Law / United States / 
Puerto Rico
Cybersecurity Standards for the Insurance Industry, investigation of a cybersecurity incident and notice to the Commissioner within 72 hours
In force.
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Security, Reporting
As of .
What it requires
- Applies to any person who holds a license or authorization to transact insurance business issued by the Office of the Commissioner of Insurance of Puerto Rico and who uses an Information System, which you declare by stating that you are an insurer; a licensee is a person that holds, or is required to hold, a license, authorization or certificate of authority under the Insurance Code of Puerto Rico, and the Rule excludes a purchasing group or risk control group established and licensed in another state, and a licensee acting as a reinsurer that is domiciled in another state or jurisdiction.
- If you learn that a cybersecurity incident has occurred or may have occurred, conduct an investigation as soon as possible and prepare a written report, and at a minimum determine whether an incident occurred, assess its nature and scope, identify the nonpublic information that may have been affected, and perform or oversee reasonable measures to restore the security of the affected information systems; if the incident is in a system maintained by a service contractor, complete those steps or confirm and document that the contractor completed them.
- Notify the Commissioner as promptly as possible, within 72 hours after it has been determined that a cybersecurity incident has occurred, when you reasonably believe that the nonpublic information involved impacts 250 or more consumers residing in Puerto Rico and the incident impacts you in a manner that requires notice to a government agency, corporation or instrumentality, regulatory agency or supervisory entity under a state or federal law, or has a reasonable probability of causing material harm to consumers residing in Puerto Rico or to a material aspect of your normal operations.
- Give the Commissioner as much as possible of the information the Rule lists, in electronic format as the Commissioner directs, including the date of the incident, how the information was disclosed, lost or stolen, how it was discovered, the source of the incident, the types of data involved, the period of compromise, the number of consumers in Puerto Rico affected, and a contact person, and update and supplement initial and later notifications.
- Comply with the Citizen Information on Data Banks Security Act, Act No. 111-2005, as applicable, and give the Commissioner a copy of the notice sent to consumers when you are required to notify the Commissioner.
- If the incident is in a system maintained by a service contractor, treat it as an incident of your own, with the notice deadline counted from the day after the contractor notifies you or you become aware of the incident, whichever occurs first.
- If you act as a reinsurer and the incident involves nonpublic information you use or hold and you have no direct contractual relationship with the affected consumers, notify the affected ceding insurers and the Commissioner of your state of domicile within 72 hours of determining that an incident occurred, or, for an incident at your service contractor, within 72 hours of receiving the contractor's notice.
- If you are an insurer or health service organization and your services reached the consumer through a producer or intermediary, notify the producer or intermediary of record of all affected consumers as soon as possible, unless you have no current information about the producer or intermediary for a consumer.
- Maintain records of all cybersecurity incidents for at least five years from the date of the incident, and submit them on the Commissioner's demand.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 14 provides that the Commissioner of Insurance may impose a penalty of up to $10,000 per violation, as authorized by Section 2.250 of the Insurance Code.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
The Commissioner of Insurance of Puerto Rico, who may take the necessary actions to enforce the Rule, including the imposition of penalties (Section 11(B)).
What this law does
A licensee that learns that a cybersecurity incident has occurred or may have occurred must conduct an investigation as soon as possible and prepare a written report. A licensee must notify the Commissioner of a cybersecurity incident as promptly as possible, within 72 hours after it has been determined that the incident occurred, when any of the Rule's criteria are met.
One criterion is that the licensee reasonably believes the nonpublic information involved impacts 250 or more consumers residing in Puerto Rico and that the incident either requires notice to a government agency or regulator under state or federal law or has a reasonable probability of causing material harm. A licensee acting as a reinsurer must notify the affected ceding insurers and the Commissioner of its state of domicile within 72 hours of determining that an incident has occurred.
A licensee must keep records of all cybersecurity incidents for at least five years from the date of the incident. A licensee that violates the Rule may be penalized up to $10,000 per violation.
When LexLint raises it
When your app profile says your app is an insurer.