Does My State Have an Insurance Cybersecurity Law?

Whether your state has an insurance cybersecurity law depends on where you sell insurance. As of the NAIC’s most recent state legislative brief, 28 jurisdictions have adopted the underlying model law. It’s called NAIC Model #668. Illinois is one of them.

Model #668 requires insurers and agencies to run an information security program. It also requires risk assessments and breach reporting to state regulators. Not every state has adopted it. Some rely on older, separate rules instead. Others show no current activity on this specific model at all.

The table below shows where every state stands right now. It also covers Washington D.C. and Puerto Rico.

How to Read the Table Below

The NAIC’s own adoption chart sorts every jurisdiction into one of three buckets. Knowing the difference matters before you draw conclusions about your state.

• Adopted: the state passed a version of Model #668 that the NAIC’s Legal Division considers substantially similar to the current model, in its entirety.
• Related activity / older law: the state has its own separate insurance data-security regulation on the books instead of the NAIC model as written.
• No current activity: the NAIC’s brief does not list the state as having adopted the model or having comparable related activity.

One more status shows up once: Pending. Idaho had a pending adoption in progress as of the NAIC’s last update, so it doesn’t cleanly fit any of the three buckets above yet.

This is a snapshot, not a live feed. State legislatures introduce and pass bills year-round, and the NAIC updates its chart periodically rather than in real time.

Insurance Cybersecurity Law by State

Source: NAIC’s state-adoption chart (ST-668, Summer 2025) and its August 2025 state legislative brief. As of that update. If this decision matters right now, confirm your state’s current status with your state Department of Insurance before you act on it.

A “no current activity confirmed in source” row does not mean your state definitely has no rule. It means the NAIC’s August 2025 brief did not name that state as adopted or as having related activity. Bills move fast. Check with your state DOI before treating this as final.

Illinois and Chicagoland: What This Means Right Now

Illinois adopted Model #668 in 2024. It’s codified at 215 ILCS 215. The law is already in effect, not pending.

If you’re an insurer, agency, or MGA licensed in Illinois, you’re already on the clock. This isn’t a “watch this space” state. It’s an “already law” state.

That means the full Section 4 requirement set applies to you:

LeadingIT is a managed IT and cybersecurity provider based in Woodstock and Manteno, Illinois.

Model #668’s technical controls map closely onto what a managed IT partner already builds:

• Access controls and multi-factor authentication
• Encryption of nonpublic information
• Ongoing monitoring and audit-trail logging
• A tested incident response plan

If your agency needs help getting there, see LeadingIT’s insurance/compliance IT services. Or book a call to talk through where you stand.

My State Isn’t on the Adopted List. Am I Off the Hook?

No. Here’s why:

• Exceptions are narrow, not automatic. Even in adopted states, only three groups qualify: licensees with fewer than 10 employees, licensees already compliant with HIPAA’s security rules, and employees already covered by another licensee’s program. – “No current activity” isn’t permanent. Illinois had no activity until 2024, then adopted the law outright. The NAIC’s own August 2025 brief lists Idaho as pending. State legislatures move on their own schedule. – Domicile can pull you in anyway. In an adopted state, the notification duty applies based on where an insurer is domiciled or where a producer’s home state is, not just where you happen to sell policies. Coverage is still partial today.

None of this tells you what compliance actually requires once your state reaches you. What NAIC Model Law 668 actually requires walks through it step by step. Or go straight to the full NAIC 668 compliance checklist for the requirement-by-requirement view.

See Where You Stand

Not sure exactly where your agency stands today? Answer 8 plain-English questions and get your compliance-readiness level, plus the specific gaps to close. No sign-up needed to see your result.

Take the free 2-minute NAIC 668 Risk-Check

Related Guides

• What Is NAIC Model Law 668? Insurance Data Security Explained
• NAIC 668 Compliance Checklist: Every Requirement, Plain English

Frequently Asked Questions

It sets standards for an information security program and for investigating and reporting a cybersecurity event to regulators. It’s a model, not a federal statute, so it only takes legal effect once a state’s legislature or insurance department adopts it.</p> </details>

Get Help Meeting Your State’s Requirements

Model #668 compliance touches nearly every part of your IT environment. That includes access controls, encryption, monitoring, and incident response. LeadingIT builds and maintains that environment for insurance agencies and insurers across Chicagoland. See LeadingIT’s insurance/compliance IT services or book a call to talk through your state’s specific requirements.

Want our cybersecurity insights first? Add LeadingIT as a preferred source on Google and see more of our guidance in your results.