Connecticut Insurance Data Security Law
Exempt:
- Agencies where less than 10 employees & independent contractors have access to non-public information (NPI)
- Agencies subject to & in compliance with federal Health Insurance Portability and Accountability Act (HIPAA) (form filing required)
- Agency employees covered by agency’s information security program
- Agencies subject to & in compliance with New York financial services cybersecurity requirements regulation (23 NYCRR 500) (form filing required)
Requirements For All Others:
- Perform annual cybersecurity risk assessment
- Implement information security program designed to mitigate identified risks, modify systems accordingly, & make adjustments as needed
- Determine appropriate security measures such as:
- Controls on who can access computer network
- Identification & management of data, devices, systems, facilities, & relevant personnel
- Restricted access to physical locations
- Data encryption
- Multi-factor authentication (MFA)
- Systems testing & monitoring to detect attempted intrusions
- Audit trails for reconstructing financial transactions
- Protection against physical destruction of data
- Procedures for securely disposing of NPI
- Stay informed of threats
- Staff cybersecurity awareness training
- Require third-party service providers to implement network security
- Create written plan for responding to cybersecurity events
- Annually certify compliance to Connecticut Insurance Department (CID)
- Investigate & report to CID & consumers certain cybersecurity events, including events of third-party service providers
Topics
