Last modied: February 11, 2019 4:00 PM
BigINY.org/cybe r
Copyright © 2019 Big I New York
Do you encrypt data in transit?
If yes, please list encrypon technology/tool used.
□ Yes
□ No
Do you encrypt data at rest (stored data)?
If yes, please list encrypon technology/tool used.
□ Yes
□ No
Do you employ access controls and policies designed to limit access to relevant informaon
systems and Nonpublic Informaon
1
?
If yes, please briey describe.
□ Yes
□ No
Do you use mul-factor authencaon or risk-based authencaon to protect against
unauthorized access to your Nonpublic Informaon (mulple passwords and codes to access
the network)?
□ Yes
□ No
Do you have policies and procedures in place to nofy our organizaon in the event of a
cybersecurity event
2
directly impacng our informaon systems or Nonpublic Informaon?
If yes, please briey describe.
□ Yes
□ No
Click here to aest that the above is true and accurate to the best of your knowledge.
□
Name & Title of person compleng form
Date
1. Denion of NPI: Nonpublic Informaon shall mean all electronic informaon that is not Publicly Available Informaon and is: (1) Business-related
informaon of a Covered Enty the tampering with which, or unauthorized disclosure, access or use of which, would cause a material adverse
impact to the business, operaons or security of the Covered Enty; (2) Any informaon concerning an individual, which because of name, number,
personal mark, or other idener can be used to idenfy such individual, in combinaon with any one or more of the following data elements: (i)
social security number, (ii) driver’ license number or non-driver idencaon card number, (iii) account number, credit or debit card number, (iv) any
security code, access code or password that would permit access to an individual’s nancial account, or (v) biometric records; (3) Any informaon
or data, except age or gender, in any form or medium created by or derived from a health care provider or an individual and that relates to (i) the
past, present or future physical, mental or behavioral health or condion of any individual or a member of the individual’s family, (ii) the provision of
health care to any individual, or (iii) payment for the provision of health care to any individual.
2. Denion of cybersecurity event: Any act or aempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse an Informaon
System or informaon stored on such Informaon System.
DISCLAIMER:
Big I New York is providing this sample quesonnaire solely as a tool to assist agencies, brokerages, and organizaons in assessing the third party service
providers you work with. This sample quesonnaire is not a substute for agencies, brokerages, and organizaons independently evaluang any business,
legal or other issues, and is not a recommendaon that a parcular course of acon be adopted. State security breach nocaon and privacy laws, coupled
with insurance laws and regulaons, impose varying requirements on agencies, brokerages, or organizaons. Therefore, it is extremely important for agencies,
brokerages, and organizaons to carefully review applicable laws and regulaons in all jurisdicons where they do business in structuring their specic security
policies and processes. We have worked from the requirements in New York Regulaon 23 NYCRR 500 in formulang this sample quesonnaire, because
the New York regulaon imposes some of the most specic requirements. If specic advice is required or desired, the services of an appropriate, competent
professional should be sought. Any agencies, brokerages, or organizaons that uses this sample quesonnaire agrees that Big I NY will have no liability for
anything related to the use of this tool or any issues that may arise related to the decisions that you make or the policy that is developed.
ACCESS IS ONLY PROVIDED TO THOSE WHO NEED IT FOR THEIR JOBS
YES WRITTEN CYBERSECURITY PROCEDURES ARE IN PLACE AND UPON BECOMING AWARE OF ANY BREACH THAT MAY HAVE IMPACTED YOUR NPI WE WILL PROVIDE YOU WITH NOTICE
