SB784,11,16 (f) The reporting and documentation of a cybersecurity event and related incident response activities.

SB784,11,18 (g) The evaluation and revision of the incident response plan following a cybersecurity event.

SB784,11,23 (6) Oversight of 3rd-party service provider arrangements. No later than 2 years after the effective date of this subsection .... [LRB inserts date], a licensee shall exercise due diligence in selecting a 3rd-party service provider. The licensee shall make reasonable efforts to require a 3rd-party service provider to do all of the following:

SB784,12,3 (a) Implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to or held by the 3rd-party service provider.

SB784,12,4 (b) Report a cybersecurity event under s. 601.954.

SB784,12,7 (7) Oversight by board of directors. If a licensee has a board of directors, the board or an appropriate committee of the board shall, at a minimum, do all of the following:

SB784,12,9 (a) Require the licensee's executive management to develop, implement, and maintain the information security program under sub. (1).

SB784,12,11 (b) Oversee the development, implementation, and maintenance of the information security program.

SB784,12,13 (c) Require the licensee's executive management to report, at least annually, all of the following information to the board:

SB784,12,15 1. The overall status of the information security program and the licensee's compliance with this subchapter.

SB784,12,18 2. Material matters relating to the information security program, including issues relating to risk assessment, risk management and control decisions, 3rd-party service provider arrangements, and security testing.

SB784,12,19 3. Recommendations for modifications to the information security program.

SB784,13,2 (8) Annual certification to commissioner. Beginning in the year that is 2 years after the effective date of this subsection .... [LRB inserts date], a licensee who is domiciled in this state shall annually submit, no later than March 1, to the commissioner a written certification that the licensee is in compliance with the requirements of this section. The licensee shall maintain all records, schedules, and data supporting the certification for a period of at least 5 years and shall produce the records, schedules, and data upon demand of the commissioner.

SB784,13,4 (9) Exemptions. (a) This section does not apply to a licensee who meets any of the following criteria:

SB784,13,5 1. Has less than $10,000,000 in year-end total assets.

SB784,13,6 2. Has less than $5,000,000 in gross annual revenue.

SB784,13,8 3. Has fewer than 25 employees, including independent contractors, who work at least 30 hours a week for the licensee.

SB784,13,11 (b) The commissioner may issue an order to a licensee who is otherwise exempt under par. (a) to comply with this section if the commissioner determines that the order is warranted by the licensee's unique circumstances.

SB784,13,14 (c) A licensee who ceases to qualify for the exemption under par. (a) or who receives an order under par. (b) shall comply with this section no later than 180 days after the date the licensee ceases to qualify or receives the order.

SB784,6 Section 6. 601.953 of the statutes is created to read:

SB784,13,20 601.953 Investigation of cybersecurity event. (1) If a licensee learns that a cybersecurity event involving the licensee's information systems or nonpublic information has or may have occurred, the licensee, or an outside vendor or service provider designated to act on behalf of the licensee, shall conduct a prompt investigation that, at a minimum, includes all of the following:

SB784,13,21 (a) An assessment of the nature and scope of the cybersecurity event.

SB784,13,23 (b) The identification of any nonpublic information that was or may have been involved in the cybersecurity event.

SB784,14,3 (c) The performance of reasonable measures to restore the security of the licensee's information systems compromised in the cybersecurity event and prevent additional unauthorized acquisition, release, or use of nonpublic information.

SB784,14,8 (2) If a licensee knows that a cybersecurity event has or may have occurred in an information system maintained by a 3rd-party service provider, the licensee shall comply with sub. (1) or make reasonable efforts to confirm and document that the 3rd-party service provider has either complied with sub. (1) or failed to cooperate with the investigation under sub. (1).

SB784,14,11 (3) The licensee shall maintain records concerning a cybersecurity event for a period of at least 5 years starting from the date of the cybersecurity event and shall produce the records upon demand of the commissioner.

SB784,7 Section 7. 601.954 of the statutes is created to read:

SB784,14,16 601.954 Notification of a cybersecurity event. (1) Notification to the commissioner. (a) A licensee shall notify the commissioner that a cybersecurity event involving nonpublic information has occurred if any of the following conditions is met:

SB784,14,19 1. The licensee is domiciled in this state and the cybersecurity event has a reasonable likelihood of materially harming a consumer or a material part of the normal operations of the licensee.