NAIC Insurance Data Security Model Law
A model law adopted in 2017 by US insurance commissioners, enacted by many states, requiring insurers and producers to maintain an information security program and notify the regulator of incidents.
The Insurance Data Security Model Law was adopted in October 2017 by the US National Association of Insurance Commissioners, drawing heavily on the New York regulation. Like any model law, it does not apply by itself: each state decides whether to enact it, possibly with adaptations, and more than twenty have done so. It requires insurance licensees, insurers, brokers, agents, to maintain a written information security program proportionate to their size and data sensitivity, based on a risk assessment, overseen by the board, with oversight of third-party service providers. It requires notifying the insurance commissioner of any significant cybersecurity event within 72 hours, and informing affected policyholders under state rules. It illustrates how the US system, based on state jurisdiction, achieves harmonization through voluntary adoption of a common model. For a European insurer operating in the United States, it adds a layer of obligations varying from state to state, which must be mapped.
Textbook case: an insurance broker operating in three US states suffers an email compromise exposing the data of 4,000 clients. It must notify the insurance commissioner of each state that enacted the model law within 72 hours, then inform clients under each state's own notification rules.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.