Law / United States / 
Louisiana
Insurance Data Security Law: records of cybersecurity events kept five years and produced to the commissioner
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- As an insurance licensee, keep records concerning all cybersecurity events for at least five years from the date of each event, and produce those records when the commissioner demands them.
- When a cybersecurity event has or may have occurred in a system a third-party service provider maintains, make reasonable efforts to complete the investigation steps in R.S. 22:2505(B) or to confirm and document that the provider has completed them.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Log retention
Five years is a minimum, running from the date of the cybersecurity event; the section sets no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Section 2505(D) requires a licensee to keep records concerning all cybersecurity events and to produce them on the commissioner's demand. The subsection names no fields the records must hold. Subsection (C) separately has a licensee make reasonable efforts to confirm and document that a third-party service provider has completed the investigation steps, and sets no period for that documentation.
- Kind
- Explicit
- As of
- Provision
- La. R.S. 22:2505(D)
- Trigger
- security_incident
What this law does
A licensee must maintain records concerning all cybersecurity events for at least five years from the date of each event and must produce those records upon demand of the commissioner. Where a cybersecurity event has or may have occurred in a system maintained by a third-party service provider, the licensee must make reasonable efforts to complete the investigation steps in Subsection B or to confirm and document that the provider has completed them.
A licensee is any person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Louisiana.
When LexLint raises it
When your app profile says your app is an insurer.