B26-0427

Cybersecurity and Accountability Act of 2025 mandates cybersecurity measures for insurers in the District of Columbia.

The Cybersecurity and Accountability Act of 2025 requires insurers in the District of Columbia to develop and maintain an information security program. This program must include administrative, technical, and physical safeguards to protect nonpublic information and information systems. Insurers must also conduct risk assessments, implement security measures, and provide cybersecurity awareness training. The Commissioner of Insurance, Securities and Banking has the authority to investigate cybersecurity events and enforce the act.