Law / United States / 
Alabama
Insurance Data Security Law: records of cybersecurity events kept five years and produced to the Commissioner
Insurance Data Security Law, Ala. Code sec. 27-62-5
In force.
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- As an insurance licensee, keep records concerning all cybersecurity events for at least five years from the date of each event, and produce those records when the Commissioner of Insurance demands them.
- When a cybersecurity event has or may have occurred in a system a third-party service provider maintains, complete the investigation steps in section 27-62-5(b) or confirm and document that the provider has completed them.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Log retention
Five years is a minimum, running from the date of the cybersecurity event; the section sets no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Section 27-62-5(e) requires a licensee to keep records concerning all cybersecurity events and to produce them on the Commissioner's demand. The section names no fields the records must hold. Subsection (d) separately has a licensee confirm and document that a third-party service provider has completed the investigation steps, and sets no period for that documentation.
- Kind
- Explicit
- As of
- Provision
- Ala. Code sec. 27-62-5(e)
- Trigger
- security_incident
What this law does
A licensee must maintain records concerning all cybersecurity events for at least five years from the date of each event and must produce those records upon demand of the Commissioner of Insurance. Where a cybersecurity event has or may have occurred in a system maintained by a third-party service provider, the licensee must complete the investigation steps in subsection (b) or confirm and document that the provider has completed them.
A licensee is a person licensed, authorized to operate, or registered, or required to be, under Alabama insurance law, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state.
When LexLint raises it
When your app profile says your app is an insurer.