This bill establishes the "Insurance Data Security Act" The bill requires licensees to implement an information security program, as defined in the bill. Each licensee must have a comprehensive information security program that is in keeping with the size and complexity of the licensee and the scope of its activities. This bill specifies data protection objectives for the programs, as well as standards for risk assessment by licensees, and measures to be implemented in the information security programs.