Ohio · statute · Ohio Rev. Code ch. 3965 · 11 active provisions
As used in this chapter: (A) "Assuming insurer" has the same meaning as in section 3901.61 of the Revised Code. (B) "Authorized individual" means an individual authorized by the licensee to access nonpublic information held by the licensee and its information systems. (C) "Ceding insurer" has the same meaning as in sec…
(A) Each licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment. The program shall be commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities including its use of third-party servic…
(A) If a licensee learns that a cybersecurity event has or may have occurred, the licensee or an outside vendor or service provider designated to act on behalf of the licensee shall conduct a prompt investigation. (B) During the investigation, the licensee or an outside vendor or service provider designated to act on b…
(A) Each licensee shall notify the superintendent of insurance as promptly as possible after a determination that a cybersecurity event involving nonpublic information in the possession of the licensee has occurred, but in no event later than three business days after that determination, when either of the following cr…
(A) The superintendent of insurance shall have power to examine and investigate into the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of this chapter. This power is in addition to the powers that the superintendent has under Title XXXIX and Chapters 1739.…
(A)(1) Any documents, materials, or other information in the control or possession of the department of insurance that are furnished pursuant to divisions (H)(1) and (I) of section 3965.02 and divisions (B)(1)(b), (c), (d), (e), (h), (j), and (k) of section 3965.04 of the Revised Code, or that are obtained by, created…
(A) A licensee is exempt from the requirements of section 3965.02 of the Revised Code if it meets any of the following criteria: (1) The licensee has fewer than twenty employees. (2) The licensee has less than five million dollars in gross annual revenue. (3) The licensee has less than ten million dollars in assets, me…
(A) A licensee that satisfies the provisions of this chapter shall be entitled to an affirmative defense to any cause of action sounding in tort that is brought under the laws of this state or in the courts of this state and that alleges that the failure to implement reasonable information security controls resulted in…
Notwithstanding any other provision of law, the provisions of this chapter and any rules adopted pursuant to this chapter constitute the exclusive state standards and requirements applicable to licensees regarding cybersecurity events, the security of nonpublic information, data security, investigation of cybersecurity…
The superintendent of insurance, pursuant to Chapter 119. of the Revised Code, may adopt rules as necessary to carry out the provisions of this chapter.
The superintendent of insurance shall consider the nature, scale, and complexity of licensees in administering this chapter and adopting rules pursuant to this chapter.