Law / United States / 
Iowa
Insurance Data Security Act: records of a cybersecurity event investigation kept five years and produced to the commissioner
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- As an insurance licensee, keep all records and documentation related to your investigation of a cybersecurity event for at least five years from the date of the event, and produce them when the commissioner demands them.
- When a cybersecurity event has or may have occurred in an information system a third-party service provider maintains, complete an investigation under section 507F.6 or confirm and document that the provider has completed one.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Log retention
Five years is a minimum, running from the date of the cybersecurity event; the section sets no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Section 507F.6(4) requires a licensee to keep all records and documentation related to its investigation of a cybersecurity event and to produce them on the commissioner's demand. The subsection names no fields the records must hold. Two other record clauses of the chapter sit outside this row: section 507F.4(4)(b)(9) lists audit trails among the security measures a licensee implements where its risk assessment finds them appropriate, and section 507F.4(8) has an insurer domiciled in Iowa keep the records supporting its annual certification for five years.
- Kind
- Explicit
- As of
- Provision
- Iowa Code 507F.6(4)
- Trigger
- security_incident
What this law does
A licensee must maintain all records and documentation related to its investigation of a cybersecurity event for a minimum of five years from the date of the event and must produce them upon demand of the commissioner. Where a cybersecurity event has or may have occurred in an information system maintained by a third-party service provider, the licensee must complete an investigation or confirm and document that the provider has completed one.
A licensee is a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Iowa.
When LexLint raises it
When your app profile says your app is an insurer.