Law / United States / 
Colorado
Standards for Safeguarding Customer Information, written information security program for insurance licensees
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
What it requires
- Applies to a licensee under Colorado insurance law, which you declare by stating that you are an insurer: every licensed insurer, producer and other person licensed or required to be licensed, or authorized or required to be authorized, under the insurance laws of Colorado, other than a purchasing group or a nonadmitted insurer in regard to surplus lines business under article 5 of title 10.
- Implement a comprehensive written information security program that includes administrative, technical and physical safeguards for the protection of customer information, meaning nonpublic personal financial information and nonpublic personal health information about a customer, in paper, electronic or other form, maintained by or on behalf of you.
- Keep the safeguards appropriate to your size and complexity and the nature and scope of your activities.
- Design the program to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to its security or integrity, and to protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any customer.
- The regulation lists non-exclusive examples you may follow to meet these duties: assess the risk to customer information and your systems, train staff and regularly test or monitor your key controls, exercise due diligence in selecting service providers and require them to implement appropriate measures designed to meet the regulation's objectives, and adjust the program as technology, threats and your business arrangements change.
These lines are LexLint's reading of the law's text.
What this law does
Colorado Division of Insurance Regulation 6-4-2 requires each licensee to implement a comprehensive written information security program that includes administrative, technical and physical safeguards for the protection of customer information. The safeguards must be appropriate to the size and complexity of the licensee and the nature and scope of its activities.
A licensee is every licensed insurer, producer and other person licensed or required to be licensed, or authorized or required to be authorized, under the insurance laws of Colorado, other than a purchasing group or a nonadmitted insurer in regard to surplus lines business under article 5 of title 10.
Customer information is nonpublic personal financial information and nonpublic personal health information about a customer, in paper, electronic or other form, that is maintained by or on behalf of the licensee.
The program must be designed to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer. Section 7 of the regulation gives non-exclusive examples of how a licensee may implement sections 5 and 6.
Among those examples, a licensee requires its service providers to implement appropriate measures designed to meet the objectives of the regulation. Noncompliance may result in any of the sanctions available under the Colorado statutes pertaining to the business of insurance, which include civil penalties, cease and desist orders, and suspension or revocation of license. The regulation implements sections 501, 505(b) and 507 of the Gramm-Leach-Bliley Act. The regulation took effect on , and the amended regulation took effect on .
When LexLint raises it
When your app profile says your app is an insurer.
Back to the example · Lint your app
Page updated .