Law / United States / 
Indiana
Insurance Data Security: licensee information security program and incident response plan
Indiana Insurance Data Security Law, Ind. Code secs. 27-2-27-16 to 27-2-27-20 and 27-2-27-26
In force since .
A sector security regimes rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a licensee, a person licensed, authorized to operate, or registered, or required to be, under Indiana's insurance title (reached by declaring that you are an insurer, reinsurer or insurance producer). A licensee with fewer than fifty employees, less than $5,000,000 in gross annual revenue, or less than $10,000,000 in year-end total assets is exempt from sections 16 through 20, a licensee governed by Health Insurance Portability and Accountability Act (HIPAA) that maintains a program under it is treated as meeting the chapter except for the notice requirements of section 21, and a licensee affiliated with a financial institution that keeps a program under the Gramm-Leach-Bliley Act interagency guidelines is treated as complying with sections 16 through 20 (section 26).
- Develop, implement, and maintain a comprehensive, written information security program, based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information systems (section 16).
- Conduct a risk assessment: designate who is responsible for the program, identify reasonably foreseeable internal and external threats including those at third party service providers, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of key controls, systems, and procedures at least once each year (section 17).
- Based on the risk assessment, design the program to mitigate the identified risks and determine and implement appropriate security measures, which may include access controls, encryption of nonpublic information sent over an external network or stored on portable devices, secure development practices for in-house applications, multi-factor authentication, regular testing and monitoring, audit trails, and secure disposal; include cybersecurity risks in enterprise risk management and provide cybersecurity awareness training (section 18).
- Establish a written incident response plan that addresses the internal response process, goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event (section 20).
- If you are an insurer domiciled in Indiana, submit a written statement to the commissioner certifying compliance by April 15 each year and keep the supporting records for five years (section 20(c)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
If a licensee violates the chapter, the insurance commissioner may, after notice and hearing, suspend or revoke the license, certificate of authority, or registration of the licensee.
What this law does
A licensee must develop, implement, and maintain a comprehensive, written information security program that is based on its risk assessment and contains administrative, technical, and physical safeguards for nonpublic information and its information systems. A licensee's risk assessment must include implementing information safeguards for the threats it identifies and assessing the effectiveness of their key controls, systems, and procedures at least one time each year.
A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event. Each insurer domiciled in Indiana must submit to the commissioner, not later than April 15 each year, a written statement certifying that it is in compliance with sections 16 through 20 of the chapter.
A licensee is exempt from sections 16 through 20 if it has fewer than fifty employees, less than five million dollars in gross annual revenue, or less than ten million dollars in year-end total assets. If a licensee violates the chapter, the insurance commissioner may, after notice and hearing, suspend or revoke the license, certificate of authority, or registration of the licensee. The chapter does not create a private right of action against any person. The chapter applies after .
When LexLint raises it
When your app profile says your app is an insurer.