States Prescribe New Cyber Requirements for Insurers via Model Security Laws

In the United States, a significant legislative trend is on the horizon for insurers in 2020: a new breed of state privacy and cybersecurity laws.  In the absence of federal intervention, a growing number of state legislatures are enacting laws and regulations modeling California’s Consumer Privacy Act for all businesses, and, in parallel, prescribing privacy and cybersecurity requirements directed at insurers.  To help insurers stay ahead of the curve, we summarize below several cybersecurity measures set to go into effect later this year.

The trend began with New York.  The New York Department of Financial Services (NYDFS) Cybersecurity Requirements for Financial Services Companies (Part 500) was enacted in 2017, and took full effect on March 1, 2019.  Initially, it stood as the first cybersecurity regulation broadly directed at financial services companies, including insurers.  

Shortly thereafter, however, and in anticipation of further legislative activity in this area, the National Association of Insurance Commissioners (NAIC) (the industry’s state-based standard-setting organization) collaboratively proposed a “Data Security Model Law” to help harmonize cybersecurity requirements for insurers.  Eight states thus far have since adopted a version of the NAIC’s Model Security Law.

Elements of a Model Security Law

Although differences exist, each state version of NAIC’s Model Security Law requires insurers to do the following: 

1. Conduct a risk assessment and implement and maintain a cybersecurity program that is based on identified risks;
2. Develop, implement, and maintain incident response plan;
3. Provide oversight of third-party service providers;
4. Investigate and report data security incidents; and
5. Certify compliance with the respective law/model regulation.

Primary differences among the laws and the Model Security Law relate to the definitions of cybersecurity events and notifications, the scope of certain exemptions, and certain prescriptive requirements outlined in New York’s Cybersecurity Regulation.

Regulatory Transition Period

The NAIC’s Model Security Law generally allows for two transition periods so insurers have time to implement the new administrative, technical, and physical regulatory requirements.  The first transition period covers the actual security program requirements, and the second transition period covers requirements to ensure third party safeguards.  South Carolina was the first state to adopt the Model Security Law with its first transition period ending on July 1, 2019, and the requirements related to third party safeguards scheduled to take effect on July 1, 2020.  

Model Security Law Deadlines

Below is the full set of deadlines (in deadline order) for both the security program and third-party safeguards in each of the states that have adopted a version of the NAIC’s Model Security Law.

Further Information

We can expect to see additional states enacting Model Security Laws in 2020.  In fact, on January 29, 2020, Assembly Bill 819, which follows the Model Security Law, was introduced in the Wisconsin State Assembly.  Insurers should also expect states to introduce other legislation targeted at data security as state legislatures go in session for this year.  To learn more about these regulatory trends impacting insurers, visit the NAIC’s website at https://www.naic.org/.

If you have any questions about how these requirements apply to you or any other privacy law, please do not hesitate to reach out to authors Brian Hengesbaugh and Harry Valetk .

Related Posts

Are You Ready for SHIELD? – New York’s new data protections for consumers