The notification must provide specified information about the cybersecurity
event, including details about the event and its discovery, a description of the
accessed nonpublic information, the number of affected Wisconsin residents, and the
licensee's efforts to address the circumstances that allowed the event to occur. The
licensee is required to update the commissioner on material changes to the
information and as additional information becomes available. If the cybersecurity
event involves a third-party service provider, the licensee must notify the
commissioner of the event unless the service provider does so.

Under the bill, the commissioner has the power to examine and investigate the
affairs of a licensee to determine whether a violation of any of the above requirements
has occurred. A licensee must generally keep records relating to the requirements
for at least five years and produce them upon demand of the commissioner. Any
documents, materials, and other information from a licensee that are in the
possession or control of the commissioner are confidential and privileged.
For further information see the state fiscal estimate, which will be printed as
an appendix to this bill.
The people of the state of Wisconsin, represented in senate and assembly, do
enact as follows:
SB784,1 1Section 1. 601.465 (3) (f) of the statutes is created to read:
SB784,3,32 601.465 (3) (f) All information protected under s. 601.955, which is subject only
3to the confidentiality provisions in s. 601.955.
SB784,2 4Section 2 . Subchapter IX (title) of chapter 601 [precedes 601.95] of the
5statutes is created to read:
SB784,3,66 Chapter 601
SB784,3,77 Subchapter IX
SB784,3,88 Insurance data security
SB784,3 9Section 3. 601.95 of the statutes is created to read:
SB784,3,10 10601.95 Definitions. In this subchapter:
SB784,3,13 11(1) “Authorized individual” means an individual who is known to and screened
12by a licensee and whose access to the licensee's information system or nonpublic
13information is determined by the licensee to be necessary and appropriate.
SB784,3,15 14(2) “Consumer” means an individual who is a resident of this state and whose
15nonpublic information is in the possession, custody, or control of a licensee.
SB784,4,2 16(3) “Cybersecurity event” means an event resulting in the unauthorized access
17to, or disruption or misuse of, an information system or the nonpublic information

1stored on an information system, except that a “cybersecurity event” does not include
2any of the following:
SB784,4,53 (a) The unauthorized acquisition of encrypted nonpublic information if the
4encryption process or key is not also acquired, released, or used without
5authorization.
SB784,4,86 (b) The unauthorized acquisition of nonpublic information if the licensee
7determines that the nonpublic information has not been used or released and has
8been returned to the licensee or destroyed.
SB784,4,10 9(4) “Encrypted” means the transformation of data into a form that results in
10a low probability of assigning meaning without the use of a protective process or key.
SB784,4,13 11(5) “Information security program” means the administrative, technical, and
12physical safeguards that a licensee uses to access, collect, distribute, process, protect,
13store, use, transmit, dispose of, or otherwise handle nonpublic information.
SB784,4,18 14(6) “Information system” means a discrete set of electronic information
15resources organized for the collection, processing, maintenance, use, sharing,
16dissemination, or disposition of nonpublic information, as well as any specialized
17system, including an industrial or process controls system, telephone switching and
18private branch exchange system, and environmental control system.
SB784,4,23 19(7) “Licensee” means a person licensed, authorized, or registered, or a person
20required to be licensed, authorized, or registered, under chs. 600 to 655, other than
21a purchasing or risk retention group that is chartered and licensed in another state
22or a person acting as an assuming insurer that is domiciled in another state or
23jurisdiction.
SB784,4,25 24(8) “Multifactor authentication” means authentication through verification of
25at least 2 of the following types of authentication factors:
SB784,5,1
1(a) Knowledge factor, including a password.
SB784,5,22 (b) Possession factor, including a token or text message on a mobile phone.
SB784,5,33 (c) Inherence factor, including a biometric characteristic.
SB784,5,6 4(9) “Nonpublic information” means electronic information in the possession,
5custody, or control of a licensee that is not publicly available information and is any
6of the following:
SB784,5,87 (a) Information concerning a consumer that can be used to identify the
8consumer, in combination with at least one of the following data elements:
SB784,5,99 1. Social security number.
SB784,5,1010 2. Driver's license number or nondriver identification card number.
SB784,5,1111 3. Financial account number or credit or debit card number.
SB784,5,1312 4. Security code, access code, or password that permits access to a financial
13account.
SB784,5,1414 5. Biometric records.
SB784,5,1815 (b) Information or data, other than information or data regarding age or
16gender, in any form or medium created by or derived from a health care provider or
17a consumer that can be used to identify the consumer and that relates to any of the
18following:
SB784,5,2019 1. The physical, mental, or behavioral health or condition of the consumer or
20a member of the consumer's family.
SB784,5,2121 2. The provision of health care to the consumer.
SB784,5,2222 3. Payment for the provision of health care to the consumer.
SB784,6,2 23(10) “Publicly available information” means information that a licensee has a
24reasonable basis to believe is lawfully made available to the general public from

1federal, state, or local government records, widely distributed media, or disclosures
2required by federal, state, or local law.
SB784,6,6 3(11) “Third-party service provider” means a person other than a licensee who
4contracts with a licensee to maintain, process, or store nonpublic information or is
5otherwise permitted access to nonpublic information through its provision of
6services to the licensee.
SB784,4 7Section 4. 601.951 of the statutes is created to read:
SB784,6,11 8601.951 General provisions. (1) Exclusive state standards. This
9subchapter establishes the exclusive state standards applicable to licensees for data
10security, the investigation of a cybersecurity event, and notification of a
11cybersecurity event to the commissioner.
SB784,6,16 12(2) Exceptions to applicability. (a) This subchapter does not apply to a person
13who is an employee, agent, representative, or designee of a licensee and who is also
14a licensee to the extent that the person is covered by the information security
15program of the other licensee and the other licensee has complied with this
16subchapter on behalf of the person.
SB784,6,2017 (b) This subchapter, except for s. 601.954 (1), does not apply to a licensee who
18is subject to and governed by 45 CFR Parts 160 and 165 and who maintains nonpublic
19information in the same manner as protected health information under 45 CFR
20Parts 160
and 165.
SB784,6,2221 (c) If a licensee ceases to qualify for an exception under par. (a) or (b), the
22licensee shall have 180 days to comply with this subchapter.
SB784,7,2 23(3) Agreements between parties. Nothing in this subchapter shall prevent or
24abrogate an agreement between a licensee and another licensee, a 3rd-party service

1provider, or another party to fulfill any of the requirements under s. 601.953 or
2601.954.
SB784,7,5 3(4) Private cause of action. This subchapter may not be construed to create
4or imply a private cause of action for violation of its provisions or to curtail a private
5cause of action that otherwise exists in the absence of this subchapter.
SB784,7,7 6(5) Rules. The commissioner may promulgate rules that are necessary to carry
7out the provisions of this subchapter.
SB784,5 8Section 5. 601.952 of the statutes is created to read:
SB784,7,16 9601.952 Information security program. (1) Implementation of program.
10No later than one year after the effective date of this subsection .... [LRB inserts
11date], a licensee shall develop, implement, and maintain a comprehensive written
12information security program based on the licensee's risk assessment under sub. (2)
13and consistent with the conditions of sub. (3) (a). The program shall contain
14administrative, technical, and physical safeguards for the protection of the licensee's
15information systems and nonpublic information. The licensee shall design the
16program to do all of the following:
SB784,7,1817 (a) Protect against threats and hazards to the security and integrity of the
18information systems and nonpublic information.
SB784,7,2119 (b) Protect against unauthorized access to and use of nonpublic information
20and minimize the likelihood of harm to a consumer from the unauthorized access or
21use.
SB784,7,2422 (c) Establish and periodically reevaluate a schedule for retention and disposal
23of nonpublic information and establish a mechanism for the destruction of nonpublic
24information that is no longer needed.
SB784,8,2
1(2) Risk assessment. The licensee shall conduct a risk assessment under which
2the licensee shall do all of the following:
SB784,8,63 (a) Identify reasonably foreseeable internal and external threats that could
4result in unauthorized access to or transmission, disclosure, misuse, alteration, or
5destruction of nonpublic information, including nonpublic information that is
6accessible to or held by 3rd-party service providers of the licensee.
SB784,8,87 (b) Assess the likelihood and potential damage of the threats identified under
8par. (a), taking into consideration the sensitivity of the nonpublic information.
SB784,8,119 (c) Assess the sufficiency of policies, procedures, information systems, and
10other safeguards to manage the threats identified under par. (a) in each relevant
11area of the licensee's operations, including all of the following:
SB784,8,1212 1. Employee training and management.
SB784,8,1413 2. Information systems, including the classification, governance, processing,
14storage, transmission, and disposal of information.
SB784,8,1615 3. Processes for detecting, preventing, and responding to attacks, intrusions,
16and other system failures.
SB784,8,18 17(3) Risk management. Based on the risk assessment under sub. (2), the licensee
18shall do all of the following:
SB784,8,2219 (a) Design an information security program to mitigate the identified threats,
20commensurate with the size and complexity of the licensee, the nature and scope of
21the licensee's activities, including its use of 3rd-party service providers, and the
22sensitivity of the nonpublic information.
SB784,8,2323 (b) Implement the following security measures, as appropriate:
SB784,8,2424 1. Place access controls on information systems.
SB784,9,4
12. Identify and manage the data, personnel, devices, systems, and facilities
2that enable the licensee to achieve its business purposes, taking into consideration
3the relative importance of the data, personnel, devices, systems, and facilities to the
4business objectives and risk strategy of the licensee.
SB784,9,65 3. Restrict physical access to nonpublic information to authorized individuals
6only.
SB784,9,97 4. Protect, by encryption or other means, nonpublic information being
8transmitted over an external network and nonpublic information stored on a
9portable computer or storage device or media.
SB784,9,1110 5. Adopt secure development practices for applications that are developed
11in-house and utilized by the licensee.
SB784,9,1312 6. Modify information systems in accordance with the licensee's information
13security program.
SB784,9,1514 7. Utilize effective controls, which may include multifactor authentication
15procedures for employees accessing nonpublic information.
SB784,9,1716 8. Implement regular testing and monitoring of systems and procedures to
17detect actual and attempted attacks on, or intrusions into, an information system.
SB784,9,2118 9. Include audit trails within the information security program that are
19designed to detect and respond to cybersecurity events and to reconstruct material
20financial transactions sufficient to support the normal operations and obligations of
21the licensee.
SB784,9,2422 10. Implement measures to protect against the destruction, loss, or damage of
23nonpublic information due to environmental hazards, natural and other disasters,
24and technological failures.
SB784,10,2
111. Develop, implement, and maintain practices for the secure disposal of
2nonpublic information in all formats.
SB784,10,43 (c) Designate at least one employee, affiliate, or outside vendor as responsible
4for the information security program.
SB784,10,65 (d) Stay informed regarding emerging threats and vulnerabilities and
6implement safeguards to manage the threats and vulnerabilities.
SB784,10,87 (e) No less than annually, assess the effectiveness of security safeguards,
8including key controls, systems, and procedures.
SB784,10,109 (f) Include cybersecurity risks in the licensee's enterprise risk management
10process.
SB784,10,1211 (g) Utilize reasonable security measures when sharing information, taking
12into consideration the character of the sharing and the type of information shared.
SB784,10,1413 (h) Provide personnel with cybersecurity awareness training that is updated
14as necessary.
SB784,10,24 15(4) Program adjustments. The licensee shall monitor, evaluate, and adjust the
16information security program under sub. (1) consistent with changes in technology,
17the sensitivity of the nonpublic information, internal and external threats to
18nonpublic information, and changes to the licensee's business operations,
19outsourcing arrangements, and information systems. If a licensee identifies areas,
20systems, or processes that require material improvement, updating, or redesign, the
21insurer shall document the identification and remedial efforts to address the areas,
22systems, or processes. The licensee shall maintain the documentation for a period
23of at least 5 years starting from the date the documentation was created and shall
24produce the documentation upon demand of the commissioner.
SB784,11,6
1(5) Incident response plan. As part of its information security program, a
2licensee shall develop an incident response plan to promptly respond to, and recover
3from, a cybersecurity event that compromises the confidentiality, integrity, or
4availability of nonpublic information, the licensee's information systems, or the
5continuing functionality of any aspect of the licensee's business or operations. The
6incident response plan shall be in writing and address all of the following:
SB784,11,77 (a) The goals of the incident response plan.
SB784,11,88 (b) The internal process for responding to a cybersecurity event.
SB784,11,109 (c) The identification of clear roles, responsibilities, and levels of
10decision-making authority during and immediately following a cybersecurity event.
SB784,11,1211 (d) The external and internal communications and information sharing during
12and immediately following a cybersecurity event.
SB784,11,1413 (e) Requirements for the remediation of identified weaknesses in the
14information systems and associated controls.
SB784,11,1615 (f) The reporting and documentation of a cybersecurity event and related
16incident response activities.
SB784,11,1817 (g) The evaluation and revision of the incident response plan following a
18cybersecurity event.
SB784,11,23 19(6) Oversight of 3rd-party service provider arrangements. No later than 2
20years after the effective date of this subsection .... [LRB inserts date], a licensee shall
21exercise due diligence in selecting a 3rd-party service provider. The licensee shall
22make reasonable efforts to require a 3rd-party service provider to do all of the
23following:
Loading...
Loading...