Third-Party Cyber Risk: How Insurance Agencies Can Protect Client Data and Keep Working

Third-party cyber risk is the potential for a vendor or business partner to expose your insurance agency’s data, compromise its systems, or disrupt operations. To reduce that risk, identify your providers, review their access, verify their security practices, and plan for outages.

Your agency management system, email platform, IT provider, and connected tools help your business run. What happens when one of them has a problem?

In Catalyit’s Understanding Third-Party Cyber Risk webinar, Ryan Smith, president of Ready State Cybersecurity, outlined a practical approach: secure your agency’s side of each relationship and verify how providers protect theirs.

What counts as a third party for an insurance agency?

A third party is an outside organization or service your agency relies on, shares information with, or allows into its systems.

Examples include:

• Agency management systems and customer relationship management platforms.
• Email, document storage, and cloud services.
• IT providers and managed service providers.
• Payment processors and premium finance platforms.
• Outsourcing firms and virtual assistants.
• Website providers, client portals, and chatbots.
• AI tools and automation platforms.

A provider does not have to store client records to create risk. An IT vendor with administrator privileges may be able to access sensitive information, even when its work does not require it.

Evaluate what each provider could access, not just what it normally uses.

Does cloud software eliminate vendor cyber risk?

No. Cloud platforms can offer strong security, but your agency still needs to manage accounts, permissions, devices, and security settings.

A compromised employee account or vendor login can expose information inside an otherwise secure platform. Available safeguards also provide little protection if nobody enables them.

For each system, confirm:

• Which security features are enabled.
• Who has access and what they can do.
• Which outside applications connect to it.
• How suspicious activity is detected and addressed.

A familiar brand or long relationship does not replace a security review.

How do you assess a vendor’s cyber risk?

Assess vendor risk by examining its access to information, its ability to make changes, and your agency’s dependence on its services.

Smith recommends evaluating three areas: confidentiality, integrity, and availability.

Ask five questions about each provider:

1. What sensitive information can it access?
2. Does it have administrator privileges?
3. Can it change records, transactions, or automated workflows?
4. What stops working if its service goes down?
5. How would a disruption affect clients?

Prioritize providers with broad access, sensitive data, or a critical role in daily operations. This approach aligns with NIST’s supply chain risk guidance, which recommends matching supplier security requirements to their criticality and potential impact.

What cybersecurity questions should agencies ask vendors?

Ask how vendors find weaknesses, protect access, respond to incidents, and restore service. Request documentation that supports their answers.

Start with these questions:

• Risk assessments: Do you conduct regular cybersecurity assessments and address the findings?
• Vulnerability management: How do you identify and fix new security weaknesses?
• Security testing: How do you test your applications and systems?
• Account protection: Do you require multifactor authentication and separate administrator accounts?
• Employee training: How do you train staff to recognize and report threats?
• Incident response: What is your response plan, and how will you notify our agency?
• Recovery: How do you test backups and your ability to restore service?

Larger providers may publish documentation in a trust center. Smaller providers may need to answer directly.

Keep the evidence, record unresolved questions, and document your decision. Bring in cybersecurity expertise when you need help evaluating the answers.

How can agencies secure their side of a vendor relationship?

Control access, enable security features, and monitor important activity. These steps can help limit damage if an employee or provider account is compromised.

Enable multifactor authentication. Require it for employee and vendor accounts wherever supported.

Limit permissions. Give each person or provider only the access needed for the job.

Use individual accounts. Named accounts make permissions easier to manage and activity easier to investigate.

Remove unused access. Review accounts, integrations, and permissions when responsibilities or vendor relationships change.

Verify sensitive requests. Confirm unexpected payment changes or access requests through a separate, trusted channel.

For more on recognizing suspicious requests, read Catalyit’s The Easiest Way to Hack an Insurance Agency: How to Stop It.

What should an agency do if a critical vendor goes down?

Prepare a continuity plan before an outage. Identify the work at risk, assign responsibilities, and establish how staff will serve clients while systems are unavailable.

For each critical provider, document:

• A verified support and incident contact.
• The workflows that depend on its service.
• A secure temporary process for urgent work.
• How employees and clients will receive updates.
• How work recorded during the outage will be reconciled.

Then test the plan. Imagine your agency management system goes down during a busy renewal day. Can staff identify urgent requests, communicate with clients, and track work securely?

Resolve the gaps before a real disruption tests your process.

Frequently asked questions about third-party cyber risk

Can a vendor outage create risk without a breach?

Yes. Failed updates, mistakes, and operational problems can interrupt essential services without an attacker being involved. Third-party risk includes both security incidents and service disruptions.

What is fourth-party cyber risk?

Fourth-party cyber risk comes from your vendor’s providers. A platform your agency uses may depend on another company for hosting, software, or support. Those dependencies can affect your agency if they fail.

Should every vendor complete the same security questionnaire?

Match the review to the risk. A provider with administrator access or sensitive client data deserves more scrutiny than a service with limited access and little operational impact.

How often should agencies review vendor risk?

Review providers before granting access, revisit critical relationships regularly, and reassess when services, permissions, ownership, or security conditions change. Assign a next-review date to keep oversight active.

Start with three critical providers

Choose the three providers your agency depends on most. Record what they can access, what happens if they go down, and what security evidence you have reviewed.

Assign an owner to address the gaps and set a follow-up date. Then work through the rest of your vendor list.

Your agency cannot control every provider’s security. It can control the access it grants, the questions it asks, and how it prepares to keep serving clients.

Explore Catalyit’s cybersecurity and IT resources for additional guidance.

Based on Catalyit’s “Understanding Third-Party Cyber Risk” webinar featuring Ryan Smith, president of Ready State Cybersecurity.