Navigating the maze of state cybersecurity regulations

Model Law 668 covers “licensees,” meaning anyone required to be licensed, authorized or registered pursuant to the state’s insurance laws. Depending on state law, this could include not only insurers but also insurance agents, public adjusters and claims handlers. (Credit: momius/Adobe Stock)

While cyberthreats continue to evolve and generate conversations, discussed less often is the fact that insurers are finding themselves more attractive targets for cybercriminals thanks to the troves of personal data they hold.

In October 2017, responding to these concerns, the National Association of Insurance Commissioners (NAIC) adopted the “Insurance Data Security Model Law,” also known as Model Law 668, which was based on New York’s first-of-its-kind cybersecurity regulation. New York’s regulation, enacted in March 2017, established minimum cybersecurity standards for insurance companies, banks and other financial services institutions.