Skip to content
SecuriFii

Insurance regulation

IRDAI Cybersecurity Compliance: Insurance Companies, ISNP Audit & Broker/TPA Assessments

IRDAI’s cyber security guidelines bind every insurer and most intermediaries, and they are audited every year by an auditor IRDAI considers eligible. The audit tests a checklist of controls against evidence, and it does not accept management representations. We build the controls and the evidence, rehearse the audit, and stay with you through it. A CERT-In empanelled auditor or an eligible audit firm conducts it and signs.

Discuss this
Standard
IRDAI Information and Cyber Security Guidelines, 2026
Issued
6 Apr 2026
Assurance audit
Every year
Internet-facing VA/PT
Every 6 months
Incident to CERT-In
6 hours

What the IRDAI guidelines actually require

IRDAI first issued information and cyber security guidelines for insurers on 7 April 2017 and extended them to all insurance intermediaries on 2 September 2022. The IRDAI Information and Cyber Security Guidelines, 2023, issued on 24 April 2023, consolidated that framework. On 6 April 2026 IRDAI issued revised guidelines — the IRDAI Information and Cyber Security Guidelines, 2026 — and directed regulated entities to comply from the current financial year.

They apply to all insurers, including foreign reinsurance branches, and to insurance intermediaries: brokers, corporate agents, web aggregators, third party administrators, insurance marketing firms, insurance repositories, ISNPs, corporate surveyors, motor insurance service providers and common service centres, as well as the Insurance Information Bureau of India. Insurance agents, micro-insurance agents, point of sales persons and individual surveyors are outside them; the insurer is responsible for making sure those follow a minimum security framework.

The guidelines combine a policy framework with an audit checklist. Annexure I sets which functions of the NIST Cybersecurity Framework apply to each kind of entity, depending on how it connects to insurer systems. Annexure II classifies intermediaries by gross insurance revenue — ₹50 crore and above, ₹5 crore to ₹50 crore, and below ₹5 crore — and every intermediary using an ISNP, and every web aggregator, falls in the top category whatever its revenue. Annexure III is the checklist the auditor reports against.

An Insurance Self-Network Platform is the website or app through which an insurer or an intermediary sells and services policies online, with IRDAI’s permission. Under the Guidelines on insurance e-commerce of 9 March 2017, its controls, systems, procedures and safeguards must be reviewed at least once a year by an external CISA, a chartered accountant with DISA, or a CERT-In expert, and its servers must be located in India. That review sits alongside the cyber security audit rather than replacing it.

What it will ask of you

Each of these is in the 2026 guidelines or the e-commerce guidelines, and each is something the auditor will test against evidence rather than take on your word.

  • An annual independent assurance audit

    Carried out every year by an auditor meeting Annexure IV, with the plan and the report presented to your audit committee, risk management committee, board or principal officer. An intermediary sends the report to each insurer it works with within thirty days of the audit; an insurer sends its report to IRDAI within ninety days of the financial year end or thirty days of the audit, whichever is earlier.

  • Testing on IRDAI’s schedule

    Vulnerability assessment and grey or white box penetration testing of all internet-facing systems at least every six months, and VAPT of critical internal systems at least once a year, each by a CERT-In empanelled auditor. Business applications and APIs need security testing, including secure code review, before they go live.

  • Remediation inside the clocks

    High-risk VAPT findings remediated immediately and in no case beyond thirty days, followed by re-validation testing. The outer limit for closing all audit gaps is two months, again followed by re-validation.

  • Governance with teeth

    A board-approved information and cyber security policy, an information security risk management committee that meets at least quarterly, and a CISO who does not report to the head of IT and carries no business targets. Exceptions are approved by the CISO up to three months, by the risk management committee beyond that, and by the board beyond a year.

  • Incident reporting in six hours

    Cyber incidents reported to CERT-In within six hours of noticing them or being told about them, with a copy to IRDAI — which depends on detection, logs kept for 180 days within India, and someone authorised to file.

Why it is worth doing properly

  • The assurance audit does not recognise management representations, so a control that exists only in a policy is a finding.
  • For an intermediary, the audit report goes to every insurer you work with, and each insurer decides under its own board policy what risk rating it will accept before continuing to do business with you.
  • The 2026 revision added controls — post-quantum readiness in the cryptographic inventory, MeitY-empanelled cloud providers with a valid STQC audit, immutable backups — that a 2023-era control set will not have.
  • The guidelines now require regulated entities to take technical and organisational measures to comply with the DPDP Act, so the two programmes can share their evidence.
  • Much of the control set overlaps with ISO/IEC 27001, so an existing ISMS shortens the work.

Not sure this is the standard you need?

Tell us what triggered the question — a customer, an auditor, a contract clause — and we will say which of these applies, including when the answer is none of them.

Ask a practitioner

Where we come in, and where we stop

IRDAI decides who may audit. The annual assurance audit must be performed by an auditor meeting Annexure IV — a chartered accountant firm meeting its criteria, or a CERT-In empanelled external systems auditor holding CISA or DISA — and the half-yearly and annual VAPT must be performed by a CERT-In empanelled auditor. We are not CERT-In empanelled and we are not a chartered accountant firm, so we conduct and sign none of them. We do the readiness, the gap assessment, the remediation and the evidence, and we support you through the audit that someone else signs.

Ours

  • Classifying the entity and the Annexure I and II controls that apply to it
  • Gap assessment against the Annexure III checklist
  • Policy, governance and exception processes written to the 2026 text
  • Remediation alongside your engineers, and the evidence each control needs
  • A readiness review run the way the auditor will run the audit
  • Support through the audit and closure of findings inside IRDAI’s clocks

A CERT-In empanelled auditor, or an eligible audit firm

  • The annual independent assurance audit and the signed Annexure III report, by an auditor meeting Annexure IV
  • The audit certificate on cyber security controls — Annexure V, or Annexure VI for a foreign reinsurance branch
  • VAPT of internet-facing systems every six months and of critical internal systems every year, by a CERT-In empanelled auditor
  • The annual ISNP review under the e-commerce guidelines, by an external CISA, a chartered accountant with DISA, or a CERT-In expert

How an engagement runs

Steps 1 to 5 are our work. Step 6 belongs to the auditor, who must meet IRDAI’s eligibility criteria and be independent of the work being audited.

  1. 01Classification and scopeWe establish which kind of regulated entity you are, which category Annexure II puts you in, and which NIST functions Annexure I applies given how you connect to insurer systems. For an ISNP we add the e-commerce guidelines.
  2. 02Gap assessmentEvery applicable Annexure III control tested against the evidence an auditor will ask for, with each gap recorded against an owner and an effort estimate.
  3. 03Policy and governanceThe information and cyber security policy, committee terms of reference, CISO reporting line and exception approvals, brought up to the 2026 text.
  4. 04Remediation and evidenceWe implement alongside your teams and build the evidence each control needs, dated and spread across the year rather than produced in the week before the audit.
  5. 05Readiness reviewA full pass against the checklist the way the auditor will run it, with no reliance on representations. We also help you confirm that the auditor you appoint appears on CERT-In’s published list or meets Annexure IV.
  6. 06The auditThe eligible auditor conducts the audit and signs the report and certificate. We support you through it, then close the findings and track re-validation inside the deadlines.

What you get from us

  • An applicability and classification note under Annexures I and II
  • A gap register against the Annexure III checklist, with owners and effort
  • A policy set and governance documents aligned to the 2026 guidelines
  • An evidence pack organised the way the checklist is
  • A readiness review report before the auditor arrives
  • Findings tracked to closure and re-validation inside IRDAI’s clocks

Common questions

Who has to comply with the IRDAI cyber security guidelines?

All insurers, including foreign reinsurance branches, and insurance intermediaries — brokers, corporate agents, web aggregators, TPAs, insurance marketing firms, insurance repositories, ISNPs, corporate surveyors, MISPs and CSCs — plus the Insurance Information Bureau of India. Individual agents, micro-insurance agents, point of sales persons and individual surveyors are outside them.

Does the IRDAI auditor have to be CERT-In empanelled?

For the half-yearly and annual VAPT, yes. For the annual assurance audit, the auditor must meet Annexure IV: either a chartered accountant firm meeting its criteria on practice, partners and CISA or DISA qualification, or a CERT-In empanelled external systems auditor holding CISA or DISA.

Do brokers and TPAs submit their audit report to IRDAI?

To their insurers. An intermediary submits the Annexure III report, with its compliance and the comments of its audit committee, risk management committee, board or principal officer, to the insurers it works with annually, within thirty days of the audit. Insurers submit their own reports to IRDAI.

What is an ISNP audit?

The annual external review of an Insurance Self-Network Platform’s controls, systems, procedures and safeguards required by clause 11 of the 2017 e-commerce guidelines, by a CISA, a chartered accountant with DISA, or a CERT-In expert. Adverse material findings go to IRDAI with an action plan. The ISNP is also an internet-facing system under the cyber security guidelines.

Can your VAPT count towards the IRDAI requirement?

No. The guidelines require that testing to be performed by a CERT-In empanelled auditor, and we are not empanelled. We can test between the mandated cycles for your own assurance, but it does not replace the empanelled auditor’s test and we will not present it as though it does.

Ready to scope it?

Send the date you are working to and roughly how large the organisation is. You will get a reply from a practitioner with an honest read on whether the date is reachable.

Start the conversation

Related services

All services

Related insights

All insights