Law / United States / 
New Hampshire
Insurance Data Security Law: investigation of a cybersecurity event and records kept by a licensee
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- If you are a licensee (a person licensed, authorized to operate or registered, or required to be, under the insurance laws of New Hampshire, other than a purchasing group or a risk retention group chartered in another state or an assuming insurer domiciled elsewhere) and learn that a cybersecurity event has or may have occurred, conduct, or have an outside vendor or service provider designated to act for you conduct, a prompt investigation (RSA 420-P:5, I).
- Where the event occurs in a system a third-party service provider maintains, complete the investigation steps or confirm and document that the provider has completed them (RSA 420-P:5, III).
- Maintain records concerning all cybersecurity events for at least 5 years from the date of each event, and produce those records upon the commissioner's demand (RSA 420-P:5, IV).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Log retention
Five years from the date of the cybersecurity event is a minimum; the paragraph sets no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
RSA 420-P:5, IV requires a licensee to maintain records concerning all cybersecurity events for at least 5 years from the date of the event and to produce them upon demand of the commissioner; it names no fields. Paragraph III separately requires a licensee to confirm and document that a third-party service provider has completed the investigation steps. The notice of an event is in 420-P:6, a different row. The reach is the licensee, a term defined by the insurance laws of New Hampshire (420-P:2).
- Kind
- Explicit
- As of
- Provision
- RSA 420-P:5, IV (records of all cybersecurity events)
- Trigger
- security_incident
What this law does
A licensee that learns that a cybersecurity event has or may have occurred must conduct, or have an outside vendor or service provider conduct, a prompt investigation. The investigation must determine as much as possible of whether a cybersecurity event has occurred, its nature and scope and the nonpublic information involved, and the licensee or its vendor must perform or oversee reasonable measures to restore the security of the compromised information systems.
Where the event occurs in a system a third-party service provider maintains, the licensee must complete those steps or confirm and document that the provider has completed them. The licensee must maintain records concerning all cybersecurity events for at least 5 years from the date of the event and must produce those records upon demand of the commissioner. The section took effect on .
When LexLint raises it
When your app profile says your app is an insurer.