IDC Names Securiti a Worldwide Leader in Data Privacy


NAIC Model 673 – Standards for Safeguarding Customer Information Model Regulation

Operationalize US NAIC 672 compliance with the most comprehensive PrivacyOps platform

Last Updated on October 10, 2023

Privacy Center
Fully Functional In Minutes

Elegant Consumer Frontend, Fully Automated Backend, Privacy Regulation Intelligent Everywhere.


The National Association of Insurance Commissioners (NAIC) is a US-based non-profit organization governed by the chief insurance regulators from the 50 states, the District of Columbia, and five US territories. In addition to preserving the financial security and solvency of the insurance business, one of NAIC’s main goals is to advance and safeguard the interests of insurance consumers by developing model laws for passage by the state legislatures. One of the several model laws developed by the NAIC to safeguard consumer data privacy and protection is the Standards for Safeguarding Customer Information Model Regulation (Model 673).

Model 673 establishes standards for the insurers licensed, authorized, or registered under state insurance laws (licensees) to develop and implement administrative, technical, and physical safeguards for protecting customer information's security, confidentiality, and integrity pursuant to sections 501, 505(b), and 507 of the federal Gramm-Leach-Bliley Act. Under Model 673, the licensees are required to implement a comprehensive written information security program, regularly assess the foreseeable internal and external threats to the protection of customer information, and keep the information security program updated in light of changing technology and other relevant factors.

Model 673 has been adopted by several US states, including Alabama, Alaska, Arizona, California, Colorado, Connecticut, Delaware, Florida, Illinois, Iowa, Maine, Minnesota, Missouri, Montana, Nebraska, New Jersey, New York, Oregon, Utah, Virginia, Wyoming and others.

The Solution

Securiti enables organizations to comply with Model 673 through AI-driven PI data discovery, DSR automation, documented accountability, enhanced visibility into data processing activities, and AI-driven process automation.

Securiti supports enterprises' journey toward compliance with 673 through automation, enhanced data visibility, and identity linking.


US California CCPA

Request a demo to learn how Securiti can aid you and your organization's compliance efforts today.

Assess Model 673 Readiness

Utilize Securiti's collaborative readiness assessment template to assess your organization's compliance with Model 673 requirements, assess compliance gaps, and mitigate risks. Seamlessly expand assessment capabilities across your vendor ecosystem to maintain compliance against this standard.

Assess GDPR readiness

Automate Risk Assessments

Sections: 6A, 6B, 7A, 7C

Automate and schedule regular risk and security assessments using Securiti's Assessment Automation module to ensure your practices fully comply with the requirements of Model 673. Monitor data risk over time with a clear breakdown of various contributors to risk and uncover high-risk activity within your environment.

Assess and Oversee Service Providers

Section: 8

Utilize Securiti's Vendors Assessment module to assess the compliance status of your vendors with a particular standard.

vendor risk managements

Automate Data Security Program

Sections: 3, 4, 9

Leverage Securiti's Data Security Posture Management module to identify the necessary security controls and implement appropriate security measures for your organization.

Key Facts about the NAIC Model 673


Information Security Program: Model 673 requires the licensees to implement a written information security program, including the administrative, technical, and physical measures appropriate to the size and complexity of the licensees and the nature and scope of their activities, to safeguard customer information.


Risk assessment: The licensees must conduct regular risk assessments to identify reasonably foreseeable threats that can result in unauthorized disclosure, misuse, alteration, or destruction of consumer personal information.


Risk management: The licensees must design their information security program to take appropriate measures to mitigate the risks identified through the risk assessment and regularly monitor the controls, systems, and procedures of the information security program.


Service provider arrangement: Under Model 673, the licensees must exercise appropriate due diligence in selecting their service providers and ensure that the service providers observe compliance with the requirements of Model 673.


Ongoing monitoring: Model 673 requires the licensees to continuously monitor, evaluate, and adjust the information security program in light of technological changes, the sensitivity of customers’ personal information, and changing business arrangements.

Forrester Names Securiti a Leader in the Privacy Management Wave Q4, 2021

Read the Report
Forrester Wave

Securiti named a Leader in the IDC MarketScape for Data Privacy Compliance Software

Read the Report
IDC MarketScape

At Securiti, our mission is to enable enterprises to safely harness the incredible power of data and the cloud by controlling the complex security, privacy and compliance risks.


Gartner Cool Vendor Award Forrester Badge IAPP Innovation award 2020 IDC Worldwide Leader RSAC Leader CBInsights Forbes Security Forbes Machine Learning G2 Users Most Likely To Recommend