Law / United States / 
Rhode Island
Insurance Data Security: investigation of a cybersecurity event and records kept by a domestic insurer
R.I. Gen. Laws sec. 27-1-46(h)(3), (i)
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- If you are a domestic insurance company and learn that a cybersecurity event has or may have occurred, conduct, or have an outside vendor or service provider designated to act for you conduct, a prompt investigation (R.I. Gen. Laws sec. 27-1-46(h)(3)).
- Maintain records concerning all cybersecurity events for at least five years from the date of each event, and produce those records upon the commissioner's demand (R.I. Gen. Laws sec. 27-1-46(h)(3)(iii)).
- If you are an insurer domiciled in Rhode Island, submit to the commissioner by April 15 each year a written statement certifying your compliance, and maintain the records, schedules and data supporting it for five years for examination by the department (R.I. Gen. Laws sec. 27-1-46(i)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Log retention
Five years from the date of the cybersecurity event is a minimum; the clause sets no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Subsection (h)(3)(iii) requires the insurer to maintain records concerning all cybersecurity events for at least five years from the date of the event and to produce them upon demand of the commissioner under chapter 13.1 of title 27 or other statutory authority; it names no fields. Subsection (i) adds an annual certificate of compliance, with the supporting records, schedules and data kept five years for examination by the department. The Rhode Island insurance data security rules sit in chapter 27-1 for domestic insurers and chapter 27-2 for foreign insurers, not in chapter 27-2.2, which concerns the domestication of insurers. The notice of an event is in 27-1-47, a different row. The reach is each domestic insurance company, the term subsection (a) uses.
- Kind
- Explicit
- As of
- Provision
- R.I. Gen. Laws sec. 27-1-46(h)(3)(iii) (records of all cybersecurity events)
- Trigger
- security_incident
What this law does
A domestic insurance company that learns that a cybersecurity event has or may have occurred must conduct, or have an outside vendor or service provider conduct, a prompt investigation. The insurer must maintain records concerning all cybersecurity events for at least five years from the date of the event and must produce those records upon demand of the commissioner.
Each insurer domiciled in the state must also submit an annual written statement of compliance by April 15 and must maintain for examination by the department the records, schedules and data supporting it for five years. The section was enacted with an effective date of .
When LexLint raises it
When your app profile says your app is an insurer.