Law / United States / 
Wisconsin
Insurance Data Security Law, information security program
Insurance Data Security Law information security program, Wis. Stat. sec. 601.952
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Obligation class
- Security
As of .
What it requires
- Applies to a licensee under Wisconsin insurance law, which you declare by stating that you are an insurer: a person licensed, authorized, or registered, or required to be, under chapters 600 to 655 of the Wisconsin Statutes, other than a purchasing or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state or jurisdiction.
- Develop, implement, and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical, and physical safeguards for your information systems and nonpublic information; this has applied since .
- Conduct a risk assessment that identifies reasonably foreseeable internal and external threats, including threats to nonpublic information held by your third-party service providers, and design the program to mitigate them in proportion to your size and complexity, the nature and scope of your activities, and the sensitivity of the nonpublic information.
- Implement the security measures that are appropriate, including access controls, restricted physical access to nonpublic information, encryption or other protection of nonpublic information transmitted over an external network or stored on a portable device, secure development practices for applications you develop in-house, regular testing and monitoring for attacks and intrusions, audit trails, and secure disposal of nonpublic information.
- Designate at least one employee, affiliate, or outside vendor as responsible for the program, assess the effectiveness of your security safeguards at least annually, and give personnel cybersecurity awareness training.
- Develop a written incident response plan to respond to and recover from a cybersecurity event, covering its goals, the internal response process, roles and decision-making authority, communications, remediation of weaknesses, reporting and documentation, and revision after an event.
- Exercise due diligence when selecting a third-party service provider, and make reasonable efforts to require it to protect your information systems and nonpublic information and to report a cybersecurity event under section 601.954; this has applied since .
- If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement, and maintain the program, and receive a report from management at least annually on the status of the program, material matters, and recommended changes.
- If you are domiciled in Wisconsin, submit to the commissioner by March 1 each year a written certification that you comply with section 601.952, and keep the supporting records for at least 5 years.
- A licensee with less than $10,000,000 in year-end total assets, less than $5,000,000 in gross annual revenue, or fewer than 50 employees (including independent contractors who work at least 30 hours a week) is exempt from this section, and a licensee that stops qualifying must comply within 180 days.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Commissioner of Insurance, who may examine and investigate the affairs of any licensee and take action that is necessary or appropriate to enforce the subchapter (section 601.956).
What this law does
A licensee must develop, implement, and maintain a comprehensive written information security program based on its risk assessment, no later than . A licensee is a person licensed, authorized, or registered, or required to be, under chapters 600 to 655 of the Wisconsin Statutes, other than a purchasing or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state or jurisdiction.
The program must implement, as appropriate, protection by encryption or other means of nonpublic information transmitted over an external network and nonpublic information stored on a portable computer or storage device or media. A licensee must develop a written incident response plan to promptly respond to, and recover from, a cybersecurity event. A licensee must exercise due diligence when selecting any third-party service provider, no later than .
If a licensee has a board of directors, the board or an appropriate committee of the board has oversight duties for the program. A licensee domiciled in Wisconsin must annually submit, no later than March 1, a written certification to the commissioner that it is in compliance with the section. The section does not apply to a licensee that has less than $10,000,000 in year-end total assets, less than $5,000,000 in gross annual revenue, or fewer than 50 employees.
The subchapter, except for the notice to the commissioner, does not apply to a licensee that is governed by the federal health privacy and security rules and maintains nonpublic information in the same manner as protected health information. The commissioner may examine and investigate the affairs of any licensee and take action that is necessary or appropriate to enforce the subchapter. The subchapter may not be construed to create or imply a private cause of action for violation of its provisions.
When LexLint raises it
When your app profile says your app is an insurer.