Requirements & evidence
NAIC Insurance Data Security Model Law
A model law for insurance-sector information security programs, incident response, and breach notification, adopted individually by roughly 25-28 US states as of 2026. It becomes enforceable law only where a state has enacted its own version — the requirements can vary state to state.
- Edition on record
- Model #668
- Issuing authority
- National Association of Insurance Commissioners (opens in a new tab)
- Edition published
- Not stated by the authority
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for insurance, healthcare, across US. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Information security program
- Investigation of a cybersecurity event
- Notification of a cybersecurity event
- Third-party service provider oversight
The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.
Source access and licensing
The model law itself is a state-legislative product; once enacted by a given state it is public law and freely ingestible verbatim per that state's statute. Ingest per-state enacted text, not the NAIC drafting PDF.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
NAIC Insurance Data Security Model Law is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Named and tracked only; adoption and exact requirements vary by state — no consolidated catalog ingested.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked September 6, 2026. Confirm the applicable edition with the authority before beginning an assessment.
Announced transition
Roughly 25-28 states had adopted a version of Model #668 as of 2026. A 2026 amendment draft addresses AI and third-party data; it has not been finalized.
Authority’s stated timing: 2026 amendment draft not yet finalized
Read the authority’s announcement (opens in a new tab)- Model #668Current edition on recordPublication date not recorded
Check the basis
Sources you can follow.
Corroborated through independent sources; direct verification with the authority was unavailable. Source verification was recorded on September 6, 2026.
- National Association of Insurance Commissioners (opens in a new tab)
Issuing authority and framework publication.
- Edition reference: Model #668 (opens in a new tab)
The publication used to establish the recorded edition.
Catalog provenance and record details
Framework record: naic-insurance-data-security-668.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Information security program · Investigation of a cybersecurity event · Notification of a cybersecurity event · Third-party service provider oversight.
Record last updated: September 6, 2026.
Common questions
A closer look.
What is NAIC Insurance Data Security Model Law?
A model law for insurance-sector information security programs, incident response, and breach notification, adopted individually by roughly 25-28 US states as of 2026. It becomes enforceable law only where a state has enacted its own version — the requirements can vary state to state.
Who does NAIC Insurance Data Security Model Law apply to?
NAIC Insurance Data Security Model Law applies to insurance, healthcare, US, per National Association of Insurance Commissioners.
What is the current version of NAIC Insurance Data Security Model Law?
The current edition is Model #668, issued by National Association of Insurance Commissioners. Source: https://content.naic.org/insurance-topics/cybersecurity.
What does an assessment under NAIC Insurance Data Security Model Law require?
No control catalog has been ingested for NAIC Insurance Data Security Model Law yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.
At a glance
NAIC Insurance Data Security Model Law
Model #668
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Independent corroboration
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize NAIC Insurance Data Security Model Law requirements, evidence preparation, and review for your assessment scope.