IRDAI Information and Cyber Security Guidelines: Who They Cover and What They Require

What are the IRDAI Information and Cyber Security Guidelines?

They are the guidelines of the Insurance Regulatory and Development Authority of India (IRDAI) on how regulated insurance entities govern and protect information and cyber assets. Two documents matter:

• 2023 guidelines. Circular IRDAI/GA&HR/GDL/MISC/88/04/2023, 24 April 2023 (version 1.0). The circular says earlier circulars dated 7 April 2017, 29 December 2020, 2 September 2022 and 11 October 2022 "are superseded by these guidelines".
• 2026 guidelines. Circular IRDAI/GA&HR/CIR/MISC/51/4/2026, 6 April 2026 (version 2.0). The circular says the "revised Guidelines are hereby issued" in view of the "evolving threat landscape, feedback received from the Industry & recommendations of various IRDAI committees".

Who must follow the IRDAI guidelines, and from when?

The 2026 circular is addressed to "All Insurers, Insurance Intermediaries and IIB". Its paragraph 5 names insurers including foreign reinsurance branches (FRBs), brokers, corporate agents, web aggregators, TPAs, IMFs, insurance repositories, ISNPs, corporate surveyors, MISPs, CSCs and the IIB. It says they "shall strictly adhere to the said guidelines and ensure compliance from the current financial year".

Section 1.4 carves out insurance agents, micro-insurance agents, point of sale persons and individual surveyors, but makes insurers responsible for ensuring those entities follow a minimum security framework. FRBs may meet governance duties through regional, controlling or head office committees, and "comply or explain" on the guidelines and checklist controls.

What changed between the 2023 and 2026 guidelines?

Annexure A to the 2026 circular sets "existing" text beside "revised" text. The changes include:

• Committees. The Information Security Risk Management Committee meets at least quarterly, not twice a year. A new IT Steering Committee, convened by the chief technology officer, also meets quarterly. Independent External Experts join the Risk Management Committee.
• Board duties. Boards provide sufficient security budget, receive the status of audit non-conformities, and approve timelines so gaps are closed within 12 months of reporting.
• CISO. The CISO shall not report directly to the Head of IT and shall not be given business targets.
• Roles removed. The Chief IT Security Officer role and the board-level Control Management Committee, with their functions moved to the CISO, CTO and Risk Management Committee.
• Audit checklist. New or changed items include external grey or white box penetration testing at least once in six months by a CERT-In empanelled auditor, a cryptographic asset inventory for post-quantum readiness, and cloud provider controls.
• Data protection. Entities "must take appropriate technical and organizational measures" to comply with the Digital Personal Data Protection Act and its rules. See our DPDP Act page.

Do the 2026 guidelines replace the 2023 guidelines?

The 2026 circular does not say so in those words. It says the "revised Guidelines are hereby issued", and Annexure A is titled "Amendments to IRDAI Cybersecurity Guidelines, 2023 and Security Controls". None of the circular, Annexure A or the 2026 guidelines uses the word "supersede" or "repeal".

IRDAI's guidelines listing, opened on 24 October 2026, shows both the 2026 circular and the 2023 guidelines as "Non-Archived". Which text applies to your organisation is a question for IRDAI or your legal adviser. This is general information, not legal advice.

What do the guidelines require of boards, CISOs and committees?

The board approves the Information and Cyber Security Policy, receives quarterly inputs on information security and approves the CISO's appointment. The CISO must be a senior official with a technical background. The CISO should report directly to the top executive overseeing risk management (or, in that executive's absence, the CEO), shall be convener of the Information Security Risk Management Committee, shall be responsible for managing and monitoring the Security Operations Centre 24x7, and shall develop and implement scenario-based incident response plans.

Risk assessments are required at least annually and before major changes. Policy exceptions are approved by the CISO up to three months, by the Risk Management Committee beyond three months, and by the board beyond one year.

What do the guidelines say about audits and incident reporting?

An independent assurance audit is required every year, with reports going to the audit committee, risk management committee, board or principal officer. Insurers submit the signed audit report (Annexure III) with board comments to IRDAI within 90 days of the financial year end or within 30 days of completing the audit, whichever is earlier. Intermediaries submit it to their insurers within 30 days of an audit by a CERT-In empanelled auditor or firm meeting the Annexure IV criteria.

Policy 2.10 says entities shall "mandatorily report cyber incidents to Cert-In within 6 hours of noticing or being brought to notice", with a copy to IRDAI and other concerned regulators.

Can a GRC platform or advisory service help with requirements like these?

It can help a team organise policies, controls, risks and audit actions in one place, but the duties sit with the regulated entity, its board and its CISO. Neither a platform nor an adviser makes an organisation compliant.

Purplecop GRC's page describes "75+ frameworks mapped once and reused everywhere" and "One control library. Test a control once, satisfy every framework mapped to it." See Purplecop GRC. Purplecop Security's GRC & Compliance Advisory page describes a "Gap assessment against your target framework, with a prioritised remediation plan" and invites you to "Tell us the obligation you are trying to meet and who is asking for it."

These are general statements. Neither page lists the IRDAI guidelines by name, so confirm with Purplecop Security what it covers before relying on either.

What is the IRDAI Information and Cyber Security Guidelines, 2026?

It is IRDAI's revised set of guidelines (version 2.0) setting minimum standards and governance mechanisms for regulated insurance entities, issued under circular IRDAI/GA&HR/CIR/MISC/51/4/2026 dated 6 April 2026.

Who do the IRDAI cyber security guidelines apply to?

Insurers including foreign reinsurance branches, insurance intermediaries such as brokers, corporate agents and web aggregators, and the Insurance Information Bureau of India. Insurance agents, micro-insurance agents, point of sale persons and individual surveyors are outside their direct scope, but insurers must make sure they follow a minimum framework.

How quickly must a cyber incident be reported?

To CERT-In within 6 hours of noticing it or being notified, with a copy to IRDAI and other concerned regulators.

How often is the cyber security audit required?

Every year, as an independent assurance audit.

Do the guidelines mention the DPDP Act?

The 2026 guidelines do: section 1.10 requires appropriate technical and organisational measures to comply with the DPDP Act and its rules.

Can Purplecop make my organisation compliant with the IRDAI guidelines?

No product or service can do that on its own, because the guidelines place the duties on the regulated entity. Purplecop's product and service pages do not list the IRDAI guidelines by name.