Law / United States / 
Delaware
Insurance Data Security Act, information security program and investigation of a cybersecurity event
Del. Code Ann. tit. 18, §§ 8604, 8605
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- Applies to a licensee under the Delaware Insurance Code, which you declare by stating that you are an insurer: a person who is licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, under the insurance laws of Delaware, other than a purchasing group or risk retention group chartered and licensed in another state and a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
- Develop, implement, and maintain a comprehensive, written information security program that is based on your risk assessment and contains administrative, technical, and physical safeguards for nonpublic information and your information system, commensurate with your size and complexity, the nature and scope of your activities, including your use of a third-party service provider, and the sensitivity of the nonpublic information.
- Designate one or more employees, an affiliate, or an outside vendor to manage and oversee the program, identify reasonably foreseeable internal and external threats, including threats to nonpublic information held by a third-party service provider, assess their likelihood and potential damage and the sufficiency of your safeguards, and at least annually assess the effectiveness of the key controls, systems, and procedures of your safeguards.
- Determine whether each security measure listed in section 8604(d)(2) is appropriate and implement each one that is: access controls on information systems, restricted physical access, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices for applications built in-house and procedures for evaluating or testing externally developed applications, effective authentication controls that may include multi-factor authentication, regular testing and monitoring, audit controls, protection against environmental hazards, and secure disposal of nonpublic information in any format.
- Include cybersecurity risks in your enterprise risk management process, stay informed regarding emerging threats or vulnerabilities, and give your personnel cybersecurity awareness training that is updated to reflect the risks identified in your risk assessment.
- If you have a board of directors, have the board or an appropriate committee require executive management or its delegates to develop, implement, and maintain the program and to report in writing at least annually on the overall status of the program, your compliance with the chapter, and material matters such as risk assessment, third-party service provider arrangements, testing results, and cybersecurity events.
- Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information system and nonpublic information it has access to or holds; the section 8604(f) duty took effect 2 years after the Act's effective date.
- Monitor, evaluate, and adjust the program consistent with relevant changes in technology, the sensitivity of your nonpublic information, internal or external threats, and your own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to information systems.
- Establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity, or availability of your nonpublic information, your information system, or the continuing functionality of any aspect of your business or operations, covering the internal response process, goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event.
- If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation, or have an outside vendor or service provider designated to act on your behalf conduct one: determine whether an event occurred, assess its nature and scope, identify the nonpublic information involved, and perform or oversee reasonable measures to restore the security of the compromised information system.
- Keep records concerning a cybersecurity event for at least 5 years from the date of the event and produce them on the Commissioner's demand.
- If you are an insurer domiciled in Delaware, submit a written statement to the Commissioner by February 15 each year certifying that you comply with section 8604, keep the supporting records, schedules, and data for 5 years, and document any area, system, or process that requires material improvement together with the remedial effort planned and underway, available for the Commissioner's inspection.
- A licensee with fewer than 15 employees is exempt from section 8604, and a licensee covered by the federal health privacy law that has established and maintains an information security program under it is considered to meet section 8604 if it is compliant and submits a written statement certifying its compliance; a licensee that ceases to qualify for an exception has 180 days to comply.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 8610 makes a licensee that violates the chapter subject to penalties under section 329 of title 18. Under section 329 the Commissioner may, after notice and hearing, impose an administrative penalty that is reasonable and appropriate, not exceeding $50,000 per violation for insurance companies, insurance holding companies and all other persons licensed under the title, and $15,000 per violation for those licensed under chapter 17.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
Who enforces it
Enforcement body
Insurance Commissioner of Delaware, who may examine and investigate a licensee and take necessary or appropriate action to enforce the chapter (18 Del. C. section 8607).
What this law does
A licensee must develop, implement, and maintain a comprehensive, written information security program that is based on its risk assessment and contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.
A licensee is a person who is licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, under the insurance laws of Delaware, other than a purchasing group or risk retention group chartered and licensed in another state and a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
A licensee must establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity, or availability of its nonpublic information, its information system, or the continuing functionality of any aspect of its business or operations.
A licensee that learns a cybersecurity event has or may have occurred must conduct a prompt investigation, or have an outside vendor or service provider designated to act on its behalf conduct one. An insurer domiciled in Delaware must submit annually to the Commissioner a written statement, by February 15, certifying that the insurer complies with section 8604. A licensee with fewer than 15 employees is exempt from section 8604.
A licensee that is subject to the federal health privacy law and maintains an information security program under it is considered to meet section 8604 if it is compliant and submits a written statement certifying its compliance. A licensee that violates the chapter may be subject to penalties under section 329 of title 18 of the Delaware Code.
The Insurance Commissioner may impose an administrative penalty of up to $50,000 per violation on an insurance company, an insurance holding company or another person licensed under title 18 of the Delaware Code. The Act took effect on enactment, , and a licensee had 1 year from that date to implement section 8604 and 2 years from that date to implement section 8604(f).
When LexLint raises it
When your app profile says your app is an insurer.