Law / United States / 
Michigan
Insurance Data Security Act: records of cybersecurity events kept five years and produced to the director
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- As an insurance licensee, keep records concerning all cybersecurity events for at least 5 years from the date of each event, and produce those records when the director demands them.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Log retention
Five years is a minimum, running from the date of the cybersecurity event; the section sets no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Section 557(3) requires a licensee to keep records concerning all cybersecurity events and to produce them on demand of the director. The subsection names no fields the records must hold. Section 555(9), which this row does not cite, separately has an insurer domiciled in the state keep the records supporting its annual compliance certificate for 5 years.
- Kind
- Explicit
- As of
- Provision
- MCL 500.557(3)
- Trigger
- security_incident
What this law does
A licensee must maintain records concerning all cybersecurity events for at least 5 years from the date of the cybersecurity event and must produce those records on demand of the director. Section 557 was added by 2018 Act 690, effective . A licensee is a licensed insurer or producer, or another person licensed or required to be licensed, authorized, or registered, or holding or required to hold a certificate of authority, under the Insurance Data Security Act.
When LexLint raises it
When your app profile says your app is an insurer.