When did the IRDAI cybersecurity guidelines take effect?

IRDAI issued the Information and Cyber Security Guidelines in April 2023. Some technical controls had a phased implementation timeline; governance and reporting requirements applied straight away.

Do intermediaries need a dedicated CISO?

Large insurance intermediaries with significant digital operations may need a dedicated CISO or equivalent. Smaller ones can give the job to a senior IT or compliance official, proportionate to their scale and risk profile, as long as a named person clearly owns it.

How does IRDAI compliance interact with RBI and CERT-In requirements?

Entities answering to several regulators, such as insurers with financial operations, must meet every framework that applies. CERT-In mandatory directions cover all organizations in India and run alongside IRDAI requirements. The 6-hour incident reporting requirement applies under both, so run a single reporting workflow that files with both.

What are the penalties for non-compliance?

IRDAI can impose penalties under the Insurance Act and IRDAI regulations: monetary fines, restrictions on business operations and directions for corrective action. Persistent non-compliance can also affect license renewal and registration status.

Are cloud services permitted for insurance operations?

Yes, with conditions. Deployments must meet data localization requirements, customer data must be encrypted, the provider must meet security standards acceptable to IRDAI, and the insurer keeps full control and auditability of its data. The cloud agreement must include IRDAI audit rights. Get that clause in before signing.

IRDAI Cybersecurity Guidelines Checklist

Overview

The Insurance Regulatory and Development Authority of India (IRDAI) issued its Information and Cyber Security Guidelines in April 2023. They cover every insurer, insurance intermediary and insurance repository operating in India, and they fold earlier IRDAI circulars into one set of governance, technical and operational controls. Compliance is mandatory. IRDAI checks it through regular inspections and on-site audits, and inspectors ask for evidence: Board minutes, access review records, VAPT reports, incident tickets with timestamps. A policy PDF on its own proves very little.

Applicability and Scope

Entity Type	Key Requirements
Life and General Insurers	Every control in the guidelines applies, including a dedicated CISO and a SOC
Health Insurers	Every control applies, plus specific protection for health data and electronic medical records
Reinsurers	The controls that apply to their India operations
Insurance Intermediaries	Brokers, corporate agents and web aggregators apply the controls in proportion to the size of their operations
Insurance Repositories	Every control applies, with stronger data protection around policyholder records

Governance Framework

Get a Board-approved Information and Cyber Security Policy, and diarise its annual review
Appoint a Chief Information Security Officer (CISO) with a direct line to the Board and CEO, not routed through the CIO
Constitute an Information Security Committee where IT, risk, compliance and operations all sit
Fund cybersecurity as its own line, a defined percentage of IT spend
Assess cyber risk at least annually and again after significant changes, for example moving claims to a new core platform
Take a quarterly report to the Board on risk posture, incidents and remediation progress; list open findings by owner and age so slippage is visible
Keep a three-year cybersecurity roadmap tied to business strategy

Technical Controls

IRDAI wants defense in depth. If one control fails, the next layer should still hold. Network security means next-generation firewalls, intrusion detection and prevention, and segmentation that keeps policy administration and claims systems off the office network. Endpoints get EDR, application whitelisting and device encryption, so a laptop left in a taxi is a hardware loss and nothing worse.

Encrypt data at rest and in transit. Put DLP (data loss prevention) on email and web uploads, since that is where policyholder spreadsheets leave the building, and watch the policyholder tables with database activity monitoring. Access management needs multi-factor authentication, privileged access management and access reviews that actually remove leavers. For applications: a secure development lifecycle, code reviews, web application firewalls.

Incident Management and Reporting

Report cybersecurity incidents to IRDAI within 6 hours of detection. Detection means the moment your SOC confirms the event, so do not wait for the root cause before filing
File with CERT-In at the same time, as the CERT-In mandatory directions require
Test the incident response plan with a tabletop at least annually; a ransomware scenario on the claims platform exposes most gaps in an afternoon
Send IRDAI the root cause analysis for every significant incident
Keep forensic evidence (disk images, logs, mail headers) with chain of custody documented
Notify policyholders of personal data breaches within the prescribed timelines
After each incident, record what changed and keep the proof

Audit and Compliance Requirements

IRDAI requires a cybersecurity audit every year by CERT-In empaneled auditors, covering IT governance, access controls, network security, application security, data protection, incident management, business continuity and vendor risk management.

Vulnerability Assessment and Penetration Testing (VAPT) must run at least twice a year, with critical findings remediated within 30 days. Scope it from a current asset inventory. The systems that usually drop out are the ones IT did not build: agent portals, partner-hosted quote pages, agency-run microsites. Insurers must also join industry-wide cyber exercises organized by IRDAI or CERT-In and file compliance reports in the prescribed format.