Joint Comments to NAIC re: Insurance Data Security Checklists

Director Bruce R. Ramge, Chair

Market Conduct Examination Standards (D)
Working Group
National Association of Insurance
Commissioners

1100 Walnut Street, Suite 1500

Kansas City, MO 64106

Attn: Petra Wallace
Via e-mail: [email protected]

Dear Director Ramge:

We, the undersigned, appreciate this opportunity to offer comments on the recently exposed Insurance Data Security Pre- and Post-Breach Checklists (the Checklists). As you and your Working Group consider your next steps, we offer these points:

• We question the necessity or advisability of making additions to the broadly-used Market Regulation Handbook that are based on a Model Law that is not an accreditation standard and has not been enacted in a majority of states. In fact, the Model has been enacted in only one state, and industry has expressed concern with the Model Law as adopted by the NAIC. Making additions to the Market Regulation Handbook based on the new Model Law is premature at this point.
• If the Working Group is intent on making the additions, it should at least place an advisory sentence at the beginning of the checklists, reading as follows:

These checklists should be used only in states that have enacted the NAIC Insurance Data Security Model Law (#668) or legislation which is substantially similar to the Model.

We are aware that generic advisories of a similar nature appear at the beginning of each chapter in the Handbook, but we believe the brief advisory set out above would be prudent and well-placed guidance to assist examiners as they prepare their tasks.

• We are aware of the multiple, detailed revisions made in the past two years to the IT portions of the Financial Examiners Handbook. We recommend a careful comparison between those provisions and the checklists here to avoid needless duplication of work by examiners and to promote regulatory efficiency.
• We strongly recommend that the Pre-Breach Checklist, and to a lesser extent, the Post- Breach Checklist, be preceded by a reminder to Examiners that the Model Law specifies these requirements are to be based on a licensee’s particular risk profile

We thank you and other Working Group members for your consideration of our comments, and we look forward to discussing them further with you at your convenience.

American Bankers Association
American Council of Life Insurers
America's Health Insurance Plans
American Land Title Association
Blue Cross Blue Shield Association
Delta Dental Plan Association
Independent Insurance Agents and Brokers of America
Insured Retirement Institute
National Association of Health Underwriters
National Association of Insurance and Financial Advisors
National Association of Mutual Insurance Companies
National Association of Professional Insurance Agents
Property Casualty Insurers Association of America (PCI)
Reinsurance Association of America