Law / United States / 
Mississippi
Insurance Data Security Law, investigation and notification of a cybersecurity event
Insurance Data Security Law, sections 5 and 6, Senate Bill 2831 (2019)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to a licensee under Mississippi insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Mississippi, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
- Notify the Commissioner of Insurance as promptly as possible, and no later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Mississippi is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a consumer residing in Mississippi or any material part of your normal operations.
- Notify the Commissioner within the same three business days when you reasonably believe the nonpublic information involved is of 250 or more consumers residing in Mississippi and the event requires notice to a government body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer or a material part of your normal operations.
- Give the Commissioner as much as possible of the 13 listed items of information, in electronic form as directed, and keep updating and supplementing the notification as material changes occur.
- Conduct a prompt investigation when you learn that a cybersecurity event has or may have occurred, keep records of every cybersecurity event for at least five years, and produce them on the Commissioner's demand.
- Give the Commissioner a copy of the notice sent to consumers under the state's breach notification statute when you must notify the Commissioner.
- Treat a cybersecurity event in a system maintained by a third-party service provider as you would one in your own system, unless the provider gives the Commissioner the notice; the clock starts the day after the provider notifies you or you otherwise have actual knowledge.
- As an assuming insurer, notify your affected ceding insurers and the Commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred.
- As an insurer whose consumer accessed your services through an independent insurance producer, notify the producers of record of all affected consumers no later than the time consumer notice is given, when consumer notice is required.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Commissioner of Insurance, who may take action that is necessary or appropriate to enforce the Act when the Commissioner has reason to believe a licensee has violated it (section 7(2)).
What this law does
Each licensee shall notify the commissioner as promptly as possible but in no event later than three business days from a determination that a cybersecurity event involving nonpublic information in its possession has occurred, when either of two criteria is met.
The first criterion is that Mississippi is the licensee's state of domicile, in the case of an insurer, or home state, in the case of a producer, and the event has a reasonable likelihood of materially harming a consumer residing in Mississippi or any material part of the licensee's normal operations.
The second criterion is that the licensee reasonably believes the nonpublic information involved is of 250 or more consumers residing in Mississippi and the event requires notice to a government body, self-regulatory agency or other supervisory body, or has a reasonable likelihood of materially harming a consumer or a material part of the licensee's normal operations.
The licensee shall provide as much as possible of a list of 13 items of information, in electronic form as directed by the commissioner. The licensee has a continuing obligation to update and supplement initial and subsequent notifications to the commissioner regarding material changes to previously provided information.
A licensee that learns that a cybersecurity event has or may have occurred shall conduct a prompt investigation, or have an outside vendor or service provider designated to act on its behalf conduct one. The licensee shall maintain records concerning all cybersecurity events for at least five years from the date of the event and produce them upon demand of the commissioner.
The licensee shall provide the commissioner a copy of the notice sent to consumers under the state's breach notification statute when it is required to notify the commissioner. A licensee that becomes aware of a cybersecurity event in a system maintained by a third-party service provider shall treat the event as it would under the notification subsection unless the provider gives the commissioner the notice.
An assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three business days of determining that a cybersecurity event has occurred.
When LexLint raises it
When your app profile says your app is an insurer.