Okla. Stat. tit. 36, § 36-674
This is the official text of Okla. Stat. tit. 36, § 36-674, part of Oklahoma’s Stat. tit. 36, — part of the compiled statutory law of Oklahoma, published by the state as "Stat. tit. 36,." Browse the sections below, each linked to its official government source.
Not legal advice. This page reproduces the official text of a government statute for reference only. Laws change, and how a statute applies depends on your specific facts. For advice about your situation, consult a licensed attorney in your state.
Cybersecurity event — Investigation by licensee
Official statutory text
A. If the licensee learns that a cybersecurity event has or may
have occurred, the licensee, or an outside vendor or service
provider designated to act on behalf of the licensee, shall conduct
a prompt investigation.
B. During the investigation, the licensee, or an outside vendor
or service provider designated to act on behalf of the licensee,
shall, at a minimum:
1. Determine whether a cybersecurity event has occurred;
2. Assess the nature and scope of the cybersecurity event;
3. Identify any nonpublic information that may have been
involved in the cybersecurity event; and
4. Perform or oversee reasonable measures to restore the
security of the information systems compromised in the cybersecurity
event in order to prevent further unauthorized acquisition, release,
or use of nonpublic information in the possession, custody, or
control of the licensee.
C. If the licensee learns that a cybersecurity event has or may
have occurred in a system maintained by a third-party service
provider, the licensee shall complete the steps listed in subsection
B of this section or confirm and document that the third-party
service provider has completed those steps.
D. The licensee shall maintain records concerning all
cybersecurity events for a period of at least five (5) years from
the date of the cybersecurity event and shall produce those records
upon request by the Insurance Commissioner.
have occurred, the licensee, or an outside vendor or service
provider designated to act on behalf of the licensee, shall conduct
a prompt investigation.
B. During the investigation, the licensee, or an outside vendor
or service provider designated to act on behalf of the licensee,
shall, at a minimum:
1. Determine whether a cybersecurity event has occurred;
2. Assess the nature and scope of the cybersecurity event;
3. Identify any nonpublic information that may have been
involved in the cybersecurity event; and
4. Perform or oversee reasonable measures to restore the
security of the information systems compromised in the cybersecurity
event in order to prevent further unauthorized acquisition, release,
or use of nonpublic information in the possession, custody, or
control of the licensee.
C. If the licensee learns that a cybersecurity event has or may
have occurred in a system maintained by a third-party service
provider, the licensee shall complete the steps listed in subsection
B of this section or confirm and document that the third-party
service provider has completed those steps.
D. The licensee shall maintain records concerning all
cybersecurity events for a period of at least five (5) years from
the date of the cybersecurity event and shall produce those records
upon request by the Insurance Commissioner.
Status: in_force · Read it on the official government site
Need a lawyer in Oklahoma?
Find a Oklahoma lawyer
About this page: Statute text is reproduced from official government publishers via the
Open US Law dataset
(Vaquill AI, snapshot v2026.08, CC BY 4.0). Primary legislative text like this is public domain under the government-edicts doctrine
(Georgia v. Public.Resource.Org, 2020). We link every section back to its official source so you can verify it independently.