
What Cyber Insurance Requirements Apply in Iowa?
When a covered breach requires notice to more than 500 Iowa residents, you must notify the Attorney General’s Consumer Protection Division within five business days after sending consumer notices. Iowa gives resident notice no fixed day count: it must be made in the most expeditious manner possible and without unreasonable delay.
What Is Cyber Insurance?
Cyber insurance can help pay covered response costs and claims against your business after a cyber incident. If your business relies on data, software or outside providers, compare response limits, vendor outages and approval rules. Read the national Cyber liability guide.
What Should You Watch for With Cyber Insurance in Iowa?
A Second Deadline Starts With Consumer Notice
If more than 500 Iowa residents require notice, the owner or licensee must file with the AG within five business days after giving consumer notice. Ask your response provider to calendar this follow-up separately from the resident mailing. 1
Iowa Uses an Expedited Standard
Resident notice follows discovery, or a maintainer’s notice to the owner, and must be made in the most expeditious manner possible without unreasonable delay. The statute allows time to identify contacts, determine scope, and restore the system; ask how the incident record will document those steps. 1
Keep a Written No-Harm Determination
Iowa permits no consumer notice after an appropriate investigation or consultation with relevant authorities finds no reasonable likelihood of financial harm, but the finding must be written and kept for five years. Confirm your incident service preserves that decision and its supporting investigation. 1
Which Cyber Insurance Providers Have Iowa License Records?
These providers publish a national listing for Cyber liability; the license records below name the licensed entities and roles. Some records rely on company-reported information rather than independent regulator verification. A national listing does not confirm the product is available in Iowa. Check the regulator’s license lookup and confirm state availability for your business when requesting a quote.
At-Bay
At-Bay Insurance Services LLC
At-Bay’s license page lists P&C producer and surplus-lines broker license numbers for all 50 states and the District of Columbia. These are company disclosures and do not establish product availability in each jurisdiction. 10
At-Bay offers primary and excess cyber insurance for businesses with revenue up to $5 billion.
Coalition
Coalition Insurance Solutions, Inc.
Coalition’s license page lists producer and surplus-lines licenses for Coalition Insurance Solutions, Inc. in all 50 states and the District of Columbia. The page separately lists insurers; this record covers the brokerage entity only. 11
Coalition offers cyber insurance.
Corgi
Corgi Insurance Services, Inc.
Corgi’s company producer-license table lists 50 jurisdictions: 49 states and the District of Columbia, including DC license 3003091619. New Mexico does not appear in the table and is not included here; the omission does not establish that Corgi is unlicensed there. The company-reported table has no stated as-of date and does not establish product availability. 12
Corgi lists cyber insurance among its business insurance offerings.
Hiscox
Hiscox Insurance Company Inc.
Hiscox’s U.S. company information states that Hiscox Insurance Company Inc. is licensed in all 50 states and the District of Columbia. This is company-reported insurer authority for this entity and does not establish which company issues every Hiscox-branded product. 13
Hiscox offers cyber insurance for small businesses.
TechInsurance
Specialty Program Group LLC
TechInsurance’s current licensing page names Specialty Program Group LLC / SPG Insurance Solutions and lists state license numbers, but labels Rhode Island “Individual licenses” rather than identifying a license for the named agency. RI is omitted because this disclosure does not establish agency authority there; this is a search limitation, not an assertion that the company is unlicensed. The remaining state entries are company-reported and are not an insurance product availability map. 15
TechInsurance arranges cyber insurance for small businesses.
Vouch
Vouch Specialty Insurance Services, LLC
Vouch’s licenses page, effective January 16, 2025, lists producer licenses in all 50 states and DC. Its separate surplus-lines table includes Idaho number 870820, while a footnote says Georgia and Idaho do not issue agency-level surplus-lines licenses. Because those statements conflict for Idaho, this record keeps Idaho producer-only and does not treat the table number as established agency surplus-lines authority. The page is company-reported and does not establish product availability. 16
Vouch lists cyber liability in its technology-company programs.
Who Regulates Insurance in Iowa?

Iowa Insurance Division
The Iowa Insurance Division licenses insurance producers and maintains separate lists for licensed insurers and surplus-lines insurer categories. Its filing page routes most rate, rule and form filings through SERFF and identifies filings requiring prior approval; eligible surplus-lines insurers are not required to file or seek approval of their rates or forms. 3,9,8,4,5
Surplus-Lines Tax and Stamping Office in Iowa
Reported tax rate. 0.925% of surplus-lines premiums when Iowa is the insured's home state, for 2026 6,7
When Iowa is the insured's home state, the 2026 premium tax is 0.925%, and the surplus-lines producer shall collect and pay it to the state in addition to gross premium. Placement generally requires an eligible surplus-lines insurer and a diligent search showing the full amount or type is unavailable from an admitted insurer; an exempt commercial purchaser may bypass that search only after the producer discloses that admitted insurance may be available and may offer greater protection and oversight, then the purchaser subsequently requests surplus-lines placement in writing.
What Should You Ask Before Buying Cyber Insurance in Iowa?
- Does our response plan start Iowa’s five-business-day AG filing clock when resident notices go out?
- How will we document scope work and system restoration while meeting Iowa’s no-unreasonable-delay standard?
- Who retains a written Iowa no-financial-harm finding and supporting record for five years?
Cyber Insurance in Iowa: Frequently Asked Questions
When must a business notify the Iowa Attorney General about a breach?
Within five business days after notifying consumers, if more than 500 Iowa residents require notice. 1
How many days does Iowa give a business to notify residents?
Iowa sets no fixed number of days; notice must be made in the most expeditious manner possible and without unreasonable delay. 1
Can a business skip Iowa consumer notice after a breach?
Yes, after an appropriate investigation or consultation with relevant authorities determines there is no reasonable likelihood of financial harm; document the finding and retain it for five years. 1
Cyber Insurance Guides for Other States
Alabama
Alaska
Arizona
Arkansas
California
Colorado
Connecticut
Delaware
District of Columbia
Florida
Georgia
Hawaii
Idaho
Illinois
Indiana
Kansas
Kentucky
Louisiana
Maine
Maryland
Massachusetts
Michigan
Minnesota
Mississippi
Missouri
Montana
Nebraska
Nevada
New Hampshire
New Jersey
New Mexico
New York
North Carolina
North Dakota
Ohio
Oklahoma
Oregon
Pennsylvania
Rhode Island
South Carolina
South Dakota
Tennessee
Texas
Utah
Vermont
Virginia
Washington
West Virginia
Wisconsin
Wyoming
Other coverage in IowaEvery coverage guide for Iowa, plus the regulator and surplus-lines details.





