NetworkDefender
NetworkDefender
Most insurance agencies know they handle sensitive data. Fewer know that Wisconsin has a dedicated insurance data security statute on the books, that it carries an annual certification to the state, or what happens when a breach hits an agency that never built the program the law requires. This covers all of it: the federal framework, Wisconsin's Insurance Data Security Law, the privacy rules, the health-information overlay, and the security standards your carriers now impose. If you are licensed to sell, solicit, or negotiate insurance in Wisconsin, every one of these applies to you.
The Gramm-Leach-Bliley Act is where this starts. Insurance companies, agencies, and producers are "financial institutions" under GLBA, and GLBA Title V requires you to protect nonpublic personal information and to be transparent about how you share it.
Because of the McCarran-Ferguson Act, insurance is regulated by the states. So GLBA does not reach your agency through the FTC; it reaches you through the Wisconsin Office of the Commissioner of Insurance (OCI). The FTC Safeguards Rule does not govern insurance licensees, OCI's rules do. The practical rulebook for a Wisconsin agency is state law: the Insurance Data Security Law and the privacy regulations in Chapter Ins 25, both of which implement GLBA for insurers.
This is the centerpiece. In 2021, Wisconsin enacted Act 73, creating subchapter IX of chapter 601, codified at Wis. Stat. §§ 601.95 to 601.956, the state's adoption of the NAIC Insurance Data Security Model Law. It is the single most important compliance framework for any agency in the state.
Who it covers. The law applies to a "licensee": any person licensed, authorized, or registered (or required to be) under Wisconsin insurance statutes chapters 600 to 655. That includes carriers, agencies, and individual producers. If you hold an insurance license in Wisconsin, you are a licensee.
What is required. Under Wis. Stat. § 601.952, every covered licensee had to develop and maintain a comprehensive written information security program by November 1, 2022, built on a documented risk assessment and containing administrative, technical, and physical safeguards. Specifically, you must:
Third-party service providers. As of November 1, 2023, you must also exercise due diligence in selecting vendors who touch your nonpublic information and take reasonable steps to require they maintain appropriate safeguards. If you outsource IT, use a cloud agency-management system, or share client data with any third party, that relationship must be governed and documented.
Board oversight. If your agency has a board, the board (or a committee) must oversee the program, and executive management must report to it at least annually on the program's status, compliance, risk decisions, vendor arrangements, and security testing.
This is the requirement most agencies do not see coming. Under Wis. Stat. § 601.952(8), licensees domiciled in Wisconsin must file an annual certification with OCI confirming compliance with the information security program requirements, due no later than March 1 each year (the first was due March 1, 2023). You must keep the records that support the certification for at least five years, and OCI can demand them.
It is an affirmative representation to your regulator that the program actually exists and works. If it does not, and a breach later proves it, that certification is the first document anyone looks at.
The information security program requirements of Wis. Stat. § 601.952 do not apply to a licensee that meets any one of the following:
Most small agencies will qualify. However, do not mistake an exemption for a pass on the paperwork. If your agency holds a business entity license with its own NPN, you are still required to log into the OCI portal by March 1st each year to explicitly file your certification and claim your exempt status.
Furthermore, the small-licensee exemption only applies to § 601.952. It does not exempt you from the investigation and notification requirements of §§ 601.953 and 601.954. An exempt agency must still investigate a cybersecurity event and provide OCI or consumer notice when the applicable statutory conditions are met. The exemption modifies the program requirements, not the exposure.
Investigate promptly. Under Wis. Stat. § 601.953, when you learn of a cybersecurity event you must promptly assess its nature and scope, identify what nonpublic information was involved, and take reasonable measures to restore security. If it occurred at a third-party provider, you must make reasonable efforts to confirm the provider investigated, or document its failure to cooperate. Records must be kept for at least five years.
Notify OCI when the reporting conditions are met. Under Wis. Stat. § 601.954(1), a Wisconsin-domiciled licensee must notify OCI if a cybersecurity event involving nonpublic information has a reasonable likelihood of materially harming a consumer or a material part of its normal operations, regardless of the number of consumers affected. For any licensee, notice is also required if it reasonably believes the event involves the nonpublic information of at least 250 consumers and either notice is required to another regulator or the event has a reasonable likelihood of that material harm. Notify OCI as promptly as possible, no later than three business days after determining the event occurred, and supplement the notice as more information becomes available.
Third-party incidents have a different clock. If the event occurs on a third-party service provider's system and the § 601.954(1)(a) reporting conditions are met, § 601.954(3) requires OCI notice within three days (not three business days) after the earlier of the provider's notification to the licensee or the licensee's actual knowledge of the event. The licensee need not provide that notice under subsection (3) if the provider provides the required notice under subsection (1).
Notify affected consumers when required. Under § 601.954(2), when nonpublic information was acquired by an unauthorized person, notice to affected consumers is generally due within a reasonable time not to exceed 45 days, subject to the subsection's exceptions, including for qualifying HIPAA entities and acquisitions without a material risk of identity theft or fraud. If a single event requires notifying 1,000 or more consumers, you must also notify the consumer reporting agencies, and you must provide a copy of any consumer notice to OCI.
Wisconsin Statute 134.98 is the state's general data breach notification law that governs most businesses, but insurance licensees do not operate under it. Wis. Stat. § 601.951 makes the insurance data security subchapter the exclusive state standard for data security, the investigation of cybersecurity events, and notification to government and consumers. For an insurance licensee, §§ 601.95 to 601.956 replace 134.98 entirely, and there is no softer general-law alternative to fall back on.
Separate from data security, Wis. Admin. Code Chapter Ins 25 (Privacy of Consumer Financial and Health Information) is Wisconsin's implementation of GLBA's privacy provisions. It governs how you tell consumers what you do with their information and when you may share it, requiring:
Agents can generally rely on the privacy notices of the carriers they represent, as long as they do not independently share nonpublic information outside the rule's exceptions. The moment an agency shares client data on its own outside those exceptions, it must issue its own notices. Data security protects the data; Ins 25 governs disclosing and sharing it. You need both.
If your agency sells or services health insurance or handles protected health information (PHI), determine whether your role and data practices bring you under HIPAA's rules.
Wisconsin builds in a specific coordination path under Wis. Stat. § 601.951(2)(d). For a licensee subject to and governed by HIPAA's rules in 45 CFR Parts 160 and 164 that maintains nonpublic information in the same manner as protected health information, the insurance data security subchapter does not apply except for § 601.954(1). OCI notice under that surviving provision is not automatic whenever consumer data is involved: a Wisconsin-domiciled licensee must have a cybersecurity event involving nonpublic information with a reasonable likelihood of materially harming a consumer or a material part of its normal operations; alternatively, a licensee that reasonably believes at least 250 consumers' nonpublic information is involved must meet the additional regulator-notice or material-harm condition. When § 601.954(1) applies, OCI notice is due as promptly as possible and no later than three business days after determining the event occurred; HIPAA's separate notification timeline does not extend that OCI deadline.
Not every requirement comes from a statute. Two industry forces now impose security obligations as a condition of doing business, and for many agencies they bite first.
Carrier appointments. Carriers increasingly condition appointments on demonstrated controls like MFA, endpoint detection and response, a written incident response plan, and evidence of a security program. The relationship is contractual and can require more than the state-law floor, so an agency that qualifies for the small-licensee exemption can still be required by its carriers to implement the full set of controls. Losing appointments is existential, which makes these requirements as binding as the law.
Cyber liability insurance. Your own cyber policy comes with underwriting questionnaires that function as a control checklist: MFA on email and remote access, EDR, tested backups, email security, and a documented incident response plan. Misrepresenting your controls can void coverage right after a breach. The controls the state asks you to build and the controls your insurer asks you to attest to are largely the same, build them once, satisfy both.
The regulatory framework is moving fast. The NAIC has introduced its new Model Bulletin on the Use of Artificial Intelligence Systems, which tightens expectations on how agencies govern algorithmic tools and AI-driven vendor software. Simultaneously, the NAIC is drafting a complete overhaul of its data privacy standards and standing up a centralized Cybersecurity Event Notification Portal to streamline breach reporting across state lines. When Wisconsin adopts these modernized frameworks, AI governance and third-party data tracking obligations will tighten significantly.
Start with the risk assessment and the written program. The certification, the breach response, and the carrier questionnaires all depend on whether that program genuinely exists. If you rely on the small-licensee exemption, document why, and remember you remain on the hook for breach investigation and consumer notification.
GLBA, Wisconsin's Insurance Data Security Law, the privacy rules in Ch. Ins 25, HIPAA where applicable, and your carriers' contractual requirements can each impose obligations and consequences. Assess which exemptions apply, document any required annual certification, and prepare for OCI notification when a reportable event meets the applicable conditions and deadline.
An agency that has not addressed these is exposed on every side at once: regulatory action from OCI, lost carrier appointments, voided cyber coverage, civil litigation, and lasting reputational damage. The agencies that handle this well are not the ones with the biggest IT budgets. They are the ones that document their security program the same way they document a policy file.
NetworkDefender Security helps Wisconsin insurance agencies meet their obligations under Wis. Stat. §§ 601.95–601.956, GLBA, and Ch. Ins 25. We build written information security programs and risk assessments, implement the controls the law and your carriers require, and prepare you for the annual OCI certification. Contact us to schedule a security review.
Want to see where you stand first? Run through our free Cyber Insurance & Compliance Readiness Checklist. It takes about five minutes and covers the same controls your carriers and cyber underwriters ask about.