Insurance agency IT
IT Support for Insurance Agencies and Brokerages
Remote support for agencies whose day runs through an agency management system, a dozen carrier portals and a comparative rater, with your technical security controls set up and written down.
- No minimum users
- Month-to-month
- Mon–Fri 8am–8pm ET
Who this is for
Independent agencies, small brokerages and MGAs with roughly 2 to 50 people: producers, CSRs, account managers, and an agency principal or operations manager who looks after the IT on top of everything else.
The setup is browser-heavy: an often cloud-based agency management system, carrier portals and raters in Chrome or Edge, quotes by email and e-signature, and policy documents through carrier downloads. Add dual monitors, a shared scanner, a VoIP phone system and staff who work from home part of the week.
Captive agents should first check what the carrier supplies and manages; we work alongside carrier-issued equipment and networks, not on them.
Title agency? Our real estate and title office page covers wire fraud and ALTA Best Practices.
What you get for $49 per user per month
- Unlimited remote help desk tickets, Mon–Fri 8am–8pm ET
- Microsoft 365 and Google Workspace administration
- Managed EDR antivirus and automated patching
- Cloud backup monitoring
- New-hire setup and offboarding
Software we work with
We are not affiliated with these vendors. Each one supports its own product, and we handle the computers, browsers, accounts and network your staff use to reach it.
| Area | Common apps | What we handle | What the vendor handles |
|---|---|---|---|
| Agency management systems | Applied Epic, Vertafore AMS360, HawkSoft, EZLynx, Momentum (formerly NowCerts) | Workstation and browser setup, required extensions and pop-up settings, printing and PDF output, staff-side sign-in and MFA problems, and cloud backup monitoring if your system is installed locally. | Application bugs, workflow and activity configuration inside the system, data conversion, carrier download mapping and user licensing. |
| Comparative raters and carrier portals | EZLynx Rating Engine, Vertafore PL Rating, carrier agent portals | Separate browser profiles so carrier logins don’t collide, download and pop-up settings, certificate and clock errors, and MFA enrollment per person. | Rating accuracy, carrier question sets, portal outages, and issuing or resetting carrier credentials. |
| Carrier downloads and documents | Ivans Download, carrier eDocs, document storage inside the AMS | Scanner-to-AMS workflows and PDF tools, plus network, firewall and disk checks when a locally installed AMS stops receiving downloads; a cloud AMS receives them on the vendor’s side. | Enrolling carriers for download, mapping errors and missing transactions. |
| E-signature and client communication | DocuSign, Adobe Acrobat Sign, e-signature built into the AMS | User accounts and MFA, deliverability of signature request emails, and browser issues that stop staff from sending. | Template and workflow features, and account billing. |
| Email, phones and remote work | Microsoft 365 or Google Workspace, VoIP softphones, VPN or remote desktop | Mailbox and sign-in security, phishing filtering, softphone and headset setup, home-office connection problems, and remote access with MFA. | Phone service, number porting and platform outages. |
Problems we fix every week
Carrier logins saved in a spreadsheet or every browser
Per-person carrier logins with MFA where offered, listed so you can disable a departing CSR’s; moving them into a password manager is scoped separately — ask before onboarding.
A rater or carrier portal breaks after a browser update
Usually a pop-up blocker, extension or cached data; we fix the browser profile rather than rebuild the computer.
Carrier downloads stopped arriving in the AMS
With a cloud AMS, downloads go from the carrier through Ivans to your vendor, so we check the Ivans Exchange dashboard with you and list the affected policies for you to report to the carrier or vendor. Network checks only matter for a locally installed AMS.
Emails asking to change premium payment or bank details
We tighten filtering, tag external senders and help you set a call-back rule for any payment change.
Read the fix →A CSR’s second monitor keeps going blank
Dock, cable or display driver; we work out which and fix it remotely or tell you which part to swap.
Read the fix →Scanned applications land in the wrong folder
We rebuild scan profiles so documents end up where your AMS or file structure expects them, named consistently.
Someone clicked a phishing link
We help contain it: isolate the device, reset the password, sign the account out everywhere and pull the sign-in and mailbox logs. If client data may be involved, call your cyber insurer or counsel early.
Read the fix →Where agency IT time actually goes
Small, repeat problems cost agencies more time than outages.
| Symptom | Likely cause | What we do |
|---|---|---|
| One carrier portal fails, others work | Carrier-side change or outage, a blocked pop-up, an extension, or stale cookies | Try the portal in an InPrivate or Incognito window. If it works there, clear that site’s data or disable extensions one at a time; if not, check the carrier’s agent notices, then your team reports it to agent support |
| Every web app is slow at once | Internet line, Wi-Fi or DNS | Test the connection path and router; involve the ISP with evidence |
| AMS opens but documents won’t attach | Default PDF app, upload size or browser download settings | Fix the file associations and browser settings on that desk |
| Staff locked out after a phone change | Authenticator app not moved to the new phone | You confirm the request by calling a known number; we reset MFA in the admin console and help them re-enroll; see moving Microsoft Authenticator to a new phone |
Cabling, new desks and network hardware need an on-site visit, which is a separate paid add-on.
Check where your agency management system runs
HawkSoft set mid-2026 as the end of updates and technical support for locally installed HawkSoft 5; HawkSoft 6 runs in HawkSoft’s cloud on Microsoft Azure. If any agency system still runs on an office server, plan the move with your vendor and check the server’s Windows version: Windows Server 2016 support ends January 12, 2027.
Renewal and enrollment seasons: when to change IT
Agency workload bunches around enrollment windows and renewal dates. Do upgrades and migrations in quiet months; keep busy weeks to fixes and security patches.
| When | Who is busiest | IT focus |
|---|---|---|
| August to early October | Medicare and health agents getting ready | Replace aging PCs, finish major Windows updates, test headsets, softphones and call recording, confirm MFA for every producer |
| October 15 to December 7 | Medicare agents (Medicare Open Enrollment) | Change freeze: fixes and security patches only |
| November and December | Health agents (Marketplace open enrollment from November 1); commercial and benefits teams on January 1 renewals | Seasonal staff get their own logins and MFA on day one; no AMS, email or phone moves |
| After the season | Everyone catching up | Offboard seasonal staff: block sign-in, remove AMS and carrier portal users, collect equipment |
Personal lines renew all year, so a mostly property and casualty agency should pick its own slowest month for AMS, phone or network moves.
Medicare Advantage sales calls must be recorded
Under 42 CFR 422.2274(g)(2)(ii), Medicare Advantage plans must make sure third-party marketing organizations, which CMS defines to include independent agents and brokers, record all marketing and sales calls in full, including web-meeting audio, and keep the recordings at least six years, in audio for the first three. We help check that recording works on each producer’s line, softphone and meeting tool, and who can play recordings back; your phone provider runs the feature, and your plan contracts set the details.
Your data security rules come from your state insurance regulator
The Gramm-Leach-Bliley Act sends enforcement for insurance businesses to state insurance authorities (15 U.S.C. 6805(a)(6)), so insurance agency cybersecurity rules come from your state, not one federal rule.
Many states have adopted a version of the NAIC Insurance Data Security Model Law (#668), adopted in 2017; check the version where your agency is licensed. It asks a licensee to keep a written information security program based on a risk assessment and scaled to its size and the sensitivity of its data. Section 4D lists security measures to put in place where that risk assessment finds them appropriate, including:
| Model law measure (Section 4D) | What we help configure and document |
|---|---|
| Access controls so only authorized individuals reach nonpublic information | Named accounts, role-based AMS and file permissions, an access list you can review |
| Encryption or other appropriate protection of nonpublic information sent over external networks and stored on laptops and portable media | BitLocker or FileVault on laptops, with each recovery key saved where you control it before encryption starts; secure ways to send applications and loss runs; no client files on loose USB drives |
| Effective controls, which may include MFA, for anyone accessing nonpublic information | MFA on email, remote access, the AMS and portals that support it |
| Monitoring for attacks, and audit trails | Endpoint protection alerts, and sign-in logs exported or reviewed before they age out (Microsoft Entra keeps sign-ins 7 days on its free tier, 30 days with P1 or P2) |
| Secure disposal of nonpublic information | Wiping PC drives before old computers leave; ask your copier vendor to clear the copier’s hard drive before a lease return |
| Oversight of third-party service providers | Ask us before onboarding |
Under the model text, a licensee with fewer than ten employees, counting independent contractors, is exempt from Section 4, and an agent covered by another licensee’s program doesn’t need its own. A licensee subject to HIPAA with a HIPAA security program, such as some benefits agencies, can meet Section 4 by certifying its compliance in writing.
The exceptions don’t remove the incident duties: investigate a possible cybersecurity event promptly, keep records of every event for at least five years, and notify the commissioner within 72 hours of determining one occurred if the state is your home state as a producer, or if you reasonably believe 250 or more of its residents are involved and the event needs notice to another government body or is reasonably likely to cause material harm. Client notices follow your state’s general data breach notification law. This is a summary, not legal advice, and states change these details.
New York agencies: 23 NYCRR Part 500
If you hold a New York license, the Department of Financial Services cybersecurity regulation applies to you as a covered entity unless an exemption fits. Its second amendment took effect November 1, 2023.
- MFA. Section 500.12 now requires MFA for any individual accessing any of your information systems. That requirement’s two-year transition ended November 1, 2025.
- Limited exemption. Under 500.19(a) you qualify with fewer than 20 employees and independent contractors (counting affiliates), under $7.5 million in gross annual revenue in each of the last three fiscal years (counting affiliates’ New York operations), or under $15 million in year-end total assets (including all affiliates). You still need a written cybersecurity program and policies approved annually, a risk assessment, annual access privilege reviews, a third-party service provider policy, an asset inventory and annual awareness training that covers social engineering. MFA still covers remote access to your systems, remote access to third-party applications, cloud-based or not, from which nonpublic information is accessible, and privileged accounts. Incidents still go to DFS within 72 hours of determining one occurred.
- Agents inside another program. An agent or employee fully covered by another covered entity’s cybersecurity program can be exempt under 500.19(b), but still files a Notice of Exemption.
- Annual filing. By April 15 each year, covered entities submit either a Certification of Material Compliance or an Acknowledgment of Noncompliance for the prior calendar year.
We set up and document the technical pieces: MFA, access privileges, asset lists and encryption. Which exemption you qualify for and what you certify are your decisions with your counsel. This is a summary, not legal advice, and we do not certify anyone.
Who can see client data, and where our team is
Applications, loss runs and claim notes are full of nonpublic information, and both the NAIC model law and Part 500 expect you to vet the service providers who can reach it. Ask us your vendor-vetting questions before onboarding.
- A US-managed support team with engineers in the United States and overseas works your tickets Monday to Friday, 8am to 8pm Eastern.
- Every remote session needs your approval, and you can end it at any time.
- Our engineers use MFA on our own tools, and remote sessions are logged.
If your compliance policy, a carrier agreement or your state’s rules limit where support staff can be located, raise it before onboarding so we can tell you plainly whether we’re a fit.
What the plan covers for an agency
Our managed IT services for insurance agencies run on the Business Support Plan: $49 per user per month, month-to-month, with no minimum users and no setup fee. It includes unlimited remote help desk tickets, Microsoft 365 and Google Workspace administration (adding and removing users, password resets, security setup), managed EDR antivirus, automated Windows patching and tune-ups, cloud backup monitoring, and new-hire setup and offboarding. Moving carrier logins into a password manager is scoped separately — ask before onboarding.
Worked example: an agency with four CSRs, one producer and a principal is 6 users × $49 = $294 a month. Hire a seventh person and it becomes $343.
Outside the plan:
- On-site work such as cabling, network gear or new desks, arranged separately as a paid add-on through a vetted local partner technician; see on-site IT support.
- Hardware and parts, and software licenses for your AMS, raters, Microsoft 365, e-signature or a business password manager.
- Bugs inside a vendor’s own application.
- Legal or regulatory advice, and filings with your insurance department.
Your first 30 days
- Week 1, map the agency. Devices, the AMS and how it is hosted, every carrier portal and rater in use, who has admin rights, and where client documents are stored outside the AMS.
- Week 2, credentials. MFA on email and remote access for everyone, a list of each person’s carrier logins, and a password manager rollout if you add it.
- Week 3, devices and email. Endpoint protection, encryption checked on every laptop, patching on a schedule, external-sender tagging and payment-change warnings in email. A quick pass through our cybersecurity health check checklist shows what is left.
- Week 4, document. A written summary of the technical controls in place and the gaps, as input for your information security program or a carrier’s security questionnaire. It’s not a risk assessment, a compliance certification or legal advice.
Frequently asked questions
Does the FTC Safeguards Rule apply to insurance agencies?
For insurance activities, the Gramm-Leach-Bliley Act gives enforcement to state insurance authorities rather than the FTC. That is why agency data security duties come from state insurance law: the NAIC Insurance Data Security Model Law in states that have adopted it, state customer-information safeguarding rules, and New York’s Part 500 for New York licensees. If your business also offers non-insurance financial services, other rules can apply, so confirm with your counsel.
What is the NAIC Insurance Data Security Model Law?
It is model legislation, number 668, adopted by the National Association of Insurance Commissioners in 2017. States that adopt it require licensees to keep a written, risk-based information security program, oversee service providers, investigate cybersecurity events and notify the commissioner within 72 hours when the law’s criteria are met. Small licensees can be exempt from parts of it, depending on the state’s version.
Do small New York agencies have to follow 23 NYCRR 500?
Usually some of it. Agencies under the 500.19(a) thresholds, such as fewer than 20 employees and contractors, get a limited exemption but still need a written program, a risk assessment and MFA for remote access, for remote access to third-party applications (including cloud apps) from which nonpublic information is accessible, and for privileged accounts. They must also file annually by April 15. Some individual and inactive licensees qualify for full exemptions. DFS publishes the details.
Do you support Applied Epic, AMS360 and HawkSoft?
We support the computers, browsers, network, sign-ins and printing those systems depend on, plus cloud backup monitoring if your system is installed locally. Applied Systems, Vertafore and HawkSoft support their own software, including configuration, downloads and data issues. We are not affiliated with any of them.
Can you help with a carrier’s cybersecurity questionnaire?
Yes, on the technical side. We can tell you accurately which controls are in place, such as MFA coverage, endpoint protection, encryption, backups and patching, and where the gaps are. You review, sign and submit the questionnaire. We do not certify your agency or answer for controls we do not manage.
How should an agency handle carrier portal passwords?
Give each person their own login wherever the carrier allows it, store them in a business password manager rather than a spreadsheet or browser, and turn on MFA wherever it is offered. Shared logins make it impossible to show who accessed a client record, and they stay active after people leave.
How much do managed IT services cost for an insurance agency?
Most providers charge per user or per device each month, and what is included varies, so compare the same scope: help desk, Microsoft 365 or Google Workspace administration, endpoint protection, patching and backup monitoring. Our Business Support Plan is $49 per user per month, month-to-month, with no minimum users and no setup fee, so a 10-person agency pays 10 × $49 = $490 a month. AMS, rater and Microsoft 365 licenses are billed by those vendors.
See whether we’re a fit in 20 minutes
Tell us how many people you have and what you use. We’ll tell you plainly what the $49/user plan covers for you and what it doesn’t.