Provides financial services, in Maine

Maine Insurance Data Security Act information security program, 24-A M.R.S. § 2264 · Read the law's page

• Applies to a licensee under Maine insurance law, which you declare by stating that you are an insurer: a person licensed, authorized to operate or registered, or required to be licensed, authorized or registered, under the insurance laws of Maine, other than a purchasing group or a risk retention group chartered and licensed in another state or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
• Develop, implement and maintain a comprehensive, written information security program based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information systems, in proportion to your size and complexity, the nature and scope of your activities, including your use of third-party service providers, and the sensitivity of the nonpublic information.
• Designate one or more employees, an affiliate or another person to be responsible for the program, identify reasonably foreseeable internal and external threats, including threats to information held by third-party service providers, and at least annually assess the effectiveness of your key controls, information systems and procedures.
• Consider the security measures section 2264 lists, including access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, multifactor authentication where effective, regular testing and monitoring, audit trails and secure disposal, and implement those you consider appropriate.
• Include cybersecurity risks in your enterprise risk management process, stay informed of emerging threats and vulnerabilities, and give your personnel cybersecurity awareness training that is updated to reflect the risks in your risk assessment.
• Establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises nonpublic information, your information systems or the continuing functionality of your business.
• If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation or have a designated outside vendor or service provider conduct it, and keep records of the event for at least 5 years and produce them on the superintendent's demand.
• Exercise due diligence in selecting each third-party service provider and require it to implement appropriate administrative, technical and physical safeguards for the information systems and nonpublic information it can access or holds.
• No later than January 1, 2027, require each third-party service provider to notify you when it becomes aware of a cybersecurity event affecting nonpublic information obtained from you, in its own system or an ancillary service provider's system, that has a reasonable likelihood of materially harming any consumer or any material part of your normal operations.
• If you are an insurance carrier domiciled in Maine, submit to the superintendent by April 15 each year a written statement certifying compliance with section 2264, and keep the supporting records for 5 years.
• A licensee with fewer than 10 employees, including independent contractors working for it in the business of insurance, is exempt from section 2264.
• A licensee that is subject to and in compliance with HIPAA and its related privacy, security and breach notification rules is considered to meet the chapter, other than the notice to the superintendent in section 2266, only if it keeps a program that treats all nonpublic information relating to Maine consumers as protected health information, certifies compliance to the superintendent each year, and the superintendent has not found the federal rules materially less stringent.

Maine Insurance Data Security Act notification of a cybersecurity event, 24-A M.R.S. § 2266 · Read the law's page

• Applies to a licensee under Maine insurance law, which you declare by stating that you are an insurer: a person licensed, authorized to operate or registered, or required to be licensed, authorized or registered, under the insurance laws of Maine, other than a purchasing group or a risk retention group chartered and licensed in another state or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
• Notify the superintendent as promptly as possible and in no event later than 3 business days from a determination that a cybersecurity event has occurred, if Maine is your state of domicile as an insurance carrier or your home state as an insurance producer.
• Also notify the superintendent within 3 business days of that determination if you reasonably believe the nonpublic information involved concerns 250 or more consumers residing in Maine and the event requires notice to a government body, self-regulatory organization or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer residing in Maine or a material part of your normal operation.
• Provide as much as possible of the information section 2266, subsection 2 lists, in electronic form as the superintendent directs, and update and supplement the notice for the continuing life of the event.
• Comply with Title 10, chapter 210-B for consumer notice and, when you must notify the superintendent, give the superintendent a copy of the notice sent to consumers.
• For an event in a system maintained by a third-party service provider or an ancillary service provider, count your notice deadlines from the day after the provider notifies you or the day after you otherwise have actual knowledge, whichever is sooner.
• If you are an assuming insurer, notify your affected ceding insurers and the superintendent of your state of domicile within 3 business days of determining that a cybersecurity event involving nonpublic information you use or hold has occurred, or of receiving notice from your third-party service provider that one has occurred.
• If you are an insurance carrier, notify the producers of record of all affected consumers no later than the time consumers must be notified or as the superintendent directs, unless you do not have the current producer of record information for a consumer.
• A licensee that complies with HIPAA is not excused from the notice to the superintendent.