Law / United States / 
Missouri
Insurance Data Security Act: licensee information security program, investigation of a cybersecurity event and incident response plan
Insurance Data Security Act, Mo. Rev. Stat. secs. 375.1405, 375.1407 and 375.1417
In force since .
A sector security regimes rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a licensee, a person licensed, authorized to operate, or registered, or required to be, under Missouri's insurance laws (reached by declaring that you are an insurer, reinsurer or insurance producer). A licensee has until to implement section 375.1405, and until to implement the third-party service provider duty in its subsection 6 (section 375.1427). A licensee with fewer than ten employees is exempt from section 375.1405, a producer with fewer than fifty employees, less than $5,000,000 in gross annual revenue, or less than $10,000,000 in year-end total assets is exempt from the Act, and a licensee affiliated with a depository institution that maintains a program under the Gramm-Leach-Bliley Act interagency guidelines is considered to meet section 375.1405 if it can document that on request (section 375.1417).
- Develop, implement, and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information system (section 375.1405.1).
- Conduct a risk assessment: designate who is responsible for the program, identify reasonably foreseeable internal and external threats including those at third-party service providers, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of key controls, systems, and procedures at least annually (section 375.1405.3).
- Determine which of the listed security measures are appropriate and implement them, including access controls, encryption of nonpublic information sent over an external network or stored on portable devices, secure development practices, effective controls that may include multifactor authentication, regular testing and monitoring, audit trails, and secure disposal; include cybersecurity risks in enterprise risk management and provide cybersecurity awareness training (section 375.1405.4).
- Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information it can reach (section 375.1405.6).
- Establish a written incident response plan that addresses the internal response process, goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event (section 375.1405.8).
- If you are an insurer domiciled in Missouri, submit a written statement to the director certifying compliance by April 15 each year and keep the supporting records for five years (section 375.1405.9).
- When you learn that a cybersecurity event has or may have occurred, promptly investigate it, determine its nature and scope and the nonpublic information involved, restore the security of the compromised systems, and keep records of all cybersecurity events for at least three years and produce them on the director's demand (section 375.1407).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The director has power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in conduct in violation of the Act.
Settledness
- As of
- Open questions
- Does the program duty in section 375.1405 first bind a licensee on the Act's effective date or on the implementation date in section 375.1427?
What this law does
Each licensee must develop, implement, and maintain a comprehensive written information security program that is based on its risk assessment and contains administrative, technical, and physical safeguards for nonpublic information and its information system. Each licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information.
If a licensee learns that a cybersecurity event has or may have occurred, the licensee, or an outside vendor or service provider designated to act on its behalf, must conduct a prompt investigation. A licensee must maintain records concerning all cybersecurity events for a period of at least three years from the date of the cybersecurity event.
Each insurer domiciled in Missouri must submit to the director by April fifteenth each year a written statement certifying that it is in compliance with section 375.1405. Licensees have until to implement section 375.1405 and until to implement its third-party service provider duty in subsection 6. A licensee with fewer than ten employees, including any independent contractors, is exempt from section 375.1405.
The Insurance Data Security Act takes effect on . In the Act, a person means any individual or any nongovernmental entity, including a nongovernmental partnership, corporation, branch, agency, or association.
When LexLint raises it
When your app profile says your app is an insurer.