By enacting the Insurance Data Security Model Law, the National Association of Insurance Commissioners (NAIC) set guidelines for data security and the examination of cybersecurity incidents inside the insurance sector.

This new approach has already been implemented in about half of the states in the US, and more are anticipated in the upcoming months. Insurance businesses are subject to several new restrictions as a result of the rules. The first prerequisite is to carry out yearly risk assessments to identify any potential vulnerabilities that might be exploited. Sustaining an information security program is the second need. The final prerequisite is looking into any cybersecurity incidents and reporting them to the commissioner. Notifying any impacted customers that their data has been compromised is the last necessity.