AB147-ASA1,10,88
1. Place access controls on information systems.
AB147-ASA1,10,129
2. Identify and manage the data, personnel, devices, systems, and facilities
10that enable the licensee to achieve its business purposes, taking into consideration
11the relative importance of the data, personnel, devices, systems, and facilities to the
12business objectives and risk strategy of the licensee.
AB147-ASA1,10,1413
3. Restrict physical access to nonpublic information to authorized individuals
14only.
AB147-ASA1,10,1715
4. Protect, by encryption or other means, nonpublic information being
16transmitted over an external network and nonpublic information stored on a
17portable computer or storage device or media.
AB147-ASA1,10,1918
5. Adopt secure development practices for applications that are developed
19in-house and utilized by the licensee.
AB147-ASA1,10,2120
6. Modify information systems in accordance with the licensee's information
21security program.
AB147-ASA1,10,2322
7. Utilize effective controls, which may include multifactor authentication
23procedures for employees accessing nonpublic information.
AB147-ASA1,10,2524
8. Implement regular testing and monitoring of systems and procedures to
25detect actual and attempted attacks on, or intrusions into, an information system.
AB147-ASA1,11,4
19. Include audit trails within the information security program that are
2designed to detect and respond to cybersecurity events and to reconstruct material
3financial transactions sufficient to support the normal operations and obligations of
4the licensee.
AB147-ASA1,11,75
10. Implement measures to protect against the destruction, loss, or damage of
6nonpublic information due to environmental hazards, natural and other disasters,
7and technological failures.
AB147-ASA1,11,98
11. Develop, implement, and maintain practices for the secure disposal of
9nonpublic information in all formats.
AB147-ASA1,11,1110
(c) Designate at least one employee, affiliate, or outside vendor as responsible
11for the information security program.
AB147-ASA1,11,1312
(d) Stay informed regarding emerging threats and vulnerabilities and
13implement safeguards to manage the threats and vulnerabilities.
AB147-ASA1,11,1514
(e) No less than annually, assess the effectiveness of security safeguards,
15including key controls, systems, and procedures.
AB147-ASA1,11,1716
(f) Include cybersecurity risks in the licensee's enterprise risk management
17process.
AB147-ASA1,11,1918
(g) Utilize reasonable security measures when sharing information, taking
19into consideration the character of the sharing and the type of information shared.
AB147-ASA1,11,2120
(h) Provide personnel with cybersecurity awareness training that is updated
21as necessary.
AB147-ASA1,12,6
22(4) Program adjustments. The licensee shall monitor, evaluate, and adjust the
23information security program under sub. (1) consistent with changes in technology,
24the sensitivity of the nonpublic information, internal and external threats to
25nonpublic information, and changes to the licensee's business operations,
1outsourcing arrangements, and information systems. If a licensee identifies areas,
2systems, or processes that require material improvement, updating, or redesign, the
3insurer shall document the identification and remedial efforts to address the areas,
4systems, or processes. The licensee shall maintain the documentation for a period
5of at least 5 years starting from the date the documentation was created and shall
6produce the documentation upon demand of the commissioner.
AB147-ASA1,12,12
7(5) Incident response plan. As part of its information security program, a
8licensee shall develop an incident response plan to promptly respond to, and recover
9from, a cybersecurity event that compromises the confidentiality, integrity, or
10availability of nonpublic information, the licensee's information systems, or the
11continuing functionality of any aspect of the licensee's business or operations. The
12incident response plan shall be in writing and address all of the following:
AB147-ASA1,12,1313
(a) The goals of the incident response plan.
AB147-ASA1,12,1414
(b) The internal process for responding to a cybersecurity event.
AB147-ASA1,12,1615
(c) The identification of clear roles, responsibilities, and levels of
16decision-making authority during and immediately following a cybersecurity event.
AB147-ASA1,12,1817
(d) The external and internal communications and information sharing during
18and immediately following a cybersecurity event.
AB147-ASA1,12,2019
(e) Requirements for the remediation of identified weaknesses in the
20information systems and associated controls.
AB147-ASA1,12,2221
(f) The reporting and documentation of a cybersecurity event and related
22incident response activities.
AB147-ASA1,12,2423
(g) The evaluation and revision of the incident response plan following a
24cybersecurity event.
AB147-ASA1,13,4
1(6) Oversight of 3rd-party service provider arrangements. A licensee shall
2exercise due diligence when selecting any 3rd-party service provider. The licensee
3shall make reasonable efforts to require a 3rd-party service provider to do all of the
4following:
AB147-ASA1,13,75
(a) Implement appropriate administrative, technical, and physical measures
6to protect and secure the information systems and nonpublic information that are
7accessible to or held by the 3rd-party service provider.
AB147-ASA1,13,88
(b) Report a cybersecurity event under s. 601.954.