Law / United States / 
Tennessee
Insurance Data Security Law: licensee information security program and investigation of a cybersecurity event
In force since .
A sector security regimes rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Enforcement body
- The commissioner may seek penalties under section 56-2-305 for a violation of the Law.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a licensee, a person licensed, authorized to operate, or registered, or required to be, under Tennessee's insurance title (reached by declaring that you are an insurer, reinsurer or insurance producer). The Law does not apply to a licensee that employs fewer than 25 individuals, has less than $5,000,000 in gross annual revenue, or has less than $10,000,000 in year-end total assets (section 56-2-1009).
- Develop, implement, and maintain a comprehensive, written information security program, based on your risk assessment, that contains administrative, technical, and physical safeguards for nonpublic information and your information system. The duty applied by (section 56-2-1004(1)).
- Conduct a risk assessment: designate who is responsible for the program, identify reasonably foreseeable internal and external threats, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of key controls, systems, and procedures at least annually (section 56-2-1004(3)).
- Determine which of the listed security measures are appropriate and implement them, including access controls, encryption of nonpublic information sent over an external network or stored on portable devices, secure development practices for applications, effective controls that may include multi-factor authentication, regular testing and monitoring, audit trails, and secure disposal of nonpublic information (section 56-2-1004(4)).
- Establish a written incident response plan that addresses the internal response process, goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event (section 56-2-1004(8)).
- Exercise due diligence in selecting a third-party service provider and, by , require each one to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information it can reach (section 56-2-1004(6)).
- If you are an insurer domiciled in Tennessee, certify your compliance to the commissioner in writing by April 15 each year and keep the supporting records for five years (section 56-2-1004).
- When you learn that a cybersecurity event has or may have occurred, promptly investigate it, determine its nature and scope and the nonpublic information involved, take reasonable measures to restore security, and keep records of all cybersecurity events for at least five years (section 56-2-1005).
These lines are LexLint's reading of the law's text, as of .
What this law does
The Insurance Data Security Law requires each licensee to develop, implement, and maintain a comprehensive, written information security program based on its risk assessment. A licensee must establish a written incident response plan designed to promptly respond to and recover from a cybersecurity event. A licensee that learns a cybersecurity event has or may have occurred must conduct a prompt investigation.
The Law does not apply to a licensee with fewer than 25 individuals, less than $5,000,000 in gross annual revenue, or less than $10,000,000 in year-end total assets. The commissioner may seek penalties under section 56-2-305 for a violation of the Law. The Law takes effect on .
When LexLint raises it
When your app profile says your app is an insurer.