Governance, risk & compliance
NAIC Insurance Data Security Model Law (#668), state adoptions Model #668; state laws as read 24 Oct 2026
The NAIC Insurance Data Security Model Law (#668) is a model, not a law.
It has force only where a state enacted it, and the states changed it: deadlines, size exemptions and dates differ. This framework follows the model law’s own sections (3 definitions, 4 information security program, 5 investigation, 6 notification, 9 exceptions, 10 penalties) and lists the state laws that were actually read.
Model structure as read from the NAIC PDF through a summarising tool (the NAIC site blocks direct download, so section numbers are from that summary): s. 4 requires a written program based on a risk assessment, board oversight, oversight of third-party service providers, an incident response plan and an annual certification to the commissioner by 15 February with five years of records; s.
6 requires notice to the commissioner within 72 hours of a cybersecurity event involving nonpublic information of 250 or more consumers in the state, with a list of required content, and consumer notice under the state breach law; s. 9 exempts licensees with fewer than 10 employees from s.
4, treats HIPAA-compliant licensees as compliant with s. 4 if they certify, and gives 180 days to comply on losing an exemption.
The NAIC says 28 jurisdictions had implemented the model as of 8 October 2026 (AL, AK, CT, DE, HI, IL, IN, IA, KY, LA, ME, MD, MI, MN, MS, MO, NH, ND, OH, OK, PA, PR, RI, SC, TN, VT, VA, WI) and its map does not decide whether a state law has every model element. Read from a state source for this pack (citations in the STATES domain rows and ussc_notes.
md): AK, CT, DE, HI, IL, IN, IA, KY, ME, MD, MI, MN, MS, MO, NH, ND, OH, OK, SC, TN, VT, VA and WI. Listed by the NAIC but NOT read from a state source: AL, LA (a 2020 digest only; enacted status not confirmed), RI (no enacted chapter was found, only introduced bills) and PR.
Not listed by the NAIC and not read: NJ, NE, GA, AZ, CO, KS, TX, WY, ID, UT, FL. Pennsylvania is built in PA_STATE, and New York’s insurance cybersecurity rule is 23 NYCRR Part 500 in NYDFS_500; neither is repeated.
Check your own state’s text before relying on a number here: deadlines in the laws read range from 72 hours to 3, 5 or 10 business days, and employee-count exemptions range from 10 to 50, some with revenue or asset alternatives. A section on using AI tools applies the existing duties (third-party provider oversight, protection of nonpublic information); regulator guidance on AI in insurance was not reviewed.
General information, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses NAIC Insurance Data Security Model Law (#668), state adoptions at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Licensee (full program) | A licensed insurer, producer or other person licensed under the insurance law of a state that adopted the model, that does not fall into an exemption. Owns the full s. 4 program, the s. 5 investigation, the s. 6 notices and the annual certification. Check your state’s text for who counts as a licensee. | — |
| Small licensee | A licensee below the size line your state sets. The model uses fewer than 10 employees for exemption from s. 4; states read use 10, 15, 20, 25 or 50 employees, and some add revenue or asset tests (for example IA, OH, TN and IN use under $5 million revenue or under $10 million assets). The exemption covers the program section only; investigation and notification still apply. Lose the exemption and 180 days (model s. 9) may apply. | — |
| HIPAA-compliant licensee | A licensee that keeps a HIPAA-compliant information security program and sends the commissioner the written statement of compliance the model requires (s. 9). It is treated as meeting the program section, but investigation and notification to the commissioner still apply. Not every state lists this exception in the same form. | — |
| Third-party provider | A person that maintains, processes or has access to nonpublic information through its services to a licensee. It is not itself the licensee, but the licensee must oversee it, and it must tell the licensee of a cybersecurity event so the licensee can meet its own deadline. Some states phase in this oversight later (for example ME by 1 January 2027, MD 1 October 2024). | — |
How Lavawall® helps you get to NAIC Insurance Data Security Model Law (#668), state adoptions compliance
Most of NAIC Insurance Data Security Model Law (#668), state adoptions comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to NAIC Insurance Data Security Model Law (#668), state adoptions, and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against NAIC Insurance Data Security Model Law (#668), state adoptions in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports NAIC Insurance Data Security Model Law (#668), state adoptions as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- NAIC Insurance Data Security Model Law (#668), state adoptions Model #668; state laws as read 24 Oct 2026
- Category
- Industry
- Region
- USA
- Levels
- 4 assessment tiers
All United States frameworks and training →
Map this framework freeTalk to our team