Is an insurer, in Ohio

Insurer Cybersecurity Event Notice, Ohio Rev. Code ss. 3965.03 and 3965.04 · Read the law's page

• This binds every licensee under Ohio's insurance laws, an insurer, agent or other person licensed, authorized or registered under them, but not a purchasing group or risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction (reached by declaring that you are an insurer); the small-licensee exemption in section 3965.07(A) lifts only section 3965.02, and a licensee in compliance with the HIPAA privacy and security rules still gives the section 3965.04 notice (sections 3965.01(M) and 3965.07).
• When you learn that a cybersecurity event has or may have occurred, investigate it promptly yourself or through a vendor you designate: determine whether an event occurred, assess its nature and scope, identify the nonpublic information involved, and restore the security of the compromised information systems (section 3965.03(A) and (B)).
• Keep records of all cybersecurity events for at least five years from the date of each event and produce them on the superintendent's demand (section 3965.03(D)).
• Notify the superintendent of insurance as promptly as possible, and no later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Ohio is your state of domicile (insurer) or home state (independent insurance agent) and the event has a reasonable likelihood of materially harming a consumer or a material part of your normal operations (section 3965.04(A)(1)).
• Give the same notice within the same three business days when you reasonably believe the nonpublic information involved relates to 250 or more Ohio consumers and the event is one you must report to a government body under other law or has a reasonable likelihood of materially harming an Ohio consumer or a material part of your normal operations (section 3965.04(A)(2)).
• In the notice give as much as possible of the information section 3965.04(B)(1) lists, including the date of the event, how the information was exposed, the number of Ohio consumers affected, the results of your internal review and your remediation efforts, give it electronically as the superintendent directs, and update it as material developments occur (section 3965.04(B)).
• Give the superintendent a copy of the notice you send to consumers under section 1349.19 of the Revised Code (section 3965.04(C)).
• Treat a cybersecurity event at a third-party service provider as your own event, with your deadlines running from the day after the provider notifies you or you otherwise have actual knowledge of it, whichever is sooner (section 3965.04(D)).
• If you are an assuming insurer, notify your affected ceding insurers and the insurance commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred (section 3965.04(E)(1)).

Insurer Information Security Program, Ohio Rev. Code ss. 3965.02 and 3965.07 · Read the law's page

• This binds every licensee under Ohio's insurance laws, an insurer, agent or other person licensed, authorized or registered under them, but not a purchasing group or risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction (reached by declaring that you are an insurer); a licensee with fewer than twenty employees, less than five million dollars in gross annual revenue, or less than ten million dollars in assets is exempt from this program duty (sections 3965.01(M) and 3965.07(A)).
• Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system (section 3965.02(A) and (B)).
• Designate the person or entity responsible for the program, identify reasonably foreseeable internal and external threats, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of your key controls, systems and procedures at least annually (section 3965.02(C)).
• Based on that risk assessment, determine which of the listed security measures are appropriate and implement them: access controls, encryption of nonpublic information in transit over an external network and on portable devices, secure development practices, effective controls that may include multifactor authentication, testing and monitoring, audit trails and secure disposal, and give your personnel cybersecurity awareness training (section 3965.02(D)).
• If you have a board of directors, have the board or an appropriate committee require management to develop, implement and maintain the program and report to it in writing at least annually on the program's status, your compliance with the chapter and material matters (section 3965.02(E)).
• Exercise due diligence in selecting each third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can reach (section 3965.02(F)).
• Monitor, evaluate and adjust the program for changes in technology, the sensitivity of your nonpublic information, internal and external threats, and your own business arrangements (section 3965.02(G)).
• Establish a written incident response plan that covers the internal response process, its goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision of the plan after a cybersecurity event (section 3965.02(H)).
• If you are an insurer domiciled in Ohio, submit to the superintendent of insurance by the fifteenth day of February each year a written statement certifying your compliance with section 3965.02, and keep the supporting records for five years; an insurer licensed only in Ohio may instead file the statement as part of its corporate governance annual disclosure (section 3965.02(I)).