Title 21, Insurance

(a) The own risk and solvency assessment summary report under AS 21.23.030 must be prepared in compliance with the own risk and solvency assessment guidance manual, subject to the requirements of (b) of this section. The insurer shall maintain documentation and supporting informa…

Documents, materials, or other information, including the own risk and solvency assessment summary report, that are obtained by, created by, or disclosed to the director or another person under this chapter are confidential and are considered trade secrets and proprietary busines…

An insurer shall pay $1,000 for each day the insurer fails to file the report within the time required in AS 21.23.030(a), not to exceed $365,000. The director may reduce the penalty under this section if the insurer demonstrates to the director that the imposition of the penalty…

The director may adopt regulations to implement, define, and enforce the provisions AS 21.23.010 — 21.23.090.

In AS 21.23.010 — 21.23.090, (1) “insurance group” means those insurers and affiliates included in an insurance holding company system as defined in AS 21.22.200; (2) “insurer” has the meaning given in AS 21.97.900, except that it does not include agencies, authorities, or instru…

(a) AS 21.23.240 — 21.23.399 establish the exclusive state standard for data security for licensees and govern the investigation and notification of a cybersecurity event. (b) AS 21.23.240 — 21.23.399 may not be construed to (1) create or imply a private cause of action for viola…

(a) A licensee shall conduct a risk assessment commensurate with the size and complexity of the licensee and in consideration of the nature and scope of the licensee's activities to evaluate the security and confidentiality of nonpublic information used by or in the possession or…

(a) A licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment conducted under AS 21.23.250(a). A licensee shall designate one or more employees, an outside vendor, or a third-party service provid…

(a) If a licensee becomes aware that a cybersecurity event has or may have occurred, the licensee or an outside vendor or third-party service provider designated to act on behalf of the licensee shall promptly investigate the cybersecurity event. During the investigation, if the …

(a) Unless a federal law enforcement official instructs the licensee not to distribute information regarding a cybersecurity event, a licensee shall notify the director as soon as possible and not later than three business days after the licensee determines that a cybersecurity e…

(a) Any document, material, or information in the possession or control of the division that is provided by a licensee or an employee or agent acting on behalf of a licensee under AS 21.23.260(f) or 21.23.280(b)(2) — (5), (8), (10), or (11) or that is obtained by the director in …

(a) AS 21.23.250 and 21.23.260 do not apply to (1) a licensee, including an independent contractor, with fewer than 10 employees; (2) a licensee if the licensee is an employee, agent, representative, or designee of another licensee covered by an information security program. (b) …

(a) In addition to the director's power to examine or investigate under AS 21.06.120, the director may examine and investigate the affairs of a licensee to determine whether the licensee is or has been in violation of AS 21.23.240 — 21.23.399. The director shall conduct an examin…

In AS 21.23.240 — 21.23.399, (1) “consumer” means an individual who is a resident of the state and whose nonpublic information is in a licensee's possession or control; (2) “cybersecurity event” (A) means an event resulting in unauthorized access to or disruption or misuse of an …