State adoption tracker · Insurance
NAIC Model Laws: 2026 State Adoption Tracker.
Search the current NAIC map status for the Insurance Data Security Model Law, then open the linked NAIC materials and state law before making a compliance decision.
Direct answer: the NAIC map dated July 4, 2026 shows 28 adopting jurisdictions, one pending jurisdiction and New York under “other insurance data security provisions.” The map is a starting point, not a determination that every enacted law contains every element of Model #668.
How to read this tracker
Regulatory fact: status is transcribed from the NAIC implementation map dated July 4, 2026. Editorial interpretation: citation notes help locate state activity but do not compare legal differences. Product capability: Sia RegAI can structure a controlled state inventory and map changes to controls; it does not replace state-law review.
- Adopted means the jurisdiction is red on the NAIC map.
- Pending means the jurisdiction is yellow on the NAIC map.
- Other provisions means the map identifies another insurance data-security regime.
- Not shown adopted does not mean “no cybersecurity law.” It only reflects the Model #668 map category.
| Jurisdiction | July 2026 map status | Citation / activity note | Timing note | Sources | Responsible regulator |
|---|---|---|---|---|---|
| Alabama | Adopted | Ala. Code §§ 27-62-1–12 (2019) | Confirm current effective date | NAIC map · state page | |
| Alaska | Adopted | Alaska Stat. §§ 21.23.240–.399; effective 2026 | Effective 2026 | NAIC map · state page | |
| Arizona | Not shown adopted | Related state activity in NAIC state page; not shown adopted on July 2026 map | Not applicable / verify | NAIC map · state page | |
| Arkansas | Not shown adopted | No adoption shown on the NAIC map; verify current state law and regulator guidance | Not applicable / verify | NAIC map · state page | |
| California | Not shown adopted | Related state activity in NAIC state page; not shown adopted on July 2026 map | Not applicable / verify | NAIC map · state page | |
| Colorado | Not shown adopted | Related state activity in NAIC state page; not shown adopted on July 2026 map | Not applicable / verify | NAIC map · state page | |
| Connecticut | Adopted | Conn. Gen. Stat. § 38a-38 (2020) | Confirm current effective date | NAIC map · state page | |
| Delaware | Adopted | 18 Del. C. §§ 8601–8611 (2019) | Confirm current effective date | NAIC map · state page | |
| District of Columbia | Pending | Pending on NAIC adoption map dated 4 July 2026 | Not applicable / verify | NAIC map · state page | |
| Florida | Not shown adopted | No adoption shown on the NAIC map; verify current state law and regulator guidance | Not applicable / verify | NAIC map · state page | |
| Georgia | Not shown adopted | No adoption shown on the NAIC map; verify current state law and regulator guidance | Not applicable / verify | NAIC map · state page | |
| Hawaii | Adopted | Haw. Rev. Stat. §§ 431:3B-101–306 (2021) | Confirm current effective date | NAIC map · state page | |
| Idaho | Not shown adopted | No adoption shown on the NAIC map; verify current state law and regulator guidance | Not applicable / verify | NAIC map · state page | |
| Illinois | Adopted | 215 ILCS 215 (2024) | Confirm current effective date | NAIC map · state page | |
| Indiana | Adopted | Ind. Code §§ 27-2-27-1–32 (2020; portions) | Confirm current effective date | NAIC map · state page | |
| Iowa | Adopted | Iowa Code §§ 507F.1–.16 (2021; portions) | Confirm current effective date | NAIC map · state page | |
| Kansas | Not shown adopted | No adoption shown on the NAIC map; verify current state law and regulator guidance | Not applicable / verify | NAIC map · state page | |
| Kentucky | Adopted | Ky. Rev. Stat. §§ 304.3-750–.768 (2022) | Confirm current effective date | NAIC map · state page | |
| Louisiana | Adopted | La. Rev. Stat. §§ 22:2501–2511 (2020) | Confirm current effective date | NAIC map · state page | |
| Maine | Adopted | 24-A Me. Rev. Stat. §§ 2261–2272 (2021/2025) | Confirm current effective date | NAIC map · state page | |
| Maryland | Adopted | Md. Code, Ins. §§ 33-101–109 (2022) | Confirm current effective date | NAIC map · state page | |
| Massachusetts | Not shown adopted | No adoption shown on the NAIC map; verify current state law and regulator guidance | Not applicable / verify | NAIC map · state page | |
| Michigan | Adopted | Mich. Comp. Laws §§ 500.550–.565 (2018) | Confirm current effective date | NAIC map · state page | |
| Minnesota | Adopted | Minn. Stat. §§ 60A.985–.9858 (2021) | Confirm current effective date | NAIC map · state page | |
| Mississippi | Adopted | Miss. Code §§ 83-5-801–825 (2019) | Confirm current effective date | NAIC map · state page | |
| Missouri | Adopted | NAIC map lists adopted; confirm current state citation | Confirm current effective date | NAIC map · state page | |
| Montana | Not shown adopted | No adoption shown on the NAIC map; verify current state law and regulator guidance | Not applicable / verify | NAIC map · state page | |
| Nebraska | Not shown adopted | No adoption shown on the NAIC map; verify current state law and regulator guidance | Not applicable / verify | NAIC map · state page | |
| Nevada | Not shown adopted | No adoption shown on the NAIC map; verify current state law and regulator guidance | Not applicable / verify | NAIC map · state page | |
| New Hampshire | Adopted | N.H. Rev. Stat. §§ 420-P:1–14 (2019) | Confirm current effective date | NAIC map · state page | |
| New Jersey | Not shown adopted | Related state activity in NAIC state page; not shown adopted on July 2026 map | Not applicable / verify | NAIC map · state page | |
| New Mexico | Not shown adopted | Bulletin 2024-04; not shown adopted on July 2026 map | Not applicable / verify | NAIC map · state page | |
| New York | Other provisions | 23 NYCRR Part 500; NAIC map labels other insurance data-security provisions | Not applicable / verify | NAIC map · state page | |
| North Carolina | Not shown adopted | Related state activity in NAIC state page; not shown adopted on July 2026 map | Not applicable / verify | NAIC map · state page | |
| North Dakota | Adopted | N.D. Cent. Code §§ 26.1-02.2-01–11 (2021) | Confirm current effective date | NAIC map · state page | |
| Ohio | Adopted | Ohio Rev. Code §§ 3965.01–.11 (2018) | Confirm current effective date | NAIC map · state page | |
| Oklahoma | Adopted | Okla. Stat. tit. 36 §§ 670–679 (2024) | Confirm current effective date | NAIC map · state page | |
| Oregon | Not shown adopted | Related rule activity in NAIC state page; not shown adopted on July 2026 map | Not applicable / verify | NAIC map · state page | |
| Pennsylvania | Adopted | 40 Pa.C.S. §§ 4501–4536 (2023) | Confirm current effective date | NAIC map · state page | |
| Rhode Island | Adopted | R.I. Gen. Laws §§ 27-1-46–47 and 27-2-29–30 (2024) | Confirm current effective date | NAIC map · state page | |
| South Carolina | Adopted | S.C. Code §§ 38-99-10–100 (2018) | Confirm current effective date | NAIC map · state page | |
| South Dakota | Not shown adopted | Related state activity in NAIC state page; not shown adopted on July 2026 map | Not applicable / verify | NAIC map · state page | |
| Tennessee | Adopted | Tenn. Code §§ 56-2-1001–1011 (2021; portions) | Confirm current effective date | NAIC map · state page | |
| Texas | Not shown adopted | No adoption shown on the NAIC map; verify current state law and regulator guidance | Not applicable / verify | NAIC map · state page | |
| Utah | Not shown adopted | Related state activity in NAIC state page; not shown adopted on July 2026 map | Not applicable / verify | NAIC map · state page | |
| Vermont | Adopted | 8 V.S.A. § 4728 (2023) | Confirm current effective date | NAIC map · state page | |
| Virginia | Adopted | Va. Code §§ 38.2-621–629; 14 VAC 5-430 (2020/2021) | Confirm current effective date | NAIC map · state page | |
| Washington | Not shown adopted | No adoption shown on the NAIC map; verify current state law and regulator guidance | Not applicable / verify | NAIC map · state page | |
| West Virginia | Not shown adopted | Related state activity in NAIC state page; not shown adopted on July 2026 map | Not applicable / verify | NAIC map · state page | |
| Wisconsin | Adopted | Wis. Stat. §§ 601.95–.956 (2021) | Confirm current effective date | NAIC map · state page | |
| Wyoming | Not shown adopted | Related state activity in NAIC state page; not shown adopted on July 2026 map | Not applicable / verify | NAIC map · state page | |
| Puerto Rico | Adopted | NAIC map lists adopted; confirm current code and effective date | Confirm current effective date | NAIC map · state page |
52 jurisdictions shown.
What Model #668 requires at a high level
| Model section | Core topic | Operating evidence to identify |
|---|---|---|
| Section 4 | Risk-based information security programme and third-party oversight | Risk assessment, governance, safeguards, vendor oversight, annual certification where applicable |
| Section 5 | Cybersecurity-event investigation | Incident record, scope analysis, affected information, recovery and preservation decisions |
| Section 6 | Commissioner notification | Notification decision, deadline calculation, filed notice and supporting facts |
Update log
| Date | Change | Source |
|---|---|---|
| July 19, 2026 | Published the searchable 52-jurisdiction table from the NAIC map dated July 4, 2026; added citation notes from the Summer 2025 state page. | NAIC adoption map |
Primary sources
- NAIC implementation map for Model Act #668 — status as of July 4, 2026
- NAIC Model #668 state page — Summer 2025
- NAIC Cybersecurity (H) Working Group
- NAIC Insurance Data Security Model Law compliance and enforcement guide
Informational content only. Confirm the current statute, regulation, regulator guidance, scope, exemptions, effective dates and notification rules in each jurisdiction.