Will stop the reviewR-SUBPROCESSOR · degrades this item
Provider not named in an approved record for Claims triage (MDL-001)
One model (Claims triage (MDL-001)) runs on a third-party provider that is not named in any approved record. "A leading commercial provider" is not an answer a reviewer can write down. The carrier has to name every third party in its own examination response, so an unnamed provider makes your gap their finding, and a reviewer who cannot close a question in their own file will stop and ask rather than accept it. A provider you cannot name is also one whose security posture and data retention you cannot answer for, which is why the questions on those follow this one.
To fix: Name every model provider, hosting region, and data processor that touches insurer data, with contract reference and an accountable owner. A single approved table is enough, as long as it is kept current.
Will escalateR-MFA · degrades this item
Multi-factor authentication is not stated for access to insurer data
You have not said whether multi-factor authentication is enforced for everyone who can reach insurer data. Section 500.12 requires the carrier to use it for any individual accessing any of its information systems, and section 500.11(b)(1) has the carrier ask its vendors about theirs, so the carrier cannot answer that question for its own examiner while a vendor holding the same data cannot. A reviewer treats silence here as a no, because every vendor that has it says so in the first sentence.
To fix: Enforce a second factor for every account, including administrators, service accounts that a person can use, and any third party with access. Then say so, with the mechanism named, in the security section of the profile.
Will escalateR-PEN-TEST · degrades this item
No penetration test is on record
There is no penetration test on record, or you have not said when the last one was. Section 500.5 has the carrier test its own systems at least annually, by a qualified internal or external party, and the questionnaire asks a vendor for evidence of the same from the last twelve months. A reviewer does not accept a description of the programme in place of the report; they ask for the report, and its date is the first thing they read.
To fix: Commission a penetration test by a qualified party, internal or external, that is independent of the team that built the systems; keep the report as an evidence record and attach it here. The report can be redacted; the date, the scope and the summary of findings cannot be.
Will be questionedR-INCIDENT-NOTICE · degrades this item
No incident notification commitment to the insurer is stated
You have not committed to a time within which the insurer is told of a security incident. Section 500.17 gives the carrier seventy-two hours to notify its own regulator once it determines an incident has occurred, including one at a third-party service provider, and section 500.11(b)(3) has the carrier require notice from its vendors for exactly that reason. A reviewer therefore looks for a vendor commitment inside that window, and treats a longer one, or none, as a term to be negotiated before the contract can be signed.
To fix: Commit to notifying the insurer within seventy-two hours or less of discovering an incident that touches their data, write it into the contract and the incident response plan, and record the number here.