Indiana Code Title 27. Insurance § 27-2-27-20

Sec. 20. (a) As part of its information security program, a licensee shall establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event.

(b) An incident response plan must include the following:

(c) Annually, not later than April 15, each insurer domiciled in Indiana shall submit to the commissioner a written statement certifying that the insurer is in compliance with the requirements set forth in sections 16 through 19 of this chapter and this section.  Each insurer shall maintain for examination by the department all records, schedules, and data supporting this certificate for a period of five (5) years.  To the extent an insurer has identified areas, systems, or processes that require material improvement, updating, or redesign, the insurer shall document the identification of the areas, systems, or processes and the remedial efforts planned and underway to address the areas, systems, or processes.  The documentation must be available for inspection by the commissioner.