LISTEN NOW: Evolution of Data Controls in the Era of Generative AI

View
Contact Us See a demo

NAIC Model 673 – Standards for Safeguarding Customer Information Model Regulation

Operationalize US NAIC 672 compliance with the most comprehensive PrivacyOps platform

Last Updated on octubre 10, 2023

Schedule Your
Personal Demo

Learn how you can leverage Securiti’s Data Command Center to address data security, privacy, governance, and compliance.

Ver una demostración
Schedule your demo today

The National Association of Insurance Commissioners (NAIC) is a US-based non-profit organization governed by the chief insurance regulators from the 50 states, the District of Columbia, and five US territories. In addition to preserving the financial security and solvency of the insurance business, one of NAIC’s main goals is to advance and safeguard the interests of insurance consumers by developing model laws for passage by the state legislatures. One of the several model laws developed by the NAIC to safeguard consumer data privacy and protection is the Standards for Safeguarding Customer Information Model Regulation (Model 673).

Model 673 establishes standards for the insurers licensed, authorized, or registered under state insurance laws (licensees) to develop and implement administrative, technical, and physical safeguards for protecting customer information's security, confidentiality, and integrity pursuant to sections 501, 505(b), and 507 of the federal Gramm-Leach-Bliley Act. Under Model 673, the licensees are required to implement a comprehensive written information security program, regularly assess the foreseeable internal and external threats to the protection of customer information, and keep the information security program updated in light of changing technology and other relevant factors.

Model 673 has been adopted by several US states, including Alabama, Alaska, Arizona, California, Colorado, Connecticut, Delaware, Florida, Illinois, Iowa, Maine, Minnesota, Missouri, Montana, Nebraska, New Jersey, New York, Oregon, Utah, Virginia, Wyoming and others.

The Solution

Securiti enables organizations to comply with Model 673 through AI-driven PI data discovery, DSR automation, documented accountability, enhanced visibility into data processing activities, and AI-driven process automation.

Securiti supports enterprises' journey toward compliance with 673 through automation, enhanced data visibility, and identity linking.

 

naic-macbook-pro-seccuriti

Request a demo to learn how Securiti can aid you and your organization's compliance efforts today.

Assess Model 673 Readiness

Utilize Securiti's collaborative readiness assessment template to assess your organization's compliance with Model 673 requirements, assess compliance gaps, and mitigate risks. Seamlessly expand assessment capabilities across your vendor ecosystem to maintain compliance against this standard.

naic-model-readiness-assessment
naic-model-risk-assessment

Automate Risk Assessments

Sections: 6A, 6B, 7A, 7C

Automate and schedule regular risk and security assessments using Securiti's Assessment Automation module to ensure your practices fully comply with the requirements of Model 673. Monitor data risk over time with a clear breakdown of various contributors to risk and uncover high-risk activity within your environment.

Assess and Oversee Service Providers

Section: 8

Utilize Securiti's Vendors Assessment module to assess the compliance status of your vendors with a particular standard.

securiti-vendor-assessment-naic-model
data-securiti

Automate Data Security Program

Sections: 3, 4, 9

Leverage Securiti's Data Security Posture Management module to identify the necessary security controls and implement appropriate security measures for your organization.

Key Facts about the NAIC Model 673

1

Information Security Program: Model 673 requires the licensees to implement a written information security program, including the administrative, technical, and physical measures appropriate to the size and complexity of the licensees and the nature and scope of their activities, to safeguard customer information.

2

Risk assessment: The licensees must conduct regular risk assessments to identify reasonably foreseeable threats that can result in unauthorized disclosure, misuse, alteration, or destruction of consumer personal information.

3

Risk management: The licensees must design their information security program to take appropriate measures to mitigate the risks identified through the risk assessment and regularly monitor the controls, systems, and procedures of the information security program.

4

Service provider arrangement: Under Model 673, the licensees must exercise appropriate due diligence in selecting their service providers and ensure that the service providers observe compliance with the requirements of Model 673.

5

Ongoing monitoring: Model 673 requires the licensees to continuously monitor, evaluate, and adjust the information security program in light of technological changes, the sensitivity of customers’ personal information, and changing business arrangements.

IDC MarketScape

Securiti named a Leader in the IDC MarketScape for Data Privacy Compliance Software

Read the Report

What's
New