Authority-to-insurance workflow crosswalk

The authority records

NAIC Insurance Data Security Model Law

U.S. states that enact corresponding law · Adopted NAIC model law with state-by-state enactment. The model law addresses information-security programs, cybersecurity-event investigation, and notice expectations for covered insurance licensees.

NAIC Insurance Information and Privacy Protection Model Act

U.S. states adopting related provisions · Maintained NAIC model-law record. The model addresses collection, use, disclosure, access, and correction of insurance information within its model scope.

NAIC Privacy Model Regulation

U.S. states adopting corresponding requirements · Maintained model-regulation record under modernization work. The model regulation addresses privacy notices and treatment of nonpublic personal financial and health information in insurance operations.

NAIC Insurance Fraud Prevention Model Act

U.S. states adopting corresponding provisions · Maintained NAIC model-law record. The model act provides a model statutory structure for insurance fraud prevention, reporting, investigation, and related authority.

NAIC Market Conduct Surveillance Model Law

U.S. states adopting corresponding provisions · Maintained NAIC model-law record. The model law provides a model framework for market analysis, examinations, regulatory response, and insurer information in market-conduct oversight.

NAIC AI Model Bulletin

Adopting U.S. insurance jurisdictions · Adopted model bulletin. The model bulletin reminds insurers that AI-supported consumer decisions remain subject to applicable insurance law and describes governance and documentation regulators may request.

New York DFS Cybersecurity Regulation

Covered New York DFS-regulated entities · Current regulation with second amendment. Part 500 establishes cybersecurity requirements for covered entities and has phased requirements under its second amendment.

Digital Operational Resilience Act (DORA)

In-scope EU financial entities and ICT third-party service providers · In application. DORA establishes a harmonized framework for ICT risk management, incident reporting, resilience testing, third-party risk, and oversight across in-scope financial entities including insurance.

IFRS 17

Entities reporting insurance contracts under IFRS within scope · Effective accounting standard. IFRS 17 sets principles for recognition, measurement, presentation, and disclosure of insurance contracts and replaces IFRS 4.

FASB LDTI

Entities issuing long-duration insurance contracts within U.S. GAAP scope · Issued accounting standard update with effective-date amendments. LDTI changes measurement, assumptions, discount rates, market risk benefits, deferred acquisition costs, and disclosures for long-duration insurance contracts.

ACORD insurance data standards

Participating insurance markets and implementations · Maintained standards families. ACORD maintains insurance data standards and architectures used to support structured exchange across market participants and lines.

NIST CSF 2.0

Organizations managing cybersecurity risk · Published framework. CSF 2.0 provides a taxonomy of cybersecurity outcomes organized around Govern, Identify, Protect, Detect, Respond, and Recover.

NIST AI RMF

Organizations designing, deploying, or using AI systems · Published framework. The AI RMF organizes voluntary AI risk-management work around Govern, Map, Measure, and Manage.

PCI DSS v4.0.1

Entities within applicable PCI program scope · Current published PCI DSS version. PCI DSS provides security requirements for account data within its defined payment-card scope.

ISO/IEC 27001:2022

Organizations establishing an information-security management system · Published standard. ISO/IEC 27001 specifies requirements for an information-security management system.

ISO 22301:2019

Organizations establishing a business-continuity management system · Published standard. ISO 22301 specifies requirements for establishing, implementing, maintaining, and improving a business-continuity management system.

FTC Safeguards Rule

Covered financial institutions within FTC jurisdiction · Current federal rule and guidance. The Safeguards Rule requires covered financial institutions to develop, implement, and maintain an information-security program with specified elements.

The operating-domain lens

Insurance product, rating, and policy lifecycle

The governed system for defining insurance products, forms, rules, rates, eligibility, versions, quotes, binds, endorsements, renewals, cancellations, and policy history across jurisdictions and channels. The crosswalk links 9 capabilities and 3 authority records.

Underwriting intake, risk, and authority

The controlled path from submission and data collection through enrichment, eligibility, referral, analysis, pricing, authority, decision, communication, and retained reason. The crosswalk links 9 capabilities and 3 authority records.

Premium billing, payments, and financial reconciliation

The control system for billing plans, invoices, receivables, cash application, fees, commissions, refunds, disbursements, write-offs, suspense, reconciliation, and financial exchange across policy and claim operations. The crosswalk links 10 capabilities and 4 authority records.

Claim intake, coverage context, and assignment

The operating discipline for receiving a loss or benefit event, identifying the policy and parties, preserving notice, gathering initial facts, establishing coverage context, segmenting the work, and assigning accountable ownership. The crosswalk links 10 capabilities and 3 authority records.

Claim adjustment, reserving, and financial control

The controlled process for investigating facts, evaluating coverage and damage, setting and changing reserves, applying authority, documenting decisions, making payments, and reviewing financial development. The crosswalk links 10 capabilities and 3 authority records.

Damage estimation, repair, and service networks

The operating chain connecting images, measurements, inspections, parts, labor, repair methods, estimates, suppliers, providers, appointments, supplements, quality, and claim settlement. The crosswalk links 12 capabilities and 3 authority records.

Fraud investigation, subrogation, and litigation

The controlled escalation from anomaly or recovery signal through review, investigation, evidence, legal authority, referral, action, recovery, dispute, litigation, and outcome. The crosswalk links 11 capabilities and 3 authority records.

Life, annuity, benefits, and long-duration contracts

The operating system for product and illustration context, application, underwriting, policy issue, billing, commissions, contract values, service, beneficiary and claimant events, benefits, reserves, and financial reporting over long durations. The crosswalk links 12 capabilities and 3 authority records.

Delegated claims authority and service partners

The governance of third-party administrators, adjusters, managed-care organizations, repair networks, technology-enabled service providers, and other partners that perform or support claim work under defined authority. The crosswalk links 13 capabilities and 3 authority records.

Core data, integration, and migration

The governed ownership, mapping, exchange, conversion, reconciliation, lineage, coexistence, cutover, and retirement of insurance product, policy, billing, claim, party, document, and financial data. The crosswalk links 12 capabilities and 5 authority records.

Cybersecurity, privacy, and operational resilience

The management of sensitive insurance information, identities, access, systems, suppliers, vulnerabilities, incidents, continuity, recovery, privacy obligations, and evidence across policy and claims operations. The crosswalk links 8 capabilities and 6 authority records.

AI, automation, and consumer-decision governance

The controlled lifecycle for data, rules, models, extraction, generation, recommendation, automation, human authority, consumer impact, monitoring, change, and evidence across insurance decisions. The crosswalk links 10 capabilities and 3 authority records.

Market conduct, financial, and audit evidence

The retained and reproducible record of consumer transactions, policy and claim decisions, financial movements, communications, complaints, exceptions, model contributions, controls, and accountability required for oversight and independent review. The crosswalk links 12 capabilities and 4 authority records.

How to use the crosswalk

Determine applicability with qualified owners, identify affected records and workflows, map each expectation to an accountable decision and retained evidence, then use capability and organization pages to frame a technology evaluation. A mapping is editorial navigation—not a conformity or legal conclusion.

Methodology

1. Define the market boundary, exclusions, operating models, and capability taxonomy before classifying organizations.
2. Require an approved official source for organization inclusion and each documented capability.
3. Keep authority sources, provider claims, independent observations, editorial synthesis, and unknowns in separate evidence states.
4. Use one primary operating model per organization while retaining adjacent scope in the narrative record.
5. Preserve source URLs, review dates, material changes, limitations, and correction history.

Limitations

• The maintained population is substantial but not claimed to be a complete global market.
• Official public documentation may omit available capabilities or lag product and service changes.
• Documented positioning does not measure product depth, configured availability, independent performance, implementation effort, customer outcome, or commercial terms.
• Authority mappings are editorial research aids and do not establish buyer-specific applicability or product conformity.
• No organization may purchase inclusion, classification, finding, or correction outcome.

Reproducibility and updates

The report is reproduced from the provider registry, normalized facts and evidence, authority and domain records, and the publication taxonomy. A material change requires a dated source and editorial explanation. Historical values remain available through the change ledger rather than disappearing when the current record changes.