What an Insurance Brokerage Needs From Its IT Provider

An independent insurance brokerage runs on information: driver and vehicle details, home and business details, claims histories, banking information and signed documents. Brokers move that information between clients, insurers and agency systems all day, mostly by email and web portals.

That makes IT for a brokerage different from IT for a general office. This post covers what a small BC brokerage should expect from an IT provider, based on what the Insurance Council of BC asks of licensees.

This is general information, not legal or regulatory advice. Check your own obligations with the Insurance Council of BC and your agency's compliance lead.

What the regulator expects

The Insurance Council of BC's licensee responsibilities page says licensees have a duty to safeguard clients' personal information and to determine the safeguards needed to meet that duty. It also says licensees must hold client information in strict confidence and must follow BC's Personal Information Protection Act (PIPA), which requires an organization to designate someone responsible for compliance.

The Council points licensees to the Canadian Insurance Services Regulatory Organizations (CISRO) Cybersecurity Readiness guide from September 2023. Key measures the Council highlights from it include:

• Understanding and following the agency's cybersecurity policies and procedures
• Reviewing cybersecurity practices and addressing identified risks
• Having a cybersecurity incident response plan to protect client information

There is also a CISRO companion guide from November 2024 on using generative AI. Among other things, it tells licensees not to share confidential information in public AI tools.

Section 34 of PIPA sets the general rule: an organization must protect personal information in its custody or control with reasonable security arrangements (BC Laws, PIPA).

A good IT provider should help you meet these expectations and show the work.

What to expect from your IT provider

Secure accounts everywhere

Brokers log in to a lot of places: Microsoft 365 or Google Workspace, the brokerage management system, insurer portals, banking and e-signature tools. Your provider should enforce MFA on your email platform, help you turn it on everywhere else that supports it, and set up a password manager so staff stop reusing passwords. Microsoft documents how security defaults enforce MFA and block legacy sign ins (Microsoft Learn), and Google covers 2-Step Verification for Workspace admins (Google Workspace Admin Help).

Email you can trust

Email carries policy documents, banking details and signed forms. Your provider should configure email filtering, protect your domain against spoofing, and give staff an easy way to report suspicious messages. Pair it with a firm rule: any change to payment or banking details gets confirmed by phone using a number already on file.

Access that matches roles

Producers, CSRs and account managers do not all need access to every client folder. Shared drives and mailboxes should be organized so staff see what their role needs. When someone leaves, their access closes that day, and their mailbox and files are handed to the right person.

A written incident response plan

The CISRO guide asks for an incident response plan. Your IT provider should help you write one: who to call first, how to isolate a computer, how to preserve logs, and who decides whether to notify clients, insurers and the OIPC. A plan that lives only in the IT provider's head does not count.

Backups and recovery

Ransomware and accidental deletion both end the same way: you need yesterday's files back. Backups should cover Microsoft 365 or Google Workspace and any local files, be encrypted, and be tested by actually restoring something. The Canadian Centre for Cyber Security baseline controls list backup and encryption as a core control for small and medium organizations.

Patched, protected devices

Every computer should get automatic updates and run endpoint protection. Laptops should be encrypted. Phones that receive work email should be enrolled so firm data can be wiped if a phone is lost.

Clear answers for questionnaires

Insurers, carriers and cyber insurance applications ask about MFA, backups, patching and training. Your IT provider should be able to answer those questions about your own setup accurately, and fix whatever forces you to answer "no."

Training that fits the job

Short, practical training on phishing, payment fraud and safe use of AI tools, with a refresher at least once a year.

Questions to ask before you sign

1. What is included in the monthly fee, and what costs extra?
2. What are your support hours and response times?
3. Will you help us write and test an incident response plan?
4. How do you test backups, and how often?
5. Do we keep our own admin access to Microsoft 365 or Google Workspace and our domain?

How Astro works with brokerages

Astro Developments is a Surrey, BC IT company. Our Full IT agreement covers help desk, patching, endpoint protection, backups, Microsoft 365 or Google Workspace administration and offboarding when staff leave, with 24/7 system monitoring and alerts. We help you write your security documentation and incident response plan too, so you have something to show when a carrier or questionnaire asks. See our managed IT services.

Offices that sign a 6-month Full IT agreement get a new website built at no charge. Our standard plans stay month to month for the first 3 months (pricing). Email [email protected] or book an IT assessment.