Law / United States / 
Virginia
Insurance Data Security Act: investigation of a cybersecurity event and records of every event
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- If you are a licensee (a person licensed, authorized to operate or registered, or required to be, under the insurance laws of the Commonwealth, other than a purchasing group or a risk retention group chartered in another state or an assuming insurer domiciled elsewhere) and learn that a cybersecurity event has or may have occurred, conduct, or have an investigator conduct, a prompt investigation (section 38.2-624(A)).
- In the investigation, determine as much as possible of whether a cybersecurity event has occurred, its nature and scope and the nonpublic information involved, and perform or oversee reasonable measures to restore the security of the compromised information systems (section 38.2-624(B)).
- Where the event occurs in a system a third-party service provider maintains, complete those steps or make reasonable efforts to confirm and document that the provider has completed them (section 38.2-624(C)).
- Maintain records concerning all cybersecurity events for at least five years from the date of each event, and produce those records upon the Commissioner's demand (section 38.2-624(D)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Log retention
Five years from the date of the cybersecurity event is a minimum; the subsection sets no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Section 38.2-624(D) requires each licensee to maintain records concerning all cybersecurity events for at least five years from the date of the event and to produce them upon the Commissioner's demand. The subsection names no fields. Subsection (C) separately requires a licensee to confirm and document that a third-party service provider has completed the investigation steps. The Commissioner's powers of examination and enforcement are in 38.2-627, which this row does not cite. The reach is the licensee, a term defined by the insurance laws of the Commonwealth (38.2-621).
- Kind
- Explicit
- As of
- Provision
- Va. Code Ann. 38.2-624(D) (records of all cybersecurity events)
- Trigger
- security_incident
What this law does
A licensee that learns that a cybersecurity event has or may have occurred must conduct, or have an investigator conduct, a prompt investigation. The investigation must at a minimum determine whether a cybersecurity event has occurred, assess its nature and scope, identify any nonpublic information involved, and perform or oversee reasonable measures to restore the security of the compromised information systems.
Where the event occurs in a system a third-party service provider maintains, the licensee must complete those steps or make reasonable efforts to confirm and document that the provider has completed them. Each licensee must maintain records concerning all cybersecurity events for at least five years from the date of the event and must produce those records upon demand of the Commissioner.
When LexLint raises it
When your app profile says your app is an insurer.