reglab/housing_qa huggingface dataset:
IN Code § 27-2-27-14 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-14. "Risk Assessment"

Sec. 14. As used in this chapter, "risk assessment" means the assessment a licensee is required to conduct under section 17 of this chapter.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-15 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-15. "Third Party Service Provider"

Sec. 15. As used in this chapter, "third party service provider" means a person that contracts with a licensee to maintain, process, store, or otherwise is permitted access to nonpublic information through its provision of services to the licensee.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-16 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-16. Information Security Program; Requirements

Sec. 16. (a) A licensee shall develop, implement, and maintain a comprehensive, written information security program that:(1) is based on the risk assessment required under section 17 of this chapter; and(2) contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information systems.(b) An information security program must accomplish the following:(1) Protect the security and confidentiality of nonpublic information and information systems.(2) Protect against any threats or hazards to the security or integrity of nonpublic information and information systems.(3) Protect against unauthorized access to or use of nonpublic information and minimize the likelihood of harm to a consumer.(4) Define and periodically reevaluate a schedule for retention of nonpublic information and a procedure for its destruction when no longer needed.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-17 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-17. Risk Assessment; Requirements

Sec. 17. A licensee shall conduct a risk assessment of its information systems and treatment of nonpublic information by doing the following:(1) Designating one (1) or more employees, an affiliate, or an outside vendor designated to act on behalf of the licensee information security program.(2) Identifying reasonably foreseeable internal or external threats that could result in a cybersecurity event, including threats to information systems and nonpublic information held or accessed by third party service providers.(3) Assessing the likelihood and potential damage of the threats identified in subdivision (2), taking into consideration the sensitivity of the nonpublic information.(4) Assessing the sufficiency of the policies, procedures, information systems, and other safeguards currently in place to manage the threats identified in subdivision (2), including an assessment of threats in each relevant area of the licensee's operations, including the following:(A) Employee training and management.(B) Information systems, including network and software design, and information classification, governance, processing, storage, transmission, and disposal.(C) Procedures for detecting, preventing, and responding to cybersecurity events or other systems failures.(5) Implementing information safeguards to manage the threats identified under subdivision (2), and assessing the effectiveness of the safeguards' key controls, systems, and procedures at least one (1) time each year.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-18 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-18. Actions Required Based on Risk Assessment Results

Sec. 18. Based on the results of the risk assessment, a licensee shall do the following:(1) Design its information security program to mitigate the identified risks, commensurate with:(A) the licensee's size and complexity;(B) the nature and scope of the licensee's activities; and(C) the sensitivity of the nonpublic information in the licensee's control.(2) Determine and implement appropriate security measures, which may include the following:(A) Placing access controls on information systems, including controls to authenticate and permit only authorized individuals to have access to nonpublic information.(B) Identifying and managing the data, personnel, devices, systems, and facilities that enable the licensee to achieve business purposes in accordance with their relative importance to business objectives and risk strategy.(C) Restricting physical access to nonpublic information to authorized individuals only.(D) Protecting by encryption or other appropriate means all nonpublic information while being transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media.(E) Adopting secure development practices for in-house developed applications used by the licensee.(F) Modifying information systems in accordance with the licensee's information security program.(G) Using effective controls, which may include multi-factor authentication procedures for any employees accessing nonpublic information.(H) Regularly testing and monitoring systems and procedures to detect actual and attempted attacks on, or intrusions into, information systems.(I) Including audit trails within the information security program designed to detect and respond to a cybersecurity event and designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the licensee.(J) Implementing measures to protect against destruction, loss, or damage of nonpublic information due to environmental hazards, such as fire and water damage or other catastrophes or technological failures.(K) Developing, implementing, and maintaining procedures for the secure disposal of nonpublic information in any format.(3) Include cybersecurity risks in the licensee's enterprise risk management process.(4) Stay informed regarding emerging threats or vulnerabilities.(5) Use reasonable security measures when sharing information, relative to the character of the sharing and the type of information shared.(6) Provide personnel with cybersecurity awareness training that is updated as necessary to reflect risks identified in the risk assessment.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-19 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-19. Board of Directors; Executive Management

Sec. 19. (a) If the licensee has a board of directors, the board of directors shall require the licensee's executive management or its delegates to develop, implement, and maintain the licensee's information security program.(b) If the licensee's executive management delegates any of its responsibilities under this section, it shall:(1) oversee the development, implementation, and maintenance of the licensee's information security program prepared by the delegate; and(2) receive a report from the delegate concerning:(A) the overall status of the information security program;(B) the licensee's compliance with this chapter; and(C) material matters related to the information security program addressing such issues as:(i) risk assessment;(ii) risk management and control decisions;(iii) third party service provider arrangements;(iv) results of testing;(v) cybersecurity events and management's responses to cybersecurity events; and(vi) recommendations for changes in the information security program.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-20 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-20. Incident Response Plan

Sec. 20. (a) As part of its information security program, a licensee shall establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event.(b) An incident response plan must include the following:(1) The internal process for responding to a cybersecurity event.(2) The goals of the incident response plan.(3) The definition of clear roles, responsibilities, and levels of decision making authority.(4) External and internal communications and information sharing.(5) Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls.(6) Documentation and reporting regarding cybersecurity events and related incident response activities.(7) The evaluation and revision, as necessary, of the incident response plan.(c) Annually, not later than April 15, each insurer domiciled in Indiana shall submit to the commissioner a written statement certifying that the insurer is in compliance with the requirements set forth in sections 16 through 19 of this chapter and this section. Each insurer shall maintain for examination by the department all records, schedules, and data supporting this certificate for a period of five (5) years. To the extent an insurer has identified areas, systems, or processes that require material improvement, updating, or redesign, the insurer shall document the identification of the areas, systems, or processes and the remedial efforts planned and underway to address the areas, systems, or processes. The documentation must be available for inspection by the commissioner.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-22 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-22. Notice to Ceding Insurers and Commissioner of Cybersecurity Event

Sec. 22. (a) In the case of a cybersecurity event involving nonpublic information that:(1) is used by a licensee acting as an assuming insurer; or(2) is in the possession, custody, or control of a licensee that:(A) is acting as an assuming insurer; and(B) does not have a direct contractual relationship with the affected consumers;the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three (3) business days after making the determination that a cybersecurity event has occurred and the ceding insurers that have a direct contractual relationship with affected consumers shall fulfill the consumer notification requirements imposed under IC 24-4.9 and any other notification requirements relating to a cybersecurity event imposed under section 21(c) through 21(f) of this chapter.(b) In the case of a cybersecurity event involving nonpublic information that is in the possession, custody, or control of a third party service provider of a licensee that is an assuming insurer:(1) the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three (3) business days after receiving notice from its third party service provider that a cybersecurity event has occurred; and(2) the ceding insurers that have a direct contractual relationship with affected consumers shall fulfill the consumer notification requirements imposed under IC 24-4.9 and any other notification requirements relating to a cybersecurity event imposed under section 21(c) through 21(f) of this chapter.(c) Except for the obligations set forth in this section, a licensee acting as assuming insurer has no notice obligations relating to a cybersecurity event or other data breach under section 21 of this chapter or any other law of Indiana.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-23 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-23. Notice to Producers of Cybersecurity Event

Sec. 23. (a) In the case of a cybersecurity event:(1) that involves nonpublic information:(A) that is in the possession, custody, or control of a licensee that is an insurer or its third party service provider; and(B) for which a consumer accessed the insurer's services through an independent insurance producer; and(2) for which consumer notice is required by IC 24-4.9;the insurer shall notify the producers of record of all affected consumers of the cybersecurity event not later than the time at which notice is provided to the affected consumers.(b) The insurer is excused from the obligation set forth in subsection (a):(1) for any producers who are not authorized by law or contract to sell, solicit, or negotiate on behalf of the insurer; and(2) in those instances in which the insurer does not have the current producer of record information for an individual consumer.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-24 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-24. Powers of Commissioner

Sec. 24. (a) The commissioner may examine and investigate into the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of this chapter. This power is in addition to the other powers the commissioner has under this title. Any investigation or examination of a licensee under this section shall be conducted pursuant to IC 27-1.(b) Whenever the commissioner has reason to believe that a licensee has been or is engaged in conduct in Indiana that violates this chapter, the commissioner may take action that is necessary or appropriate to enforce this chapter.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-26 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-26. Exemptions From Chapter

Sec. 26. (a) A licensee is exempt from sections 16 through 20 of this chapter if the licensee has:(1) fewer than fifty (50) employees;(2) less than five million dollars ($5,000,000) in gross annual revenue; or(3) less than ten million dollars ($10,000,000) in year-end total assets.(b) A licensee that:(1) is subject to the federal Health Insurance Portability and Accountability Act (Pub.L. 104–191, 110 Stat. 1936, enacted August 21, 1996); and(2) has established and maintains an information security program pursuant to that federal act and the regulations, procedures, or guidelines established under that act;will be considered as meeting the requirements of this chapter, except for the notice requirements described in section 21 of this chapter.(c) An individual who:(1) is an employee, agent, representative, or designee of a licensee; and(2) is also a licensee;is exempt from sections 16 through 20 of this chapter and need not develop the individual's own information security program to the extent that the individual is covered by the information security program of the licensee of which the individual is an employee, agent, representative, or designee.(d) A licensee shall be considered to have complied with sections 16 through 20 of this chapter if the licensee is affiliated with a financial institution (as defined in 15 U.S.C. 6809) that maintains an information security program in compliance with the Interagency Guidelines Establishing Standards for Safeguarding Consumer Information adopted under Sections 501 and 505(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805(b)).(e) If a licensee ceases to qualify for an exception under subsection (a), (b), (c), or (d), the licensee must comply with sections 16 through 20 of this chapter not more than one hundred eighty (180) days after the licensee ceases to qualify for the exception.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-27 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-27. Suspension; Revocation

Sec. 27. If a licensee violates this chapter, the insurance commissioner may, after notice and hearing under IC 4-21.5, suspend or revoke the license, certificate of authority, or registration of the licensee.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-28 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-28. Rules

Sec. 28. The insurance commissioner may adopt rules under IC 4-22-2 to carry out the provisions of this chapter.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-29 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-29. Private Right of Action

Sec. 29. This chapter does not create a private right of action against any person.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-30 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-30. Exclusivity

Sec. 30. Notwithstanding any other provision of law, this chapter establishes the exclusive state standards applying to licensees for:(1) data security;(2) the investigation of a cybersecurity event; and(3) notification to the insurance commissioner concerning a cybersecurity event.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-31 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-31. Financial Institutions

Sec. 31. The requirements of this chapter do not apply to a financial institution (as defined in 15 U.S.C. 6809), except to the extent the financial institution transacts insurance business.As added by P.L.130-2020, SEC.10.
IN Code § 27-2-27-32 (2021)
2021 Indiana Code|Title 27. Insurance|Article 2. Powers and Duties of Insurers|Chapter 27. Insurance Data Security|27-2-27-32. Affirmative Defense

Sec. 32. (a) A licensee that satisfies the requirements of this chapter is entitled to an affirmative defense to any cause of action sounding in tort that:(1) is brought under the laws or in the courts of this state; and(2) alleges that the failure to implement reasonable information security controls resulted in a data breach concerning nonpublic information.(b) The affirmative defense available under this section does not limit any other affirmative defenses available to a licensee.As added by P.L.130-2020, SEC.10.
IN Code § 27-3-1-1 (2021)
2021 Indiana Code|Title 27. Insurance|Article 3. Consolidations and Reorganization|Chapter 1. Exchange of Securities|27-3-1-1. Construction and Application

Sec. 1. This chapter shall be supplemental to IC 27-1. All provisions of IC 27-1 shall be fully and completely applicable to this chapter in the same manner as if the provisions of this chapter had been an original part of IC 27-1; provided, that the provisions of this chapter shall be controlling in the event there exists any conflict between the provisions of this chapter and the provisions of IC 27-1.Formerly: Acts 1967, c.61, s.1. As amended by P.L.252-1985, SEC.138.
IN Code § 27-3-1-2 (2021)
2021 Indiana Code|Title 27. Insurance|Article 3. Consolidations and Reorganization|Chapter 1. Exchange of Securities|27-3-1-2. Authority to Adopt Plan of Exchange

Sec. 2. Any domestic stock insurance company (referred to in this chapter as the "domestic company") may adopt a plan of exchange providing for the exchange by its shareholders of their stock in the domestic company for:(i) shares of stock issued by any other stock insurance corporation organized or reorganized under the provisions of IC 27-1 or any statute enacted prior to March 8, 1935, or any stock corporation organized under the provisions of IC 23-1 or any foreign stock corporation (such other corporation is referred to in this chapter as the "acquiring corporation");(ii) other securities issued by the acquiring corporation;(iii) cash;(iv) other consideration; or(v) any combination of such stock, such other securities, cash, or other consideration.Formerly: Acts 1967, c.61, s.2. As amended by P.L.252-1985, SEC.139.
IN Code § 27-3-1-4 (2021)
2021 Indiana Code|Title 27. Insurance|Article 3. Consolidations and Reorganization|Chapter 1. Exchange of Securities|27-3-1-4. Filing; Time Plan Becomes Effective

Sec. 4. Not earlier than thirty-one (31) days after the date of the meeting of shareholders of the domestic company at which the plan of exchange was approved by such shareholders, a certificate setting forth the plan of exchange, the manner of the approval thereof by the directors of the acquiring corporation and the domestic company and the manner of its adoption and the vote by which adopted by the shareholders of the domestic company or setting forth that the plan of exchange has been abandoned shall be signed on behalf of each such corporation by its president or a vice-president and shall then be presented in triplicate to the department at its office for filing. The department shall file one (1) copy of such certificate in its offices and shall deliver copies bearing the date and time of filing endorsed thereon to the domestic company and the acquiring corporation. Upon the filing of such certificate, the plan of exchange and the issuance and exchange provided for therein shall become effective, unless a later date and time is specified in the plan of exchange, in which event the plan of exchange and the issuance and exchange provided for therein shall become effective upon such later date and time.Formerly: Acts 1967, c.61, s.4.