The National Association of Insurance Commissioners (“NAIC”) has adopted the Insurance Data Security Model Law.

The model law creates rules for insurers, agents, and other licensed entities covering data security, investigation, and notification of breach. This includes maintaining an information security program based on ongoing risk assessment, overseeing third-party service providers, investigating data breaches, and notifying regulators of a cybersecurity event.

“Considering the recent series of data breaches, cybersecurity is more important now than ever,” said Ted Nickel, the NAIC's president and Wisconsin's insurance commissioner. “Regulators have a critical role to play in protecting consumers as the cyber landscape continues to evolve and this model law sets cybersecurity customs for insurers to help safeguard consumers.”