In the modern age, the insurance industry, like many others, increasingly relies on information technology (IT) systems to support its operations. Whether it’s underwriting policies, processing claims, or managing customer data, IT systems are at the heart of the insurance business.

Regulatory authorities often issue guidelines and requirements to ensure the robustness of these systems and the security of sensitive customer data. In Germany, BaFin, the Federal Financial Supervisory Authority, has released a Regulatory Circular that outlines the supervisory requirements for IT in insurance undertakings. Let’s delve into the significance of this circular and what it means for the German insurance industry.

See BigID in Action

The Significance of BaFin

BaFin, short for Bundesanstalt für Finanzdienstleistungsaufsicht, is Germany’s integrated financial supervisory authority. Established in 2002, it took on the role of overseeing banks, financial services providers, insurers, and securities trading. BaFin’s mission is to ensure the integrity and stability of Germany’s financial system, protect the interests of investors, and promote the proper functioning of financial markets.

The Impact of IT on Insurance

IT systems have transformed the insurance sector in many positive ways. They’ve streamlined processes, improved customer service, and enabled insurers to develop innovative products. However, this increasing reliance on technology also brings risks, especially concerning data security, operational resilience, and compliance with regulatory requirements. In this context, BaFin’s Regulatory Circular on IT supervisory requirements become critical for organizations to meet compliance standards.

Download the guide.

Critical Aspects of BaFin’s Circular on IT Supervisory Requirements

BaFin’s Regulatory Circular applies to all primary insurers and reinsurers in Germany. The circular outlines several essential components of IT supervisory requirements for insurance organizations to implement:

Implement IT Policies & Data Governance

Organizations must implement IT operations, data governance, and policies that support overall business strategy. The portfolio of IT systems should be carefully managed, monitored, and regularly updated. This included documenting IT system connections and the inventory of data collected.

Inventory data includes, in particular:

  • inventory and specified use of the IT system components with the relevant configuration
  • data (e.g. versions and patch level)
  • owners of the IT systems and their components
  • location of the IT system components
  • list of the relevant information about warranties and other support agreements (including links where appropriate)
  • details of the expiry date of the support period for the IT system components;
  • protection requirements and criticality classification of the IT systems and their components
  • accepted non-availability period of the IT systems as well as the maximum tolerable data loss

It’s more critical than ever for insurance organizations to maintain an updated data inventory to gain visibility and protect data. BigID empowers organizations to know their data — generating a single, accurate, reliable data inventory that covers all data types — on-prem and in the cloud. Ensuring visibility into deeper areas of the data ecosystem is crucial to solidifying security posture and protecting sensitive, regulated, and high-risk data — wherever it exists.

Ensure Compliance Today

Conduct Risk Assessments for Change Management

According to BaFin’s Regulatory Circular, insurance companies are expected to conduct regular risk assessments related to their IT systems, especially when there are changes (data migrations, configuration, expanded functions, replacements, relocation, etc..) to the system. Changes to the IT systems and major process changes that impact data processing and protection should be accepted, documented, and evaluated, considering any risk related to implementation. This also includes identifying and mitigating risks that could affect data security, operational stability, and the continuity of services. Adequate risk management processes are crucial for resilience.

Assessing and managing data risks and vulnerabilities is a key component of Data Security Posture Management (DSPM). Data risk assessment tools like BigID provide a streamlined approach to risk identification and uncovering potential vulnerabilities based on location, sensitivity, and cybersecurity compliance standards. BigID provides a clear view of the most significant risks to take remediation steps to mitigate and strengthen security posture proactively.

Automate Identity & Access Management

Regarding IT systems and processes, insurance organizations must ensure the integrity, availability, authenticity, and confidentiality of data. User access rights on all levels of an IT system (operating system, databases, applications) must consistently align with data protection objectives and requirements. It is highly recommended that access rights be combined into a role-based model to ensure that all staff members only have the rights they need for their work.

Understanding what employees and applications have access to what data is critical for stopping data overexposure and insider threats to meet the BaFin circular requirements.
With BigID, organizations can restrict access to sensitive data, which helps prevent unauthorized personnel from accessing critical information. Utilize deep access intelligence to remediate access violations to reduce insider risks and accelerate zero trust based on internal policies and rules.

Operationalize Data Privacy & Protection

The protection of customer data is of paramount importance. Insurance undertakings must adhere to data protection regulations, such as the General Data Protection Regulation (GDPR) in the EU. As stated by the BaFin’s Regulatory Circular, “As a general principle, the rule-based evaluation (e.g., using parameters, correlation of information, deviations or patterns) of large data volumes requires the use of automated IT systems.” This requires implementing technologies to automatically secure data processing, ensure data subject rights, and report on data breaches. Insurers must establish measures to protect sensitive customer data and ensure the confidentiality, integrity, and availability of IT systems.

Leveraging solutions like BigID can be easily deployed by the CISO, CPO, and CDO to take action for data privacy and protection to meet industry challenges. BigID eliminates the manual processes to automate compliance with data privacy regulations, providing the data visibility and controls needed to reduce risk, secure data, and achieve regulatory compliance.

Report Breaches & Incidents

The BaFin Regulatory Circular requires insurers to report significant IT incidents and breaches promptly. This enables regulatory authorities to assess the extent of the incident and its impact on policyholders and the market.

With BigID, organizations can move quickly to secure data and get to the root of the vulnerabilities that may have caused a breach. Then, following a breach, accurately identify the individuals whose data was compromised to streamline breach response reporting to BaFin and consumers. Simplify incident response with detection, reporting, and communication to comply with BaFins’ breach notification requirements.

Benefits of Implementing BaFin Circular Requirements

BaFin’s Regulatory Circular on IT supervisory requirements is designed to strengthen IT systems’ resilience and data security in the insurance industry. By adhering to these requirements, insurance undertakings can benefit in several ways:

  • Enhanced Data Security: Improved measures protect sensitive customer data from breaches and unauthorized access.
  • Regulatory Compliance: Compliance with BaFin’s requirements is essential for maintaining a good standing with the regulator and avoiding potential penalties.
  • Customer Trust: By safeguarding data and ensuring operational stability, insurers build and maintain trust with their policyholders.

In Germany, the BaFin has put Insurers under a microscope, increasing the need to focus on reducing risk — and implementing effective risk reduction across the enterprise.

Insurance organizations can leverage BigID to build a comprehensive data inventory that provides full visibility into the personal and sensitive data — and take action to manage the risks associated with it across the entire organization.

Can you meet the expectations of the BaFin Circular on IT Supervisory Requirements? Get a 1:1 demo with our experts to see how BigID can help you achieve compliance.