601.951 General provisions.
280 words·~1 min read·
/wi/chapter-601/601-951A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
601.951 General provisions.
(1)Exclusive state standards. This subchapter establishes the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event, and notification of a cybersecurity event or unauthorized access to nonpublic information to the state government and consumers.
(2)Exceptions to applicability.
(a)This subchapter does not apply to a person who is an employee, agent, representative, or designee of a licensee and who is also a licensee to the extent that the person is covered by the information security program of the other licensee and the other licensee has complied with this subchapter on behalf of the person.
(b)A licensee affiliated with a depository institution that maintains an information security program in compliance with the interagency guidelines establishing information security standards as set forth pursuant to 15 USC 6801 and 6805 shall be considered to meet the requirements of this subchapter, provided that the licensee produces, upon request of the commissioner, documentation satisfactory to the commissioner that independently validates the adoption by the affiliated depository institution of an information security program that satisfies the interagency guidelines.
(bm)A licensee affiliated with a broker, as defined in 15 USC 78c
(a)(4), or dealer, as defined in 15 USC 78c
(a)(5), that maintains an information security program in compliance with the requirements of the financial industry regulatory authority that address information security standards shall be considered to meet the requirements of this subchapter, provided that the licensee produces, upon request of the commissioner, documentation satisfactory to the commissioner that independently validates the adoption by the affiliated broker or dealer of an information security program that satisfies the financial industry regulatory authority’s requirements.