IRDAI cybersecurity audit

Insurance Self-Network Platforms operate under IRDAI permission per the Guidelines on Insurance e-commerce (circular IRDA/INT/GDL/ECM/055/03/2017, 9 March 2017). The controls, systems, procedures and safeguards of the platform must be reviewed at least once a year, at the applicant's own cost, by an external Certified Information Systems Auditor (CISA), a Chartered Accountant holding DISA (ICAI), or a CERT-In empanelled expert, and the resulting report placed before the Board or its sub-committee.

The governing instrument is the Guidelines on Insurance e-commerce, IRDA/INT/GDL/ECM/055/03/2017 of 9 March 2017. That guidelines PDF is not retrievable in text form from the IRDAI portal, so the citation points to IRDAI's own follow-on circular, which states the reference number and date verbatim. The audit-clause wording is corroborated across multiple independent summaries; verify against the guidelines PDF before quoting it in a deliverable.

Annexure IV sets two alternative routes. Either a Chartered Accountant firm registered with ICAI (partnership or LLP) with at least five years of continuous practice and four partners, including one CISA/DISA holder, one ICAI Fellow, one with three years of cyber or information security audit experience in insurance companies, banks or mutual funds, and one with IT-environment and remote-audit experience — OR, in the guidelines’ own words, a “Cert-In empanelled external systems Auditor holding CISA / DISA certifications”. The auditor must not have been debarred or declared ineligible for corrupt or fraudulent practices by the Government of India, a State Government, IRDAI, SEBI, RBI, ICAI, CERT-In or SFIO.

Read from the guidelines document itself (VER 2.0, April 2026, 175 pages) rather than from secondary analyses. The covering circular reference number does not appear in the guidelines body and remains unconfirmed, so it is still not cited. CyberSigma qualifies under the second route as a CERT-In empanelled auditor, without needing to meet the four-partner CA-firm test.

Insurers must submit the Audit Report (Annexure III), signed by the auditor and accompanied by the comments of the Board, to IRDAI within 90 days from the end of the financial year OR within 30 days of completion of the audit, whichever is earlier. Foreign Reinsurance Branches whose IT systems interface with overseas parent companies must comply and have the auditor certify per Annexure VI, submitted at the end of every financial year.

Read from the guidelines document itself (VER 2.0, April 2026, 175 pages) rather than from secondary analyses. The covering circular reference number does not appear in the guidelines body and remains unconfirmed, so it is still not cited. The “whichever is earlier” limb is the one commonly missed: completing an audit early shortens the deadline rather than extending it.

Certification under these guidelines may not rest on management representation or on reliance upon the work of other auditors, because the auditor is appointed by regulated entities that must protect policyholder and public data. The auditor is required to perform the work through interviews, document verification, compliance checks and adequate testing of controls.

Read from the guidelines document itself (VER 2.0, April 2026, 175 pages) rather than from secondary analyses. The covering circular reference number does not appear in the guidelines body and remains unconfirmed, so it is still not cited.

IRDAI issued Version 2.0 of its Information and Cyber Security Guidelines in April 2026, replacing the Information and Cyber Security Guidelines, 2023 dated 24 April 2023. They apply to all Insurers including Foreign Re-Insurance Branches (FRBs) and Insurance Intermediaries regulated by IRDAI, and to all data created, received or maintained by Regulated Entities in any form. Insurance Agents, Micro-Insurance Agents, Point of Sale Persons and Individual Surveyors are expressly outside their purview, though Insurers remain responsible for ensuring those entities follow a minimum security framework under the Insurer’s Board-approved policy.

Read from the guidelines document itself (VER 2.0, April 2026, 175 pages) rather than from secondary analyses. The covering circular reference number does not appear in the guidelines body and remains unconfirmed, so it is still not cited. An earlier version of this entry listed brokers, corporate agents, web aggregators, TPAs, ISNPs and IIB as in-scope; that enumeration came from secondary summaries and is not how the guidelines define scope.

IRDAI issued the Information and Cyber Security Guidelines, 2023 on 24 April 2023 (ref IRDAI/GA&HR/GDL/MISC/88/04/2023), superseding the 2017 guidelines (IRDA/IT/GDL/MISC/082/04/2017) and three subsequent circulars. These were themselves superseded on 6 April 2026 by the IRDAI Information and Cybersecurity Guidelines, 2026 (Version 2.0) - the 2023 text is retained here as the previous baseline, not as the current requirement.