Information Security Program and Security Event Notification for Financial Services Licensees

Enacted in 2025 and modeled on the FTC Safeguards Rule, this law requires non-bank financial services licensees to keep a written, risk-based information security program for customer information, including encryption, multi-factor authentication, annual penetration testing, secure disposal and an incident response plan. Licensees must report qualifying security events to the Division of Banking within three business days.