Law / United States / 
Mississippi
Insurance Data Security Law, licensee information security program and annual certification
Insurance Data Security Law, sections 4 and 9, Senate Bill 2831 (2019)
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a licensee under Mississippi insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Mississippi, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
- Develop, implement and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, sized to your size and complexity, the nature and scope of your activities, your use of third-party service providers and the sensitivity of the information.
- Designate one or more employees, an affiliate or an outside vendor to be responsible for the program, identify reasonably foreseeable internal and external threats, and no less than annually assess the effectiveness of the safeguards' key controls, systems and procedures.
- Determine which of the listed security measures are appropriate for your risk assessment and implement them, including access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, multi-factor authentication where appropriate, testing and monitoring, audit trails, and secure disposal; include cybersecurity risks in your enterprise risk management and train your personnel.
- Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, your information systems or the continuing functionality of your business.
- Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access; licensees have two years from to implement this requirement and one year to implement the rest of the program section.
- If you have a board of directors, the board or an appropriate committee must require executive management to develop, implement and maintain the program and to report in writing at least annually on its status, your compliance and material matters.
- If you are an insurer domiciled in Mississippi, submit to the Commissioner of Insurance by February 15 each year a written statement certifying compliance with the program section, and keep the supporting records for five years.
- You are exempt from the program section if you have fewer than 50 employees, less than $5,000,000 in gross annual revenue or less than $10,000,000 in year-end total assets, or if you are an insurance producer or adjuster; a licensee that maintains a Health Insurance Portability and Accountability Act (HIPAA) information security program and certifies compliance in writing, or is affiliated with a depository institution that meets the Interagency Guidelines, is considered to meet the program section.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Commissioner of Insurance, who may take action that is necessary or appropriate to enforce the Act when the Commissioner has reason to believe a licensee has violated it (section 7(2)).
What this law does
The Insurance Data Security Law defines a licensee as any person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Mississippi, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
Each licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment, with administrative, technical and physical safeguards for nonpublic information and the licensee's information system.
Each licensee shall establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, the licensee's information systems, or the continuing functionality of its business.
Each insurer domiciled in Mississippi shall submit to the commissioner by February 15 each year a written statement certifying that it complies with the information security program section. A licensee with fewer than fifty employees, less than five million dollars in gross annual revenue, or less than ten million dollars in year-end total assets, and insurance producers and adjusters, are exempt from the program section.
Licensees have one year from the effective date to implement the program section and two years to implement its third-party service provider provisions. The Act takes effect . A licensee that violates the Act may be penalized in accordance with section 83-5-85.
When LexLint raises it
When your app profile says your app is an insurer.