April 10, 2018

 Cybersecurity is an ever-growing concern to many, affecting corporations and individuals alike. Both are at risk of having data and funds stolen by a hacker and used for a variety of purposes. Hackers use stolen consumer data to create false accounts and wreak havoc with consumers' credit and funds. When a corporation has a breach, consumers look to the corporation for help in rectifying the situation. In 2014, Yahoo! sustained a breach where three billion email accounts were exposed to hackers, and has since been sued for failure to properly disclose the breach. As the issue continues to grow and change, so do the risks. Protecting those cyber risks is vital, but there is still a need for protection should the data be hacked, since as security changes so does the method of hackers.

 The National Association of Insurance Commissioners (NAIC) has developed the Insurance Data Security Model Law in an attempt to develop standards for the investigation and notification to the state insurance commissioners of a cybersecurity event that occurs to any licensee. A licensee is anyone licensed, authorized to operate, or registered, or required to be licensed, or authorized per state insurance laws. Insurance carriers fall into this category. Not included are purchasing groups or risk retention groups chartered and licensed in another state, or licensees acting as assuming insurers that are domiciled in another state or jurisdiction. The model law will affect the licensees, or carriers, in the states where the law is adopted. The model act is presented here: Insurance Data Security Model Law