IRDAI Cyber Security Guidelines 2026: What Insurers & Intermediaries Need to Know

Cybersecurity is no longer just an IT responsibility. Under IRDAI’s 2026 Information & Cyber Security Guidelines, it is a governance, risk, compliance and business-continuity responsibility.

The IRDAI Information & Cyber Security Guidelines Version 2.0 (April 2026) apply to insurers, Foreign Re-Insurance Branches and IRDAI-regulated insurance intermediaries. The framework is designed to protect critical information assets and customer data while strengthening organisations' ability to prevent, detect, respond to and recover from cyber threats.

What does the 2026 framework emphasise?

1. Cybersecurity starts with governance

The guidelines require a structured Information & Cyber Security Policy and governance framework. An Information Security Risk Management Committee (ISRMC), including the CRO, CISO and relevant business/functional heads, is expected to oversee the policy, with meetings at least quarterly. The policy itself is to be reviewed annually and updated when regulatory, technology, business or threat conditions change.  

2. The CISO has a central role

The CISO is responsible for governance and monitoring of information security, including security assessments, vulnerability and penetration testing baselines, incident reporting, cyber exercises, security training and oversight of security solutions.  

3. Security must cover the entire information lifecycle

The framework goes beyond protecting servers and networks. Information assets include data, logs, systems, network equipment, storage media and other information resources, with protection expected throughout their lifecycle—from creation and transmission to storage and disposal. Strong authentication, authorization, audit trails, confidentiality, integrity and availability are key principles.  

4. Continuous monitoring and testing matter

The audit checklist covers a broad range of controls, including security-log monitoring, secure coding, asset inventories, penetration testing, encryption, centralized logging, network security, vulnerability management and incident-response capabilities.  

For example, the checklist calls for regular internal and external penetration testing; for Category 1 intermediaries, the stated frequency is at least half-yearly, compared with annual testing for Categories 2 and 3.

5. Third-party risk cannot be overlooked

Vendors and service providers handling organisational information assets are also part of the security equation. The guidelines call for information-security requirements in contracts and SLAs, including appropriate audit rights and controls around outsourcing and further outsourcing.

What about insurance intermediaries?

The 2026 framework classifies insurance intermediaries according to gross insurance revenue:

• Category 1: ₹50 crore and above — including intermediaries using ISNP and Web Aggregators

• Category 2: ₹5 crore to below ₹50 crore

• Category 3: below ₹5 crore

Annual independent assurance is a key requirement

The guidelines require an independent assurance audit every year. For insurance intermediaries, the relevant audit report and applicable compliance/comments are to be submitted to the insurer annually, within 30 days of completion of the audit by an audit firm meeting the prescribed criteria in Annexure IV.

The audit framework itself is extensive: Annexure III structures findings across areas such as governance, asset management, access control, data security, incident response, network security, business continuity, third-party risk, cloud security, cyber resilience and more.

The bigger message

IRDAI's 2026 framework signals a shift from “having cybersecurity controls” to demonstrating that those controls are governed, tested, monitored and independently assured.

For insurers and intermediaries, the practical priorities are therefore clear:

Govern → Identify → Protect → Detect → Respond → Recover → Assure.

And cybersecurity should be treated as an ongoing business discipline not an annual audit exercise.

For insurance organisations, the question is no longer whether cybersecurity is required. The question is whether your controls can withstand scrutiny when they are tested.