South Carolina Governor Signs Cybersecurity Bill into Law

May 29, 2018

South Carolina passed a cybersecurity bill that requires insurers to establish a “strong and aggressive” program to protect companies and consumers from a data breach.

The bill was passed by the state’s General Assembly on April 18 and signed by Gov. Henry McMaster on May 3.

The law creates rules for insurers, agents and other licensed entities covering data security, investigation and notification of breach. This includes maintaining an information security program based on ongoing risk assessment, overseeing third-party service providers, investigating data breaches and notifying regulators of a cybersecurity event. Other provisions that the new law provides include:

  • Protects consumer information: Safe-guarding individual insurance policy holder’s personal information is a high priority in the wake of several major insurance companies’ data breaches.
  • Establish data security standards: Requires insurance companies to mitigate the potential damage of a data breach. The law applies to insurers, insurance agents and other entities licensed by the South Carolina Department of Insurance.
  • Strong protection and quick reaction: Requires insurance companies to develop, to implement and to maintain a secure information security program, investigate any cybersecurity events and notify the South Carolina Department of Insurance of such events immediately.

The law requires a company to notify the insurance department within 72 hours after determining a cybersecurity event occurred. The company—or an outside service provider—must also investigate each incident to determine the scope of the breach, the nonpublic information compromised and the measures to restore the security of the company’s information system.

South Carolina is the first state to pass a measure based off the model law developed by the National Association of Insurance Commissioners Cybersecurity (EX) Working Group. South Carolina Insurance Director Raymond Farmer chaired the group.

Additionally, Rhode Island’s General assembly is considering a similar provision.


Contact ALTA at 202-296-3671 or [email protected].