Maine Revised Statutes Title 24-A. Maine Insurance Code § 2265. Investigation of cybersecurity event

1. Investigation. If a licensee learns that a cybersecurity event has or may have occurred, the licensee or an outside vendor or service provider designated to act on behalf of the licensee shall conduct a prompt investigation. During the investigation, the licensee or an outside vendor or service provider designated to act on behalf of the licensee, at a minimum, shall:

2. System maintained by 3rd-party service provider. If a licensee learns that a cybersecurity event has or may have occurred in an information system maintained by a 3rd-party service provider, the licensee shall either use its best efforts to complete the steps listed in subsection 1 or confirm that the 3rd-party service provider has completed those steps.

3. Maintenance of records. A licensee shall maintain records concerning a cybersecurity event for a period of at least 5 years from the date of the cybersecurity event and shall produce those records upon demand of the superintendent.