SB 903 — AN ACT CONCERNING INSURANCE DATA AND INFORMATION SECURITY.

(2) "Authorized individual" means an individual who is known to, LCO 4439 \\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-00903-R1 of 21 SB.docx Raised Bill No.

4439903 1 of 21 Raised Bill No.903 and screened by, a licensee, and to whom the licensee deems it necessary and appropriate to grant access to nonpublic information that is in the possession, custody or control of such licensee or stored on such licensee's information systems;

(7) "Information security program" means a comprehensive written program that contains the administrative, physical and technical safeguards that a licensee uses to access, collect, dispose of, distribute, process, protect, store, transmit, use or otherwise handle nonpublic information;LCO 4439 {\\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-0092 of 21 R01-SB.docx } Raised Bill No.

LCO903 No.information;

4439 2 of 21 Raised Bill No.903 (8) "Information system" means:

(B) that is in a form or medium created or derived from a consumer or health care provider concerning (i) the behavioral, mental or physical health of the consumer or a member of the family of suchLCO consumer,4439 (ii){\\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-00903 healthof care21 providedR01-SB.docx to} theRaised consumer,Bill orNo. (iii) payment for health care provided to the consumer;

903 such consumer, (ii) health care provided to the consumer, or (C)(iii) concerningpayment afor LCOhealth No.care provided to the consumer;

4439or 3(C) ofconcerning 21a Raised Bill No.903 consumer, including, but not limited to, the name, number, personal mark or other personal identifier of the consumer, that, in combination with any of the following forms of information, can be used to identify such consumer:

(B) Designates an affiliate, employee or outside vendor of such licensee as the person responsible for developing, implementing and maintainingLCO the4439 information{\\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-00904 security program for such licensee pursuant to subdivision (1) of subsection21 (e)R01-SB.docx of} thisRaised section;Bill No.

LCO903 No.maintaining the information security program for such licensee pursuant to subdivision (1) of subsection (e) of this section;

4439 4 of 21 Raised Bill No.903 (C) Identifies reasonably foreseeable threats, regardless of whether such threats originate inside or outside of such licensee, (i) that might result in unauthorized access to, or unauthorized alteration, destruction, disclosure, misuse or transmission of, nonpublic information that is in the possession, custody or control of such licensee, or (ii) to the security of such licensee's information systems and the nonpublic information that is accessible to, or in the possession, custody or control of, a third-party service provider that has contracted with such licensee;

(2)LCO Each4439 licensee{\\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-0095 shall, on the basis of the21 riskR01-SB.docx assessment} programRaised implementedBill forNo. such licensee pursuant to subdivision (1) of this subsection:

LCO903 No.(2) Each licensee shall, on the basis of the risk assessment program implemented for such licensee pursuant to subdivision (1) of this subsection:

4439 5 of 21 Raised Bill No.903 (A) Include cybersecurity risks in such licensee's enterprise risk management process;

(iv) Measures that protect, by encryption or other means, nonpublic information while such nonpublic information is transmitted over an externalLCO network4439 or{\\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-0096 storedof on21 aR01-SB.docx laptop} computerRaised orBill otherNo. portable computing device, storage device or medium;

903 external network or stored on a laptop computer or other portable computing device, storage device or medium;

LCO(vi) No.Measures for assessing, evaluating and testing the security of software applications utilized but not developed by such licensee;

4439 6 of 21 Raised Bill No.903 (vi) Measures for assessing, evaluating and testing the security of software applications utilized but not developed by such licensee;

(e)LCO (1)4439 Not{\\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-0097 laterof than21 OctoberR01-SB.docx 1,} 2020,Raised eachBill licenseeNo. shall cause an information security program to be developed, implemented and maintained for such licensee that:

(A)903 Is(e) commensurate(1) withNot thelater (i)than complexityOctober and1, size2020, ofeach suchlicensee licensee,shall (ii)cause naturean andinformation scopesecurity ofprogram suchto licensee'sbe activities,developed, including,implemented LCOand No.maintained for such licensee that:

4439(A) 7Is commensurate with the (i) complexity and size of 21such Raisedlicensee, Bill(ii) No.903nature and scope of such licensee's activities, including, but not limited to, such licensee's use of third-party service providers, and (iii) sensitivity of the nonpublic information that is used by, or in the possession, custody or control of, such licensee or stored on such licensee's information systems;

and (E) Includes a written incident response plan that (i) is designed to promptly respond to, and recover from, each cybersecurity event that compromises (I) such licensee's information systems, (II) the continued functioning of any aspect of such licensee's business operations, or (III) the availability, confidentiality or integrity of the nonpublic information that is in the possession, custody or control of such licensee, (ii) addresses such licensee's internal processes for responding toLCO cybersecurity4439 events,{\\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-0098 (iii) sets forth the goals of such21 plan,R01-SB.docx (iv)} clearlyRaised definesBill the various responsibilities, roles and levels of decision- making authority concerning cybersecurity events, (v) addresses both internal and external communications and information sharing, (vi) identifies requirements for the remediation of any weaknesses identified in such licensee's information systems or the controls LCO No.

4439903 8to cybersecurity events, (iii) sets forth the goals of 21such Raisedplan, Bill(iv) No.903clearly defines the various responsibilities, roles and levels of decision- making authority concerning cybersecurity events, (v) addresses both internal and external communications and information sharing, (vi) identifies requirements for the remediation of any weaknesses identified in such licensee's information systems or the controls associated with such information systems, (vii) provides for the documentation and reporting of cybersecurity events and any activities undertaken in response to cybersecurity events, and (viii) establishes a process to evaluate and, if necessary, revise such plan following each cybersecurity event.

(i)LCO Cause4439 an{\\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-0099 informationof security21 programR01-SB.docx to} beRaised developed,Bill implementedNo. and maintained for such licensee pursuant to subdivision (1) of this subsection;

and903 (ii)(i) Report,Cause atan leastinformation annually,security program to suchbe boarddeveloped, concerningimplemented (I)and themaintained overallfor statussuch oflicensee thepursuant informationto securitysubdivision program(1) developed,of implementedthis LCOsubsection; No.

4439and 9(ii) Report, at least annually, to such board concerning (I) the overall status of 21the Raisedinformation Billsecurity No.903program developed, implemented and maintained for such licensee pursuant to subdivision (1) of this subsection, and (II) all matters material to such information security program, including, but not limited to, control decisions, cybersecurity events and responses thereto, recommendations for changes to such information security program, the ongoing risk assessment program implemented for such licensee pursuant to subdivision (1) of subsection (d) of this section, risk management measures, testing results and third-party service provider arrangements.

Each licensee shall exercise dueLCO diligence4439 in{\\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-0010 selectingof third-party21 serviceR01-SB.docx providers.} Raised Bill No.

903 due diligence in selecting third-party service providers.

Each insurer LCOdomiciled No.in this state shall maintain, for a period of not less than five years from the date such insurer submits a written statement to the commissioner pursuant to this subsection, all data, information, records and schedules supporting such written statement.

4439 10 of 21 Raised Bill No.903 domiciled in this state shall maintain, for a period of not less than five years from the date such insurer submits a written statement to the commissioner pursuant to this subsection, all data, information, records and schedules supporting such written statement.

(2) (A) Except as provided in subparagraph (B) of this subdivision, if a licensee suspects that a cybersecurity event involving the licensee's information systems has occurred, such licensee, or a person designated to act on behalf of such licensee, shall promptly conduct an investigation to, at a minimum, determine whether the suspected cybersecurity event occurred, and, if the suspected cybersecurity event occurred:LCO 4439 {\\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-0011 of 21 R01-SB.docx } Raised Bill No.

903 occurred:

and (iii) Perform, or oversee the implementation of, reasonable measures LCOto No.(I) restore the security of such information systems, and (II) prevent further unauthorized acquisition, release or use of the nonpublic information that is stored on such information systems.

4439 11 of 21 Raised Bill No.903 to (I) restore the security of such information systems, and (II) prevent further unauthorized acquisition, release or use of the nonpublic information that is stored on such information systems.

(i) Such licensee is (I) an insurer, as defined in section 38a-1 of the general statutes, that is domiciled in this state, or (II) an insurance producerLCO whose4439 home{\\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-0012 state, as such terms are defined in section 38a- 702a of the21 generalR01-SB.docx statutes,} isRaised thisBill state;No.

or903 (ii)producer Suchwhose licenseehome reasonablystate, believesas thatsuch theterms nonpublicare informationdefined involved in suchsection cybersecurity38a- event702a concernsof notthe lessgeneral thanstatutes, two hundred fifty consumers, and (I) such licensee is requiredthis tostate; send notice concerning such cybersecurity event to any government body, self-regulatory agency or supervisory body pursuant to any applicable LCO No.

4439or 12(ii) ofSuch 21licensee Raisedreasonably Billbelieves No.903that the nonpublic information involved in such cybersecurity event concerns not less than two hundred fifty consumers, and (I) such licensee is required to send notice concerning such cybersecurity event to any government body, self-regulatory agency or supervisory body pursuant to any applicable federal or state law, or (II) it is reasonably likely that such cybersecurity event will materially harm any consumer or any material part of the normal operations of such licensee.

(4) Each licensee, or person designated to act on behalf of a licensee, that is required to send notice to the commissioner pursuant to subparagraph (A) of subdivision (3) of this subsection, or the commissioner and a ceding insurer pursuant to subparagraph (B) of saidLCO subdivision,4439 shall{\\PRDFS1\SCOUSERS\FORZANOF\WS\2019SB-0013 sendof such21 noticeR01-SB.docx to} theRaised commissioner,Bill orNo. the commissioner and a ceding insurer, as applicable, not later than seventy-two hours after:

903 said subdivision, shall send such notice to the commissioner, or the commissioner and a ceding insurer, as applicable, not later than seventy-two hours after:

or LCO(B) No.Such licensee, or the person designated to act on behalf of such licensee, receives notice from a third-party service provider pursuant to subdivision (1) of this subsection disclosing that a cybersecurity event has occurred, or such licensee first has actual knowledge that a cybersecurity event involving the information systems maintained by a third-party service provider has occurred.