IRDAI Information and Cyber Security Guidelines: Cyber Rules for Indian Insurers

Indian insurers and intermediaries must run their security programme to a sector rulebook from the Insurance Regulatory and Development Authority of India (IRDAI), and that rulebook was rewritten in April 2026. The IRDAI Information and Cyber Security Guidelines, 2026 (Version 2.0) replace the 2023 guidelines and change governance roles, audit filing and exception handling. This guide covers who is in scope, the obligations that matter most to security teams, the audit and reporting cycle, and how service accounts, APIs and AI agents fit. It is written for CISOs, risk officers, internal auditors and IT leaders at insurers, reinsurance branches, brokers, web aggregators and third-party administrators. The page is based on secondary sources, listed in the note below. Banks should read the RBI Cyber Security and IT Governance Guide instead, and securities market entities the SEBI CSCRF Guide.

Sources: IRDAI's own website could not be accessed, so this page is based on secondary sources: the guideline text republished by CAalley, the circular as reproduced by TaxGuru, a review by the law firm Cyril Amarchand Mangaldas, and MediaNama's summary. Each obligation names its source. Figures, deadlines and periods appear only where the CAalley copy and at least one independent source agree; others have been left out. Confirm against the official text before relying on it.

Key takeaways

• The 2026 guidelines are now the baseline. TaxGuru, MediaNama and Cyril Amarchand Mangaldas all report a circular dated 6 April 2026 replacing the 2023 guidelines (dated 24 April 2023 per TaxGuru and the CAalley copy), with compliance expected from the current financial year (TaxGuru, MediaNama).
• Scope is the whole regulated chain. Per the CAalley copy and MediaNama, insurers, foreign reinsurance branches (FRBs) and most intermediaries are covered; individual agents sit outside direct scope.
• The CISO is independent of IT. Cyril Amarchand Mangaldas and MediaNama both report that the CISO must not report directly to the Head of IT and must not carry business targets.
• Audit evidence goes to IRDAI every year. The CAalley copy and MediaNama both state that insurers file the audit report within 90 days of financial year end or 30 days of audit completion, whichever is earlier.
• Generic and shared IDs need an owner and an expiry. The access control policy in the CAalley copy expects unique IDs, logged privileged accounts and exceptions for group IDs, which brings service accounts and AI agents into scope.

Scope: who and what is covered

According to the CAalley copy, section 1.4 of the 2026 guidelines applies them to all insurers, including FRBs, and to insurance intermediaries regulated by IRDAI. The covering circular, as reproduced in that copy, lists brokers, corporate agents, web aggregators, third-party administrators (TPAs), insurance marketing firms, insurance repositories, insurance self-network platforms, corporate surveyors, micro-insurance agents and common service centres, plus the Insurance Information Bureau of India. Read the circular's own addressee list against your licence type, because the scope list on secondary sites is sometimes garbled.

The CAalley copy says the guidelines cover all data the entity creates, receives or maintains, in any form and location. That wording matters for cloud tenants, outsourced claims platforms and SaaS tools: data held by a provider is still in scope.

Key obligations

Governance and roles

• Board: ultimately responsible for information security and approves the policy, strategy and CISO appointment (CAalley copy). Cyril Amarchand Mangaldas and the CAalley copy both state that identified audit gaps must be remediated within 12 months of reporting.
• Information Security Risk Management Committee (ISRMC): governs the information and cyber security policy; MediaNama, Cyril Amarchand Mangaldas and the CAalley copy all state it meets at least quarterly.
• CISO: senior and technically qualified, with no direct reporting line to the Head of IT and no business targets (Cyril Amarchand Mangaldas, MediaNama). The CAalley copy lists duties including managing the SOC, reporting incidents to CERT-In and other regulators within stipulated timelines, setting VAPT baselines, running cyber drills and reviewing every security exception; Cyril Amarchand Mangaldas also notes the exception review duty.
• Risk Management Committee (RMC): per Cyril Amarchand Mangaldas, takes over the functions of the former management committee and must include one or more independent external experts.
• Removed role: Cyril Amarchand Mangaldas reports that the Chief IT Security Officer requirement is gone, with its functions moving to the CISO and/or CTO.
• IT Steering Committee: meets at least quarterly with the CTO as convener (Cyril Amarchand Mangaldas, CAalley copy), and per the CAalley copy keeps an IT architecture diagram and reviews third-party access.

Risk management and exceptions

The CAalley copy and MediaNama both state that a risk assessment is required at least annually; the CAalley copy adds triggers before new major technologies, outsourcing, offshoring or cloud use, and before granting external parties access to critical systems. Section 1.9, as summarised in the CAalley copy and MediaNama, sets a tiered exception regime:

Domain policies

Section 2 of the CAalley copy gives a set of domain policies to adapt into the entity's own approved policy, from data classification and access control to cloud security, cyber resilience, email security and remote work. Points practitioners most often need:

• Data classification: the CAalley copy lists Public, Internal Use Only, Restricted and Confidential labels; it and MediaNama both state labels are reviewed at least every two years.
• Asset management: the CAalley copy expects a CMDB-backed inventory, device authentication to the network and tagging of unsupported software.
• Access control: per the CAalley copy, one user ID per person; group and generic IDs avoided, or allowed only by exception with an accountable owner and an expiry date; privileged accounts limited, logged and never shared; vendor privileged access supervised; third-party IDs expire unless reviewed. The CAalley copy and MediaNama both state passwords change every 45 days and both require two-factor authentication for access from outside the organisation.
• Backups and maintenance: the CAalley copy expects restoration testing, encrypted backup media and hardening before production.
• Development and source code: the CAalley copy expects audit logs of access to source libraries and right-to-audit clauses for third-party developers.

Timeline and current status

As of 8 November 2026 the 2026 guidelines are the current text. The circular gives no separate transition schedule, so confirm any transition expectations with IRDAI or your compliance function, and check irdai.gov.in for later clarifications before each audit cycle.

Enforcement and penalties

The guidelines are issued by IRDAI as the sector regulator, and per the CAalley copy the CISO's duties include compliance with CERT-In directions, the Information Technology Act 2000, IRDAI rules, and the Digital Personal Data Protection Act and its rules. The guidelines themselves do not set out a penalty schedule; non-compliance is handled through IRDAI's supervisory powers under insurance law, and internal violations through the "punitive actions" section of the entity's own policy. In practice the pressure points are:

• Annual filing: a late, unsigned or Board-uncommented Annexure III report is visible to the regulator immediately.
• Open gaps: audit findings must close within 12 months of reporting on a Board-approved timeline, so repeat findings are easy to spot.
• Parallel regimes: incident reporting to CERT-In, and personal data breach duties under the India DPDP Act Guide, carry their own consequences.

The CAalley copy's section 1.10 also asks entities to follow CERT-In directions, including those on Safe and Trusted Internet, and to make security researchers aware of CERT-In's role as a CVE Numbering Authority and its responsible disclosure process. For CERT-In incident reporting timelines see the CERT-In Directions 2022 Guide.

What it means for AI agents and non-human identities

The access control policy was written around people, but its rules apply directly to the service accounts, API clients, bots and AI agents that run policy administration, claims, underwriting and customer portals. Our reading at NHI Mgmt Group:

• Generic IDs need an exception: a shared integration account or a bot login is a "group or generic ID" in 2.3 terms. Give each one an accountable owner, an expiry date and an exception record approved at the right tier (CISO up to 3 months, then a risk committee, then the Board beyond a year).
• Privileged non-human accounts are privileged accounts: database, backup and batch accounts with admin rights must be limited, logged and not shared. Vault their credentials and record sessions. See the Service Account Security Guide.
• Third-party and broker integrations expire: API credentials issued to TPAs, web aggregators and corporate agents are third-party IDs; tie their lifetime to the contract and the annual access review.
• Risk assessment before AI deployment: section 1.8 in the CAalley copy triggers an assessment before new major technologies and before granting external parties access to critical systems. An AI agent connected to policyholder data with tool access meets both triggers. Use the AI Agent Risk Assessment Template.
• Logging and the SOC: the SOC should receive authentication and API events from non-human identities, not only from human users, so misuse of an agent's token can be detected and reported to CERT-In in time.
• Password rotation: the 45-day password change rule is written for user passwords. For service credentials we recommend short-lived tokens or vault-managed rotation instead, documented in the policy as the equivalent control, rather than manual rotation that breaks integrations.

Compliance steps

1. Read the 2026 text against your 2023 programme. Use Annexure A (summary of major changes) from the official circular to build a delta register: removed roles, new RMC expert, exception tiers, filing deadlines.
2. Fix governance first. Confirm the CISO reporting line and absence of business targets, ISRMC membership, RMC terms of reference and the independent external expert, and Board calendar items for quarterly security inputs.
3. Classify and inventory. Apply the classification scheme, update the CMDB, and include non-human identities (service accounts, API keys, bot and agent identities) with owners. See the NHI Inventory Reconciliation guide.
4. Close access control gaps. Remove or except generic IDs, enforce two-factor authentication from non-organisation devices, put privileged accounts and vendor access under a PAM process, and set third-party ID expiry.
5. Prove the SOC and reporting path. Test that an incident detected at 02:00 reaches the CISO and CERT-In within the required window, including incidents at outsourced providers.
6. Run the exception register. Move every open deviation into the tiered regime with a Technology Risk Assessment and an expiry.
7. Prepare the audit. Engage an eligible auditor (CERT-In empanelled for intermediaries), complete the audit checklist, get Board comments and file within the earlier of the two deadlines.
8. Cascade to intermediaries. Insurers should collect intermediary Annexure III reports or self-certifications and set the minimum framework for individual agents in the Board-approved policy.

Measuring progress

• Percentage of Annexure III checklist items rated compliant, by domain.
• Audit findings open beyond the Board-approved closure date (target: zero past 12 months).
• Generic and non-human IDs with a named owner and expiry, as a share of all such IDs.
• Active exceptions by approval tier and age.
• Median time from incident detection to regulator notification in drills.
• Intermediaries with a current audit report or self-certification on file.

Framework mapping

Common failure patterns

• Running the 2023 programme unchanged: keeping a CITSO and a separate Cyber Security Management Committee after both were folded into other roles.
• CISO inside IT: a CISO reporting to the CTO, or carrying digital sales targets, fails the independence test on day one.
• Bots on shared logins: robotic process automation and AI tools running on a generic ID with no owner, expiry or exception record.
• Exceptions without end dates: deviations approved once and never reassessed after 12 months.
• Missing the earlier deadline: filing 90 days after year end when the audit completed months earlier and the 30-day clock had already run out.

Practitioner checklist

• Obtain the 6 April 2026 circular, Annexure A and Annexure B from irdai.gov.in and record the version in your policy.
• Confirm the CISO reports outside IT, has no business targets and owns the SOC.
• Reconstitute the ISRMC and RMC, including an independent external expert on the RMC.
• Apply the data classification scheme and a CMDB inventory that includes non-human identities.
• Remove or formally except every generic, shared and bot ID, with owner and expiry.
• Vault and log privileged service accounts and supervise vendor privileged access.
• Drill the CERT-In and regulator reporting path, including provider-originated incidents.
• Move all deviations into the CISO, RMC and Board exception tiers.
• Book an eligible auditor and diarise the earlier of the two Annexure III filing dates.
• Collect intermediary audit reports or self-certifications annually.

Standards and references

Source note: IRDAI's own website could not be accessed, so this page relies on the secondary sources below: the guideline text republished by CAalley, the circular reproduced by TaxGuru, and reviews by Cyril Amarchand Mangaldas and MediaNama. Confirm against the official text before relying on it.

• IRDAI: Information and Cyber Security Guidelines, Version 2.0, April 2026 (secondary copy republished by CAalley; confirm against the official text on irdai.gov.in)
• TaxGuru: IRDAI circular issuing the Information and Cyber Security Guidelines, 2026 (secondary copy)
• Cyril Amarchand Mangaldas: Amended cyber security guidelines for the insurance sector, key amendments (secondary source)
• MediaNama: IRDAI updates cyber security guidelines (secondary source)
• Data Security Council of India: Brief on IRDAI's Information and Cyber Security Guidelines, 2026
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev. 5, Security and Privacy Controls

Related NHI Mgmt Group resources: Insurance Sector Cybersecurity Programme Guide · Insurance Sector Identity Security Guide · Financial Services Cyber Regulation Map · Service Account Security Guide. This guide summarises the IRDAI Information and Cyber Security Guidelines, 2026 as at 8 November 2026 and is not legal advice.