Nevertheless, the NAIC provided 12 primary principles for regulators and the industry to follow, which are paraphrased as follows:

1. A general understanding that state regulators should collaborate with companies, federal agencies, and each other to achieve a consistent and coordinated approach to cyber security
2. That confidential or personally sensitive information that is collected should be appropriately safeguarded
3. In the event of a breach, notification should be provided promptly
4. Cyber security regulatory guidance for insurers must be flexible, scalable, practical and consistent with national standards
5. Regulatory guidance must be risk-based and must consider the resources of the insurer with a caveat that a minimum set of cybersecurity standards must be in place for the entire industry regardless of the size and scope of a company's operations
6. State insurance regulators should provide oversight of cyber security issues in conjunction with financial and market conduct examinations
7. It is essential for the industry to plan for incident responses in the event of a breach
8. The industry must take steps to ensure third parties and service providers have adequate measures or controls to protect personal information
9. Cyber security transcends the information technology department and must include all facets of an organization;
10. Internal audit findings relating to information technology (especially those identifying material risks) should be reviewed by the board of directors or appropriate oversight committee which reports to the board
11. It is essential carriers use information-sharing and analysis organizations to help prevent against emerging threats and vulnerabilities; and
12. Periodic and timely training and evaluation of employees, vendors, and other third parties regarding cybersecurity issues.

While some of the guidelines are obvious, the overall perspective provided by the NAIC reflects a thoughtful approach to a growing problem. This means that companies must evaluate and plan according to their own ability, given their strengths and weaknesses, to provide meaningful security of the data they maintain. While the regulatory guidance is not designed to be overbearing, keep in mind that there will still be minimum standards which must be maintained. This also means that response plans and data security monitoring must be routinely updated.

Special Reports /

Are you prepared for a cyber attack?

Related Stories

Recommended For You