AB147-ASA1,13,2323 3. Recommendations for modifications to the information security program.
AB147-ASA1,14,5 24(8) Annual certification to commissioner. Beginning in the year that is 2
25years after the effective date of this subsection .... [LRB inserts date], a licensee who

1is domiciled in this state shall annually submit, no later than March 1, to the
2commissioner a written certification that the licensee is in compliance with the
3requirements of this section. The licensee shall maintain all records, schedules, and
4data supporting the certification for a period of at least 5 years and shall produce the
5records, schedules, and data upon demand of the commissioner.
AB147-ASA1,14,7 6(9) Exemptions. (a) This section does not apply to a licensee who meets any
7of the following criteria:
AB147-ASA1,14,88 1. Has less than $10,000,000 in year-end total assets.
AB147-ASA1,14,99 2. Has less than $5,000,000 in gross annual revenue.
AB147-ASA1,14,1110 3. Has fewer than 50 employees, including independent contractors, who work
11at least 30 hours a week for the licensee.
AB147-ASA1,14,1412 (b) A licensee who ceases to qualify for the exemption under par. (a) shall
13comply with this section no later than 180 days after the date the licensee ceases to
14qualify or receives the order.
AB147-ASA1,6 15Section 6. 601.953 of the statutes is created to read:
AB147-ASA1,14,20 16601.953 Investigation of cybersecurity event. (1) If a licensee learns that
17a cybersecurity event involving the licensee's information systems or nonpublic
18information has or may have occurred, the licensee, or an outside vendor or service
19provider designated to act on behalf of the licensee, shall conduct a prompt
20investigation that, at a minimum, includes all of the following:
AB147-ASA1,14,2121 (a) An assessment of the nature and scope of the cybersecurity event.
AB147-ASA1,14,2322 (b) The identification of any nonpublic information that was or may have been
23involved in the cybersecurity event.
AB147-ASA1,15,3
1(c) The performance of reasonable measures to restore the security of the
2licensee's information systems compromised in the cybersecurity event and prevent
3additional unauthorized acquisition, release, or use of nonpublic information.
AB147-ASA1,15,8 4(2) If a licensee knows that a cybersecurity event has or may have occurred in
5an information system maintained by a 3rd-party service provider, the licensee shall
6comply with sub. (1) or make reasonable efforts to confirm and document that the
73rd-party service provider has either complied with sub. (1) or failed to cooperate
8with the investigation under sub. (1).
AB147-ASA1,15,11 9(3) The licensee shall maintain records concerning a cybersecurity event for a
10period of at least 5 years starting from the date of the cybersecurity event and shall
11produce the records upon demand of the commissioner.
AB147-ASA1,7 12Section 7. 601.954 of the statutes is created to read:
AB147-ASA1,15,16 13601.954 Notification of a cybersecurity event. (1) Notification to the
14commissioner.
(a) A licensee shall notify the commissioner that a cybersecurity
15event involving nonpublic information has occurred if any of the following conditions
16is met:
AB147-ASA1,15,1917 1. The licensee is domiciled in this state and the cybersecurity event has a
18reasonable likelihood of materially harming a consumer or a material part of the
19normal operations of the licensee.
AB147-ASA1,15,2220 2. The cybersecurity event is any of the following and the licensee reasonably
21believes that the cybersecurity event involves the nonpublic information of at least
22250 consumers:
AB147-ASA1,15,2523 a. A cybersecurity event for which notice is required to be provided to a
24government body, self-regulatory agency, or other supervisory entity under state or
25federal law.
AB147-ASA1,16,2
1b. A cybersecurity event that has a reasonable likelihood of materially harming
2a consumer or a material part of the normal operations of the licensee.
AB147-ASA1,16,63 (b) A licensee shall provide the notification under par. (a) in electronic form and
4as promptly as possible, but no later than 3 business days from the determination
5that the cybersecurity event occurred. In the notification, the licensee shall provide
6as much of the following information as possible:
AB147-ASA1,16,87 1. The date and source of the cybersecurity event and the time period during
8which information systems were compromised by the cybersecurity event.
AB147-ASA1,16,99 2. A description of how the cybersecurity event was discovered.
AB147-ASA1,16,1210 3. A description of how the nonpublic information was exposed, lost, stolen, or
11breached and an explanation of how the information has been, or is in the process
12of being, recovered.
AB147-ASA1,16,1513 4. A description of the specific data elements, including types of medical,
14financial, and personally identifiable information, that were acquired without
15authorization.
AB147-ASA1,16,1616 5. The number of consumers affected by the cybersecurity event.
AB147-ASA1,16,1817 6. A description of efforts to address the circumstances that allowed the
18cybersecurity event to occur.
AB147-ASA1,16,2019 7. The results of any internal review related to the cybersecurity event,
20including the identification of a lapse in automated controls or internal procedures.
AB147-ASA1,16,2321 8. Whether the licensee notified a government body, self-regulatory agency, or
22other supervisory entity of the cybersecurity event and, if applicable, the date the
23notification was provided.