Smart Choice Virginia 

Webinar Series:  Virginia Insurance Data Security Act Guide

NOTE: As of January 1, 2022 the NODE Internation Cyber Program with Burns & Wilcox is no longer available.  Cowbell Cyber is now available as of March 1, 2022. Our fourth webinar in the series will be held on Thursday, August 13th, 2020 at 3:00pm. In this session Presenter Roger Gill will breakdown the key factors that you ABSOLUTELY MUST KNOW about the Virginia Insurance Data Security Act, which went into effect on July 1st, 2020. Join Us to learn more about the new law and what you can do now to protect your agency and yourself in the event of a data breach.  Link to Recorded Webinar: Insurance Data Security Act Guide Webinar     Link to Insurance Data Security Act Document:  VA Cyber Security Guide  

The Virginia Information Security Program 

A Guide for Insurance Agents 

INTERNAL DRAFT: FOR AGENT USE ONLY

By Roger Gill & Daniel Brown

Originally Published August 11, 2020

Updated February 23, 2022

 

Purpose

  This document has been written to educate Independent Insurance Agencies on how to meet the new State and Federal Cyber Security and Data Breach Laws to Protect their agencies, which now includes Cyber Security Awareness Training, Development of a Cyber Security Program, Privacy and Data Breach Response Policy Manuals, Employee and Associate Contractor Cyber Security Program Training and more. The new Virginia Data Security Law based on the NAIC Data Security Model Law became effective July 1, 2020.  This law and associated regulations (not completed as of yet by the BOI) places a much higher level of compliance on Virginia Insurance Agencies.  Failure to comply may result in costly fines. Similar laws based on the NAIC Model Law have been passed in many other states and likely to be passed by most other states soon---requiring Agencies to comply that sell in multiple states.  Failure to report a Cyber Breach may result in costly fines also.    “If a company fails to give notice when it is required, the Attorney General may bring an action against it for up to $150,000 per breach.”  (What To Do First When Data Is Hacked: A Guide To Mandatory Notification For Virginia Businesses,  by JOLT, Allen, Spencer. Nov 9, 2017, Blog Posts) The following will provide an overview of the Virginia Data Security Law and how it impacts Insurance Agencies immediately and also address the components of the Law that will become effective in 2022 and 2023.  Specifically addressed will be an overview of  the Components of the New Virginia Law, Compliance Requirements, Prevention Tools and Resources,  Required Training for Staff, How to Develop a Data Security Policy and Breach Response Plan,  and How to Implement a Data Security Program Plan. Also provided will be information on Comprehensive Solutions for Compliance and Data Security Breach Protection for Insurance Agencies and on how to sell Cyber Security Protection Programs to other businesses.

Cyber Security Plan Solutions

How Can Insurance Agents meet the new Data Security Compliance requirements and protect their agencies from the high costs of a data breach? 

The Cyber Security compliance responsibilities along with enhanced data protection technologies and processes are most likely beyond the abilities of an Insurance Agency. However, the Cyber Security Solution is not as bad as it may appear, thanks to companies and organizations that specialize in this field. Below is a summary outline of immediate steps that agencies can take to meet the new compliance responsibilities and to protect their clients and agencies.

A. Get Educated on the New Law. Use the resources within this document. Additional resources include the large Insurance Brokers and Wholesalers Burns & Wilcox and RPS as well as The Agency Technology Counsel (ACT) of Independent Insurance Agency Association of America (BIG I).

B. An Important note: Agencies must appoint a Cyber Security Officer that will manage the Plan; however, the Agency Principal will be ultimately responsible. C. Another Note of Caution: Agencies need to be careful in the development of all written documents associated with the Security Plan including the required Data Security Manual, Training Manual, and Breach Response Manual. Agencies most likely will be held accountable for any processes and procedures; thus do not just copy a template and put the Agency Name on it. The Agency must be able to follow and to execute all processes and procedures included. Burns & Wilcox has developed Templates for all required documents that can be easily customized. They come with their Information Security Program. D. Purchase a Cyber Security Total Solution Program: Cowbell Cyber Insurance is available as of March 1, 2022 for Smart Choice Agents as a sub-code direct appointment in the Agents Program.   Cowbell Cyber offers a wealth of  risk management resources for policyholders including:  a Customizable Cyber Security Manual Template, Continuous Risk Assessment and Monitoring, Cybersecurity Awareness Training Program for employees, Access to Cowbell’s Risk Engineering Advice and more.  It is my understanding that Cowbell plans to provide agents with resources and services that will meet a "State's Info Data Security Compliance Requirements" in addition to their robust Cyber Policy.  Learn More   Press Release  Get Appointed  (Appointment is via an online portal on the Cowbell website.) As an Agent Program sub-code partner, Cowbell Commissions count toward the cap, and agents may write their own policy and get paid.  Cowbell enables agents to offer robust, standalone, and admitted cyber coverage to their clients. They can prepare customized quotes in minutes and issue policies instantaneously. Link to Recorded Webinar: Insurance Data Security Act Guide Webinar     Link to Insurance Data Security Act Document:  VA Cyber Security Guide  

Cyber Security Resources

Work In Progress

  From SuiteBriar on Google Suite Security

Google Suite Security Best Practices 

SuiteBriar BLOG   EXCELLENT GOOGLE SUITE Resource

Other Cyber Security Resources

NATIONAL INITIATIVE FOR CYBERSECURITY EDUCATION (NICE)

Cyber Security Prevention & Breach Management Information by Ready.Gov 

• • Department of Homeland Security (DHS) (Link)
  • Cyberattack Information Sheet (PDF)
  • DHS United States Computer Emergency Readiness Team (US-CERT) (Link)
  • DHS Stop.Think.Connect.™ Campaign (Link)
  • United States Secret Service Electronic Crimes Task Force (Link)
  • Federal Bureau of Investigation (Link)
  • Department of Justice (Link)
  • Federal Communications Commission (Link)
  • Internet Crime Complaint Center (Link)
  • Federal Trade Commission (Link)
  • National Cyber Security Alliance (Link)
  • National Center for Missing & Exploited Children’s CyberTipline (Link)
  • Internet Crimes Against Children Taskforce (Link)
  • NetSmartz (Link)
  • iKeepSafe (Link)
  • iSafe (Link)

FCC Cyber Security Planner

FTC - A Security Guide for Business

FTC Cyber Security Policy Analysis Identity Theft Resource Center 

Research Statistics Data and Systems CMS Information Security

NAIC Legislative Brief:  State Adoption MAP

Security Breach Notification Laws by State  from NCSL

IBM Main Data Breach Cost Study--Annually