State security rules for insurance agencies
By Tyler Mayberry · Cirlet. Page updated .
A summary of public law and regulator guidance for independent agencies, checked October 28, 2026. It is not legal advice. Read the linked source and ask your counsel or the regulator how it applies to your agency.
Agency security duties depend on your state. Some states adopted the NAIC Insurance Data Security Model Law, which sets an information security program and a short regulator notice deadline. Every state also has a general breach notification law.
The NAIC map shows 28 jurisdictions adopting the model law, as of October 8, 2026. These pages cover five states so far, each checked against the statute or regulator.
| State | NAIC model law | Regulator notice after a cybersecurity event |
|---|---|---|
| Missouri | Adopted | 4 business days |
| Ohio | Adopted | 3 business days |
| New York | Not the NAIC model | 72 hours (DFS) |
| Texas | Not adopted | No insurance-specific notice |
| California | Not adopted | No insurance-specific notice |