Okla. Stat. tit. 36, § 36-675

information.

A. Every licensee shall notify the Insurance Commissioner

without unreasonable delay, but not later than three business days,

from a determination that a cybersecurity event involving nonpublic

information that is in the possession of a licensee has occurred

when either of the following criteria has been met:

1. This state is the state of domicile of the licensee, in the

case of an insurer, or this state is the home state of the licensee,

in the case of a producer, as those terms are defined in the

Oklahoma Producer Licensing Act, Sections 1435.1 through 1435.41 of

Title 36 of the Oklahoma Statutes, and the cybersecurity event has a

reasonable likelihood of materially harming any material part of the

Oklahoma Statutes - Title 36. Insurance Page 184

normal operations of the licensee or any consumer residing in this

state; or

2. The licensee reasonably believes that the nonpublic

information involved is of two hundred fifty (250) or more consumers

residing in this state and is either of the following:

a. a cybersecurity event impacting the licensee of which

notice is required to be provided to any government

body, self-regulatory agency, or any other supervisory

body pursuant to any state or federal law, or

b. a cybersecurity event that has a reasonable likelihood

of materially harming:

(1) any consumer residing in this state, or

(2) any material part of the normal operation or

operations of the licensee.

B. The licensee making the notification required in subsection

A of this section shall provide as much of the following information

as possible, electronically in the manner and form prescribed by the

Commissioner, along with any applicable fees. The licensee shall

have a continuing obligation to update and supplement initial and

subsequent notifications to the Commissioner regarding material

changes to previously provided information relating to the

cybersecurity event. The licensee shall provide:

1. Date of the cybersecurity event;

2. Description of how the information was exposed, lost,

stolen, or breached including, but not limited to, the specific

roles and responsibilities of third-party service providers, if any;

3. How the cybersecurity event was discovered;

4. Whether any lost, stolen, or breached information has been

recovered and, if so, how this was done;

5. The identity of the source of the cybersecurity event;

6. Whether the licensee has filed a police report or has

notified any regulatory, government, or law enforcement agencies

and, if so, when such notification was provided;

7. Description of the specific types of information acquired

without authorization. The term “specific types of information”

means particular data elements including, but not limited to, types

of medical information, financial information, or information

allowing identification of the consumer;

8. The period during which the information system was

compromised by the cybersecurity event;

9. The number of total consumers in this state affected by the

cybersecurity event. The licensee shall provide the best estimate

in the initial report to the Commissioner and update this estimate

with each subsequent report to the Commissioner pursuant to this

section;

Oklahoma Statutes - Title 36. Insurance Page 185

10. The results of any internal review identifying a lapse in

either automated controls or internal procedures, or confirming that

all automated controls or internal procedures were followed;

11. Description of efforts being undertaken to remediate the

situation which permitted the cybersecurity event to occur;

12. A copy of the privacy policy of the licensee and a

statement outlining the steps the licensee will take to investigate

and notify consumers affected by the cybersecurity event; and

13. Name of a contact person who is both familiar with the

cybersecurity event and authorized to act for the licensee.
ng undertaken to remediate the

situation which permitted the cybersecurity event to occur;

12. A copy of the privacy policy of the licensee and a

statement outlining the steps the licensee will take to investigate

and notify consumers affected by the cybersecurity event; and

13. Name of a contact person who is both familiar with the

cybersecurity event and authorized to act for the licensee.

C. A licensee shall comply with the procedures of the Security

Breach Notification Act, Section 161 et seq. of Title 24 of the

Oklahoma Statutes, to notify affected consumers and provide a copy

of the notice sent to consumers under that statute to the

Commissioner, when a licensee is required to notify the Commissioner

under subsection A of this section.

D. 1. In the case of a cybersecurity event in a system

maintained by a third-party service provider, of which the licensee

has become aware, the licensee shall treat the event as it would

under subsection A of this section unless the third-party service

provider provides the notice required under subsection A of this

section to the Commissioner and the licensee.

2. The computation of deadlines of the licensee shall begin on

the day after the third-party service provider notifies the licensee

of the cybersecurity event or the licensee otherwise has actual

knowledge of the cybersecurity event, whichever is sooner.

3. Nothing in this act shall prevent or abrogate an agreement

between a licensee and another licensee, a third-party service

provider, or any other party to fulfill any of the investigation

requirements or notice requirements imposed under this act.

E. 1. In the case of a cybersecurity event involving nonpublic

information that is used by the licensee that is acting as an

assuming insurer, or in the possession, custody, or control of a

licensee, that is acting as an assuming insurer and that does not

have a direct contractual relationship with the affected consumers,

the assuming insurer shall notify its affected ceding insurers and

the Commissioner of its state of domicile within three (3) business

days of making the determination that a cybersecurity event has

occurred. The ceding insurers that have a direct contractual

relationship with affected consumers shall fulfill the consumer

notification requirements imposed under the Security Breach

Notification Act, Section 161 et seq. of Title 24 of the Oklahoma

Statutes, and any other notification requirements relating to a

cybersecurity event imposed under this section.

2. In the case of a cybersecurity event involving nonpublic

information that is in the possession, custody, or control of a

third-party service provider of a licensee that is an assuming

Oklahoma Statutes - Title 36. Insurance Page 186

insurer, the assuming insurer shall notify its affected ceding

insurers and the Commissioner of its state of domicile within three
imposed under this section.

2. In the case of a cybersecurity event involving nonpublic

information that is in the possession, custody, or control of a

third-party service provider of a licensee that is an assuming

Oklahoma Statutes - Title 36. Insurance Page 186

insurer, the assuming insurer shall notify its affected ceding

insurers and the Commissioner of its state of domicile within three

(3) business days of receiving notice from its third-party service

provider that a cybersecurity event has occurred. The ceding

insurers that have a direct contractual relationship with affected

consumers shall fulfill the consumer notification requirements

imposed under Security Breach Notification Act, Section 161 et seq.

of Title 24 of the Oklahoma Statutes, and any other notification

requirements relating to a cybersecurity event imposed under this

section.

F. In the case of a cybersecurity event involving nonpublic

information that is in the possession, custody, or control of a

licensee that is an insurer or its third-party service provider for

which a consumer accessed the services of the insurer through an

independent insurance producer, and for which consumer notice is

required by this act or the Security Breach Notification Act,

Section 161 et seq. of Title 24 of the Oklahoma Statutes, the

insurer shall notify the producers of record of all affected

consumers of the cybersecurity event no later than the time at which

notice is provided to the affected consumers. The insurer is

excused from this obligation for any producers who are not

authorized by law or contract to sell, solicit, or negotiate on

behalf of the insurer, and in those instances in which the insurer

does not have the current producer of record information for an

individual consumer. Any licensee acting as an assuming insurer

shall have no other notice obligations relating to a cybersecurity

event or other data breach under this section or any other law of

this state.