EKL:amn
2019 - 2020 LEGISLATURE
2019 Senate BILL 784
February 6, 2020 - Introduced by Senators Testin, Feyen and Olsen, cosponsored
by Representatives Petersen, Neylon and Duchow. Referred to Committee
on Insurance, Financial Services, Government Oversight and Courts.
SB784,1,4 1An Act to create 601.465 (3) (f), subchapter IX (title) of chapter 601 [precedes
2601.95], 601.95, 601.951, 601.952, 601.953, 601.954, 601.955 and 601.956 of the
3statutes; relating to: imposing requirements related to insurance data
4cybersecurity and granting rule-making authority.
Analysis by the Legislative Reference Bureau
This bill imposes requirements relating to the protection of nonpublic
information on insurers and other persons regulated by the Office of the
Commissioner of Insurance (licensees). The bill defines “nonpublic information” to
mean nonpublic electronic information in the possession, custody, or control of a
licensee that is either information concerning a Wisconsin resident that can be used
to identify the individual in combination with another data element, such as a Social
Security number, or certain health-related information that can be used to identify
a Wisconsin resident.
Under the bill, a licensee must conduct a risk assessment and develop an
information security program based on the assessment. The risk assessment must
identify and assess reasonably foreseeable threats that could result in unauthorized
access to or transmission, disclosure, misuse, alteration, or destruction of nonpublic
information. The information security program must contain safeguards for the
protection of the licensee's information systems and nonpublic information and be
designed to mitigate threats, commensurate with the size and complexity of the
licensee, the nature and scope of the licensee's activities, and the sensitivity of the
nonpublic information. The bill requires the licensee to take specified risk mitigation

actions and to monitor, evaluate, and adjust the information security program as
appropriate.
The bill also requires that a licensee develop an incident response plan to
promptly respond to, and recover from, a cybersecurity event that compromises the
confidentiality, integrity, or availability of nonpublic information, the licensee's
information systems, or the continuing functionality of the licensee's business or
operations. Under the bill, “cybersecurity event” generally means an event resulting
in the unauthorized access to, or disruption or misuse of, an information system or
nonpublic information stored on an information system.
The bill further requires that a licensee exercise due diligence in selecting
third-party service providers and make reasonable efforts to require that a service
provider implement measures to protect and secure information systems and
nonpublic information and report the occurrence of any cybersecurity event.
Under the bill, the above requirements do not apply to a licensee who has less
than $10 million in year-end total assets, less than $5 million in gross annual
revenue, or fewer than 25 full-time employees. However, the commissioner may
issue an order to require compliance by an otherwise exempt licensee if warranted
by the licensee's circumstances. A licensee who is not exempt from the requirements
must annually certify to the commissioner that the licensee has complied with them.
Additionally, if a licensee knows that a cybersecurity event has or may have
occurred, the bill requires that the licensee conduct a prompt investigation to assess
the nature and scope of the event and take related actions, including the performance
of reasonable measures to restore the security of affected information systems. If the
cybersecurity event involves an information system maintained by a third-party
service provider, the licensee must comply with the investigation requirements or
make reasonable efforts to confirm that the service provider has either complied with
the requirements or failed to cooperate with the investigation.
Under the bill, a licensee must notify the commissioner of a cybersecurity event
if either of the following conditions is met:
1. The licensee is domiciled in Wisconsin and the cybersecurity event has a
reasonable likelihood of materially harming a Wisconsin resident or a material part
of the licensee's normal operations.
2. The licensee reasonably believes that the cybersecurity event involves the
nonpublic information of at least 250 Wisconsin residents, and the cybersecurity
event either must be reported to a government entity under federal or state law or
has a reasonable likelihood of materially harming a Wisconsin resident or a material
part of the licensee's normal operations.
The notification must provide specified information about the cybersecurity
event, including details about the event and its discovery, a description of the
accessed nonpublic information, the number of affected Wisconsin residents, and the
licensee's efforts to address the circumstances that allowed the event to occur. The
licensee is required to update the commissioner on material changes to the
information and as additional information becomes available. If the cybersecurity
event involves a third-party service provider, the licensee must notify the
commissioner of the event unless the service provider does so.

Under the bill, the commissioner has the power to examine and investigate the
affairs of a licensee to determine whether a violation of any of the above requirements
has occurred. A licensee must generally keep records relating to the requirements
for at least five years and produce them upon demand of the commissioner. Any
documents, materials, and other information from a licensee that are in the
possession or control of the commissioner are confidential and privileged.
For further information see the state fiscal estimate, which will be printed as
an appendix to this bill.
The people of the state of Wisconsin, represented in senate and assembly, do
enact as follows: