Let’s Connect

IRDAI – Circular on IRDAI Information and Cyber Security Guidelines, 2026

  • Regulatory Updates
  • IRDAI – Circular on IRDAI Information and Cyber Security Guidelines, 2026

The Insurance Regulatory and Development Authority of India (“ IRDAI/ Authority” ) has issued a circular dated April 6, 2026, bearing reference number IRDAI/GA&HR/CIR/MISC/51/4/2026 (“ Circular ”) on the IRDAI Information and Cyber Security Guidelines, 2026 (“ Guidelines, 2026 ”).

The key highlights of the Circular are as follows:

  • The Guidelines, 2026 revise the earlier framework titled ‘IRDAI Guidelines on information and Cyber Security for Regulated Entities’ dated April 24, 2023, bearing reference number IRDAI/GA&HR/GDL/MISC/88/04/2023 (“ Guidelines, 2023 ”) in the light of evolving threat landscape, industry feedback and recommendations of various IRDAI committees, with the objective of strengthening defence and governance mechanisms to deal with emerging cyber threats.
  • The Guidelines, 2026 are applicable to all insurers including FRBs, Insurance Intermediaries covering Brokers, Corporate Agents, Web Aggregators, TPAs, IMFs, Insurance Repositories, ISNP, Corporate Surveyors, MISPs, CSCs and Insurance Information Bureau of India (“ IIB ”), requiring adherence to the prescribed standards and ensuring compliance from the current financial year.
  • The Guidelines, 2026 also set out the revised controls for preparation of the Auditor’s Report.

The changes introduced in the Guidelines, 2026 are as follows:

Summary of Modifications

Sl. No.Relevant ProvisionExisting ProvisionChanges IntroducedRevised Provision
11.4. Applicability – FRBsNo specific framework for FRBsNew provision for compliance by FRBs
  • As long as governance responsibilities outlined in the specified committees are met at regional / controlling / head office for complying with these guidelines, they may not constitute committees at the branch level.
  • W.r.t to compliance with the provisions of guidelines or controls provided in the checklist (annexure-III), FRBs shall ‘comply or explain’, subject to a reasonably justifiable explanation, as a part of the supervisory process.
21.5. (II) GovernanceII. Governing BoardThe ISRMC meeting shall require CISO and at least two members to participate with all members meeting at least twice in a year.Frequency has been increased from twice in a year to quarterly basis.The Information Security Risk Management Committee (ISRMC) shall meet at least on a quarterly basis.
31.6.(1) Roles and Responsibilities – Board of Directors1. Board of Directors(Roles and responsibilities of Board of Directors)Additional responsibilities have been introduced including budget allocation, monitoring of cyber risks and ensuring closure of gaps.
  • Provide sufficient budget for Information and Cyber security keeping in view the current/emerging threat landscape and ensure that the budget is proportional to the organization’s risk appetite.
  • Receive the status of non-conformities observed in the annual cyber security assurance audit report and risk report.
  • Approve timelines for closure of gaps observed and ensure that gaps are closed within 12 months of reporting.
41.6.(3) Roles and Responsibilities – CISO

3. Chief Information Security Officer (CISO)

The CISO shall be responsible for carrying out the following functions:

Briefing to the ISRMC

CISO shall review and approve requested exceptions to information security policies, standards and procedures.

These provisions are modified and new additional responsibilities has been prescribed.

Provisions have been amended to –

  • Mandate independence of CISO from IT function
  • Prohibit assignment of business targets, and
  • Expand responsibilities to include incident response, regulatory compliance (including CERT-In), and enhanced reporting to ISRMC/Board.
  • The CISO shall not have direct reporting relationship with the Head of IT Function and shall not be given any business targets. The CISO should be adequately staffed with people having relevant technical expertise.
  • Briefing to the ISRMC and the Board.
  • Shall be Permanent invitee to IT Steering Committee.
  • The CISO shall review and comment on each of requested exceptions to information security policies, standards and procedures.
  • The CISO shall develop and implement Scenario based Incident Response plans to deal with Cyber crises, contingencies and disasters, attacks on IT systems etc.
  • The CISO shall be responsible for complying with guidelines issued by Cert-In from time to time.
51.6.(4) Roles and Responsibilities – CTO

4. Chief Technology Officer (CTO)

CTO was responsible for information security rated technology implementation of the organization.

Provision amended to introduce detailed roles and responsibilities of CTO and align implementation responsibilities with CISO oversight.

4. Chief Technology Officer (CTO)/ Head of IT Functions:

  • CTO shall enable and support implementation of the security related technology and processes within the organization in consultation or agreement with CISO.
  • CTO shall ensure that information technology and processes are in line with the IS standards defined by the CISO.
  • CTO shall ensure that all identified vulnerabilities through internal/external audits or Risk Assessment are remediated in a timely manner.
61.6.(5) Roles and Responsibilities – CITSO

5. Chief IT Security Officer (CITSO)

Requirement for designation of a CITSO with defined roles and responsibilities.

Provision amended to remove requirement of designated CITSO.

5. Chief IT Security Officer (CITSO)

The requirement of having a CITSO designation has been removed. However, organizations to ensure all functions envisaged to be done by the erstwhile CITSO are adequately discharged by the designated personnel.

71.6.(7) Roles and Responsibilities – CSO/Admin/ Head Administration7. Chief Security Officer (CSO)/ Admin/ Head AdministrationProvision amended to provide for detailed roles and responsibilities of Regulated Entities (REs) to adopt enhanced controls.

6. Chief Security Officer (CSO)/ Admin/ Head Administration

  • The roles and responsibilities prescribed in the guidelines are baseline governance controls, however, REs may adopt enhanced controls commensurate with their risk profile, size, and complexity.
81.6.(13) Roles and Responsibilities – Functional Head/Business Owner13. Functional Head/Business OwnerProvision amended to provide for additional responsibilities of Functional Head and Business Owner.

12. Functional Head/Business Owner

  • Ensure the implementation and adherence to cybersecurity policies, procedures, and guidelines by all team members.
  • Collaborate with the organization’s Chief Information Security Officer (CISO) to assess and address specific cybersecurity risks associated with the business unit/function.
  • Report and escalate cybersecurity incidents promptly to the designated incident response team.
91.6.(14) Roles and Responsibilities – ISRMC

14. Insurance Security Risk Management Committee (ISRMC)

The Committee shall provide relevant periodic assurances to the Control Management Committee (CMC).

Provisions amended to require reporting of cyber security audit non-conformities with closure timelines and to shift periodic assurance reporting from CMC to the Risk Management Committee (RMC).

13. Insurance Security Risk Management Committee (ISRMC)

  • The ISRMC shall report the status of non-conformities observed in the annual cyber security assurance audit report along with timelines for closure of gaps observed, to the RMC, which in turn will take to the Board serious non-conformities, if any, observed.
  • The Committee shall provide relevant periodic assurances to the Risk Management Committee (RMC) on a quarterly basis.
101.6.(14) Roles and Responsibilities – ITSCNo provision relating to constitution of an IT Steering Committee (ITSC)The Provision has been introduced requiring establishment of an IT Steering Committee with senior level representation from IT and business functions.

14. IT Steering Committee (ITSC)

  • The Organization shall establish a IT Steering Committee with representation at senior management level from IT and Business functions.
  • Assist the Board in developing the IT strategy for the Organization in alignment with business needs.
  • Ensure implementation of a robust IT architecture meeting statutory and regulatory compliance.
  • Ensuring all IT Related SLAs/SOWs are in alignment with regulatory requirements and periodic review of SLA monitoring process.
  • Ensure effective implementation and governance of business continuity and disaster recovery frameworks.
  • Monitor the effectiveness of controls established to protect policyholder data within IT systems.
  • On Aspects of IT Procurements or projects, software license subscriptions, Saas Service subscriptions, tools procurement etc. which have a bearing on Information Security, the Committee needs to obtain the inputs from CISO function to ensure IT and IT Security are aligned on such decisions.
  • Update RMC & CEO periodically on activities of ITSC.
  • The ITSC shall meet at least on a quarterly basis. The Chief Technological Officer shall be the convener of ITSC.
111.6.(15) Roles and Responsibilities – CMC15. Control Management Committee (CMC)The provision has been amended to provide for detailed roles and responsibilities of CMC.

15. Control Management Committee (CMC)

The requirement of Control Management Committee (CMC), a board level committee, is done away with, however, Organizations are required to ensure that all functions envisaged to be done by the erstwhile CMC are part of Risk Management Committee (RMC) terms of reference.

121.6.(16) Roles and Responsibilities – IEENo existing provisionThe provision has been introduced requiring introduction of IEE to be the part of RMC.

16. Responsibilities – Independent External Expert (IEE) shall be inserted.

Considering the importance of Cybersecurity in rapidly changing technological landscape, one or more Independent External Expert (IEE) having substantial IT and/or Cybersecurity expertise in managing or guiding IT/Cybersecurity related initiatives or projects, shall be a part of RMC.

131.9.(II) ExceptionsII. Exception grant and risk assessment methodologyIn this respect, structured timelines and a tiered approval mechanism based on duration of exceptions (up to 3 months, beyond 3 months, and beyond 1 year) have been introduced, along with requirements for periodic reassessment and documentation of associated risks.

Exceptions not exceeding three months shall be approved by the Chief Information Security Officer (CISO) of the organisation.

Exceptions exceeding three months shall be approved by the Risk Management Committee (RMC). Further, exceptions exceeding one year shall be approved by the Board of Directors of the organisation.

Also, it is required that any exception request exceeding 12 months must undergo a reassessment and re-approval process.

All exceptions granted should formally document risk associated with granting such exceptions.

141.10. ComplianceThe Insurance Intermediary shall submit the Annexure – III along with compliance thereto and the comments of the board to the Insurer/s annually.Additional compliance requirement introduced mandating Insurance Intermediary to submit Annexure -III along with compliance thereto and comments of the Board to the Insurer/s annually.

Clause (b) is inserted.

  • The Insurance Intermediary shall submit the Annexure – III along with compliance thereto and the comments of the Audit Committee / Risk Management Committee / Board of Directors / Principal Officer, as applicable, to the Insurer/s annually, within 30 days of completion of Audit by a Cert-In Empaneled Auditor or Audit firm as prescribed under Annexure IV of the guidelines.
  • Also, Regulated Entities must take appropriate technical and organizational measures to comply with the provisions of Digital Personal Data Protection Act (DPDP) and rules made thereunder.
152.0. Security Domain PoliciesNo such existing provisionDetailed description of Policies inserted.This section is a guidance document for Regulated Entities to frame their own policies, specifying appropriate and adequate security controls along with the applicable standards. The policies shall encompass each of the security domains provided and shall be a part of their approved Information and Cyber Security Policy.

The changes introduced in the Auditors Report under Annexure -III of the Guidelines, 2026 are as follows:

Sl. No.Control number and AreaChanges IntroducedRevised Control
132- Security Continuous Monitoring & Detection (DE.CM):New control introducedGroup companies’ infrastructure, networks, and databases are logically and/or physically segregated, and where a vendor provides services to group companies, IT personnel with cross-entity access are segregated, wherever possible.
296- Security Continuous Monitoring & Detection (DE.CM):Addition to existing controlsIs External Grey/White box Penetration Testing (PT) conducted for all internet facing information assets or systems at least once in 6 months by a CERT-In empanelled Auditor.
397- Security Continuous Monitoring & Detection (DE.CM):New control has been introducedWhether, in cases where PT is conducted in a test environment due to unavoidable circumstances, the organization ensures that the test environment’s version and configuration resemble the production environment for VAPT, and any deviations are placed before the ISRMC for approval?
4110- Asset Management (ID.AM)New control has been introducedDoes the organization maintain an up-to-date inventory of its cryptographic assets to ensure preparedness for transition to post quantum cryptographic environments?
5148 – Supply Chain Risk Management (ID.SC)New control has been introduced.Whether the Regulated Entity, through SLAs, requires service providers/outsourced entities to obtain prior written permission before any further outsourcing.
6149 – Supply Chain Risk Management (ID.SC)New control has been introduced.Is the Cloud Service Provider (CSP) MeitY empaneled CSP and holds a valid STQC (or any other equivalent agency appointed by Government of India) audit status?
7150 – Supply Chain Risk Management (ID.SC)New control has been introduced.Has the organization signed NDA with CSP covering all aspects relating to privacy, confidentiality, security and business continuity?
8151 – Supply Chain Risk Management (ID.SC)New control has been introduced.Does the organization contractually require that the cloud service provider will completely eliminate any trace of data/information in disks, backups, etc., at the termination of the contract?
9204 – Information Protection Processes and Procedures (PR.IP)New control has been introduced as to whether appropriate hardware backup available?Is appropriate immutable backup and Failover/Resilient components available for critical hardware?

The Circular also released the brief summary of major changes introduced under Annexure A, and IRDAI Information and Cyber Security Guidelines, 2026 under Annexure B.

A copy of the Circular, Annexure A and Annexure B has been attached herewith for your ready reference.

Source category: IRDAI

Attachments

Comments are closed