Law / United States / 
Kentucky
Insurance Data Security Law: licensee investigation of a cybersecurity event and five-year record of events
In force since .
A breach notification rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Investigate promptly, as an insurance licensee, any cybersecurity event that has or may have occurred, including determining whether an event has occurred, its nature and scope, and the nonpublic information involved.
- Keep records concerning all cybersecurity events for at least five years from the date of each event, and produce them on the demand of the Commissioner of Insurance.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Log retention
Five years from the date of the cybersecurity event is a minimum for the licensee's records concerning all cybersecurity events; the section states no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Each licensee must maintain records concerning all cybersecurity events for at least five years from the date of the event and produce them upon demand of the commissioner (304.3-758(3)). The investigation duty in subsection (1) lists what a prompt investigation must determine, assess and identify, and subsection (2) has the licensee complete, or confirm and document that a third-party service provider has completed, those steps, but the section names no field the records must hold. The section has no scope clause: the licensee's domicile or home state and the consumers residing in the state are in the notice section, KRS 304.3-760, and the definitions, which this row does not cite.
- Kind
- Explicit
- As of
- Provision
- KRS 304.3-758(3)
- Trigger
- security_incident
What this law does
A licensee that learns a cybersecurity event has or may have occurred must conduct, or have a designated outside vendor or service provider conduct, a prompt investigation that at a minimum determines whether an event has occurred, assesses its nature and scope, identifies the nonpublic information involved and performs or oversees reasonable measures to restore the security of the compromised systems.
Where the event occurred in a system maintained by a third-party service provider, the licensee must complete, or confirm and document that the provider has completed, those steps. Each licensee must maintain, and produce upon demand of the commissioner, records concerning all cybersecurity events for a period of at least five years from the date of the event.
When LexLint raises it
When your app profile says your app is an insurer.