Third-party cyber risk is the potential for a vendor or business partner to expose your insurance agency’s data, compromise its systems, or disrupt operations. To reduce that risk, identify your providers, review their access, verify their security practices, and plan for outages.
Your agency management system, email platform, IT provider, and connected tools help your business run. What happens when one of them has a problem?
In Catalyit’s Understanding Third-Party Cyber Risk webinar, Ryan Smith, president of Ready State Cybersecurity, outlined a practical approach: secure your agency’s side of each relationship and verify how providers protect theirs.
A third party is an outside organization or service your agency relies on, shares information with, or allows into its systems.
Examples include:
A provider does not have to store client records to create risk. An IT vendor with administrator privileges may be able to access sensitive information, even when its work does not require it.
Evaluate what each provider could access, not just what it normally uses.
No. Cloud platforms can offer strong security, but your agency still needs to manage accounts, permissions, devices, and security settings.
A compromised employee account or vendor login can expose information inside an otherwise secure platform. Available safeguards also provide little protection if nobody enables them.
For each system, confirm:
A familiar brand or long relationship does not replace a security review.
Assess vendor risk by examining its access to information, its ability to make changes, and your agency’s dependence on its services.
Smith recommends evaluating three areas: confidentiality, integrity, and availability.
| Risk area | What it means | Agency example |
|---|---|---|
| Confidentiality | Keeping sensitive information private | A provider exposes client applications or policy documents. |
| Integrity | Protecting information from unauthorized changes | A compromised account changes payment instructions. |
| Availability | Keeping systems and information accessible | A vendor outage blocks access to agency records. |
Ask five questions about each provider:
Prioritize providers with broad access, sensitive data, or a critical role in daily operations. This approach aligns with NIST’s supply chain risk guidance, which recommends matching supplier security requirements to their criticality and potential impact.
Ask how vendors find weaknesses, protect access, respond to incidents, and restore service. Request documentation that supports their answers.
Start with these questions:
Larger providers may publish documentation in a trust center. Smaller providers may need to answer directly.
Keep the evidence, record unresolved questions, and document your decision. Bring in cybersecurity expertise when you need help evaluating the answers.
Control access, enable security features, and monitor important activity. These steps can help limit damage if an employee or provider account is compromised.
Enable multifactor authentication. Require it for employee and vendor accounts wherever supported.
Limit permissions. Give each person or provider only the access needed for the job.
Use individual accounts. Named accounts make permissions easier to manage and activity easier to investigate.
Remove unused access. Review accounts, integrations, and permissions when responsibilities or vendor relationships change.
Verify sensitive requests. Confirm unexpected payment changes or access requests through a separate, trusted channel.
For more on recognizing suspicious requests, read Catalyit’s The Easiest Way to Hack an Insurance Agency: How to Stop It.
Prepare a continuity plan before an outage. Identify the work at risk, assign responsibilities, and establish how staff will serve clients while systems are unavailable.
For each critical provider, document:
Then test the plan. Imagine your agency management system goes down during a busy renewal day. Can staff identify urgent requests, communicate with clients, and track work securely?
Resolve the gaps before a real disruption tests your process.
Yes. Failed updates, mistakes, and operational problems can interrupt essential services without an attacker being involved. Third-party risk includes both security incidents and service disruptions.
Fourth-party cyber risk comes from your vendor’s providers. A platform your agency uses may depend on another company for hosting, software, or support. Those dependencies can affect your agency if they fail.
Match the review to the risk. A provider with administrator access or sensitive client data deserves more scrutiny than a service with limited access and little operational impact.
Review providers before granting access, revisit critical relationships regularly, and reassess when services, permissions, ownership, or security conditions change. Assign a next-review date to keep oversight active.
Choose the three providers your agency depends on most. Record what they can access, what happens if they go down, and what security evidence you have reviewed.
Assign an owner to address the gaps and set a follow-up date. Then work through the rest of your vendor list.
Your agency cannot control every provider’s security. It can control the access it grants, the questions it asks, and how it prepares to keep serving clients.
Explore Catalyit’s cybersecurity and IT resources for additional guidance.
Based on Catalyit’s “Understanding Third-Party Cyber Risk” webinar featuring Ryan Smith, president of Ready State Cybersecurity.