Multi-factor Authentication (MFA) Survey

ACT Industry MFA/2FA Survey
Due to the ever-increasing array of cyber-attacks and expanding regulations, our industry is seeing insurance company partners and others implementing Multi-Factor Authentication (‘MFA’ or ‘2FA’), and inevitably, in varying ways.

In order to provide all stakeholders a clear picture of the landscape – and to drive consistent implementations - we’re asking you to participate in this anonymous survey for insurance companies/carriers, independent agents, and vendor/technology providers.

Please complete this survey as soon as possible, and no later than February 28th.

Thank you!
Please tell us about your organization.
Additional questions will appear based on your response.
I am with:

An Insurance Company/CarrierA Technology Provider/VendorAn AgencyOther
We greatly appreciate your willingness to participate in our survey, however, in order to focus our results, we are currently limiting the completion of the survey to Insurance Companies/Carriers, Agents, and Technology Providers/Vendors.

We will share the results of our survey in our March edition of ACT News. If you aren't a subscriber, please sign up here to receive ACT News.
Does your company use MFA for independent agents?

YesUnsureNo
What are your plans for MFA/2FA implementations? (Check all that apply)

Currently researchingWill use guidance from our technology/vendor partnersCurrent plan to implement within 6 monthsWill use guidance from state/federal cyber regulations (NAIC, GLBA, NY DFS, etc.) or other industry authoritiesCurrent plan to implement in 1-2 yearsOther
Do your systems detect and prevent logins using 'scripting robots'?

We detect and prevent logins using 'scripting robots'We accept logins using 'scripting robots'Other
What MFA solution (s) are you using? (Check all that apply)

Adaptive (recognizes previous devices, via 'Save my Device' option)Biometric AuthenticationDuo authenticator appGoogle AuthenticatorLink sent to agency email addressLink sent to agency rep mobile phoneMicrosoft AuthenticatorOkta Verify authenticator appPhysical hardware token (like 'YubiKey')PingIDSMS (text to mobile number)Within agency workflow using SignOn Once (ID Federation)Not SureOther
What is the adoption rate for MFA across all your partner independent agents?
Please provide approximate percentage here
What is the feedback from independent agents?
What impact from the implementation of MFA (if any) have you noted on conducting business with your agents (quoting/sales/servicing volumes)?
Is your agency partner MFA strategy mandatory, or can individuals 'Opt-in/Opt-out'?

Yes - Mandatory for all usersUnsure at this timeNo - Agents can 'Opt-in/Opt-Out' as desired
Do you use the same MFA solution for access to your platform and for self-service password resets?

YesUnsureNo
Does your company issue credentials for your platform to every unique user, or is there another method of distribution (i.e. only licensed agents receive login credentials)?

IDs for each individual userID issued for licensed agents onlyOne ID issued for entire agencyOther
Have you conducted or participated in a MFA market test?

YesUnsureNo
What solution did you test and what was your impression?
Are there are any foreign countries from which your company restricts logins?

YesUnsureNo
Please indicate what regions are restricted.
Does your company use (or are planning to use) MFA in conjunction with any comparative raters?

YesUnsureNo
Is MFA being used during the quote within the comparative rater, or is it only used when the agent bridges over to bind a quote?

Within Comp Rater OnlyWhen bridging
Are your carrier partners requiring you to use MFA to access their agency-carrier portals?

YesUnsureNo
Do you see value in secured authentication like MFA, and are you open to carriers implementing it?

YesUnsureYes, providing implementations are similarNone as of this timeNoOther
What number of carriers are currently requiring it?

Only 1 or 2 at this timeNone as of this time, but I have received communications stating that they will be implementing soon3-5None as of this timeMost of my carriers
What is your preferred method of MFA? (Check all that apply)

Adaptive (recognizes previous devices, via 'Save my Device' option)Biometric AuthenticationDuo authenticator appGoogle AuthenticatorLink sent to agency email addressLink sent to agency rep mobile phoneMicrosoft AuthenticatorOkta Verify authenticator appPhysical hardware token (like 'YubiKey')PingIDSMS (text to mobile number)Within agency workflow using SignOn Once (ID Federation)Not SureOther
How often are you required to authenticate using MFA? (Check all that apply)

Must use MFA at every loginHave an option to 'Save my Device' when using MFA for future logins, or set period of time (ex:60 days)I am using ID Federation's "SignOn Once" via my agency management systemOther
How much time are carriers allowing agencies to prepare before MFA is mandatory?

1 week or less2-3 weeks1 month2 months or longer
What impact from the implementation of MFA (if any) have you noted on quoting/sales/servicing volumes?
What challenges does the use of MFA create for your agency and staff? (i.e. impact to quoting, servicing, overall workflow)
Does your company require background checks for all users that are issued system login credentials?

YesUnsureNo
Please tell us about your agency's policy regarding use of personal cell phones during business hours.

We do not restrict the use of personal cell phonesWe do restrict the use of personal cell phones and would NOT allow them to be used for authentication purposes.We do restrict the use of personal cell phones but would allow them to be used for authentication purposesOther
What can your carrier partners and the industry do to help your agency with MFA and login issues?
Does your agency use unique IDs/passwords for every user or share?

Unique IDs are provided for each individual userUnique IDs are provided for licensed agents onlyIDs are shared among staffOther
Do any of your platforms (including carrier connection solutions) use MFA for independent agent systems?

YesUnsureNo
What are your plans for MFA/2FA implementation? (Check all that apply)

Currently researchingCurrent plan to implement within 6 monthsCurrent plan to implement 1-2 yearsWill use guidance from our insurance company partnersWill use guidance from state/federal cyber regulations (NAIC, GLBA, NY DFS, etc.) or other industry authorities.Other
What MFA solution are you using? (Check all that apply)

Adaptive (recognizes previous devices, via 'Save my Device' option)Biometric AuthenticationDuo authenticator appGoogle AuthenticatorLink sent to agency email addressLink sent to agency rep mobile phoneMicrosoft AuthenticatorOkta Verify authenticator appPhysical hardware token (like 'YubiKey')PingIDSMS (text to mobile number)Within agency workflow using SignOn Once (ID Federation)Not SureOther
Do any of your platforms support SSO (Single Sign On) into carrier portals and systems?

YesUnsureNot at this timeIn planning/developmentOther
Have you developed a strategy around MFA for your mobile app?

Yes - have developed MFA for mobileIntend to develop at a future pointYes - in developmentNo - we do not currently offer a mobile appUnsure at this timeNo - we do offer a mobile app but do not have a MFA strategy currentlyOther
What security considerations are you contemplating that could benefit from industry assistance? (examples may be multi-system interoperability, integration/acceptance from carrier systems, unified industry direction, etc.)
Please use the area below to provide any explanations or additional information you would like us to know.
Your responses are completely anonymous, however if you would like to provide your email to discuss the survey and/or the results please feel free to list it below.
example@example.com
Should be Empty:

ACT Industry MFA/2FA Survey