Cybersecurity Event Initial Notification Form

Section 33-105 of the Insurance Article, Maryland Annotated Code, requires a carrier to notify the Commissioner as promptly as possible, but no more than 3 business days from a determination that a cybersecurity event has occurred when either of the following criteria has been met:

                (1)          (i)    the State is the carrier’s state of domicile; and
(ii)    the cybersecurity event has a reasonable likelihood of harming a consumer residing in the State or any material part of the normal operations of the carrier; or

               (2)    the carrier reasonably believes that the nonpublic information involved is of 250 or more consumers residing in the State and either of the following circumstances is present:

                               (i)    a cybersecurity event impacting the carrier has occurred for which notice must be provided to a government body, self–regulatory agency, or any other supervisory body under state or federal law; or
(ii)    a cybersecurity event has occurred that has a reasonable likelihood of materially harming:

                                              1.    a consumer residing in the State; or
                                              2. a material part of the normal operation of the carrier.

The statute further states that a carrier shall provide the information in electronic form as directed by the Commissioner. This is the electronic form to be completed. Note that a carrier has a continuing obligation to update and supplement initial and subsequent notifications to the Commissioner regarding the cybersecurity event.

Answer the questions below, providing as much information as is reasonably possible. If information is not available at the time of the initial notification, provide a supplemental response using the case number assigned to this matter.

A1. ) Carrier Name (List each legal entity affected by the event)*

A2. ) Carrier's NAIC Number (List each legal entity affected by the event)*

A3.) Maryland Domestic Carrier?*

A4.) Line of Business?*

Life and HealthProperty and Casualty

A5.) Contact Name (The contact person is someone familiar with the cybersecurity event and authorized to act for the carrier.)*

First NameLast Name

A6.) Contact Job Title

A7.) Contact Email Address*

example@example.com

A8.) Contact Address*

Street Address

Street Address Line 2

CityState

Zip Code

A9.) Contact Phone Number*

B1.) What was the date of the cybersecurity event?

Approximately Date and Time

Hour MinutesAM/PM Option

B2.) If applicable, when did the cybersecurity event end?

Approximately Date and Time

Hour MinutesAM/PM Option

C1.) How was the cybersecurity event discovered?*

C2.) Has any lost, stolen, or breached information been recovered? If so, how was this done?*

C3.) Provide the identity of the source of the cybersecurity event, if known.*

C4.) Has a police report been filed or other regulatory, government, or law enforcement agencies been notified?*

C5.) Date of Law Enforcement Report Filed

Date

C6.) Describe the specific types of information acquired without authorization. Include particular data elements, such as types of medical information, types of financial information, or types of information allowing identification of the consumer.*

C7.) How many total consumers in Maryland were affected by the cybersecurity event? Provide your best estimate of this number in this initial report, and update in your subsequent reports.*

C8.) What were the results of your internal review? Did you identify a lapse in either automated controls or internal procedures or confirm that all automated controls or internal procedures were followed?*

C9.) What are the steps that the carrier will take to identify and notify consumers affected by the cybersecurity event?*

C10.) Please attach your privacy policy and your statement outlining the steps you will take to investigate and notify consumers affected by the cybersecurity event.*

C11.) Please attach the notice sent to consumers, if applicable. (Under 14-3504 of the Commercial Law Article)

Cybersecurity Event Initial Notification Form

Section A

Section B

Section C