Insurers, state insurance regulators, and NAIC all have roles that are key to the continued functioning of the insurance sector and important to U.S. consumers and businesses. Insurers provide services that allow individuals and businesses to manage their risk by providing compensation for certain losses or expenses, such as car crashes, fires, medical services, or loss of the ability to work. Some insurers also provide access to certain financial services, such as annuities and mutual funds. State insurance regulators are responsible for enforcing state insurance regulations, and do so primarily through the licensing of agents, the approval of insurance rates and products, and the examination of insurers’ financial solvency and conduct. State regulators typically conduct financial solvency examinations every 3 to 5 years, while examinations reviewing insurers’ conduct are generally done in response to specific complaints by consumers or concerns on the part of the regulator. State regulators also monitor the resolution of consumer complaints against insurers. NAIC is a body composed of state insurance regulators, and while it does not regulate insurers, it does provide optional services designed to make certain interactions between insurers and regulators more efficient. For example, NAIC operates automated systems that insurers can use to request approvals from state regulators for new insurance products and rates as well as licenses for their insurance agents. Most of the insurers and state regulators we spoke with used these services to some extent, although some insurers said that they did not. NAIC also provides services to state regulators that help them monitor insurers’ financial condition and prepare for examinations. This service primarily involves collecting financial data that insurers are required by state insurance regulations to provide to NAIC, analyzing that data, and providing the analyses to state regulators. State regulators can also access this database to conduct analyses of their own. According to NAIC, all state regulators use these services to at least some extent. Finally, NAIC develops guidance to be used by state examiners, regularly updating this guidance to ensure it adequately addresses existing or emerging conditions in the insurance sector. In order to protect their operations from potential disruptions, organizations can invest in both physical and information security measures. Physical security measures are intended to reduce the risk that facilities and personnel could be harmed by individuals or groups attempting unauthorized entry, sabotage, or other criminal acts. Typical measures might include employee access badges, security guards, or video monitoring systems. Information security measures are intended to protect the confidentiality, integrity, and availability of an organization’s information and information systems and to reduce the risk and magnitude of harm resulting from threats such as hackers and computer viruses. These measures might include password controls, firewalls, and intrusion detection systems. In order to recover their operations should a disruption occur, organizations can develop business continuity plans and invest in business continuity capabilities. Organizations design such plans to guide their response to disruptions, and generally create their plans by identifying the most critical functions and the resources needed to carry out those functions. Business continuity plans and capabilities might include alternate work space should facilities become inaccessible, and backup computer systems and data centers should primary systems and facilities be damaged or destroyed. Effectively managing the risk of operations disruptions may involve making trade-offs between protecting facilities, personnel, and systems and ensuring business continuity. For example, organizations must weigh the expected costs of operations disruptions against the expected cost of implementing security protections, developing facilities, or implementing other business continuity capabilities to ensure that the organizations would be able to resume operations after a disaster. Costs of disruptions can include revenues actually lost during the outage, as well as lost income because of damage to an organization’s reputation resulting from its inability to resume operations. In addition, risk management guidance suggests that organizations identify potential threats that could cause disruptions, estimate the likelihood of these events, and develop their plans accordingly. By quantifying the costs and probabilities of various types of disruptions, organizations can better allocate their resources. For example, an organization whose primary site is located in a highly trafficked public area may have limited ability to increase the physical security of these facilities but could reduce the risk of disruption with a backup facility manned by staff capable of supporting its critical operations or by cross- training other staff. The Department of Homeland Security (DHS), created to help coordinate the efforts of organizations and institutions involved in protecting the nation’s critical infrastructures against terrorist attacks, has delegated to the Department of the Treasury (Treasury) this coordinating role within the banking and finance sector, which includes the insurance sector. Treasury’s responsibilities include collaborating with all relevant federal, state, and local officials and the private sector. To fulfill this responsibility, Treasury coordinates with other federal officials through the Financial and Banking Information Infrastructure Committee (FBIIC), whose members include representatives of the various federal financial regulators and other related organizations. The NAIC is a participating member of FBIIC. Treasury coordinates its collaboration with the private sector through the Financial Services Sector Coordinating Council (FSSCC), whose members include representatives from organizations such as securities exchanges, clearing organizations, and banking, securities, and insurance trade associations. For example, the American Insurance Association is a member of FSSCC. Unless insurers maintain adequate security and business continuity capabilities, disruptions to their operations could occur that might delay the provision of key services to policyholders, such as the processing and payment of insurance claims. While a disruption at a large insurer has the potential to affect a large number of consumers and businesses, the effects would likely be limited to that insurer’s policyholders and would not spread to other insurers or the larger insurance sector. Disruptions to the operations of a state insurance regulator could also delay some important services, such as licensing and product approvals for insurers and complaint resolution for consumers, but such services do not appear to be highly time sensitive, and in the short term, such disruptions would have a limited effect on insurers’ normal operations. Similarly, a disruption to NAIC’s operations could delay services to insurers and state regulators, but these services also do not appear to be highly time sensitive. Unless insurers implement security and business continuity capabilities that adequately protect their operations from disruption and allow them to recover those operations in a reasonable amount of time should a disruption occur, important policyholder services could be delayed. Potentially disruptive events could include natural disasters, such as earthquakes or hurricanes, as well as intentional acts like bombings or computer attacks. The primary insurance services insurers provide to policyholders include assessing damage, making payments on claims or through other arrangements such as annuities, and, for health insurers, ensuring access to medical services. A disruption to any of these services has the potential to negatively impact policyholders, holding up funds needed to repair property or pay living expenses and, in some cases, cutting off access to necessary medical attention. Some large insurers have millions of policies, and while it is unlikely that all policyholders would require services at the same time, a disruption at one of these large insurers could affect a large number of people. For example, the annual report of one of the large insurers we spoke with stated that in 2004 they had approximately 65 million policies in force and handled approximately 30,000 claims a day. The majority of insurers we spoke with generally determined the period of time customers could reasonably be without certain key services before being significantly inconvenienced and set their recovery goals for those services based on these determinations. For most property/casualty and life insurers, recovery goals for claims-processing functions were 3 days or less. For most health insurers, such goals for customer service functions, including telephone information lines and authorizations necessary to receive medical services, was 1 day or less. Three of the five health insurers also told us, however, that access to critical services was not dependent on verification or preauthorization provided by the insurer, so that policyholders could obtain many critical medical services even if the insurer’s operations were disrupted. For example, two health insurers said that possession of an insurance card, and not any action by the insurer, established policyholders’ eligibility for medical services. This is discussed in more detail later in the report. We also found, however, that several distinctive characteristics of the insurance industry would likely mitigate the potential effects of a disruption at one insurer, even a large company, on the rest of the insurance sector or the larger financial sector. First, limited interdependencies exist among insurers—that is, an insurer’s interactions are primarily limited to those involving its own policyholders, and insurers generally do not depend on other insurers for critical business functions. Second, insurance transactions do not need to pass through a central point or process and thus are unlikely to be caught in a potential bottleneck involving the operations of many insurers. For example, in the securities trading markets, all trades must pass through an exchange and a clearing organization, creating potential single points of failure that could affect the entire securities market. In contrast, no such potential single point of failure exists in the insurance sector. Third, while there are some areas of geographic concentration of insurers, the insurance sector as a whole is geographically dispersed across the United States, making it unlikely that a single wide-scale event could disrupt the operations of a large number of insurers. For instance, a number of large insurance companies are located in New York City, but many more are located in other states. Finally, while insurers do depend on reinsurers to help them manage their level of risk, industry officials told us that the relationship is primarily financial rather than operational, and the interactions are not highly time sensitive. Thus, a disruption at a reinsurer could delay a payment to an insurer but would not affect the insurer’s normal operations. In addition, reinsurers we spoke with told us that a delay of 1 week in the payment of a reinsurance claim would not have a significant negative effect on an insurer, since such claims can take anywhere from several days to years to resolve, depending on their complexity.