Is an insurer, in Puerto Rico

Rule No. 108 of the Insurance Code Regulations, Sections 9 and 10, Cybersecurity Standards for the Insurance Industry · Read the law's page

• Applies to any person who holds a license or authorization to transact insurance business issued by the Office of the Commissioner of Insurance of Puerto Rico and who uses an Information System, which you declare by stating that you are an insurer; a licensee is a person that holds, or is required to hold, a license, authorization or certificate of authority under the Insurance Code of Puerto Rico, and the Rule excludes a purchasing group or risk control group established and licensed in another state, and a licensee acting as a reinsurer that is domiciled in another state or jurisdiction.
• If you learn that a cybersecurity incident has occurred or may have occurred, conduct an investigation as soon as possible and prepare a written report, and at a minimum determine whether an incident occurred, assess its nature and scope, identify the nonpublic information that may have been affected, and perform or oversee reasonable measures to restore the security of the affected information systems; if the incident is in a system maintained by a service contractor, complete those steps or confirm and document that the contractor completed them.
• Notify the Commissioner as promptly as possible, within 72 hours after it has been determined that a cybersecurity incident has occurred, when you reasonably believe that the nonpublic information involved impacts 250 or more consumers residing in Puerto Rico and the incident impacts you in a manner that requires notice to a government agency, corporation or instrumentality, regulatory agency or supervisory entity under a state or federal law, or has a reasonable probability of causing material harm to consumers residing in Puerto Rico or to a material aspect of your normal operations.
• Give the Commissioner as much as possible of the information the Rule lists, in electronic format as the Commissioner directs, including the date of the incident, how the information was disclosed, lost or stolen, how it was discovered, the source of the incident, the types of data involved, the period of compromise, the number of consumers in Puerto Rico affected, and a contact person, and update and supplement initial and later notifications.
• Comply with the Citizen Information on Data Banks Security Act, Act No. 111-2005, as applicable, and give the Commissioner a copy of the notice sent to consumers when you are required to notify the Commissioner.
• If the incident is in a system maintained by a service contractor, treat it as an incident of your own, with the notice deadline counted from the day after the contractor notifies you or you become aware of the incident, whichever occurs first.
• If you act as a reinsurer and the incident involves nonpublic information you use or hold and you have no direct contractual relationship with the affected consumers, notify the affected ceding insurers and the Commissioner of your state of domicile within 72 hours of determining that an incident occurred, or, for an incident at your service contractor, within 72 hours of receiving the contractor's notice.
• If you are an insurer or health service organization and your services reached the consumer through a producer or intermediary, notify the producer or intermediary of record of all affected consumers as soon as possible, unless you have no current information about the producer or intermediary for a consumer.
• Maintain records of all cybersecurity incidents for at least five years from the date of the incident, and submit them on the Commissioner's demand.

Rule No. 108, Cybersecurity Standards for the Insurance Industry, Sections 6 to 8, 11 and 13 · Read the law's page

• Applies to any person who holds a license or authorization to transact insurance business issued by the Office of the Commissioner of Insurance of Puerto Rico and who uses an Information System, which you declare by stating that you are an insurer; a licensee is a person that holds, or is required to hold, a license, authorization or certificate of authority under the Insurance Code of Puerto Rico, and the Rule excludes a purchasing group or risk control group established and licensed in another state, and a licensee acting as a reinsurer that is domiciled in another state or jurisdiction.
• Develop, implement, maintain and document a comprehensive written information security program, based on your risk assessment and commensurate with your size and complexity, the nature and scope of your activities including your use of service contractors, and the sensitivity of the nonpublic information you hold, containing administrative, technical and physical safeguards for nonpublic information and your information system.
• Conduct a risk assessment that designates who is responsible for the program, identifies reasonably foreseeable internal and external threats to nonpublic information, assesses their likelihood and potential damage, implements safeguards, and evaluates the effectiveness of key controls, systems and procedures at least once a year; if you have adopted artificial intelligence algorithms, programs or technology, evaluate the related policies and processes so that data the AI uses is accessed and processed securely.
• Implement the security measures your infrastructure, staff, operations and systems warrant, which include a formal cyber risk training program, effective access controls including multi-factor authentication, protection, by encryption or other appropriate means, of nonpublic information transmitted over an external network or stored on laptops and portable media, secure development practices, regular testing and monitoring of systems, audit logs, protection against environmental loss, secure disposal of nonpublic information, and regular vulnerability tests of your information systems.
• If you have a board of directors, have the board or a committee of it require executive management to develop, implement and maintain the program and to submit, at least once a year, a report for the board's approval and signature on the overall condition of the program and your compliance with the Rule.
• Perform due diligence in selecting each service contractor, and require by contract or service agreement that it implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access or holds.
• Establish a written incident response plan, as part of the program, that provides for a prompt response and recovery in the event of a cybersecurity incident.
• No later than June 30 of each year, if you are domiciled in Puerto Rico, submit to the Commissioner a written statement certifying that you comply with the program section, and keep for five years the records, forms and data on which the certification is based.
• A licensee with fifteen or fewer employees is exempt from the program section; a licensee that maintains a program under the HIPAA Security Rule, or that is an affiliate or subsidiary of a financial institution and maintains a program under section 501 of the Gramm-Leach-Bliley Act, is considered to meet the program section if it submits a written certification of compliance.