State National Companies Completes SAS 70 Examination

CPI Customers Benefit from Independent Assessments

Fort Worth, TX – April 10, 2008 – State National Companies (SNC), a national leader in collateral protection insurance (CPI) solutions, has completed a SAS 70 examination, performed by independent auditor Deloitte & Touche LLP, a member of Deloitte Touche Tohmatsu.

The SAS 70 strengthens State National’s data security profile, adding to previous certifications the company has received from network security specialist Foundstone. Of particular importance to State National’s customers, SNC’s SAS 70 examined not only the traditional areas of computer and data center security, but also controls specifically related to CPI.

“Because State National is the only company in the nation that specializes in collateral protection insurance, it is critical that our examinations and certifications focus on CPI data, system, and operational security,” says Trace Ledbetter, senior vice president of service at State National.

State National’s SAS 70 examination is part of the company’s continued commitment to security and complements other certifications State National has attained. For instance, State National maintains the FoundSecure™ seal from Foundstone, a division of McAfee, which signifies that State National maintains its network environment in a security-conscious manner. The FoundSecure certification affirms that State National has undergone and established a rigorous ongoing security assessment program and continues to support and maintain its network security.

“It’s not enough that our clients know State National takes data security very seriously,” says Ledbetter. “The SAS 70 examination and FoundSecure certification provide assurance based on an independent, objective analysis that we consistently maintain the highest data security measures. They give State National’s clients further proof of a secure, solid operation and provide peace of mind to our business partners.”

CPI processes reviewed included procedures to ensure accurate and timely processing of premium, refund and claims processing. Information examined in technology controls included procedures to assure customers that computer systems and applications are tested, backed up, and securely stored. Also examined were computer controls at SNC’s service operations center in Fort Worth. The examination encompassed SNC’s internal network as well as its client-facing applications, including its renowned InsurTrak online CPI management platform.

Additionally, processes were reviewed to demonstrate that SNC has established administrative and operational procedures and environmental controls to limit unauthorized access to computer equipment, storage media, application programs and client data. The Deloitte examination was performed in accordance with standards established by the American Institute of Certified Public Accountants.