South Carolina Insurance Data Security Act

Why does it matter?

The Act is the binding security law for the South Carolina insurance market, from domestic insurers to producers and third-party administrators, and it is the state's version of the model that other insurance departments have since adopted. It names the safeguards a licensee must consider, fixes a 72-hour clock for reporting a cybersecurity event to the Director, requires a written certification from every domestic insurer each year, and gives the Director examination and enforcement powers under section 38-99-50 with the administrative penalties of section 38-2-10. A licensee that cannot produce its risk assessment, incident response plan and certification records, which section 38-99-20(I) says must be kept for five years, faces fines, suspension or revocation.

Key benefits include:

• Defined terms that set the scope

Section 38-99-10 defines cybersecurity event, nonpublic information, licensee, third-party service provider and multifactor authentication, so the duties attach to specific data and specific events.

• A written program with named measures

Section 38-99-20(D) lists eleven security measures, from access controls and encryption of nonpublic information in transit and on portable devices to audit trails and secure disposal.

• Board and management accountability

Section 38-99-20(E) requires executive management to report in writing to the board at least annually on program status, risks, provider arrangements, test results and events.

• A 72-hour regulatory clock

Section 38-99-40 requires notice to the Director no later than 72 hours after the licensee determines that a cybersecurity event has occurred, with thirteen content items.

• An annual certification

Section 38-99-20(I) requires each domestic insurer to certify compliance in writing by February 15 and to keep the supporting records for five years.

How does it work?

Section 38-99-20(A) requires each licensee, commensurate with its size and complexity, the nature and scope of its activities including its use of third-party service providers, and the sensitivity of the nonpublic information it holds, to develop, implement and maintain a comprehensive written information security program based on its risk assessment, with administrative, technical and physical safeguards. Subsection (B) sets four design objectives: protect the security and confidentiality of nonpublic information and the information system, protect against threats or hazards, protect against unauthorized access or use and minimize harm to consumers, and define and periodically reevaluate a retention schedule with a destruction mechanism.

Subsection (C) requires the licensee to designate one or more employees, an affiliate or an outside vendor as responsible for the program, identify reasonably foreseeable internal and external threats including those at third-party service providers, assess their likelihood and potential damage, assess the sufficiency of existing safeguards across training, information systems and attack detection, and implement safeguards with at least an annual assessment of key controls. Subsection (D) then lists the measures to determine the appropriateness of and implement: access controls, an inventory of data, personnel, devices, systems and facilities, physical access restrictions, encryption of nonpublic information transmitted over external networks and stored on laptops or portable media, secure development practices, system modification, effective controls which may include multifactor authentication, regular testing and monitoring, audit trails, protection against environmental hazards and secure disposal, plus cybersecurity in the enterprise risk management process, threat awareness and staff training.

Section 38-99-30 requires a prompt investigation of any actual or suspected cybersecurity event, including one at a third-party service provider, and five-year retention of event records. Section 38-99-40(A) requires notice to the Director within 72 hours of determining that an event has occurred when South Carolina is the insurer's domicile or the producer's home state, or when the event involves nonpublic information of at least 250 South Carolina consumers and either triggers notice to another regulator or has a reasonable likelihood of materially harming a consumer or the licensee's operations. Subsection (C) applies the consumer notice rules of section 39-1-90, with a copy to the Director. Subsection (D) treats a provider's event as the licensee's own, with the clock starting the day after the licensee learns of it, and subsection (E) gives assuming insurers 72 hours to notify ceding insurers and their domiciliary director.

Key Elements

• Cybersecurity event (38-99-10(3))

Unauthorized access to, or disruption or misuse of, an information system or stored information; excludes encrypted data where the key is not also acquired and events where the information was not used or released and has been returned or destroyed.

• Nonpublic information (38-99-10(11))

Business information whose compromise would materially harm the licensee; consumer identifiers combined with a Social Security number, driver's license number, account or card number, security code or biometric record; and health information.

• Third-party service provider oversight (38-99-20(F))

Due diligence in selecting providers and a requirement that each provider implement appropriate administrative, technical and physical measures; required from July 1, 2020 under section 4 of the Act.

• Incident response plan (38-99-20(H))

A written plan covering the internal response process, goals, roles and decision authority, communications, remediation of weaknesses, documentation and reporting, and post-event revision.

• Notice content (38-99-40(B))

Thirteen items including the event date, how information was exposed, how it was discovered, recovery, the source, law enforcement contacts, data types, the compromise period, the number of consumers affected, control lapses, remediation and a contact person, updated as the investigation continues.

• Exemptions and penalties (38-99-70 and 38-99-80)

Licensees with fewer than ten employees including contractors, licensees covered by another licensee's program, and HIPAA-compliant licensees that certify compliance are exempt from section 38-99-20; violations carry the penalties of section 38-2-10.

What does it cover?

The Act applies to every licensee under the South Carolina insurance laws, which section 38-99-10(9) defines as any person licensed, authorized to operate or registered, or required to be, excluding purchasing groups and risk retention groups chartered and licensed in another state and assuming insurers domiciled elsewhere. It covers nonpublic information about South Carolina consumers, meaning applicants, policyholders, insureds, beneficiaries, claimants and certificate holders resident in the state, and the licensee's own business information and information systems, whether held by the licensee or by its third-party service providers. Section 38-99-100 creates no duty for communications providers that merely transmit data, and section 1 of the Act creates no private right of action.

What are its objectives?

Section 1 of 2018 Act No. 171 states the purpose: to establish standards for data security and for the investigation of and notification to the Director of a cybersecurity event applicable to licensees.

Protect the security and confidentiality of nonpublic information and the security of the information system (38-99-20(B)(1)).

Protect against threats or hazards to the security or integrity of nonpublic information and the information system (38-99-20(B)(2)).

Protect against unauthorized access to or use of nonpublic information and minimize the likelihood of harm to a consumer (38-99-20(B)(3)).

Define and periodically reevaluate a schedule for retention of nonpublic information and a mechanism for its destruction when no longer needed (38-99-20(B)(4)).

Give the Director prompt, documented notice of cybersecurity events and an annual certification from domestic insurers (38-99-40 and 38-99-20(I)).

Framework in Context

The Act is South Carolina's enactment of the NAIC Insurance Data Security Model Law (MDL-668), whose drafting working group was chaired by the state's insurance director, and the Department of Insurance states that South Carolina was the first state to pass it; other states have since adopted their own versions. Its structure mirrors the New York Department of Financial Services cybersecurity regulation that preceded the model, and its program elements line up with the GLBA Safeguards Rule that applies to non-bank financial institutions under FTC jurisdiction, so a licensee that already follows GLBA or NYDFS 23 NYCRR 500 can map most of its controls across. The consumer notice duty sits in the state's general breach notification statute, section 39-1-90, and HIPAA-covered licensees can satisfy section 38-99-20 through their HIPAA program under section 38-99-70(A)(3).

Common Framework Mappings

Licensees map the Act's program elements, security measures and notification duties to the frameworks below so that one control set serves the Department of Insurance, other state regulators and auditors.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

GLBA Safeguards Rule (16 CFR Part 314)

HIPAA

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2