Is an insurer, in North Dakota

N.D. Cent. Code §§ 26.1-02.2-04, 26.1-02.2-05 · Read the law's page

• Applies to a licensee under North Dakota insurance law, which you declare by stating that you are an insurer, with the notice owed where North Dakota is your state of domicile (an insurer) or your home state (a producer), or where you reasonably believe the nonpublic information involved is of 250 or more consumers residing in North Dakota.
• If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation, or have an outside vendor or service provider designated to act on your behalf conduct one: determine whether an event occurred, assess its nature and scope, identify the nonpublic information involved, and perform or oversee reasonable measures to restore the security of the compromised information systems; keep records of every cybersecurity event for at least five years and produce them on the commissioner's demand.
• Notify the commissioner as promptly as possible, and no later than three business days from your determination that a cybersecurity event has occurred, where North Dakota is your state of domicile (an insurer) or your home state (a producer) and the event triggers notification to a consumer residing in North Dakota under chapter 51-30 or has a reasonable likelihood of harming any material part of your normal operations.
• Notify the commissioner within the same three business days where you reasonably believe the nonpublic information involved is of two hundred fifty or more consumers residing in North Dakota and the event requires notice to any government body, self-regulatory agency, or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer residing in North Dakota or any part of your normal operations.
• Give the notice in electronic form as the commissioner directs, update and supplement it for material changes, and provide as much as possible of what the section lists: the date and cause of the event, how it was discovered, whether information was recovered, the source, whether a police report or other regulatory notice was made, the types of information, the period of compromise, the number of affected North Dakota consumers, the results of your internal review, your remediation efforts, a copy of your privacy policy and a statement of the steps you will take to investigate and notify consumers, and a contact person.
• Comply with chapter 51-30, as applicable, and give the commissioner a copy of the notice sent to consumers when you must notify the commissioner.
• Treat a cybersecurity event in a system maintained by a third-party service provider, of which you have become aware, as your own event unless the provider gives the commissioner the notice, with your deadline running from the day after the provider notifies you or you otherwise have actual knowledge of the event.
• If you are an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of making the determination that a cybersecurity event has occurred, or within three business days of receiving notice from your third-party service provider.
• If you are an insurer and consumer notice is required by chapter 51-30 for an event involving a consumer who reached you through an independent insurance producer, notify the producers of record of all affected consumers no later than the time you notify the consumers.

N.D. Cent. Code § 26.1-02.2-03 · Read the law's page

• Applies to a licensee under North Dakota insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate, registered, or required to be licensed, authorized, or registered under the insurance laws of North Dakota, other than a purchasing group or a risk retention group chartered and licensed in another state or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
• Develop, implement, and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information system, commensurate with your size and complexity, the nature and scope of your activities, including your use of third-party service providers, and the sensitivity of the nonpublic information.
• Designate one or more employees, an affiliate, or an outside vendor as responsible for the program, identify reasonably foreseeable internal or external threats, including those to nonpublic information held by third-party service providers, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of the key controls, systems, and procedures of your safeguards annually.
• Determine which of the security measures in section 26.1-02.2-03(4)(b) are appropriate and implement them: access controls, restricted physical access, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices for in-house applications, effective controls that may include multi-factor authentication, regular testing and monitoring, audit trails, protection against environmental hazards, and secure disposal of nonpublic information in any format.
• Include cybersecurity risks in your enterprise risk management process, stay informed regarding emerging threats or vulnerabilities, and give your personnel cybersecurity awareness training that is updated to reflect the risks identified in your risk assessment.
• If you have a board of directors, have the board or an appropriate committee require executive management or its delegates to develop, implement, and maintain the program and to report in writing annually on the status of the program, your compliance, and material matters, including risk assessment, third-party service provider arrangements, results of testing, and cybersecurity events.
• Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information accessible to, or held by, the provider, and monitor, evaluate, and adjust the program as technology, the sensitivity of your nonpublic information, threats, and your business arrangements change.
• Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in your possession, including your plan to recover your information systems and restore continuous functionality, and address the internal response process, goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event.
• If you are an insurer domiciled in North Dakota, submit to the commissioner by April fifteenth each year a written statement certifying that you comply with section 26.1-02.2-03, keep the supporting records, schedules, and data for five years, and document any area, system, or process that requires material improvement together with the remedial effort planned and underway.
• A licensee with less than five million dollars in gross revenue or less than ten million dollars in year-end assets is exempt from subsections 2 through 10 of section 26.1-02.2-03, and a licensee that is subject to, governed by, and compliant with the federal health privacy, security, and breach notification rules and maintains nonpublic information in the same manner as protected health information is deemed to comply; a licensee that ceases to qualify for an exception has one hundred eighty days to comply.