Law / United States / 
Alaska
Insurance Data Security, licensee risk assessment and information security program
Alaska Stat. secs. 21.23.250 and 21.23.260 (Insurance Data Security)
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a licensee of the Alaska Division of Insurance, which you declare by stating that you are an insurer: a person licensed, authorized to operate, or registered, or required to be licensed, authorized or registered, under Title 21 of the Alaska Statutes, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction. A licensee with fewer than 10 employees, including independent contractors, is outside the risk assessment and program duties, as is a licensee that is an employee, agent, representative or designee of another licensee covered by an information security program, and a licensee subject to the Health Insurance Portability and Accountability Act of 1996 that maintains and complies with a program under that Act and certifies this in writing to the director is outside the article.
- From , conduct a risk assessment commensurate with your size and complexity and the nature and scope of your activities: identify reasonably foreseeable internal and external threats to nonpublic information, including information held by third-party service providers, assess their likelihood and potential damage, and assess the sufficiency of your policies, procedures, information systems and other safeguards in each area of your operations.
- From , develop, implement and maintain a comprehensive written information security program based on the risk assessment, with administrative, technical and physical safeguards, a schedule for retaining nonpublic information and a mechanism for destroying it when no longer needed, and designate an employee, an outside vendor or a third-party service provider as the person responsible for the program.
- Based on the risk assessment, implement each security measure you determine is appropriate from those the law lists, which include access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information; include cybersecurity risks in your enterprise risk management process; and give your personnel cybersecurity awareness training that is updated to reflect the risks you identify.
- Require a third-party service provider that has access to or holds nonpublic information to notify you as soon as possible, and not later than 10 business days, after it determines that it has experienced a cybersecurity event involving nonpublic information associated with a consumer.
- From , exercise due diligence in selecting a third-party service provider and, where appropriate, require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access or holds.
- Establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, the licensee's information systems or the continuing functionality of an aspect of your business, covering the internal response process, goals, roles and decision-making authority, communications, remediation of identified weaknesses, documentation and reporting, and revision of the plan after an event.
- Have your board of directors or an appropriate committee require executive management to develop, implement and maintain the program, and have executive management report to it in writing at least once a year on the overall status of the program and your compliance and on material matters such as risk assessment, third-party service provider arrangements, test results and cybersecurity events.
- If you are an insurer domiciled in Alaska, submit to the director by February 15 of each year a written statement certifying that you comply with the risk assessment and program duties, keep the supporting records for five years after the statement, and document the areas you have identified as needing material improvement and the remedial efforts planned and under way.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
AS 21.27.440(a) lets the director impose a civil penalty of not more than $10,000 for each violation, or not more than $25,000 for each violation found wilful, in addition to a civil penalty equal to the compensation promised, paid or to be paid for the violation and denial, nonrenewal, suspension or revocation of a license. The $25,000 figure is the higher tier.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 25,000
Who enforces it
Enforcement body
The director, who may take necessary or appropriate action to enforce the article (AS 21.23.310(a)).
What this law does
A licensee must conduct a risk assessment commensurate with its size and complexity and the nature and scope of its activities, to evaluate the security and confidentiality of the nonpublic information it uses or controls. A licensee must develop, implement and maintain a comprehensive written information security program based on that risk assessment.
The program must contain administrative, technical and physical safeguards to protect the security and confidentiality of nonpublic information and the security of the licensee's information system. A licensee must establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession or its information systems.
A licensee must require a third-party service provider that has access to or holds nonpublic information to notify the licensee as soon as possible, and not later than 10 business days, after determining that the provider has experienced a cybersecurity event involving nonpublic information associated with a consumer.
The duties to exercise due diligence in selecting a third-party service provider and to require it to protect the information systems and nonpublic information it can access, AS 21.23.260(c)(7) and (8), take effect . A licensee that is an insurer domiciled in Alaska must submit to the director by February 15 of each year a written statement certifying that the insurer complies with AS 21.23.250 and 21.23.260.
AS 21.23.250 and 21.23.260 do not apply to a licensee, including an independent contractor, with fewer than 10 employees. The article does not apply to a licensee subject to the Health Insurance Portability and Accountability Act of 1996 that maintains and complies with a program under that Act and certifies this to the director in writing. A person who violates the article is subject to the penalties provided under AS 21.27.440.
When LexLint raises it
When your app profile says your app is an insurer.