Law / United States / 
Ohio
Ohio Insurance Data Security Law, information security program
Insurer Information Security Program, Ohio Rev. Code ss. 3965.02 and 3965.07
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds every licensee under Ohio's insurance laws, an insurer, agent or other person licensed, authorized or registered under them (reached by declaring that you are an insurer); a licensee with fewer than twenty employees, less than five million dollars in gross annual revenue, or less than ten million dollars in assets is exempt from this program duty (sections 3965.01(M) and 3965.07(A)).
- Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system (section 3965.02(A) and (B)).
- Designate the person or entity responsible for the program, identify reasonably foreseeable internal and external threats, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of your key controls, systems and procedures at least annually (section 3965.02(C)).
- Based on that risk assessment, determine which of the listed security measures are appropriate and implement them: access controls, encryption of nonpublic information in transit over an external network and on portable devices, secure development practices, effective controls that may include multifactor authentication, testing and monitoring, audit trails and secure disposal, and give your personnel cybersecurity awareness training (section 3965.02(D)).
- If you have a board of directors, have the board or an appropriate committee require management to develop, implement and maintain the program and report to it in writing at least annually on the program's status, your compliance with the chapter and material matters (section 3965.02(E)).
- Exercise due diligence in selecting each third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can reach (section 3965.02(F)).
- Monitor, evaluate and adjust the program for changes in technology, the sensitivity of your nonpublic information, internal and external threats, and your own business arrangements (section 3965.02(G)).
- Establish a written incident response plan that covers the internal response process, its goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision of the plan after a cybersecurity event (section 3965.02(H)).
- If you are an insurer domiciled in Ohio, submit to the superintendent of insurance by the fifteenth day of February each year a written statement certifying your compliance with section 3965.02, and keep the supporting records for five years; an insurer licensed only in Ohio may instead file the statement as part of its corporate governance annual disclosure (section 3965.02(I)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The superintendent of insurance, who may examine and investigate any licensee and take any necessary or appropriate action to enforce the chapter.
What this law does
Section 3965.02 of the Revised Code requires each licensee to develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment. A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered under the insurance laws of Ohio, and the term includes an insurer.
The program must contain administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system. A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information.
By the fifteenth day of February each year, unless otherwise permitted under division (I)(2) of section 3965.02, each insurer domiciled in Ohio must submit to the superintendent of insurance a written statement certifying that the insurer is in compliance with that section. An insurer domiciled in Ohio and licensed exclusively to conduct business in Ohio may submit that statement as part of its corporate governance annual disclosure required by section 3901.073 of the Revised Code.
A licensee with fewer than twenty employees, less than five million dollars in gross annual revenue, or less than ten million dollars in assets is exempt from section 3965.02. The superintendent of insurance has the power to examine and investigate the affairs of any licensee to determine whether it has engaged in conduct that violates the chapter.
The provisions of the chapter and any rules adopted under it are the exclusive state standards and requirements for licensees on cybersecurity events, the security of nonpublic information, data security, investigation of cybersecurity events, and notification to the superintendent. The Revised Code shows section 3965.02 as effective , with Senate Bill 273 of the 132nd General Assembly as its latest legislation.
When LexLint raises it
When your app profile says your app is an insurer.