IT support and cybersecurity for insurance agencies in Kansas City

A short checklist

• Risk assessment. Section 375.1405 requires the written program to be based on the licensee's risk assessment. The licensee identifies foreseeable threats, including threats to information held by third-party service providers, assesses likelihood and potential damage, and assesses the safeguards already in place. Implementing section 375.1405 is due January 1, 2027. Section 375.1405.
• Written information security program. Section 375.1405.1 says each licensee shall develop, implement, and maintain a comprehensive written information security program based on that risk assessment, commensurate with the licensee's size, complexity, activities, and the sensitivity of the nonpublic information. The same January 1, 2027 date applies. Section 375.1405.1.
• Multifactor authentication. Section 375.1405.4 says the licensee determines which of the listed security measures are appropriate and implements those measures. One listed measure is effective controls, which may include multifactor authentication procedures for any individual accessing nonpublic information. The statute does not say every licensee must use multifactor authentication the same way. The section's implementation date is January 1, 2027. Section 375.1405.4.
• Third-party service provider oversight. Subsection 6 of section 375.1405 says a licensee shall exercise due diligence in selecting its third-party service provider and shall require that provider to implement appropriate administrative, technical, and physical measures. Section 375.1427 gives licensees until January 1, 2028, to implement subsection 6. Section 375.1402 defines a third-party service provider as a person, not otherwise defined as a licensee, that contracts with a licensee to maintain, process, store, or otherwise is permitted access to nonpublic information through its services. Section 375.1405.6.
• Incident response plan. Section 375.1405.8 says each licensee shall establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event that compromises confidentiality, integrity, or availability. That plan is part of section 375.1405, so the January 1, 2027 implementation date applies. Section 375.1405.8.
• Notice to the Director. Section 375.1410 requires a licensee to notify the director as promptly as practicable, but no later than four business days from a determination that a cybersecurity event involving nonpublic information has occurred, when either criterion in that section is met. Section 375.1402 defines the director as the director of the department of commerce and insurance. Section 375.1427 does not move this notice to January 1, 2027. Bulletin 26-01, which the Department says does not have the force and effect of law, tells licensees to use its electronic form. Section 375.1410.

The effective date and the later implementation dates are in section 375.1427. The full act, including the exceptions, is in sections 375.1400 to 375.1427. Whether your agency is a licensee, and whether an exception applies, is a question for your counsel and the Department. The definition of licensee is in section 375.1402.

How Blue Tree Technology® helps

We help identify IT risks and support the technical safeguards your compliance program needs. Blue Tree Technology® helps Kansas City firms put practical controls in place, including multi-factor authentication, limited access, monitored backup, and a way to remove access when someone leaves. We do not guarantee compliance, and we do not decide whether the Act or an exception applies to your agency.

Automated RMM monitors client devices 24/7 and raises alerts. For security issues, managed detection and response (MDR), endpoint detection and response (EDR), and identity threat detection and response (ITDR) include a SOC that watches for those issues and blocks those threats. That SOC is not a Blue Tree Technology® desk for general IT. The help desk is available Monday–Friday, 8 AM–6 PM Central, except holidays. Blue Tree Technology® does not provide 24/7 support. Higher-end plans include extended hours, and after-hours support is for emergency-type issues.

Related services: managed IT, cybersecurity, IT compliance help, backup and recovery, and ransomware help in Kansas City.

This is not legal advice

This page is general information, not legal advice. Talk with your own counsel, and check Department of Commerce and Insurance guidance, before you treat any of it as a duty that applies to your agency. That is especially true for the exceptions in section 375.1417, including the small-licensee exception.

Section 375.1417.1(1) says a licensee with fewer than ten employees, including any independent contractors, is exempt from section 375.1405. That exception does not, by its own words, exempt the licensee from every other section. Other exceptions in the same section include a HIPAA deemed-compliance path that still requires the director notification in subsections 1 and 2 of section 375.1410, coverage by another licensee's program, and a depository-institution path tied to the Gramm-Leach-Bliley Act guidelines. If a licensee stops qualifying for an exception, section 375.1417.2 gives 180 calendar days to comply.

On the Revisor page, subsection 1(4) reads: “Producers that have fewer than fifty employees; less than five million dollars in gross annual revenue; or less than ten million dollars in year-end total assets; and” The published sentence stops there. This page does not finish it. Read the statute and ask counsel.

Insurance Bulletin 26-01 was issued January 5, 2026. The bulletin says it does not have the force and effect of law. It asks licensees to review the definitions and the exceptions before reporting a cybersecurity event, and it gives this electronic notification form.