Law / United States / 
South Carolina
Insurance Data Security Act, information security program
Insurance Data Security Act information security program, S.C. Code Ann. sec. 38-99-20
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Obligation class
- Security
As of .
What it requires
- Applies to a licensee under South Carolina insurance law, which you declare by stating that you are an insurer: a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of South Carolina, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
- Develop, implement, and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information system, in proportion to your size and complexity, the nature and scope of your activities, and the sensitivity of the nonpublic information.
- Designate one or more employees, an affiliate, or an outside vendor as responsible for the program, identify and assess reasonably foreseeable internal and external threats, and at least annually assess the effectiveness of the key controls, systems, and procedures of your safeguards.
- Determine the appropriateness of, and implement, security measures including access controls, restricted physical access, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, multifactor authentication where effective, regular testing and monitoring, audit trails, and secure disposal of nonpublic information.
- Include cybersecurity risks in your enterprise risk management process, stay informed of emerging threats and vulnerabilities, and give personnel cybersecurity awareness training that is updated to reflect the risks identified in your risk assessment.
- Establish a written incident response plan to promptly respond to and recover from a cybersecurity event, covering its goals, the internal response process, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event.
- Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information it holds or can access; this has applied since .
- If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement, and maintain the program and to report in writing at least annually on its status, your compliance, and material matters.
- If you are an insurer domiciled in South Carolina, submit to the director by February 15 each year a written statement certifying that you comply with section 38-99-20, and keep the supporting records for five years.
- A licensee with fewer than ten employees, including independent contractors, is exempt from section 38-99-20, as is a licensee covered by another licensee's program and a licensee subject to Health Insurance Portability and Accountability Act (HIPAA) that maintains a program under it and submits a written statement certifying its compliance with section 38-99-20; a licensee that stops qualifying has one hundred and eighty days to comply.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Director of the Department of Insurance, who may take necessary and appropriate action to enforce the chapter (section 38-99-50).
What this law does
Each licensee must develop, implement, and maintain a comprehensive written information security program based on its risk assessment that contains administrative, technical, and physical safeguards for nonpublic information and the licensee's information system.
A licensee is a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of South Carolina, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
Based on its risk assessment, a licensee must determine the appropriateness of, and implement, protection by encryption or other appropriate means of all nonpublic information transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media. A licensee must establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event.
A licensee must exercise due diligence in selecting its third-party service provider and require the provider to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information it holds or can access.
If the licensee has a board of directors, the board or an appropriate committee must require executive management to develop, implement, and maintain the program and to report in writing at least annually on its status and compliance. Each insurer domiciled in South Carolina must submit to the director by February fifteenth a written statement certifying that it is in compliance with the section.
Licensees have until to implement the section generally and until to implement the third-party service provider duty. A licensee with fewer than ten employees, including any independent contractors, is exempt from the section. The director may examine and investigate the affairs of a licensee and take necessary and appropriate action to enforce the chapter. The Act may not be construed to create or imply a private cause of action for a violation of its provisions.
When LexLint raises it
When your app profile says your app is an insurer.