IRDAI cyber security guidelines

What are the IRDAI cyber security guidelines?

IRDAI regulates India’s insurance sector. Its Information and Cyber Security Guidelines, 2023 replaced the 2017 guidelines. They set out how insurers and intermediaries must govern, implement and assure information and cyber security, with an annexure of detailed control requirements.

Who does it apply to?

Insurers, including foreign reinsurance branches, and insurance intermediaries regulated by IRDAI. Requirements are applied in proportion to the type and size of the entity.

Key duties

• Governance: a board-approved information and cyber security policy, an Information Security Risk Management Committee and a Chief Information Security Officer independent of IT operations.
• Risk management: asset inventories, data classification, risk assessments and treatment, and controls over third parties and outsourced services, including cloud.
• Technical controls: access control, network and endpoint security, secure configuration, encryption, logging and monitoring, vulnerability management, and a security operations capability.
• Logs: keep ICT logs in line with CERT-In’s Directions, which require 180 days within India.
• Assurance: periodic cyber security audits by qualified, often CERT-In-empanelled, auditors, with findings reported to the board committee.
• Incident reporting: report cyber incidents to CERT-In within six hours and inform IRDAI, with a cyber crisis management plan ready to execute.

In practice

Insurers usually start with a gap assessment against the annexure, then build a remediation plan the board committee tracks. Common gaps are third-party oversight, logging and monitoring coverage, privileged access management and tested incident and crisis plans. Intermediaries with smaller IT estates can often meet requirements through well-governed managed services, but they remain accountable for them.

How does it relate to other frameworks?

The guidelines align closely with ISO/IEC 27001 and NIST CSF. Insurers processing personal data must also meet the DPDP Act, and CERT-In’s Directions apply in parallel.