What is Evolving Technology Solutions?

Evolving Technology Solutions manages 5 data types including leads. Helps you organize, track, and share your work in 1 place for teams and solo users.

Which states have adopted MDL-668?

As of 2026, over 28 states have enacted MDL-668 or substantially equivalent legislation, including Michigan, Ohio, Indiana, Wisconsin, New York, Virginia, Tennessee, and others. The full adopted-states list is maintained at naic.org. If your agency holds licenses in multiple states, you may have overlapping obligations, the Scorecard helps map which frameworks apply to your specific situation.

What happens during a DOI audit without a WISP?

A state Department of Insurance examination that finds no Written Information Security Program is treated as a material non-compliance finding. Depending on the state, outcomes can include a formal remediation order (with a compliance deadline), statutory fines (in Michigan, up to $100,000 per violation per day for willful non-compliance), and referral for appointment review. Carrier appointments that require WISP attestation at renewal may also be at risk.

Does a WISP cover the DOI requirement entirely?

In most enacted states, a compliant WISP that addresses all six MDL-668 elements, security program, risk assessment, technical controls, incident response plan, vendor oversight, and record retention, satisfies the core DOI requirement. Some carriers have additional attestation requirements on top of MDL-668 (particularly around multi-factor authentication and endpoint protection). The Scorecard helps identify whether you have carrier-specific gaps beyond the statutory minimum.

How long does WISP delivery take?

28 days for agencies of 10-100 employees. That timeline covers: initial Scorecard baseline (day 1-3), policy drafting and review cycle (day 4-21), training program delivery and incident response plan completion (day 22-28). Agencies with significant existing documentation may complete faster. We don't stop at 28 days if something isn't done, the engagement continues until you have a document you can hand to your DOI or carrier.

Can we use our existing policy document?

Yes, if it's salvageable. We can update an existing WISP rather than draft from scratch, which often saves time and preserves institutional context your operations manager already understands. The Scorecard benchmarks your current document against all six MDL-668 elements and tells us whether we're updating or rebuilding.

What happens if our agency files with the state DOI without a WISP?

Most states with NAIC Model Law MDL-668 adopted treat the WISP as an enforceable license condition. A DOI audit without a WISP can result in remediation orders, statutory fines, and in some states a producer-license review. Carrier appointment teams increasingly require proof of a WISP before renewing or adding new appointments. At least 28 jurisdictions have adopted the model law as of early 2026.

MicrosoftSolutions Partner

10-person team · 200+ combined years

Grand Rapids, MI · serving West Michigan

How can a small business in a regulated industry (healthcare, finance, legal) stay HIPAA and PCI-DSS compliant without hiring an in-house IT team?

Small businesses in regulated industries can achieve and maintain HIPAA, PCI-DSS, GLBA, NAIC, IRS Pub 4557, and CMMC compliance without an in-house IT team by combining (a) an MSP-delivered Compliance-as-a-Service program with documented controls, written policies, and quarterly evidence collection, and (b) a fractional vCISO who owns risk assessment, incident response, and auditor liaison. Compliance software like Drata or Vanta automates evidence collection but does NOT operate your firewalls, patch your endpoints, train your staff, respond to incidents, or sign off on residual risk, you still need an operator. Evolv combines both. Evolv's regulated-industry program covers: (1) Written Information Security Program (WISP) tailored to your framework, $6,500 for HIPAA, $7,500 for NAIC, $5,500 for IRS Pub 4557, $4,500 for CMMC Level 1, $45,000 for CMMC Level 2. (2) vCISO at $3,500/month, quarterly risk assessments, board reporting, incident response leadership, vendor risk review. (3) 24/7 SOC monitoring through our Fortinet, Sophos, and Barracuda partner stack. (4) Annual policy review, tabletop exercises, and employee security awareness training. (5) Audit-ready evidence binder maintained continuously, not scrambled at audit time. This stack costs a 25-employee healthcare practice roughly $6,000/month all-in (CaaS + vCISO + WISP amortized), substantially less than a $130K+/year in-house IT manager plus tooling, and with broader expertise. Drata and Vanta cost $7,500-$25,000/year for the software alone and require you to bring the operator.

See compliance pricing →vCISO details →CaaS details →

NAIC MDL-668 · Insurance Agencies · Michigan & 28+ States

NAIC WISP in 28 days. Or we keep working until it's done.

Every Evolv CaaS subscriber receives ongoing compliance evidence collection at no extra cost, quarterly patching records, training completion logs, MFA enforcement audits, backup verification reports, and incident response timelines, all mapped to your framework's control set. The fees below cover net-new program build-outs, the writing of your initial Written Information Security Program (WISP), policy library, and audit-ready evidence binder. Once the program is built, ongoing maintenance is included in CaaS.

NAIC MDL-668 compliance is a regulatory requirement for every state-licensed insurance producer to maintain a Written Information Security Program (WISP), conduct annual risk assessments, and report cybersecurity events within 72 hours. NAIC compliance is required in 28+ states as of 2026 for agencies of all sizes (most states exempt agencies under 10 employees).

Evolv's NAIC compliance program includes:

NAIC-compliant WISP tailored to your agency size and book of business
Annual employee training program with completion tracking
Incident response plan with 72-hour notification thresholds
DOI audit-ready documentation package
Quarterly maintenance reviews, your DOI never sees a stale document

NAIC WISP starting at $7,500 fixed fee for agencies of 10-100 employees. See full compliance pricing →

Start the Insurance Compliance Scorecard →Book a WISP scoping call

Free · No pressure · We come prepared

Curious about AI for your agency? →

What the WISP requirement is built to fix.

Deadline pressure

Your DOI registration deadline is real. So is your carrier appointment review.

Policy drift

Your last WISP was a Word doc on someone's desktop. Nobody's updated it. Nobody can find it.

Audit risk

A state DOI audit without a WISP isn't a fine. It's an appointment-jeopardizing event.

Our Authority

Built by people who've worked inside insurance compliance.

Evolv was founded by a 15-year technology veteran and staffed by a 10-person team with 200+ combined years in cybersecurity, compliance, and IT operations. We're a Microsoft Solutions Partner with Fortinet, Sophos, Barracuda, Cisco, and Meraki in our practitioner stack, the same tools Michigan insurance agencies use. Our NAIC compliance program was built specifically for the pace and budget of independent agencies, not adapted from an enterprise template.

Your path to WISP compliance.

Score

Start with the insurance-specific Scorecard. We baseline your current WISP status against all six MDL-668 elements.

Draft

We deliver a NAIC-compliant WISP, training plan, and incident response plan in 28 days.

Maintain

We update your WISP annually and on every material change. Your DOI never sees a stale document.

What's included.

NAIC-compliant WISP tailored to your agency size and book of business

Annual employee training program with completion tracking

Incident response plan with named roles and 72-hour notification thresholds

Documentation package ready for state DOI audit or carrier appointment review

Quarterly maintenance reviews, your DOI never sees a stale document

Related Case Study →

A 45-employee insurance agency in Lansing, NAIC WISP delivered in 28 days, two carriers re-appointed within the next quarter. The agency's operations manager now owns ongoing compliance with a quarterly maintenance calendar we built into the engagement.

Read the full case study →

What changes after 28 days.

Your DOI registration renewal isn't a fire drill.

Your carrier appointments stay clean.

Your producers can answer 'are we covered?' with a document, not a shrug.

Agencies that filed without a WISP have lost appointments, paid statutory fines, and watched producers leave for compliant competitors. The cost of waiting is documented.

Start the Insurance Compliance Scorecard

Frequently Asked Questions

Get your WISP in 28 days.

Start with the 5-minute Scorecard. We baseline where you are today and scope what it takes to get you to compliant.

Start the Insurance Compliance Scorecard →

Related Services

Service

Virtual CISO (vCISO)

Named security officer for your agency →

Service

Cybersecurity as a Service

24/7 monitoring to satisfy IRP requirements →

Location

Lansing Managed IT

Insurance corridor IT support →