IRDAI's guidelines tell insurers, foreign reinsurance branches and intermediaries how to govern information and cyber security: board and committee duties, an independent CISO, twenty-four security domain policies, annual audit by a CERT-In empanelled auditor and six-hour incident reporting.
Free account needed to download. You come straight back to the file.
Who it is for. Insurers, foreign reinsurance branches and insurance intermediaries regulated by IRDAI, including brokers, corporate agents, web aggregators and third-party administrators.
What this list covers. IRDAI Version 2.0 of April 2026, which revised the 2023 guidelines; check IRDAI's site for any later change: 58 requirements. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| 1.4 | Know whether and how it applies | Insurers, foreign reinsurance branches and intermediaries are covered. Agents, POS persons and individual surveyors are not, but insurers must make them follow a minimum framework set in the Board's policy. |
| 1.4 FRB | Foreign reinsurance branches | Branches need no committees of their own if the duties are met at the regional, controlling or head office, and may comply or explain against the audit checklist as part of supervision. |
| 1.5 | ISRMC governs the policy | An Information Security Risk Management Committee (CRO, CISO and heads of IT, operations, finance, legal, compliance, HR and admin) governs the policy and meets at least quarterly, with the CISO and two members present. |
| 1.5 Review | Review the policy every year | The CISO reviews the Information and Cyber Security Policy each year and the ISRMC approves it, considering new law, standards, technology, business changes and incidents. |
| 1.6 Board | Board duties | Give security a budget that suits the risk appetite and threat landscape, receive the status of audit non-conformities and the risk report, approve closure timelines, and make sure gaps close within 12 months. |
| 1.6 CISO | An independent CISO | The CISO has no reporting line to the Head of IT and no business targets, is adequately staffed, briefs the ISRMC and Board, sits on the IT Steering Committee, reviews exception requests and complies with CERT-In directions. |
| 1.6 CISO IR | Scenario-based incident plans | The CISO builds and runs scenario-based incident response plans for cyber crises, contingencies, disasters and attacks on IT systems. |
| 1.6 CTO | CTO and Head of IT | The CTO puts security technology and processes in place in agreement with the CISO, keeps IT within the CISO's standards, and makes sure vulnerabilities found by audits and risk assessments are fixed in time. |
| 1.6 CITSO | Cover the old CITSO duties | The CITSO post is gone. Make sure its former functions sit in the job definitions of the CISO or CTO. |
| 1.6 Business | Functional heads and business owners | Business owners ensure their teams follow security policy, work with the CISO on risks in their area, and escalate incidents promptly to the response team. |
| 1.6 Reporting | Report audit gaps upward | The ISRMC reports audit non-conformities and closure timelines to the Risk Management Committee, which takes serious ones to the Board, and gives that committee assurances each quarter. |
| 1.6 ITSC | IT Steering Committee | Set up a senior IT and business committee, convened by the CTO, meeting at least quarterly. It covers IT strategy, compliant architecture, SLAs, continuity, policyholder data controls, and security input on IT purchases. |
| 1.6 RMC | Risk committee takes over the CMC | The Control Management Committee is gone. Put its functions in the Risk Management Committee's terms of reference, and include an independent external expert in IT or cyber security. |
| 1.8 | Risk assessment | Assess risk at least annually and before major new technology, outsourcing, external access to critical systems or access from outside locations. Record treatment in a plan signed off by the owner and an executive. |
| 1.9 | Exceptions to policy | Approve exceptions case by case after a risk assessment: up to three months by the CISO, beyond that by the Risk Management Committee, beyond one year by the Board. Reassess any that run past 12 months. |
| 1.9 Emergency | Emergency exceptions | In a pandemic, war or disaster, use a Crisis Management Committee to approve workarounds, ratified by the Board's Risk Management Committee, and remove them when normal operations return. |
| 1.10 Audit | Annual independent audit | Have an independent assurance audit each year and present the plan and reports to the Audit Committee, Risk Management Committee, Board or Principal Officer as applicable. |
| 1.10 Filing | Submit the audit report | Insurers send the signed Annexure III audit report, with Board comments, to IRDAI within 90 days of year end or 30 days of finishing the audit, whichever is earlier. Intermediaries file with insurers within 30 days of a CERT-In empanelled audit. |
| 1.10 Insurer | Insurers oversee intermediaries | Insurers make sure their intermediaries comply during the engagement, under a Board-approved policy, and take annual self-certification from those that hold only paper records. |
| 1.10 Law | CERT-In, other laws and DPDP | Follow CERT-In directions, tell security researchers about CERT-In's CVE and responsible disclosure role, comply with applicable laws, and take technical and organisational measures to meet the DPDP Act and Rules. |
| Ref | Control | What it requires |
|---|---|---|
| 2.1 | Classify information | Classify information assets into four levels: Confidential, Restricted, Internal and Public. The owner sets the class, and personal data is flagged as PII as well. |
| 2.1 Owners | Name data owners | Give every information asset an owner who stays accountable for its protection and classification. |
| 2.2 | Manage assets through their life | Follow a formal process to buy, profile, classify, track and dispose of assets, including those held at provider premises. |
| Ann. III Crypto | Inventory cryptographic assets | Keep an up-to-date inventory of cryptographic assets so you are ready to move to post-quantum cryptography (a control in the Annexure III audit checklist). |
| Ref | Control | What it requires |
|---|---|---|
| 2.3 | Access control | Give each person a unique ID, grant access on least privilege, need to know and segregation of duties, and keep individuals accountable for what their accounts do. |
| 2.3 Passwords | Password changes | Require users to change their password at first log-on and then every 45 days, and block reuse of previous passwords. |
| 2.3 Privileged | Privileged access | Limit privileged access to documented business need, log it fully and review it regularly. Vendors and contractors get none without close supervision and monitoring. |
| 2.4 | Human resource security | Cover security before, during and at the end of employment: screening, agreements, awareness and training, and removing access on exit. |
| 2.7 | Mobile security | Set rules for securing mobile devices and applications that touch organisational information. |
| 2.8 | Bring your own device | Set a BYOD policy that controls how personal devices connect to and hold organisational data. |
| Ref | Control | What it requires |
|---|---|---|
| 2.5 | Security in development and acquisition | State security requirements for every new or changed system and build security in by design across development, customisation and acquisition. |
| 2.6 | Maintenance and patching | Maintain information systems and apply patches in a controlled way, with documented procedures and records. |
| 2.6 Backups | Back up and test restores | Define restoration needs by data class and test restoration at least every six months for critical assets, or more often if the business needs it. |
| 2.9 | Change control | Document change management procedures and make all changes to information assets follow them. |
| Ref | Control | What it requires |
|---|---|---|
| 2.11 | Network perimeter and segmentation | Deploy firewalls and intrusion detection at the perimeter, segment networks by data classification, use micro-segmentation to limit lateral movement, and put WAFs in front of web-facing applications. |
| 2.11 2FA | Two-factor for outside connections | Require two-factor authentication for any connection from outside the organisation's own or controlled network to business transaction systems and high-severity systems. |
| 2.12 | Cryptographic controls | Apply cryptography according to data classification, define the key management lifecycle, protect keys from loss and change, and send keys over networks only through secure channels. |
| 2.1 Handling | Encrypt what leaves | Encrypt confidential information sent outside the network, including over the internet, and keep it encrypted when it is held on mobile or removable media. |
| 2.21 | Email security | Apply DMARC, SPF and DKIM to reduce spoofed email, filter DNS to block known bad domains, and sandbox inbound attachments to detect and block malicious ones. |
| 2.22 | Work from a remote location | Secure remote working with controlled access, protected devices and defined rules for the data handled. |
| 2.23 | Dealing room operations | Record dealer and broker communications on dedicated lines, review them independently in the mid-office, keep recordings as proof of transactions, and provision tested backup connectivity. |
| Ref | Control | What it requires |
|---|---|---|
| 2.10 | Incident management | Have procedures to detect, report and respond to incidents by severity, with a response team, an incident management coordinator, and root cause and remediation recorded for each. |
| 2.10 CERT-In | Report to CERT-In in six hours | Report cyber incidents to CERT-In within six hours of noticing them or being told of them, with a copy to IRDAI and other regulators concerned. |
| 2.13 | Continuity and disaster recovery | Protect systems so operations can resume after disruption, with capacity monitoring, regular data backups and tested restoration. |
| 2.13 Test | Test the plans | Test business continuity and DR plans at least once a year or after significant change, report results to the ISRMC, and include real disaster scenarios, not only planned shutdowns. |
| 2.15 | Physical and environmental security | Protect premises, equipment and data centres with physical and environmental controls. |
| 2.18 | Situational awareness | Keep watch on the threat environment so you can act on advisories and emerging threats. |
| 2.20 | Cyber resilience | Build the ability to anticipate, withstand and recover from cyber events. |
| Ann. III Backup | Immutable backup and resilient hardware | Keep immutable backup and failover or resilient components for critical hardware (a control in the Annexure III audit checklist). |
| Ref | Control | What it requires |
|---|---|---|
| 2.14 | Third-party service providers | Control providers by contract. Providers cannot subcontract further without your prior written permission, and the SLAs must meet regulatory requirements. |
| 2.19 | Cloud providers | Use only MeitY-empanelled cloud providers with a valid STQC (or equivalent) audit status, sign an NDA covering privacy, confidentiality, security and continuity, and require full erasure of your data when the contract ends. |
| 2.16 Logs | Keep logs | Keep ICT infrastructure logs for a rolling 180 days within India as CERT-In directs, protect log information, and retain audit trails as record retention and regulation require. |
| 2.16 Testing | Grey or white box penetration tests | Test every internet-facing asset with a grey or white box penetration test at least every six months, by a CERT-In empanelled auditor. |
| Ann. III Test env | Make test environments match production | If a penetration test must run in a test environment, make its version and configuration match production and put any deviation to the ISRMC for approval (a control in the Annexure III audit checklist). |
| Ann. III Group | Segregate group entities | Separate group companies' infrastructure, networks and databases logically or physically, and separate vendor staff with cross-entity access where possible (a control in the Annexure III audit checklist). |
| 2.17 | Legal and regulatory compliance | Identify and comply with the laws relevant to your operations, including the IT Act, IRDAI rules and the DPDP Act. |
| 2.24 | IT Intermediary Rules, 2021 | Meet the duties the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 place on you where they apply. |
| 2.16 Audit | Rotate the auditor | Rotate the independent assurance auditor every three years. |
Version 2.0 (April 2026) makes the ISRMC meet quarterly, adds an IT Steering Committee, requires an independent CISO, removes the CITSO and the Control Management Committee, and adds controls such as grey or white box penetration testing every six months, a cryptographic asset inventory and cloud provider requirements.
Within six hours of noticing it or being told of it, to CERT-In, with a copy to IRDAI and other concerned regulators.
Not directly. Insurers must make sure agents, micro-insurance agents, POS persons and individual surveyors follow a minimum security framework under the insurer's Board-approved policy.
No. It is a plain-English summary in our own words, using IRDAI's section numbers and the Annexure III checklist where the entry says so. The guidelines are the authority.