Establishes cybersecurity and informational security standards to safeguard insurance company customer information

HB 436 establishes mandatory cybersecurity standards for insurance companies licensed to operate in Missouri, directly affecting all such insurers handling customer data. The bill requires insurers to develop written security programs based on risk assessments, including specific safeguards for sensitive customer information like Social Security numbers, health records, financial account details, and biometric data. Key provisions mandate multi-factor authentication for access, regular threat assessments, and protocols for responding to cybersecurity incidents. Insurers must also define data retention and secure destruction practices, with no private legal claims allowed for violations. The law sets the exclusive state standard for data security, overriding conflicting local rules but not impacting existing private lawsuits.