Illinois Statutes Chapter 215. Insurance § 215/15. Investigation of a cybersecurity event

(a) If the licensee learns that a cybersecurity event has occurred or may have occurred, the licensee, or an outside vendor or service provider designated to act on behalf of the licensee, shall conduct a prompt investigation.

(b) During the investigation the licensee, or an outside vendor or service provider designated to act on behalf of the licensee, shall, at a minimum, comply with as many of the following as possible:

(c) If the licensee learns that a cybersecurity event has occurred or may have occurred in a system maintained by a third-party service provider, the licensee will complete the steps listed in subsection (b) or confirm and document that the third-party service provider has completed those steps.

(d) The licensee shall maintain records concerning all cybersecurity events for a period of at least 5 years from the date of the cybersecurity event and shall produce those records upon demand of the Director.