What Insurance Brokers Need from Their IT Provider

Insurance brokers sit in an interesting position when it comes to IT. You're regulated by the FCA, so there's a compliance layer that many small businesses don't have to deal with. You handle sensitive client data — financial details, health information, claims histories — that needs proper protection. Your business runs on specialist software that your IT provider has probably never heard of. And increasingly, the insurers you place business with expect you to demonstrate your own cybersecurity credentials.

Yet many small to mid-sized brokerages are making do with IT support that was set up for a generic office environment. The provider keeps the lights on, but they don't understand your regulatory requirements, your software stack, or the specific risks your business faces.

Here's what to look for when choosing an IT provider that actually fits an insurance brokerage.

What to Look For

1. FCA Compliance Awareness

The FCA expects regulated firms to have adequate systems and controls — and that includes IT. Your provider should understand the FCA's expectations around data protection, operational resilience, and information security. They should be able to help you demonstrate to the FCA (or your compliance team) that your IT infrastructure supports your regulatory obligations.

This matters more than many brokers realise. If an FCA review finds that your IT security is inadequate — client data accessible without MFA, no encryption, no breach response plan — that's a compliance failure, not just a technical one.

2. Policy Management System Integration

Your broking platform is the heart of your operation. Whether you use Acturis, SSP, Open GI, Applied Epic, or another system, your IT provider needs to understand how it's deployed (cloud, on-premise, or hybrid), how it integrates with insurer portals, and how to troubleshoot it when performance drops or integrations break.

This is one of the biggest gaps we see. A general IT provider will support your email and desktops competently but throw their hands up when there's an issue with Acturis. And since Acturis is where your team spends most of their day, that's not acceptable.

3. Email Security

Insurance brokers send and receive emails containing highly sensitive information every day — policy documents, claims details, financial data. If your email isn't properly secured, you're one compromised account away from a serious data breach.

Your IT provider should configure SPF, DKIM, and DMARC on your email domain to prevent spoofing. They should enforce multi-factor authentication for all users. They should ensure that sensitive attachments are protected and that your team isn't sending client financial information in plain text to the wrong recipient because autocomplete suggested the wrong contact.

4. Client Data Protection

You hold personal and financial data for potentially thousands of clients. Under GDPR, that makes you a data controller with significant responsibilities. Your IT setup needs to reflect this:

• Access controls — not everyone in the office should have access to every client record
• Encryption — data at rest and in transit should be encrypted
• Secure file sharing — client documents shouldn't be sent via personal email or WhatsApp
• Retention and disposal — old client data should be securely deleted when retention periods expire
• Audit trails — you should be able to see who accessed what and when

A good IT provider will build these protections into your environment from the start, not bolt them on after an incident or an FCA query.

5. Cyber Essentials Certification

This is increasingly non-negotiable for insurance brokers. Many insurers now require their broker partners to hold Cyber Essentials certification. Some won't offer cyber insurance policies to businesses that don't have it. And the FCA views it as a baseline indicator of good cybersecurity practice.

Your IT provider should be able to prepare your infrastructure for Cyber Essentials certification and handle the technical side of the assessment. If they can't, or if they don't know what Cyber Essentials is, they're behind the curve for your industry. See our Cyber Essentials service for how this works in practice.

6. Claims Workflow and Operational Resilience

When a client makes a claim, time matters. If your systems are down, claims stall — and that damages your reputation with both clients and insurers. Your IT provider should ensure that your claims workflow technology is reliable, backed up, and recoverable quickly in the event of an outage.

Operational resilience is also an FCA focus area. Your provider should help you document and test your ability to continue operating during a significant IT disruption.

Questions to Ask

1. Which insurance brokerages do you currently support? Which broking platforms have you worked with?
2. How do you approach FCA compliance requirements from an IT perspective?
3. Can you get us to Cyber Essentials certification — and maintain it year-on-year?
4. What email security measures do you implement as standard?
5. How quickly can you restore our systems if our broking platform goes down?

Senri works with insurance brokers across London to deliver IT support that meets FCA requirements and keeps broking platforms running. Visit our IT support for insurance brokers page to see how we can help.

Related Reading

• Cyber Essentials Certification Guide
• Do I Need Cyber Essentials for Government Contracts?
• SPF, DKIM, and DMARC Explained