NAIC Advances Centralized Portal for Insurer Breach Reporting
The NAIC Cybersecurity (H) Working Group adopted its Centralized Cybersecurity Event Notification Portal project document at an interim meeting on March 13, 2026, and that document carries a first draft of the standard form licensees would file through the portal. The formal drafting, against Section 6B of the Insurance Data Security Model Law (#668), still has to happen before development begins. The Innovation, Cybersecurity and Technology (H) Committee put adoption of the project proposal on the agenda of its April 30 virtual meeting, and the minutes are not yet public. Today a licensee notifies each adopting state separately; the portal would take one filing.
The convenience carries a synchronization cost that is easy to miss. The 72-hour clock in Section 6.A of Model Law #668 starts at the determination that a cybersecurity event occurred, and it starts only in the states whose gates that event opens. Two gates do that work: the licensee’s domicile or home state, and any state where 250 or more resident consumers’ nonpublic information was involved and the event either triggers notice to another regulator or is reasonably likely to cause material harm. Those gates already fix how many regulators an event reaches; the portal would fix only how many filings it takes to reach them. With the model law on the books in more than two dozen jurisdictions per the NAIC’s own adoption map, one submission landing everywhere at once would hang every open deadline on a single internal timestamp.
That moves the thing worth auditing away from the filing mechanics and onto the determination process behind them. The project document signals what the portal will expect: one standard form carrying everything each adopting regulator needs to meet its own statutory requirements, secure downloads and logging that satisfy recordkeeping on both sides, and a notification the licensee updates in place as the investigation progresses. An insurer that today assembles a separate package per regulator would have to fold those into a single submission built to carry what every adopting state asks for. That change would move the internal question of when an event is formally “determined” to the center of every state’s deadline at once.
The vendor dimension does not change, but centralization would make it more visible. A third-party breach that touches insurance data still leaves the carrier, not the vendor, owning the notification under #668; the portal would push one vendor incident to every adopting regulator simultaneously rather than letting it trickle out filing by filing. That would make contractual breach-notification timelines with vendors a governance dependency, not boilerplate.
The recent NAIC PeopleSoft breach showed how a single upstream incident can put notification duties in motion across the whole regulated population. A centralized portal is the regulators’ bet that standardizing the reporting side will at least make that cascade legible while it happens.