Law / United States / 
Delaware
Insurance Data Security Act: records of a cybersecurity event kept five years and produced to the Commissioner
Del. Code Ann. tit. 18, § 8605
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- As an insurance licensee, keep records concerning each cybersecurity event for at least 5 years from the date of the event, and produce those records when the Commissioner demands them.
- When a cybersecurity event has or may have occurred in a system a third-party service provider maintains, complete the investigation steps in section 8605(b) or make reasonable efforts to confirm and document that the provider has completed them.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Log retention
Five years is a minimum, running from the date of the cybersecurity event; the section sets no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Section 8605(d) requires a licensee to keep records concerning a cybersecurity event and to produce them on the Commissioner's demand. The section names no fields the records must hold. Subsection (c) separately has a licensee make reasonable efforts to confirm and document that a third-party service provider has completed the investigation steps, and sets no period for that documentation.
- Kind
- Explicit
- As of
- Provision
- 18 Del. C. § 8605(d)
- Trigger
- security_incident
What this law does
A licensee must maintain records concerning a cybersecurity event for at least 5 years from the date of the event and must produce those records upon the Commissioner's demand. Where a cybersecurity event has or may have occurred in a system a third-party service provider maintains, the licensee must complete the investigation steps in subsection (b) or make reasonable efforts to confirm and document that the provider has completed them.
A licensee is a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Delaware.
When LexLint raises it
When your app profile says your app is an insurer.