IRDAI cyber security rules for insurers and intermediaries

In short

IRDAI’s Information and Cyber Security Guidelines set the minimum security rules for everyone it regulates in insurance, from large insurers to brokers, web aggregators and TPAs. The current version was issued on 6 April 2026 and replaces the guidelines of 24 April 2023, keeping their structure while tightening governance and testing. The main software effects are half-yearly testing of internet-facing systems, 180-day logs kept in India, cloud only from MeitY-empanelled providers and 6-hour incident reporting. Insurers’ websites and complaint systems are governed separately by IRDAI’s policyholder protection rules.

Who it applies to

• Insurers: life, general and health insurers, and foreign reinsurance branches. Foreign branches need not form local committees if head office committees do the work, and may comply or explain against the audit checklist.
• Insurance intermediaries: brokers, corporate agents, web aggregators, third party administrators (TPAs), insurance marketing firms, insurance repositories, insurance self-network platforms (ISNPs), corporate surveyors, motor insurance service providers (MISPs) and common service centres.
• The Insurance Information Bureau of India.

Individual agents, micro-insurance agents, point of sale persons and individual surveyors are outside the guidelines. Insurers must still make them follow a minimum security framework set in the insurer’s board-approved policy. Intermediaries that keep only paper records of insurer data and do not access insurer systems give the insurer a yearly self-certification instead.

The guidelines apply to all data the entity creates, receives or keeps, wherever and in whatever form. IRDAI requires compliance from the current financial year, 2026-27.

What it means for your website

Insurer websites

IRDAI’s Master Circular on Protection of Policyholders’ Interests, 2024 says every insurer should have a website. It should cover the insurer’s services, FAQs on policy servicing, enquiry facilities and a way to lodge complaints, on top of the disclosures IRDAI mandates. The circular also requires:

• A search tool to verify the distribution channels the insurer works with, and a way to find channels in a given location.
• Claim documents: the list of documents needed to process a claim.
• Base products (general insurance): the designated base retail product in each line of business, so customers can compare variants.
• Benefit illustrations (life insurance): customised benefit illustrations in IRDAI’s format.
• Product documents: a web link to product documents, including the Customer Information Sheet.
• Unclaimed amounts: a search on the insurer’s website, also reachable from Bima Bharosa.

Complaints and Bima Bharosa

Policyholders can complain on the insurer’s website, by email or letter, at a branch or through the call centre. They can also use Bima Bharosa, IRDAI’s online grievance portal. Insurers must acknowledge a complaint immediately and resolve it within 14 days. Complainants must be able to track status on Bima Bharosa or the insurer’s own grievance portal.

Intermediary websites

The IRDAI (Insurance Intermediaries) (Amendment) Regulations, 2026 were notified on 30 July 2026. Intermediaries with majority foreign ownership, or commission above ₹10 crore in a year, must publish their commission, related-party transactions, profits and dividends on their websites. Brokers must also give an undertaking that their digital interfaces have been checked against the consumer protection rules on dark patterns. Web aggregators and ISNPs have their own registration rules, which this article does not cover.

What it means for your software

Governance and the CISO

The board must fund information and cyber security in proportion to the entity’s risk appetite and ensure audit gaps are closed within 12 months. The Information Security Risk Management Committee now meets at least quarterly, up from twice a year. A new IT Steering Committee, convened by the Chief Technology Officer, meets at least quarterly. The Risk Management Committee must include at least one independent external expert in IT or cyber security. It also takes over the work of the former Control Management Committee.

The Chief Information Security Officer (CISO) must not report directly to the head of IT and must not be given business targets. The CISO is a permanent invitee to the IT Steering Committee, builds scenario-based incident response plans and is responsible for following CERT-In’s directions. The separate Chief IT Security Officer role has been removed.

Exceptions to security policy

Exceptions of up to three months are approved by the CISO, longer ones by the Risk Management Committee, and those over a year by the board. Any exception beyond 12 months must be reassessed and re-approved, and the risk of every exception must be documented.

Audits

An independent assurance audit is required every year, by a CERT-In empanelled auditor meeting IRDAI’s eligibility criteria. Insurers send the audit report, with board comments, to IRDAI. It is due within 90 days of the financial year end or 30 days of the audit, whichever is earlier. Intermediaries send their audit checklist and compliance, with comments from the board or principal officer, to each insurer they work with, within 30 days of the audit.

VAPT and security testing

• Internet-facing systems: vulnerability assessment and external grey or white box penetration testing at least every six months, by a CERT-In empanelled auditor.
• Critical internal applications: VAPT at least once a year by a CERT-In empanelled auditor.
• Changes: every change to an internet-facing system needs security testing, with gaps closed before it goes live.
• Applications and APIs: security audit, VAPT and secure code review before go-live and periodically.
• Test environments: if testing cannot be done in production, the test setup must match production, and any difference goes to the security committee for approval.
• Closure: high-risk gaps fixed within 30 days, all audit gaps within two months, each followed by re-testing.

See our VAPT guide.

Logs

ICT infrastructure logs must be kept for a rolling 180 days within Indian jurisdiction, and made available to law enforcement, IRDAI, CERT-In and CSIRT-Fin on request. System administrator and operator activity must be logged, protected and reviewed.

Incident reporting

Cyber incidents must be reported to CERT-In within 6 hours of noticing them or being told of them, with a copy to IRDAI and other concerned regulators. CERT-In publishes the reporting formats; see our article on the CERT-In directions.

Cloud and vendors

Cloud services may be taken only from MeitY-empanelled providers whose data centres hold a valid STQC audit status. The entity must sign a non-disclosure agreement covering privacy, confidentiality, security and continuity. The contract must require the provider to erase all traces of data, including backups, when it ends. Service providers must get written permission before outsourcing further. Where a vendor serves several group companies, their infrastructure, networks and databases should be kept separate.

Resilience and future risks

Critical hardware needs immutable backups and failover components. Entities must keep an up-to-date inventory of cryptographic assets to prepare for post-quantum cryptography.

Personal data

The 2026 guidelines require technical and organisational measures to comply with the DPDP Act and its rules.

Grievance systems

The policyholder protection master circular requires insurers to integrate their grievance portal with Bima Bharosa, with real-time mirroring so both databases stay in step. The system must also flag unrelated or unidentifiable complaints raised by fraudsters.

Checklist

1. Check whether your entity type is covered, and plan for compliance in 2026-27.
2. Reset governance: quarterly security and IT steering committees, an independent external expert, and a CISO with no business targets.
3. Set up an exceptions register with the approval levels IRDAI now requires.
4. Book half-yearly VA and grey or white box PT for every internet-facing system with a CERT-In empanelled auditor.
5. Fix high-risk findings within 30 days and all audit gaps within two months.
6. Keep ICT logs for 180 days on infrastructure in India.
7. Move cloud workloads to MeitY-empanelled providers and add data erasure and sub-outsourcing clauses to contracts.
8. Write a 6-hour incident reporting procedure to CERT-In with a copy to IRDAI.
9. Insurers: integrate your grievance system with Bima Bharosa and check the website items in the policyholder protection master circular.

How Kreon helps

We have built an insurance agency management system, and we can build policy, renewal, commission, CRM and grievance systems for insurers and intermediaries with IRDAI requirements designed in: role-based access, logs kept on Indian infrastructure, and an audit trail of every change with before and after values. Systems we have built have passed independent VAPT.