Law / United States / 
Virginia
Insurance Data Security Risk Assessment and Reporting regulation: risk assessment and security measures
14VAC5-430-40 and 14VAC5-430-50 (Virginia Administrative Code)
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- This binds a licensee as the Insurance Data Security Act defines the term: any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered under the insurance laws of Virginia, other than a purchasing group or a risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state; declare is_insurer if your organization is one.
- Conduct a periodic risk assessment that identifies reasonably foreseeable internal or external threats to nonpublic information (including information held by third-party service providers), assesses the likelihood and potential damage of those threats and the sufficiency of your policies, procedures, information systems, and other safeguards, implements safeguards to manage the threats, and assesses the effectiveness of the key controls, systems, and procedures at least annually.
- Based on your risk assessments, implement appropriate security measures: manage your data, personnel, devices, systems, and facilities in accordance with identified risk; protect by encryption or other appropriate means all nonpublic information transmitted over an external network and all nonpublic information stored on portable computing or storage devices or media; adopt secure development practices for applications developed in-house and procedures for evaluating the security of externally developed applications; implement effective access controls, which may include multi-factor authentication; and use audit trails or audit logs designed to detect and respond to cybersecurity events and to reconstruct material financial transactions.
- If you use a third-party service provider, exercise due diligence in selecting it and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider.
- Meet the risk assessment and security measure requirements on or before .
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 38.2-218: a person who knowingly or willfully violates any provision of Title 38.2, or any regulation issued under it, is punished for each violation by a penalty of not more than $5,000, and a person who violates a provision without knowledge or intent may be punished for each violation by a penalty of not more than $1,000, with a series of similar violations from the same act limited to $10,000 in the aggregate. The knowing or willful ceiling is recorded as per_violation_amount.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Virginia Commissioner of Insurance, who may examine and investigate the affairs of any licensee and take the action that is necessary or appropriate to enforce the article (section 38.2-627).
What this law does
Each licensee must conduct a periodic risk assessment that identifies reasonably foreseeable internal or external threats to nonpublic information, assesses the likelihood and potential damage of those threats, and assesses the sufficiency of the safeguards in place. An assessment conducted in accordance with the objectives of the most current revision of NIST SP 800-30, NIST SP 800-39, or another substantially similar standard meets the requirements for a periodic assessment.
Each licensee must implement appropriate security measures based on its risk assessments, including protecting by encryption or other appropriate means all nonpublic information while it is transmitted over an external network.
Effective , a licensee that uses a third-party service provider must exercise due diligence in selecting it and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider. Compliance with the risk assessment requirement was required of all licensees on or before .
The chapter sets out rules to carry out the Insurance Data Security Act and sets minimum standards for risk assessment and security standards required of all licensees. Section 14VAC5-430-50 derives from Virginia Register Volume 37, Issue 21, effective , and was amended effective .
When LexLint raises it
When your app profile says your app is an insurer.