Each licensee shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards for the protection of customer information. The administrative, technical, and physical safeguards included in the information security program shall be appropriate to the size and complexity of the licensee and the nature and scope of its activities.

1. (1) Physical safeguards ensuring that nonpublic personal information is under lock when agency personnel are not present to ensure its privacy; and
2. (2) Technical safeguards ensuring that any electronic information that can be potentially accessed by another person or entity be guarded by an appropriate software program; and
3. (3) Administrative safeguards that outline agency procedures indicating that nonpublic personal information is not to be provided to persons other than the insured, insurer or its representatives, or others as necessary to carry out the transaction or claim of the insured or customer or requests of the insured or customer and that spell out the specific physical and technical safeguards that are required by the agency.

Licensed producers must determine the level of safeguards appropriate for their business. For those licensed producers that require only a minimum level of safeguards based upon their size and complexity, the appropriate level of safeguards may consist of the following:

Source: 29 SDR 48, adopted September 20, 2002, effective March 1, 2003; 31 SDR 67, effective November 14, 2004.

General Authority: SDCL 58-2-40 , 58-2-41.

Law Implemented: SDCL 58-2-40 , 58-2-41.