District of Columbia legislation · 26th Council
District of Columbia B427: Cybersecurity and Accountability Act of 2025
Status: Chaptered, October 30, 2026
As introduced, Bill 26-427 would establish standards for data security and standards for investigating and notifying the Commissioner of the Department of Insurance, Securities and Banking of cybersecurity events affecting insurance licensees.
What the bill says
To amend the FreedomofInformation Act of1976 to makea conforming change. BE ITENACTED BYTHE COUNCILOFTHE DISTRICTOF COLUMBIA, Thatthis act maybe cited as the"Cybersecurity andAccountability AmendmentActof2026". TITLE I. CYBERSECURITYAND ACCOUNTABILITYREQUIREMENTS. Sec. 101, Short title. This title maybe known as the "Cybersecurity and Accountability Act of 2026". Sec. 102, Definitions. Forthepurposes ofthis title, theterm: (1) "Authorized individual" means an individual known to, and sereenedby, the licensee, and to whom thelicenseehas determined access to thenonpublicinformation held by theli.
From the enrolled text, October 29, 2026:
to amend the FreedomofInformation Act of1976 to makea conforming change. BE ITENACTED BYTHE COUNCILOFTHE DISTRICTOF COLUMBIA, Thatthis act maybe cited as the"Cybersecurity andAccountability AmendmentActof2026". TITLE I. CYBERSECURITYAND ACCOUNTABILITYREQUIREMENTS. Sec. 101, Short title. This title maybe known as the "Cybersecurity and Accountability Act of 2026". Sec. 102, Definitions. Forthepurposes ofthis title, theterm: (1) "Authorized individual" means an individual known to, and sereenedby, the licensee, and to whom thelicenseehas determined access to thenonpublicinformation held by thelicensee and its information systems is necessary and appropriate. (2) "Commissioner" means theCommissioner ofthe DepartmentofInsurance, Securities, and Banking. (3) "Consumer" means aperson, including anapplicant, policyholder, insured, beneficiary, claimant, or certificateholder who is aresidentofthe Districtand whose nonpublic information is in a licensee's possession, custody, or control. (4) "Cybersecurity event" means an eventresultingin unauthorized access to, or disruption ormisuse of, aninformation system ornonpublic information stored on the information system, butdoes notinclude: (A) The unauthorized acquisition ofencrypted nonpublic information if the encryption, process, orkey is not also acquired, released, or used without authorization; or (B)An event where thelicensee has determinedthat thenonpublic information accessed by anunauthorized personhas notbeen usedorreleased and hasbeen returned ordestroyed. (5) "Department"means theDepartmentofInsurance, Securities, and Banking, ENROLLED ORIGINAL (6) "Encrypted"means the transformation ofdatainto a formwhich results in a low probability ofassigning meaning tothedatawithout theuseof a protectiveprocess or key. (7) "Information security program" meansthe administrative, technical, and physical safeguardsthat …