IRDAI’s cyber security guidelines: who is audited, how often, and by whom

All insurers, including foreign reinsurance branches, and insurance intermediaries. The 2026 circular names them: brokers, corporate agents, web aggregators, third party administrators, insurance marketing firms, insurance repositories, ISNPs, corporate surveyors, motor insurance service providers and common service centres, along with the Insurance Information Bureau of India.

Four groups are outside them: insurance agents, micro-insurance agents, point of sales persons and individual surveyors. That is not a gap in the framework. The guidelines make each insurer responsible for ensuring those people follow a minimum security framework set by its own board-approved policy, so the obligation reaches them through the insurer instead.

How much of the framework applies depends on how an entity touches insurer systems. Annexure I maps the NIST Cybersecurity Framework functions to each kind of access: an intermediary that can only view data gets the Protect function, one that edits data or connects through APIs gets all of them, and one that holds insurer data only on paper gets none — though the insurer must then obtain a self-certification from it every year.

IRDAI issued the revised guidelines on 6 April 2026 under circular IRDAI/GA&HR/CIR/MISC/51/4/2026, with a summary of the major changes, and directed compliance from the current financial year.

On governance: the information security risk management committee now meets at least quarterly rather than twice a year. The CISO must not report directly to the head of IT and must not be given business targets. The board must provide a cyber security budget proportional to risk appetite, receive the status of non-conformities from the annual assurance audit, and ensure gaps are closed within twelve months of reporting. Exceptions are approved by the CISO up to three months, by the risk management committee beyond that, and by the board beyond a year.

On controls: external penetration testing of internet-facing systems moved from black box to grey or white box, and must now be performed by a CERT-In empanelled auditor. New checklist controls cover cloud providers that are MeitY-empanelled with a valid STQC audit, an inventory of cryptographic assets to prepare for post-quantum cryptography, prior written permission before a vendor sub-outsources, and immutable backups for critical hardware. And regulated entities must now take technical and organisational measures to comply with the DPDP Act and its Rules.

Every year. The guidelines require an independent assurance audit annually, with the audit plan and the reports presented to the audit committee, risk management committee, board or principal officer as applicable.

Where the report goes depends on who you are. An insurer submits its Annexure III audit report, signed by the auditor and with the board’s comments, to IRDAI within ninety days from the end of the financial year or within thirty days of completing the audit, whichever is earlier. An intermediary submits its report, with its compliance and its governing body’s comments, to each insurer it works with, annually and within thirty days of the audit. A foreign reinsurance branch has its auditor certify compliance in the Annexure VI form, submitted to IRDAI at the end of every financial year.

Testing runs on a shorter clock. Vulnerability assessment and grey or white box penetration testing of all internet-facing systems are required at least once every six months, and VAPT of critical internal applications and infrastructure at least once a year. High-risk VAPT findings must be remediated immediately and in no case beyond thirty days; the outer limit for closing all audit gaps is two months. Both are followed by mandatory re-validation testing.

IRDAI sets this, in Annexure IV, and it is not open to choice. The auditor must be either a chartered accountant firm — a partnership or LLP registered with ICAI, in continuous practice for at least five years, with at least four partners including one holding CISA or DISA, one Fellow member, one with three years of cyber security audit experience at insurers, banks or mutual funds, and one with experience of IT-environment and remote audit — or a CERT-In empanelled external systems auditor holding CISA or DISA certifications.

The half-yearly VA and PT of internet-facing systems and the annual VAPT of critical internal systems must be performed by a CERT-In empanelled auditor. Annexure IV also says the certification does not recognise management representations: the auditor works by interview, document verification, compliance checks and substantive checks of controls. A control that exists only as a statement in a policy is a non-compliance.

A consultancy that is neither empanelled nor a qualifying chartered accountant firm cannot conduct or sign any of these. It can prepare you, which is a different and useful job, but the report has to carry an eligible auditor’s signature.

An Insurance Self-Network Platform is the website or app through which an insurer or an intermediary sells and services policies online, with IRDAI’s permission. Insurance agents cannot set up their own; they use their insurer’s platform. The rules for it are the Guidelines on insurance e-commerce of 9 March 2017, which IRDAI still lists as current.

Clause 11 requires a review of the platform’s controls, systems, procedures and safeguards at least once a year, by an external certified information systems auditor, a chartered accountant with the DISA qualification from ICAI, or a CERT-In expert, at the applicant’s cost. The report goes before the board or its sub-committee, and adverse findings that are material to the platform’s operations, or that result in financial loss to policyholders, must be reported to IRDAI with an action plan. The platform’s domain must be registered and its servers located in India.

Note what clause 11 says and does not say. It names CISA, DISA or a CERT-In expert; it does not say CERT-In empanelled. But an ISNP is an internet-facing system, so the cyber security guidelines’ six-monthly VA and PT by a CERT-In empanelled auditor apply to it as well — and every intermediary using an ISNP falls in the top Annexure II category regardless of revenue.