Is an insurer, in South Carolina

Insurance Data Security Act cybersecurity event notice, S.C. Code Ann. secs. 38-99-30 and 38-99-40 · Read the law's page

• Applies to a licensee under South Carolina insurance law, which you declare by stating that you are an insurer: a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of South Carolina, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
• Notify the director of the Department of Insurance no later than seventy-two hours after you determine that a cybersecurity event has occurred, when South Carolina is your state of domicile (insurer) or your home state (producer).
• Give the same notice within seventy-two hours when you reasonably believe the nonpublic information involved is of no less than two hundred and fifty consumers residing in South Carolina and the event requires notice to a governmental body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer residing in South Carolina or a material part of your normal operations.
• Provide the director, in electronic form as the director directs, as much as possible of the 13 listed items, from the date of the event and how the information was exposed to the number of consumers affected, your remediation efforts, a copy of your privacy policy, and a contact person, and keep updating and supplementing the notification.
• Provide the director a copy of the notice sent to consumers when you are required to notify the director.
• Treat a cybersecurity event in a system maintained by a third-party service provider as you would under the notice duty, counting your deadlines from the day after the provider notifies you or you otherwise have actual knowledge, whichever is sooner.
• As an assuming insurer that does not have a direct contractual relationship with the affected consumers, notify your affected ceding insurers and the director of your state of domicile within seventy-two hours of determining that a cybersecurity event has occurred; as an insurer whose consumers accessed your services through an independent producer, notify the producers of record of affected consumers as soon as practicable as the director directs.
• Conduct a prompt investigation when you learn that a cybersecurity event has occurred or may have occurred, and keep records concerning all cybersecurity events for at least five years from the date of the event, producing them on the director's demand.

Insurance Data Security Act information security program, S.C. Code Ann. sec. 38-99-20 · Read the law's page

• Applies to a licensee under South Carolina insurance law, which you declare by stating that you are an insurer: a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of South Carolina, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
• Develop, implement, and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information system, in proportion to your size and complexity, the nature and scope of your activities, and the sensitivity of the nonpublic information.
• Designate one or more employees, an affiliate, or an outside vendor as responsible for the program, identify and assess reasonably foreseeable internal and external threats, and at least annually assess the effectiveness of the key controls, systems, and procedures of your safeguards.
• Determine the appropriateness of, and implement, security measures including access controls, restricted physical access, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, multifactor authentication where effective, regular testing and monitoring, audit trails, and secure disposal of nonpublic information.
• Include cybersecurity risks in your enterprise risk management process, stay informed of emerging threats and vulnerabilities, and give personnel cybersecurity awareness training that is updated to reflect the risks identified in your risk assessment.
• Establish a written incident response plan to promptly respond to and recover from a cybersecurity event, covering its goals, the internal response process, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event.
• Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information it holds or can access; this has applied since July 1, 2020.
• If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement, and maintain the program and to report in writing at least annually on its status, your compliance, and material matters.
• If you are an insurer domiciled in South Carolina, submit to the director by February 15 each year a written statement certifying that you comply with section 38-99-20, and keep the supporting records for five years.
• A licensee with fewer than ten employees, including independent contractors, is exempt from section 38-99-20, as is a licensee covered by another licensee's program and a licensee subject to HIPAA that maintains a program under it and submits a written statement certifying its compliance with section 38-99-20; a licensee that stops qualifying has one hundred and eighty days to comply.