A carrier's security team gets a request to approve one more partner connection. An MGA, TPA or vendor needs to send submissions or claims data into the core platform. The questionnaire answers look fine, but nothing tells the reviewer what the integration layer enforces once data starts moving.
That gap matters because partner access is where breaches now run. A paper approval ages quickly, while the sender's credentials, payload shape and data scope keep changing.
This checklist gives security leads five gates to verify before approving any sender, a comparison of how common integration options handle them, and the evidence to request at each gate.
What Does an Integration Gateway Need to Enforce Before Data Moves?
An integration gateway is a single, secured entry point that lets outside systems send data into a carrier's core platform without building a separate connector for each sender. Security reviews should test what that entry point enforces, not what the sender promises.
Why the Entry Point Carries the Risk
Verizon's 2026 Data Breach Investigations Report found that breaches involving a third party now account for 48% of all breaches across industries, up 60% from the prior year. Every MGA, TPA and vendor holding a credential into your core platform adds to that exposure.
What Regulators Now Expect
The New York Department of Financial Services (NYDFS) put the last provisions of its amended Part 500 cybersecurity rules into effect on November 1, 2025. Covered entities licensed under the state's Insurance Law must now use multi-factor authentication for anyone accessing their information systems, with limited exceptions, and keep an asset inventory that records owner, location and sensitivity.
An October 21, 2025 NYDFS industry letter also expects access for a departing service provider, including service accounts and application interfaces, to be revoked promptly.
The Five-Gate Integration Security Checklist
Five gates cover the full path of a partner's data, from the first credential to the last log entry. Each gate pairs a control to verify with the evidence to request.
Gate | Control to verify | Evidence to request |
|---|---|---|
1. Identity | Unique credentials per sender, multi-factor sign-in for human users, key rotation and expiry | Credential inventory with owner, issue date and last rotation |
2. Payload | Every request checked against a defined schema, with malformed or oversized payloads rejected | Rejected-request report and the schema version in force |
3. Boundary | Processing inside the carrier's environment, encryption in transit and at rest, patched gateway software | Data flow diagram, encryption settings and patch records |
4. Oversight | A named person confirms each field mapping before data moves | Mapping approval log with approver and date |
5. Evidence | Every request, response and error logged and retained, with access revoked at exit | Log sample, retention policy and revocation record |
Gates 1 and 2: Who Is Sending, and What Are They Sending?
Start with identity. A shared API key used by several staff at a vendor cannot be traced or retired cleanly, so each sender needs its own credential, an owner and an expiry date.
Payload mapping matches each field in a sender's data to the field the target platform expects, so a submission or claim lands in the right place on the first send. An unvalidated payload also lets malformed or oversized data through, so schema checks belong at the gateway.
Gates 3 and 4: Where Does the Data Live, and Who Confirmed the Mapping?
Keep PII and PHI inside the carrier's controlled environment, and ask for the data flow diagram that proves it. Patch records for the gateway software matter as well, because vulnerability exploitation is now the leading breach entry point at 31% of breaches in the same Verizon report.
Oversight closes the boundary. A named person confirms each mapping, so accountability sits with someone who can answer an examiner.
Gate 5: Can You Prove What Happened?
Logs answer the first question an examiner or incident responder asks. Confirm that every request, response and error is recorded, retained under a stated policy and attributable to one sender, because that record becomes the audit trail.
Then test the exit path. Keys, service accounts and endpoints for an ended relationship are revoked, and the revocation itself is recorded.
How Do Custom, File-Based and Shared Gateway Options Compare on Security?
Every integration option answers the five gates differently. The comparison below shows where each one leaves gaps.
Where the Options Differ
Control | Custom connector per sender | File or email exchange | Shared governed gateway |
|---|---|---|---|
Credential ownership | Varies by build | Rarely tracked | Central inventory |
Payload validation | Written per connector | None | One schema check path |
Monitoring | Separate for each connection | Manual | One dashboard view |
Upgrade upkeep | Rebuilt after platform changes | Not applicable | Maintained once |
Exit and revocation | Each connection found one at a time | Shared mailboxes linger | One credential retired |
What a Shared Layer Does Not Replace
Point-to-point builds are the hardest to audit because nobody holds a complete list of what each one can reach. A shared layer does not remove vendor review, but it gives one place to apply the five gates and one place to prove they held.
Cloud-hosted core platforms raise the same question, since every sender needs a verified identity rather than trust based on network location.
When Should Security Teams Run the Checklist?
Run all five gates before the first production message, then again whenever the partnership changes shape.
At Onboarding and at Every Scope Change
Scope growth turns a low-risk connection into a high-risk one. A partner that adds a line of business, a new data type or a new carrier tenant needs a fresh pass, because point-in-time assessments miss that drift.
Who Owns Each Gate
Security owns identity and boundary. The integration team owns payload and evidence, and the business sponsor signs the oversight step. Record each owner in the asset inventory so the review has a named person behind every gate.
How InsOps Helps
InsOps builds an insurance-trained AI that assists with moving partner data into your core platform. LiLa, our insurance-trained LLM, drafts the field mapping from a sender's payload to your platform's structure, and a person at the sender reviews and confirms every mapping before data moves.
The InsOps Integration Gateway gives MGAs, TPAs, brokers and underwriting vendors a prebuilt route into your policy, claims and billing systems. Senders register in a self-service portal with a one-time passcode, receive an API key, and upload a JSON payload that the portal checks for syntax errors immediately. A dashboard records every request, response and error.
The gateway runs inside your own environment, so PII and PHI stay in controlled infrastructure. It also flags incomplete data before it reaches an underwriter or adjuster. InsOps is a Guidewire technology partner with prebuilt connectors to the core platforms carriers run.
Apply this checklist to any gateway, ours included, and ask for the evidence in the table. If you are evaluating how to approve partner integrations without a custom connector build for each sender, contact us to talk through what this looks like for your operation.
Frequently Asked Questions
What is an integration gateway?
It is one controlled doorway between outside senders and a carrier's policy, claims and billing systems. Identity checks, payload validation and logging run at that doorway instead of inside each sender's custom build.
What role does an API gateway play in security?
It centralizes authentication enforcement, rate limiting, threat detection and logging in one enforcement point. A security team then applies and audits one set of policies instead of a different set for every connection.
What are the consequences of poor API security in insurance?
Policyholder PII and PHI are exposed, regulators scrutinize the gap during examinations, and attackers use partner access as an entry point. A weak credential at one vendor becomes a path into the carrier's core systems.
How does API integration security protect against unauthorized access?
It ties every request to a unique, expiring credential and rejects anything outside the defined schema. Prompt revocation closes the path when a relationship ends.
Which metrics show an integration is secure?
Track the share of senders with a unique credential and a named owner, credentials past their rotation date, requests rejected at validation, and the time from partner exit to revoked access. Review all four at each scope change.
How does the InsOps Integration Gateway help?
It gives senders a prebuilt route into your core platform through a self-service portal, with payload checks and a request dashboard. LiLa drafts each field mapping, and a person at the sender confirms it before any data moves.
How long does it take to put this checklist into practice?
Start with the partner integrations that carry the most sensitive data, run the five gates on each, and record the gaps. The first pass is an inventory exercise, and after that the checklist runs at onboarding and at each scope change.