significantly strengthened in 2023 are likely out of compliance today.

Requirement 3: State Insurance Commissioner Requirements

Your state insurance commissioner has its own cybersecurity requirements that operate independently of federal law. A majority of states have adopted some version of the National Association of Insurance Commissioners (NAIC) Insurance Data Security Model Law, which requires licensed insurers and agencies to maintain an information security program, conduct risk assessments, oversee third-party service providers, and report cybersecurity events to the commissioner within defined timeframes. Non-compliance can result in regulatory action, fines, and in serious cases, license suspension.

Requirement 4: Vendor and Third-Party Oversight

Both the FTC Safeguards Rule and the NAIC Model Law require your agency to assess and oversee the cybersecurity practices of the third-party service providers that handle NPI on your behalf. This includes your agency management system provider, your cloud storage vendor, and yes, your IT provider. If a vendor suffers a breach involving your client data and you have no documented oversight program in place, the regulatory exposure lands on your agency.

A Compliance Program and a Security Partner. Without Starting Over.

A Compliance Program and a Security Partner. Without Starting Over.

Most insurance agencies do not need to rebuild their entire technology environment to become compliant. They need a structured compliance program, a documented risk assessment, and a security layer that addresses the gaps that assessment uncovers. That is exactly what Exceed Cybersecurity delivers, and we do it in a way that works alongside your existing operations and IT relationships.

Step 1: Compliance Discovery Call

Every engagement begins with a conversation. We learn about your agency, your current technology environment, your existing IT relationships, and your state-specific regulatory obligations. No assumptions, no generic solutions. We start with your specific situation.

Step 2: Risk Assessment

The Gramm-Leach-Bliley Act (GLBA) and the Federal Trade Commission (FTC) Safeguards Rule both require a documented risk assessment as the foundation of your information security program. We conduct that assessment against your actual environment, identifying where nonpublic personal information (NPI) lives, how it flows, who has access to it, and where the gaps are between your current posture and what the law requires.

Step 3: Written Information Security Program (WISP) Development

Based on the risk assessment findings, we build your Written Information Security Program (WISP). This is the core documented program that satisfies your federal and state regulatory obligations. It covers your data protection policies, access controls, employee responsibilities, vendor oversight requirements, and incident response procedures, all tailored to your agency’s specific size, structure, and risk profile.

Step 4: Gap Remediation and Managed Security Services

A WISP without implemented security controls is an incomplete program. Once we identify the technical gaps your risk assessment reveals, Exceed Cybersecurity can deliver and co-manage the security infrastructure needed to close them. This is where our managed security services become relevant, not as a replacement for your existing IT provider, but as a specialized security layer that most generalist IT consultants are not equipped to provide. If your agency already has an IT provider you trust, we work alongside them. That co-managed model is one we are already delivering for clients today.

Step 5: Ongoing Compliance Maintenance

Regulatory requirements evolve, your agency grows, and your technology environment changes. Your compliance program needs to keep pace with all of it. Exceed Cybersecurity provides ongoing compliance monitoring, annual risk assessment updates, and continuous managed security services to ensure your program remains current, your controls remain effective, and your agency remains protected.

Common Misconceptions That Leave Agencies Exposed

Common Misconceptions That Leave Agencies Exposed

In working with independent insurance agencies, we hear the same dangerous assumptions over and over. Here are the ones that concern us most.

Your Managed IT Service Provider (MSP) or IT consultant plays an important role in keeping your agency’s systems running. However, most generalist IT providers are not equipped to deliver the specific compliance program that the Gramm-Leach-Bliley Act (GLBA), the Federal Trade Commission (FTC) Safeguards Rule, and your state insurance commissioner require. Building a Written Information Security Program (WISP), conducting a documented risk assessment, managing vendor oversight, and maintaining an incident response plan are compliance obligations that go well beyond typical IT support. If your IT provider has not had that specific conversation with you, there is a good chance the compliance work has not been done.

This is one of the most common and most dangerous assumptions we hear from independent agency owners. The Gramm-Leach-Bliley Act (GLBA) and the Federal Trade Commission (FTC) Safeguards Rule apply to financial institutions of every size, and insurance agencies are explicitly included in that definition regardless of employee count or revenue. Your state insurance commissioner does not make exceptions for small agencies either. In fact, smaller agencies often present a more attractive target for cybercriminals precisely because their defenses are less robust. Regulatory size thresholds exist in some contexts, but they do not exempt your agency from the core obligation to protect client nonpublic personal information (NPI) with a documented security program.

Antivirus software and a firewall are basic security hygiene, not a compliance program. The Federal Trade Commission (FTC) Safeguards Rule requires a documented, risk-based Written Information Security Program (WISP) that goes well beyond perimeter defenses. That program must include a formal risk assessment, designated security personnel, employee training, vendor oversight, an incident response plan, and regular testing and monitoring of your controls. Technology tools are one component of a compliant security program. They are not a substitute for the program itself. An agency that relies on antivirus and a firewall alone, without the documentation and governance structure the law requires, is not compliant regardless of how good the technology is.

This misconception is understandable given that much of the public conversation around insurance cybersecurity compliance focuses on large carriers. However, the Gramm-Leach-Bliley Act (GLBA), the Federal Trade Commission (FTC) Safeguards Rule, and the National Association of Insurance Commissioners (NAIC) Insurance Data Security Model Law all apply to licensed insurance entities, which explicitly includes independent agencies, brokerages, and managing general agents (MGAs). If your agency is licensed by your state insurance commissioner and handles nonpublic personal information (NPI) on behalf of clients, you are subject to these requirements. The size of your agency does not change your licensing status, and your licensing status does not change your compliance obligations.

A clean track record is not the same as being secure, and part of the problem is that many agency owners do not distinguish between a compromise and a breach. A compromise is when an attacker gains unauthorized access to your systems or data. A breach is the confirmed acquisition, exposure, or exfiltration of that data, which is the event that typically triggers regulatory notification requirements. The critical point is that a compromise almost always comes first, and it can sit quietly in your environment for months before it becomes a breach. Attackers frequently gain access and wait, observing and positioning themselves before they act. An agency without real monitoring in place may already be compromised and have no way of knowing it.

This is exactly why the goal cannot simply be to check a compliance box. It has to be to genuinely protect the sensitive client information your agency depends on. A real, actively managed security program reduces the likelihood of a compromise in the first place, detects intrusions before they escalate into a breach, and limits the damage if something does occur. By stopping the compromise early, you can often avoid the breach, and the costly, reputation-damaging notification process that comes with it, entirely. Compliance is the floor, not the ceiling. The agencies that take security seriously are the ones that protect their clients, their reputation, and their business for the long term.

These are the five misconceptions we see most often across independent insurance agencies. Want to see exactly where your own agency stands? Download the free compliance checklist below.

Not Sure Where Your Agency Stands? Start Here.

Not Sure Where Your Agency Stands? Start Here.

Most insurance agency owners are not certain whether they are compliant, and that uncertainty is itself a risk. Our free Insurance Agency Cybersecurity Compliance Checklist walks you through the key requirements under the Gramm-Leach-Bliley Act (GLBA), the Federal Trade Commission (FTC) Safeguards Rule, and state insurance commissioner regulations, so you can quickly see where your agency is covered and where the gaps are.

Insurance Agencies That Took Compliance Seriously

Insurance Agencies That Took Compliance Seriously

★★★★★  5-Star Rated on Google  |  41 Reviews

“We assumed our technology and security needs were being handled, but it became clear there was much more involved in protecting our business and our clients. Exceed Cybersecurity helped us put a structured, documented security program in place. We now have confidence that our information is better protected and that we are meeting important compliance and regulatory requirements.”
— Ray Cogan, President, Lindquist Insurance

“These folks Rock!!! They understand the needs of a small business and not only solve your direct issue, but also look for ways to mitigate future ones. They are always professional!!!” (Controller & Operations Manager, Insurance Agency, Mid-Atlantic)

Every insurance agency we work with gets the same thing: a documented, defensible compliance program and a security partner that keeps their client data protected and their agency in good standing with regulators.

The First Step Is a Conversation. Schedule Your Free Compliance Discovery Call Below.

The First Step Is a Conversation. Schedule Your Free Compliance Discovery Call Below.

Schedule a free 30-minute Compliance Discovery Call with Exceed Cybersecurity. We will learn about your agency, review your current situation, and give you a clear, honest picture of where you stand against your federal and state compliance obligations, and what it would take to close any gaps. No sales pressure. No obligation. Just straight answers from a team that understands both compliance and security at a level most IT providers cannot match.