§ 507f-10

507F.10 Cybersecurity event reinsurers. 1. If a cybersecurity event involves nonpublic information used by, or that is in the possession, custody, or control of, a licensee that is acting as an assuming insurer and thatdoes not have a direct contractual relationship with consumers affected by the cybersecurityevent, the assuming insurer shall notify each of the assuming insurer’s affected cedinginsurers and the commissioner of the assuming insurer’s state of domicile within threebusiness days of determining that a cybersecurity event has occurred. A ceding insurerthat has a direct contractual relationship with a consumer affected by the cybersecurityevent shall comply with the applicable provisions of section 715C.2, and all other applicablenotification requirements pursuant to federal or state law. 2. If a cybersecurity event involves nonpublic information that is in the possession, custody, or control of a third-party service provider of a licensee that is acting as an assuminginsurer, the assuming insurer shall notify each of the assuming insurer’s affected cedinginsurers and the commissioner of the assuming insurer’s state of domicile within threebusiness days of the date the

er, the assuming insurer shall notify each of the assuming insurer’s affected cedinginsurers and the commissioner of the assuming insurer’s state of domicile within threebusiness days of the date the assuming insurer receives notice from the assuming insurer’sthird-party service provider that a cybersecurity event involving nonpublic informationhas occurred. A ceding insurer that has a direct contractual relationship with a consumeraffected by the cybersecurity event shall comply with the applicable provisions of section715C.2, and all other applicable notification requirements pursuant to federal or state law. 3. Notwithstanding any law to the contrary, a licensee acting as an assuming insurer shall have no other notice obligations related to a cybersecurity event or other data breach thanthe notice requirements pursuant to subsections 1 and 2. 2021 Acts, ch 79, §10, 17 Sat Dec 23 00:40:20 2023 Iowa Code 2024, Section 507F.10 (2, 0)