up:: Doing the Work MOC
PQC for P&C and Specialty Insurers
The post-quantum case for insurance is usually made with life and annuity books, where a policy written today pays a claim in 2080 and the retention horizon does the arguing for you. A property and casualty or specialty carrier reading that reasonably concludes it does not apply, because most P&C claims open and close inside a few years. The exposure is real here and it sits somewhere else: in the long-tail lines, and in the fact that this is the sector that writes cyber cover.
This note is general education about regulation and market practice, not legal or actuarial advice.
The short version:
- Long-tail lines are the exposure. Workers’ compensation, environmental, asbestos, product liability, medical malpractice and D&O carry claim files that stay live for decades.
- Reinsurance and bordereaux exchange move the same records between organizations continuously, on terms mostly set long ago.
- ⭐ You underwrite the enforcement mechanism. The cyber application already moved the whole market on multi-factor authentication without any regulator, and it currently asks nothing about cryptographic agility.
- If the carrier is New York licensed, encryption of nonpublic information in transit is already unconditional under 23 NYCRR 500.15.
- The life-book argument at PQC for Insurance Carriers is the neighboring case, and the difference is worth being precise about rather than borrowing.
Why is the retention argument different here?
Because P&C claim duration is bimodal rather than short. An auto physical-damage claim closes in weeks. A workers’ compensation indemnity claim on a permanent disability can pay for the claimant’s life, and an environmental or asbestos claim can be reported decades after the policy period it attaches to. The file behind a long-tail claim is exactly the profile the vulnerability test describes: medical records, wage histories, legal strategy and reserve positions, held for as long as the claim lives.
Three categories carry it:
- Long-tail claim files. Medical and indemnity records on claims that will not close for decades.
- Reserve positions and reinsurance treaty data. Commercially sensitive for as long as the exposure is on the books, and shared with reinsurers, brokers and auditors by design.
- Underwriting submissions. Detailed operational descriptions of insured businesses, which are the insureds’ secrets rather than the carrier’s.
⚠️ The third one is the underrated category. A specialty carrier’s submission files describe other companies’ operations in more detail than most of their vendors ever see, and the sensitivity belongs to somebody who did not choose your cryptography.
What obligations actually reach a P&C carrier?
The same ones that reach any insurer, and they are covered in full at PQC for Insurance Carriers. In summary:
| Regime | What it says about encryption |
|---|---|
| 23 NYCRR 500.15 | Required for nonpublic information in transit and at rest, against “industry standards.” The in-transit exception was struck by the Second Amendment, so it is unconditional |
| NAIC Insurance Data Security Model Law (#668) | A written information security program with safeguards selected against an annual risk assessment, in adopting states |
Source: NYDFS, Second Amendment to 23 NYCRR 500, dfs.ny.gov; NAIC Model 668 state page, content.naic.org.
The licensing footprint decides it, and specialty and excess-and-surplus writers are frequently licensed in New York without thinking of themselves as New York carriers.
What can a P&C carrier do that no other institution can?
Change what the market has to prove. This is the part of the position that has no equivalent anywhere else in the transition, and it belongs to this sector specifically because cyber insurance is a P&C product.
The application has already done this once. Multi-factor authentication went from a recommended control to a near-universal precondition for coverage in roughly 3 years, and it happened through underwriting rather than through any regulation: carriers put it on the form and priced against the answer. The controls carriers ask about became the market’s floor by being asked.
Nothing equivalent exists yet for cryptography. A standard cyber application asks whether data is encrypted at rest and in transit. It does not ask which algorithms, whether the answer is inventoried or asserted, whether the applicant could change algorithms without re-architecting, or whether its own vendors have committed to dated support.
⭐ Those questions are answerable in a sentence each by an applicant that has done the work, and unanswerable by one that has not, which is exactly the property that makes an underwriting question useful. A carrier that adds a cryptographic-agility question gets better risk selection on a peril nobody has priced, and the standard-setting position it already holds on authentication.
Where does the cryptography live in a P&C carrier?
| Surface | Typical zone | Note |
|---|---|---|
| Policy administration and rating | Zone 2 | Long-lived vendor platforms, frequently several after acquisitions |
| Claims systems and document archives | Zone 2 | ⭐ Where the long-tail files live, under the oldest cryptography |
| Reinsurance and bordereaux exchange | Zone 2 and 3 | Counterparty terms, high volume, rarely revisited |
| Broker and MGA connectivity | Zone 2 | Delegated authority means somebody else holds your data |
| Actuarial and reserving environments | Zone 1 | Internal, high value, least inventoried |
| Third-party administrators | Zone 3 | Claims handled entirely inside another firm |
⭐ The delegated-authority row is structural to specialty. An MGA or coverholder writing on your paper holds submission and claim data inside its own estate, and its cryptographic posture is effectively yours. The instrument is the binder agreement, which is a contract with a renewal date, and procurement language is what goes in it.
Common misconceptions
“Our claims close quickly, so retention isn’t our problem.” Most do. The long-tail lines are the exposure, and they are the ones with medical and legal content in the file.
“That life-insurance quantum argument doesn’t apply to us.” Correct, and a different argument does. Borrowing the life-book framing is why this often gets dismissed.
“We’re a specialty writer, so we’re too small for this.” Delegated authority and reinsurance mean a specialty carrier’s data footprint is larger than its headcount suggests, and spread across more organizations.
“Cyber underwriting is a separate business unit from our security program.” It is, and that separation is why nobody has connected the two. The connection is the opportunity.
Questions people ask
Which records should be inventoried first? Long-tail claim archives, ranked by expected duration rather than by volume. Workers’ compensation and environmental usually top that list.
How does this interact with our reinsurers? They receive the same data and their posture is part of yours. Treaty renewal is the moment to ask, using the checklist.
Should we add a cryptography question to the cyber application? That is a product and underwriting decision beyond the scope of this note. The prerequisite, knowing what a good answer looks like, is a security question and you can settle it independently.
Does this change reserving? Not directly. It changes what a data-breach scenario looks like on a long-tail book, because the exposure period is the claim duration rather than the policy period.
What about our MGAs and coverholders? They hold your data under a binder. That contract is the only cryptographic control you have over them.
Is there a deadline? No sector deadline. The dates that reach a carrier first are a policy-administration vendor’s release schedule and, if New York licensed, the standard that 500.15’s “industry standards” points at.
Everything here is the map, given freely. When a carrier needs its long-tail claim archives inventoried and its binder and treaty language brought up to date, that’s the work I do.
Last verified 2026-09-07 · Updated 2026-09-07 · Maintained by Addie LaMarr, LaMarr Labs.