What the IRDAI cyber guidelines ask of insurers and intermediaries.

What the guidelines are for

The IRDAI Information and Cyber Security Guidelines set the controls IRDAI expects insurers and intermediaries to have around their information and systems, organised on the NIST functions of identify, protect, detect, respond and recover. They were first issued on 24 April 2023. On 6 April 2026, by circular IRDAI/GA&HR/CIR/MISC/51/4/2026, IRDAI issued a fully revised set that replaces them, with compliance required from the current financial year, 2026-27.

The revision changes more than wording. It reshapes who governs cyber security inside an insurer, makes the main security committee meet more often, adds a control for preparing for post-quantum cryptography, and tightens the rules on exceptions and on closing audit gaps.

Who they apply to, and how they tier

The guidelines bind insurers, intermediaries, third-party administrators, web aggregators and insurance repositories. How much of them applies depends on what kind of entity you are.

• Insurers: life, non-life, health and reinsurers, including foreign reinsurance branches. There is no size threshold. Every insurer is subject to all of the NIST sub-chapters and the work from remote location controls.
• Category 1 intermediaries: gross insurance revenue of Rs 50 crore and above.
• Category 2 intermediaries: gross insurance revenue of Rs 5 crore and above but less than Rs 50 crore.
• Category 3 intermediaries: gross insurance revenue of less than Rs 5 crore.

Intermediaries here include brokers, corporate agents, third-party administrators, IMFs, insurance repositories, corporate surveyors, MISPs and CSCs. A Category 3 intermediary that keeps insurer data only in physical form, with no electronic database and no access to the insurer's systems, may give an annual self-certification in place of full audit compliance.

The categories matter because several controls come in two versions: a stricter one for insurers and larger intermediaries, and a lighter one for the smaller categories. The examples below show both where the rulebook holds both.

Governance: who is in charge

The point of the second rule is independence: the person who checks security should not answer to the person whose systems are being checked. The 2026 text also removes the separate Chief IT Security Officer role, folding its duties into the CISO and CTO, and asks for one or more independent external experts with IT or cyber security expertise to sit on the Risk Management Committee.

Exceptions have a clock

Reporting an incident and keeping logs

These two restate the six-hour and 180-day rules of the CERT-In Directions inside the insurance guidelines. IRDAI's circular of 24 March 2025 on cyber incident preparedness repeated them and added that a forensic auditor must be empanelled in advance, and that the firm handling the SOC, attack surface monitoring, red teaming or the annual assurance audit must not also be engaged as the forensic auditor.

Testing, and closing what testing finds

External penetration testing follows the same pattern. The 2026 text changed it from a black-box test to a grey-box or white-box one, still at least every six months for insurers and Category 1 and 2 intermediaries, and once a year for Category 3.

Recovery that has been tried

Getting ready for quantum-safe cryptography

This control is new in 2026. It asks for an up-to-date inventory, not a migration, so that the organisation is prepared for the move to post-quantum cryptography.

The annual assurance audit

An insurer sends its own Annexure-III report to IRDAI within 90 days of the end of the financial year or 30 days of the audit being completed, whichever is earlier. For the year 2026-27 that means no later than 29 June 2027. The Board approves the timelines for closing the gaps this audit finds and must see them closed within 12 months of reporting.

What this looks like as evidence

For governance, the committee charters and minutes showing quarterly meetings, and the CISO's reporting line. For exceptions, a register showing who approved each one and for how long. For incidents, the reporting procedure and a timestamped record of each report to CERT-In and IRDAI. For logs, the retention setting and where the logs are kept. For testing, the VAPT and penetration test reports with their dates and a tracker of gaps closed and retested. For recovery, the test records. For cryptography, the inventory. For the audit, the Annexure-III report and the date it was sent. These are the documents an auditor asks for, and they are what AuditSahi asks you to upload for this rulebook.