5.1 Insurance Sector Requirements
IRDAI has issued comprehensive guidelines on Information and Cyber Security applicable to all registered insurers including life, general, health, and reinsurance companies.
Applicable Entities
- Life Insurance Companies: All life insurers registered with IRDAI
- General Insurance Companies: Motor, property, liability insurers
- Health Insurance Companies: Standalone health insurers
- Reinsurance Companies: Reinsurers operating in India
- Insurance Intermediaries: Brokers, TPAs, surveyors (proportionate requirements)
Key IRDAI Circulars
| Circular | Focus Area | Key Requirements |
|---|---|---|
| Information and Cyber Security Guidelines 2017 | Core security framework | IS Policy, CISO appointment, security controls |
| Outsourcing Guidelines 2017 | Third-party risk | Due diligence, contracts, oversight |
| Cloud Computing Guidelines 2020 | Cloud adoption | Data localization, security requirements |
| Master Circular on E-Insurance 2023 | Digital insurance | Electronic policy, authentication |
Data Classification
Insurers handle highly sensitive data including: health records (medical underwriting, claims), financial information (income, assets), personal identifiers (Aadhaar, PAN), beneficiary details. Protection of policyholder data is a regulatory priority.
- Critical: Core insurance systems, policy databases, claims records
- Sensitive: Medical records, financial data, underwriting information
- Internal: Employee data, operational procedures
- Public: Product information, marketing materials
5.2 IT Governance
IRDAI mandates robust IT governance structures within insurance companies to ensure alignment of IT strategy with business objectives and effective risk management.
Board-Level Oversight
Key Appointments
| Role | Requirement | Responsibility |
|---|---|---|
| Chief Information Officer (CIO) | Mandatory for large insurers | IT strategy, operations, digital transformation |
| Chief Information Security Officer (CISO) | Mandatory for all insurers | Information security, incident response, compliance |
| Data Protection Officer (DPO) | As per DPDPA requirements | DPDPA compliance, data subject rights |
| Chief Risk Officer (CRO) | Mandatory | Enterprise risk including cyber risk oversight |
Policies and Procedures
Insurers must maintain documented policies covering:
- Information Security Policy: Board-approved, annual review
- Acceptable Use Policy: Employee responsibilities, prohibited activities
- Access Control Policy: User management, privileged access
- Incident Management Policy: Detection, response, escalation
- Business Continuity Policy: BCP and DR procedures
- Outsourcing Policy: Third-party risk management
Security Controls
- Network Security: Firewalls, segmentation, intrusion detection
- Endpoint Security: Anti-malware, host-based controls, encryption
- Application Security: Secure coding, testing, change management
- Data Security: Encryption, masking, DLP for sensitive data
- Identity Management: SSO, MFA for critical systems, access reviews
IRDAI expects insurers to adopt industry frameworks like ISO 27001. Many insurers pursue ISO 27001 certification to demonstrate compliance and may reference it in regulatory submissions.
5.3 BCP/DR Requirements
Business Continuity Planning and Disaster Recovery are critical for insurance operations. IRDAI mandates comprehensive BCP/DR capabilities to ensure policyholder protection and claims processing continuity.
Business Continuity Management
Critical Insurance Functions
- Claims Processing: Must continue even during disasters - policyholder protection priority
- Policy Issuance: New business continuation with defined RTO
- Premium Collection: Payment gateway and reconciliation systems
- Customer Service: Call center and grievance handling
- Regulatory Reporting: IRDAI submission capabilities
DR Site Requirements
| Aspect | Requirement |
|---|---|
| Location | Geographically separated, different seismic zone preferred |
| Capability | Must handle full production load |
| Data Sync | Real-time or near-real-time replication for critical data |
| Testing | Annual DR drill mandatory with documented results |
| Switchover | Defined procedures and trained personnel |
Testing Requirements
IRDAI requires annual DR drills with actual switchover to DR site. Results must be documented, gaps identified, and remediation tracked. Board must be apprised of DR drill outcomes.
- Annual Full DR Drill: Complete switchover to DR site
- Half-Yearly Table-Top: Scenario-based discussions
- Component Testing: Individual system recovery testing
- Documentation: Test plans, results, gaps, remediation
5.4 Outsourcing Guidelines
Insurers extensively outsource IT and business processes. IRDAI has specific guidelines governing outsourcing to manage associated risks while enabling operational efficiency.
Categories of Outsourcing
- Core Insurance Activities: Claims processing, underwriting support (limited outsourcing)
- IT Infrastructure: Data center, network, cloud services
- Application Services: Core system vendors, policy admin
- Business Processes: TPA services, call centers, back-office
Due Diligence Requirements
- Financial Assessment: Vendor financial stability and viability
- Technical Capability: Skills, experience, certifications
- Security Posture: Security controls, incident history, compliance
- Reference Checks: Existing client feedback, performance history
- Legal Review: Contract terms, liability, jurisdiction
Contractual Requirements
Outsourcing agreements must include: confidentiality provisions, data protection obligations, audit rights (including IRDAI access), SLAs with penalties, termination and transition assistance, sub-contracting restrictions.
Cloud Adoption
| Aspect | IRDAI Requirement |
|---|---|
| Data Location | Policyholder data must be stored in India |
| CSP Selection | Due diligence, security assessment, contractual protections |
| Encryption | Data encrypted at rest and transit, key management with insurer |
| Audit Access | CSP must allow IRDAI inspection/audit rights |
| Exit Strategy | Documented plan for CSP transition/exit |
Maintain a vendor register with risk ratings. Conduct periodic vendor assessments. Include cyber security requirements in all RFPs. Monitor vendor performance against SLAs. Have exit plans for critical vendors.
Key Takeaways
- IRDAI guidelines apply to all registered insurers and proportionately to intermediaries
- IT Strategy Committee at Board level is mandatory for oversight
- CISO appointment is required for all insurers
- Annual DR drills with actual switchover are mandatory
- Policyholder data must be stored in India for cloud deployments
- Outsourcing agreements must include IRDAI audit access rights
- Medical and financial data require enhanced protection measures
Part 5 Assessment Quiz
Test Your Knowledge
8 questions on IRDAI IT & Cyber Security requirements