Updated for the 2026 guidelines. On 6 April 2026 IRDAI issued its Information and Cyber Security Guidelines, 2026 (version 2.0), replacing the guidelines of 24 April 2023. Compliance is required from the current financial year, FY 2026-27. For insurers the core obligation is unchanged: an independent assurance audit every year. Almost everything around that audit is tighter. The auditor must be CERT-In empanelled or meet IRDAI's Annexure IV criteria, and must be rotated every three years. VA and grey/white-box penetration tests are due every six months, the ISRMC must meet quarterly, and the CISO must now be independent of IT. This checklist covers what an insurer should have in place before the auditor arrives.
Who the 2026 guidelines apply to
All insurers (life, general, health and reinsurers), foreign reinsurance branches, and every insurance intermediary regulated by IRDAI: brokers, corporate agents, web aggregators, TPAs, insurance marketing firms and others. Individual agents, micro-insurance agents, Point of Sale Persons and individual surveyors are outside direct scope. The insurer must still hold them to a minimum security baseline under its Board-approved policy.
The guidelines also make each insurer answerable for the intermediaries it engages. If you are an intermediary, read our IRDAI compliance guide for intermediaries. Web aggregators have their own 2026 audit guide.
What changed from 2023 to 2026
| Area | 2026 requirement |
|---|---|
| ISRMC | The Information Security Risk Management Committee meets at least quarterly, with a quorum of the CISO and at least two members |
| CISO | Reports to the head of risk management (or the CEO), not to the Head of IT, and carries no business targets |
| Risk Management Committee | Must include one or more Independent External Experts with substantial IT or cyber security expertise |
| Board | Approves the policy and the CISO appointment, gets quarterly security updates, funds security in proportion to risk appetite, and makes sure audit gaps close within 12 months |
| Auditor | CERT-In empanelled, or an audit firm meeting Annexure IV. Rotated every three years |
| Report to IRDAI | Annexure III report signed by the auditor, with the Board's comments, within 90 days of financial year-end or 30 days of the audit closing, whichever is earlier |
| VAPT | VA of all internet-facing assets every 6 months, plus external grey/white-box PT every 6 months. Critical internal applications at least yearly. All by CERT-In empanelled auditors |
| Change testing | Every change to an internet-facing system is security-tested before production. APIs and web services get a security audit, VAPT and secure code review before go-live |
| Incidents | Reported to CERT-In within 6 hours, with a copy to IRDAI |
| Logs | ICT logs kept for a rolling 180 days within India |
| Cloud | Only MeitY-empanelled providers whose data centres hold valid STQC (or equivalent) audit status |
| Outsourcing | SLAs must stop vendors sub-outsourcing without the insurer's prior written permission |
| Privacy | Technical and organisational measures to comply with the DPDP Act and its rules |
The 2026 pre-audit checklist for insurers
1. Governance that matches the new structure
Check that the CISO's reporting line no longer runs through the Head of IT and that the role carries no business targets. Check that the ISRMC's quarterly minutes show real decisions and that the RMC includes an Independent External Expert. Auditors will read the minutes, not the org chart.
2. An auditor you are allowed to use
Confirm the audit firm is CERT-In empanelled or meets the Annexure IV criteria. If the same firm has audited you for three years, rotate now. The guidelines also expect a real assurance audit — interviews, document checks and control testing — not a restated VAPT report.
3. A six-monthly testing cycle
List every internet-facing asset: portals, policy servicing apps, APIs to intermediaries, payment and KYC integrations. Put them on a six-monthly VA and grey/white-box PT calendar. Add security testing to the release process so that changes are tested before production, not at the next cycle.
4. Oversight of your intermediaries and vendors
Your Board-approved policy must cover how you make sure intermediaries comply during their engagement. That includes collecting each intermediary's Annexure III audit report within 30 days of their audit, and using the Part C risk rating to decide whether to continue the relationship. Vendor SLAs need the sub-outsourcing clause, and cloud contracts need MeitY/STQC status and data deletion on exit.
5. Logs, incidents and data protection
Keep 180 days of ICT logs inside India, and have a tested runbook that reaches CERT-In within six hours. Map policyholder data flows against the DPDP Rules 2025, whose core obligations apply from 14 May 2027. The IRDAI audit and DPDP readiness share most of their evidence, so run them together.
What the audit report must contain
The report follows Annexure III: an audit summary, overall findings, non-compliances, a risk rating and the control checklist. It goes to IRDAI with the Board's comments. Gaps must close within 12 months, and any exception lasting longer needs fresh approval. Praxis-Q's IRDAI Cyber Security Audit is delivered by a CERT-In empanelled team in the Annexure III format, together with the six-monthly VAPT cycle. Pricing is scoped per engagement. Request a proposal.
Frequently asked questions
Do the 2026 IRDAI guidelines replace the 2023 guidelines?
Yes. The circular of 6 April 2026 replaces the guidelines of 24 April 2023, and compliance is required from the current financial year.
Which auditors can perform the IRDAI cyber security audit?
A CERT-In empanelled auditor, or an audit firm that meets the eligibility criteria in Annexure IV. The independent assurance auditor must be rotated every three years.
When must insurers file the audit report with IRDAI?
Within 90 days of the end of the financial year, or within 30 days of the audit closing, whichever is earlier. The report must be signed by the auditor and carry the Board's comments.
How often is penetration testing required?
Every six months for internet-facing systems (VA plus external grey- or white-box PT), and at least once a year for critical internal applications, all by CERT-In empanelled auditors.
Can this audit double up for DPDP Act compliance?
Partly. The 2026 guidelines require DPDP compliance measures, and data mapping, consent, retention and breach handling overlap heavily. Running both assessments together avoids duplicate evidence-gathering.
Sources
- IRDAI, Information and Cyber Security Guidelines, 2026 (circular dated 6 April 2026), irdai.gov.in
- CERT-In Directions under Section 70B(6) of the IT Act (28 April 2022), cert-in.org.in
- Digital Personal Data Protection Rules, 2025, PIB
How this article was made: drafted with AI assistance from Praxis-Q's audit checklists and engagement experience, then fact-checked and edited by our consultants before publishing. Corrections: hello@praxis-q.com.
Free Consultation
Ready to Get Compliant?
ISO 27001, PCI DSS, HIPAA, SOC 2 & more — fast-track in a few weeks.
Tags
Share this article
Praxis-Q Team
Compliance & Security Expert
Praxis-Q’s compliance and offensive-security practitioners deliver ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR and DPDP engagements for banks, payment gateways and regulated fintechs.