Control by control
| Requirement | Source | WYEA today | Status |
|---|---|---|---|
| Access controls and MFA | 23 NYCRR 500.11(b)(1)62% of security teams require MFA from vendors, 73% in financial services (ISC2 2025) | Own sign-in per insurer, linked to your identity provider | Holds todayMFA enforced |
| Encryption in transit and at rest | 23 NYCRR 500.11(b)(2) | Encrypted in transit and at rest | Holds today |
| Notice of a cybersecurity event | 23 NYCRR 500.11(b)(3)61% require incident response and breach notification, 75% in financial services (ISC2 2025) | Notice of a cybersecurity event, committed in the MSA | Holds today |
| Security representations and warranties | 23 NYCRR 500.11(b)(4) | Security representations and warranties in the MSA | Holds today |
| Standards compliance: SOC 2, ISO 27001, NIST | 77% name it their top vendor requirement, 84% in financial services (ISC2 2025) | SOC 2 report and ISO 27001 certificate | Holds today |
| Independent audit or penetration test | 71% require audits or attestations, 80% in financial services (ISC2 2025) | Independent penetration test | Holds today |
| No training on client content | wyea.ai/security | Contractual and architectural | Holds today |
| Data isolation | wyea.ai/security | One system per insurer, with its own database, network and sign-in | Holds today |
Sources
- 23 NYCRR 500.11, third-party service provider security policy, New York Department of Financial Services cybersecurity regulation, via the Legal Information Institute.
- 2025 ISC2 Supply Chain Risk Survey, ISC2, November 2025.
Thanks. Your message is on its way. We'll reply within one business day.