IRDAI's Cyber Security Guidelines 2026 supersede the 2023 framework with quarterly ISRMC, CISO independence, and stricter outsourcing and cloud controls. Compliance is mandatory from the current financial year.
The IRDAI Information and Cyber Security Guidelines 2026 (dated 6 April 2026) supersede the 2023 framework. Key changes: quarterly ISRMC meetings (up from semi-annual), CISO independence from IT with no business targets, new IT Steering Committee, 30-day audit submission, DPDPA alignment, stricter outsourcing and cloud controls, and post-quantum cryptographic readiness.
Appoint CISO separated from IT with no business targets per 2026 Guidelines Clause 6, responsible for scenario-based IRP and CERT-In compliance.
Develop board-approved IS Policy per Clause 8 covering data classification, IAM, cryptography, and DPDPA integration.
Annual VAPT per Clause 18 covering external perimeter, internal network, web applications, and critical insurance systems.
Assess governance structures against 2026 requirements for quarterly ISRMC per Clause 5 and IT Steering Committee per Clause 7.
Evaluate IT vendors against 2026 outsourcing controls per Clauses 28-32: prior sub-outsourcing approvals, empanelled CSPs, and data deletion.
Assess cryptographic infrastructure against post-quantum readiness per Clause 20, building a crypto asset inventory and migration roadmap.
Design 24/7 SOC per Clause 19 meeting IRDAI detection, alerting, and response obligations for policyholder data and core operations.
Implement 2026 outsourcing/cloud controls per Clauses 28-32: prior sub-outsourcing approvals, empanelled CSPs, data deletion at contract end.
Implement scenario-based IRPs per Clause 14, 6-hour CERT-In notification, and IRDAI cyber incident templates with tabletop exercises.
Build crypto asset inventory and post-quantum readiness measures per Clause 20, covering key management and algorithm migration.
Implement data classification and IAM per IS Policy Clause 8, covering RBAC, PAM, and MFA for insurance systems.
Develop scenario-based IRPs per Clause 14 covering ransomware, data breach, insider threat, and cloud incident scenarios.
Prepare materials and support quarterly ISRMC reviews per Clause 5 with compliance status, risk assessments, and board reporting.
Prepare audit reports for 30-day submission per Clause 22, including evidence organisation, control validation, and auditor coordination.
Ongoing annual VAPT per Clause 18 with remediation tracking and retest validation across all scoped systems.
Periodic review ensuring CISO independence from IT per Clause 6, no business targets, and correct reporting lines.
Continuous monitoring of IT vendors against outsourcing/cloud controls per Clauses 28-32 including sub-outsourcing and data deletion.
Track IRDAI circulars, guideline amendments, and CERT-In directions, implementing changes within regulatory timelines.
All insurance companies regulated by IRDAI, including life, non-life, health, reinsurance, and Foreign Reinsurance Branches (FRBs), must comply with the 2026 Guidelines and submit audit reports within 30 days.
Insurance brokers, corporate agents, web aggregators, IMFs, Insurance Repositories, ISNPs, corporate surveyors, MISPs, and CSCs are all covered for policyholder data protection and incident reporting.
Third-Party Administrators processing health claim data, the Insurance Information Bureau of India (IIB), and all other covered entities must meet the 2026 Guidelines including VAPT, CISO appointment, and incident reporting.
A structured six-phase process from initial gap assessment against the 2026 Guidelines through to ongoing quarterly reviews and audit submission.
Gap-assess current IS controls against the IRDAI 2026 Guidelines for your entity type, covering ISRMC, CISO independence, IT Steering Committee, and DPDPA alignment requirements.
Appoint CISO with IT independence, establish ISRMC and IT Steering Committee with quarterly cadences, develop board-approved IS Policy, and integrate DPDPA compliance.
Develop comprehensive board-approved IS Policy covering data classification, IAM, cryptography, network security, third-party risk, BCP, and incident response with DPDPA integration.
Execute annual VAPT, design or evaluate SOC capability, implement outsourcing and cloud controls (sub-outsourcing approvals, empanelled CSPs, data deletion), and build cryptographic asset inventories for post-quantum readiness.
Prepare audit reports for 30-day submission to IRDAI, document CERT-In and IRDAI incident reporting, develop scenario-based incident response plans, and conduct tabletop exercises.
Quarterly ISRMC reviews, 30-day audit submissions, annual VAPT, vendor security monitoring, CISO independence assurance, and regulatory update tracking to sustain IRDAI 2026 compliance year-round.