Insurance and capital markets — IRDAI and SEBI compliance

Applicable regulations

• IRDAI Information and Cyber Security Guidelines
• IRDAI ISNP (Insurance Self-Network Platform) requirements
• SEBI CSCRF for capital-markets intermediaries
• DPDP Act 2023, including health data
• PCI DSS for premium and card payments

Common cybersecurity risks

• Large volumes of sensitive policyholder and health data
• Broker, aggregator and TPA third-party exposure
• Legacy policy-admin systems with weak segmentation
• Fraud across digital onboarding and claims

Audit findings we typically see

• Incomplete data inventory for PII and health data
• ISNP security controls not evidenced
• Access and log-monitoring gaps in policy and claims systems
• Weak security oversight of vendors and TPAs

Services required

• IRDAI cybersecurity audit
• ISNP cybersecurity audit
• SEBI cybersecurity and CSCRF audit
• VAPT
• DPDP privacy programme

Our engagement approach

• Data and scope discovery. Inventory policyholder and health data, ISNP and TPA flows.
• Assessment. Test against IRDAI guidelines and ISNP requirements.
• Remediation. Control design, privacy workflows and evidence templates.
• Assurance. An IRDAI-aligned audit report and management pack.

Expected evidence

• PII and health-data inventory
• ISNP control evidence
• VAPT reports with closure
• TPA and vendor risk register

Deliverables

• IRDAI-mapped gap assessment
• ISNP audit evidence
• VAPT reports
• DPDP data inventory and DSR workflow