NAIC Insurance Data Security Model Law (MDL-668)

Why does it matter?

After major data breaches at large insurers, state insurance regulators made data security a top priority, and the NAIC began drafting this model in early 2016. The model gives commissioners a written program to examine, a certification to read each year and a fixed clock for breach reports. A licensee that cannot show its risk assessment, board reporting, third-party due diligence and incident response plan faces examination under Section 7 and the penalties of its own state's general penalty statute, because Section 10 leaves the amount to each state.

Key benefits include:

• A written program tied to a risk assessment

Section 4A requires a comprehensive written Information Security Program based on the Licensee's Risk Assessment, scaled to its size, activities and use of third parties.

• Named security measures

Section 4D(2) lists measures to implement where appropriate: access controls, encryption of data in transit and on portable devices, multi-factor authentication, audit trails, secure disposal and testing.

• Board and executive accountability

Under Section 4E the board or a committee requires management to report in writing at least annually on program status and compliance.

• A 72-hour notice

Section 6A requires notice to the Commissioner within 72 hours of determining that a Cybersecurity Event occurred, when the listed criteria are met.

• Annual certification

Section 4I has each domestic insurer certify compliance by February 15 and keep supporting records for five years.

How does it work?

Section 4 builds the program. The Licensee designates a responsible person, identifies foreseeable threats, assesses their likelihood and damage and tests the sufficiency of safeguards (Section 4C), then selects measures from the Section 4D(2) list, includes cybersecurity in enterprise risk management and trains personnel. It exercises due diligence in choosing Third-Party Service Providers and requires them to protect Nonpublic Information (Section 4F), adjusts the program as its business changes (Section 4G) and keeps a written incident response plan covering roles, communications, remediation, documentation and revision after an event (Section 4H).

Section 5 requires a prompt investigation when a Cybersecurity Event has or may have occurred: determine whether it occurred, assess its nature and scope, identify the Nonpublic Information involved and restore security. Where a Third-Party Service Provider holds the system, the Licensee completes those steps or documents that the provider did. Records of all events are kept at least five years (Section 5D). Section 6 then sets who is told and when: the Commissioner (6A and 6B), consumers under the state's breach law (6C), ceding insurers (6E) and producers of record (6F).

Section 6A applies when the state is the insurer's state of domicile or the producer's home state, or when the Licensee reasonably believes the Nonpublic Information of 250 or more consumers residing in the state is involved and notice is required to a government body or the event is reasonably likely to cause material harm. Section 6B lists the 13 items to report and requires updates. Under Section 6D(2), the deadline starts the day after a third-party provider notifies the Licensee or the Licensee otherwise knows of the event, whichever is sooner.

Key Elements

• Licensee

Any person licensed, authorized or registered, or required to be, under the state's insurance laws, excluding certain out-of-state purchasing and risk retention groups and assuming insurers domiciled elsewhere (Section 3I).

• Nonpublic Information

Business information whose compromise would materially harm the Licensee, personal identifiers combined with data such as Social Security or account numbers, and health information (Section 3K).

• Cybersecurity Event

Unauthorized access to, disruption or misuse of an Information System or the information on it, excluding encrypted data whose key was not also taken (Section 3D).

• Information Security Program

Administrative, technical and physical safeguards for handling Nonpublic Information, set out in Section 4A through 4I.

• Third-Party Service Provider

A person that contracts with a Licensee to maintain, process, store or access Nonpublic Information (Section 3P), overseen under Section 4F.

• Commissioner's power

Section 7 lets the chief insurance regulator examine and investigate any Licensee, and Section 8 keeps specified filed material confidential and privileged.

What does it cover?

The model applies to a Licensee, defined in Section 3I, in a state that has enacted it. Section 9 exempts a Licensee with fewer than ten employees, including independent contractors, from Section 4; treats a HIPAA-covered Licensee with a compliant information security program as meeting Section 4 if it submits a written certification; and exempts an employee, agent or designee covered by another Licensee's program. A Licensee that stops qualifying has 180 days to comply. The model creates no private cause of action (Section 2B), and each state fills in its own penalty, regulation and breach-notification references.

What are its objectives?

The model's purpose in Section 2A is to establish data security standards and standards for investigating and notifying the Commissioner of a Cybersecurity Event.

Protect the security and confidentiality of Nonpublic Information and of the Information System (Section 4B(1)).

Protect against threats to its integrity and against unauthorized access or use, and minimize the likelihood of harm to any Consumer (Section 4B(2) and (3)).

Define a retention schedule for Nonpublic Information and a way to destroy it when no longer needed (Section 4B(4)).

Give the Commissioner prompt notice of events, in electronic form and with continuing updates (Section 6).

Let the Commissioner confirm compliance through the annual certification and examinations (Sections 4I and 7).

Framework in Context

The NAIC built examiner guidance on this law: its Market Regulation Handbook carries pre-breach and post-breach checklists, first distributed on July 16, 2018, that examiners use in states that enacted the model or something substantially similar. The drafting note to Section 2 links the model to 23 NYCRR 500, New York's financial services cybersecurity regulation; the NAIC map shows New York as having other insurance data security provisions. State enactments vary, so a licensee reads its own state's statute and regulations first.

Common Framework Mappings

Licensees map the model's Section 4 measures to these frameworks and rules to reuse one control set across insurance regulators and other regimes.

Mapped frameworks include:

CIS Controls v8.1

EU DORA

FFIEC IT Handbook

GLBA Safeguards Rule (16 CFR Part 314)

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2