STATE CYBER & BREACH REQUIREMENTS
State-based requirements, translated into proof.
Select a state to see:
- Breach notification basics (applies to everyone)
- Insurance cybersecurity overlays (where adopted)
- Federal overlays (FTC Safeguards / GLBA)
- The evidence you should be able to produce on demand
Built for "show me" moments—renewals, audits, DOI exams, and diligence.
Free • confidential • ~2 minutes • built from real regulator + auditor questions
Select your state
Most requirements share the same fundamentals: a written program, risk decisions, vendor oversight, incident readiness, and an evidence trail. What differs by state is timing, who must be notified, and how you're expected to present proof.
Operate in multiple states? Select each state you care about—your program should meet the strictest applicable requirements.
The map highlights insurance cybersecurity overlays. Breach notification laws apply in every state—see the state summary below.
State summary
Select a state on the map (or from the list) to see:
- What applies to everyone (breach notification + baseline expectations)
- Industry overlays (insurance / tax & accounting)
- The evidence artifacts you should keep ready
Nationwide Baseline
Core security + breach notification expectations
Federal and common-sense expectations that apply everywhere—written program, MFA, vendor oversight, incident readiness, and evidence you can produce.
Alabama
Ala. Code §27-62-1 to 27-62-11
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Alaska
SB 134 • Alaska Insurance Data Security Law • AS 21.23.240–.399
State-based requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Arizona
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Arkansas
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
California
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Colorado
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Connecticut
CT Gen. Stat. §38a-38
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Delaware
18 Del. C. §8601-8611
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Florida
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Georgia
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Hawaii
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Idaho
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Illinois
Public Act 103-0142
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Indiana
Ind. Code §27-2-27
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Iowa
Iowa Code §507F
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Kansas
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Kentucky
HB 474 (KRS 304.17D)
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Louisiana
La. R.S. 22:2501-2511
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Maine
24-A M.R.S. §2266
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Maryland
MD Code, Ins. §33-101 to 33-112
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Massachusetts
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Michigan
MCL 500.559
State-based requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Minnesota
Minn. Stat. §60A.9853
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Mississippi
Miss. Code Ann. §83-5-801 to 83-5-825
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Missouri
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Montana
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Nebraska
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Nevada
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
New Hampshire
RSA 420-P
State-based requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
New Jersey
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
New Mexico
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
New York
23 NYCRR 500
Evidence-first expectations (23 NYCRR 500) mapped to what you must show in audits.
North Carolina
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
North Dakota
NDCC 26.1-02.2
State-based requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Ohio
Ohio Rev. Code §3965 (SB 220)
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Oklahoma
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Oregon
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Pennsylvania
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Rhode Island
R.I. Gen. Laws §27-2-30
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
South Carolina
SC Code Ann. §38-99
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
South Dakota
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Tennessee
Tenn. Code Ann. §56-2-1001 to 56-2-1012
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Texas
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Utah
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Vermont
9 V.S.A. §2435
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Virginia
Va. Code §38.2-621 to 38.2-629
NAIC 668-style requirements mapped to actions + evidence (WISP, risk, vendors, incident readiness).
Washington
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
West Virginia
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Wisconsin
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Wyoming
Nationwide baseline
No dedicated state insurance cybersecurity statute. Baseline expectations still apply: written security plan, risk decisions, vendor oversight, MFA, and incident readiness—with evidence you can export.
Ready to map your requirements?
Get a prioritized checklist in 2 minutes—what you have, what’s missing, and what evidence to collect next. Then book a short program review to confirm scope, state deltas, and what to prep for “show me” requests.