Law / United States / 
North Dakota
Insurance Data Security Law, information security program
N.D. Cent. Code § 26.1-02.2-03
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- Applies to a licensee under North Dakota insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate, registered, or required to be licensed, authorized, or registered under the insurance laws of North Dakota, other than a purchasing group or a risk retention group chartered and licensed in another state or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
- Develop, implement, and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information system, commensurate with your size and complexity, the nature and scope of your activities, including your use of third-party service providers, and the sensitivity of the nonpublic information.
- Designate one or more employees, an affiliate, or an outside vendor as responsible for the program, identify reasonably foreseeable internal or external threats, including those to nonpublic information held by third-party service providers, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of the key controls, systems, and procedures of your safeguards annually.
- Determine which of the security measures in section 26.1-02.2-03(4)(b) are appropriate and implement them: access controls, restricted physical access, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices for in-house applications, effective controls that may include multi-factor authentication, regular testing and monitoring, audit trails, protection against environmental hazards, and secure disposal of nonpublic information in any format.
- Include cybersecurity risks in your enterprise risk management process, stay informed regarding emerging threats or vulnerabilities, and give your personnel cybersecurity awareness training that is updated to reflect the risks identified in your risk assessment.
- If you have a board of directors, have the board or an appropriate committee require executive management or its delegates to develop, implement, and maintain the program and to report in writing annually on the status of the program, your compliance, and material matters, including risk assessment, third-party service provider arrangements, results of testing, and cybersecurity events.
- Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information accessible to, or held by, the provider, and monitor, evaluate, and adjust the program as technology, the sensitivity of your nonpublic information, threats, and your business arrangements change.
- Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in your possession, including your plan to recover your information systems and restore continuous functionality, and address the internal response process, goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event.
- If you are an insurer domiciled in North Dakota, submit to the commissioner by April fifteenth each year a written statement certifying that you comply with section 26.1-02.2-03, keep the supporting records, schedules, and data for five years, and document any area, system, or process that requires material improvement together with the remedial effort planned and underway.
- A licensee with less than five million dollars in gross revenue or less than ten million dollars in year-end assets is exempt from subsections 2 through 10 of section 26.1-02.2-03, and a licensee that is subject to, governed by, and compliant with the federal health privacy, security, and breach notification rules and maintains nonpublic information in the same manner as protected health information is deemed to comply; a licensee that ceases to qualify for an exception has one hundred eighty days to comply.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 26.1-02.2-09 makes a licensee that violates the chapter subject to penalty in accordance with section 26.1-01-03.3, under which the commissioner may, after hearing, impose an administrative monetary fine of up to ten thousand dollars for each violation, and may in addition or instead require restitution of direct financial loss.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Insurance Commissioner of North Dakota, who may examine and investigate the affairs of any licensee and, on reason to believe a licensee has violated the chapter, take action that is necessary or appropriate to enforce it (N.D. Cent. Code section 26.1-02.2-06).
What this law does
Each licensee must develop, implement, and maintain a comprehensive written information security program based on its risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.
A licensee is any person licensed, authorized to operate, registered, or required to be licensed, authorized, or registered under the insurance laws of North Dakota, other than a purchasing group or a risk retention group chartered and licensed in another state or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession. An insurer domiciled in North Dakota must submit annually to the commissioner a written statement, by April fifteenth, certifying that the insurer complies with the information security program section.
A licensee with less than five million dollars in gross revenue or less than ten million dollars in year-end assets is exempt from subsections 2 through 10 of the information security program section. A licensee that is subject to, governed by, and compliant with the federal health privacy, security, and breach notification rules and maintains nonpublic information in the same manner as protected health information is deemed to comply with the information security program section.
A licensee that violates the chapter may be penalized in accordance with section 26.1-01-03.3 of the North Dakota Century Code. A person who violates title 26.1 is subject, after hearing by the commissioner, to payment of an administrative monetary fine of up to ten thousand dollars for each violation, unless otherwise provided by law.
Under the original Act, a licensee had to implement subsections 1, 2, 3, 4, 5, 8, and 9 of the information security program section no later than , and subsections 6 and 7 no later than . Chapter 280 of the Session Laws of 2025 repealed the section that set those implementation dates.
When LexLint raises it
When your app profile says your app is an insurer.