Email security for insurers, privacy law and regulators
Partners rarely ask "is our DKIM aligned?". They ask "can we answer the insurance renewal?" and "would we be in trouble if a client file leaked?". The checkup report is written to help with both.
Cyber insurance
Applications and renewals ask more security questions every year, and an answer that turns out to be wrong can matter at claim time. These are the email topics that appear on most applications we see.
-
MFA on email
Almost always asked, often with "for all users" and "including admins". The checkup gives you an account-by-account answer.
-
Backups
Insurers increasingly ask whether cloud data is backed up, and whether backups are separate from the main environment.
-
Email security
Filtering, spoofing protection (DMARC), and sometimes whether external email is labelled.
-
Payment fraud controls
Not a setting, but often tied to coverage: whether changes to payment details are verified by phone. The report flags it.
Canadian privacy law
Most of what a professional firm holds about clients is personal information, and a lot of it sits in email.
-
BC PIPA
BC's Personal Information Protection Act requires organizations to make reasonable security arrangements to protect personal information in their custody or control.
-
PIPEDA
The federal law sets a similar safeguards principle for commercial activity, plus mandatory reporting and record-keeping for breaches that pose a real risk of significant harm.
-
What the checkup adds
Evidence of what is in place, what isn't and what's planned. Audit log retention is part of it, since it decides whether you can work out what a breach actually exposed.
Professional regulators
Law, accounting, financial and other regulated professions in BC each publish their own guidance. The common thread is that regulators expect reasonable safeguards for client information.
-
Law Society of BC
Lawyers are expected to protect client confidentiality, including in the technology they use.
-
CPABC
Accounting firms hold sensitive financial and tax information and are expected to safeguard it.
-
BCFSA and other financial regulators
Financial firms face increasingly specific expectations about information security.
-
Engineering, architecture and others
Client and project confidentiality obligations apply to email like any other record.
CIS Controls as a yardstick
Implementation Group 1 of the CIS Critical Security Controls is a published baseline aimed at smaller organizations. We use it to frame the report, so you can see progress year over year and explain it to anyone who asks.
Policy paperwork
Insurers and regulators often ask whether you have written policies, not just settings. The checkup notes which ones exist. KDTS can provide policies written for firms your size.
-
Acceptable use
What firm systems and accounts may be used for.
-
AI use
Which AI tools staff may use with client information, and how.
-
Incident response
Who to call first, including your insurer's breach line, and what not to touch.
-
MFA and passwords
What every account must have, in writing.
-
Backup
What is backed up, where, for how long, and how often restores are tested.
Free cyber insurance policy review
If the renewal is what prompted this, start there. KDTS offers a free review of your cyber insurance policy and application, mapping each security requirement to your firm. Email insurance@kdts.ca or read about the policy review on kdts.ca.
The fine print
We're an IT and security provider, not lawyers or insurance brokers. This page and the checkup report are general information, not legal advice. Questions about your obligations go to your lawyer or regulator; questions about coverage go to your broker. The checkup helps reduce risk and gives you evidence of reasonable steps. It doesn't guarantee compliance or coverage.
Get answers you can put in writing
A one-minute form with your firm name, staff count and platform. We reply within two business days. Prefer email? checkup@emailcheckup.ca