Mich. Admin. Code R. 500.557
Manage and control risk; example.
(By the authority conferred on the Office of Financial and Insurance Services by Section 547 of 1956 PA 215, MCL 500.547, by Section 210 of 1956 PA 218, MCL 500.210, and E.R.O. No. 2003-1, and pursuant to 15 U.S.C. 6801, 6805(a)(6), 6805(b), 6805(c))Insurance
To manage and control risk, a licensee may do all of the following:
- (a) Design its information security program to control the identified risks, commensurate with the sensitivity of the information, as well as the complexity and scope of the licensee's activities.
- (b) Train staff, as appropriate, to implement the licensee's information security program.
- (c) Regularly test or otherwise regularly monitor the key controls, systems, and procedures of the information security program. The frequency and nature of these tests or other monitoring practices are determined by the licensee's risk assessment.
History: 2004 AACS.