# Iowa Code § 507F.6: Cybersecurity event investigation > Iowa · Statutes · In force URL: https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.6 ## Section - **Citation:** Iowa Code § 507F.6 - **Heading:** Cybersecurity event investigation - **Jurisdiction:** Iowa - **Kind:** Statutes - **Status:** In force - **Text as of:** August 14, 2026 - **Source:** Compiled text - **Location:** IA Code / Title XIII / Chapter 507F / Section 507F.6 ## Text (1) If a licensee discovers that a cybersecurity event has occurred, or that a cybersecurity event may have occurred, the licensee, or the outside vendor or third-party service provider the licensee has designated to act on behalf of the licensee, shall conduct a prompt investigation of the event. (2) During the investigation, the licensee, outside vendor, or third-party service provider the licensee has designated to act on behalf of the licensee, shall, at a minimum, determine as much of the following as possible: (2) (a) Confirm that a cybersecurity event has occurred. (2) (b) Assess the nature and scope of the cybersecurity event. (2) (c) Identify all nonpublic information that may have been compromised by the cybersecurity event. (2) (d) Perform or oversee reasonable measures to restore the security of any compromised information systems in order to prevent further unauthorized acquisition, release, or use of nonpublic information that is in the licensee’s possession, custody, or control. (3) If a licensee learns that a cybersecurity event has occurred, or may have occurred, in an information system maintained by a third-party service provider of the licensee, the licensee shall complete an investigation in compliance with this section, or confirm and document that the third-party service provider has completed an investigation in compliance with this section. (4) A licensee shall maintain all records and documentation related to the licensee’s investigation of a cybersecurity event for a minimum of five years from the date of the event, and shall produce the records and documentation upon demand of the commissioner. 2021 Acts, ch 79, §6, 17 ## Nearby sections - [Iowa Code § 507F.1 Title.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.1.md) - [Iowa Code § 507F.2 Purpose and scope.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.2.md) - [Iowa Code § 507F.3 Definitions.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.3.md) - [Iowa Code § 507F.4 Information security program.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.4.md) - [Iowa Code § 507F.5 Third-party service provider arrangements.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.5.md) - [Iowa Code § 507F.6 Cybersecurity event investigation.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.6.md) - [Iowa Code § 507F.7 Cybersecurity event notification and report to the commissioner.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.7.md) - [Iowa Code § 507F.8 Cybersecurity event notification to consumers.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.8.md) - [Iowa Code § 507F.9 Cybersecurity event third-party service providers.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.9.md) - [Iowa Code § 507F.10 Cybersecurity event reinsurers.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.10.md) - [Iowa Code § 507F.11 Cybersecurity event producers of record.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.11.md) - [Iowa Code § 507F.12 Confidentiality.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.12.md) - [Iowa Code § 507F.13 Applicability.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.13.md) - [Iowa Code § 507F.14 Penalties.](https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.14.md) --- Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/STATE_IA_TXIII_C507F_S507F.6. Check the current official text before relying on it. Not legal advice.