Wisconsin Statutes Insurance (Ch. 600 to 655) § 601.953. Investigation of cybersecurity event

(1) If a licensee learns that a cybersecurity event involving the licensee's information systems or nonpublic information has or may have occurred, the licensee, or an outside vendor or service provider designated to act on behalf of the licensee, shall conduct a prompt investigation that, at a minimum, includes all of the following:

(2) If a licensee knows that a cybersecurity event has or may have occurred in an information system maintained by a 3rd-party service provider, the licensee shall comply with sub. (1) or make reasonable efforts to confirm and document that the 3rd-party service provider has either complied with sub. (1) or failed to cooperate with the investigation under sub. (1).

(3) The licensee shall maintain records concerning a cybersecurity event for a period of at least 5 years starting from the date of the cybersecurity event and shall produce the records upon demand of the commissioner.