SB 160

This bill imposes requirements relating to the protection of nonpublic

information on insurers and other persons regulated by the Office of the

Commissioner of Insurance (licensees). The bill defines “nonpublic information” to

mean nonpublic electronic information in the possession, custody, or control of a

licensee that is either information concerning a Wisconsin resident that can be used

to identify the individual in combination with another data element, such as a Social

Security number, or certain health-related information that can be used to identify

a Wisconsin resident.

Under the bill, a licensee must conduct a risk assessment and develop an

information security program based on the assessment. The risk assessment must

identify and assess reasonably foreseeable threats that could result in unauthorized

access to or transmission, disclosure, misuse, alteration, or destruction of nonpublic

information. The information security program must contain safeguards for the

protection of the licensee's information systems and nonpublic information and be

designed to mitigate threats, commensurate with the size and complexity of the

licensee, the nature and scope of the licensee's activities, and the sensitivity of the

nonpublic information. The bill requires the licensee to take specified risk mitigation

actions and to monitor, evaluate, and adjust the information security program as

appropriate.

The bill also requires that a licensee develop an incident response plan to

promptly respond to, and recover from, a cybersecurity event that compromises the

confidentiality, integrity, or availability of nonpublic information, the licensee's

information systems, or the continuing functionality of the licensee's business or

operations. Under the bill, “cybersecurity event” generally means an event resulting

in the unauthorized access to, or disruption or misuse of, an information system or

nonpublic information stored on an information system.

The bill further requires that a licensee exercise due diligence in selecting

third-party service providers and make reasonable efforts to require that a service

provider implement measures to protect and secure information systems and

nonpublic information and report the occurrence of any cybersecurity event.

Under the bill, the above requirements do not apply to a licensee who has less

than $10 million in year-end total assets, less than $5 million in gross annual

revenue, or fewer than 25 full-time employees. However, the commissioner may

issue an order to require compliance by an otherwise exempt licensee if warranted

by the licensee's circumstances. A licensee who is not exempt from the requirements

must annually certify to the commissioner that the licensee has complied with them.

Additionally, if a licensee knows that a cybersecurity event has or may have

occurred, the bill requires that the licensee conduct a prompt investigation to assess

the nature and scope of the event and take related actions, including the performance

of reasonable measures to restore the security of affected information systems. If the