SSB 1190

“Licensee” does not include a purchasing group or a risk retention group chartered and licensed in a state other than this state, or a person acting as an assuming insurer that is domiciled in another state or jurisdiction. The bill does not create or imply a private cause of action for a violation of its provisions, and does not curtail a private cause of action that would otherwise exist in the absence of the bill. The bill requires licensees to develop, implement, and maintain a comprehensive written information security program (program) based on the licensee’s risk assessment (assessment) conducted pursuant to the bill. Licensees must comply with the program requirements no later than January 1, 2023. The program must safeguard the licensee’s nonpublic information and information system. _____ the bill as a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic information, and any specialized system such as an industrial or process controls system, a telephone switching and private branch exchange system, or an environmental control system. “Nonpublic information” is also defined in the bill. Certain licensees and other persons are exempt from the program requirement as detailed in the bill. The bill requires a licensee’s program to protect the security and confidentiality of nonpublic information and the security of the information system, to protect against threats or hazards to the security or integrity of nonpublic information and the information system, to protect against unauthorized access to or the use of nonpublic information, to minimize the likelihood of harm to consumers, and to define and periodically reevaluate a schedule for the retention and destruction of nonpublic information. A licensee’s assessment must designate one or more employees, an affiliate, or an outside vendor to act on behalf of the licensee and to have responsibility for the program; identify reasonably foreseeable internal or external threats that may result in unauthorized access, transmission, disclosure, misuse, alteration, or destruction of nonpublic information, including nonpublic information that is accessible to, or held by, a third-party service provider; assess the probability of and the potential damage caused by identified threats; and assess the sufficiency of policies, procedures, information systems, and other safeguards in place to manage identified threats. The assessment must include consideration of threats identified in each relevant area of the licensee’s operations. _____ enterprise-wide risk management process, to maintain knowledge and understanding of emerging threats or vulnerabilities, to utilize reasonable security measures when sharing information, and to provide the licensee’s personnel with cybersecurity awareness training. If a licensee has a board of directors, the bill directs the board to require the licensee’s executive management or its delegates to develop, implement, and maintain the licensee’s program, and to provide an annual report to the board that documents the information specified in the bill. If a licensee’s executive management delegates any of its responsibilities, it must oversee the delegate’s development, implementation, and maintenance of the licensee’s program. As part of a licensee’s program, the bill requires the licensee to establish a written incident response plan (plan) designed to respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in the licensee’s possession or information systems; or that compromises the continuing functionality of the licensee’s operations. The plan must address all criteria specified in the bill. “Cybersecurity event” is defined in the bill as an event resulting in unauthorized access to, or the disruption or misuse of, an information system or of nonpublic information stored on an information system. “Cybersecurity event” does not include the unauthorized acquisition of encrypted nonpublic information if the encryption, process, or key is not also acquired, released, or used without authorization; or an event for which a licensee has determined that the nonpublic information accessed by an unauthorized person has not been used or released, and the nonpublic information has been returned or destroyed. Insurers domiciled in this state must submit an annual certification to the commissioner that the insurer is in compliance with the plan requirements. _____ the selection of a third-party service provider (provider), to conduct oversight of all provider arrangements, and to require all providers to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider. Licensees must comply with these requirements no later than January 1, 2024. “Third-party service provider” is defined in the bill as a person that is not a licensee that contracts with a licensee to maintain, process, store, or is otherwise permitted access to nonpublic information through the person’s provision of services to the licensee. If a licensee discovers that a cybersecurity event has occurred, or that a cybersecurity event may have occurred, the licensee, or the outside vendor or provider the licensee has designated to act on behalf of the licensee, must conduct a prompt investigation of the event as detailed in the bill. If a licensee learns that a cybersecurity event has occurred, or may have occurred, in an information system maintained by a provider of the licensee, the licensee must complete the same type of investigation, or confirm and document that the provider has completed such an investigation. A licensee must maintain all records and documentation related to the licensee’s investigation for a minimum of five years from the date of the cybersecurity event. A licensee is required to notify the commissioner no later than three business days from the date of the licensee’s confirmation of a cybersecurity event if the licensee is an insurer who is domiciled in this state, or is a producer whose home state is this state, and state or federal law requires notice to a government body, self-regulatory agency, or other supervisory body. _____ or the licensee reasonably believes that nonpublic information compromised by the cybersecurity event involves 250 or more consumers and state or federal law requires notice to a government body, self-regulatory agency, or other supervisory body. The licensee must provide the commissioner with the information specified in the bill and has a continuing obligation to update and supplement the information as material changes to the information occur. In the event of a cybersecurity event involving nonpublic information, the licensee must notify consumers as detailed in the bill. A licensee that has to provide notification to more than 500 consumers must also give written notice to the director of the consumer protection division of the office of the attorney general within five business days of the date the first notice of the cybersecurity event is provided to an affected consumer. The bill also details the requirements for cybersecurity event notifications related to providers, reinsurers, and producers of record. The bill details confidentiality and privilege as applied to documents, materials, or other information furnished by a licensee, or that are obtained by the commissioner pursuant to an investigation or examination, and that are in the control or possession of the commissioner. The bill details which documents, materials, or other information do not constitute a public record under Code chapter 22; are not subject to subpoena and discovery; and are not admissible in a private civil action. The bill also describes how the documents, materials, and other information may be shared or used by the commissioner. The bill does not apply to a licensee that is subject to, and in compliance with, the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The licensee must submit an annual written certification to the commissioner of the licensee’s compliance with HIPAA.7A and Code chapter 507B. The commissioner may adopt rules to administer the bill and may take any enforcement action under the commissioner’s authority to enforce compliance with the bill. If any provision of the bill, or its application to any person or circumstance is held invalid, the invalidity does not affect other provisions or applications of the bill which can be given effect without the invalid provision or application. The bill takes effect January 1, 2022.