Maine § 24-A §2266 Notification of cybersecurity event

Maine Statutes

§ 24-A §2266 — Notification of cybersecurity event

Maine·Title 24-A MAINE INSURANCE CODE·Ch. 24-B MAINE INSURANCE DATA SECURITY ACT

1.Notification to superintendent. Notwithstanding Title 10, chapter 210‑B, a licensee shall notify the superintendent as promptly as possible but in no event later than 3 business days from a determination that a cybersecurity event has occurred if:

2.Provision of information by licensee. A licensee shall provide in electronic form as directed by the superintendent as much of the following information regarding a cybersecurity event as possible:

3.Notification to consumers. A licensee shall comply with Title 10, chapter 210‑B, as applicable, and, when required to notify the superintendent under subsection 1, provide to the superintendent a copy of the notice sent to consumers pursuant to Title 10, chapter 210‑B.

4.Notice regarding cybersecurity events of 3rd-party service providers and

Free access — add to your briefcase to read the full text and ask questions with AI

1.
Notification to superintendent.
Notwithstanding Title 10, chapter 210‑B, a licensee shall notify the superintendent as promptly as possible but in no event later than 3 business days from a determination that a cybersecurity event has occurred if:
2.
Provision of information by licensee.
A licensee shall provide in electronic form as directed by the superintendent as much of the following information regarding a cybersecurity event as possible:
3.
Notification to consumers.
A licensee shall comply with Title 10, chapter 210‑B, as applicable, and, when required to notify the superintendent under subsection 1, provide to the superintendent a copy of the notice sent to consumers pursuant to Title 10, chapter 210‑B.
4.
Notice regarding cybersecurity events of 3rd-party service providers and ancillary service providers.
In the case of a cybersecurity event in an information system maintained by a 3rd-party service provider or ancillary service provider of which the licensee has become aware:
5.
Notice regarding cybersecurity events of reinsurers to insurers.
This subsection governs notice regarding cybersecurity events of reinsurers to insurers.
6.
Notice regarding cybersecurity events of insurance carriers to producers of record.
In the case of a cybersecurity event involving nonpublic information that is in the possession, custody or control of a licensee that is an insurance carrier or its 3rd-party service provider, and for which information a consumer accessed the insurance carrier's services through an independent insurance producer, the insurance carrier shall notify the producers of record of all affected consumers no later than the time consumers must be notified under subsection 3 or as directed by the superintendent, except that the insurance carrier is excused from this obligation for those instances in which it does not have the current producer of record information for any individual consumer.