Ohio’s New Data Security Law
Ohio’s New Data Security Law Seeks to Minimize the Risk of Data Breaches Impacting Insurers and Their Customers
Stu Sjouwerman, KnowB4
Following in the footsteps of North Carolina, the new Ohio law looks to regulate the cybersecurity practices, reporting, and notifications of its insurance industry.
Modeled after the NAIC Insurance Data Security Model Law, MDL-668, Ohio lawmakers are looking for ways to protect both Ohio businesses in the insurance sector, as well as the customer data they use. Every business is susceptible to cyber attack, phishing, social engineering scams, and fraud – and that includes insurers. This is the position taken by the Ohio legislature, who have unanimously passed a bill that will put additional burden on insurers and those businesses that maintain, process, or store nonpublic data owned by the insurer.
It’s no surprise to see legislation like this (and expect to see more of it) in the wake of data breaches like Marriott’s in 2018 exposing the personal data of over 500 million customers. Lawmakers are realizing that companies holding a material amount of nonpublic information about their customers are responsible to ensure the security of that data.
The new law requires insurers to put measures in place that include:
- An information security program
- Risk assessment and management
- Board of directors’ oversight
- Third-party service provider due diligence and monitoring
- Notice and investigation of cybersecurity events
- Annual certification to the Superintendent of Insurance
Insurers will need to establish a defense-in-depth strategy utilizing layers of security that include protecting the perimeter, network, endpoint, applications, and data. We highly recommend including Security Awareness Training as part of a comprehensive information security plan to educate users on attack methods, tactics, techniques, and scams in an effort to raise their security mindedness when interacting with external content via email or the web.
The insurance industry is only the beginning. We fully expect to see many other industries follow suit to protect the consumer.
Having a solid plan now is the key to ensuring your business doesn’t become a victim.
If you’re ready to discuss a plan to keep your customer’s data secure, give Ashton a call at 216.397.4080.
