Law / United States / 
Mississippi
Insurance Data Security Law: audit trails, supporting records and cybersecurity event records
Miss. Code Ann. §§ 83-5-801 to 83-5-825, SB 2831 §§ 4, 5
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- If you are a licensee under the Mississippi insurance laws, maintain records concerning all cybersecurity events for at least five years from the date of each event (section 5(4)).
- Produce those cybersecurity event records upon the Commissioner of Insurance's demand (section 5(4)).
- If you are an insurer domiciled in Mississippi, maintain for examination by the department all records, schedules and data supporting your annual certificate for five years (section 4(9)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Mississippi Commissioner of Insurance, who may examine and investigate a licensee and take action necessary or appropriate to enforce the act (section 7).
What it makes you log
Who may demand the log
Regulator
Log retention
Section 5(4) sets at least five years from the date of the cybersecurity event; section 4(9) sets five years for the records supporting the annual certificate. Neither states a maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Section 5(4) requires a licensee to maintain records concerning all cybersecurity events for at least five years from the date of the event and to produce them upon the Commissioner's demand. Section 4(9) separately has an insurer keep the records, schedules and data supporting its annual certificate for five years for examination by the department, and section 4(4)(b)(ix) lists audit trails among the security measures a licensee implements where appropriate. The clauses name no field of the record from the closed list. Section 9(1)(a) exempts a licensee meeting its size criteria, and every insurance producer and adjuster, from sections 4, 5(3) and 6(4)(a) and (b), and it does not name section 5(4). The Commissioner's examination power is in section 7.
- Kind
- Explicit
- As of
- Provision
- SB 2831 (2019) sec. 5(4), records of all cybersecurity events, with sec. 4(9) (supporting records of the annual certificate) and sec. 4(4)(b)(ix) (audit trails)
- Trigger
- security_incident
What this law does
Section 5(4) requires a licensee to maintain records concerning all cybersecurity events for a period of at least five years from the date of the cybersecurity event. The licensee must produce those records upon demand of the commissioner. Section 4(9) requires each insurer domiciled in this state to submit to the commissioner an annual written statement by February 15.
Section 4(9) also requires each insurer to maintain for examination by the department all records, schedules and data supporting the certificate for a period of five years. Section 4(4)(b)(ix) includes audit trails within the information security program, designed to detect and respond to cybersecurity events and to reconstruct material financial transactions sufficient to support normal operations and obligations of the licensee.
A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized or registered, under the insurance laws of Mississippi. The commissioner has power to examine and investigate into the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of the act. Section 9(1)(a) exempts a licensee meeting listed size criteria from sections 4, 5(3) and 6(4)(a) and (b) of the act. A violation of the act may be penalized in accordance with section 83-5-85. The act takes effect .
When LexLint raises it
When your app profile says your app is an insurer.