Virginia’s insurance data security regulations require licensees to maintain records of cybersecurity events for a minimum of five years. These records must be available for examination by the Bureau of Insurance and are essential for demonstrating compliance, remediation efforts, and incident response procedures.

Shorter retention periods do not meet regulatory standards, and longer periods are not mandated. Therefore, option C is correct.

This requirement reinforces accountability and supports regulatory oversight of data protection practices within the insurance industry.