# Tennessee Insurance Agencies and the NAIC Data Security Model Law URL: https://limehawk.io/reports/tennessee-insurance-data-security-law Published: 2026-10-01 Author: Corey Watson, Managing Member Topic: Guides Read time: 7 min Tennessee adopted the NAIC Data Security Model Law as the Insurance Data Security Law in 2021. Agencies under 25 people, $5M revenue, or $10M assets are exempt. > **TL;DR** Tennessee adopted the NAIC Insurance Data Security Model Law in 2021 as the Insurance Data Security Law, Tenn. Code Ann. 56-2-1001 through 56-2-1011. It took effect July 1, 2021. The written security program was due July 1, 2022, and vendor requirements July 1, 2023. Tennessee's small-licensee exemption is wider than the model's: the law does not apply to a licensee with fewer than 25 people (employees and contractors), under $5 million in gross annual revenue, or under $10 million in year-end assets. Many small agencies are out. Grow past all three and you have 180 days to comply. - Small-agency exemption: <25 people ## What is the NAIC Insurance Data Security Model Law? It is a template law the National Association of Insurance Commissioners adopted in October 2017, Model #668. States pass their own version. Per the [NAIC's August 2025 brief on the model](https://content.naic.org/sites/default/files/government-affairs-brief-data-security-model-law.pdf), it applies to insurers, agents, and anyone else licensed by a state insurance department. It requires a licensee to keep an information security program, investigate cybersecurity events, and notify the state insurance commissioner. The model itself exempts licensees with fewer than 10 employees from the security program section. Keep that number in mind. Tennessee did not copy it. ## Has Tennessee adopted it? Yes. Tennessee passed it as [Public Chapter 345 of 2021](https://publications.tnsosfiles.com/acts/112/pub/pc0345.pdf) (House Bill 766), signed May 18, 2021, according to the [General Assembly's bill record](https://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=HB0766&GA=112). It is codified as the "Insurance Data Security Law" at Tenn. Code Ann. 56-2-1001 through 56-2-1011. The [Department of Commerce and Insurance](https://www.tn.gov/commerce/insurance/company-resources/cybersecurity.html) says the law took effect July 1, 2021. The NAIC's brief lists Tennessee among the 28 jurisdictions that have implemented the model. The deadlines came in stages. The law took effect July 1, 2021, for events on or after that date. The written information security program was due by July 1, 2022. Contracts requiring vendors to protect your data were due by July 1, 2023. "Licensee" means anyone licensed, authorized, or registered under Tennessee's insurance title, or required to be. That covers carriers, and it covers agencies and producers. If you run an [insurance agency in East Tennessee](/industries/insurance-agencies), the question isn't whether the law exists. It's whether it reaches you. ## Does it apply to small agencies? Often, no. Section 56-2-1009 says the law "does not apply to" a licensee that meets any one of these: - Employs fewer than 25 individuals, "regardless of whether the individuals are employees or independent contractors." - Has less than $5,000,000 in gross annual revenue. - Has less than $10,000,000 in year-end total assets. That is a much bigger carve-out than the model's 10-employee line, and it exempts the whole law, not just the program section. A 12-person agency is out. So is a 40-person agency doing $4 million a year. Count carefully. Contracted producers count toward the 25. And if you stop qualifying, you have 180 days to comply. There are also separate provisions for licensees already compliant with HIPAA or GLBA, and for producers covered by another licensee's program. Confirm where your agency lands with your compliance counsel or the Department before you rely on any exemption. Exempt from the statute doesn't mean nobody is checking. As we cover on our [insurance agency page](/industries/insurance-agencies), carriers are tightening what they'll accept before they grant or keep portal access, and cyber insurance renewals ask for the same evidence the law describes. ## What does it require? For a covered agency, section 56-2-1004 requires a written information security program built on a risk assessment and scaled to your size and complexity. In plain terms: - **Someone in charge.** Designate one or more employees, an affiliate, or an outside vendor responsible for the program. - **A risk assessment.** Identify foreseeable threats, including at your vendors. Assess safeguards in training, systems, and detection. Test key controls at least annually. - **Safeguards picked from a list.** The law tells you to decide which apply: access controls, an inventory of data, devices, and systems, encryption of data in transit and on laptops and portable media, MFA, monitoring and testing, audit trails, protection against loss, and secure disposal. - **Training.** Cybersecurity awareness training, updated for the risks your assessment finds. - **Vendor oversight.** Due diligence on third-party service providers, and a requirement that they protect your data. - **A written incident response plan.** Roles, decision authority, communications, remediation, and documentation. If a cybersecurity event happens, section 56-2-1006 sets the clock. You notify the commissioner within three business days of determining an event occurred, when Tennessee is your home state and the event is reasonably likely to materially harm a consumer or your operations, or when 250 or more Tennessee consumers are involved and the event is reportable elsewhere or likely harmful. Affected consumers get notice within 45 days when harm is reasonably likely. The Department takes reports through its [cybersecurity event page](https://www.tn.gov/commerce/insurance/company-resources/cybersecurity/report.html). The annual April 15 compliance certification falls on insurers domiciled in Tennessee, not agencies. The Department's [certification form](https://www.tn.gov/commerce/insurance/company-resources/cybersecurity/compliance.html) says so. ## What IT has to keep on file The commissioner can examine and investigate any licensee under section 56-2-1007. Here's what a covered agency should be able to hand over: - **The written program and the risk assessment behind it.** - **The incident response plan.** - **Event records for five years.** Section 56-2-1005 requires records on every cybersecurity event for at least five years from discovery. If you investigate something and decide it wasn't an event, that decision goes in writing and is kept five years too. - **Evidence the safeguards run.** A device inventory, encryption status for every laptop, MFA enforcement, and vendor contracts with security terms. The inventory and the encryption report are where agencies usually come up short. We built an [automated hardware inventory of 312 assets in 47 minutes](/reports/automated-hardware-inventory) when a cyber insurance audit gave one client five business days. We [rolled BitLocker out across 127 endpoints in 72 hours](/reports/bitlocker-encryption-automation), with recovery keys escrowed, when a client's cyber insurance required full-disk encryption. Those are the two artifacts this law and every carrier questionnaire ask for. ## Key takeaways - Tennessee's version is the Insurance Data Security Law, Tenn. Code Ann. 56-2-1001 to 56-2-1011, in effect since July 1, 2021. - Under 25 people, under $5M gross revenue, or under $10M in assets: the law does not apply. Contractors count toward the 25. - Covered agencies need a written program built on a risk assessment, a written incident response plan, and vendor oversight. - Notify the commissioner within three business days of determining a qualifying cybersecurity event. Keep event records for five years. - Exempt or not, carriers and cyber insurers still ask for inventory, encryption, and MFA evidence. ## What this looks like when we do it We start by counting. Headcount with contractors, revenue, and assets tell us whether the Insurance Data Security Law applies to you at all. If it doesn't, we say so and build to what your carriers and cyber insurer are asking for instead. If it does, we map controls to the specific sections of the Tennessee law, not a generic checklist. That means a risk assessment, the written program, an incident response plan you can actually follow, and vendor terms. Then the evidence comes from tools that run every day: inventory and encryption status from the RMM, MFA enforced across email, the agency management system, and carrier portals, and logs that let you make a three-business-day call based on facts. The build is scoped on a call, then folds into month-to-month managed IT so the program doesn't go stale in a binder. More on how we work with agencies is on the [insurance agencies page](/industries/insurance-agencies). If you're not sure which side of the 25-person line you're on, or what you could show the commissioner tomorrow, [book a call](/contact). Fifteen minutes is enough to find out.