Wisconsin Act 73 Insurance Data Security

Wisconsin’s new cybersecurity law (Act73 – Insurance Data Security) was signed by Governor Tony Evers on July 15, 2021, and can be found in Wisconsin Statutes Subchapter IX of Chapter 601. Act73 – Insurance Data Security is aimed at protecting consumers from increasing risks of cybersecurity threats such as ransomware and data breaches from their insurers and their affiliate agencies. Threat actors remain on the offensive everyday so time is of the essence. Wisconsin insurers should immediately take steps to familiarize themselves with the new legislation and take immediate action to become compliant.

In order to comply, licensees have one year (Deadline of November 1, 2022) to conduct a risk assessment, address the vulnerabilities and risks identified, and create an information security program tailored to their business. Additionally, licensees must implement a comprehensive incident response plan, in the event of a cybersecurity event, and map out how they will provide notice in a timely fashion to affected consumers. The law also requires licensees to exercise appropriate diligence and due care in selecting their third-party service providers to ensure that these entities are also in alignment with the new regulations.

The law empowers the Office of the Commissioner of Insurance to examine and investigate the affairs of a licensee to determine violations of the requirements. Therefore, it remains a best practice for all insurance companies, providers, and agencies to take these steps and remain committed to protecting the personal information of their consumers.

While the law provides certain exemptions, we suggest to our clients that they become compliant with all aspects of this law; because meeting regulatory expectations through an exemption is not the same as complying with all parts of a regulation. One could expect that upon notification of a cybersecurity event, the Office of the Commissioner of Insurance will investigate how that organization complied, or failed to comply, with all sections of Act 73 regardless of their exemption status.

Many sections of the new law reflect industry leading practices relating to cybersecurity, the implementation of which would increase an organization’s cybersecurity maturity and preparedness to detect a cybersecurity event, respond to that event, and recover normal business operations.

Wisconsin Act 73 Compliance Requires More Than Good Intentions

Wisconsin Act 73 established clear expectations for how insurance organizations protect sensitive information, manage cybersecurity risks, and respond to security incidents. While compliance requirements may seem complex, they ultimately support a common goal: reducing risk and protecting the information entrusted to your organization.

Organizations that take a proactive approach to compliance are often better positioned to identify vulnerabilities, strengthen security controls, improve vendor oversight, and demonstrate accountability during regulatory reviews. Risk assessments, documented policies, employee training, incident response planning, and ongoing governance all play important roles in supporting compliance efforts.

Compliance should not be viewed as a one-time project. It is an ongoing commitment to managing risk, protecting customer information, and maintaining a strong security posture as threats and business requirements continue to evolve.

The organizations that embrace compliance as part of their overall business strategy are often better prepared for both regulatory expectations and future cybersecurity challenges.

Is Your Organization Ready for Wisconsin Act 73 Requirements?

Many insurance agencies and related organizations are uncertain whether their current security controls, documentation, risk assessments, and policies fully align with Wisconsin Act 73 expectations. If you’d like help evaluating your current compliance posture, schedule a free consultation with ITNS Consulting.

We’ll help identify potential gaps, assess your current cybersecurity and compliance readiness, and develop a practical roadmap for strengthening governance, reducing risk, and supporting ongoing regulatory compliance.

Is Your Insurance Agency Compliance-Ready?

Meeting Wisconsin Act 73 requirements requires more than security tools alone. It requires documented policies, risk management processes, employee accountability, vendor oversight, and ongoing governance.

Download our Insurance Agency Cybersecurity & Compliance Readiness Checklist to evaluate your current safeguards, identify potential compliance gaps, and strengthen your organization’s ability to meet cybersecurity and regulatory expectations.