IRDAI cybersecurity guidelines
the 2026 revision of the 2023 rules.

The IRDAI Information and Cyber Security Guidelines, 2026, issued by IRDAI circular on 6 April 2026. They replace the IRDAI Information and Cyber Security Guidelines, 2023 of 24 April 2023, and regulated entities are to comply from the current financial year. The 2023 structure largely survives; governance, audit and exceptions changed most.

The 2026 guidelines are published with an Annexure A listing every amendment to the 2023 guidelines and an Annexure B holding the revised 175-page text, its NIST CSF applicability matrix, the classification of intermediaries by gross insurance revenue, the auditor's report format and the eligibility criteria for audit firms. If your policy set was written against the 2023 version, the Annexure A table is the fastest route to a gap list.

All insurers, including foreign reinsurance branches, and every insurance intermediary IRDAI regulates. Individual agents, micro-insurance agents, point-of-sale persons and individual surveyors are outside the guidelines, but each insurer must make them follow a minimum security framework set by its own board-approved policy.

Two further points of scope. The guidelines cover all data the regulated entity creates, receives or maintains, wherever the records are and whatever form they take, so a spreadsheet at a TPA is in scope as much as the core policy system. And insurers are responsible for the intermediaries they engage: an intermediary submits its audit report and compliance to each insurer annually, and an intermediary that holds only paper records and does not access the insurer's systems gives a self-certification instead. Foreign reinsurance branches whose systems interface with an overseas parent must comply and have an auditor certify it at each year end, and under the 2026 revision may comply or explain against the checklist.

Within six hours. The guidelines require cyber incidents to be reported to CERT-In within six hours of noticing them or being told of them, with a copy to IRDAI and other regulators concerned, and IRDAI's March 2025 circular requires the report to IRDAI itself, in its prescribed format, within the same six hours.

The circular on Cyber Incident or Crisis Preparedness of 24 March 2025 added more than a deadline. Regulated entities must keep ICT logs for 180 days, synchronise clocks, maintain a Cyber Crisis Management Plan, empanel forensic auditors in advance so an investigation can start without procurement delay, and make sure the vendor running the SOC, attack-surface monitoring, red-teaming or the annual assurance audit is not the one engaged as forensic auditor. A compliance report goes to the board, and the minutes to IRDAI.

The guidelines also require ICT logs to be kept for a rolling 180 days within Indian jurisdiction, in line with CERT-In, and protected against tampering. If the incident is a personal data breach, the DPDP duties follow as well: tell the Data Protection Board and each affected person, with the detailed report to the Board within 72 hours. CERT-In and DPDP breach reporting compared sets out the overlap.

An independent assurance audit every year, by an auditor meeting IRDAI's eligibility criteria, rotated at least every three years. Insurers file the signed report with the board's comments to IRDAI within 90 days of the financial year end or 30 days of the audit's completion, whichever is earlier.

The audit follows the Annexure III format: summary, findings, non-compliances, a risk rating and a checklist mapped to the NIST Cybersecurity Framework functions set out in Annexure I. Insurers use the intermediary's risk rating, under their own board policy, to decide whether to start or continue business with it. Because the board now owns closure within twelve months, a finding that rolls from one annual audit into the next is a governance failure, not only a technical one.

Contractual control. Insurers must keep exclusive ownership of their data at a cloud provider, including backups; bar the provider from using it for advertising or any secondary purpose; and require notification of a confirmed breach without delay and of a suspected breach within four hours of its discovery.

Beyond cloud, the guidelines expect a right to audit in vendor contracts and security requirements flowed down to every third party that touches insurer data, including the intermediaries covered above. For a SaaS vendor selling to insurers, the four-hour suspected-breach clause is the one to check against your own incident process before you sign. The SaaS sector page covers what regulated customers flow down.

The guidelines secure the systems; the DPDP Act governs what an insurer may do with a proposer's or policyholder's personal data. The 2026 revision now requires compliance with the Act explicitly, but the Act's duties of notice, consent, purpose limitation and erasure are not satisfied by a security audit.

The place insurers most often come unstuck is data about people who never became customers: health and financial information collected during underwriting for proposals that were declined or lapsed. The insurance sector page works through that, and the DPDP Act and Rules guide sets out the timetable, with substantive duties from 13 May 2027.

TryTrustable is not an IRDAI-eligible audit firm and does not ship the IRDAI checklist as a built-in framework. It maps controls across ISO 27001, SOC 2 and CERT-In, supports custom framework authoring for a regulator's list, and keeps a hash-chained evidence ledger. The consent platform handles the DPDP side: versioned notices, the consent record, rights requests and the breach clock.