Law / United States / 
Oklahoma
Insurance Data Security Act, investigation of a cybersecurity event and records of every event
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.oklegislature.gov/cf_pdf/2023-24%20ENR/SB/SB543%20ENR.PDFIn force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- If you are a licensee (a person licensed, authorized to operate or registered, or required to be, under Title 36 of the Oklahoma Statutes, other than a purchasing group or a risk retention group chartered in another state or an assuming insurer domiciled elsewhere) and learn that a cybersecurity event has or may have occurred, conduct, or have an outside vendor or service provider designated to act for you conduct, a prompt investigation (Okla. Stat. tit. 36, Sec. 674(A)).
- Where the event occurs in a system a third-party service provider maintains, complete the investigation steps or confirm and document that the provider has completed them (Okla. Stat. tit. 36, Sec. 674(C)).
- Maintain records concerning all cybersecurity events for at least five years from the date of each event, and produce those records upon the Insurance Commissioner's request (Okla. Stat. tit. 36, Sec. 674(D)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Log retention
Five years from the date of the cybersecurity event is a minimum; the subsection sets no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Subsection D of section 674 requires a licensee to maintain records concerning all cybersecurity events for at least five years from the date of the event and to produce them upon request by the Insurance Commissioner; it names no fields. Subsection C separately requires a licensee to confirm and document that a third-party service provider has completed the investigation steps. The notice of an event is in section 675, a different row. The reach is the licensee, a term defined by Title 36 of the Oklahoma Statutes (section 672).
- Kind
- Explicit
- As of
- Provision
- Okla. Stat. tit. 36, Sec. 674(D) (records of all cybersecurity events)
- Trigger
- security_incident
What this law does
A licensee that learns that a cybersecurity event has or may have occurred must conduct, or have an outside vendor or service provider conduct, a prompt investigation. Where the event occurs in a system a third-party service provider maintains, the licensee must complete the investigation steps or confirm and document that the provider has completed them.
The licensee must maintain records concerning all cybersecurity events for at least five years from the date of the event and must produce those records upon request by the Insurance Commissioner. The act becomes effective on .
When LexLint raises it
When your app profile says your app is an insurer.