Law / United States / 
Michigan
Michigan Insurance Data Security Act, information security program
Insurance Data Security Program, MCL 500.555 and 500.565
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds every licensee under Michigan's Insurance Code, a licensed insurer or producer or other person licensed, authorized or registered under it (reached by declaring that you are an insurer); a licensee with fewer than 25 employees, including independent contractors, is exempt from this program duty (sections 500.553(g) and 500.565(1)).
- Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, sized to your size and complexity, activities and the sensitivity of the information (section 500.555(1) and (2)).
- Designate the employees, affiliate or outside vendor responsible for the program, identify reasonably foreseeable internal and external threats, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of your key controls, systems and procedures at least annually (section 500.555(3)).
- Based on that risk assessment, determine which of the listed security measures are appropriate and implement them: access controls, encryption of nonpublic information in transit over an external network and on portable devices, secure development practices, effective controls that may include multi-factor authentication, testing and monitoring, audit trails and secure disposal, and give your personnel cybersecurity awareness training (section 500.555(4)).
- If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement and maintain the program and report to it in writing at least annually (section 500.555(5)).
- Exercise due diligence in selecting each third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can reach; you have until to implement this duty (sections 500.555(6) and 500.565(5)).
- Monitor, evaluate and adjust the program for changes in technology, the sensitivity of your nonpublic information, threats, and your own business arrangements (section 500.555(7)).
- Establish a written incident response plan that covers the internal response process, its goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision of the plan after a cybersecurity event (section 500.555(8)).
- If you are an insurer domiciled in Michigan, submit to the director by February 15 each year a written statement certifying your compliance with section 555, and keep the supporting records for 5 years (section 500.555(9)).
- Implement section 555 by (section 500.565(5)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The director under the Insurance Code, to whom a licensee must produce its records of cybersecurity events on demand.
What this law does
Section 555 of the Insurance Code requires each licensee to develop, implement, and maintain a comprehensive written information security program, based on its risk assessment, that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.
A licensee is a licensed insurer or producer, and other persons licensed or required to be licensed, authorized, or registered, or holding or required to hold a certificate of authority under the Insurance Code. A licensee must exercise due diligence in selecting its third-party service provider and must require the provider to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information it can reach.
Each licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, its information systems, or the continuing functionality of any aspect of its business or operations.
By February 15 of each year, each insurer domiciled in Michigan must submit to the director a written statement certifying that the insurer is in compliance with section 555. A licensee that has fewer than 25 employees, including any independent contractors, is exempt from section 555.
A licensee subject to and in compliance with the federal health insurance portability and accountability act of 1996 is not required to comply with the chapter except for the requirements under sections 559 and 561. The chapter took effect on , a licensee had to implement section 555 by , and a licensee had until to implement section 555(6). The chapter does not create or imply a private cause of action for violation of its provisions.
When LexLint raises it
When your app profile says your app is an insurer.