Alaska Statutes Title 21. Insurance § 21.23.270. Investigation of cybersecurity event

(a) If a licensee becomes aware that a cybersecurity event has or may have occurred, the licensee or an outside vendor or third-party service provider designated to act on behalf of the licensee shall promptly investigate the cybersecurity event. During the investigation, if the licensee, outside vendor, or third-party service provider determines that a cybersecurity event has occurred, the licensee, outside vendor, or third-party service provider shall, to the extent possible,

(b) If a licensee becomes aware that a cybersecurity event has or may have occurred in an information system maintained by a third-party service provider, the licensee shall, to the extent possible, complete the actions described in (a) of this section or confirm and document that the third-party service provider has completed those actions.

(c) A licensee shall maintain records concerning all cybersecurity events for a period of at least five years from the date of the cybersecurity event and shall produce the records at the request of the director.