Law / United States / 
Tennessee
Insurance Data Security Law: investigation records of cybersecurity events and determinations kept five years
Tenn. Code Ann. sec. 56-2-1005(d), (e)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://publications.tnsosfiles.com/acts/112/pub/pc0345.pdfIn force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- If you are a licensee under Tennessee insurance law, maintain records concerning all cybersecurity events for at least five years from the date of discovery of each event (section 56-2-1005(d)).
- Provide those cybersecurity event records to the commissioner upon request (section 56-2-1005(d)).
- If you investigate or review a potential or suspected cybersecurity event and determine that it is not one, put that determination in writing, keep the writing for at least five years from the date of discovery of the event, and provide it to the commissioner upon request (section 56-2-1005(e)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Tennessee Commissioner of Commerce and Insurance, who may seek penalties under section 56-2-305 for a violation of the part (section 56-2-1010).
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Log retention
Subsection (d) sets at least five years from the date of discovery of the cybersecurity event and subsection (e) sets at least five years from the date of discovery of the event for the written determination; neither states a maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Subsection (d) requires a licensee to maintain records concerning all cybersecurity events for at least five years from the date of discovery and to provide them to the commissioner upon request. Subsection (e) requires a licensee that determines after an investigation or review that a potential or suspected event is not a cybersecurity event to put that determination in writing, keep the writing for at least five years from the date of discovery, and provide it to the commissioner upon request; the writing records the licensee's reason for treating the event as outside the definition. Section 56-2-1009(a)(1) removes a licensee below its size thresholds from the part. Section 56-2-1006, cited by a separate row, carries the notice duties. This row reads the enacted Public Chapter through its web.archive.org capture.
- Kind
- Explicit
- As of
- Provision
- Tenn. Code Ann. sec. 56-2-1005(d) and (e), records of cybersecurity events and written determinations
- Trigger
- security_incident
What this law does
Section 56-2-1005(d) of the Insurance Data Security Law requires a licensee to maintain records concerning all cybersecurity events for a period of at least five years from the date of discovery of the cybersecurity event. The licensee must provide those records to the commissioner upon request.
Section 56-2-1005(e) requires a licensee that conducts an investigation or review and determines that a potential or suspected event is not a cybersecurity event to reduce that determination to writing, maintain the writing for at least five years from the date of discovery of the event, and provide it to the commissioner upon request.
Section 56-2-1005(a) requires a licensee that learns that a cybersecurity event has or may have occurred to conduct, or to have a designated outside vendor or service provider conduct, a prompt investigation. Section 56-2-1005(c) requires a licensee that learns of an event in a system maintained by a third-party service provider to complete the actions required by subsection (b), or to confirm and document that the provider has completed them.
Section 56-2-1003 defines a licensee as a person licensed, authorized to operate, or registered, or required to be, under title 56. Section 56-2-1009(a)(1) provides that the part does not apply to a licensee that employs fewer than 25 individuals, has less than $5,000,000 in gross annual revenue, or has less than $10,000,000 in year-end total assets. Section 56-2-1010 provides that the commissioner may seek penalties under section 56-2-305 for a violation of the part.
Section 4 of the act that enacted the Insurance Data Security Law provides that, for all purposes other than promulgating rules, the act takes effect and applies to breaches that occur or are discovered on or after that date.
When LexLint raises it
When your app profile says your app is an insurer.