Missouri Issues Guidance on Insurance Data Security Act Implementation Understanding Cybersecurity Reporting Obligations for Licensees

The Missouri Department of Commerce and Insurance has released Insurance Bulletin 26-01 to help regulated entities understand their responsibilities under the Insurance Data Security Act. Effective January 1, 2026, the Act establishes cybersecurity event reporting requirements for insurance licensees and clarifies how incidents involving third-party service providers must be handled. This guidance outlines who qualifies as a licensee, how and when cybersecurity events must be reported, and which entities fall outside the Act’s scope.

Missouri’s Insurance Data Security Act: Overview and Effective Date

The Missouri General Assembly enacted the Insurance Data Security Act during the 2025 First Regular Session, with an effective date of January 1, 2026. Codified in sections 375.1400 to 375.1427 RSMo, the Act is based on the NAIC Insurance Data Security Model Law and is designed to strengthen cybersecurity standards across the insurance industry.

While the Act is now in effect, certain provisions allow licensees additional time to implement specific requirements. Insurance Bulletin 26-01 was issued to educate regulated entities and provide practical guidance on how the Department interprets and will administer the Act.

Cybersecurity Event Reporting Requirements

Under section 375.1410.1 RSMo, a licensee must notify the Director when a cybersecurity event has occurred, and specific statutory criteria are met. To support compliance, the Department has created a mandatory electronic notification form (Missouri Cybersecurity Event Notification Form), which must be used for all cybersecurity event reports.

Initial notifications, as well as updates related to material changes in previously reported information, must be submitted through this electronic form. The Department strongly encourages licensees to review statutory definitions and exclusions before reporting to ensure the event meets the reporting threshold under the Act.

 

Third-Party Service Provider Cybersecurity Events

The Act explicitly addresses cybersecurity events involving third-party service providers. If a cybersecurity event occurs within a system maintained by a third-party service provider—and the license becomes aware of the event, the license is required to report it as though the event occurred within its own systems.

This requirement reinforces the importance of vendor oversight and incident awareness. Licensees should review their third-party contracts, cybersecurity policies, and monitoring procedures to ensure timely detection and reporting of qualifying events.

Who Is and Is Not Considered a “Licensee”

The bulletin provides important clarification regarding which regulated entities are considered “licensees” under the Act. While the statutory definition is broad, the Department confirms that certain entities are excluded, including:

• Health services corporations (HCSCs), HMOs, and prepaid dental plan corporations
• Captive insurance companies and special purpose life insurance captives
• Missouri mutual insurance companies
• Associations licensed under Chapter 383
• Certain providers registered under Chapter 385

These exclusions are based on statutory provisions stating that general insurance laws do not apply unless expressly made applicable.

Clarifying “Home State” and Reporting Scope

The Department also clarified how the terms “home state” and “producer” are applied for reporting purposes. Specifically, the phrase “those terms” in section 375.1410.1 refers only to “home state” and “producer,” as defined in section 375.012, and does not apply to the term “insurer.” This interpretation aligns Missouri’s approach with how other states have implemented the NAIC Model Law.

Conclusion

Insurance Bulletin 26-01 provides critical clarity on how Missouri expects licensees to comply with the Insurance Data Security Act. With cybersecurity event reporting now governed by a standardized electronic process and expanded to include third-party incidents, licensees should review internal controls, vendor relationships, and response procedures. Early preparation and clear documentation will be key to maintaining compliance as enforcement expectations evolve.