Cybersecurity and Accountability Act of 2025

This bill requires insurance licensees in the District of Columbia to meet specific data security standards to protect consumer information. It mandates that licensees investigate cybersecurity incidents, notify the Department of Insurance, Securities and Banking Commissioner about such events, and implement security measures for nonpublic information stored on portable devices or transmitted externally. The law specifically protects sensitive data including Social Security numbers, health records, financial account details, and biometric information. Licensees must use multi-factor authentication and maintain security programs to prevent unauthorized access or disclosure of this information.