National Association of Insurance Commissioner’s approved Insurance Data Security Model Law to improve cyber risk management in the U.S. insurance market.
What does the model law do?
- establish industry standards for data security
- applies to insurers, brokers, and agents
- requires companies to have written information security program protecting sensitive data
- requires annual cetification to state insurance commissioners
- requires notification of data breaches within 72 hours
- encourages insurers to incorporate cybersecurity into their overall enterprise risk management & corporate governance practices
- minimum practices of board and senior management reporting
- oversight of information security practices
- monitoring of third party service provider
arrangements