Compliance & Risk Advisory
Gap assessments, policies and playbooks aligned with RBI, SEBI CSCRF, CERT-In, IRDAI, PCI DSS and DPDP.
Learn more about Compliance & Risk Advisory → Compliance · IRDAI
IRDAI cyber security guidelines compliance
The Insurance Regulatory and Development Authority of India (IRDAI) expects insurers and insurance intermediaries to run a documented information and cyber security programme with board oversight.
Overview
In plain English
The guidelines cover governance, risk assessment, technical controls, incident management and periodic audit, and they align with CERT-In reporting obligations.
Instruments covered
- IRDAI Information and Cyber Security Guidelines, 2023
Key requirements
What IRDAI expects
Governance and roles
Board-approved information and cyber security policy and a designated CISO or equivalent responsible official.
Risk assessment
Periodic assessment of information and cyber security risks across systems and vendors.
Technical controls
Controls for access, data protection, network security, application security and endpoint security.
Logging and monitoring
Logging and monitoring of systems, aligned with CERT-In log retention expectations.
Incident management
Incident response procedures and reporting of cyber incidents, including to CERT-In within prescribed timelines.
Periodic audit
Regular information and cyber security audit, with findings reported and closed.
How TrustNet helps
From gap to evidence
- Gap assessment against the IRDAI guidelines
- Audit preparation and support
- VAPT of policy, claims and customer-facing systems
- Incident readiness and reporting playbooks
- Policy suite drafting
Official sources
Aligned with, not endorsed by any regulator. This page is a plain-English summary for awareness — confirm obligations against the latest official circulars or with your compliance officer.
Services mapped to IRDAI
Security Audit
Independent review of your systems, controls and architecture against the rules you must follow.
Learn more about Security Audit →VAPT
Find and fix weaknesses in apps, APIs, networks and cloud before attackers exploit them.
Learn more about VAPT →24/7 Incident Response
Call us when it matters: triage, containment, recovery and regulator reporting support.
Learn more about 24/7 Incident Response →FAQ
IRDAI FAQ
Do the IRDAI guidelines apply to brokers?
They apply to insurers and insurance intermediaries as specified by IRDAI. We help you confirm your obligations.
How often is an audit needed?
The guidelines require periodic audit. We help you plan the audit cycle and prepare evidence.
Do we still need to report to CERT-In?
Yes. Insurers are also covered by the CERT-In Directions, so incident reporting to CERT-In applies alongside IRDAI requirements.
Book a consultation
Get IRDAI-ready
We assess where you stand, close the gaps and prepare the evidence your auditors and regulator will ask for.
support@trustnetsecure.com · +91 93229 37312 · +91 88300 61438
Under attack right now? Go to emergency help →