Business Continuity Planning for Insurance Firms

Start with what actually needs to stay running

Not every system in the office is equally critical. A continuity plan should rank systems by how quickly their loss affects client service, since that ranking drives everything else in the plan, from backup frequency to failover connectivity investment.

• Tier 1, restore within hours: broker management system, phone lines, email
• Tier 2, restore within a day: file storage, accounting software, internal document templates
• Tier 3, restore within a few days: archived records, historical reporting tools

Setting realistic recovery time targets

A recovery time objective is only useful if the backup and infrastructure behind it can actually meet it. Promising same-day recovery of a broker management server without a tested backup and recovery process in place is a plan on paper only. Our backup and disaster recovery services, built on Acronis Cyber Protect Cloud, are designed around specific recovery time targets agreed with the client rather than a generic backup schedule.

Planning for a ransomware scenario specifically

Ransomware deserves its own line item in a continuity plan because it behaves differently from a typical hardware failure: backups themselves can be targeted, and recovery decisions involve more than restoring data, including whether systems were compromised beyond the encrypted files. Our ransomware recovery guide covers the recovery process in more depth, and immutable, offline-capable backups are a core defence against backups being encrypted alongside production data.

Communication during an outage

Clients calling during an outage need a consistent answer, not confusion. A continuity plan should include a communication plan: who updates clients, what channel is used if phones or email are affected, and how staff are kept informed as the situation develops. A brief, honest update goes a long way toward preserving client trust compared to silence.

Working with carriers during an outage

Carriers a brokerage works with need to know if the brokerage cannot process transactions or communicate normally during an extended outage, particularly if time-sensitive renewals or claims are affected. Identifying key carrier contacts ahead of time, as part of the continuity plan itself, saves scrambling for phone numbers during an actual incident.

Testing the plan, not just writing it

A continuity plan that has never been tested is a guess. Periodic tests, whether a simulated outage, a test restore of the broker management system's data, or a tabletop walkthrough with staff, reveal gaps that look fine on paper but fall apart in practice, such as a backup that takes far longer to restore than expected.

Insurance and regulatory considerations

Many cyber insurance policies expect a documented continuity or incident response plan as part of underwriting, and some regulators expect firms to have reasonable continuity measures in place, though the specifics vary. Confirming what a particular insurer or regulator expects should go directly to that insurer or to FSRA, since general guidance like this article cannot substitute for a firm's specific policy terms or licensing obligations.

Frequently asked questions