Most insurance agencies we talk to believe they’re in decent shape when it comes to cybersecurity. 

But when it comes to NYDFS compliance for insurance agencies, the reality is often very different.

They’re not careless. They’ve made some investments. Things seem secure.

But NYDFS doesn’t measure effort. It measures whether your cybersecurity program actually holds up under scrutiny.

Here are five gaps we see all the time that usually mean an agency isn’t as prepared as they think.

You’ve never actually sat down and measured risk

Not a scan. Not a checklist. Not something your IT provider glanced at once.

NYDFS expects a real, documented risk assessment that’s reviewed and updated regularly. If that doesn’t exist, everything else is built on assumptions.

MFA exists, just not where it needs to

Most agencies have MFA on email. That’s good, but it’s not the full picture.

The expectation now is broader use of MFA across systems and access points, depending on your size and exemption status. If it only lives in a few places, it’s usually a sign the environment hasn’t been fully thought through.

You don’t fully know what you’re responsible for

If someone asked you to list every system, device, and place your data lives, could you do it confidently?

NYDFS requires a documented inventory of systems. Without that, you can’t properly secure or manage anything.

Your policies look good on paper

A lot of agencies technically have policies.

They were downloaded, written years ago, or never revisited. They exist, but they don’t reflect how the business actually operates.

NYDFS expects policies that are relevant, maintained, and followed. If they’re just sitting in a folder, they don’t help you.

You wouldn’t know there’s a problem until it’s too late

Security isn’t something you set up once and forget.

You need some level of visibility into what’s happening. That could be monitoring, alerting, or just knowing when something is off.

For smaller agencies, requirements vary depending on exemptions. But in practice, a lack of visibility is one of the fastest ways issues go unnoticed.

Most agencies don’t miss all five of these.

But they usually miss two or three, and that’s enough to create real risk. Not just from a compliance standpoint, but with insurance renewals and day-to-day operations.

How this usually shows up

In most cases, agencies don’t realize these gaps exist until something forces the issue.

That might be:

• a cyber insurance renewal questionnaire
• a client asking about security controls
• or an internal review that raises more questions than answers

By that point, you’re reacting instead of being prepared.

If you’re not sure where you stand, we put together a simple Cyber Risk Snapshot. It’s not a full compliance review, but it gives you a quick view of what’s visible from the outside, including known breaches, email risks, and external exposure.