Law / United States / 
Vermont
Vermont Insurance Data Security Law, licensee information security program
Vermont Insurance Data Security Law, 8 V.S.A. § 4728
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- Applies to a licensee under Vermont insurance law, which you declare by stating that you are an insurer: a person licensed, authorized to operate or registered, or required to be licensed, authorized or registered, under the insurance laws of Vermont, other than a captive insurance company, a purchasing group or risk retention group, or a licensee domiciled elsewhere acting as an assuming insurer for a Vermont-domiciled licensee.
- Develop, implement and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, in proportion to your size and complexity, the nature and scope of your activities, including your use of third-party service providers, and the sensitivity of the nonpublic information.
- Designate one or more employees, an affiliate or an outside vendor as responsible for the program, identify reasonably foreseeable internal and external threats, including threats to information held by third-party service providers, and at least annually assess the effectiveness of your safeguards' key controls, systems and procedures.
- Implement the security measures your risk assessment makes appropriate, including access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, multi-factor authentication where effective, regular testing and monitoring, audit trails and secure disposal.
- Establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises nonpublic information, your information systems or the continuing functionality of your business.
- If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation or have a designated outside vendor or service provider conduct it, and keep records of all cybersecurity events for at least 5 years and produce them on the commissioner's demand.
- Exercise due diligence in selecting each third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access or holds. This duty applied from two years after , and the rest of subsection (d) from one year after that date.
- If you are an insurer domiciled in Vermont, submit to the commissioner on or before April 15 each year a written statement certifying compliance with subsection (d), and keep the supporting records for 5 years.
- A licensee with fewer than 20 employees, including independent contractors, is exempt from subsection (d). A licensee in compliance with 23 NYCRR Part 500 is considered to meet the section if it certifies that in writing to the commissioner.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Commissioner of Financial Regulation, who may examine and investigate the affairs of any licensee and take action necessary or appropriate to enforce the section (8 V.S.A. § 4728(f)).
What this law does
Each licensee must develop, implement, and maintain a comprehensive written information security program that is based on the licensee's risk assessment and contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.
A licensee is a person licensed, authorized to operate, or registered or required to be licensed, authorized, or registered pursuant to the insurance laws of Vermont, but not a captive insurance company, a purchasing group or risk retention group chartered, or a licensee domiciled in another jurisdiction that is acting as an assuming insurer for a licensee domiciled in Vermont.
A licensee must establish, as part of its information security program, a written incident response plan designed to promptly respond to and recover from any cybersecurity event. Each insurer domiciled in Vermont must annually submit to the commissioner, on or before April 15, a written statement certifying that the insurer is compliant with the requirements of the subsection.
A licensee that learns that a cybersecurity event has or may have occurred must conduct a prompt investigation, or have a designated outside vendor or service provider conduct it. A licensee with fewer than 20 employees, including any independent contractors, is exempt from subsection (d) of the section. A licensee has one year from the effective date of the section to implement subsection (d), other than subdivision (d)(6), and two years to implement subdivision (d)(6).
The section takes effect on . A licensee that violates the section may be penalized in accordance with section 3661 or 4726 of Title 8, as appropriate.
When LexLint raises it
When your app profile says your app is an insurer.