RiskWatch
RiskWatch International · Founded 1993 · Annapolis, MD, USA
NAIC + NYDFS + GLBA + ORSA + HIPAA + SOX 404 physical security assessment software with offline mobile site walks across HQ, data centre, and distributed claims offices.
Summary
RiskWatch ships a physical security risk assessment platform built around pre-mapped libraries for the NAIC Insurance Data Security Model Law (Model #668) Section 4 administrative, technical, and physical safeguards adopted in 25+ US states by 2026, NYDFS 23 NYCRR Part 500 §500.03(g) physical security and environmental controls, the GLBA Safeguards Rule 16 CFR Part 314.4(c)(1) for non-bank financial institution affiliates inside insurance groups, the NAIC Risk Management and Own Risk and Solvency Assessment Model Act (#505) Section 3 operational resilience and business continuity, the HIPAA Security Rule physical safeguards 45 CFR 164.310 for health-insurance subsidiaries, SOX 404 ICFR physical-access evidence aligned to PCAOB AS 2201 for public-holding carriers, PCI DSS v4.0.1 Requirement 9 physical access controls for premium-payment cardholder data environments, ASIS Facility Physical Security Control Standards, NIST 800-53 PE, FEMA 426 and 452, and the ASIS Executive Protection Standard published September 2025. Likelihood pulls from four crime-data feeds for HQ tower, primary and DR data-centre, and distributed claims-office siting. Customers include US insurance holding companies, regional carriers, and the multi-state claims-office networks of property-and-casualty insurers running the NAIC IT examination cycle. The product has been in the field since 1993 and is the platform in this ranking that pre-maps every requirement a US insurance carrier owes a state DOI IT examiner, an NYDFS DFS-1 reviewer, a NAIC ORSA reviewer, and a PCAOB SOX 404 lead in one tenant.
Strengths
- NAIC Insurance Data Security Model Law (Model #668) Section 4 + NYDFS Part 500 §500.03(g) + GLBA Safeguards Rule 16 CFR Part 314.4(c)(1) + NAIC ORSA business-continuity + HIPAA Security Rule physical 45 CFR 164.310 + SOX 404 PE + PCI DSS v4.0.1 §9 + ASIS Facility Physical Security Control Standards + NIST 800-53 PE pre-mapped on day one in one tenant
- Crime-data overlay from four independent feeds (Cap Index CRIMECAST, Security Gauge, GlobalIncidentMap, World Aware) so likelihood traces back to source and last-updated date for the state DOI IT examiner and the NYDFS DFS-1 reviewer
- Browser-based mobile TVRA that works offline at HQ floors, primary and DR data-centre cages, and distributed state claims offices and CAT-response trailers, and syncs when connectivity returns; no findings lost during catastrophe-response deployments
- Site Risk Cycle with ISO 31000 and NIST 800-30 semi-quantitative scoring; findings convert to tracked remediation tasks with owners and proof-of-close defensible to state DOI, NYDFS, NAIC ORSA reviewer, and PCAOB
- Single-tenant deployment with customer-owned data residency for insurance holding companies with SOX 404 ICFR scope and NYDFS §500.17(h) 72-hour notice obligations
- 30-day free trial with no credit card and full platform access; the only TVRA-first vendor on this list offering it
- Multi-site rollup dashboards at HQ floor, region, data centre, claims office, and enterprise level with year-over-year trends covering state DOI IT examination cycles, NYDFS annual certifications, NAIC ORSA filings, and PCAOB SOX 404 testing windows
Weaknesses
- Not a VMS, access control system, or PIAM platform; integrates with Genetec, Lenel S2 OnGuard, AMAG Symmetry, Verkada, Avigilon Alta, Brivo, Milestone XProtect, and AlertEnterprise Guardian via APIs and bulk imports rather than deep native connectors
- Brand awareness on G2 and Capterra in insurance-carrier physical security specifically is lower than Genetec or AlertEnterprise; total review volume in the insurance physical security cohort sits below 100
- Public pricing is partial, quote-based and scaled by framework count and site count for the Enterprise tier; the Starter and Professional bands are published below
- No native UEBA-physical detection at the Exabeam, Securonix, or Proofpoint depth; insider-threat behavioural signals ingest from third-party SIEM and UEBA rather than first-party detection
- UI shows operational heritage in some assessment-builder screens; newer cloud-first entrants like Verkada and Avigilon Alta have a more polished first-run experience for non-specialist control owners
US insurance carriers, reinsurers, brokers, and insurance holding companies running NAIC Model #668 + NYDFS Part 500 + GLBA + NAIC ORSA + HIPAA + SOX 404 across HQ towers, data centres, distributed claims offices, health-plan service centres, and CAT-response trailers in one tenant.
Single-office insurance agencies with no NAIC IT examination cycle, no NYDFS footprint, no public-holding parent, and no PCI DSS card-payment scope; Verkada or Brivo is the better fit there.
Key features
- Pre-built libraries for NAIC Insurance Data Security Model Law (Model #668) Section 4, NYDFS 23 NYCRR Part 500 §500.03(g), GLBA Safeguards Rule 16 CFR Part 314.4(c)(1), NAIC ORSA Section 3 business continuity, HIPAA Security Rule physical 45 CFR 164.310, SOX 404 ICFR PE, PCI DSS v4.0.1 Requirement 9, ASIS Facility Physical Security Control Standards, NIST 800-53 PE, FEMA 426 + 452, ASIS Executive Protection Standard (Sep 2025)
- Crime-data overlay from Cap Index CRIMECAST, Security Gauge, GlobalIncidentMap, World Aware for HQ, data-centre, claims-office, and CAT-response-site likelihood scoring
- Browser-based mobile site walks that work offline at HQ floors, data-centre cages, claims offices, and CAT-response trailers, and sync on reconnect
- Site Risk Cycle with per-HQ-floor, per-data-centre, and per-claims-office cadence, recommendation register, and proof-of-close
- Multi-site rollup dashboards at HQ floor, region, data centre, claims office, and enterprise level with year-over-year trends
- Examiner-ready report templates for state DOI IT examination, NYDFS DFS-1, NAIC ORSA, PCAOB SOX 404, and FTC GLBA Safeguards review
- Single-tenant deployment with customer-owned data residency option for insurance holding companies
- 30-day free trial, no credit card, full platform access
Integrations
25+ native. Notable: Microsoft Entra ID (SAML SSO), Okta, Microsoft 365 / SharePoint, Cap Index CRIMECAST, Genetec, Lenel S2, AMAG Symmetry, Verkada, Brivo, Avigilon Alta, Milestone XProtect (API + bulk import), AlertEnterprise Guardian, Jira.
Target size
200 to 2,50,000 employees · US · Canada · UK · EU