Information security is a matter of law, not just technology.

Information security isn't just a technology issue, it's a legal issue, and one that every employee at a company should be concerned with, said two experts on the front line of insurance technology and security.

Thomas J. Smedinghoff, an attorney with Baker & McKenzie in Chicago, said insurers have a legal obligation to protect their systems and data. "Even if you outsource the work, you cannot outsource the responsibility," Smedinghoff said. He added that companies and their directors and officers can be held liable for security breaches and might have to face class-action lawsuits.

Security is an issue that must be discussed throughout the company; said Jane Koppenheffer, chief information officer and vice president of Penn National Insurance, a regional property/casualty company. Koppenheffer said every new employee is trained in technology security, and an entire month is to be dedicated to educating employees about security issues. The company will even award prizes to employees for participating. "We try to keep security awareness in front of people," she said.

Companies Need to Do The Following:

* Identity data assets to be protected.

* Conduct a risk analysis.

* Develop and implement a written security program and response plan.

* Test and monitor the plan to ensure it's effective.

* Review, reassess and adjust the plan over time in light of new threats.

* Obtain an independent audit.

* Enforce security on outsourcing providers as well.