IRDAI Cyber Security Rules for Insurance Intermediaries: 2026 Guide

Updated for the 2026 guidelines. If you are a broker, corporate agent, TPA, web aggregator or insurance marketing firm, IRDAI's Information and Cyber Security Guidelines, 2026 apply to you directly. They were issued on 6 April 2026, replace the 2023 guidelines, and apply from FY 2026-27. You need an independent cyber security audit every year by a CERT-In empanelled auditor or an audit firm meeting Annexure IV. The report goes to every insurer you work with within 30 days of the audit closing, and each insurer uses its risk rating to decide whether to keep doing business with you.

Why the insurer, not IRDAI, is your enforcer

The 2026 guidelines make each insurer responsible for ensuring that the intermediaries it engages comply "during the currency of their engagement", under a Board-approved policy. You submit the Annexure III audit report, your compliance response and the comments of your Audit/Risk Committee, Board or Principal Officer to each insurer. Part C of that report carries a risk rating, and insurers use it to decide whether to enter into or continue business with you. So your audit report is a commercial document: a weak rating can cost you an insurer relationship long before IRDAI looks at you.

Who is in scope, and who is not

• In scope: insurance brokers, corporate agents, web aggregators, TPAs, insurance marketing firms and other IRDAI-regulated intermediaries.
• Outside direct scope: individual insurance agents, micro-insurance agents, Point of Sale Persons and individual surveyors. Their insurers must still hold them to a minimum baseline.
• Self-certification route: intermediaries that hold insurer data only on paper, with no electronic database of insurer data and no access to insurer systems, give the insurer an annual self-certification instead of an audit.
• Tiered by size: Annexure II classifies intermediaries by gross insurance revenue, and Annexure I sets which NIST functions and controls apply to each class. Check your band in the Annexure II table before scoping the audit.

The 2026 compliance guide: six things to get right

1. The right auditor, rotated

Use a CERT-In empanelled auditor or a firm that meets Annexure IV, and change the independent assurance auditor every three years.

2. VAPT every six months, not once a year

Every internet-facing asset — website, portal, APIs to insurers, mobile app — needs a vulnerability assessment and an external grey- or white-box penetration test every six months by a CERT-In empanelled auditor. Critical internal applications need VAPT at least once a year. Changes to internet-facing systems must be security-tested before production.

3. Logs that stay in India

Keep ICT logs for a rolling 180 days within India. Check your SaaS CRM, telephony and hosting providers, because a log store outside India is a finding.

4. Cloud and vendor contracts

Cloud services must come from MeitY-empanelled providers with valid STQC (or equivalent) audit status. Vendor SLAs must prevent sub-outsourcing without your prior written permission.

5. A six-hour incident runbook

Cyber incidents go to CERT-In within six hours of noticing them, with a copy to IRDAI. Write down who does it and how, and test it with a tabletop exercise.

6. DPDP alignment

The 2026 guidelines require DPDP compliance measures. The DPDP Rules 2025 core obligations — consent, security safeguards, breach notification and data principal rights — apply from 14 May 2027. Build one data map and one incident process that serve both. Our DPDP compliance service covers the privacy side.

What insurers will ask you for in FY 2026-27

Expect partner insurers to request the Annexure III audit report within 30 days of your audit, evidence of the six-monthly VAPT cycle, your incident runbook, and confirmation of where your logs and cloud workloads sit. Web aggregators face the heaviest version of this, because the whole business is internet-facing. See our IRDAI audit guide for insurance web aggregators.

How Praxis-Q helps

Praxis-Q is a CERT-In empanelled audit firm. Our IRDAI Cyber Security Audit is scoped for insurers and intermediaries alike, delivered in the Annexure III format insurers expect, with the six-monthly grey/white-box VAPT cycle alongside. Scope depends on your Annexure II band, the systems that handle policyholder data, and the vendors in your chain. Pricing is scoped per engagement. Request a proposal.

Frequently asked questions

Do small brokers need a formal IRDAI cyber security audit?

If you are an IRDAI-regulated intermediary holding or accessing insurer data electronically, yes. The applicable controls scale with your gross insurance revenue class under Annexure II. Intermediaries holding insurer data only on paper, with no access to insurer systems, give an annual self-certification instead.

Who receives an intermediary's audit report?

Each insurer the intermediary works with, within 30 days of the audit closing, together with the compliance response and the governing body's comments.

Can one audit cover all my insurer relationships?

The guidelines require one annual audit and submission of its report to your insurer(s), so a single current report is shared with each insurer you work with.

Which auditor can we use?

A CERT-In empanelled auditor or an audit firm meeting the Annexure IV eligibility criteria, rotated every three years.

Are individual agents and PoSPs covered?

Not directly. Individual agents, micro-insurance agents, PoSPs and individual surveyors are outside the guidelines' purview, but insurers must apply a minimum security framework to them.

Sources

• IRDAI, Information and Cyber Security Guidelines, 2026 (circular dated 6 April 2026), irdai.gov.in
• CERT-In Directions under Section 70B(6) of the IT Act (28 April 2022), cert-in.org.in
• Digital Personal Data Protection Rules, 2025, PIB