Cybersecurity practitioners and policymakers have long been discussing the potential positive benefits of smart insurance policy and standards to reduce risk. Of the many actions and activities we see in the insurance world today, the news of NAIC involvement is seen as particularly interesting.
What is the NAIC?
The National Association of Insurance Commissioners (NAIC) is the U.S. standard-setting and regulatory support organization created and governed by the chief insurance regulators from the 50 states, the District of Columbia and five U.S. territories. Through the NAIC, state insurance regulators establish standards and best practices, conduct peer review, and coordinate their regulatory oversight. NAIC members form the national system of state-based insurance regulation in the U.S.
What have they announced?
NAIC has coordinated two drafts which will provide comprehensive policy for oversight of insurance regarding cybersecurity:
The first is a draft of Principles for Effective Cybersecurity Insurance Regulatory Guidance, developed by the Cybersecurity (EX) Task Force. This document will help state insurance departments identify uniform standards, promote accountability, and provide access to essential information. It also outlines the process for working with the insurance industry to identify risks and offer practical solutions.
The second draft document: the Annual Statement Supplement for Cybersecurity policies, comes from the NAIC’s Property and Casualty Insurance (C) Committee.
Here are the 18 draft principles from this first document:
NAIC’s Principles for Effective Cybersecurity Insurance Regulatory Guidance
- Principle 1. Insurance regulators have a significant role and responsibility regarding protecting consumers from cybersecurity risks.
- Principle 2. Insurance regulators have a significant role and responsibility regarding the insurers’ efforts to protect sensitive customer health and financial information.
- Principle 3. Insurance regulators have a significant role and responsibility in protecting the sensitive information housed in insurance departments and at the NAIC.
- Principle 4. Insurance regulators recognize the value of collaboration in the development of regulatory guidance with insurers, insurance producers, consumers and the federal government with the goal of a consistent, coordinated national approach.
- Principle 5. Compliance with cybersecurity regulatory guidance must be flexible, scalable, practical and consistent with the national efforts embodied in the National Institute of Standards and Technology (NIST) framework.
- Principle 6. Regulatory guidance must consider the resources of the insurer or insurance producer.
- Principle 7. Effective cybersecurity guidance must be risk-based and threat-informed.
- Principle 8. Insurance regulators should provide appropriate regulatory oversight, which includes but is not limited to, conducting risk-based, value-added financial examinations and/or market conduct examinations regarding cybersecurity.
- Principle 9. Planning for crisis response for insurance regulators, insurers, and insurance producers is an essential component to an effective cybersecurity program.
- Principle 10. The effective management of cybersecurity by third parties and service providers is essential for protection of consumer’s sensitive personal health and financial information.
- Principle 11. Information sharing is important for risk management purposes; however, it must be limited to essential cybersecurity information and protect sensitive confidential information.
- Principle 12. Cybersecurity risks should be included and addressed as part of an insurers and insurance producers Enterprise Risk Management processes.
- Principle 13. High level information technology internal audit findings should be discussed at the insurers and insurance producers Board of Director meetings.
- Principle 14. It is essential for insurers and insurance producers to join Financial Services Information Sharing and Analysis Center (FSISAC) to share information and stay informed about cyber and physical threat intelligence analysis and sharing.
- Principle 15. Sensitive data collected and stored and transferred inside or outside of an insurers or insurance producers network should be encrypted.
- Principle 16. Periodic and timely training for employees of insurers and insurance producers regarding cybersecurity issues is essential.
- Principle 17. Enhanced solvency oversight is needed for insurers selling cyber insurance to businesses and families.
- Principle 18. Additional data on the sale of cyber insurance products should be collected to assist insurance regulators with oversight of financial and market regulation.
Regarding Principle 7. Effective cybersecurity guidance must be risk-based and threat-informed. We most strongly endorse that point. Our Daily Threat Brief is now informing executives across most every sector of the economy and can provide a strong baseline on the threat to inform cyber security guidance. Subscribe for free at https://www.oodaloop.com
For more information, visit www.naic.org.
For more see:
