SB160,7,13
11(4) Private cause of action. This subchapter may not be construed to create
12or imply a private cause of action for violation of its provisions or to curtail a private
13cause of action that otherwise exists in the absence of this subchapter.
SB160,7,15
14(5) Rules. The commissioner may promulgate rules that are necessary to carry
15out the provisions of this subchapter.
SB160,5
16Section
5. 601.952 of the statutes is created to read:
SB160,7,24
17601.952 Information security program.
(1) Implementation of program.
18No later than one year after the effective date of this subsection .... [LRB inserts
19date], a licensee shall develop, implement, and maintain a comprehensive written
20information security program based on the licensee's risk assessment under sub. (2)
21and consistent with the conditions of sub. (3) (a). The program shall contain
22administrative, technical, and physical safeguards for the protection of the licensee's
23information systems and nonpublic information. The licensee shall design the
24program to do all of the following:
SB160,8,2
1(a) Protect against threats and hazards to the security and integrity of the
2information systems and nonpublic information.
SB160,8,53
(b) Protect against unauthorized access to and use of nonpublic information
4and minimize the likelihood of harm to a consumer from the unauthorized access or
5use.
SB160,8,86
(c) Establish and periodically reevaluate a schedule for retention and disposal
7of nonpublic information and establish a mechanism for the destruction of nonpublic
8information that is no longer needed.
SB160,8,10
9(2) Risk assessment. The licensee shall conduct a risk assessment under which
10the licensee shall do all of the following:
SB160,8,1411
(a) Identify reasonably foreseeable internal and external threats that could
12result in unauthorized access to or transmission, disclosure, misuse, alteration, or
13destruction of nonpublic information, including nonpublic information that is
14accessible to or held by 3rd-party service providers of the licensee.
SB160,8,1615
(b) Assess the likelihood and potential damage of the threats identified under
16par. (a), taking into consideration the sensitivity of the nonpublic information.
SB160,8,1917
(c) Assess the sufficiency of policies, procedures, information systems, and
18other safeguards to manage the threats identified under par. (a) in each relevant
19area of the licensee's operations, including all of the following:
SB160,8,2020
1. Employee training and management.
SB160,8,2221
2. Information systems, including the classification, governance, processing,
22storage, transmission, and disposal of information.
SB160,8,2423
3. Processes for detecting, preventing, and responding to attacks, intrusions,
24and other system failures.
SB160,9,2
1(3) Risk management. Based on the risk assessment under sub. (2), the licensee
2shall do all of the following:
SB160,9,63
(a) Design an information security program to mitigate the identified threats,
4commensurate with the size and complexity of the licensee, the nature and scope of
5the licensee's activities, including its use of 3rd-party service providers, and the
6sensitivity of the nonpublic information.
SB160,9,77
(b) Implement the following security measures, as appropriate:
SB160,9,88
1. Place access controls on information systems.
SB160,9,129
2. Identify and manage the data, personnel, devices, systems, and facilities
10that enable the licensee to achieve its business purposes, taking into consideration
11the relative importance of the data, personnel, devices, systems, and facilities to the
12business objectives and risk strategy of the licensee.
SB160,9,1413
3. Restrict physical access to nonpublic information to authorized individuals
14only.
SB160,9,1715
4. Protect, by encryption or other means, nonpublic information being
16transmitted over an external network and nonpublic information stored on a
17portable computer or storage device or media.
SB160,9,1918
5. Adopt secure development practices for applications that are developed
19in-house and utilized by the licensee.
SB160,9,2120
6. Modify information systems in accordance with the licensee's information
21security program.
SB160,9,2322
7. Utilize effective controls, which may include multifactor authentication
23procedures for employees accessing nonpublic information.
SB160,9,2524
8. Implement regular testing and monitoring of systems and procedures to
25detect actual and attempted attacks on, or intrusions into, an information system.
SB160,10,4
19. Include audit trails within the information security program that are
2designed to detect and respond to cybersecurity events and to reconstruct material
3financial transactions sufficient to support the normal operations and obligations of
4the licensee.
SB160,10,75
10. Implement measures to protect against the destruction, loss, or damage of
6nonpublic information due to environmental hazards, natural and other disasters,
7and technological failures.
SB160,10,98
11. Develop, implement, and maintain practices for the secure disposal of
9nonpublic information in all formats.
SB160,10,1110
(c) Designate at least one employee, affiliate, or outside vendor as responsible
11for the information security program.
SB160,10,1312
(d) Stay informed regarding emerging threats and vulnerabilities and
13implement safeguards to manage the threats and vulnerabilities.
SB160,10,1514
(e) No less than annually, assess the effectiveness of security safeguards,
15including key controls, systems, and procedures.
SB160,10,1716
(f) Include cybersecurity risks in the licensee's enterprise risk management
17process.
SB160,10,1918
(g) Utilize reasonable security measures when sharing information, taking
19into consideration the character of the sharing and the type of information shared.
SB160,10,2120
(h) Provide personnel with cybersecurity awareness training that is updated
21as necessary.
SB160,11,6
22(4) Program adjustments. The licensee shall monitor, evaluate, and adjust the
23information security program under sub. (1) consistent with changes in technology,
24the sensitivity of the nonpublic information, internal and external threats to
25nonpublic information, and changes to the licensee's business operations,
1outsourcing arrangements, and information systems. If a licensee identifies areas,
2systems, or processes that require material improvement, updating, or redesign, the
3insurer shall document the identification and remedial efforts to address the areas,
4systems, or processes. The licensee shall maintain the documentation for a period
5of at least 5 years starting from the date the documentation was created and shall
6produce the documentation upon demand of the commissioner.
SB160,11,12
7(5) Incident response plan. As part of its information security program, a
8licensee shall develop an incident response plan to promptly respond to, and recover
9from, a cybersecurity event that compromises the confidentiality, integrity, or
10availability of nonpublic information, the licensee's information systems, or the
11continuing functionality of any aspect of the licensee's business or operations. The
12incident response plan shall be in writing and address all of the following:
SB160,11,1313
(a) The goals of the incident response plan.
SB160,11,1414
(b) The internal process for responding to a cybersecurity event.
SB160,11,1615
(c) The identification of clear roles, responsibilities, and levels of
16decision-making authority during and immediately following a cybersecurity event.
SB160,11,1817
(d) The external and internal communications and information sharing during
18and immediately following a cybersecurity event.
SB160,11,2019
(e) Requirements for the remediation of identified weaknesses in the
20information systems and associated controls.
SB160,11,2221
(f) The reporting and documentation of a cybersecurity event and related
22incident response activities.
SB160,11,2423
(g) The evaluation and revision of the incident response plan following a
24cybersecurity event.
SB160,12,5
1(6) Oversight of 3rd-party service provider arrangements. No later than 2
2years after the effective date of this subsection .... [LRB inserts date], a licensee shall
3exercise due diligence in selecting a 3rd-party service provider. The licensee shall
4make reasonable efforts to require a 3rd-party service provider to do all of the
5following:
SB160,12,86
(a) Implement appropriate administrative, technical, and physical measures
7to protect and secure the information systems and nonpublic information that are
8accessible to or held by the 3rd-party service provider.
SB160,12,99
(b) Report a cybersecurity event under s. 601.954.
SB160,12,12
10(7) Oversight by board of directors. If a licensee has a board of directors, the
11board or an appropriate committee of the board shall, at a minimum, do all of the
12following:
SB160,12,1413
(a) Require the licensee's executive management to develop, implement, and
14maintain the information security program under sub. (1).
SB160,12,1615
(b) Oversee the development, implementation, and maintenance of the
16information security program.
SB160,12,1817
(c) Require the licensee's executive management to report, at least annually,
18all of the following information to the board:
SB160,12,2019
1. The overall status of the information security program and the licensee's
20compliance with this subchapter.
SB160,12,2321
2. Material matters relating to the information security program, including
22issues relating to risk assessment, risk management and control decisions,
233rd-party service provider arrangements, and security testing.
SB160,12,2424
3. Recommendations for modifications to the information security program.
SB160,13,7
1(8) Annual certification to commissioner. Beginning in the year that is 2
2years after the effective date of this subsection .... [LRB inserts date], a licensee who
3is domiciled in this state shall annually submit, no later than March 1, to the
4commissioner a written certification that the licensee is in compliance with the
5requirements of this section. The licensee shall maintain all records, schedules, and
6data supporting the certification for a period of at least 5 years and shall produce the
7records, schedules, and data upon demand of the commissioner.
SB160,13,9
8(9) Exemptions. (a) This section does not apply to a licensee who meets any
9of the following criteria:
SB160,13,1010
1. Has less than $10,000,000 in year-end total assets.
SB160,13,1111
2. Has less than $5,000,000 in gross annual revenue.
SB160,13,1312
3. Has fewer than 25 employees, including independent contractors, who work
13at least 30 hours a week for the licensee.
SB160,13,1614
(b) The commissioner may issue an order to a licensee who is otherwise exempt
15under par. (a) to comply with this section if the commissioner determines that the
16order is warranted by the licensee's unique circumstances.
SB160,13,1917
(c) A licensee who ceases to qualify for the exemption under par. (a) or who
18receives an order under par. (b) shall comply with this section no later than 180 days
19after the date the licensee ceases to qualify or receives the order.
SB160,6
20Section
6. 601.953 of the statutes is created to read:
SB160,13,25
21601.953 Investigation of cybersecurity event.
(1) If a licensee learns that
22a cybersecurity event involving the licensee's information systems or nonpublic
23information has or may have occurred, the licensee, or an outside vendor or service
24provider designated to act on behalf of the licensee, shall conduct a prompt
25investigation that, at a minimum, includes all of the following:
SB160,14,1
1(a) An assessment of the nature and scope of the cybersecurity event.
SB160,14,32
(b) The identification of any nonpublic information that was or may have been
3involved in the cybersecurity event.
SB160,14,64
(c) The performance of reasonable measures to restore the security of the
5licensee's information systems compromised in the cybersecurity event and prevent
6additional unauthorized acquisition, release, or use of nonpublic information.
SB160,14,11
7(2) If a licensee knows that a cybersecurity event has or may have occurred in
8an information system maintained by a 3rd-party service provider, the licensee shall
9comply with sub. (1) or make reasonable efforts to confirm and document that the
103rd-party service provider has either complied with sub. (1) or failed to cooperate
11with the investigation under sub. (1).
SB160,14,14
12(3) The licensee shall maintain records concerning a cybersecurity event for a
13period of at least 5 years starting from the date of the cybersecurity event and shall
14produce the records upon demand of the commissioner.
SB160,7
15Section
7. 601.954 of the statutes is created to read:
SB160,14,19
16601.954 Notification of a cybersecurity event. (1)
Notification to the
17commissioner. (a) A licensee shall notify the commissioner that a cybersecurity
18event involving nonpublic information has occurred if any of the following conditions
19is met:
SB160,14,2220
1. The licensee is domiciled in this state
and the cybersecurity event has a
21reasonable likelihood of materially harming a consumer or a material part of the
22normal operations of the licensee.
SB160,14,2523
2. The cybersecurity event is any of the following and the licensee reasonably
24believes that the cybersecurity event involves the nonpublic information of at least
25250 consumers:
SB160,15,3
1a. A cybersecurity event for which notice is required to be provided to a
2government body, self-regulatory agency, or other supervisory entity under state or
3federal law.
SB160,15,54
b. A cybersecurity event that has a reasonable likelihood of materially harming
5a consumer or a material part of the normal operations of the licensee.
SB160,15,96
(b) A licensee shall provide the notification under par. (a) in electronic form and
7as promptly as possible, but no later than 3 business days from the determination
8that the cybersecurity event occurred. In the notification, the licensee shall provide
9as much of the following information as possible:
SB160,15,1110
1. The date and source of the cybersecurity event and the time period during
11which information systems were compromised by the cybersecurity event.
SB160,15,1212
2. A description of how the cybersecurity event was discovered.
SB160,15,1513
3. A description of how the nonpublic information was exposed, lost, stolen, or
14breached and an explanation of how the information has been, or is in the process
15of being, recovered.
SB160,15,1816
4. A description of the specific data elements, including types of medical,
17financial, and personally identifiable information, that were acquired without
18authorization.
SB160,15,1919
5. The number of consumers affected by the cybersecurity event.
SB160,15,2120
6. A description of efforts to address the circumstances that allowed the
21cybersecurity event to occur.
SB160,15,2322
7. The results of any internal review related to the cybersecurity event,
23including the identification of a lapse in automated controls or internal procedures.
SB160,16,3
18.
Whether the licensee notified a government body, self-regulatory agency, or
2other supervisory entity of the cybersecurity event and, if applicable, the date the
3notification was provided.
SB160,16,64
9. A copy of the licensee's privacy policy and a statement outlining the steps the
5licensee will take, or has taken, to investigate and notify consumers affected by the
6cybersecurity event.
SB160,16,87
10. The name of a contact person who is familiar with the cybersecurity event
8and authorized to act for the licensee.
SB160,16,119
(c) The licensee shall update and supplement the information provided under
10par. (b) to address material changes to the information as additional information
11becomes available to the licensee.
SB160,16,21
12(2) Notice to consumers and producers of record. A licensee required to
13notify the commissioner under sub. (1) shall comply with s. 134.98, if applicable, and
14provide to the commissioner a copy of any notice sent under s. 134.98 (2). If the
15licensee is an insurer whose services are accessed by consumers through an
16independent insurance producer, the licensee shall notify the producer of record of
17any consumers affected by the cybersecurity event no later than the date at which
18notice is provided under s. 134.98, except that notice is not required to a producer of
19record who is not authorized by law or contract to sell, solicit, or negotiate on behalf
20of the licensee or if the licensee does not have the current producer of record
21information for a consumer.
SB160,17,3
22(3) Third-party service providers. If the licensee has knowledge of a
23cybersecurity event involving an information system maintained by a 3rd-party
24service provider, the licensee shall provide notice to the commissioner no later than
253 days after the earlier of the date the 3rd-party service provider notifies the licensee
1of the cybersecurity event or the licensee has actual knowledge of the cybersecurity
2event. The licensee is not required to comply with this subsection if the 3rd-party
3service provider provides notice under sub. (1).
SB160,17,14
4(4) Reinsurers. In the event of a cybersecurity event involving nonpublic
5information, or involving an information system maintained by a 3rd-party service
6provider, a licensee who is acting as an assuming insurer and who does not have a
7direct contractual relationship with consumers affected by the cybersecurity event
8shall notify the ceding insurer and the commissioner of the licensee's state of domicile
9of the cybersecurity event no later than 3 business days after learning of the
10cybersecurity event. The licensee shall have no other notice obligations relating to
11a cybersecurity event or other data breach under this section or any other law of this
12state. A ceding insurer who has a direct contractual relationship with the affected
13consumers shall comply with the notification requirements under this section and,
14if applicable, the requirements under s. 134.98.
SB160,8
15Section
8. 601.955 of the statutes is created to read: