A 10 to 50 person insurance agency needs 7 layers of protection: identity, endpoints, email, patching, backups, people, and remote access. Each layer needs a set schedule for proving it's working, not just a one-time install.
At Tomorrow's Technology Today, all 7 layers are part of managed IT at $175 to $350 per user per month:
- 10-person agency: all 7 layers for $1,750 to $3,500 per month
- 25-person agency: the same 7 layers for $4,375 to $8,750 per month
- 50-person agency: the same 7 layers for $8,750 to $17,500 per month
What changes as an agency grows isn't the list of layers. It's how many offices, remote producers, and admin accounts those layers have to cover.
The 7 Layers, and What "Working" Looks Like
"Enterprise-grade, multi-layered security" tells you nothing. Here's each layer, what's in place, and how often it's checked:
1. Identity
Multifactor authentication is required on every email account and enforced everywhere it's within our control. Each computer's local admin password is rotated automatically every day, privileged admin passwords are rotated on a set schedule, and emergency-access accounts are rotated after every use.
2. Endpoints
Every computer and server is monitored 24/7 through managed detection and response, with a human-staffed Security Operations Center reviewing alerts across your firewall, computers, Microsoft 365, and servers at the same time.
3. Email
Email security filtering, plus Microsoft 365 settings hardened against the impersonation that leads to invoice and payment fraud.
4. Patching
Updates go to a test group first and roll out after a 3-day hold. Critical security patches go out immediately. Firewalls and wireless access points are reviewed and updated monthly. Vulnerability scans run monthly, with a vulnerability report every quarter.
5. Backups
Microsoft 365 backup for every agency, and immutable backup copies that ransomware can't alter. An engineer reviews backup status every business morning, and every backup gets a full restore test every other week, with a screenshot as proof.
6. People
Security awareness training is included in every plan: weekly simulated phishing emails, short 2 to 3 minute training modules each week, and every employee's score reviewed with management every quarter.
7. Remote access
Secure connections for producers and staff working from home, on the road, or at a second office, along with secure connections between your offices.
Why Insurance Agencies Are a Specific Target
- Agency management system and carrier portal logins. One stolen login can open policy, client, and claims information.
- Client personal information. Driver's license numbers, dates of birth, and financial details move through agency systems every day.
- Premium and payment fraud. A fake "updated payment instructions" email is cheap for an attacker to send. A call-back to a known contact before changing any payment details is your agency's own control.
- Producers on the road. Home networks, personal phones, and laptops that leave the office.
What Changes at 10, 25, and 50 Employees
- One office, no server: the focus is identity, email, Microsoft 365 backup, and training.
- Multiple offices or an on-site server: add secure connections between offices, server backups, and firewall management at every location.
- Remote producers, or a growing team: tighter admin account controls, a formal process for shutting off a departing employee's access, and a check on whether Ohio's or Indiana's insurance data security law applies to you.
For how those state laws work and what carriers ask at renewal, see what it takes to qualify for or renew cyber insurance.
6 Questions to Ask Your Current IT Provider
- When was our last full restore test, and can I see the proof?
- Is multifactor authentication on for every account, including admin and remote access?
- Who is watching our computers overnight?
- What are our employees' phishing test scores?
- When was our last vulnerability report?
- What happens to a former employee's access on their last day?
If you can't get clear answers, work through 21 questions every insurance agency should ask before choosing an IT provider, or use our free insurance agency IT provider scorecard.
How to Find Out Where Your Agency Stands
- Book a 10-minute discovery call to talk through your agency's IT frustrations and growth plans.
- Get a free technology risk assessment. We review your systems, security, and support, and show you where the gaps are.
- Receive your personalized IT roadmap, a clear plan for closing those gaps.
A Real Client Example: Secure Remote Access in About 30 Minutes
The problem: Two team members at one of our agency clients suddenly needed to work from home.
The solution: They called our help desk, and a technician had them both connected securely within about 30 minutes. We then upgraded the agency to a more secure remote-access system as a planned project, rather than leaving a quick fix in place.
The result: The team kept serving clients from home without opening a hole in the agency's security, and the owner never had to step in.
Why Insurance Agencies Work With Tomorrow's Technology Today
- Supporting independent insurance agencies since 2011
- 24/7 managed detection and response with a human-staffed Security Operations Center, included in every plan
- Every technician is security-trained to CJIS standards and background-checked
- We require every client to carry at least $2 million in cyber liability coverage, and we carry $2 million in professional and cyber liability coverage ourselves
- Our agreements commit us to notify you within 72 hours of confirming unauthorized access to your data in our care
- Headquartered in St. Henry, Ohio, with an office in Fort Wayne; woman-owned and woman-led; Microsoft Partner
See what managed IT costs for a 10 to 50 person agency, and how we support independent insurance agencies across Ohio and Indiana.
Want to know where your agency stands? Book a 10-minute discovery call. Call us at (419) 678-2083 or visit www.TomTechToday.com/discoverycall to schedule yours.