IRDAI Information Security Framework
The Insurance Regulatory and Development Authority of India (IRDAI) mandates comprehensive cybersecurity controls for insurance companies operating in India. These guidelines focus on protecting policyholder data, ensuring business continuity, and establishing governance frameworks.
Key Requirements
Governance
- Board-approved information security policy
- Chief Information Security Officer (CISO) appointment
- Information Security Committee with quarterly reviews
- Annual information security audit
Technical Controls
- Network segmentation between customer-facing and internal systems
- Multi-factor authentication for administrative access
- Endpoint Detection and Response (EDR) on all endpoints
- Data Loss Prevention (DLP) for policyholder data
- Web Application Firewall (WAF) for online portals
VAPT Requirements
- Quarterly vulnerability assessments
- Annual penetration testing by CERT-In empaneled auditors
- Remediation of critical vulnerabilities within 30 days
- Re-testing after remediation
Incident Management
- Incident response plan with defined roles
- Report significant incidents to IRDAI within 48 hours
- Report to CERT-In per their guidelines
- Annual incident response drill
Data Protection
- Encryption of policyholder PII at rest and in transit
- Database Activity Monitoring for policyholder databases
- Secure backup with tested recovery procedures
- Data retention per IRDAI regulations
SuperClue IRDAI Module
SuperClue's IRDAI framework scan runs 10 checks covering governance, data protection, access control, incident response, and more. It checks your external website and asks for evidence for the rest.