NAIC adopts model law on cybersecurity: Will states adopt it?

The model law requires Licensees to implement a comprehensive written information security program based on the licensees’ risk assessment. (Photo: Shutterstock)

On Oct. 24, the National Association of Insurance Commissioners (NAIC) formally approved the Insurance Data Security Model Law (model law). The NAIC is a standard setting and regulatory support organization consisting of the top insurance regulators from the 50 states, District of Columbia, and five U.S. territories.

The model law applies to “licensees” which are defined as persons and nongovernmental business entities subject to the insurance laws of the state adopting the model law. In Pennsylvania, for example, this would encompass insurance companies and insurance producers (i.e., agents, agencies and brokers). Notably, this applies to nonresident licensees except for purchasing groups, risk retention groups or when acting as assuming insurer. For example, a broker resident in a state that has not adopted the model law, is potentially subject to the model law if they are also licensed in another state that has adopted the model law. Thus, it will be important to track what states enact the model law and also how uniformly the model law is enacted state to state.