IRDAI Information and Cyber Security Guidelines, 2026
Minimum information and cyber security governance and control standards for insurers, insurance intermediaries and the Insurance Information Bureau of India.
- Applies in
- India
- Edition
- Ver 2.0, April 2026; replaces the April 2023 guidelines
- Area
- Operational resilience & ICT
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- 1.5Constitute an ISRMC to approve and review the information and cyber security policyGovernance
- 1.6Appoint a CISO responsible for policy, SOC oversight, risk assessment and CERT-In complianceGovernance
- 1.10Annual independent assurance audit, filed with IRDAI within 90 days of year endAssurance
- 2.10Report cyber incidents to CERT-In within 6 hours with a copy to IRDAIReporting
- 2.13Maintain business continuity and disaster recovery arrangementsResilience
- 2.14Manage the security risk of third-party service providersThird parties
- 2.16Keep ICT logs for a rolling 180 days within Indian jurisdictionLogging
- 2.19Apply cloud security policy controlsCloud
How Amoreg keeps you on it.
Enable the IRDAI Information and Cyber Security Guidelines, 2026 and the Monitor suggests IRDAI as a source. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 8 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read irdai.gov.in/guidelines
- Check the library against 8 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: constitute an ISRMC to approve and review the information and cyber security policy
- Rule
- IRDAI Information and Cyber Security Guidelines, 2026, 1.5
- Area
- Governance
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- DORA — Digital Operational Resilience ActICT risk management, incident reporting, resilience testing and third-party risk for financial entities.European Union · 8 controls
- NIS2 DirectiveCybersecurity risk-management measures and incident reporting for essential and important entities.European Union · 4 controls
- UK Operational Resilience (FCA SYSC 15A / PRA SS1/21)Important business services, impact tolerances, mapping and scenario testing.United Kingdom · 5 controls
- UK Outsourcing & Third-Party Risk (SYSC 8 / PRA SS2/21)Requirements for outsourcing and third-party arrangements, including critical third parties.United Kingdom · 5 controls
- CSSF Circular 20/750 — ICT and security risk managementEBA ICT and security risk guidelines applied to Luxembourg entities outside DORA's scope.Luxembourg · 5 controls
- CSSF Circular 22/806 — Outsourcing arrangementsThe single outsourcing framework, now applying to DORA entities for business process outsourcing only.Luxembourg · 5 controls
Also in India
- SEBI (Intermediaries) Regulations, 2008SEBI regulations for all registered intermediaries, covering registration, fit-and-proper criteria, general conduct, inspection and enforcement.India · 8 controls
- SEBI (Prohibition of Insider Trading) Regulations, 2015SEBI regulations preventing insider trading and controlling unpublished price sensitive information (UPSI) at listed companies, intermediaries and fiduciaries.India · 8 controls
- SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015SEBI regulations for the continuing disclosure and corporate governance obligations of listed entities, read with the LODR master circular.India · 8 controls
- SEBI (Investment Advisers) Regulations, 2013SEBI regulations for the registration, qualifications and client-facing conduct of investment advisers, read with the IA master circular.India · 8 controls
- SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)SEBI framework setting cybersecurity and cyber resilience requirements for SEBI-regulated entities, graded by entity category.India · 8 controls
- RBI (Commercial Banks – Know Your Customer) Directions, 2025RBI's binding KYC/AML/CFT direction for commercial banks under the PML Act and Rules, replacing the repealed 2016 KYC Master Direction.India · 8 controls
Questions
Does Amoreg watch for changes to the IRDAI Information and Cyber Security Guidelines, 2026?
Yes. Enable it and the Monitor suggests Insurance Regulatory and Development Authority of India as a source; every publication it records keeps its source, stage and date.
Can Amoreg check our policies against the IRDAI Information and Cyber Security Guidelines, 2026?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records Ver 2.0, April 2026; replaces the April 2023 guidelines. Editions were last verified in August 2026, and the Monitor records new publications as they appear.