Meet NAIC MDL-668 data security duties with less manual effort

The NAIC Insurance Data Security Model Law, Model #668, is a model act adopted by the National Association of Insurance Commissioners in late 2017. It sets standards for protecting insurance data, requiring licensees to run a risk-based information security programme, oversee third-party service providers, investigate cybersecurity events and notify the insurance commissioner. It only has legal force in states that enact it.

Licensees of a state insurance department in a state that has enacted the model law must comply. This includes insurers, producers and other persons licensed, authorised or registered under the state's insurance laws. Licensees with fewer than ten employees, including independent contractors, are exempt from Section 4, and HIPAA-covered licensees with a compliant programme are treated as meeting Section 4.

Section 4 requires a comprehensive written information security programme based on a risk assessment and scaled to the licensee's size, complexity and the sensitivity of the information it holds. It covers risk assessment, risk management safeguards such as access controls and encryption, board oversight, third-party service provider oversight, programme adjustments, an incident response plan and annual certification by domiciled insurers.

Under the model text, a licensee must notify the commissioner as promptly as possible and no later than 72 hours after determining that a cybersecurity event has occurred, where the state is its home state or domicile, or 250 or more state residents are affected and certain harm or reporting conditions apply. Enacted state versions can differ, so check your state's statute.

The model law leaves penalties to each state: a licensee that violates the Act may be penalised under the state's general insurance penalty statute. The commissioner can also examine and investigate licensees and take action where a violation is suspected. Penalty amounts therefore vary by state, so check the enacted law in each state where you are licensed.

MDL-668 does not require a specific framework or certification, but its risk-based programme overlaps heavily with ISO 27001 and NIST-based security programmes. Risk assessment, access control, encryption, logging, vendor oversight and incident response all appear in both. A mapped control set lets evidence gathered for ISO 27001 or SOC 2 support MDL-668 obligations too.

Each insurer domiciled in an enacting state must submit a written statement to its commissioner by 15 February each year, certifying compliance with Section 4. Insurers must keep supporting records for five years and document any areas needing material improvement along with the remedial work planned or underway, available for the commissioner to inspect.

OneClickComply has mapped NAIC MDL-668 in its control library, and support is available on request rather than live in the product today. Because controls are mapped across frameworks, evidence you collect for ISO 27001, SOC 2 or other standards can count towards MDL-668. OneClickComply does not issue certifications, and your annual certification remains your own statement.