NAIC Model 668 notices need jurisdiction and threshold records
NAIC Model Law 668 provides a model framework for insurance data security, investigation and notification. A licensee should map each actual event to the jurisdiction’s enacted version, affected information and systems, determination time, threshold analysis, required recipients, notices, updates and closure evidence.
Editorial figure by Claims Core Ledger. Source context: NAIC Insurance Data Security Model Law 668.
Resolve jurisdiction and threshold before closing notification work
| Control record | Evidence to retain | What it does not establish |
|---|---|---|
| Licensee and jurisdiction | Legal entity, license status, regulator, enacted text and version, effective date, exemptions and contacts | That the model text is the enacted rule |
| Event and investigation | Discovery and awareness times, systems, information, actors, containment and investigation record | That an alert is a determined cybersecurity event |
| Threshold decision | Affected residents or consumers, materiality or harm facts, jurisdiction-specific test, owner and decision time | That one state’s decision transfers to another |
| Notice and update | Recipient, required content, approved version, delivery channel and time, receipt, correction and supplemental notice | That sending proves completeness or timeliness |
| Closure | Investigation outcome, regulator questions, consumer actions, third-party work, remediation, retention and closure approval | That notice ends accountability |
Anchor the analysis in the enacted jurisdiction
The direct answer is to use Model 668 as a governance reference while deciding duties from the actual jurisdiction’s enacted law and regulator instructions. Record the licensed legal entity, lines and resident or consumer population, regulator, adoption status, enacted section and version, effective date, exemption or exception considered, and qualified owner. Do not turn a model-law citation into a universal state rule. [1]
A group may have several licensees, regulators and consumer populations in one event. Build a jurisdiction matrix linked to the same incident evidence, but preserve each entity’s analysis. The NAIC model does not establish that a particular state adopted identical language, that an entity is a licensee, or that an exemption or threshold applies. [1]
Separate discovery, investigation and determination
Create a chronology for the alert or occurrence: source, first observed and awareness times, affected systems and information, unauthorized activity or access facts, containment, forensic preservation, third-party role, investigative steps and decision points. Model 668 describes investigation and notification concepts, but the actual event record determines what is known and when. [1]
Do not set the notification clock from an arbitrary ticket date without documented authority. Preserve who determined that a cybersecurity event occurred, the evidence available, the time of determination, disagreement or uncertainty, and later corrections. An investigation may narrow or expand the population; keep each version and its effect on the jurisdiction analysis.
Apply the threshold to facts retained for each jurisdiction
For each licensee and jurisdiction, map the enacted threshold to affected nonpublic information, systems, residents or consumers, materiality or harm considerations where applicable, third-party custody, and other required facts. Retain calculations, inclusion and exclusion rules, assumptions, legal review, decision and approval. A single enterprise impact count should not silently answer every state test. [1]
Record unknowns explicitly. Missing residency, duplicate identities, encrypted fields, uncertain access, vendor scope and incomplete logs can affect the analysis. Use human legal, security and regulatory judgment, document interim protective actions, and update the matrix as evidence changes. This article does not decide whether an event is reportable or whether a notice is due.
Track every notice, correction and closure item
When notice is required, preserve the recipient, approved content, version, channel, send time, delivery or receipt evidence, regulator questions, consumer communication, correction and supplemental notice. Keep regulator, consumer, producer, reinsurer, law-enforcement, contractual and other communications separate because their triggers and contents may differ. [1]
Closure should link the final investigation, remediation, jurisdiction decisions, notices and updates, third-party follow-up, retention and accountable approval. Claims Core Ledger freshly reviewed the exact NAIC model text on October 7, 2026; no post-October 6 model change was established. Unknowns include enacted state law, licensee status, event determination, affected population, threshold, timing, required content, delivery and regulator outcome. [1]
Enterprise buyer test
Translate this change into the exact population, record type, workflow stage, decision owner, effective date, and evidence that could be affected. Ask current or prospective providers to demonstrate the named workflow with representative data and an exception—not a polished feature tour. Record what official documentation establishes, what a provider states, what the team observes, and what remains unresolved.
A defensible review also identifies the dependency outside the product. Authority interpretation, policy configuration, data quality, integrations, human judgment, approval rights, release governance, training, and retained evidence may remain customer or service responsibilities. The evaluation should preserve those boundaries instead of treating a technology claim as the complete operating model.
What we will watch next
Claims Core Ledger will watch the named source and affected market records for later evidence that changes status, scope, availability, implementation timing, workflow consequence, or the limits of the initial report. A later announcement does not silently overwrite this dated account; the change ledger preserves the sequence.