NAIC Cybersecurity Model Law Training Academy - Risk Management Strategies

New cybersecurity risk management regulations for insurance companies are approaching faster than you might think. The National Association of Insurance Commissioners (NAIC) approved Insurance Data Security Model Law and the State of New York in March 2017 placed into effect Section 500 of Title 23 of the Official Compilation of Codes.

"Computers, software, programming and algorithms are all parts of a cybersecurity risk program but it is the interaction with the "humans" that makes all the difference in world."

NAIC's model law requires insurance organizations to have everything from information security program policies to incident response plans to specific breach notification procedures. Insurance organizations will also have to certify compliance to state insurance commissioners annually. Now that NAIC's model law is heading for adoption, it's important to learn how it might apply to your organization and what you can do now to start preparing for compliance.

This event focuses on describing the effective components of a modern cybersecurity risk management program. The attendees will be prepared to start the evaluation of an existing program. They will then be able to discuss with senior management, the audit committee, and the board of directors how to proceed in improving cybersecurity risk management. We consider five main components of an effective risk management program: data, control implementation, verification, breach preparedness and risk management.

Follow the below links for these regulations in HTML format on this website:
. 23 NYCRR 500 - NYS DFS Cybersecurity Regulation
. NAIC Data Security Model Law

This comprehensive training course is for anyone who wants to have a strong base of knowledge and understanding of the essentials of cybersecurity risk management.

This timely, two day CPE training seminar is designed for the project director, project leader and individuals who have to create effective cybersecurity program and the related documents for an insurance organization. Each attendee will go home with a set of 35 documents that were used to create the academy.

Follow the below links for further detail information:
. Seminar Highlights
. Learning Objectives
. Key Issues on the Agenda
. Table of Contents - Insurance Data Security Model Law
. Table of Contents - New York State Department of Financial Services 23 NYCRR 500

Each attendee will receive 16 CPE Hours.

The retail cost of this CPE seminar is $1,195.00 for the first attendee from a single organization. Discounts are available for more than one attendee from each organization: (2) $2,270.00 (3) $3,270.00 (4) $4,060.00 (5) $4,780.00.

To reserve your space, click on this SIGN-UP NOW! link and complete the registration form, and use the corresponding "Submit Registration Form and Move to Payment Options Page" button for filing the registration and moving to the payment page.

Testimonials:

View Testimonials from prior CCS attendees.

Presentation of all two day events is contingent until full payment has been received for three attendees. Once this requirement is meet, we update the seminar status with "Confirmed Event".

Course Duration: 2 Days; CPE Credits: 16; Knowledge Level: Basic; Field of Study: Information Technology, Risk Assessment, Audit; Delivery Format: Group-Live Presentation; Prerequisites: None; Advance Preparation: None. A certificate of completion will be provided.

 Upcoming NAIC Cybersecurity Model Law Training Academies:

Seminar Highlights

. What are the NAIC goals with this Act?
. How does this Act compare to New York State Regulation Section 500?
. Which organizations fall under the Act's provisions?
. What is the definition of "cybersecurity event".
. What is contained in an "Information Security Program".
. What is nonpublic information under an information security program?
. What is "publicly available information"?
. How do you approach creating a cybersecurity risk assessment?
. What are the eleven enumerated security measures?
. What does continuous monitoring mean?
. What Board of Director's oversight is required?
. What certficiation is required?

Learning Objectives

- Attendees will see how cybersecurity is an evolving art.
- Attendees will understand risk assessment from the cybersecurity viewpoint.
- Attendees will have examples for the minimum standards.
- Attendees will know the components in an effective information security program.
- Attendees will have an approach to controls at third party providers.
- Attendess will have a example incident reporting and notification plan.

Key Issues on the Agenda

Follow the below links for the regulations in PDF format:
. 23 NYCRR 500 - NYS DFS Cybersecurity Regulation
. NAIC Data Security Model Law

Insurance Data Security Model Law

Section 1. Title
Section 2. Purpose and Intent
Section 3. Definitions
Section 4. Information Security Program
Section 5. Investigation of a Cybersecurity Event
Section 6. Notification of a Cybersecurity Event
Section 7. Power of Commissioner
Section 8. Confidentiality
Section 9. Exceptions
Section 10.Penalties
Section 11.Rules and Regulations [OPTIONAL]
Section 12.Severability
Section 13.Effective Date

New York State Department of Financial Services 23 NYCRR 500

Section 500.00 Introduction.
Section 500.01 Definitions.
Section 500.02 Cybersecurity Program.
Section 500.03 Cybersecurity Policy.
Section 500.04 Chief Information Security Officer.
Section 500.05 Penetration Testing and Vulnerability Assessments.
Section 500.06 Audit Trail.
Section 500.07 Access Privileges.
Section 500.08 Application Security.
Section 500.09 Risk Assessment.
Section 500.10 Cybersecurity Personnel and Intelligence.
Section 500.11 Third Party Service Provider Security Policy.
Section 500.12 Multi-Factor Authentication.
Section 500.13 Limitations on Data Retention.
Section 500.14 Training and Monitoring.
Section 500.15 Encryption of Nonpublic Information.
Section 500.16 Incident Response Plan.
Section 500.17 Notices to Superintendent.
Section 500.18 Confidentiality.
Section 500.19 Exemptions.
Section 500.20 Enforcement.
Section 500.21 Effective Date.
Section 500.22 Transitional Periods.
Section 500.23 Severability.
APPENDIX A Certification of Compliance
APPENDIX B Notice of Exemption

Follow the below links for these regulations:
. 23 NYCRR 500 - NYS DFS Cybersecurity Regulation
. NAIC Data Security Model Law

Corporate Compliance Seminars (CCS) was created by experts who enjoy providing CPE training events. All our experts have years of experience in providing training courses, workshops and consulting on internal controls, internal auditing, information technology, cybersecurity and accounting related subjects. We have focused on SOX, COSO, PCAOB, COBIT, CMMI, GRC, GAAP, IFRS, AICPA, GAO, NAIC, ISO, and IIA Standards. We are your best source for continuing professional education (CPE).

Our programs, live in-person, webinar and on-demand, provide CPE for professionals with CPA, CGA, CIA, CFE, CISA, CMA and CA designations. CCS is focused on providing the best learning programs in using three distinct distribution channels: live in-person events, virtual webinar events and on-demand self-study elearning.

Corporate Compliance Seminars presents CPE to a range of professionals, auditors, accountants, finance staff, compliance personnel, information technology (IT) professionals, Boards of Directors and Audit Committees. We examine the details of risk management, Sarbanes-Oxley Act compliance, Model Audit Rule (MAR) compliance, auditing, internal controls, cybersecurity and compliance, and fraud prevention and detection.

Within the U.S.A. marketplace, Corporate Compliance Seminars allows the attendee to earn NASBA CPE credit.

Our events focus on the details of the Sarbanes-Oxley Act of 2002 (SOX), Internal Controls over Financial Reporting (ICFR), Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control Frameworks, ISACA's Control Objectives over Information Technology (COBIT), Information Technology Infrastructure Library (ITIL), Open Compliance & Ethics Group's (OCEG) Governance, Risk & Compliance (GRC) methodology, PCAOB's Auditing Standard 5 (AS5), AICPA auditing standards, and NAIC regulatory model regulations and acts .

Our live in-person events are generally presented in a small classroom setting with two to five attendees. Over the last few weeks, we have come to the understand we need to provide distant elearning events. We are now in the process of moving all our content to an online available status. We have created distant elearning opportunities using both a virtual webinar event approach and on-demand elearning self-study modules. These two elearning approaches: webinars and on-demand self-study with extended web access to our content into the global continuing professional development (CPD) marketplace. In the webinar elearning events we will limit the number of students to maximize the interaction between the live instructor and attendees. The on-demand self-study elearning modules will be created and offered to meet the NASBA CPE credit requirements .

Our seminars provide CPE for the CPA, CFE, CIA, CISA, auditors and others with effective and engaging internal audit training courses.

Our instructors have had direct experience in the following industries: financial activities, bank, insurance, healthcare, construction, leisure and hospitality, professional and business services, mining and oil & gas extraction, manufacturing, educational, government agencies, transportation, software, technical, hi-tech and agricultural.

top of page