Insurance
Ohio does not suggest that insurance agencies write a security program. It requires one.
ORC Chapter 3965 obliges every licensee to develop, implement and maintain a comprehensive written information security program, scaled to the size and complexity of the business. We build the technology and write the document.
If somebody asked for your written information security program this afternoon, could you send it? That is the whole question.
Mandatory, not optional
ORC 3965 is a requirement.
Written, not intended
Verbal policies do not qualify.
Scaled to you
Sized to your agency, not a carrier.
Carrier portals
Where your producers live all day.
What The Law Asks
A program based on your own risk assessment, in writing, kept current.
ORC 3965.02 requires each licensee to develop, implement and maintain a comprehensive written information security program based on the licensee’s own risk assessment, commensurate with the size and complexity of the business. The obligation scales; it does not disappear because an agency is small.
The word doing the work there is written. Good habits, a careful office manager and a decent antivirus subscription are not a program. A document that identifies your risks, states your safeguards, assigns responsibility and gets reviewed is.
This differs from the rest of Ohio business in an important way. The Chapter 1354 safe harbour is voluntary — you write a program to earn a legal deffence. Chapter 3965 is not voluntary. You write it because the law says you must.
Write it down, size it right, and review it. That is the whole obligation.
It is also the easy sale internally
Most of what the program requires you either already do or should. The gap is usually that nobody has written it down, assigned it, or reviewed it since.
What We Handle
The program, and the technology underneath it
Risk assessment
The foundation the statute asks you to build on — what data you hold, where it lives, and what would actually go wrong.
The written program
Administrative, technical and physical safeguards documented, responsibility assigned, and a review cycle that keeps it from going stale.
Access control and MFA
Across agency management systems, email and every carrier portal, because credentials are what attackers are actually after.
Client data protection
Applications, policy documents and claims files hold everything an identity thief wants. Encrypted, controlled and retained properly.
Email and impersonation defence
Producers send and receive client information all day. Filtering, encryption and warning banners on external mail.
Incident response planning
Who does what, in what order, and which regulator hears about it — decided before you need it rather than during.
Ohio breach notification applies to you as well — see secure email and Ohio compliance.
The program is required. Making it genuinely useful is optional, and worth it.
Questions
Questions from agencies
We are a small agency. Does ORC 3965 really apply?
The program must be commensurate with your size and complexity, so a small agency writes a smaller program. The obligation to have one does not scale away.
Is a folder of policies enough?
Only if it reflects a real risk assessment, names who is responsible, and is actually reviewed. A template nobody has read is the thing regulators find.
Can you write the program, or only build the technology?
Both. The document is most of the value, and it has to describe what is genuinely in place rather than what a template says.
Does this overlap with what carriers ask us for?
Heavily. Most carrier and E&O security questionnaires ask for exactly what the program documents, so one piece of work answers several requests.
Backup & Security Compliance
SOC 2 Type II platforms
The backup and security platforms we deploy are independently SOC 2 Type II audited.
HIPAA controls, BAAs signed
Configured to the HIPAA Security Rule, and we sign Business Associate Agreements.
PCI DSS aligned
Cardholder environments segmented, encrypted and logged to PCI DSS requirements.
Your One Stop I.T. Shop
Whenever You Are Ready
Could you produce your written program today?
If the honest answer is no, or not one you would want reviewed, that is worth a conversation. We will tell you what exists, what is missing and what it takes.
Required by law. Best done before anybody asks.
Chas Enterprise Group · Grafton, Ohio 44044 · (440) 364-3596 · charley.george@chasenterprisegroup.com