Is an insurer, in Alaska

Alaska Stat. secs. 21.23.270 and 21.23.280 (Insurance Data Security) · Read the law's page

• Applies to a licensee of the Alaska Division of Insurance, which you declare by stating that you are an insurer: a person licensed, authorized to operate, or registered, or required to be licensed, authorized or registered, under Title 21 of the Alaska Statutes, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction. The notice duty reaches an insurer domiciled in Alaska and an insurance producer whose home state is Alaska, and any other licensee that reasonably believes a cybersecurity event involves the nonpublic information of 250 or more Alaska consumers and either affects it and must be reported to a government agency under state or federal law or has a reasonable likelihood of materially harming an Alaska consumer or a material part of its normal operation. A licensee subject to the Health Insurance Portability and Accountability Act of 1996 that maintains and complies with a program under that Act and certifies this in writing to the director is outside the article.
• When you become aware that a cybersecurity event has or may have occurred, promptly investigate it, or have an outside vendor or third-party service provider designated to act for you do so, and to the extent possible assess its nature and scope, identify the nonpublic information involved, and restore the security of the compromised information systems; if the event is in a system a third-party service provider maintains, complete those steps or confirm and document that the provider has.
• Keep records concerning all cybersecurity events for at least five years from the date of each event and produce them at the request of the director.
• Notify the director as soon as possible and not later than three business days after you determine that a cybersecurity event has occurred, unless a federal law enforcement official instructs you not to distribute information about it, in the form and format the director prescribes, with the date of the event, how nonpublic information was exposed, how the event was discovered, the number of Alaska consumers affected, the results of your internal review, your remediation efforts, your privacy policy and a contact person, among the other items listed in the section.
• Update and supplement the notice in the form, format and frequency the director prescribes, and give the director a copy of any consumer notice you send under the Alaska Personal Information Protection Act.
• If the event is in an information system a third-party service provider maintains, count your three business days from the day after the provider notifies you or the day after you have actual knowledge of the event, whichever is earlier, unless the provider notifies the director itself.
• If you are an assuming insurer without a direct contractual relationship with an affected consumer, notify your affected ceding insurers and the insurance supervisory official of your state of domicile not later than three business days after you determine that a cybersecurity event has occurred, or after your third-party service provider notifies you of one.
• If you are an insurer, notify each independent insurance producer of record of an affected consumer as soon as possible, in the form and format the director prescribes, where the consumer accessed your services through that producer and you have the current producer of record information.

Alaska Stat. secs. 21.23.250 and 21.23.260 (Insurance Data Security) · Read the law's page

• Applies to a licensee of the Alaska Division of Insurance, which you declare by stating that you are an insurer: a person licensed, authorized to operate, or registered, or required to be licensed, authorized or registered, under Title 21 of the Alaska Statutes, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction. A licensee with fewer than 10 employees, including independent contractors, is outside the risk assessment and program duties, as is a licensee that is an employee, agent, representative or designee of another licensee covered by an information security program, and a licensee subject to the Health Insurance Portability and Accountability Act of 1996 that maintains and complies with a program under that Act and certifies this in writing to the director is outside the article.
• From January 1, 2026, conduct a risk assessment commensurate with your size and complexity and the nature and scope of your activities: identify reasonably foreseeable internal and external threats to nonpublic information, including information held by third-party service providers, assess their likelihood and potential damage, and assess the sufficiency of your policies, procedures, information systems and other safeguards in each area of your operations.
• From January 1, 2026, develop, implement and maintain a comprehensive written information security program based on the risk assessment, with administrative, technical and physical safeguards, a schedule for retaining nonpublic information and a mechanism for destroying it when no longer needed, and designate an employee, an outside vendor or a third-party service provider as the person responsible for the program.
• Based on the risk assessment, implement each security measure you determine is appropriate from those the law lists, which include access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information; include cybersecurity risks in your enterprise risk management process; and give your personnel cybersecurity awareness training that is updated to reflect the risks you identify.
• Require a third-party service provider that has access to or holds nonpublic information to notify you as soon as possible, and not later than 10 business days, after it determines that it has experienced a cybersecurity event involving nonpublic information associated with a consumer.
• From January 1, 2027, exercise due diligence in selecting a third-party service provider and, where appropriate, require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access or holds.
• Establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, the licensee's information systems or the continuing functionality of an aspect of your business, covering the internal response process, goals, roles and decision-making authority, communications, remediation of identified weaknesses, documentation and reporting, and revision of the plan after an event.
• Have your board of directors or an appropriate committee require executive management to develop, implement and maintain the program, and have executive management report to it in writing at least once a year on the overall status of the program and your compliance and on material matters such as risk assessment, third-party service provider arrangements, test results and cybersecurity events.
• If you are an insurer domiciled in Alaska, submit to the director by February 15 of each year a written statement certifying that you comply with the risk assessment and program duties, keep the supporting records for five years after the statement, and document the areas you have identified as needing material improvement and the remedial efforts planned and under way.