Pennsylvania § 4514 Corporate oversight

Pennsylvania Statutes

§ 4514 — Corporate oversight

Pennsylvania § 4514

JurisdictionPennsylvania

Title 40INSURANCE

PartPART II

Ch. 45INSURANCE DATA SECURITY

Subch.PROCEDURES

This text of Pennsylvania § 4514 (Corporate oversight) is published on Counsel Stack Legal Research, covering Pennsylvania primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

40 Pa. Cons. Stat. § 4514 (2026).

Text

(a)Duties.--If a licensee has a board of directors, the board or an appropriate committee of the board shall, at a minimum:

(1)Require the licensee's executive management or delegates to develop, implement and maintain the licensee's information security program.

(2)Require the licensee's executive management or delegates to report in writing at least annually, the following information:

(i)The overall status of the information security program and the licensee's compliance with this chapter.

(ii)Material matters related to the information security program, addressing issues such as:

(A)Risk assessment, risk management and control decisions.

(B)Third-party service provider arrangements.

(C)The results of testing.

(D)Cybersecurity events.

(E)Any violation of this chapter

Free access — add to your briefcase to read the full text and ask questions with AI

(a) Duties.--If a licensee has a board of directors, the board or an appropriate committee of the board shall, at a minimum:

(1) Require the licensee's executive management or delegates to develop, implement and maintain the licensee's information security program.

(2) Require the licensee's executive management or delegates to report in writing at least annually, the following information:

(i) The overall status of the information security program and the licensee's compliance with this chapter.

(ii) Material matters related to the information security program, addressing issues such as:

(A) Risk assessment, risk management and control decisions.

(B) Third-party service provider arrangements.

(C) The results of testing.

(D) Cybersecurity events.

(E) Any violation of this chapter and management's responses to the violation.

(F) Recommendations for changes in the information security program.

(b) Delegation.--If the executive management of a licensee delegates any of its responsibilities under this section or section 4512 (relating to risk assessment), 4513 (relating to information security program) or 4515 (relating to oversight of third-party service provider arrangements), the executive management shall oversee the development, implementation and maintenance of the licensee's information security program prepared by the delegated entity, which shall provide a written report to the executive management in accordance with the reporting requirements of this chapter.