Regulatory Bodies | NAIC | Cybersecurity
In 2014, the NAIC formed a Cybersecurity Task Force to undertake an ambitious agenda of work products, following the disclosure of a massive security breach at the health insurer Anthem. The Task Force developed a set of regulatory principles, proposed a “Bill of Rights” for consumers, and set out to develop a model law addressing data security issues for insurers and other regulated entities. The Task Force also enhanced financial exam standards to focus on cybersecurity issues and developed a supplement to the annual statement to collect information on insurers’ writing of cybersecurity insurance.
The NAIC Cybersecurity Task Force development of both data security standards and security breach protocol measures has involved addressing many issues including: 1) the breadth of definitions regarding personal information and cybersecurity breach event; 2) the inclusion of a harm trigger to determine when notice to regulators and consumers is required; and 3) the obligation to ensure proper measures and practices of third-party service providers.
NAMIC Position
NAMIC has engaged in every initiative undertaken by the Cybersecurity Task Force by continually stressing the need for regulatory measures to be risk-based and scalable to match the needs and abilities of entities of varying size and complexity, and to be workable from a compliance perspective.
