Investor Presentaiton
Report Submissions through the
SCDOI Cybersecurity Portal
SOUTH CAROLINA
DEPARTMENT INSURANCE
CONSUMERS
Search...
You Tube
LICENSING & CE
INSURERS
CAPTIVES
ABOUT US
How Do I...?
Feature Links > Cybersecurity
File a Complaint
SC DOI Connect Login
Investigating Fraud
SC Safe Home
Search SCDOI Database
Government and Industry
Resources
Employment at the DOI
Report State Agency Fraud
Cybersecurity
ONLINE
FORMS
BULLETINS
& ORDERS
ONLINE
SERVICES
MARKET
ASSISTANCE
NOTIFICATION
SUBSCRIPTIONS
Cybersecurity
On May 3, 2018, Governor Henry McMaster signed into law the South Carolina Insurance Data Security Act (the "Act"). The Act
will become effective on January 1, 2019. South Carolina is the first state in the nation to pass this important and timely
legislation which is modeled after the NAIC Insurance Data Security Model Law.
The Act is codified in Title 38, Chapter 99 of the South Carolina Code of Laws. The Act defines the requirements applicable to a
"licensee" and establishes standards for data security and standards for the investigation of and notification to the Director of a
cybersecurity event.
Key Implementation Dates
January 1, 2019: South Carolina Insurance Data Security Act becomes effective. This requires, among other things, that a
licensee notify the Director no later than 72 hours after determining that a cybersecurity event has occurred when certain criteria
are met.
July 1, 2019: Licensees must have implemented Section 38-99-20 by this date. This section requires that licensees establish a
comprehensive, written information security program by July 1, 2019.
July 1, 2020: Licensees must have implemented Section 38-99-20(F) by this date. This section details additional requirements
for licensees who contract with third-party service providers that maintain, process, store or otherwise is permitted access to
nonpublic information through its provision of services to the licensee.
February 15, 2020: Beginning on this date, each insurer domiciled in South Carolina must annually submit to the Director a
written statement certifying that the insurer is in compliance with the requirements set forth in Section 38-99-20.
Additional Information
The Department will issue a series of bulletins regarding the implementation of this legislation and each will be copied below as
they become available.
1. Bulletin 2018-02. South Carolina Insurance Data Security Act. This bulletin provides answers to questions such as to
whom does the Act apply, what does the legislation do, and when will the legislation be effective.
2. Bulletin 2018-09. Cybersecurity Event Reporting Form. This bulletin addresses the process for reporting a cybersecurity
event and provides guidance regarding what constitutes a cybersecurity event.
View a copy of the "Report a Cybersecurity Event" form.
999View entire presentation