The IRDAI has issued a circular having reference number IRDAI/GA&HR/C1R/MISC/49/03/2025, dated March 24, 2025, regarding Cyber Incident or Crisis Preparedness (“Circular”). The key highlights of the Circular are as under:
- Reference is drawn to the IRDAI Information and Cyber Security Guidelines, 2023, as under:
- Para 3.5 under Policy no. 2.10: Regulated Entities (REs) are required to report any cyber incidents to IRDAI in the prescribed format within 6 hours of noticing or being notified of such incidents.
- Para 3.3 under Policy no. 2.16: REs shall maintain and monitor all ICT infrastructure and application logs for a rolling period of 180 days. Additionally, the clocks of all relevant information processing systems should be synchronized with Network Time Protocol (NTP) servers of NIC, NPL, or traceable NTP servers.
- Para 3.3 under Policy no. 2.18: A Cyber Crisis Management Plan (CCMP) shall be in place as part of the organization’s response to cyber-attacks.
- Para 3.4 under Policy no. 2.20: REs shall perform forensic investigations for severe information security incidents, and the Chief Information Security Officer (CISO) should engage certified external forensic experts when necessary.
- Para 1.10 under General Guidelines: REs shall comply with the directions issued by CERT-In, including those related to incident reporting and cybersecurity practices as per CERT-In’s directions issued on April 28, 2022, concerning information security practices, prevention, response, and reporting of cyber incidents for a safe and trusted internet.
- It is reiterated that all REs shall comply with the provisions on cyber incident/crisis preparedness to ensure effective readiness.
- The REs shall establish a well-defined procedure to ensure that forensic auditors are empanelled in advance, enabling them to be promptly onboarded to conduct forensic investigations and root cause analysis in the event of a cyber incident without delay.
- The vendor handling Security Operation Centre (SOC), attack surface monitoring, red teaming, or conducting annual assurance audits, or any cybersecurity aspect of the Regulated Entity, shall not be engaged as the forensic auditor for the incident to prevent conflict of interest.
- All REs, including insurance intermediaries, are advised to present compliance with these provisions to their Board in the upcoming Board Meeting and submit the meeting minutes to the IRDAI for their information.
A copy of the Circular is attached for your ready reference.
Source category: IRDAI
Comments are closed