IRDAI vide circular dated June 13, 2023 has expressed concerns about non-adherence by Regulated Entities* (RE) of the para 3.5 of policy no. 2.10 in IRDAI Information and Cyber Security Guidelines, 2023 with regards to the timelines and their communications to Indian Computer Emergency Response Team (CERT-In). Thereby the REs are directed to:
- abide by the provisions and further submit details of a Cyber Security Incident.
- submit within 24 hours, the details in reporting format that needs to be updated with the flow of information from forensic analysis as and when obtained.
Reference:
IRDAI Information and Cyber Security Guidelines, 2023
“ 3. POLICY:
…
3.5 Notification to regulatory authorities:
1. Organization shall identify how incident shall be reported to internal parties and external organizations (e.g., Regulators, media, law enforcement, customers, IRDAI, CERT-In, CSIRT-Fin, Cyber Swachhta Kendra)
2. The timelines prescribed for reporting incidents to external organizations shall be strictly adhered to.
3. Organization shall mandatorily report cyber incidents to Cert-In within 6 hours of noticing or being brought to notice about such incidents with a copy to IRDAI and other concerned regulators / authorities. The details regarding methods and formats of reporting cyber incident is published on Cert-In website.
4. Organization shall ensure that contact details of Ministries, stakeholders, vendors and agencies like NCIIPC & CERT-In for incident resolutions are up to date and documented.”
…
* Regulated Entities include Insurers, Insurance Intermediaries etc.
For more details regarding IRDAI Information and Cyber Security Guidelines, 2023 please visit:
Source category: IRDAI
Attachments
- /2023/216_Circular_on_Reporting_of_Cyber_Security_Incident.pdf
- /2023/216_Proforma_for_Reporting_of_Cyber_Security_Incident.pdf
Comments are closed