NAIC Model Law gap analysis: what MDL-668 compliance actually requires
Geert WarmenbolApril 29, 2026
Key takeaways
NAIC MDL-668 requires a written information security program, annual risk assessments, third-party oversight, and tested incident response plans. Most insurance firms document all four and validate none of them.
Third-party risk is where MDL-668 compliance fails most consistently. Insurers conduct vendor due diligence at onboarding and treat it as continuous oversight. Those are not the same thing.
MDL-668 incident response plans that have never been tabletop tested are a finding, not a program. The law requires testing. Regulators increasingly ask for testing records during examinations.
State adoption of the NAIC model law is not uniform. 24 states have adopted MDL-668 as of early 2025 with varying effective dates and scope thresholds. An insurer operating across multiple states needs a compliance map, not a single program.
Risk assessments that cover internal systems and exclude third-party data processing environments have a structural gap that no amount of internal control documentation can address.
The written information security program required under MDL-668 Section 4 must be calibrated to the size and complexity of the licensee. Copying a template program is a compliance artifact, not a program. Examiners can tell the difference.
TL;DR
MDL-668 is not a complex framework. The requirements are clear: risk assessment, written information security program, third-party oversight, incident response. What makes NAIC Model Law gap analysis consistently productive is that insurance companies document compliance with all of these requirements and implement most of them at a depth that would not survive a real examiner review or an actual incident. The gap between what the program document says and what the program does is where the findings live.
The incident response plan that had never been tested
A regional insurer operating in eight states had an MDL-668 compliance program that passed its most recent internal review. Written information security program: documented. Annual risk assessment: completed. Third-party vendor inventory: maintained. Incident response plan: written, approved by the board, filed with the compliance function. A gap analysis conducted before a state examination found one question the internal review had not asked: when was the incident response plan last tested? The answer was that it had been written during initial MDL-668 implementation and updated once to reflect an org chart change. It had never been executed in any form — no tabletop exercise, no simulated breach, no walkthrough with the response team.
The insurer's compliance position was that the plan existed and met the documentation requirements. The examination finding was that MDL-668 Section 4(F) requires that the incident response plan be tested. 'Tested' is not synonymous with 'written.' The examiner's report noted the gap. The remediation required executing a tabletop exercise within 90 days and establishing an annual testing cadence. The documentation had been thorough. The program had not been operational.
How MDL-668 compliance programs fail while appearing to succeed
MDL-668 structures its requirements around five core elements: a written information security program, risk assessment, third-party service provider oversight, an incident response plan, and notification obligations. Each element has documentation requirements. Each element also has operational requirements that the documentation is supposed to reflect. The compliance failure mode for NAIC Model Law programs is systematic: organizations build documentation programs, not security programs.
The written information security program required under Section 4 must be 'designed to protect the security, confidentiality, and integrity of nonpublic information.' The law specifies it must be calibrated to 'the size and complexity of the licensee, the nature and scope of the licensee's activities, and the sensitivity of the nonpublic information.' A program that was assembled from a template, applies uniformly to a regional insurer with 200 employees and a national carrier with 15,000, and has not been updated since adoption fails this requirement regardless of how polished the document looks.
The same pattern applies to risk assessments. MDL-668 Section 4(C) requires risk assessments that identify 'reasonably foreseeable internal or external threats' and evaluate 'sufficiency of policies, procedures, customer information systems, and other safeguards.' An annual risk assessment that reviews the internal network inventory and stops there has not evaluated the third-party processing environments where a significant fraction of consumer nonpublic information actually lives. The assessment is technically annual. It is not technically sufficient.
Example
A commercial lines insurer processed claims data through four third-party administrators, two document management vendors, and a cloud-based actuarial platform. Their MDL-668 risk assessment covered the internal environment thoroughly — network segmentation, endpoint controls, identity management. The third-party processing environments were represented in the assessment by a single line: 'Third-party vendors are subject to contractual security requirements.' That sentence is not a risk assessment of third-party environments. It is a reference to contract terms. The actual security posture of the vendors — their control implementation, their incident history, their own vulnerability exposure — was unknown to the insurer and unassessed.
MDL-668 Section 4(F)(3) specifically requires that the incident response plan address 'internal and external notification and communication, including notification to the superintendent as applicable.' State notification timelines under MDL-668 vary: most adopting states require notification within 72 hours of determining that a cybersecurity event has occurred, but some states use different thresholds. An incident response plan that specifies a single notification timeline regardless of jurisdiction, or that does not identify which state regulations apply to which policyholder population, will fail in a multi-state examination regardless of how well the rest of the plan is structured.
What MDL-668 gap analysis finds across insurance environments
Assessment base: Vulnox insurance sector compliance assessments, 2024-2025
Third-party risk assessed at onboarding and not revisited
The most consistently recurring MDL-668 gap is third-party oversight that functions as a one-time due diligence exercise rather than continuous oversight. Insurers conduct vendor security reviews during onboarding — reviewing SOC 2 reports, completing security questionnaires, executing data processing agreements. After onboarding, the vendor relationship continues under the assumption that the initial review remains valid. SOC 2 reports from two years prior are treated as current assessments. Vendors that have changed their infrastructure, experienced incidents, or modified their data handling practices since onboarding have not been reassessed.
The insurer's documented vendor oversight program showed complete coverage because every vendor had been assessed at onboarding. The operational vendor oversight program covered a point in time, not a current state. MDL-668 requires oversight of third-party service providers, not a record that they were once reviewed. Those are different obligations, and the documentation often reflects the former while the requirement is the latter.
Written information security programs not calibrated to licensee profile
Section 4 requires the information security program to be calibrated to the size, complexity, and activity scope of the licensee. In practice, programs assembled from industry templates — and a substantial number are — apply controls uniformly regardless of the insurer's actual risk profile. A regional health insurer processing protected health information needs different program depth than a specialty commercial lines writer with no consumer data. Both may have documentation that checks the same boxes. Neither has a program that reflects the calibration requirement.
An examiner who reads a program document and cannot identify how it differs from a generic template will ask questions the program cannot answer. The calibration requirement is not satisfied by adding the company name to a template. It requires demonstrating that the program was designed around the specific risk profile of the organization — which requires that someone conducted that analysis.
Digital footprint visibility gaps creating unknown risk assessment scope
Risk assessments cannot cover what the organization does not know it has. Insurance companies operating across multiple business lines, acquired entities, or legacy platforms frequently have data processing environments that are not in the current system inventory. Acquired subsidiaries may still be operating on their original infrastructure with their own data repositories. Legacy policy administration systems may be transmitting data to third-party services provisioned years before the current compliance program was established. The risk assessment covers what the inventory covers. The inventory has gaps.
The MDL-668 risk assessment obligation extends to 'information assets' — which requires knowing what information assets exist. An assessment that covers the known environment thoroughly is not a compliant risk assessment if significant portions of the actual information environment are unknown. Digital footprint analysis run against an insurance company's external exposure consistently surfaces domains, services, and data connections that are not in the official inventory.
Incident response notification timelines not mapped to state-specific requirements
Insurers operating in multiple MDL-668 adopting states face a multi-jurisdiction notification requirement. State adoption dates, threshold definitions, and notification timelines vary. An incident response plan that specifies a single notification timeline — typically 72 hours — without identifying which timeline applies to which regulatory authority, which state's consumer notification requirements apply to which policyholder population, and which state insurance departments must receive notification for which types of events is structurally incomplete for a multi-state operator.
The compliance gap here is not in incident detection or containment capability — it is in regulatory knowledge mapped to operational procedure. A carrier that detects and contains an incident successfully but files notifications on the wrong timeline or to the wrong regulatory authorities has compliance exposure regardless of how well the technical response functioned.
What MDL-668 compliance programs consistently fail to address
Independent agents and brokers as third-party data processors
MDL-668 Section 4(F)(5) requires oversight of third-party service providers with access to nonpublic information. Independent agents and brokers access policyholder nonpublic information as part of normal operations. They are also typically outside the insurer's IT environment, operating on their own systems with their own security practices. Most insurer MDL-668 programs classify agents and brokers differently from 'vendors' and do not include them in third-party oversight programs. The regulatory language does not make that distinction — it covers any nonaffiliated third party that accesses nonpublic information on behalf of the licensee.
Paper records and physical media in the MDL-668 scope
MDL-668 covers nonpublic information in 'any form' — including paper records and physical media. Most insurance data security programs focus on electronic systems. Physical security controls for paper policyholder records, physical media containing claims documentation, and physical access to server environments receive less consistent attention in MDL-668 gap assessments. An insurer with mature electronic security controls and minimal physical security documentation has a compliance gap in the area where most legacy insurance data still exists.
Employee and contractor access not reviewed against current role
MDL-668 requires access controls calibrated to the need for access. Insurance company workforces have high turnover in claims, customer service, and sales roles. Access provisioned for a previous role is rarely revoked when someone moves positions internally. A claims adjuster who transferred to underwriting eighteen months ago may still have active access to claims systems they no longer need. That access represents both a compliance gap under MDL-668's access control requirements and an insider threat surface that risk assessments frequently do not evaluate.
Board reporting obligations under Section 4(H)
MDL-668 Section 4(H) requires that the CISO or equivalent report to the board at least annually on the information security program's overall status. The report must cover material matters related to the program — risk assessment findings, third-party oversight status, incident history, and compliance gaps. In gap assessments, board reporting either does not exist, consists of a brief line item in a larger board update with no substantive program information, or occurs less frequently than annually. The reporting requirement is in the statute. Many compliance programs do not operationalize it.
MDL-668 vs NYDFS Part 500: where the requirements diverge
NAIC MDL-668
Model law framework requiring state-level adoption. Applies to insurance licensees — insurers, agents, and brokers holding a license. Threshold exemptions for small licensees (fewer than 10 employees or under $5M revenue in some state adoptions). Risk assessment required but methodology is not prescribed. Third-party oversight required but no specific assessment frequency mandated. Incident response plan testing required but format not specified.
MDL-668 gives licensees significant flexibility in implementation. That flexibility is a feature for large sophisticated insurers who can design programs suited to their risk profile. It is a gap risk for smaller licensees who interpret flexibility as permission to implement minimally. Examiners in states with active MDL-668 enforcement are developing expectations around what 'reasonable' implementation looks like, and those expectations are higher than the minimums the statute's language permits.
NYDFS Part 500 (23 NYCRR 500)
Prescriptive regulation with specific technical requirements: annual penetration testing, bi-annual vulnerability assessments, multi-factor authentication requirements for critical systems, specific CISO designation with defined responsibilities, 72-hour incident notification to DFS, detailed audit trail requirements. Applies to DFS-licensed entities including insurance companies operating in New York. No small licensee threshold that eliminates core requirements — limited exemptions apply to specific program elements only.
An insurer operating in New York under both MDL-668 (as adopted by NY) and NYDFS Part 500 faces two compliance regimes with overlapping but not identical requirements. Part 500 is more prescriptive and has more aggressive enforcement history. Compliance programs designed only to MDL-668 standards will have gaps under Part 500 — specifically around penetration testing frequency, MFA scope, and audit trail retention.
GLBA Safeguards Rule (FTC)
Applies to financial institutions including insurance companies subject to FTC jurisdiction — primarily non-bank insurers not regulated by state insurance departments for certain activities. Requires a written information security program, risk assessments, and vendor oversight similar to MDL-668. FTC Safeguards Rule 2023 amendments added specific technical requirements: encryption, MFA, access controls, annual penetration testing for entities over 5,000 customers. Enforcement is federal.
Some insurance entities have dual exposure to both GLBA Safeguards and MDL-668 depending on their business mix and state licensing. The 2023 Safeguards amendments moved the GLBA standard closer to NYDFS Part 500 in technical specificity. An insurer whose MDL-668 compliance program was designed to minimum standards may have gaps under the current Safeguards Rule even if the MDL-668 documentation is complete.
Why larger insurer compliance programs have more MDL-668 exposure than smaller ones
Common belief
Large insurance companies with dedicated compliance functions, mature security programs, and significant regulatory experience have better MDL-668 compliance posture than smaller regional insurers with limited resources.
What we found
In gap assessments across insurer sizes, the most significant findings at large carriers are consistently scope gaps — systems, subsidiaries, or vendor relationships that are not covered by the documented compliance program. At smaller carriers, the findings are more often depth gaps — the right systems are in scope but the controls are implemented at minimum depth. Both are MDL-668 compliance failures. They require different remediation approaches.
Large insurers have more compliance infrastructure. They also have more surface area — more systems, more acquired entities, more third-party integrations, more jurisdictions, more legacy environments. The MDL-668 requirement to calibrate the program to size and complexity cuts against large insurers in a specific way: complexity creates the conditions for the program to address the documented environment while the actual environment grows beyond what the documentation covers.
Smaller regional insurers with straightforward operations, limited third-party relationships, and a single-state footprint can maintain genuine alignment between their documented program and their actual environment. A large carrier operating in 30 states with 200 vendor relationships and a history of acquisitions has an MDL-668 compliance problem that scales with its footprint, not with its compliance team size. The gap analysis findings at large carriers are not bigger because the programs are worse — they are bigger because the environments are harder to fully scope.
Where NAIC MDL-668 enforcement is heading
By 2027, state insurance department examinations in MDL-668-adopting states will shift from reviewing program documentation to requiring evidence of program execution — specifically incident response testing records, vendor reassessment dates, and board reporting records. Insurers that have documentation-only programs will face examination findings at a scale the industry has not experienced under MDL-668 to date.
MDL-668 adoption is now mature enough that initial implementation is complete for most large licensees. The examination cycle has reached a point where examiners have reviewed the same programs in the same states for two to three years. The natural next step in examination maturity is moving from 'does the program exist' to 'does the program work.' State insurance departments that have invested in cybersecurity examination capacity — New York, Connecticut, Ohio, Texas — are already asking operational questions. Others will follow as examination guidance matures.
Confidence: highState insurance department examination reports showing operational findings (untested IR plans, lapsed vendor reassessments) as a share of total MDL-668 findings from 2026 NAIC examination data.The first enforcement action citing MDL-668 third-party oversight failures as a primary basis — not just a contributing factor — will occur before the end of 2026, following a breach traced to a vendor environment that the insurer had not reassessed since onboarding.
The vendor oversight gap is structural and widely present. The breach fact pattern — insurer with documented vendor security requirements, vendor with unassessed security posture, breach through vendor environment — is predictable given the current state of insurer vendor programs. The regulatory tools to cite MDL-668 third-party oversight requirements in an enforcement action already exist in adopting states. The case that will use those tools is in some insurer's vendor portfolio right now.
Confidence: mediumState insurance department enforcement actions citing MDL-668 Section 4(F)(5) as a primary violation basis. Observable in state regulatory filings and NAIC enforcement tracking from 2025-2026.
MDL-668 is the right framework being implemented at the wrong depth
The NAIC Insurance Data Security Model Law has the right structure. Risk assessment, third-party oversight, incident response, written program calibrated to the licensee — these are the right requirements for insurance cybersecurity. What is wrong is the depth at which they are being implemented. Most insurer MDL-668 programs are built to pass an initial examination, not to function as operational security programs. The risk assessment is annual because the law says annual, not because the risk environment changes annually and the assessment tracks it. The incident response plan is tested once because testing was flagged as a gap, not because the organization has internalized that an untested plan is not a plan. The compliance program is a snapshot of a security posture that the organization intends to maintain. The actual security posture keeps changing, and the program keeps documenting the intended version.
Counterargument
The counterargument is that MDL-668 represents meaningful progress for insurance cybersecurity — that before the model law, many insurers had no formal program at all, and that minimum compliance with MDL-668 is demonstrably better than the pre-regulatory baseline. That is accurate. The issue is not whether MDL-668 raised the floor — it did. The issue is that the industry has treated the floor as the ceiling. The regulators who wrote the model law intended for programs to be calibrated to risk, not to the minimum documentation standard. When gap analysis reveals that the calibration requirement was not met, that is the finding the law intended to produce.
The one question to ask before the next examination cycle
Before the next state examination cycle, ask one question about your MDL-668 program: for each required element — risk assessment, third-party oversight, incident response testing, board reporting — can you produce evidence that it was executed, not just documented? The risk assessment report, the vendor reassessment records with dates, the tabletop exercise summary, the board presentation and meeting minutes. If any of those evidence items does not exist, the program element exists on paper and not in practice. That is the finding. It is fixable before the examination. It is not fixable during one.
Further Reading
Gap Analysis
gap analysis frameworkDigital Footprint
digital footprint assessmentNIST SP 800-30 Risk Assessment Guide
NIST risk assessment guideThird-Party Risk Management
third-party risk managementCISA Vulnerability Disclosure Program
CISA vulnerability disclosure
Frequently Asked Questions
What does NAIC MDL-668 require for a written information security program?
MDL-668 Section 4 requires a written information security program designed to protect the confidentiality, integrity, and availability of nonpublic information. The program must be calibrated to the size and complexity of the licensee, the nature and scope of activities, and the sensitivity of the nonpublic information it covers. A generic template program applied uniformly regardless of insurer profile does not satisfy the calibration requirement, and examiners in active MDL-668 states are increasingly asking for evidence that the calibration was actually performed.
How does MDL-668 third-party oversight differ from vendor due diligence at onboarding?
MDL-668 requires ongoing oversight of third-party service providers with access to nonpublic information — not a one-time review at onboarding. Ongoing oversight means vendors are reassessed periodically, SOC 2 reports are reviewed for currency, and significant changes to vendor security posture or incident history are tracked. Onboarding due diligence that is never updated reflects the vendor's security posture at a point in time. The law requires monitoring of their current posture.
What does MDL-668 require for incident response plan testing?
MDL-668 Section 4(F) requires that the incident response plan be tested. A plan that exists in documentation but has never been executed in any form — tabletop exercise, simulated breach, or structured walkthrough — does not meet the testing requirement. Examiners in MDL-668 states are increasingly requesting testing records, including exercise dates, participants, findings, and evidence that lessons learned were incorporated. The absence of testing records is a direct examination finding.
Which states have adopted the NAIC Insurance Data Security Model Law?
As of early 2025, 24 states have adopted MDL-668 with varying effective dates and scope thresholds. Adopting states include Alabama, Connecticut, Delaware, Hawaii, Indiana, Iowa, Kentucky, Louisiana, Maine, Maryland, Michigan, Minnesota, Mississippi, Montana, Nevada, New Hampshire, New Jersey, New York, North Dakota, Ohio, South Carolina, Tennessee, Virginia, and Wisconsin. Threshold exemptions for small licensees vary by state. Insurers operating across multiple adopting states need a jurisdiction-specific compliance map, not a single uniform program.
Does MDL-668 require independent agents and brokers to be included in third-party oversight?
The MDL-668 third-party oversight requirement covers any nonaffiliated third party that has access to nonpublic information on behalf of the licensee. Independent agents and brokers access policyholder nonpublic information as part of normal operations and technically fall within this scope. Most insurer compliance programs classify agents and brokers separately from vendors and do not include them in third-party oversight programs. That classification is a compliance gap under the statute's language.
How does NYDFS Part 500 differ from NAIC MDL-668 for insurance cybersecurity compliance?
NYDFS Part 500 is more prescriptive than MDL-668 and has more aggressive enforcement history. Part 500 requires annual penetration testing, bi-annual vulnerability assessments, specific MFA scope, detailed audit trail requirements, and 72-hour incident notification to DFS. MDL-668 sets equivalent categories of requirements but does not prescribe specific technical methods or frequencies for most controls. An insurer operating in New York faces both regimes, and a program designed to MDL-668 minimum standards will have gaps under Part 500 — particularly around penetration testing frequency and MFA scope.
What are the most common findings in a NAIC MDL-668 gap analysis?
The most consistent MDL-668 gap analysis findings are: third-party oversight treated as onboarding due diligence rather than continuous monitoring; incident response plans that have never been tested; written information security programs assembled from templates without calibration to the licensee's actual risk profile; risk assessments that cover internal environments but exclude third-party data processing environments; and multi-state notification timelines not mapped to jurisdiction-specific requirements. All five are documentation programs being treated as operational programs.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.