Law / United States / 
Puerto Rico
Cybersecurity Standards for the Insurance Industry, licensee cybersecurity program, Rule 108 of the Insurance Code Regulations
Rule No. 108, Cybersecurity Standards for the Insurance Industry, Sections 6 to 8, 11 and 13
In force.
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to any person who holds a license or authorization to transact insurance business issued by the Office of the Commissioner of Insurance of Puerto Rico and who uses an Information System, which you declare by stating that you are an insurer; a licensee is a person that holds, or is required to hold, a license, authorization or certificate of authority under the Insurance Code of Puerto Rico, and the Rule excludes a purchasing group or risk control group established and licensed in another state, and a licensee acting as a reinsurer that is domiciled in another state or jurisdiction.
- Develop, implement, maintain and document a comprehensive written information security program, based on your risk assessment and commensurate with your size and complexity, the nature and scope of your activities including your use of service contractors, and the sensitivity of the nonpublic information you hold, containing administrative, technical and physical safeguards for nonpublic information and your information system.
- Conduct a risk assessment that designates who is responsible for the program, identifies reasonably foreseeable internal and external threats to nonpublic information, assesses their likelihood and potential damage, implements safeguards, and evaluates the effectiveness of key controls, systems and procedures at least once a year; if you have adopted artificial intelligence algorithms, programs or technology, evaluate the related policies and processes so that data the AI uses is accessed and processed securely.
- Implement the security measures your infrastructure, staff, operations and systems warrant, which include a formal cyber risk training program, effective access controls including multi-factor authentication, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, regular testing and monitoring of systems, audit logs, protection against environmental loss, secure disposal of nonpublic information, and regular vulnerability tests of your information systems.
- If you have a board of directors, have the board or a committee of it require executive management to develop, implement and maintain the program and to submit, at least once a year, a report for the board's approval and signature on the overall condition of the program and your compliance with the Rule.
- Perform due diligence in selecting each service contractor, and require by contract or service agreement that it implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access or holds.
- Establish a written incident response plan, as part of the program, that provides for a prompt response and recovery in the event of a cybersecurity incident.
- No later than June 30 of each year, if you are domiciled in Puerto Rico, submit to the Commissioner a written statement certifying that you comply with the program section, and keep for five years the records, forms and data on which the certification is based.
- A licensee with fifteen or fewer employees is exempt from the program section; a licensee that maintains a program under the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, or that is an affiliate or subsidiary of a financial institution and maintains a program under section 501 of the Gramm-Leach-Bliley Act, is considered to meet the program section if it submits a written certification of compliance.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 14 provides that the Commissioner of Insurance may impose a penalty of up to $10,000 per violation, as authorized by Section 2.250 of the Insurance Code.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
The Commissioner of Insurance of Puerto Rico, who may take the necessary actions to enforce the Rule, including the imposition of penalties (Section 11(B)).
What this law does
Rule 108 applies to any person who holds a license or authorization to transact insurance business issued by the Office of the Commissioner of Insurance and who uses an Information System. Each licensee must develop, implement, maintain and document a comprehensive written information security program, based on its risk assessment, that contains administrative, technical and physical safeguards for nonpublic information and the licensee's information system.
A licensee with fifteen or fewer employees is exempt from the program section. A licensee that maintains a program under the Health Insurance Portability and Accountability Act (HIPAA) Security Rule is considered to meet the program section if it submits a written certification of compliance. A licensee that is an affiliate or subsidiary of a financial institution and maintains a program under section 501 of the Gramm-Leach-Bliley Act is considered to meet the program section if it submits a written certification of compliance.
No later than June 30 of each year, every licensee domiciled in Puerto Rico must submit to the Commissioner a written statement certifying compliance with the program section. A licensee that violates the Rule may be penalized up to $10,000 per violation. The Rule may not be construed to create a cause of action for violating its provisions. Licensees have a period of six months to implement the Rule.
When LexLint raises it
When your app profile says your app is an insurer.