Maine § 24-A §2265 Investigation of cybersecurity event

Maine Statutes

§ 24-A §2265 — Investigation of cybersecurity event

Maine § 24-A §2265

Title 24-AMAINE INSURANCE CODE

Ch. 24-BMAINE INSURANCE DATA SECURITY ACT

This text of Maine § 24-A §2265 (Investigation of cybersecurity event) is published on Counsel Stack Legal Research, covering Maine primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

Me. Rev. Stat. tit. 24-A, § 24-A §2265 (2026).

Text

1.Investigation. If a licensee learns that a cybersecurity event has or may have occurred, the licensee or an outside vendor or service provider designated to act on behalf of the licensee shall conduct a prompt investigation. During the investigation, the licensee or an outside vendor or service provider designated to act on behalf of the licensee, at a minimum, shall:

2.System maintained by 3rd-party service provider. If a licensee learns that a cybersecurity event has or may have occurred in an information system maintained by a 3rd-party service provider, the licensee shall either use its best efforts to complete the steps listed in subsection 1 or confirm that the 3rd-party service provider has completed those steps.

3.Maintenance of records. A licensee shall maintain records conce

Free access — add to your briefcase to read the full text and ask questions with AI

1.
Investigation.
If a licensee learns that a cybersecurity event has or may have occurred, the licensee or an outside vendor or service provider designated to act on behalf of the licensee shall conduct a prompt investigation. During the investigation, the licensee or an outside vendor or service provider designated to act on behalf of the licensee, at a minimum, shall:
2.
System maintained by 3rd-party service provider.
If a licensee learns that a cybersecurity event has or may have occurred in an information system maintained by a 3rd-party service provider, the licensee shall either use its best efforts to complete the steps listed in subsection 1 or confirm that the 3rd-party service provider has completed those steps.
3.
Maintenance of records.
A licensee shall maintain records concerning a cybersecurity event for a period of at least 5 years from the date of the cybersecurity event and shall produce those records upon demand of the superintendent.