Independent insurance agencies are not “generic SMBs with extra PDFs.” You hold other people’s policies, you move premium and vendor money, you onboard producers who already have a Gmail habit, and you sit in a shared suite where the neighbor’s Wi-Fi has the same password it had in 2019. Carriers and cyber underwriters increasingly ask whether you can show MFA, EDR, backups, and a mailbox that is not forwarding to an address nobody recognizes.
SAINT does not have a dedicated /industries/insurance page. That is intentional. Agencies, brokers, and insurance-adjacent offices are a named fit on professional services — accounting, insurance agencies, brokers, marketing shops, consultants — not a doorway clone of healthcare or legal. If you are a shop that is not this kind of office, start at small business.
This is a requirements guide for principals and office managers in Lincoln and Omaha. No invented AMS certifications. No fake carrier endorsements. No “we saved Agency X.”
Primary next step: Get Your Free Security & IT Assessment. Bring the cyber-insurance questionnaire or the last IT invoice. Or call 531-625-2111.
What IT does an independent agency actually run on?
Most agencies we meet run some mix of:
- An agency management system (AMS) or comparative rater in the browser, plus shared drives or SharePoint for applications and loss runs.
- Microsoft 365 or Google Workspace for mail, calendars, and the real filing cabinet.
- A bookkeeper or outsourced accounting function that pays carriers and vendors by ACH.
- Seasonal or 1099 producers who need email and AMS access in November and somehow still have it in March.
- A suite door, a cheap camera kit in a shared hallway, and a guest network that was never separated from ops.
The AMS vendor owns the application. You own the identities, the laptops, the mailbox, the backup of everything around the AMS, and the story you tell a cyber carrier. When those seams split, you get a two-vendor incident: “not our app” / “not our PC.” Managed IT plus email security is how one team owns the seam.
We will not name AMS platforms we have not scoped in your engagement.
Why is business email compromise the requirement that pays for itself?
Agency email is a finance system that happens to look like Outlook. Premium disbursements, commission statements, and “updated wiring instructions” from a familiar thread are the loss scenario. Omaha’s private-sector gravity is insurance and finance; Lincoln agencies still get the same lure, usually with a smaller AP team and no second pair of eyes.
Requirements that match that risk:
- MFA on every mailbox that can see payments or policy documents.
- External sender tags, anti-phishing policy, forwarding and inbox-rule audits.
- Huntress or Guardz identity detection so a phished CSR is not a quiet week of redirected ACH.
- An out-of-band callback rule for any bank-change request — known phone numbers, not the email thread.
- A first-hour path: phishing click and BEC.
Default spam filtering is not this control. Program page: /email-security.
What security baseline do carriers and clients now expect from an agency?
Treat it as the same load-bearing list we use on the insurability check — because your own cyber policy will ask:
- MFA on email and cloud apps (including the AMS).
- MFA on VPN / remote access if producers work from home.
- MFA on admin accounts (Global Admin is not “the owner’s mailbox”).
- EDR, not antivirus theater — Huntress or Guardz.
- Someone watching alerts (SOC / MDR), not a dashboard nobody opens.
- Backups that are immutable, offsite, and tested.
- Security-awareness training with phishing simulations, documented.
- A written incident-response plan with names.
- Email filtering beyond the default folder.
- Critical patches in a tracked window.
That is not an insurance-company IT standard we invented. It is what underwriters verify. Run the tool, then put gaps on a written plan. Fractional vCISO exists when a principal does not want to own the questionnaire narrative — catalog from $2,500/mo planning, sized after assessment. We do not bind coverage and we are not your broker.
Do FTC Safeguards requirements apply to insurance agencies?
Often, when the agency is a non-bank financial institution handling customer financial information. Many CPA, tax-prep, and insurance agencies fall in that bucket. The FTC Safeguards Rule is about access, encryption, vendor management, monitoring, and incident response — readiness and evidence, not a certificate SAINT can sell.
We map controls to that language when it is in scope. We will not tell you that a blog post determines your FTC status. Your counsel and examiner do. Same honesty we use for HIPAA-readiness in clinics: alignment, not a stamp. Framework links live on the professional services page (CISA Cyber Performance Goals, Safeguards, NIST CSF).
CISA’s cross-sector performance goals are the practical SMB translation: MFA, EDR, email, backup, IR — sized to an office, not a 200-page binder.
What about producers, CSRs, and the suite next door?
Identity lifecycle has to move at hiring speed. A producer who left still in the AMS and the shared inbox is a findings machine. Temp licenses during open enrollment need an end date.
Devices: BYOD without MDM or at least MFA + EDR is how a household PC becomes your incident. You do not need a federal laptop program. You need a rule you can evidence.
Physical: Haymarket, downtown Lincoln, Aksarben, and West Omaha offices often share a building. After-hours suite doors and entry cameras matter; recording the neighbor’s reception does not. Assess first: physical security assessments. Access control that ties to identity beats a shared fob in a drawer.
Network: Guest vs ops SSIDs. The comparative-rater laptop should not sit on the same flat LAN as a camera NVR with the default password.
Lincoln vs Omaha is logistics, not a different product. Hickman HQ (city-level only, no storefront). Lincoln on-site is a short drive. Omaha insurance-adjacent offices are scheduled via I-80; we do not claim an Omaha HQ. Hubs: Lincoln, Omaha.
How should an agency buy this without a 200-seat MSP contract?
- Read professional services so you are in the right vertical.
- Skim pricing: fixed monthly rate first, 15-minute T&M when hourly is honest, catalog not exhaustive, match-or-beat on comparable written quotes.
- Planning tiles: managed IT from $125/user/mo, cybersecurity program from $35/user/mo, Huntress EDR $12/endpoint/mo, Guardz Pro $18/seat/mo — all catalog estimates, not checkout. /products/services, /estimate.
- Book the free assessment or /#talk. Bring the questionnaire.
If you already pay an MSP and cannot get a patch report or an MFA export, vendor assessments review the paper and the tickets. Switching is optional. If the incumbent is delivering, we will say so.
Open enrollment and tax-adjacent agencies should plan identity the way clinics plan associate turnover: a start date and an end date on every seasonal mailbox. The requirement is not “be mean to producers.” It is that a departed book of business should not still be able to download the shared drive from a phone that was never collected.
SAINT is veteran-owned and founder-led. Huntress or Guardz. Phone 531-625-2111. We will not invent a dedicated insurance microsite to win this search, and we will not certify you as Safeguards-complete.
Get agency-sized scope in writing. Free Security & IT Assessment · professional services · 531-625-2111.
