Law / United States / 
Illinois
Insurance Data Security Law, information security program
Insurance Data Security Law, 215 ILCS 215/10
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a licensee under Illinois insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Illinois, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
- Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, commensurate with your size, your activities, your use of third-party service providers and the sensitivity of the information.
- Select and implement appropriate security measures from the set the law lists, which includes access controls, encryption of nonpublic information in transit over an external network and on portable devices, multifactor authentication for any individual accessing nonpublic information, regular testing and monitoring of systems, and audit trails.
- Establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information.
- Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it holds; this duty has applied since .
- If you are an insurer domiciled in Illinois, submit to the Director a written statement by April 15 each year certifying that you comply with section 10, and keep the supporting records for 5 years.
- A licensee with fewer than 50 employees, including independent contractors, is exempt from section 10, and a licensee compliant with the federal health privacy, security and breach notification rules that maintains nonpublic information in the same manner as protected health information is treated as meeting section 10 if it submits an annual statement by April 15.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Director of Insurance, who may take any action necessary or appropriate to enforce the Act when the Director has reason to believe a licensee has violated it (section 25(b)).
What this law does
Section 10 of the Insurance Data Security Law requires each licensee to develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.
A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered pursuant to the insurance laws of Illinois, and the term excludes a purchasing group or a risk retention group chartered and licensed in another state and a licensee that is acting as an assuming insurer that is domiciled in another state or jurisdiction.
A licensee must select and implement appropriate security measures from a listed set that includes protecting, by encryption or other appropriate means, all nonpublic information while being transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media.
The listed measures also include utilizing effective controls, including multifactor authentication procedures, for any individual accessing nonpublic information.
A licensee must establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, its information systems, or the continuing functionality of any aspect of its business or operations.
A licensee must exercise due diligence in selecting its third-party service provider and require the provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to or held by the provider. An insurer domiciled in Illinois must submit to the Director by April 15 each year a written statement certifying that the insurer is in compliance with the requirements of section 10.
Licensees must comply with subsection (f) 2 years after the effective date of the Act, and with all other subsections of section 10 one year after the effective date of the Act. The Act takes effect . A licensee with fewer than 50 employees, including any independent contractors, is exempt from section 10. A violation of the Act may be penalized in accordance with the provisions of the Illinois Insurance Code, including Section 403A of the Illinois Insurance Code. The Act does not create or imply a private cause of action for a violation of its provisions.
When LexLint raises it
When your app profile says your app is an insurer.