Pennsylvania Statutes Title 40 Pa.C.S.A. Insurance § 4512. Risk assessment

(1) Identify reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration or destruction of nonpublic information, including the security of information systems and nonpublic information that are accessible to, or held by, third-party service providers.

(2) Assess the likelihood and potential damage of threats, taking into consideration the sensitivity of the nonpublic information.

(3) Assess the sufficiency of policies, procedures, information systems and other safeguards in place to manage threats in each relevant area of the licensee's operations, including:

(4) Implement information safeguards to manage the threats identified in its ongoing assessment.

(5) At least annually, assess the effectiveness of the safeguards' key controls, systems and procedures.