Insurance Archives

Insurance

Cybersecurity Awareness Month for small business four-week plan: training, vendor review, scanning, incident prep

September 30, 2026

Cybersecurity Awareness Month 2026: A Four-Week Plan for Firms Without a Security Team

Cybersecurity Awareness Month for small business has always had a mismatch. The campaign’s advice assumes someone on staff owns security. At a 30-person tax firm, insurance agency, or mortgage shop, nobody does. Last Updated: September 2026 Key takeaways Train staff in week one with a live, 30-minute session on the attacks your industry actually sees, and record who attended. Review every vendor that holds client data in week two, including its breach notice terms and whether MFA is enforced. Scan for vulnerabilities in week three, give each fix an owner and a date, and test one backup restore. Rehearse the first hour of an incident in week four with a 45-minute tabletop and a one-page contact sheet. Finally, keep the records. By November 1, that evidence is what clients, carriers, and examiners ask to see. However, that does not make the month useless. It changes what the month is for. […]

Insurance agency incident response plan binder on an office desk beside a 72-hour countdown clock

September 23, 2026

The 72-Hour Clock: An Incident Response Plan for Independent Insurance Agencies

Brian Thompson Breach, Insurance, SMB

An insurance agency incident response plan gets written in one of two moments. Some agencies write it on a quiet afternoon, with time to think. Others write it in the first hour of a cybersecurity event, while a producer’s mailbox sends fake invoices to clients. The second version costs far more, and it starts a legal clock the agency may not know about. Last Updated: September 2026 Here is how that hour usually looks at a 25-person agency. A client calls to ask why your office emailed new wire instructions. Nobody sent them. The account manager assumes it is spam. The owner is at a carrier meeting. By the time anyone asks who is in charge, half a day is gone. Under the insurance data security law in many states, that half day may count against a 72-hour deadline to notify the insurance commissioner. This guide covers what that deadline […]