If you run an independent agency, you’re probably using cloud apps: AMS, raters, e-signature, CRM, email, and remote-work tools. That combination saves time, but it does not erase risk. The FBI reported $16.6 billion in cyber losses last year, and the insurance workforce is now largely hybrid, which means more exposure from home laptops, home routers, and unmanaged devices. The fundamentals still stop a large share of attacks: strong passwords, MFA, and keeping devices updated.
Let’s retire a myth: “Our vendors hold the data, so we’re covered.” Cloud providers secure their platforms. Your agency still owns logins, access, device hygiene, vendor oversight, and how data is configured. That is the shared-responsibility model, and it does not outsource your liability.
What regulators expect, in plain English: agencies need to prove they are controlling access, training staff, managing vendors, and protecting systems that touch client information. NYDFS cybersecurity rules and the NAIC Insurance Data Security Model Law both point in the same direction: document the basics, enforce them, and be ready to show your work.
A fast start for agencies this quarter:
– Turn on MFA everywhere your team logs in: email, AMS/CRM, raters, e-signature, remote access, and admin tools.
– Harden every device used for client work with full-disk encryption, auto-updates, and reputable endpoint protection.
– Stop spoofed email at the door by enforcing SPF, DKIM, and DMARC.
– Set a home-router baseline for remote staff: change admin passwords, update firmware, use WPA3 or WPA2-AES, and separate work devices where possible.
– Keep a living asset inventory for devices, SaaS tools, and vendors that touch nonpublic information.
Bottom line: cloud vendors reduce what your agency has to manage, but they do not cover your identity, endpoints, email, home-office risks, or vendor responsibility. Regulators and cyber underwriters increasingly expect agencies to prove the basics across logins, laptops, email, and vendors, including when staff work from home.
If you want this handled without the headache, ask about Smart Services and our Security+ program for independent agencies.