Law / United States / 
Rhode Island
Insurance Data Security: investigation of a cybersecurity event and records kept by a foreign insurer
R.I. Gen. Laws sec. 27-2-29(h)(3)
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- If you are a foreign insurance company and learn that a cybersecurity event has or may have occurred, conduct, or have an outside vendor or service provider designated to act for you conduct, a prompt investigation (R.I. Gen. Laws sec. 27-2-29(h)(3)).
- Maintain records concerning all cybersecurity events for at least five years from the date of each event, and produce those records upon the commissioner's demand (R.I. Gen. Laws sec. 27-2-29(h)(3)(iii)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Log retention
Five years from the date of the cybersecurity event is a minimum; the clause sets no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Subsection (h)(3)(iii) requires the insurer to maintain records concerning all cybersecurity events for at least five years from the date of the event and to produce them upon demand of the commissioner under chapter 13.1 of title 27 or other statutory authority; it names no fields. This section is the foreign-insurer counterpart of 27-1-46, and chapter 27-2.2 concerns the domestication of insurers and holds no data security rule. The notice of an event is in 27-2-30, a different row. The reach is each foreign insurance company, the term subsection (a) uses.
- Kind
- Explicit
- As of
- Provision
- R.I. Gen. Laws sec. 27-2-29(h)(3)(iii) (records of all cybersecurity events)
- Trigger
- security_incident
What this law does
A foreign insurance company that learns that a cybersecurity event has or may have occurred must conduct, or have an outside vendor or service provider conduct, a prompt investigation. The insurer must maintain records concerning all cybersecurity events for at least five years from the date of the event and must produce those records upon demand of the commissioner. The section was enacted with an effective date of .
When LexLint raises it
When your app profile says your app is an insurer.