Provides financial services, in Illinois

Insurance Data Security Law, 215 ILCS 215/15 and 215/20 · Read the law's page

• Applies to a licensee under Illinois insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Illinois, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
• Notify the Director of Insurance as promptly as possible, and no later than 3 business days after you determine that a cybersecurity event has occurred, when Illinois is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming any consumer residing in Illinois or any material part of your normal operations.
• Notify the Director within the same 3 business days when you reasonably believe the nonpublic information involved is of 250 or more consumers residing in Illinois and the event requires notice to a government body, self-regulatory agency or other supervisory body under state or federal law or has a reasonable likelihood of that harm.
• Give the Director as much as possible of the 13 listed items of information, in electronic form as the Director directs, and keep updating and supplementing the notification as material changes occur.
• Conduct a prompt investigation when you learn that a cybersecurity event has occurred or may have occurred, and keep records of every cybersecurity event for at least 5 years from the date of the event, producing them on the Director's demand.
• Give the Director a copy of the notice sent to consumers under the Personal Information Protection Act when you must notify the Director.
• Treat a cybersecurity event in a system maintained by a third-party service provider as you would one in your own system, unless the provider gives the Director the notice; as an assuming insurer, notify your affected ceding insurers and the Director of your state of domicile within 3 business days.

Insurance Data Security Law, 215 ILCS 215/10 · Read the law's page

• Applies to a licensee under Illinois insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Illinois, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
• Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, commensurate with your size, your activities, your use of third-party service providers and the sensitivity of the information.
• Select and implement appropriate security measures from the set the law lists, which includes access controls, encryption of nonpublic information in transit over an external network and on portable devices, multifactor authentication for any individual accessing nonpublic information, regular testing and monitoring of systems, and audit trails.
• Establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information.
• Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it holds; this duty has applied since January 1, 2026.
• If you are an insurer domiciled in Illinois, submit to the Director a written statement by April 15 each year certifying that you comply with section 10, and keep the supporting records for 5 years.
• A licensee with fewer than 50 employees, including independent contractors, is exempt from section 10, and a licensee compliant with the federal health privacy, security and breach notification rules that maintains nonpublic information in the same manner as protected health information is treated as meeting section 10 if it submits an annual statement by April 15.