What Is the NAIC Insurance Data Security Model Law?

The NAIC Insurance Data Security Model Law (Model #668) is a model law adopted by at least 28 U.S. jurisdictions that requires insurers and insurance agencies to maintain a written information security program, conduct risk assessments, and report breaches to regulators. Source: NAIC.

This law applies to the insurance industry itself, not to general businesses. It does not create any requirement for a typical small business to purchase cyber liability insurance. See Is Cyber Insurance Required by Law? for the full picture on legal requirements.