The IRDAI Information and Cyber Security Guidelines, dated 24 April 2023, require insurers and regulated intermediaries to run a board-approved security policy under a CISO, test internet-facing systems at set intervals, report incidents on tight timelines and submit an annual independent audit. The document is about 175 pages, so this is a map, not a substitute.
Who must follow them?
The guidelines apply to all insurers, including foreign re-insurance branches, and to insurance intermediaries regulated by IRDAI. Insurance agents, micro-insurance agents, point of sale persons and individual surveyors are outside their direct scope, but insurers must make sure those entities follow a minimum framework defined in the insurer's board-approved policy. The guidelines cover all data created, received or maintained by regulated entities, in whatever form. An annexure sets out how the NIST framework applies to each type of entity.
What does governance look like?
The Board is ultimately responsible for information security. It approves the Information and Cyber Security Policy, approves the appointment of the CISO, approves and reviews the IT framework, and receives quarterly inputs on information security matters. The policy is reviewed annually.
The CISO must be a sufficiently senior official with the requisite technical background, with a reasonable minimum term, reporting directly to the top executive overseeing risk management or, absent that, to the CEO. Among the CISO's duties are setting standards for technology risk assessments, application security, vendor risk assessment and vendor classification, and security testing baselines for vulnerability assessment and penetration testing. The CISO is also responsible for ensuring critical or high severity incidents are reported to the relevant regulators.
What testing cadence does it set?
The security testing section lists specific expectations:
- Vulnerability assessment and penetration testing of internet-facing applications and infrastructure at least once a year.
- Mandatory security testing for all changes to internet-facing assets, with reported gaps closed before moving to production.
- Business applications, including APIs and web services, undergo VAPT including secure code review periodically and before go-live.
- External blackbox penetration testing of internet-facing assets and systems once in six months.
- Network and application vulnerability assessments on an ongoing basis by competent personnel, with risks documented.
- High-risk gaps from VAPT closed within one month, followed by validation testing.
- Priority for other gaps based on risk, with an outer limit of two months for closing all audit gaps.
- Risks left unmitigated because of technology limits or business needs go to the information security risk committee for resolution or exception approval.
What are the incident reporting rules?
The guidelines say the organization must identify how incidents are reported to internal and external parties and adhere strictly to prescribed timelines. They require mandatory reporting of cyber incidents to CERT-In within six hours of noticing or being notified, with a copy to IRDAI and other concerned authorities.
What about audit and intermediaries?
An independent assurance audit is required every year, with plans and reports presented to the Audit Committee or Board. Insurers submit the signed audit report with the Board's comments to IRDAI within 90 days of the end of the financial year or within 30 days of completing the audit, whichever is earlier. Intermediaries submit their audit checklist with compliance and board comments to the insurers they serve each year.
Constructed example
An insurer's engineering team builds a tracker keyed to the testing list above. The customer portal API gets a pre-release secure code review and VAPT, and the ticket shows closure of high-risk gaps within a month plus a retest. Every release touching an internet-facing component links to a test report. Auditors sampling any change see testing, closure and validation in one place.
What to do
- Read the full guidelines and extract each "shall" into a tracker with an owner.
- Confirm your entity type and which annexure applies.
- Schedule annual VAPT and six-monthly external blackbox testing for internet-facing assets.
- Add a release gate for security testing of internet-facing changes.
- Define closure targets for high-risk findings and a retest step.
- Rehearse CERT-In reporting inside six hours, including who files and from which template.
- Classify vendors and set review periodicity per class.
- Prepare the annual audit evidence pack from the tracker.
Safeguard's dependency scanning, policies and gates, and compliance automation can help generate and organise evidence for steps 3 to 5 and 8. Safeguard does not certify any insurer against IRDAI requirements.
Quick check
How fast must cyber incidents be reported to CERT-In under the guidelines?
Within six hours of noticing or being notified of the incident, with a copy to IRDAI and other concerned regulators.
How often must external penetration testing run?
The guidelines call for external blackbox penetration testing of internet-facing assets once every six months, with VAPT at least annually.
Sources
Last reviewed: 18 October 2026.
