Law / United States / Rhode Island

Foreign insurers, information security program

R.I. Gen. Laws sec. 27-2-29

In force since 1 Jan 2025.

A sector security regimes rule binding private bodies.

Obligation class

Security, Governance

As of 27 October 2026.

What it requires

• Applies to a foreign insurance company, which you declare by stating that you are an insurer.
• Develop, implement and maintain a comprehensive written information security program, based on your risk assessment and commensurate with your size and complexity, the nature and scope of your activities including your use of third-party service providers, and the sensitivity of the nonpublic information you hold, with administrative, technical and physical safeguards that protect the security and confidentiality of nonpublic information and your information system.
• Designate one or more employees, an affiliate or an outside vendor responsible for the program, identify reasonably foreseeable internal and external threats to nonpublic information, assess their likelihood and potential damage, assess the sufficiency of your safeguards, and at least annually assess the effectiveness of the key controls, systems and procedures of those safeguards.
• Based on the risk assessment, determine which of the security measures the law lists are appropriate and implement each one that is, which include access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, multi-factor authentication where effective, regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information.
• Include cybersecurity risks in your enterprise risk management process and give your personnel cybersecurity awareness training that is updated to reflect the risks your risk assessment identifies.
• If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement and maintain the program and to report to it in writing at least annually on the program's overall status, your compliance with the chapter and material matters such as risk assessment, third-party service provider arrangements, test results and cybersecurity events.
• Exercise due diligence in selecting a third-party service provider and take reasonable steps to request the provider to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access or holds.
• Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information in your possession, your information systems or the continuing functionality of any aspect of your business, covering the internal response process, goals, roles and decision-making authority, communications, remediation of identified weaknesses, documentation and reporting, and revision of the plan after an event.
• If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation, or have an outside vendor or service provider designated to act for you do so, to determine whether an event has occurred, its nature and scope and the nonpublic information involved, and to restore the security of the compromised information systems; keep records of all cybersecurity events for at least five years and produce them on demand of the commissioner.

These lines are LexLint's reading of the law's text, as of 27 October 2026.

When LexLint raises it

When your app profile says your app is an insurer.

Back to the example  ·  Lint your app