industries · insurance

Agents, adjusters and policyholders each get the access they need and no more.

Insurers manage more outside identities than most industries. Independent agents, MGAs, TPAs, adjusters and policyholders each come in through a different portal. We build the identity layer for those audiences and govern the data behind underwriting and claims. We also keep the records state regulators ask for.

Talk to an engineer The rules that apply

industry / insurance 4 rules in scope

Auth0OktaSailPointSalesforce

in short·20-second read

Insurers juggle access for employees, independent agents, third-party administrators and policyholders, and they answer to state insurance data security laws and NYDFS Part 500 while doing it.

Cohash builds customer and partner identity for the agent and policyholder portals. We put governance on policy and claims systems. And we set up governed data platforms for underwriting and AI models, with the lineage and documentation the NAIC AI bulletin expects.

you probably need this if

Agents who left an agency months ago can still log in to quote.
Independent adjusters share one claims system account per firm.
Policyholder account recovery is a security question set up a decade ago.

Ask an engineer facts checked 2026-10-20

how it runs: 01Map each rule to its systems
02Measure who can reach regulated data
03Fix and automate the controls
04Produce evidence auditors can sample
rules: State insurance data security lawsNYDFS Cybersecurity RegulationNAIC Model Bulletin on the Use of AI Systems by InsurersNYDFS Insurance Circular Letter No. 7
platforms
proof: 6 case studies on this
background: field note · 13 minAuth0's lazy migration changes on 20 January 2027, and half-imported users won't fix themselves

regulations

The rules your access program answers to

Summaries for orientation, not legal advice. Ask us how each one maps to your systems.

State insurance data security laws (NAIC Model 668)

28 jurisdictions had adopted the model as of 8 October 2026. If you're licensed in one, do the risk assessment first and build your security program from it. Vet third-party service providers. Tell the commissioner within 72 hours of a breach. Domestic insurers file the annual certification by 15 February.

map it to your systems →

NYDFS Cybersecurity Regulation (23 NYCRR Part 500)

Covers insurers and producers licensed in New York. MFA for all users has applied since 1 November 2025. Class A companies must also run a privileged access management solution and automatically block commonly used passwords under 500.7(c).

map it to your systems →

NAIC Model Bulletin on the Use of AI Systems by Insurers

Adopted by the NAIC in December 2023 and by 29 jurisdictions as of 8 October 2026. Insurers using AI in decisions that affect consumers need a written AI program covering governance, risk controls, data and model documentation, and oversight of third-party AI vendors.

map it to your systems →

NYDFS Insurance Circular Letter No. 7 (2024)

Issued in July 2024. If you underwrite or price with external consumer data or AI systems, this tells you what's expected. Govern them. Test for unfair discrimination. Document where the data came from.

map it to your systems →

from rule to evidence

How a regulation turns into proof.

For insurance, each rule below lands as a control, the control runs on a platform, and the platform leaves a record an auditor can read.

01
Rules you answer to

State insurance data security laws NYDFS Cybersecurity Regulation NAIC Model Bulletin on the Use of AI Systems by Insurers NYDFS Insurance Circular Letter No. 7
02
Controls we build

Agent and broker identityPolicyholder sign-inGovernance for policy and claims systemsGoverned data for underwriting and AIAgent and service CRM
03
Platforms that enforce them
04
Evidence your auditors read

Access review records Joiner, mover and leaver logs Privileged session records Change and approval history Control-to-rule mapping

the story · insurance access program

From the first call to a setup your own team can run.

Here's what usually prompts a call about your insurance access program, what we do about it and in which order, and where you end up.

01 · where it hurts02 · what we change03 · how it runs04 · where you end up

incident board · insurance access program3 open

openAgents who left an agency months ago can still log in to quote.

recurringIndependent adjusters share one claims system account per firm.

blockedPolicyholder account recovery is a security question set up a decade ago.

exposure

Agent and broker identityPolicyholder sign-inGovernance for policy and claims…Governed data for underwriting…Agent and service CRM

startrehearsehandover

Map each rule to the systems…

Measure who can reach…

Fix access and automate the…

Produce evidence auditors…

we are here

ready to hand over

End the appointment in the licensing system and the portal login dies with it.
Next time a regulator asks what fed the rating model, the pricing team pulls up the…

chapter 01 · where it hurts
Why teams reach out
- Agents who left an agency months ago can still log in to quote.
- Independent adjusters share one claims system account per firm.
- Policyholder account recovery is a security question set up a decade ago.
chapter 02 · what we change
How we solve it
- Agent and broker identity
- Policyholder sign-in
- Governance for policy and claims systems
- Governed data for underwriting and AI
- Agent and service CRM
chapter 03 · how it runs
Our approach
- Map each rule to the systems it touches
- Measure who can reach regulated data today
- Fix access and automate the controls
- Produce evidence auditors can sample
chapter 04 · where you end up
What changes
- End the appointment in the licensing system and the portal login dies with it.
- Next time a regulator asks what fed the rating model, the pricing team pulls up the lineage instead of searching notebooks and email.

challenges and answers

Where it usually goes wrong, and what we do about it

where it goes wrong

01
Independent agents who change agencies
Agents move from agency to agency and hold appointments with lots of carriers. In small offices they share a login. None of that changes what the carrier needs to know, which is the person who quoted the policy, and when to cut access because the appointment ended.
02
TPA and claims vendor access
Third-party administrators, independent adjusters and repair networks need claims system access. Model 668 makes their security your problem, yet their accounts rarely follow your HR-driven processes.
03
Policyholder account takeover
Policyholder portals hold payment details and claim payouts, so they attract fraud. Reused passwords and weak recovery flows let it in. Bolt on friction and the service center phones start ringing.
04
Underwriting data without lineage
Pricing and claims models pull from policy, claims and third-party data. A regulator asks which data fed one decision. Right now the answer lives in the head of whoever built the model.
05
Policy systems from several eras
Mainframe policy admin, a newer platform for one line and acquired books on something else. Each has its own roles, so access reviews run per system and rarely line up.

how we help

01
Agent and broker identity
Customer and partner identity on Auth0 or Okta. Each agency gets delegated admin, and the bigger ones federate their own identity. Access hangs off appointment status. When the appointment ends, so does the login.
02
Policyholder sign-in
Passkeys, risk-based MFA and safer account recovery for policyholder portals and apps. We design it with the service center, so a sign-in change doesn't turn into a spike in calls.
03
Governance for policy and claims systems
Role design, certifications and separation of duties across policy admin, billing and claims. TPA and vendor accounts get reviewed in the same campaign as staff.
04
Governed data for underwriting and AI
Lineage, access policies and documentation on Databricks or Snowflake for the data your pricing and claims models use. When the NAIC bulletin asks for an AI program, these are the records it runs on.
05
Agent and service CRM
Salesforce or Dynamics 365 for agent management, policy servicing and claims intake. Hook it to the identity layer and each agent sees their own book and nobody else's.

typical situations

Situations we walk into

We pieced these together from insurance situations that come up a lot. They're patterns. You won't find a specific client in them.

case file 01

Agents who changed agencies and kept their quoting logins

composite · not a client story

Beforethe situation

A regional property and casualty carrier gives independent agents accounts in its agent portal. Appointment terminations reach the licensing system weeks before anyone touches the portal, and several small agencies share one login per office.
What we dothe work

We move agents into a customer and partner identity platform with agency-level delegated administration, and tie each account to appointment status from the licensing system. Agency principals manage their own staff. At renewal, shared logins get replaced with named accounts.
Afterwhere you end up

End the appointment in the licensing system and the portal login dies with it. Every quote now has a named agent on it. When an agency hires someone, the principal sets them up without calling the carrier.

case file 02

A regulator asks which data fed a rating model

composite · not a client story

Beforethe situation

A regulator asked which external data sources fed a personal auto rating model. The pricing team had to rebuild the answer from notebooks and email. NYDFS Circular Letter No. 7 applies to the carrier's New York business.
What we dothe work

We put every pricing data source and feature in the data platform catalog, with lineage running from source to model. Third-party data vendors get recorded, along with how each was vetted. Access policies keep production features in the model team's hands only.
Afterwhere you end up

Next time a regulator asks what fed the rating model, the pricing team pulls up the lineage instead of searching notebooks and email. The same records serve the AI program under the NAIC bulletin.

architecture

How agents, policyholders and staff reach insurance systems and data

Agents, policyholders and TPAs come in through customer and partner identity. Employees use the workforce identity provider. Policy and claims systems feed a governed data platform, and that's where pricing and claims models get documented data.

case studies

Work on the platforms insurance runs on

All case studies

upgrade Identity and access

Moving Auth0 Rules and Hooks to Actions before Auth0 switches them off

Moving Auth0 Rules and Hooks to Actions before Hooks stop on 30 April 2027 and Rules on 31 January 2028, with token claims checked before and after each change.

read the case study

implementation Industry platforms

TriZetto Facets upgrades and CMS-0057-F interoperability APIs

Keeping TriZetto Facets current while we build the Provider Access, Payer-to-Payer and Prior Authorization APIs that CMS-0057-F requires by January 2027.

read the case study

implementation Identity and access

Homegrown customer login to Auth0 or Okta Customer Identity

We swap homegrown customer login and its user table for Auth0, move users without forcing password resets, and keep the CRM records in sync.

read the case study

migration Identity and access

On-premises Active Directory to cloud-first Microsoft Entra ID

We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.

read the case study

implementation Industry platforms

Epic integrations, FHIR APIs and TEFCA connectivity

Building and governing the HL7 and FHIR integrations, SMART on FHIR apps and TEFCA exchange around Epic, with an interface catalog and scope reviews.

read the case study

migration Identity and access

ForgeRock AM/IDM to PingOne Advanced Identity Cloud

Moving self-managed ForgeRock AM and IDM, now called PingAM and PingIDM, to PingOne Advanced Identity Cloud without breaking sign-in or provisioning.

read the case study

talent and delivery · insurance

Certified engineers, wherever you need them.

Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.

Onsite

Engineers at your sites in the US

Nearshore

Overlapping hours with US teams

Offshore

Overnight progress on your backlog

All time zones

Coverage handed over across time zones

24-hour coverage · US Central time

OnsiteUS business hours

Nearshoreoverlapping US hours

Offshoreovernight progress

Combinedhandover, not hand-off

due diligence · insurance

Questions to ask any partner, including us.

Put these to anyone bidding on your insurance work. The ones who've done it answer differently from the ones who've read about it.

Q1
We're licensed in states beyond our domicile. How will you map controls to every one of them?
Model 668 duties follow your licenses into every state that's enacted it. New York does its own thing with Part 500. Pick the strictest rule that applies and build once, or you'll be rebuilding state by state.
Q2
What will your work give us toward the annual Model 668 certification?
Domestic insurers in adopting states file a compliance certification each year by 15 February. Ask how the identity and access work will produce evidence you can put behind that filing.
Q3
If we're a Class A company under Part 500, how does your design meet 500.7(c)?
Class A companies have to run a privileged access management solution and block commonly used passwords automatically. Put both in the design on day one. Don't leave them until after the exam.
Q4
How will TPA and independent adjuster access fall under third-party oversight?
Model 668 wants due diligence on third-party service providers. In practice their accounts need an owner, an end date and a review, even if they sign in through your customer identity platform.
Q5
The NAIC bulletin says we need an AI program. What records will the data platform actually keep to back it up?
Adopting jurisdictions want documentation of your data, your models and your third-party vendors. Build lineage and access logging into the platform and that record piles up on its own. Nobody has to make a project of it.

01Does Model 668 apply if our home state hasn't adopted it?

It only binds you in states that have enacted it. The duties follow your licenses, though, so your domicile isn't the whole story. Some non-adopting states have their own rules, New York's Part 500 for one. We map controls to every state you're licensed in and build one program to the strictest.

02Can independent agents sign in with their agency's own login?

Often they can. A big agency with its own identity provider federates through SAML or OIDC. Small agencies usually get accounts in your customer identity platform. Then a principal at each agency manages its own people, and your service desk stays out of it.

03What does the NAIC AI bulletin mean for our data team?

Adopting states expect a written AI program. Your data team has to be able to say which data feeds each model, who's allowed to change it, and how third-party data and models were vetted. Lineage, access controls and documentation on the data platform give you most of that.

04Do you also implement the CRM for agents and service teams?

Yes. We implement Salesforce and Dynamics 365 for agent management, servicing and claims intake. They hang off the same identity layer, so an agent loses access when the appointment goes.

05Can you help us answer a regulator's data request about a model?

Our part is the data platform. We help pull together sources, lineage, access history and documentation. Writing the response, and any legal interpretation, stays with your compliance team and counsel.

services

Services for insurance

The services insurance clients ask us for most, alongside the work on this page.

you are hereInsurance

fact-checked Checked against vendor and official documentation last checked 2026-10-20 content fingerprint 9ec5afbb

01Book a 30-minute working sessionsenior engineer
02Talk to an engineer about your setupreply within 24 hours
03See how similar projects wentcase studies

Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →

next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies

useful to bring

The platform and the version you're on
Where you need to get to, and by when
What's custom: rules, plugins, integrations
Any audit finding or deadline driving it

Agents, adjusters and policyholders each get the access they need and no more.

The rules your access program answers to

State insurance data security laws (NAIC Model 668)

NYDFS Cybersecurity Regulation (23 NYCRR Part 500)

NAIC Model Bulletin on the Use of AI Systems by Insurers

NYDFS Insurance Circular Letter No. 7 (2024)

How a regulation turns into proof.

Rules you answer to

Controls we build

Platforms that enforce them

Evidence your auditors read

From the first call to a setup your own team can run.

Why teams reach out

How we solve it

Our approach

What changes

Where it usually goes wrong, and what we do about it

Independent agents who change agencies

TPA and claims vendor access

Policyholder account takeover

Underwriting data without lineage

Policy systems from several eras

Agent and broker identity

Policyholder sign-in

Governance for policy and claims systems

Governed data for underwriting and AI

Agent and service CRM

Situations we walk into

How agents, policyholders and staff reach insurance systems and data

Work on the platforms insurance runs on

Moving Auth0 Rules and Hooks to Actions before Auth0 switches them off

TriZetto Facets upgrades and CMS-0057-F interoperability APIs

Homegrown customer login to Auth0 or Okta Customer Identity

On-premises Active Directory to cloud-first Microsoft Entra ID

Epic integrations, FHIR APIs and TEFCA connectivity

ForgeRock AM/IDM to PingOne Advanced Identity Cloud

Certified engineers, wherever you need them.

Onsite

Nearshore

Offshore

All time zones

Questions to ask any partner, including us.

We're licensed in states beyond our domicile. How will you map controls to every one of them?

What will your work give us toward the annual Model 668 certification?

If we're a Class A company under Part 500, how does your design meet 500.7(c)?

How will TPA and independent adjuster access fall under third-party oversight?

The NAIC bulletin says we need an AI program. What records will the data platform actually keep to back it up?

Services for insurance

Tell us what you're running. We'll tell you what we'd do first.