Insurance Sector Preparedness: Insurers Appear Prepared to Recover Critical Operations Following Potential Terrorist Attacks, but Some Issues Warrant Further Review
Released: 2005-12-20T00:00:00

Letter

Background

Insurers, state insurance regulators, and NAIC all have roles that are key to the continued functioning of the insurance sector and important to U.S. consumers and businesses. Insurers provide services that allow individuals and businesses to manage their risk by providing compensation for certain losses or expenses, such as car crashes, fires, medical services, or loss of the ability to work. Some insurers also provide access to certain financial services, such as annuities and mutual funds. State insurance regulators are responsible for enforcing state insurance regulations, and do so primarily through the licensing of agents, the approval of insurance rates and products, and the examination of insurers’ financial solvency and conduct. State regulators typically conduct financial solvency examinations every 3 to 5 years, while examinations reviewing insurers’ conduct are generally done in response to specific complaints by consumers or concerns on the part of the regulator. State regulators also monitor the resolution of consumer complaints against insurers.

NAIC is a body composed of state insurance regulators, and while it does not regulate insurers, it does provide optional services designed to make certain interactions between insurers and regulators more efficient. For example, NAIC operates automated systems that insurers can use to request approvals from state regulators for new insurance products and rates as well as licenses for their insurance agents. Most of the insurers and state regulators we spoke with used these services to some extent, although some insurers said that they did not. NAIC also provides services to state regulators that help them monitor insurers’ financial condition and prepare for examinations. This service primarily involves collecting financial data that insurers are required by state insurance regulations to provide to NAIC, analyzing that data, and providing the analyses to state regulators. State regulators can also access this database to conduct analyses of their own. According to NAIC, all state regulators use these services to at least some extent. Finally, NAIC develops guidance to be used by state examiners, regularly updating this guidance to ensure it adequately addresses existing or emerging conditions in the insurance sector.

Organizations Take Actions to Protect Operations from Disruption, and Recover Operations Should a Disruption Occur

In order to protect their operations from potential disruptions, organizations can invest in both physical and information security measures. Physical security measures are intended to reduce the risk that facilities and personnel could be harmed by individuals or groups attempting unauthorized entry, sabotage, or other criminal acts. Typical measures might include employee access badges, security guards, or video monitoring systems. Information security measures are intended to protect the confidentiality, integrity, and availability of an organization’s information and information systems and to reduce the risk and magnitude of harm resulting from threats such as hackers and computer viruses. These measures might include password controls, firewalls, and intrusion detection systems.

In order to recover their operations should a disruption occur, organizations can develop business continuity plans and invest in business continuity capabilities. Organizations design such plans to guide their response to disruptions, and generally create their plans by identifying the most critical functions and the resources needed to carry out those functions. Business continuity plans and capabilities might include alternate work space should facilities become inaccessible, and backup computer systems and data centers should primary systems and facilities be damaged or destroyed.

Effectively managing the risk of operations disruptions may involve making trade-offs between protecting facilities, personnel, and systems and ensuring business continuity. For example, organizations must weigh the expected costs of operations disruptions against the expected cost of implementing security protections, developing facilities, or implementing other business continuity capabilities to ensure that the organizations would be able to resume operations after a disaster. Costs of disruptions can include revenues actually lost during the outage, as well as lost income because of damage to an organization’s reputation resulting from its inability to resume operations. In addition, risk management guidance suggests that organizations identify potential threats that could cause disruptions, estimate the likelihood of these events, and develop their plans accordingly. By quantifying the costs and probabilities of various types of disruptions, organizations can better allocate their resources. For example, an organization whose primary site is located in a highly trafficked public area may have limited ability to increase the physical security of these facilities but could reduce the risk of disruption with a backup facility manned by staff capable of supporting its critical operations or by cross- training other staff.

The Department of Homeland Security Delegated Responsibility for Protection of the Financial Sector to Treasury

The Department of Homeland Security (DHS), created to help coordinate the efforts of organizations and institutions involved in protecting the nation’s critical infrastructures against terrorist attacks, has delegated to the Department of the Treasury (Treasury) this coordinating role within the banking and finance sector, which includes the insurance sector. Treasury’s responsibilities include collaborating with all relevant federal, state, and local officials and the private sector. To fulfill this responsibility, Treasury coordinates with other federal officials through the Financial and Banking Information Infrastructure Committee (FBIIC), whose members include representatives of the various federal financial regulators and other related organizations. The NAIC is a participating member of FBIIC. Treasury coordinates its collaboration with the private sector through the Financial Services Sector Coordinating Council (FSSCC), whose members include representatives from organizations such as securities exchanges, clearing organizations, and banking, securities, and insurance trade associations. For example, the American Insurance Association is a member of FSSCC.

Disruptions to Insurers’ Operations Could Delay Services to Policyholders, but Disruptions at State Regulators or NAIC Would Have Limited Short-Term Effects

Unless insurers maintain adequate security and business continuity capabilities, disruptions to their operations could occur that might delay the provision of key services to policyholders, such as the processing and payment of insurance claims. While a disruption at a large insurer has the potential to affect a large number of consumers and businesses, the effects would likely be limited to that insurer’s policyholders and would not spread to other insurers or the larger insurance sector. Disruptions to the operations of a state insurance regulator could also delay some important services, such as licensing and product approvals for insurers and complaint resolution for consumers, but such services do not appear to be highly time sensitive, and in the short term, such disruptions would have a limited effect on insurers’ normal operations. Similarly, a disruption to NAIC’s operations could delay services to insurers and state regulators, but these services also do not appear to be highly time sensitive.

Disruptions to Insurers’ Operations Could Delay Important Services, but Limited Risk Exists of Disruption to Larger Insurance Sector

Unless insurers implement security and business continuity capabilities that adequately protect their operations from disruption and allow them to recover those operations in a reasonable amount of time should a disruption occur, important policyholder services could be delayed. Potentially disruptive events could include natural disasters, such as earthquakes or hurricanes, as well as intentional acts like bombings or computer attacks. The primary insurance services insurers provide to policyholders include assessing damage, making payments on claims or through other arrangements such as annuities, and, for health insurers, ensuring access to medical services. A disruption to any of these services has the potential to negatively impact policyholders, holding up funds needed to repair property or pay living expenses and, in some cases, cutting off access to necessary medical attention. Some large insurers have millions of policies, and while it is unlikely that all policyholders would require services at the same time, a disruption at one of these large insurers could affect a large number of people. For example, the annual report of one of the large insurers we spoke with stated that in 2004 they had approximately 65 million policies in force and handled approximately 30,000 claims a day.

The majority of insurers we spoke with generally determined the period of time customers could reasonably be without certain key services before being significantly inconvenienced and set their recovery goals for those services based on these determinations. For most property/casualty and life insurers, recovery goals for claims-processing functions were 3 days or less. For most health insurers, such goals for customer service functions, including telephone information lines and authorizations necessary to receive medical services, was 1 day or less. Three of the five health insurers also told us, however, that access to critical services was not dependent on verification or preauthorization provided by the insurer, so that policyholders could obtain many critical medical services even if the insurer’s operations were disrupted. For example, two health insurers said that possession of an insurance card, and not any action by the insurer, established policyholders’ eligibility for medical services. This is discussed in more detail later in the report.

We also found, however, that several distinctive characteristics of the insurance industry would likely mitigate the potential effects of a disruption at one insurer, even a large company, on the rest of the insurance sector or the larger financial sector. First, limited interdependencies exist among insurers—that is, an insurer’s interactions are primarily limited to those involving its own policyholders, and insurers generally do not depend on other insurers for critical business functions. Second, insurance transactions do not need to pass through a central point or process and thus are unlikely to be caught in a potential bottleneck involving the operations of many insurers. For example, in the securities trading markets, all trades must pass through an exchange and a clearing organization, creating potential single points of failure that could affect the entire securities market. In contrast, no such potential single point of failure exists in the insurance sector. Third, while there are some areas of geographic concentration of insurers, the insurance sector as a whole is geographically dispersed across the United States, making it unlikely that a single wide-scale event could disrupt the operations of a large number of insurers. For instance, a number of large insurance companies are located in New York City, but many more are located in other states. Finally, while insurers do depend on reinsurers to help them manage their level of risk, industry officials told us that the relationship is primarily financial rather than operational, and the interactions are not highly time sensitive. Thus, a disruption at a reinsurer could delay a payment to an insurer but would not affect the insurer’s normal operations. In addition, reinsurers we spoke with told us that a delay of 1 week in the payment of a reinsurance claim would not have a significant negative effect on an insurer, since such claims can take anywhere from several days to years to resolve, depending on their complexity.

Of the seven insurers that told us about their experience with previous potentially disruptive events, such as the 9/11 terrorist attacks, power outages, or hurricanes, all said that the events had not caused a disruption to their operations. Those insurers that were in the areas affected by those events, even one with operations in the World Trade Center on 9/11, said that they were able to restore operations within several days and that their policyholders did not experience a disruption in their service. However, all of the insurers said that the events of 9/11 had caused them to reassess and improve their business continuity capabilities. Specifically, 13 of the insurers said that they now plan for wider-scale disruptions or have more comprehensive plans, 5 had increased their physical security, and 3 had increased the pace of previously planned business continuity improvements.

Disruptions to Insurance Regulators’ and NAIC’s Operations Could Delay Some Services but Would Have Limited Effect in the Short Term

A disruption to the operations of a state insurance regulator could delay some services to insurers and consumers but would generally have a limited effect in the short term. Insurance regulators provide services necessary to insurers’ operations—such as the licensing of agents and the approval of insurance rates and products—as well as services designed to protect consumers, such as the examination of insurers’ financial solvency and conduct, and the resolution of consumer complaints. In addition, regulators may play an important role in overseeing insurers’ response to policyholders’ needs following a disaster. And while a disruption to a regulator’s operations could delay the provision of these services, almost all of the insurers we spoke with said that a delay of even 1 or 2 weeks would likely not have a significant negative effect on insurers or consumers. For example, according to some insurers, a delay of a week or two in a regulator’s approval of a new insurance product or rate would have little effect on their operations. While there are occasions when a regulator’s approval is time sensitive, such as during a merger of insurance companies, such events are infrequent, and insurers do not consider them to be part of their normal operations. Similarly, state regulators’ services on behalf of consumers do not appear to be highly time-sensitive. Because the resolution of consumer complaints against insurers can take several months, and examinations generally occur once every 3 to 5 years, a delay of 1 or 2 weeks would not be substantial.

A disruption to NAIC’s operations could also delay some services to insurers and state regulators but would generally have a limited short-term effect on insurers’ and regulators’ normal operations. As noted earlier, NAIC provides optional automated services to both insurers and state regulators, services that were used to at least some extent by most of the insurers and regulators we spoke with. In addition, NAIC provides data collection and analysis services for state regulators, a service used by all of the state regulators we spoke with. A disruption to NAIC’s operations could disrupt the provision of any of these services but would generally have only a limited short-term effect. As noted above, product and rate approvals and agent licensing did not appear to be highly time sensitive, and a delay of 1 to 2 weeks would not have a significant negative effect. In addition, several of the regulators and insurers that used these NAIC services said that if NAIC’s systems were not operational, other means were available, such as e-mail and standard mail, to complete the same transactions (although less efficiently). Because the examination process is also not highly time sensitive, a delay of 1 or 2 weeks in state regulators’ ability to obtain financial analyses from NAIC or use NAIC’s financial database would not have significant negative effects. Finally, of the 17 insurers that commented on the potential effect of a disruption to NAIC’s operations, 16 said that it would not affect their normal operations.

Insurers, Most State Regulators, and NAIC Have Taken Actions Designed to Protect and Recover Their Critical Operations

Each of the insurers we spoke with, most of the state insurance regulators we met with, and NAIC all indicated that they had taken actions designed to protect their critical operations from disruption and recover them should a disruption occur. The insurers told us that they had generally implemented similar capabilities, using analyses of their own and their customers’ needs to establish their business continuity plans and set their recovery time objectives. As discussed earlier, most insurers told us they could recover their most critical operations within a day and most other operations within 3 days. While each of the state regulators said they had taken steps to back up critical data, three were lacking other important elements of a sound business continuity plan, such as procedures to follow if critical computer systems were unavailable or their primary offices were inaccessible. NAIC has also taken actions to protect and recover its critical systems and told us critical operations could be recovered within 24 hours.

Insurers Have Implemented Security and Business Continuity Capabilities Designed to Meet Their Own and Their Customers’ Needs

As discussed more fully later in this report, while NAIC examination guidelines provide some criteria for insurers to use in developing their information and business continuity capabilities, they do not establish specific recovery time objectives for insurers’ critical operations. To set specific recovery time objectives for their critical systems, most insurers used an analysis of their own needs or some combination of their own and their customers’ needs. For example, some insurers said they had based their recovery time objectives on their need to manage their assets and liquidity, while others said they looked at the length of disruption that would be tolerable to their customers. Those using cost-benefit analyses estimated the costs of disruptions of varying lengths and compared them with the costs of different recovery time capabilities. None of the insurers we spoke with were aware of any generally accepted, industrywide recovery time objectives for insurers’ operations.

Most of the insurers we spoke with said that while they generally faced the same level of threats as financial market organizations, they were less likely to be the target of intentional disruptions because they believed they had a lower public profile than many financial market organizations. That is, while insurers said they generally faced the same threats from events such as natural disasters, power outages, and computer viruses, they also said that they were less likely to be specifically targeted by terrorists, computer hackers, or others because they were not as well known publicly as certain organizations in the financial markets. In addition, most insurers also believed that the insurance sector as a whole faced a lower risk of industrywide disruptions than the financial markets, largely because— unlike the financial markets—the industry did not have a single point through which all transactions passed. A number of insurers also pointed to the geographic dispersion of insurers across the country, compared with the concentration of financial market organizations in New York City, as a reason why the overall insurance sector faced a lower risk of disruption.

The majority of insurers told us that there was less of a need for quick recovery of insurers’ operations compared with other financial market organizations. For example, 10 of the 18 insurers we spoke with felt that their individual company’s need to recover quickly was less than it was for other financial market organizations. In addition, most of the insurers felt that the need for quick recovery in the insurance sector as a whole was less urgent than in the financial markets. These insurers cited several reasons for this, including that most insurance transactions were less time sensitive than financial market transactions and, again, the lack of a potential single point of failure in the insurance sector that could spread a disruption from one insurer throughout the industry.

Insurers Took Similar Actions to Protect Their Operations from Disruption

Most of the 18 insurers we spoke with indicated that they had taken similar actions designed to protect their operations from disruption and meet their recovery needs should a disruption occur. First, insurers indicated that they were taking a number of similar actions designed to protect their information systems and data from theft and disruption, including hacking attempts and computer viruses. For example, all of the insurers we spoke with told us that they had implemented access controls and intrusion detection systems and did regular assessments of potential vulnerabilities in their information systems, including tests in which internal or external parties attempted to gain unauthorized access to their systems. In addition, all of the insurers indicated that they had taken steps designed to ensure their compliance with provisions of the Gramm-Leach-Bliley Act (GLBA) requiring that they protect consumer privacy information, incorporating GLBA requirements in their information security program and performing internal compliance reviews. The insurers we spoke with reported varying levels of intrusion or hacking attempts, with one insurer stating it experienced what it considered to be “frequent” intrusion attempts, six stating they had experienced what they would consider an “average” amount of such attempts for companies such as theirs, and four reporting they had experienced only “occasional” or “infrequent” intrusion attempts. None of the insurers reported having experienced any significant disruptions or thefts as a result of intrusion attempts, viruses, or other types of potentially disruptive events.

All of the insurers had also indicated that they had implemented similar physical security protections, with most stating that the level of security at any given facility usually varied according to the perceived risks at that facility. For example, all of the insurers we spoke with utilized some combination of employee badges or scan cards, visitor stations, or security guards to protect their facilities, but at high-risk locations, such as those located in large cities, or at more critical facilities, such as computer data centers, they implemented greater physical security protections. For example, one insurer established minimum standards for most facilities that included security guards, surveillance cameras, and employee badges. In areas containing critical computer systems, however, the firm installed tailgating alarms—which are tripped if more than one person attempts to enter based on a single employee badge—and biometric devices that ensure a single employee is never alone within the area, reducing the risk that someone could cause a disruption without being observed.

Insurers Implemented Similar Business Continuity Capabilities, Most of Which Are Designed to Recover Critical Operations within a Day

Insurers also told us that they had implemented similar capabilities designed to restore critical operations following potential disruptions. First, all of the insurers we spoke with had separate computer backup facilities designed to be capable of running critical operations that, for almost all of the insurers, were located in different geographic areas from their primary facility. Of the 18 insurers, 14 owned their own backup facility, 3 had contracted with a vendor for backup space and computer systems at the vendor’s facilities, and 1 used a combination of owned and contracted facilities. Second, at least 16 of the 18 insurers were conducting at least some critical operations at multiple geographically dispersed facilities, so that if one facility experienced a disruption, the other facilities could continue those critical operations. Third, at least 13 of the insurers had multiple, geographically dispersed customer call centers and had the ability to immediately reroute calls to any of the call centers should one experience a disruption. Finally, at least 11 of the insurers had the capability for certain staff to log in to the company’s computer systems remotely, from home or other locations, should their offices become inaccessible. Some insurers also had additional capabilities that enhanced their ability to continue operations following a disruption. For example, 4 insurers either owned or had contracted for mobile operations vehicles that could be driven to wherever they were needed. These trailers generally had full computer systems, generators, and satellite communications capabilities and could be used to conduct claims processing or other critical operations. For example, 2 of the insurers used such vehicles to set up temporary claim processing or customer service operations in areas affected by Hurricane Katrina in September 2005 to provide better access for their policyholders. Figure 1 shows an example of one such vehicle.

Most of the insurers told us that they were capable of recovering what they considered to be their most critical operations within 1 day, and recover most other operations within 3 days (see fig. 2). The type of operations considered to be most critical varied somewhat by the type of insurer. All of the health insurers considered customer service functions, including customer call centers and services required to receive medical care, to be one of their highest priorities, and 4 of the 5 health insurers we spoke with said they could restore such operations within 24 hours. All of the property/casualty and life insurers we spoke with considered their investment management functions one of their highest priorities, with all 6 of the life insurers and 6 of the 7 property/casualty insurers telling us they could restore such operations within 24 hours. Claims-processing operations were considered to be of highest priority by 3 of the 5 health insurers, 3 of the 7 property/casualty insurers, and none of the 6 life insurers. For a number of the insurers, the relatively low priority given to claims-processing operations was reflected in longer recovery time objectives. For example, while all 6 life insurers told us they could restore their investment management functions within 24 hours, only 2 could restore their claims-processing operations that quickly. The remaining 4 insurers needed 2 to 4 days. Similarly, while 6 of 7 property/casualty insurers said they could restore their investment management functions within 24 hours, only 3 said they could restore claims-processing operations as quickly. The remaining 4 insurers could restore such operations within 2 or 3 days. As noted earlier in this report, insurers often set their recovery time objectives based on the length of delay tolerable to their customers; thus, while a number of insurers have longer recovery objectives for claims operations, they believe such objectives will still adequately meet their customers needs.

Insurers indicated that they were also taking steps to help ensure the resiliency of their telecommunications capabilities and reduce the risk of a disruption to their ability to communicate and transfer data. As we have noted in a previous report, the September 2001 terrorist attacks highlighted the critical importance of resilient telecommunications services, as the resulting damage disrupted service to thousands of business and residences. We also described some of the difficulties of ensuring that telecommunications services can withstand the effects of disruptions, as well as actions taken by organizations to enhance the resiliency of their telecommunications systems, such as using diversely routed lines and circuits. All of the insurers we spoke with were also taking actions to address their need for telecommunications resiliency. Most of the insurers did so by purchasing services from multiple telecommunications carriers and obtaining contractual provisions that required carriers to ensure diverse routing of the insurer’s lines. One of the insurers that did not use multiple carriers had paid to have its own private optical lines laid in a trench between its primary and backup data centers and planned on using these lines if normal telecommunications capabilities were disrupted. Three insurers also took advantage of technology that utilizes redundant fiber-optic rings whose routes are geographically and physically diverse, thus eliminating potential single points of failure.

Insurers Regularly Tested Their Information Security and Business Continuity Capabilities

All of the insurers we spoke with told us that they regularly tested their information security and recovery capabilities. Testing of information security systems generally involved some form of annual vulnerability assessment or penetration testing. The vulnerability assessments, which were generally done by the insurer, involved identifying potential weaknesses in the insurer’s information security program that could possibly be exploited by hackers or others. Penetration testing, which was generally done by external consultants, usually involved trying to break into the insurer’s information systems, just as an external hacker might do. A few insurers also gave the consultants the same level of computer access as a typical employee in order to test company protections against internal employees gaining access to systems or data for which they did not have access privileges. In addition, all insurers were making some efforts to comply with the information security requirements of GLBA, typically in the form of an annual review by an internal compliance department.

All of the insurers also indicated that they had conducted some type of annual testing of their business continuity capabilities, such as walk- throughs of their business continuity plans or tests of their backup arrangements for their data centers. Many insurers conducted scenario- based exercises that simulated particular events, such as power or telecommunications disruptions, and two insurers conducted surprise recovery tests that required certain units or facilities to activate their continuity plans with no warning. Further, some insurers had their data centers connected in such a way that they tested their recovery capabilities daily. For example, six of the insurers said that critical data was copied from its primary to its backup data center either continuously or a number of times a day, and four of the insurers were routing customer calls among several call centers in order to balance the load of calls at any one data center.

Trend toward Increased Outsourcing by Insurers Raises Potential Concerns

All but one of the insurers we spoke with outsourced some of their operations to at least some extent. In addition, two of the state insurance regulators said that such outsourcing was common among insurers, and two others—as well as a large industry association—noted that the trend toward outsourcing was growing. The most commonly outsourced function was software application development, with about half of the insurers outsourcing some work in this area and most of those using overseas vendors. Four of the insurers had outsourced part or all of their data centers’ backup functions, and three had outsourced some portion of their claims-processing operations. In order to help ensure that information shared with vendors was safeguarded and that any backup arrangements with vendors functioned properly, all of the insurers monitored their outsourced functions to some extent. Most of the insurers required their vendors to adhere to certain information security or business continuity standards, had obtained contractual rights to audit certain aspects of vendors’ operations, and had reviewed audit reports on the vendors’ operations, such as Statement on Auditing Standards (SAS) 70 reports. For example, several insurers said that they required vendors to work only on computer systems owned and maintained by the insurer or to separate the computer systems they used to do work for the insurer from other computer systems. Slightly less than half of the insurers conducted on-site visits to their vendors as part of their monitoring efforts, and a similar number said that they conducted some form of business continuity testing with critical vendors.

Most State Insurance Regulators Had Business Continuity Plans, but Some Plans Lacked Critical Elements

Three state insurance regulators had business continuity plans, but some plans lacked critical elements. Only two of five the state regulators we spoke with appeared aware of any guidance from their state regarding their business continuity capabilities. And while we did not find any laws in any of the five states requiring state agencies to have business continuity plans, the governor of one state had issued an order requiring all state agencies to have continuity of operations plans, and subsequent to our visit in another state, that state established a policy requiring all state agencies to have a business continuity plan. In addition, all of the states appeared to have an office within the state responsible for coordinating the state’s response during an emergency as well as helping state agencies with their recovery plans or capabilities. In the absence of specific state requirements for the business continuity plans of state insurance regulators, we compared what the regulators had in place with guidance issued by the Federal Emergency Management Agency (FEMA) to federal executive branch agencies for use in developing contingency plans and programs for continuity of government operations. The guidance states that continuity of operations planning is simply a good business practice and part of the fundamental mission of agencies as responsible and reliable public institutions. The guidance states that all such plans should provide procedures for conducting operations and administration at alternate operating facilities, and that such facilities should have all computer equipment, software, and other automated data processing equipment necessary to carry out essential functions.

Most of the state insurance regulators we spoke with indicated that they had business continuity plans in place to guide their actions during a potential disruption. Specifically, all of the state regulators had procedures in place to back up critical data, most had plans for how they would operate if their primary facilities were inaccessible, and most had backup computer systems. Despite these precautions, we found that some insurance regulators had not developed certain key components of a business continuity plan. For example, two did not have backup computer capabilities that could be used if their primary computer systems experienced a disruption. Officials at one state regulator said that it was the state’s responsibility to provide such backup systems, and although such capabilities had been promised several years ago, they had yet to be put in place. In addition, two of the state regulators—including one of the regulators that had no backup computer capabilities—had no plans for what actions they would take, or how they would conduct critical operations, if their primary offices were inaccessible. Two of the state regulators we spoke with had set recovery time objectives of restoring critical operations within 2 days after a disruption, but the other regulators had set no such goals.

NAIC officials told us that they can aid state insurance regulators’ business continuity efforts in two ways. First, by servicing as a repository for much of the states’ critical data, including insurer financial data as well as insurer licensing and market regulatory information, NAIC acts as a backup for critical data also possessed by state regulators. Second, NAIC can provide some resources to assist state regulators in the event that a disaster or other disruption affects regulators’ ability to conduct business. For example, following Hurricane Katrina in 2005 NAIC coordinated efforts to provide an automated system to capture, coordinate, and address consumer complaints.

NAIC Has Taken Actions to Protect Its Operations and Recover Critical Functions Following a Potential Disruption

NAIC had taken action designed to protect its critical information systems and data, and recover its operations should a disruption occur. Because no criteria specific to NAIC exist in the areas of information and physical security, we compared NAIC’s capabilities in these areas with guidance for federal agencies. To review NAIC’s information security capabilities, we also compared NAIC’s practices with information security guidance developed for federal agencies in the Federal Information System Controls Audit Manual (FISCAM) and recommended security controls published by the National Institute of Standards and Technology. To review NAIC’s physical security capabilities, we used standards developed by the Department of Justice for federal facilities. While business continuity criteria specific to NAIC also do not exist, NAIC officials told us that they generally try to meet the same criteria as financial market organizations, such as those issued in 2003 by securities and banking regulators. We applied this guidance, which outlines various practices related to the resumption of critical activities by key financial market organizations—including recovering those activities within the same business day, maintaining geographically dispersed resources to meet their recovery objectives, and the routine testing of recovery arrangements.

NAIC’s information security efforts were reasonable since NAIC faces a low level of identified threats and its services are not particularly time sensitive. NAIC implemented numerous information security controls to help protect the confidentiality, integrity, and availability of its systems and information. For example, it required the use of passwords, user IDs, and personal identification numbers to access systems. NAIC also installed devices or software designed to detect intrusions or attempts to gain unauthorized access to their networks and systems and developed appropriate procedures for responding to information security intrusion attempts or incidents. In addition, NAIC established and maintained a security awareness and training program for its personnel and others having access to their systems and networks. Furthermore, NAIC staff periodically tested and assessed the effectiveness of its controls and overall vulnerability of its computer environment. However, it has not had an independent organization test its controls or overall computer vulnerability since 2002. Information security literature suggests that an independent organization, on an annual or biannual basis, should test security controls and the overall vulnerability of an organization’s computer environment. The lack of independent testing does not give NAIC an objective evaluation of its security controls and overall computer environment vulnerability. NAIC, however, has budgeted funds for independent testing purposes in 2006. NAIC also took steps to protect its primary facility from a physical attack. For example, it monitors the exterior and interior of this facility with closed circuit televisions, requires employees and visitors to display identification while on the premises, and limits access to sensitive areas such as computer areas and telecommunication closets.

NAIC had also implemented business continuity capabilities designed to allow it to recover critical operations within 24 hours of a disruption—even the total destruction of its primary facility. NAIC’s current capabilities include a backup computer data center—located off-site within a vendor’s facility—to which critical data is copied many times a day, allowing NAIC to restore operations at the center within several hours. The backup center has work space for six NAIC staff, is on a separate power grid from their primary facility, and is connected to the primary facility via redundant telecommunications lines. In addition, NAIC staff can connect to both the primary and backup sites from remote locations via a telephone line connection. NAIC’s business continuity capabilities also include backup power generators at its primary facility and cross-training for staff to help ensure the availability of critical skills in the event that some staff are incapacitated. Finally, the systems used by NAIC’s Securities Valuation Office can be run out of either NAIC’s primary or backup computer data centers.

NAIC told us they have tested its business continuity capabilities in several ways. First, NAIC tests its entire business continuity plan annually. Second, NAIC tests its backup power capabilities at its primary facility quarterly by shutting down the main power systems and switching over to its backup generators. Third, NAIC conducts an annual audit of both on-site and off- site backup procedures and includes a risk assessment of NAIC’s computer data center. In an actual recovery situation, NAIC was forced to restore the operations of its Securities Valuation Office when the September 11, 2001, terrorist attacks destroyed that facility. NAIC was able to restore the functions of that office quickly at its primary facility, and ran those operations from that location for 6 weeks.

Current Laws and Regulations and State Insurance Examinations Require Insurers to Have Business Continuity and Information Security Plans but Generally Do Not Set Minimum Capabilities

Several federal laws, such as GLBA, the Sarbanes-Oxley Act of 2002, and the Health Insurance Portability and Accountability Act of 1996 (HIPAA), impose general information security requirements. Neither the acts nor their implementing regulations specifically prescribe steps insurers must take to ensure business continuity in the face of disruptions; they also do not require insurers to meet certain recovery time objectives with respect to the operations and systems used to maintain their business and serve customers. State insurance departments we visited examine insurers’ financial solvency and market conduct to regulate the industry and protect consumers and, as part of the examination process, review the steps insurers take to protect their key information systems and data. This review fits within the examination process as part of the larger objective of reviewing insurers’ internal controls over financial solvency and financial reporting systems. Similarly, while state insurance examiners also review insurers’ business continuity programs, they do so as part of the larger objective of reviewing internal controls over information systems and do not require that insurers have minimum capabilities or meet minimum recovery times.

Regulations and State Examinations Do Not Establish Specific Requirements for Business Continuity for Insurers

GLBA requires financial institutions, defined to include most insurance providers or companies, to protect consumers’ personal financial information and limits the conditions under which such information may be distributed to third parties (such as other businesses). The Sarbanes- Oxley Act requires public companies, including insurance companies, to include a management assessment of internal controls for financial reporting. In addition, HIPAA requires the Secretary of Health and Human Services to adopt standards for the electronic exchange, privacy, and security of health information. The regulations that govern these laws outline general security and recovery guidance that insurers must address. But these laws and regulations do not outline specific information security and business continuity protections or minimum requirements to serve customers. For example, the regulations do not require insurers to take specific actions to protect or recover the financial management systems that ensure claims payment in a timely manner.

State regulators we visited examine insurers’ business continuity programs, but only when reviewing internal controls over the information systems critical for insurers’ financial solvency. In addition, these states do not require that insurers meet minimum recovery standards. The placement of business continuity within the context of the overall financial solvency exam poses a potential disconnect between regulators’ concern over insurers’ recovery capability and where business continuity fits in the state exam process. For example, regulators told us that business continuity is an important issue and that making sure insurers can recover the ability to service policyholders, particularly the processing and payment of claims, following a disruption, is of concern to regulators. However, within the financial solvency exam, state regulators review business continuity as a part of their review of information system controls, which may not result in business continuity getting the warranted attention. In contrast, examination guidelines used by federal financial regulators, published by the Federal Financial Institutions Examination Council (FFIEC), contain a separate examination handbook devoted to business continuity planning. In addition, although state insurance regulators had informal expectations that insurers recover certain critical operations, especially claims processing, within two days of a disruption, examination guidelines do not call for examiners to review insurers’ ability to meet certain recovery time objectives. As a result, a potential disparity exists between what regulators expect, and know, regarding insurers’ recovery capabilities and those insurers’ actual capabilities. For example, 9 of the 18 insurers had a goal of recovering their claims- processing operations within 3 or more days, which is beyond regulators’ informal expectations.

On the other hand, the lack of specific recovery time objectives in the insurance sector is similar to the situation for most other financial sector organizations. For example, with the exception of the most critical organizations in the securities markets, many financial services organizations are not required to meet specific recovery time objectives for key operational and information systems. Critical organizations in securities markets—those that are unique, provide centralized functions, or have single points of failure—are required to recover within several hours, but organizations such as broker-dealers are not required to meet specific recovery times. Banks are required to meet certain criteria for developing and testing business continuity plans, but not specific recovery times.

Financial solvency examinations review the accuracy and soundness of insurers’ financial information and seek to protect the public by making sure insurers maintain a financial position sufficient to stay in business and meet customer needs. As part of the exam, regulators review insurers’ business continuity efforts by sending insurers a series of questions from NAIC’s Information Systems Questionnaire (ISQ), which insurers answer prior to the exam. The questions generally ask whether insurers’ business continuity plans prioritize and cover all critical systems, provide for backup computer operations, and ensure that plan components have been tested and remain current. Examiners review the answers and then obtain documentation during the exam to verify insurers’ responses. Often, state examiners will also seek other company files or records or conduct tests of their own to verify responses. Our limited review of exam workpapers found that state examiners appeared to follow NAIC’s examination guidelines and collect supporting documentation to verify insurers’ responses to ISQ questions.

Based on our limited review of exam workpapers and discussions with examiners and insurers, state examinations are generally limited to ensuring that business continuity plans exist, contain basic backup capabilities, and have been tested. NAIC’s exam guidelines do not establish minimum business continuity or recovery capabilities; therefore, state examiners do not hold insurers to minimum recovery time frames or capabilities during their exam. Our review of a sample of state exam workpapers in this area indicated that examiners generally did not find significant weaknesses in insurer’s business continuity efforts. State examinations typically occur on a 3- to 5-year cycle—a significant amount of time between examinations, during which some information may become dated. One regulator responded to the need to remain current with insurers’ business continuity plans by gathering information on the plans annually. This regulator asks insurers on an annual basis to answer a business protection and continuity questionnaire that essentially uses the same questions as the ISQ. This regulator also asks insurers to provide information describing how they will provide services to customers in the event of a wide-scale disaster.

States Examine Insurers’ Information Security Capabilities While Reviewing Internal Controls over Financial Reporting Systems

The primary objective of information security reviews by the states we visited focuses on ensuring the accuracy of financial data related to the solvency of insurance companies. That is, examiners review internal controls that are designed to ensure the accuracy of financial information and the stability of the systems that process the financial information needed, for example, for cash management and claims transactions. To understand insurers’ information security protections, state examiners use ISQ questions and materials to determine the scope of the examination and then review what steps insurers take to protect management, computer application, data processing, and Internet capabilities. Examiners also make sure that insurers use computer passwords, restrict access levels to key data facilities, and protect networks and other systems from hackers and viruses. As with business continuity capabilities, examiners also seek documentation and typically conduct tests of their own to verify insurer protections. Our limited review of a sample of state exam workpapers suggested that examiners identified areas to improve insurers’ information security, but examiners did not view these as significant information security weaknesses that would likely impact either consumers or the larger insurance industry.

We spoke with five state regulators and learned that three are now using outside contractors to help conduct the information systems portions of their exams. As insurers’ business continuity and information security capabilities grow more sophisticated, regulators remain concerned about the ability of their examiners to review increasingly complex information systems. While three of the regulators we visited said that they had the ability to retain staff with necessary expertise, most made use of consultants that they believed possessed the technical skills and expertise needed to understand and assess insurers’ systems.

Unclear Whether Examination of Outsourced Functions Is Adequate

It is unclear whether current examination practices related to state regulator’s review of functions outsourced by insurers are adequate. As noted earlier, several insurers were outsourcing some or all of certain important functions—including computer systems backup and some claims-processing functions—and some insurers and regulators indicated that there appeared to be a trend toward increased outsourcing. State regulators told us that examiners seek to hold outsourced functions to the same standards as functions performed by insurers, and work in this area primarily consisted of reviewing documentation on insurers’ relationships with their vendors, such as contractual audit and testing rights, and reviewing vendors’ audit results obtained by the insurer. However, only one of the state regulators we spoke with had conducted any audit work at a vendor facility, which for some functions might be necessary in order to hold insurers to the same standards as if they performed the functions themselves. For example, NAIC examination guidelines suggest that, as part of their review of insurers’ business continuity capabilities, examiners observe manual processing procedures designed to be used in the event that computer systems are unavailable. Without visiting vendors’ facilities, it is not clear that examiners can always hold insurers to the same standards as if the procedures were carried out at insurers’ own facilities.

Conclusions

Disruptions to insurers’ operations, while unlikely to lead to wider disruptions in the insurance and overall financial sector, have the potential to inconvenience a large number of customers. However, insurers we visited generally appeared to be taking steps designed to protect their operations from disruption and prepare themselves to recover critical operations should a disruption occur. And while NAIC appeared well- prepared for a disruption, the association agreed that increasing the frequency with which they obtain external evaluations of their security controls and overall computer environment vulnerabilities could further increase their preparedness, and had already budgeted the funds to do so in 2006. In contrast, some state regulators were prepared in some areas and less so in others. All five state regulators we visited had procedures in place for backing up their data, but three regulators lacked capabilities in other critical areas. While we recognize that the effect of a disruption to a state regulator’s operations would likely have a limited short-term effect, these regulators provide key services to insurers and customers. Therefore, state regulators could generally benefit from having at least basic business continuity plans to recover their operations in the event of a disruption.

While state insurance regulators indicated the importance of reviewing insurers’ business continuity capabilities, current examination guidelines and practices may not fully reflect this view. Current examination guidelines place regulators’ review of insurers’ business continuity plans within the larger objective of reviewing insurers’ internal controls, which in turn occurs as part of reviewing insurers’ financial solvency. In addition, while regulators have informal expectations for how soon after a disruption insurers should be able to recover certain critical operations, such as claims processing, the examination process does not require examiners to determine whether insurers can meet these informal expectations. This creates a potential disparity between what regulators expect—and what they know—regarding insurers’ recovery capabilities and insurers’ actual capabilities. This may limit regulators’ ability to assess insurers’ ability to recover critical operations within a reasonable time following a disruption.

Finally, the limited frequency with which the regulators we spoke with conducted examination work at vendors’ facilities raised questions about the adequacy of current examination practices regarding functions outsourced by insurers. According to a number of insurers and regulators we spoke with, insurers are increasingly outsourcing certain business functions, including information technology operations. While insurance regulators seek to hold outsourced functions to the same standards as those performed by insurers, examining these arrangements is generally limited to reviewing documentation on insurers’ outsourcing arrangements and, at least among the regulators we spoke with, rarely involves on-site work at vendor locations. Although examiners obtain audit reports and other documentation regarding vendors’ internal controls, which may be sufficient in many cases, it is unclear whether in all cases examiners can review insurers’ operations to the same extent without actually visiting vendors’ facilities.

While the potential concerns with existing examination guidelines and practices identified above may not necessarily have resulted in lengthier disruptions to insurers’ operations to date, the opportunity exists for NAIC to ensure that this remains the case. NAIC already conducts ongoing reviews of state examination guidelines and practices to ensure that they adequately address existing and emerging conditions, and frequently revises those guidelines as a result. Considering the questions and concerns raised in this report as part of that process could potentially result in improved oversight of insurers’ preparedness for potential catastrophic events—whether natural or man-made—and, in so doing, help insurers to better assist consumers, businesses, and others to recover from such events.

Recommendations for Executive Action

In order to ensure that state insurance regulators can continue to provide insurers and consumers with important services within a reasonable time following a potential disruption at a state insurance regulator, state regulators, working through NAIC, as well as other appropriate state officials, should take steps to ensure that state insurance regulators implement consistent, appropriate capabilities for recovering critical functions following a potential disruption.

In addition, in order to help ensure that NAIC continues to adequately protect its information systems, we recommend that NAIC follow through with its commitment to have an independent organization more frequently test NAIC’s information security controls and the overall vulnerability of its computer environment.

Finally, although we visited a limited number of state insurance regulators, and did not observe any specific problems as a result of current examination guidelines and practices, we recommend that state regulators, working through NAIC, use their regular review of the adequacy of state examination guidelines and practices as an opportunity to consider whether any changes to the following are warranted: the manner and extent to which current examinations review insurers’ business continuity capabilities, including the placement of business continuity within the examination guidelines and the minimum recovery time objectives for certain insurer services; and current examination guidelines and practices related to the review of insurers’ outsourcing of critical functions.

NAIC Comments and Our Evaluation

In commenting on a draft of this report, NAIC’s Executive Vice President and Chief Executive Officer generally agreed with our findings and recommendations, and identified actions that NAIC had taken, or planned to take, that were consistent with those recommendations, including actions taken following Hurricane Katrina. NAIC also provided technical comments on the report that were incorporated, as appropriate.

As agreed with your offices, unless you publicly release its contents earlier, we plan no further distribution of this report until 30 days from the report date. At that time, we will send copies to the Chair and Ranking Minority Member, Senate Committee on Banking, Housing, and Urban Affairs; the Ranking Minority Member, Committee on Financial Services, House of Representatives; the President of NAIC; and other interested congressional members and committees. We will also make copies available to others upon request. In addition, this report will be available at no charge on GAO’s Web site at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-8678 or williamso@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III.

Objectives, Scope, and Methodology

The objective of this report is to describe the preparedness of key parts of the insurance industry for major business disruptions such as terrorist attacks and natural disasters. Specifically, we (1) described the potential effects of disruptions to the operations of insurers, state regulators, and National Association of Insurance Commissioners (NAIC); (2) determined what actions insurers, state regulators, and NAIC have taken to prepare for, protect against, and recover from business disruptions; and (3) assessed the extent to which certain current laws and regulations require reviews of insurers’ efforts in these areas and the extent to which state examinations include such reviews. To begin addressing these objectives and obtain background information, we met with officials from insurance industry organizations representing the life, health, and property-casualty insurers.

To describe the potential effects of disruptions to the operations of insurers, state regulators, and NAIC, we interviewed officials from a judgmental sample of 18 large insurers and 5 state insurance regulators, and NAIC. We gathered information from each organization on the potential impact of disruptions on their operations, on policyholders, and on the larger insurance industry. For the purposes of our analysis, we selected large insurers by determining those with the highest total revenue in 2003 in each of the life, health, and property/casualty lines of insurance. The combined 2003 revenue of the life and health insurers in our sample represented approximately 44 percent of the 2003 revenue of all such insurers, while the combined 2003 revenue of the property/casualty insurers represented approximately 37 percent of the 2003 revenue of all such insurers. We selected state insurance regulators according to the states where those 18 insurers were located.

To determine what actions insurers, state regulators, and NAIC had taken to protect against and recover from business disruptions, we interviewed insurers, state regulators, and NAIC officials to ask what protective actions they had taken in the areas of physical security and information security. In addition, we asked about their business continuity plans, including how they were developed, of what they consisted, and how they were tested. In assessing the organizations’ capabilities in these areas, we used criteria that were either established by regulators or were generally accepted by government or industry. As part of our work to assess actions taken by state regulators, we reviewed a sample of examination workpapers from each of the state regulators with whom we spoke. We attempted to review examinations of the insurers we spoke with, but were unable to do so in all cases. For our reviews, we generally relied on documentation and descriptions provided by the organizations, although we did directly observe some security controls and business continuity elements at some insurers, some state regulators, and NAIC. We performed the most in-depth work at NAIC, where our information technology staff performed a review of information security steps NAIC had taken. Through discussions with NAIC officials and our review of NAIC’s Computer and Electronic Information Security Policy and other documentation, we obtained information on NAIC’s computer operating environment, including network and systems configuration, safety of key applications, and how NAIC protects points of interconnectivity between NAIC, insurers, and regulators. We also obtained information to determine whether NAIC’s information security program involved risk-based policies and procedures to address security risks and how NAIC implemented logical, system access, and software change controls. In addition, we reviewed the extent to which NAIC used intrusion detection protection, periodically tested and evaluated its information security program, and had security awareness training for staff, contractors, and others with access to information systems.

To assess the extent to which current laws and regulations and state examinations review insurer business continuity efforts, we reviewed the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act of 1996, and the Sarbanes-Oxley Act of 2002, as well as their applicable regulations, to determine what each required in terms of business continuity and information security. In addition, we met with insurers, state regulators, and NAIC officials to ask how they comply with these and other regulatory requirements. When interviewing state officials, we questioned where business continuity and information fit into the examination process and reviewed state examination workpapers to determine the depth at which state examiners review insurers’ business continuity efforts. During our meetings with state regulators, we reviewed a sample of examination workpapers from state financial solvency examinations of insurers and compared these materials with NAIC’s examination guidelines. In most cases, state regulators provided workpapers from their most recent examination of the insurers with whom we met. One regulator, however, provided us with workpapers from examinations of other insurers with whom we had not met.

For our reviews, we relied on documentation and descriptions provided by insurers, states, and NAIC. When possible during the course of our work, we also observed controls in place for physical security, information security, and business continuity at the organizations assessed. We did not test these controls by attempting to gain unauthorized entry or access to facilities or information systems, or observe testing of business continuity capabilities.

To maintain the security and confidentiality of sensitive business continuity plan information, we agreed not to name insurers or states in the report or describe their continuity or recovery efforts in ways that could identify them. Confidentiality agreements were used between us and states that requested these arrangements. We performed our work from December 2004 through October 2005 in accordance with generally accepted government auditing standards.

Comments from the National Association of Insurance Commissioners

GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Lawrence Cluff (Assistant Director), Emily Chalmers, Kirk Daubenspeck, Patrick Dugan, Marc Molino, Stephen Ruszczyk, and Patrick Ward made key contributions to this report.