IRDAI Cyber Security Guidelines 2026 for Insurers and Intermediaries

The IRDAI cyber security guidelines are the Insurance Regulatory and Development Authority of India's minimum standards for information and cyber security across the insurance sector. They apply to insurers, foreign reinsurance branches and a wide range of intermediaries, from brokers and corporate agents to web aggregators and third-party administrators. On 6 April 2026, IRDAI issued the Information and Cyber Security Guidelines, 2026, revising the 2023 guidelines and requiring compliance from the 2026-27 financial year.

The 2026 revision keeps the 2023 structure but tightens governance and accountability: more frequent committee meetings, a new IT Steering Committee, an independent CISO, independent experts on the risk committee, budgets matched to risk, and remediation of audit gaps within 12 months. This guide explains who is covered, what changed, the core control areas, audits, incident reporting and what insurtech and IT vendors need to deliver.

What are the IRDAI cyber security guidelines?

IRDAI first issued guidelines on information and cyber security for insurers in 2017. In April 2023, it replaced them with the IRDAI Guidelines on Information and Cyber Security for Regulated Entities, which aligned the sector with the CERT-In Directions of 2022 and extended coverage to intermediaries. The circular of 6 April 2026 issues the IRDAI Information and Cyber Security Guidelines, 2026, citing an evolving threat environment, industry feedback and recommendations from IRDAI committees. It includes a summary of major changes and the full guidelines, which set the minimum standards and governance mechanisms regulated entities must adopt.

Commentators differ on whether the 2026 text is best described as a replacement or a set of amendments. In practice, the 2026 guidelines are the document to comply with, and they keep the overall structure of the 2023 version.

Who must comply?

The circular directs the following to strictly adhere to the guidelines and ensure compliance from the current financial year:

• All insurers, including foreign reinsurance branches (FRBs).
• Insurance intermediaries: brokers, corporate agents, web aggregators, third-party administrators (TPAs), insurance marketing firms, insurance repositories, insurance self-network platforms, corporate surveyors, motor insurance service providers and common service centres.
• The Insurance Information Bureau of India.

Requirements are proportionate: some governance structures and controls apply fully to insurers and large entities, while smaller intermediaries have lighter obligations. FRBs may meet committee responsibilities at regional or head office level and can use a comply-or-explain approach for audit checklist controls, subject to supervision.

Is it mandatory or voluntary?

Mandatory for regulated entities from FY 2026-27. IRDAI supervises compliance through audits, inspections and reporting, and can act under the Insurance Act and its regulations. There is no certification, though many insurers hold ISO/IEC 27001 certification to support compliance.

Key governance changes in 2026

• Board responsibility: the board must allocate a security budget proportionate to the entity's risk profile and review reports of audit non-conformities.
• Information Security Risk Management (ISRM) Committee: must now meet quarterly instead of at least twice a year, give quarterly assurance to the Risk Management Committee, and report audit non-conformities with remediation timelines.
• IT Steering Committee: a new committee, convened by the CTO and meeting at least quarterly, covering IT strategy, compliance of IT architecture, business continuity and disaster recovery governance, and review of security-relevant IT procurement with the CISO.
• Risk Management Committee: takes over the functions of the abolished Control Management Committee and must include one or more independent external experts with IT or cybersecurity experience.
• CISO: must be technically qualified, must not report directly to the head of IT, and must not carry business targets. Added responsibilities include scenario-based incident response planning, reviewing all security exception requests, ensuring compliance with CERT-In directives, and regular briefings to the ISRM Committee and board.
• CITSO role removed: its functions move into the CISO and CTO roles.
• Remediation: identified gaps must be remediated within 12 months of being reported.

Core control areas

The guidelines cover the full range of information security controls, broadly aligned with ISO/IEC 27001 and the NIST Cybersecurity Framework. Main areas include:

• Information security policy, risk assessment and asset management.
• Data classification and protection of policyholder data, including health and financial information.
• Identity and access management with MFA and privileged access controls.
• Network and endpoint security, secure configuration and patch management.
• Application security and secure development, including for mobile apps and web portals.
• Logging, monitoring and a security operations capability.
• Vulnerability assessment and penetration testing.
• Incident management and cyber crisis management plans.
• Business continuity and disaster recovery.
• Cloud security and third-party and supply chain risk management.
• Security awareness training for staff, agents and partners.

Reports on the 2026 revision highlight added emphasis on cloud security, supply chain and vendor controls, alignment with the DPDP Act, and inventories of cryptographic assets.

Incident reporting and logs

Regulated entities must report cyber incidents to CERT-In within six hours of detection, as the CERT-In Directions require, with copies to IRDAI and other relevant regulators. Logs of ICT systems must be maintained in line with CERT-In requirements, which call for 180 days of logs kept within Indian jurisdiction. Entities should have scenario-based incident response plans, root cause analysis and post-incident reviews, and must coordinate with vendors so that incidents at TPAs, aggregators or software providers are escalated in time.

Audits and assurance

Regulated entities must undergo an independent annual cybersecurity assurance audit against the guidelines, usually by a CERT-In empanelled auditor, plus periodic vulnerability assessments and penetration testing. Audit non-conformities must be reported to the Risk Management Committee and board with remediation timelines, and fixed within 12 months. Entities should track findings in a register with owners and evidence of closure.

Data location and policyholder records

Insurance regulations require policyholder records held electronically to be maintained in data centres located in India. Combined with CERT-In log retention and DPDP obligations, this means insurers and their vendors should host policyholder data and logs in India, control any access from outside India, and document data flows to reinsurers, TPAs and other partners.

Cloud adoption

Insurers increasingly run policy administration, claims and customer portals on public cloud. Under the guidelines, cloud providers are third parties subject to due diligence, contracts and monitoring, and cloud workloads fall within the scope of VAPT, logging, access control and audits. Insurers should choose Indian regions for policyholder data and logs, understand the shared responsibility split for each service, keep administrative access tightly controlled with MFA and privileged access management, manage encryption keys carefully, and ensure contracts give the insurer, its auditors and IRDAI the access they need. An exit plan for critical cloud services is also good practice.

Vendor, insurtech and TPA requirements

Insurers rely heavily on partners: TPAs for health claims, web aggregators and corporate agents for distribution, insurtech platforms for policy administration and claims, and cloud providers. The guidelines expect regulated entities to perform security due diligence before engaging vendors, include security clauses in contracts, monitor vendor compliance, restrict and log vendor access, and include vendors in incident response. Vendors should expect:

• Security questionnaires and audit rights, including audits by the insurer's auditors.
• Requirements to host data in India and follow the insurer's policies.
• VAPT of delivered applications and timely fixing of findings.
• Incident notification fast enough for the insurer to meet the six-hour CERT-In deadline.
• MFA, role-based access and audit logs in delivered systems.
• Data protection commitments aligned with the DPDP Act.

Distribution partners and digital sales

Insurance is increasingly sold through digital channels: web aggregators comparing policies, banks and fintech apps acting as corporate agents, embedded insurance in e-commerce checkouts, and point-of-sales persons using mobile apps. Each channel handles policyholder data and often integrates directly with the insurer's systems through APIs. The guidelines' vendor and third-party expectations therefore extend to distribution partners. Insurers should authenticate partner APIs strongly, limit the data each partner can access to what its role needs, monitor for unusual volumes or patterns, and make sure partners report incidents promptly. Intermediaries that are regulated entities in their own right have their own obligations under the guidelines, scaled to their size.

Health insurance, TPAs and hospitals

Health insurance brings additional risk because claims involve medical records, diagnoses and bills exchanged between hospitals, TPAs and insurers, often through portals and email. Health data is among the most sensitive personal data under the DPDP Act, and a breach can expose thousands of patients. Good practice includes secure hospital portals instead of email attachments, encryption of documents at rest and in transit, strict access controls for TPA staff, retention limits for claim documents, and alignment with national digital health standards where claims flow through the National Health Claims Exchange or ABDM-linked systems. TPAs, as regulated intermediaries, must meet the guidelines themselves and are also overseen by the insurers they serve.

How to comply, step by step

1. Confirm your entity type and the requirements that apply to it.
2. Read the summary of changes in the 2026 circular and gap-assess against the new text.
3. Restructure governance: quarterly ISRM Committee, IT Steering Committee, independent experts on the Risk Management Committee.
4. Review the CISO role for qualifications, reporting line and absence of business targets.
5. Set a risk-based security budget approved by the board.
6. Update policies and controls for cloud, supply chain, cryptography and data protection.
7. Plan the annual assurance audit and VAPT, and set up a 12-month remediation tracker.
8. Test six-hour incident reporting, including vendor escalation.
9. Review vendor contracts and due diligence.

Documentation you will need

• Board-approved information and cyber security policy and budget.
• Committee charters, minutes and quarterly assurance reports.
• CISO appointment, qualifications and reporting structure.
• Risk assessments and asset and cryptographic inventories.
• VAPT reports and annual audit reports.
• Non-conformity register with remediation evidence.
• Incident reports to CERT-In and IRDAI.
• Vendor due diligence and contracts.
• BCP and DR plans and test results.

Timeline and cost considerations

Compliance is required from FY 2026-27, which began on 1 April 2026. Governance changes, such as new committees and CISO reporting lines, can be made quickly, while control improvements and vendor contract changes may take most of the year. Costs include security staffing, independent experts, audits, tooling and vendor remediation. The 12-month remediation rule means findings from the first audit under the new guidelines must be closed before the following year's audit.

Common mistakes

• CISO still reporting to the CIO or CTO.
• Committees meeting twice a year instead of quarterly.
• Audit findings carried over for more than 12 months.
• TPA and aggregator access not monitored or logged.
• Policyholder data or logs held outside India by vendors.
• Ignoring smaller intermediaries' obligations because they are not insurers.

Best practices, tools and technologies

• Map controls to ISO/IEC 27001 and the guidelines to reuse evidence.
• Use privileged access management for administrators and vendors.
• Run a SOC with playbooks for six-hour reporting.
• Maintain a cryptographic inventory and plan for algorithm changes.
• Automate vulnerability tracking and audit finding closure.
• Run joint incident drills with TPAs and key vendors.

We build insurance, claims and health platforms with audit trails, role-based access, secure partner APIs and India hosting through our web application and API integration services, with experience in healthcare systems.

How the guidelines relate to other frameworks

Framework	Relationship
CERT-In Directions	National six-hour incident reporting and log retention rules the guidelines build on.
DPDP Act	Personal data protection duties for policyholder data.
RBI cybersecurity directions	Equivalent framework for banks and NBFCs, relevant to bancassurance partners.
SEBI CSCRF	Equivalent framework for securities market entities.
ABDM health data	Health data standards relevant to health insurance claims.

Real-world example

A health insurer works with a TPA and an insurtech vendor that runs its cashless claims portal for hospitals. After the 2026 guidelines, the insurer moves its CISO to report to the CEO, creates an IT Steering Committee, and adds an external cybersecurity expert to its Risk Management Committee. It requires the vendor to host claims data in India, enforce MFA for hospital and TPA users, send logs to the insurer's SOC, notify incidents within two hours, and fix critical VAPT findings within 30 days. Its annual assurance audit includes the claims portal, and findings go into a 12-month remediation tracker reviewed quarterly.

Next steps

1. Gap-assess against the 2026 guidelines.
2. Restructure committees and the CISO role.
3. Update vendor contracts and due diligence.
4. Plan the annual audit and remediation tracking.
5. Test incident reporting with vendors.

Frequently asked questions

What are the IRDAI cyber security guidelines?

IRDAI's minimum information and cyber security standards for insurers and intermediaries, revised on 6 April 2026.

When do the 2026 guidelines apply?

From the 2026-27 financial year, as directed in the circular.

Who must comply?

Insurers including foreign reinsurance branches, brokers, corporate agents, web aggregators, TPAs, insurance marketing firms, repositories and other listed entities.

Can the CISO report to the head of IT?

No. The CISO must not report directly to the head of IT and must not carry business targets.

How often must the ISRM Committee meet?

Quarterly under the 2026 guidelines, up from at least twice a year.

How quickly must cyber incidents be reported?

To CERT-In within six hours of detection, with copies to IRDAI and other relevant regulators.

How long do entities have to fix audit findings?

Identified gaps must be remediated within 12 months of being reported.

Do the guidelines apply to insurtech vendors?

Indirectly, through insurers' vendor due diligence, contracts and monitoring.

Is an annual audit required?

Yes, an independent annual cybersecurity assurance audit, plus periodic VAPT.

Do the guidelines require DPDP compliance?

Reports on the 2026 revision note stronger alignment with the DPDP Act, which applies to policyholder personal data in any case.

What happened to the Control Management Committee?

It was abolished, and its functions moved to the Risk Management Committee.