Insurance

Identify where identity documents, financial details, medical records, claims evidence, and coverage information are stored and shared. Include adjusters, brokers, repair networks, analytics platforms, and outsourced administration. Access should reflect current responsibilities, not every role an employee has ever held.

Cerberus can support approved data-protection workflows, while Librarian can help organize systems and ownership. Review unusual exports and external sharing in context. Claims teams may legitimately move large volumes of information, so investigation should establish purpose and authorization before imposing disruptive restrictions.

• Separate sensitive claims access from general customer-service access.
• Review retention and deletion across internal platforms and service providers.

Help-desk procedures deserve the same attention as login controls. Require robust verification for password resets, authentication-factor changes, and emergency access. Include third-party administrators and contractors in these procedures, and give staff an escalation route when a request appears urgent but cannot be verified.

Psycher can support suspicious-request review and Argus can inform credential-exposure investigations. Start Relay integrations with limited permissions. Supplier agreements should make access responsibilities and incident cooperation clear, including which party can revoke access and obtain the records needed for investigation.

• Use named accounts rather than shared support credentials.
• Review privileged access after role changes and supplier transitions.

Map applicable obligations by entity, jurisdiction, and business activity. State adoption and implementation of insurance cybersecurity requirements vary, so a model law should not be presented as a uniform rule everywhere. Maintain evidence of actual controls, exceptions, and remediation ownership.

Judge can help organize that evidence, Growler can support investigation records, and Dewey can assist with response planning. Authorized leadership and counsel retain responsibility for notifications, submissions, and consequential response actions. Exercise an incident involving claims operations and a critical provider, then verify restoration and customer-service alternatives.

• Protect recovery credentials and claims-system backups.
• Avoid equating a dashboard score with insurability, regulatory approval, or reduced premiums.