(d) This subchapter, except for s. 601.954 (1), does not apply to a licensee who is subject to and governed by 45 CFR Parts 160 and 164 and who maintains nonpublic information in the same manner as protected health information under 45 CFR Parts 160 and 164.

(e) If a licensee ceases to qualify for an exception under par. (a) to (d), the licensee shall have 180 days to comply with this subchapter.

(3) Agreements between parties. Nothing in this subchapter shall prevent or abrogate an agreement between a licensee and another licensee, a 3rd-party service provider, or another party to fulfill any of the requirements under s. 601.953 or 601.954.

(4) Private cause of action. This subchapter may not be construed to create or imply a private cause of action for violation of its provisions or to curtail a private cause of action that otherwise exists in the absence of this subchapter.

(5) Rules. The commissioner may promulgate rules that are necessary to carry out the provisions of this subchapter.

601.952 Information security program. (1) Implementation of program. No later than one year after the effective date of this subsection .... [LRB inserts date], a licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment under sub. (2) and consistent with the conditions of sub. (3) (a). The program shall contain administrative, technical, and physical safeguards for the protection of the licensee's information systems and nonpublic information. The licensee shall design the program to do all of the following:

(a) Protect against threats and hazards to the security and integrity of the information systems and nonpublic information.

(b) Protect against unauthorized access to and use of nonpublic information and minimize the likelihood of harm to a consumer from the unauthorized access or use.

(c) Establish and periodically reevaluate a schedule for retention and disposal of nonpublic information and establish a mechanism for the destruction of nonpublic information that is no longer needed.

(2) Risk assessment. The licensee shall conduct a risk assessment under which the licensee shall do all of the following:

(a) Identify reasonably foreseeable internal and external threats that could result in unauthorized access to or transmission, disclosure, misuse, alteration, or destruction of nonpublic information, including nonpublic information that is accessible to or held by 3rd-party service providers of the licensee.

(b) Assess the likelihood and potential damage of the threats identified under par. (a), taking into consideration the sensitivity of the nonpublic information.

(c) Assess the sufficiency of policies, procedures, information systems, and other safeguards to manage the threats identified under par. (a) in each relevant area of the licensee's operations, including all of the following:

1. Employee training and management.

2. Information systems, including the classification, governance, processing, storage, transmission, and disposal of information.

3. Processes for detecting, preventing, and responding to attacks, intrusions, and other system failures.

(3) Risk management. Based on the risk assessment under sub. (2), the licensee shall do all of the following:

(a) Design an information security program to mitigate the identified threats, commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities, including its use of 3rd-party service providers, and the sensitivity of the nonpublic information.

(b) Implement the following security measures, as appropriate:

1. Place access controls on information systems.

2. Identify and manage the data, personnel, devices, systems, and facilities that enable the licensee to achieve its business purposes, taking into consideration the relative importance of the data, personnel, devices, systems, and facilities to the business objectives and risk strategy of the licensee.

3. Restrict physical access to nonpublic information to authorized individuals only.

4. Protect, by encryption or other means, nonpublic information being transmitted over an external network and nonpublic information stored on a portable computer or storage device or media.

5. Adopt secure development practices for applications that are developed in-house and utilized by the licensee.

6. Modify information systems in accordance with the licensee's information security program.

7. Utilize effective controls, which may include multifactor authentication procedures for employees accessing nonpublic information.

8. Implement regular testing and monitoring of systems and procedures to detect actual and attempted attacks on, or intrusions into, an information system.

9. Include audit trails within the information security program that are designed to detect and respond to cybersecurity events and to reconstruct material financial transactions sufficient to support the normal operations and obligations of the licensee.