NAIC Principles for Effective Cyber security

---

The National Association of Insurance Commissioners (NAIC) recently announced its Principles for Effective Cyber Security. 

HT  provides has vast experience and provides extensive services to  insurance companies across the country, and will assist in helping  insurance companies meet the NAIC Principles of Cyber Security.

The  insurance industry looks to state insurance regulators to aid in the  identification of uniform standards, to promote accountability across  the entire insurance sector, and to provide access to essential  information. State insurance regulators look to the insurance industry  to join forces in identifying risks and offering practical solutions.  The guiding principles stated below are intended to establish insurance  regulatory guidance that promotes these relationships and protects  consumers.

State  insurance regulators have a responsibility to ensure that personally  identifiable consumer information held by insurers, producers and other  regulated entities is protected from cybersecurity risks. Additionally,  state insurance regulators should mandate that these entities have  systems in place to alert consumers in a timely manner in the event of a  cybersecurity breach. State insurance regulators should collaborate  with insurers, insurance producers and the federal government to achieve  a consistent, coordinated approach.

Confidential  and/or personally identifiable consumer information data that is  collected, stored and transferred inside or outside of an insurer's,  insurance producer's or other regulated entity's network should be  appropriately safeguarded.

State  insurance regulators have a responsibility to protect information that  is collected, stored and transferred inside or outside of an insurance  department or at the NAIC. This information includes insurers’ or  insurance producers’ confidential information, as well as personally  identifiable consumer information. In the event of a breach, those  affected should be alerted in a timely manner.

Cybersecurity  regulatory guidance for insurers and insurance producers must be  flexible, scalable, practical and consistent with nationally recognized  efforts such as those embodied in the National Institute of Standards  and Technology (NIST) framework.

Regulatory  guidance must be risk-based and must consider the resources of the  insurer or insurance producer, with the caveat that a minimum set of  cybersecurity standards must be in place for all insurers and insurance  producers that are physically connected to the Internet and/or other  public data networks, regardless of size and scope of operations.

State  insurance regulators should provide appropriate regulatory oversight,  which includes, but is not limited to, conducting risk-based financial  examinations and/or market conduct examinations regarding cybersecurity.

Planning  for incident response by insurers, insurance producers, other regulated  entities and state insurance regulators is an essential component to an  effective cybersecurity program.

Insurers,  insurance producers, other regulated entities and state insurance  regulators should take appropriate steps to ensure that third parties  and service providers have controls in place to protect personally  identifiable information.

Cybersecurity  risks should be incorporated and addressed as part of an insurer’s or  an insurance producer’s enterprise risk management (ERM) process.  Cybersecurity transcends the information technology department and must  include all facets of an organization.

Information  technology internal audit findings that present a material risk to an  insurer should be reviewed with the insurer’s board of directors or  appropriate committee thereof.

It  is essential for insurers and insurance producers to use an  information-sharing and analysis organization (ISAO) to share  information and stay informed regarding emerging threats or  vulnerabilities, as well as physical threat intelligence analysis and  sharing.

Periodic  and timely training, paired with an assessment, for employees of  insurers and insurance producers, as well as other regulated entities  and other third parties, regarding cybersecurity issues is essential.