Insurance cybersecurity & IRDAI compliance

Applicable regulations

• IRDAI Information & Cyber Security Guidelines
• IRDAI ISNP (Insurance Self-Network Platform) requirements
• DPDP Act 2023 (incl. health data)
• PCI DSS for premium/card payments

Common cyber risks

• Large volumes of sensitive policyholder & health data
• Broker/aggregator and TPA third-party exposure
• Legacy policy-admin systems and weak segmentation
• Fraud across digital onboarding and claims

Audit findings we typically see

• Incomplete data inventory for PII/health data
• ISNP security controls not evidenced
• Access and log-monitoring gaps in policy/claims systems
• Vendor/TPA security oversight weak

Services required

• IRDAI cyber-security audit
• ISNP cyber-security audit
• VAPT
• DPDP privacy programme

Our engagement approach

• Data & scope discovery. Inventory policyholder/health data, ISNP and TPA flows.
• Assessment. Test against IRDAI guidelines and ISNP requirements.
• Remediation. Control design, privacy workflows and evidence templates.
• Assurance. IRDAI-aligned audit report and management pack.

Expected evidence

• PII/health data inventory
• ISNP control evidence
• VAPT reports with closure
• TPA/vendor risk register

Deliverables

• IRDAI-mapped gap assessment
• ISNP audit evidence
• VAPT reports
• DPDP data inventory & DSR workflow