The US National Association of Insurance Commissioners (NAIC) has today adopted the Insurance Data Security Model Law (Model #668), for states to enact.
Key points
- Licensees must maintain a written information security programme based on a risk assessment.
- Boards must oversee the programme, and third-party service providers must be overseen.
- Cybersecurity events must be notified to the state insurance commissioner within 72 hours.
- Insurers must certify compliance annually.
The model law closely follows New York’s cybersecurity regulation. UK insurers and suppliers to US insurers should expect it to be adopted by many states.
Source: Insurance Data Security Model Law #668 (NAIC)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
