An Act to Amend the Laws
Maine Legislature, Session 132, LD 1837
Senate Amendment SA_A_S278 (Senate)
Amends: 24-A MRSA §2263, 24-A MRSA §2264

SENATE AMENDMENT "A ,, to S.P, 720, L,D. 1837, "An Act to Amend the Laws 
Affecting Insurnnce" 
Amend the bill by striking out all of section 29 and inserting the following: 
'Sec, 29, 24-A MRSA §2263, sub-§1-A is enacted to read: 
1-A. Ancillary service provider. 
11Ancilla1y service provider" means a person that is 
not a licensee and that contrncts with a 3rd-party service provider 01· with another ancillary 
service provider to maintain, process or store nonpublic information obtained from the 
licensee or is otherwise permitted access to nonpublic information obtained from the 
licensee through its provision of services to the 3rd-party service provider or othe1· ancillary 
service pl'Ovider. 
Sec, 30. 24-A MRSA §2264, sub-§6, as enacted by PL 2021, c. 24, § 1, is amended 
to read: 
6, Oversight of 3rd-party service provider arrnngements. A licensee shall: 
A. Exercise due diligence in selecting its 3rd-pa11y service providers; aft& 
B. Require each 3rd-pat1y service provider to implement appropriate administrative, 
technical and physical safeguards to protect and secure the information systems and 
nonpublic information that are accessible to or held by the 3rd-party service provider.~ 
and 
C. No later than Janua1y 1. 2027. reguire each 3rd-party service provider to notify the 
licensee when the 3rd-party service provider becomes aware of any cybersecurity event 
affecting nonpublic information obtained from the licensee that has occurred in an 
information system maintained by the 3rd-party service provider 01· by an ancilla1y 
service provider if the cybersecurity event has a reasonable likelihood of matel'ially 
harming any consumer or any material pa11 of the nOl'mal operations of the licensee, 
Sec. 31. 24-AMRSA §2266, sub-§4, as enacted by PL 2021, c, 24, §1, is amended 
to read: 
4. Notice regarding cybersecurity events of 3rd-party service p1·oviders and 
ancillary service providers. In the case of a cybersecurity event in an information system 
Page I - 132LR0628(03) 
SENATE AMENDMENT 
~as 
SENATE AMENDMENT «,4" to S.P. 720, L.D. 1837 ( S • d 13J 
maintained by a 3rd-patty service provider or ancillary service provider of which the 
licensee has become aware: 
A. The licensee shall respond to the cybersecurity event as described under subsection 
1; and 
B. The computation of the licensee's deadlines for notification undet· this section 
begins on the day after the 3rd-patty service provider notifies the licensee of the 
cybersecurity event or the day after the licensee otherwise has actual knowledge of the 
cybersecul'ity event, whichever is sooner. 
Nothing ia this This chapter may not be constrned to prevent or abrogate an agreement 
between a licensee and another licensee, a 3rd-party service provider or any other party to 
fulfill any of the investigation requirements imposed under section 2265 or notice 
requirements imposed under this subsection.' 
Amend the bill by relettering 01· renumbering any nonconsecutive Part letter or section 
number to read consecutively. 
SUMMARY 
This amendment amends the bill by replacing changes made in the bill to the Maine 
Insurance Data Secul'ity Act. The amendment requires that a person who is licensed, 
required to be licensed or otherwise authorized to operate plll'suant to the insurance laws of 
the State must require that a contrncted 3rd-pa1ty service provider notify that person when 
the 3rd-party service provider becomes aware of any cybersecurity event affecting 
nonpublic information obtained from the person that has occuned in an information system 
maintained by the 3rd-party service provider or an ancilla1y service provider if the event 
has a reasonable likelihood of materially harming any consumer or any material part of the 
normal operations of the person. 
The amendment defines 
11anci11ary service provider" as a person, not licensed under the 
insurance laws of this State, that contracts with a 3rdNparty service provider or another 
ancillaty service provider to maintain, process or store nonpublic information obtained 
from a person licensed under the insurance laws of this State or is otherwise permitted 
access to that information through its services to the 3rd-party service provider or other 
anci1la1y service provider. 
SPONSORED BY: &, 
--------=-==--=c:::~. 
- __ -_ -------
(Senator BAILEY, D.) 
COUNTY: Yo1·k 
SENATE AMENDMENT