SB160,13,13 3. Has fewer than 25 employees, including independent contractors, who work at least 30 hours a week for the licensee.

SB160,13,16 (b) The commissioner may issue an order to a licensee who is otherwise exempt under par. (a) to comply with this section if the commissioner determines that the order is warranted by the licensee's unique circumstances.

SB160,13,19 (c) A licensee who ceases to qualify for the exemption under par. (a) or who receives an order under par. (b) shall comply with this section no later than 180 days after the date the licensee ceases to qualify or receives the order.

SB160,6 Section 6. 601.953 of the statutes is created to read:

SB160,13,25 601.953 Investigation of cybersecurity event. (1) If a licensee learns that a cybersecurity event involving the licensee's information systems or nonpublic information has or may have occurred, the licensee, or an outside vendor or service provider designated to act on behalf of the licensee, shall conduct a prompt investigation that, at a minimum, includes all of the following:

SB160,14,1 (a) An assessment of the nature and scope of the cybersecurity event.

SB160,14,3 (b) The identification of any nonpublic information that was or may have been involved in the cybersecurity event.

SB160,14,6 (c) The performance of reasonable measures to restore the security of the licensee's information systems compromised in the cybersecurity event and prevent additional unauthorized acquisition, release, or use of nonpublic information.

SB160,14,11 (2) If a licensee knows that a cybersecurity event has or may have occurred in an information system maintained by a 3rd-party service provider, the licensee shall comply with sub. (1) or make reasonable efforts to confirm and document that the 3rd-party service provider has either complied with sub. (1) or failed to cooperate with the investigation under sub. (1).

SB160,14,14 (3) The licensee shall maintain records concerning a cybersecurity event for a period of at least 5 years starting from the date of the cybersecurity event and shall produce the records upon demand of the commissioner.

SB160,7 Section 7. 601.954 of the statutes is created to read:

SB160,14,19 601.954 Notification of a cybersecurity event. (1) Notification to the commissioner. (a) A licensee shall notify the commissioner that a cybersecurity event involving nonpublic information has occurred if any of the following conditions is met:

SB160,14,22 1. The licensee is domiciled in this state and the cybersecurity event has a reasonable likelihood of materially harming a consumer or a material part of the normal operations of the licensee.

SB160,14,25 2. The cybersecurity event is any of the following and the licensee reasonably believes that the cybersecurity event involves the nonpublic information of at least 250 consumers:

SB160,15,3 a. A cybersecurity event for which notice is required to be provided to a government body, self-regulatory agency, or other supervisory entity under state or federal law.

SB160,15,5 b. A cybersecurity event that has a reasonable likelihood of materially harming a consumer or a material part of the normal operations of the licensee.

SB160,15,9 (b) A licensee shall provide the notification under par. (a) in electronic form and as promptly as possible, but no later than 3 business days from the determination that the cybersecurity event occurred. In the notification, the licensee shall provide as much of the following information as possible:

SB160,15,11 1. The date and source of the cybersecurity event and the time period during which information systems were compromised by the cybersecurity event.

SB160,15,12 2. A description of how the cybersecurity event was discovered.

SB160,15,15 3. A description of how the nonpublic information was exposed, lost, stolen, or breached and an explanation of how the information has been, or is in the process of being, recovered.

SB160,15,18 4. A description of the specific data elements, including types of medical, financial, and personally identifiable information, that were acquired without authorization.

SB160,15,19 5. The number of consumers affected by the cybersecurity event.

SB160,15,21 6. A description of efforts to address the circumstances that allowed the cybersecurity event to occur.

SB160,15,23 7. The results of any internal review related to the cybersecurity event, including the identification of a lapse in automated controls or internal procedures.

SB160,16,3 8. Whether the licensee notified a government body, self-regulatory agency, or other supervisory entity of the cybersecurity event and, if applicable, the date the notification was provided.

SB160,16,6 9. A copy of the licensee's privacy policy and a statement outlining the steps the licensee will take, or has taken, to investigate and notify consumers affected by the cybersecurity event.

SB160,16,8 10. The name of a contact person who is familiar with the cybersecurity event and authorized to act for the licensee.

SB160,16,11 (c) The licensee shall update and supplement the information provided under par. (b) to address material changes to the information as additional information becomes available to the licensee.

SB160,16,21 (2) Notice to consumers and producers of record. A licensee required to notify the commissioner under sub. (1) shall comply with s. 134.98, if applicable, and provide to the commissioner a copy of any notice sent under s. 134.98 (2). If the licensee is an insurer whose services are accessed by consumers through an independent insurance producer, the licensee shall notify the producer of record of any consumers affected by the cybersecurity event no later than the date at which notice is provided under s. 134.98, except that notice is not required to a producer of record who is not authorized by law or contract to sell, solicit, or negotiate on behalf of the licensee or if the licensee does not have the current producer of record information for a consumer.