The NAIC's guiding principles help lay a foundation to prevent the disclosure of personally identifiable information and best position those in the insurance industry should a breach occur and if an action is taken against them. The best prepared companies will be those which are able to state that they have used reasonable efforts to: (1) prevent a cyberattack; and (2) protect personally identifiable and trade secret information . . . and have evidence to prove that! These efforts will lead to the measure of damages, if any, being significantly less. This can effectively be done through careful preparation of a written information security plan (WISP) and a data breach response plan (DBRP) including appropriate IT technical and legal analyses and incorporating the NAIC guiding principles:

Insurers must have systems in place to alert consumers in a timely manner in the event of a cyber breach.
Personally identifiable information held by insurance producers and third-parties as well as insurers must be reasonably protected.
An essential component of any plan is preparing for an incident suffered by an insurer, insurance producer and other third-parties (a data breach response plan).
Third-parties and producers should be audited to determine if controls are in place to protect personally identifiable information.
Cyber security should be a part of an insurer's or a producer's Enterprise Risk Management (ERM).
Cyber security audits and written information security plans containing data breach response plans should be reviewed by the Board regularly.
Periodic employee training and assessment is also an essential part of any plan.

Special Reports /

Cyber security: Insurance industry challenges and opportunities

Related Stories

Recommended For You