This is the preview version of the Wisconsin State Legislature site.
Please see http://docs.legis.wisconsin.gov for the production version.
SB160-SSA1,5,8 4(6) “Information system” means a discrete set of electronic information
5resources organized for the collection, processing, maintenance, use, sharing,
6dissemination, or disposition of nonpublic information, as well as any specialized
7system, including an industrial or process controls system, telephone switching and
8private branch exchange system, and environmental control system.
SB160-SSA1,5,13 9(7) “Licensee” means a person licensed, authorized, or registered, or a person
10required to be licensed, authorized, or registered, under chs. 600 to 655, other than
11a purchasing or risk retention group that is chartered and licensed in another state
12or a person acting as an assuming insurer that is domiciled in another state or
13jurisdiction.
SB160-SSA1,5,15 14(8) “Multifactor authentication” means authentication through verification of
15at least 2 of the following types of authentication factors:
SB160-SSA1,5,1616 (a) Knowledge factor, including a password.
SB160-SSA1,5,1717 (b) Possession factor, including a token or text message on a mobile phone.
SB160-SSA1,5,1818 (c) Inherence factor, including a biometric characteristic.
SB160-SSA1,5,21 19(9) “Nonpublic information” means electronic information in the possession,
20custody, or control of a licensee that is not publicly available information and is any
21of the following:
SB160-SSA1,5,2322 (a) Information concerning a consumer that can be used to identify the
23consumer, in combination with at least one of the following data elements:
SB160-SSA1,5,2424 1. Social security number.
SB160-SSA1,5,2525 2. Driver's license number or nondriver identification card number.
SB160-SSA1,6,1
13. Financial account number or credit or debit card number.
SB160-SSA1,6,32 4. Security code, access code, or password that permits access to a financial
3account.
SB160-SSA1,6,44 5. Biometric records.
SB160-SSA1,6,85 (b) Information or data, other than information or data regarding age or
6gender, in any form or medium created by or derived from a health care provider or
7a consumer that can be used to identify the consumer and that relates to any of the
8following:
SB160-SSA1,6,109 1. The physical, mental, or behavioral health or condition of the consumer or
10a member of the consumer's family.
SB160-SSA1,6,1111 2. The provision of health care to the consumer.
SB160-SSA1,6,1212 3. Payment for the provision of health care to the consumer.
SB160-SSA1,6,16 13(10) “Publicly available information” means information that a licensee has a
14reasonable basis to believe is lawfully made available to the general public from
15federal, state, or local government records, widely distributed media, or disclosures
16required by federal, state, or local law.
SB160-SSA1,6,20 17(11) “Third-party service provider” means a person other than a licensee who
18contracts with a licensee to maintain, process, or store nonpublic information or is
19otherwise permitted access to nonpublic information through its provision of
20services to the licensee.
SB160-SSA1,4 21Section 4. 601.951 of the statutes is created to read:
SB160-SSA1,7,2 22601.951 General provisions. (1) Exclusive state standards. This
23subchapter establishes the exclusive state standards applicable to licensees for data
24security, the investigation of a cybersecurity event, and notification of a

1cybersecurity event or unauthorized access to nonpublic information to the state
2government and consumers.
SB160-SSA1,7,7 3(2) Exceptions to applicability. (a) This subchapter does not apply to a person
4who is an employee, agent, representative, or designee of a licensee and who is also
5a licensee to the extent that the person is covered by the information security
6program of the other licensee and the other licensee has complied with this
7subchapter on behalf of the person.
SB160-SSA1,7,158 (b) A licensee affiliated with a depository institution that maintains an
9information security program in compliance with the interagency guidelines
10establishing information security standards as set forth pursuant to 15 USC 6801
11and 6805 shall be considered to meet the requirements of this subchapter, provided
12that the licensee produces, upon request of the commissioner, documentation
13satisfactory to the commissioner that independently validates the adoption by the
14affiliated depository institution of an information security program that satisfies the
15interagency guidelines.
SB160-SSA1,7,2416 (c) A licensee affiliated with a legal entity established pursuant to the federal
17farm credit act of 1971, 12 USC 2001, et seq., that maintains an information security
18program in compliance with the farm credit administration's guidance and
19regulations establishing policies and procedures to address data security and
20integrity shall be considered to meet the requirements of this subchapter, provided
21that the licensee produces, upon request of the commissioner, documentation
22satisfactory to the commissioner that independently validates the adoption by the
23affiliated legal entity of an information security program that satisfies the farm
24credit administration's guidance and regulations.
SB160-SSA1,8,4
1(d) This subchapter, except for s. 601.954 (1), does not apply to a licensee who
2is subject to and governed by 45 CFR Parts 160 and 164 and who maintains nonpublic
3information in the same manner as protected health information under 45 CFR
4Parts 160
and 164.
SB160-SSA1,8,65 (e) If a licensee ceases to qualify for an exception under par. (a) to (d), the
6licensee shall have 180 days to comply with this subchapter.
SB160-SSA1,8,10 7(3) Agreements between parties. Nothing in this subchapter shall prevent or
8abrogate an agreement between a licensee and another licensee, a 3rd-party service
9provider, or another party to fulfill any of the requirements under s. 601.953 or
10601.954.
SB160-SSA1,8,13 11(4) Private cause of action. This subchapter may not be construed to create
12or imply a private cause of action for violation of its provisions or to curtail a private
13cause of action that otherwise exists in the absence of this subchapter.
SB160-SSA1,8,15 14(5) Rules. The commissioner may promulgate rules that are necessary to carry
15out the provisions of this subchapter.
SB160-SSA1,5 16Section 5. 601.952 of the statutes is created to read:
SB160-SSA1,8,24 17601.952 Information security program. (1) Implementation of program.
18No later than one year after the effective date of this subsection .... [LRB inserts
19date], a licensee shall develop, implement, and maintain a comprehensive written
20information security program based on the licensee's risk assessment under sub. (2)
21and consistent with the conditions of sub. (3) (a). The program shall contain
22administrative, technical, and physical safeguards for the protection of the licensee's
23information systems and nonpublic information. The licensee shall design the
24program to do all of the following:
SB160-SSA1,9,2
1(a) Protect against threats and hazards to the security and integrity of the
2information systems and nonpublic information.
SB160-SSA1,9,53 (b) Protect against unauthorized access to and use of nonpublic information
4and minimize the likelihood of harm to a consumer from the unauthorized access or
5use.
SB160-SSA1,9,86 (c) Establish and periodically reevaluate a schedule for retention and disposal
7of nonpublic information and establish a mechanism for the destruction of nonpublic
8information that is no longer needed.
SB160-SSA1,9,10 9(2) Risk assessment. The licensee shall conduct a risk assessment under which
10the licensee shall do all of the following:
SB160-SSA1,9,1411 (a) Identify reasonably foreseeable internal and external threats that could
12result in unauthorized access to or transmission, disclosure, misuse, alteration, or
13destruction of nonpublic information, including nonpublic information that is
14accessible to or held by 3rd-party service providers of the licensee.
SB160-SSA1,9,1615 (b) Assess the likelihood and potential damage of the threats identified under
16par. (a), taking into consideration the sensitivity of the nonpublic information.
SB160-SSA1,9,1917 (c) Assess the sufficiency of policies, procedures, information systems, and
18other safeguards to manage the threats identified under par. (a) in each relevant
19area of the licensee's operations, including all of the following:
SB160-SSA1,9,2020 1. Employee training and management.
SB160-SSA1,9,2221 2. Information systems, including the classification, governance, processing,
22storage, transmission, and disposal of information.
SB160-SSA1,9,2423 3. Processes for detecting, preventing, and responding to attacks, intrusions,
24and other system failures.
SB160-SSA1,10,2
1(3) Risk management. Based on the risk assessment under sub. (2), the licensee
2shall do all of the following:
SB160-SSA1,10,63 (a) Design an information security program to mitigate the identified threats,
4commensurate with the size and complexity of the licensee, the nature and scope of
5the licensee's activities, including its use of 3rd-party service providers, and the
6sensitivity of the nonpublic information.
SB160-SSA1,10,77 (b) Implement the following security measures, as appropriate:
SB160-SSA1,10,88 1. Place access controls on information systems.
SB160-SSA1,10,129 2. Identify and manage the data, personnel, devices, systems, and facilities
10that enable the licensee to achieve its business purposes, taking into consideration
11the relative importance of the data, personnel, devices, systems, and facilities to the
12business objectives and risk strategy of the licensee.
SB160-SSA1,10,1413 3. Restrict physical access to nonpublic information to authorized individuals
14only.
SB160-SSA1,10,1715 4. Protect, by encryption or other means, nonpublic information being
16transmitted over an external network and nonpublic information stored on a
17portable computer or storage device or media.
SB160-SSA1,10,1918 5. Adopt secure development practices for applications that are developed
19in-house and utilized by the licensee.
SB160-SSA1,10,2120 6. Modify information systems in accordance with the licensee's information
21security program.
SB160-SSA1,10,2322 7. Utilize effective controls, which may include multifactor authentication
23procedures for employees accessing nonpublic information.
SB160-SSA1,10,2524 8. Implement regular testing and monitoring of systems and procedures to
25detect actual and attempted attacks on, or intrusions into, an information system.
SB160-SSA1,11,4
19. Include audit trails within the information security program that are
2designed to detect and respond to cybersecurity events and to reconstruct material
3financial transactions sufficient to support the normal operations and obligations of
4the licensee.
SB160-SSA1,11,75 10. Implement measures to protect against the destruction, loss, or damage of
6nonpublic information due to environmental hazards, natural and other disasters,
7and technological failures.
SB160-SSA1,11,98 11. Develop, implement, and maintain practices for the secure disposal of
9nonpublic information in all formats.
SB160-SSA1,11,1110 (c) Designate at least one employee, affiliate, or outside vendor as responsible
11for the information security program.
SB160-SSA1,11,1312 (d) Stay informed regarding emerging threats and vulnerabilities and
13implement safeguards to manage the threats and vulnerabilities.
SB160-SSA1,11,1514 (e) No less than annually, assess the effectiveness of security safeguards,
15including key controls, systems, and procedures.
SB160-SSA1,11,1716 (f) Include cybersecurity risks in the licensee's enterprise risk management
17process.
SB160-SSA1,11,1918 (g) Utilize reasonable security measures when sharing information, taking
19into consideration the character of the sharing and the type of information shared.
SB160-SSA1,11,2120 (h) Provide personnel with cybersecurity awareness training that is updated
21as necessary.
SB160-SSA1,12,6 22(4) Program adjustments. The licensee shall monitor, evaluate, and adjust the
23information security program under sub. (1) consistent with changes in technology,
24the sensitivity of the nonpublic information, internal and external threats to
25nonpublic information, and changes to the licensee's business operations,

1outsourcing arrangements, and information systems. If a licensee identifies areas,
2systems, or processes that require material improvement, updating, or redesign, the
3insurer shall document the identification and remedial efforts to address the areas,
4systems, or processes. The licensee shall maintain the documentation for a period
5of at least 5 years starting from the date the documentation was created and shall
6produce the documentation upon demand of the commissioner.
SB160-SSA1,12,12 7(5) Incident response plan. As part of its information security program, a
8licensee shall develop an incident response plan to promptly respond to, and recover
9from, a cybersecurity event that compromises the confidentiality, integrity, or
10availability of nonpublic information, the licensee's information systems, or the
11continuing functionality of any aspect of the licensee's business or operations. The
12incident response plan shall be in writing and address all of the following:
SB160-SSA1,12,1313 (a) The goals of the incident response plan.
SB160-SSA1,12,1414 (b) The internal process for responding to a cybersecurity event.
SB160-SSA1,12,1615 (c) The identification of clear roles, responsibilities, and levels of
16decision-making authority during and immediately following a cybersecurity event.
SB160-SSA1,12,1817 (d) The external and internal communications and information sharing during
18and immediately following a cybersecurity event.
SB160-SSA1,12,2019 (e) Requirements for the remediation of identified weaknesses in the
20information systems and associated controls.
SB160-SSA1,12,2221 (f) The reporting and documentation of a cybersecurity event and related
22incident response activities.
SB160-SSA1,12,2423 (g) The evaluation and revision of the incident response plan following a
24cybersecurity event.
SB160-SSA1,13,4
1(6) Oversight of 3rd-party service provider arrangements. A licensee shall
2exercise due diligence when selecting any 3rd-party service provider. The licensee
3shall make reasonable efforts to require a 3rd-party service provider to do all of the
4following:
SB160-SSA1,13,75 (a) Implement appropriate administrative, technical, and physical measures
6to protect and secure the information systems and nonpublic information that are
7accessible to or held by the 3rd-party service provider.
SB160-SSA1,13,88 (b) Report a cybersecurity event under s. 601.954.
SB160-SSA1,13,11 9(7) Oversight by board of directors. If a licensee has a board of directors, the
10board or an appropriate committee of the board shall, at a minimum, do all of the
11following:
SB160-SSA1,13,1312 (a) Require the licensee's executive management to develop, implement, and
13maintain the information security program under sub. (1).
SB160-SSA1,13,1514 (b) Oversee the development, implementation, and maintenance of the
15information security program.
SB160-SSA1,13,1716 (c) Require the licensee's executive management to report, at least annually,
17all of the following information to the board:
SB160-SSA1,13,1918 1. The overall status of the information security program and the licensee's
19compliance with this subchapter.
SB160-SSA1,13,2220 2. Material matters relating to the information security program, including
21issues relating to risk assessment, risk management and control decisions,
223rd-party service provider arrangements, and security testing.
SB160-SSA1,13,2323 3. Recommendations for modifications to the information security program.
SB160-SSA1,14,5 24(8) Annual certification to commissioner. Beginning in the year that is 2
25years after the effective date of this subsection .... [LRB inserts date], a licensee who

1is domiciled in this state shall annually submit, no later than March 1, to the
2commissioner a written certification that the licensee is in compliance with the
3requirements of this section. The licensee shall maintain all records, schedules, and
4data supporting the certification for a period of at least 5 years and shall produce the
5records, schedules, and data upon demand of the commissioner.
SB160-SSA1,14,7 6(9) Exemptions. (a) This section does not apply to a licensee who meets any
7of the following criteria:
SB160-SSA1,14,88 1. Has less than $10,000,000 in year-end total assets.
SB160-SSA1,14,99 2. Has less than $5,000,000 in gross annual revenue.
SB160-SSA1,14,1110 3. Has fewer than 50 employees, including independent contractors, who work
11at least 30 hours a week for the licensee.
SB160-SSA1,14,1412 (b) A licensee who ceases to qualify for the exemption under par. (a) shall
13comply with this section no later than 180 days after the date the licensee ceases to
14qualify or receives the order.
SB160-SSA1,6 15Section 6. 601.953 of the statutes is created to read:
SB160-SSA1,14,20 16601.953 Investigation of cybersecurity event. (1) If a licensee learns that
17a cybersecurity event involving the licensee's information systems or nonpublic
18information has or may have occurred, the licensee, or an outside vendor or service
19provider designated to act on behalf of the licensee, shall conduct a prompt
20investigation that, at a minimum, includes all of the following:
SB160-SSA1,14,2121 (a) An assessment of the nature and scope of the cybersecurity event.
Loading...
Loading...