IRDAI vs CERT-In: Cybersecurity Compliance & Audit Guide

how to use this playbook

An insurer or intermediary in India answers to two cyber regimes at once: CERT-In sets the baseline for every organisation, and IRDAI adds governance, testing and audit duties for insurance. This playbook turns both into controls you can implement, evidence you can show an auditor, owners you can assign, and a breach notification path you can run under pressure.

	CERT-In	IRDAI
Full form	Indian Computer Emergency Response Team	Insurance Regulatory and Development Authority of India
What it is	National nodal agency for cyber incidents under MeitY (Ministry of Electronics and Information Technology), set up under section 70B of the IT Act, 2000	Statutory insurance regulator, set up under the IRDA Act, 1999
Main instrument	Directions of 28 April 2022 under section 70B(6), plus the Comprehensive Cyber Security Audit Policy Guidelines v1.0 of 25 July 2025	Information and Cyber Security Guidelines, revised 6 April 2026 (Ver. 2.0), replacing the 23 April 2023 version
Why it exists	Before 2022 incident reporting had no deadline, so CERT-In could not analyse incidents or coordinate response. The directions made reporting mandatory and time-bound	Insurers hold large volumes of personal and health data on connected systems. IRDAI sets minimum security and governance standards to protect policyholders
Where it applies	Every service provider, intermediary, data centre, body corporate and government organisation in India, in every sector	Insurers, foreign reinsurance branches, intermediaries (brokers, corporate agents, web aggregators, third-party administrators) and the Insurance Information Bureau

Side-by-side comparison

Area	CERT-In	IRDAI
Full form and role	Indian Computer Emergency Response Team. The national agency under the Ministry of Electronics and Information Technology (MeitY) that receives cyber incident reports, analyses threats, issues advisories and coordinates response across the country. It is not a sector regulator. It sets operational duties for everyone	Insurance Regulatory and Development Authority of India. The statutory regulator of the insurance sector. It licenses and supervises insurers and intermediaries and protects policyholders. Its cyber guidelines are one part of its supervision of how insurers run their business
Legal basis	Section 70B of the Information Technology Act, 2000. The Directions are issued under sub-section 70B(6), which lets CERT-In direct organisations on information security practice, prevention, response and reporting of cyber incidents. Failure to comply is an offence under the Act	The IRDA Act, 1999, through circulars that bind regulated entities. A circular dated 6 April 2026 issued the current Information and Cyber Security Guidelines. Breach of them is a supervisory matter that can lead to regulatory action
Main documents	Directions of 28 April 2022 (in force from late June 2022). Comprehensive Cyber Security Audit Policy Guidelines v1.0 of 25 July 2025 for how audits are run	Guidelines on Information and Cyber Security for Regulated Entities, Ver. 2.0, of 6 April 2026. They replace the 24 April 2023 version, which replaced earlier 2017 and 2022 advisories. Separate circulars add specific duties, for example the March 2025 circular on reporting and forensic auditors
Why the rules exist	Before April 2022 there was no deadline for reporting incidents, so CERT-In could not collect information quickly enough to analyse incidents and coordinate response. The Directions make reporting mandatory and time-bound	Insurers hold large volumes of personal and health data on connected systems. IRDAI wants that data and the services policyholders rely on protected, and wants security to be a board-level responsibility. The 2026 revision responds to a changing threat landscape, industry feedback and committee recommendations
Who must comply	Service providers, intermediaries, data centres, body corporates and government organisations operating in India, in every sector. There is no small-business exemption, so a startup and a bank have the same reporting duty	Insurers, foreign reinsurance branches, and intermediaries such as brokers, corporate agents, web aggregators and third-party administrators, plus the Insurance Information Bureau. Duties for intermediaries and foreign reinsurance branches are graded or comply-or-explain. Confirm your tier in the circular

2. Governance and accountability

Area	CERT-In	IRDAI
Board and management	– No board-level rule. The duty sits with the organisation as a whole	The Board approves the information and cyber security policy, allocates a security budget in proportion to the organisation’s risk, reviews non-conformities raised in audit reports, and must see that gaps are closed within 12 months. Security is a board matter, not only an IT matter
Named people	You must register a point of contact with CERT-In. This person receives alerts, coordinates the response and files reports. Keep the registration current when people change. Foreign entities serving India need an India point of contact	An independent CISO who does not report to the Head of IT and carries no business targets. The CISO briefs the Board and the ISRMC, sits on the IT Steering Committee, owns scenario-based incident response plans and ensures compliance with CERT-In guidelines. The CTO supports implementation. The separate CITSO role is removed
Committees	– None prescribed	The ISRMC (Information Security Risk Management Committee) meets at least quarterly. An IT Steering Committee aligns IT strategy with compliance and oversees SLAs, procurement, cloud decisions, business continuity and disaster recovery. The Risk Management Committee takes over from the Control Management Committee and includes independent external cybersecurity experts
Exceptions to policy	–	Any exception needs documented risk and periodic reassessment. Approval depends on duration: up to 3 months the CISO, 3 to 12 months the risk committee, beyond 12 months the Board. Beyond 12 months it must be reassessed and re-approved
Risk assessment	–	Done at least yearly, and again before a major technology change, a new outsourcing arrangement or external access to critical systems. Treat it as a gate in change management and procurement

3. Incident reporting and response

Area	CERT-In	IRDAI
Deadline	6 hours from the moment you notice an incident or are told about it, not from when it started. This applies to incidents in 20 notified categories such as ransomware, data breach, unauthorised access, phishing and DDoS. If facts are incomplete, file an initial good-faith report and send updates as the investigation progresses	Incidents go to IRDAI in its prescribed format, and the report must be updated as forensic findings arrive. Recent circulars describe a 6-hour window, with CERT-In notified in parallel. An older June 2023 circular set 24 hours for the details. Confirm the exact wording in the 2026 circular before you rely on a number
How to report	Portal at www.cert-in.org.in, email to incident@cert-in.org.in, or phone 1800-11-4949. Include incident type, affected systems and IP addresses, time detected and an early impact assessment	Through the format and channel named in the circular. Use one runbook so the facts you send IRDAI match what you sent CERT-In
Response planning	Be ready to run the reporting path: a named contact, a deputy for out-of-hours, a template, and a tested route. Test it at least yearly, including at night or on a weekend	The CISO owns scenario-based response plans, for example ransomware, data leak, DDoS and vendor compromise. Cyber crisis preparedness is expected, and business heads must enforce policy and report incidents promptly
Forensic investigation	No fixed rule on who investigates. You must give CERT-In the information and logs it requests	Forensic auditors must be empanelled in advance, so there is no delay when an incident hits. The vendor that runs your SOC, attack-surface monitoring or red teaming, or does your annual assurance audit, cannot act as the forensic auditor for that incident. This avoids conflicts of interest
Other duties in the same event	If personal data is involved, a separate notification duty under the Digital Personal Data Protection (DPDP) Act applies. Run it from the same runbook	Same. IRDAI’s guidelines are aligned to the DPDP Act, so the report to IRDAI, the report to CERT-In and the DPDP notification should be consistent

4. Logs, monitoring and technical controls

Area	CERT-In	IRDAI
Log retention	Keep logs of all ICT systems for a rolling 180 days, stored within India, and produce them to CERT-In on request. Examples include firewall, IPS, SIEM, web, database, mail, FTP, proxy, application, SSH and VPN logs. Keeping 30 days is not enough, and logs held in a non-India cloud region do not meet the Direction	Continuous monitoring of all ICT systems. Retention follows the CERT-In rule. The aim is that every system is watched and the evidence exists when an incident has to be investigated
Clock synchronisation	Synchronise system clocks to the NIC or NPL time servers, or to NTP servers traceable to them, on servers, workstations and network devices. This keeps timestamps accurate across systems for investigations	Time synchronisation across security monitoring and logging tools, so events from different systems line up in one timeline
Access and passwords	–	Restrict access to personal data and review privileged access. One summary reports a 45-day password change cycle. Confirm it in the circular
Cryptography	–	Keep an inventory of cryptographic assets such as keys, certificates and algorithms, with post-quantum readiness in view. Match controls to data classification and define a key lifecycle
Resilience	–	Immutable backups, failover and infrastructure segregation across group entities. Test business continuity and disaster recovery at least yearly on real disaster scenarios and report the results to the ISRMC

5. Testing, audit and assurance

Area	CERT-In	IRDAI
Penetration testing	Included in the scope of the comprehensive cyber security audit	External grey-box or white-box testing at least every 6 months, by a CERT-In empanelled auditor, on a test environment that mirrors production. Retest fixed findings
Audit	At least one comprehensive audit a year by a CERT-In empanelled auditor, using CERT-In templates and evidence rules. Critical applications that hold sensitive personal data are checked against the 282-point audit checklist. Audits cover cloud, IoT, AI, blockchain and OT where relevant	An annual independent assurance audit. The assurance auditor must be rotated every 3 years. Findings go to the Audit Committee, risk committee or Board as applicable
Submission	One summary says the report and metadata go to CERT-In within 5 days. Confirm in the policy	Insurers submit to IRDAI within 90 days of year end or 30 days of audit completion, whichever is earlier. Intermediaries submit a CERT-In empanelled auditor’s report within 30 days of audit completion
Closing gaps	Fix findings and keep evidence for the next audit	The Board reviews non-conformities and gaps must close within 12 months

6. Data protection, vendors and cloud

Area	CERT-In	IRDAI
Personal data	The Directions do not themselves set data protection controls. The DPDP Act runs alongside them with its own breach notification duty and penalties	Aligned to the DPDP Act. Classify data in four tiers and tag personal information separately. Review labels every 2 years. Encrypt confidential data leaving the network and on mobile or removable media
Third parties and outsourcing	–	Check a vendor’s security before onboarding. Approve outsourcing strictly. Sign NDAs. Include right-to-audit clauses. Get written permission before the vendor sub-outsources. A periodic audit may be waived for a vendor holding ISO 27001 that covers the service
Cloud	Cloud providers have their own record-keeping duty (see section 7)	Use cloud providers empanelled by MeitY with valid STQC audit status. Contracts must require the provider to erase your data from disks and backups when the contract ends

7. Records for providers, and what happens if you do not comply

Area	CERT-In	IRDAI
Records kept by service providers	VPN, VPS and cloud providers keep subscriber details (name, email, address, phone, purpose of use, allocated IPs) and activity logs for 5 years after the service is cancelled, and IP assignment and release records with timestamps. Produce them to CERT-In on request	– No separate rule. Insurers rely on this through contracts with their providers
Consequences	Per a secondary source: failure to report, give information or logs, or follow directions can lead to a fine of up to INR 1 lakh and/or imprisonment of up to 1 year under section 70B. Repeat default may lead to blocking or licence action. DPDP Act penalties are separate and larger	Regulatory action, including penalties or sanctions, as IRDAI has warned in its circulars. Audit gaps also reach the Board

IRDAI’s guidelines make the CISO responsible for CERT-In compliance, so an insurer meets both columns together. Where this table and the original circulars differ, the circulars govern.

Does it apply to me?

CERT-In applies to every posture below. IRDAI applies in full to insurers, in graded or comply-or-explain form to intermediaries and foreign reinsurance branches, and not at all to a company outside insurance.

Key: Yes applies. Graded scales with system access and revenue. C/E comply or explain. Contract reaches you through insurer customers. Check confirm in the circular text. No does not apply.

Control	Insurer	Foreign reinsurance branch	Intermediary	Other company	VPN, cloud or data centre provider
CERT-In 6-hour incident report	Yes	Yes	Yes	Yes	Yes
CERT-In registered point of contact	Yes	Yes	Yes	Yes	Yes
180-day ICT logs kept in India	Yes	Yes	Yes	Yes	Yes
NIC or NPL clock sync	Yes	Yes	Yes	Yes	Yes
DPDP Act breach notification	Yes	Yes	Yes	Yes	Yes
CERT-In annual audit by empanelled auditor	Yes	Yes	Yes	Check	Check
5-year subscriber and activity records	No	No	No	No	Yes
IRDAI-format incident report with versioned updates	Yes	Yes	Yes	No	Contract
Forensic auditors empanelled in advance	Yes	Yes	Yes	No	No
Board-approved cyber policy and budget	Yes	C/E	Graded	No	No
Independent CISO	Yes	Check	Graded	No	No
ISRMC quarterly, risk committee with external expert	Yes	C/E	Graded	No	No
IT Steering Committee	Yes	C/E	Check	No	No
Exception approval tiers	Yes	C/E	Graded	No	No
Annual risk assessment	Yes	Yes	Graded	No	No
6-monthly grey-box or white-box penetration test	Yes	Check	Graded	No	No
Annual assurance audit and submission to IRDAI	Yes	Check	Yes	No	No
MeitY-empanelled cloud with STQC status	Yes	Yes	Check	No	No
Vendor due diligence, NDA, right-to-audit	Yes	Yes	Graded	No	No
Cryptographic asset inventory	Yes	Yes	Check	No	No
BCP and DR tested yearly, immutable backups	Yes	Yes	Graded	No	No

Other company means an organisation outside insurance with no IRDAI licence: CERT-In rules reach it, and DPDP Act duties apply on their own. Entries for intermediaries and foreign reinsurance branches come from law-firm and industry summaries, so confirm them. The 2023 guidelines exempted individual insurance agents and micro-insurance agents, and intermediary duties were graded by system access and gross insurance revenue. Confirm both points in the 2026 text.

Clause-level comparison

Where both bodies speak to a topic, the stricter rule governs. Rows follow the order you build a programme. A dash means the framework has no separate rule.

Area	Control or clause	CERT-In	IRDAI	How to implement	Audit evidence
1. Legal basis	Instrument	Directions of 28 Apr 2022, section 70B(6), IT Act. In force late June 2022	Guidelines Ver. 2.0, circular of 6 Apr 2026, applies from the current financial year	Keep a regulatory register naming each instrument, version and owner	Register with dates and review log
1. Legal basis	Scope	Service providers, intermediaries, data centres, body corporates, government. No small-business exemption	Insurers, foreign reinsurance branches, brokers, corporate agents, web aggregators, TPAs, IIB	Record your posture and the controls it triggers	Applicability memo signed by compliance
2. Governance	Board duties	–	Approve policy, fund security in line with risk appetite, review audit non-conformities, ensure gaps close within 12 months	Add cyber to the board calendar and approve a budget line	Board minutes, budget approval
2. Governance	Committees	–	ISRMC at least quarterly. IT Steering Committee for IT strategy, SLAs, procurement, cloud, BCP and DR. Risk committee takes over the Control Management Committee and includes independent external cyber experts	Set terms of reference, quorum and a yearly meeting plan	Minutes, attendance, action log
2. Governance	CISO	Named point of contact registered with CERT-In	Independent of the Head of IT, no business targets, briefs Board and ISRMC, permanent invitee to ITSC, owns scenario-based response, ensures CERT-In compliance. CITSO role removed	Reporting line outside IT, written mandate, no revenue KPIs	Org chart, appointment letter, CISO reports
2. Governance	Exceptions	–	Up to 3 months CISO. 3 to 12 months risk committee. Beyond 12 months Board. Documented risk and periodic reassessment	One exception register with approver tier built in	Register with approvals and expiry
3. Risk and data	Risk assessment	–	At least yearly, and before major technology change, new outsourcing or external access to critical systems	Make the assessment a gate in change and procurement	Assessment reports, change tickets
3. Risk and data	Data protection	Separate DPDP Act breach notification	Aligned to DPDP Act. Four-tier classification with PII tagged separately, labels reviewed every 2 years, encryption of confidential data leaving the network and on mobile or removable media	Tag data at source, encrypt by default, review labels on a 2-year cycle	Classification policy, encryption configuration
4. Technical	Logging	ICT logs kept a rolling 180 days, stored in India, produced on request. Examples: firewall, IPS, SIEM, web, database, mail, FTP, proxy, application, SSH, VPN	Continuous monitoring of ICT systems. Retention follows CERT-In	List every log source, set 180-day retention, pin storage to an India region	Log source inventory, retention settings, region proof
4. Technical	Clock sync	Sync to NIC or NPL time servers or NTP traceable to them, on servers, workstations and network devices	Time sync across monitoring and logging tools	Push one NTP policy to all devices and alert on drift	NTP configuration, drift report
4. Technical	Access and passwords	–	Restricted access to personal data. Summary reports a 45-day password change cycle	Role-based access, privileged access review monthly	Access reviews, password policy
4. Technical	Cryptography	–	Inventory of cryptographic assets with post-quantum readiness in view. Controls match data class and a defined key lifecycle	Build the inventory from code, certificates, keys and vendors	Inventory with review date
4. Technical	Resilience	–	Immutable backups, failover, infrastructure segregation across group entities. BCP and DR tested yearly on real disaster scenarios, results to ISRMC	Test restores and failover, report outcomes to ISRMC	Test reports, ISRMC minutes
4. Technical	Provider records	VPN, VPS and cloud providers keep subscriber KYC and activity records 5 years after service ends	–	Flag records for retention at service cancellation	Retrieval test result
5. Incident handling	Reporting clock	6 hours from noticing, in 20 categories, initial report then updates	Prescribed IRDAI format, versioned updates, 6-hour window in recent circulars. Confirm the 2026 wording	One runbook that triggers CERT-In, IRDAI and DPDP duties	Incident register with timestamps
5. Incident handling	Response planning	Named contact and tested reporting path	Scenario-based response plans owned by the CISO. Cyber crisis preparedness expected	Write scenarios for ransomware, data leak, DDoS and vendor compromise	Plans and exercise reports
5. Incident handling	Forensics	Produce logs and information on request	Forensic auditors empanelled in advance. SOC, attack-surface, red team and assurance-audit vendors cannot act as forensic auditor for that incident	Sign a retainer with an independent firm before you need it	Empanelment record, independence declaration
6. Vendors and cloud	Third parties	–	Due diligence before onboarding, strict outsourcing approval, NDAs, right-to-audit, written permission for sub-outsourcing. Audit may be waived for vendors holding ISO 27001 covering the service	Security questionnaire and contract clause set in procurement	Due diligence file, signed clauses
6. Vendors and cloud	Cloud	Cloud providers carry the 5-year record duty	MeitY-empanelled provider with valid STQC status. Contract requires erasure from disks and backups on exit	Check empanelment before award and obtain an erasure certificate at exit	Empanelment proof, erasure certificate
7. Testing and audit	Penetration test	Part of the comprehensive audit	External grey-box or white-box test at least every 6 months by a CERT-In empanelled auditor, on an environment mirroring production	Calendar two tests a year and retest fixes	Test report, retest evidence
7. Testing and audit	Audit	At least one comprehensive audit a year by an empanelled auditor in CERT-In templates. Critical applications with sensitive personal data checked against the 282-point checklist. One summary says report and metadata go to CERT-In within 5 days	Annual independent assurance audit, assurance auditor rotated every 3 years. Insurers submit within 90 days of year end or 30 days of audit completion, whichever is earlier. Intermediaries within 30 days	Engage an empanelled auditor early and agree scope against both lists	Audit report, submission receipt
8. Consequences	Non-compliance	Per a secondary source: fine up to INR 1 lakh and/or up to 1 year imprisonment under section 70B, with possible blocking or licence action on repeat default	Regulatory action including penalties or sanctions, as IRDAI has warned in circulars	Track findings to closure and report to the Board	Findings tracker

The DPDP Act, 2023 carries separate and larger penalties for failing to notify the Data Protection Board of a personal data breach and for inadequate safeguards. One secondary source quotes up to INR 200 crore and INR 250 crore respectively. Confirm the figures and commencement dates against the Act and the current DPDP Rules.

Breach intimation to government and regulators

Report a notified incident to CERT-In within 6 hours of noticing it or being told of it. Do not wait for root cause: file a good-faith initial report and update it as facts arrive. The clock runs from noticing, not from when the incident began, so record the time noticed.

Who is told	Deadline	Channel	Applies to
CERT-In	6 hours from noticing	Incident reporting portal at www.cert-in.org.in, email incident@cert-in.org.in, phone 1800-11-4949	Every posture, for incidents in the 20 categories
IRDAI	Prescribed format. Recent circulars describe 6 hours, with new versions as forensic findings arrive. A June 2023 circular set 24 hours for the details. Confirm the 2026 wording	IRDAI prescribed format, through the channel in the circular	Insurers, foreign reinsurance branches, intermediaries
Data Protection Board and affected individuals	Per the DPDP Act and current Rules. Confirm timing and commencement dates	As prescribed under the Act	Any entity holding personal data
Other regulators and law enforcement	As their rules require	As prescribed	Depends on your business and the incident

Sequence to run

Notice. Whoever sees the event opens an incident ticket and records the time noticed. Escalate to the security duty officer at once.
Triage. A named person, with an out-of-hours deputy, decides within the first hour whether the event falls in one of the 20 categories. If in doubt, treat it as reportable.
Contain. Isolate affected systems, preserve logs and snapshots, and stop further loss. Do not wipe evidence.
Report to CERT-In inside 6 hours with an initial report. Keep the acknowledgement.
Report to IRDAI in its prescribed format where you are an IRDAI-regulated entity. Use one runbook so the facts match across reports.
Start the DPDP track if personal data is involved: assess risk to individuals, prepare the Board and individual notices, and keep the decision log.
Call the forensic auditor you empanelled in advance. It must not be your SOC, attack-surface, red team or assurance-audit vendor.
Update reports. Send new versions to CERT-In and IRDAI as findings arrive. Produce 180-day logs to CERT-In when asked.
Recover and report to governance. Restore from immutable backups, brief the CISO, ISRMC and Board, and record root cause and fixes.
Close. Track corrective actions to closure, feed lessons into the plan and update exercises.

What the initial report should contain

Incident type and category from the CERT-In list
Date and time detected, and time of first occurrence if known
Affected systems, IP addresses and locations
Early impact: data involved, services affected, customers affected
Actions taken so far and a named contact
Whether personal data is involved and whether IRDAI and other regulators have been told

If the notice is late or incomplete, CERT-In expects a good-faith initial notice and prompt updates. Failure to report or to produce logs is an offence under section 70B of the IT Act, per a secondary source.

RACI

This allocation is a recommended arrangement built from the roles the rules name, not regulatory text. R is responsible, A is accountable (one per row, except exception approval, where it depends on duration), C is consulted, I is informed. Adapt role names to your organisation. Intermediaries and smaller entities can combine roles, but keep the CISO independent of IT where IRDAI requires it.

Implementation and governance

Activity	Board	CEO or MD	CISO	CTO or CIO	ISRMC or Risk Committee	IT Steering Committee	Compliance or DPO	Legal	HR	Procurement	Internal audit
Approve cyber policy and budget	A	R	C	C	C	I	C	I	I	I	I
Appoint independent CISO	A	R	I	I	C	I	C	C	R	I	I
Run quarterly ISRMC	I	I	R	C	A	C	C	I	I	I	I
Run IT Steering Committee	I	C	C	R	I	A	C	I	I	C	I
Maintain regulatory register	I	I	C	I	I	I	A	R	I	I	C
Approve exceptions	A for over 12 months	I	R	C	A for 3 to 12 months	I	C	I	I	I	I
Annual risk assessment	I	I	A	R	C	C	C	I	I	C	C
Data classification and DPDP alignment	I	I	C	C	I	I	A	R	I	I	C
Log retention and NTP sync	I	I	A	R	I	I	C	I	I	I	I
Cryptographic inventory	I	I	A	R	I	C	I	I	I	I	I
Vendor and cloud due diligence	I	I	A	C	I	C	C	C	I	R	I
BCP and DR testing	I	I	C	R	A	C	I	I	I	I	I

Incident response and notification

Activity	Board	CEO or MD	CISO	CTO or CIO	SOC or IT operations	Compliance or DPO	Legal	Communications	Business heads	Forensic auditor
Detect and log time noticed	I	I	A	C	R	I	I	I	R	I
Decide reportability	I	I	A	C	R	C	C	I	C	I
Report to CERT-In within 6 hours	I	I	A	C	R	C	C	I	I	I
Report to IRDAI	I	I	A	C	C	R	C	I	I	I
DPDP Board and individual notices	I	C	C	I	C	A	R	C	I	I
Contain and recover	I	I	A	R	R	I	I	I	C	C
Engage forensic auditor	I	I	A	C	C	C	C	I	I	R
Update reports as facts arrive	I	I	A	C	R	R	C	I	I	C
Customer and media statement	I	A	C	I	I	C	R	R	C	I
Brief Board and ISRMC	I	R	A	C	I	C	C	I	I	I
Close corrective actions	I	I	A	R	R	I	I	I	R	I

Audit, testing and review

Activity	Board	CISO	CTO or CIO	ISRMC	Compliance or DPO	Internal audit	External empanelled auditor	Vendors
Annual comprehensive and assurance audit	I	A	C	I	C	C	R	C
Submit audit report to IRDAI and CERT-In	I	A	I	I	R	I	C	I
Penetration test every 6 months	I	A	C	I	I	I	R	C
Remediate findings	I	A	R	I	I	C	I	R
Review non-conformities and gap closure within 12 months	A	R	C	C	C	I	I	I
Rotate assurance auditor every 3 years	I	C	I	A	R	I	I	I
Quarterly control attestation	I	A	R	I	C	C	I	I
Vendor reassessment	I	A	C	I	C	I	I	R

Implementation roadmap

Build in four phases over about 120 days, starting with the controls that are already in force and carry a hard deadline. Dates are a suggested plan. Move them to fit your audit cycle.

Phase	Days	Focus	Exit gate
1. Foundation	0 to 30	Regulatory register and posture memo. Name the CERT-In point of contact and deputy. Open the incident register with a time-noticed field. Inventory log sources. Confirm NTP sync to NIC or NPL. Draft the single breach runbook covering CERT-In, IRDAI and DPDP	Runbook approved by CISO. Reporting path tested once end to end
2. Governance	31 to 60	Board-approved cyber policy and budget. Independent CISO mandate. ISRMC and IT Steering Committee terms of reference and a yearly meeting plan. Exception register with approval tiers. Sign a forensic auditor retainer	Board minute on policy and budget. First ISRMC held
3. Controls	61 to 90	180-day retention in India verified for every source. Data classification and PII tagging. Cryptographic inventory started. Vendor register with MeitY and STQC status, NDA and right-to-audit clauses. Immutable backup and restore test	Evidence pack for each control collected
4. Assurance	91 to 120	Engage a CERT-In empanelled auditor. First grey-box or white-box penetration test. BCP and DR test. Tabletop exercise on a scenario-based plan. Gap list to the Board with 12-month closure dates	Audit scope agreed. Test report received. Board review done

After day 120 the programme moves to the calendar below. Keep the regulatory register current as IRDAI and CERT-In issue updates.

Review and audit calendar

Every recurring duty, who owns it and what proves it. The cadence is taken from the rules where one exists and suggested where it is marked PRACTICE.

Cadence	Activity	Source	Owner	Reviewer
Daily	Alert review and time-noticed record. Reportability decision. Log source health. Clock sync check	CERT-IN, PRACTICE	SOC or IT operations	CISO
Weekly	Open findings and exception review. Vendor change review. Backup restore sample	IRDAI, PRACTICE	CISO	CTO or CIO
Monthly	Forensic auditor independence check. Privileged access and password review. 180-day log retrieval test. CERT-In contact check. Vendor register expiry review	IRDAI, CERT-IN, PRACTICE	CISO	ISRMC
Quarterly	ISRMC meeting. IT Steering Committee meeting (confirm cadence). CISO report to Board or risk committee. Tabletop exercise. Control attestation	IRDAI, PRACTICE	CISO, CTO or CIO	Board
Every 6 months	External grey-box or white-box penetration test and retest	IRDAI	CISO	ISRMC
Yearly	Comprehensive cyber security audit. Independent assurance audit and submission to IRDAI. Annual risk assessment. BCP and DR test. Board review of non-conformities, policy and budget. Cryptographic inventory refresh. Reporting path test at night or weekend	CERT-IN, IRDAI, PRACTICE	CISO, Compliance	Board, ISRMC
Every 2 years	Data classification label review	IRDAI	Compliance or DPO	ISRMC
Every 3 years	Rotate the independent assurance auditor	IRDAI	Compliance or DPO	ISRMC
Within 12 months of finding	Close audit gaps	IRDAI	CTO or CIO	Board
Within 30 days of audit completion	Submit the audit report to IRDAI. Insurers also within 90 days of year end, whichever is earlier	IRDAI	Compliance or DPO	CISO
On event	Incident reporting. Information and log requests. Contact changes. Vendor and cloud onboarding and exit. Exceptions. Pre-change risk assessment	CERT-IN, IRDAI	CISO	ISRMC

Checklists by posture and cadence

Every posture starts with checklist A, the CERT-In baseline. Add the checklist for your posture: B for insurers, C for foreign reinsurance branches, D for intermediaries, E for providers. An organisation outside insurance uses A alone. Source tags: CERT-IN and IRDAI come from the rules, PRACTICE is a suggested routine that proves the rule is working.

A. Baseline for every posture (CERT-In)

Cadence	Check	Source	Evidence to keep
Daily	Review overnight alerts and record the time any suspected incident was first noticed	CERT-IN, PRACTICE	Alert export, incident ticket with time noticed
Daily	Decide whether each open incident falls in one of the 20 categories and report within 6 hours if it does	CERT-IN	Reportability decision, report copy, acknowledgement
Daily	Confirm the registered reporting contact and deputy are reachable, including out of hours	CERT-IN	On-call roster
Daily	Check every log source is sending with no gaps	CERT-IN	SIEM source health report
Daily	Confirm retention is at least 180 days and storage is in India	CERT-IN	Retention settings, region record
Daily	Check clocks sync to NIC or NPL sources on servers, network gear and security tools	CERT-IN	NTP status report
Daily	Read new CERT-In advisories and log the action taken	CERT-IN	Advisory register
Daily	If personal data is involved, start the DPDP breach track from the same runbook	CERT-IN, PRACTICE	Breach register entry
Weekly	Confirm newly added systems send logs to the central store	PRACTICE	Onboarding checklist
Weekly	Summarise incidents and near misses for the security head	PRACTICE	Weekly digest
Monthly	Pull a log record close to 180 days old to prove retention	PRACTICE	Retrieval output
Monthly	Check CERT-In holds the current point of contact and that report templates and channels work	PRACTICE	Contact confirmation
Monthly	Review vulnerability and patch status against your own SLA	PRACTICE	Patch compliance report
Quarterly	Attest log coverage, retention and NTP sync across the estate	PRACTICE	Signed attestation
Yearly	Complete the comprehensive cyber security audit by a CERT-In empanelled auditor where you are an auditee. One summary says to send the report and metadata to CERT-In within 5 days	CERT-IN	Audit report in CERT-In templates, submission proof
Yearly	Test the reporting path end to end, including at night or on a weekend	PRACTICE	Test log with timings
On event	Incident: record time noticed, decide reportability, report within 6 hours, then update	CERT-IN	Incident register, reports
On event	Produce information or logs from the India-held store when CERT-In asks	CERT-IN	Request, response, log extract
On event	Update CERT-In and the roster when the point of contact changes	CERT-IN	Updated contact record

B. Insurer additions (IRDAI)

Cadence	Check	Source	Evidence to keep
Daily	Update any open IRDAI incident report with new forensic findings as a new version	IRDAI	Report versions with timestamps
Daily	Review vendor and cloud access granted in the last day and confirm backups ran	IRDAI, PRACTICE	Access change log, backup report
Weekly	Review penetration test and audit findings against the 12-month closure limit	IRDAI, PRACTICE	Findings tracker
Weekly	Review the exception register for items nearing 3 or 12 months and route to the right approver	IRDAI, PRACTICE	Exception register
Weekly	Review vendor, sub-outsourcing and external access changes	PRACTICE	Vendor change log
Weekly	Restore a sample from backup	PRACTICE	Restore record
Monthly	Check the forensic auditor list is current and independent of SOC, attack-surface, red team and assurance-audit vendors	IRDAI	Empanelment record, independence declaration
Monthly	Review privileged access and the 45-day password change cycle	IRDAI, PRACTICE	Access review sign-off
Monthly	Review the vendor register, including MeitY empanelment and STQC status of cloud providers	IRDAI	Vendor register with expiry dates
Quarterly	Hold the ISRMC meeting and file minutes	IRDAI	Minutes, actions
Quarterly	Hold the IT Steering Committee meeting (confirm cadence in the circular)	IRDAI	Minutes
Quarterly	CISO report to Board or risk committee, and take up exceptions older than 3 months	IRDAI	Board pack, decisions
Quarterly	Run a tabletop on a scenario-based plan	PRACTICE	Exercise report
Every 6 months	External grey-box or white-box penetration test by a CERT-In empanelled auditor on an environment mirroring production, then retest	IRDAI	Test report, retest evidence
Yearly	Independent assurance audit. Submit to IRDAI within 90 days of year end or 30 days of audit completion, whichever is earlier	IRDAI	Audit report, submission receipt
Yearly	Annual risk assessment	IRDAI	Assessment report
Yearly	Test BCP and DR on real disaster scenarios and report to the ISRMC	IRDAI	Test report, minute
Yearly	Board reviews non-conformities, approves budget and reviews the policy	IRDAI	Board minutes
Yearly	Refresh the cryptographic asset inventory	IRDAI	Inventory with review date
Every 2 years	Review data classification labels	IRDAI	Review record
Every 3 years	Rotate the assurance auditor	IRDAI	Tenure record
On event	Before major change, new outsourcing or external access to critical systems, complete a risk assessment	IRDAI	Pre-change assessment
On event	Vendor onboarding: due diligence, NDA, right-to-audit, written permission for sub-outsourcing	IRDAI	Due diligence file
On event	Cloud onboarding: MeitY-empanelled provider with valid STQC status. Exit: confirm erasure from disks and backups	IRDAI	Empanelment proof, erasure certificate
On event	Exception request: up to 3 months CISO, 3 to 12 months risk committee, beyond 12 months Board	IRDAI	Approval record

C. Foreign reinsurance branch (comply or explain)

Complete checklist A and checklist B. Where branch-level governance is handled centrally, a committee or control in B may be met by the parent arrangement if you document the explanation and the equivalent control. Confirm which items qualify in the circular.

Cadence	Check	Source	Evidence to keep
Yearly	Record each control in B as complied, explained or not applicable, with the parent control that covers it	IRDAI, PRACTICE	Comply-or-explain register
Quarterly	Confirm parent-level committees and reporting cover the branch	PRACTICE	Parent minutes, branch extract
On event	Report incidents to CERT-In and IRDAI from the branch, not only through the parent	CERT-IN, IRDAI	Branch incident register

D. Intermediary additions (graded)

Complete checklist A. Apply the parts of B that match your tier, which the 2023 guidelines graded by access to insurer systems and gross insurance revenue. Confirm your tier in the 2026 text.

Cadence	Check	Source	Evidence to keep
Yearly	Confirm your tier and list the B controls that apply	IRDAI, PRACTICE	Tier memo
Yearly	Obtain a compliance report from a CERT-In empanelled auditor and submit it to IRDAI within 30 days of audit completion	IRDAI	Audit report, submission receipt
Every 6 months	Penetration test if your tier requires it	IRDAI	Test report
Quarterly	Review access to insurer systems and remove unused access	PRACTICE	Access review
On event	Report incidents to CERT-In and IRDAI, and tell the insurer whose systems or data are involved	CERT-IN, IRDAI	Incident register
On event	Keep the forensic auditor arrangement in place as the guidelines require	IRDAI	Empanelment record

E. VPN, cloud and data centre providers

Complete checklist A. Add these.

Cadence	Check	Source	Evidence to keep
Daily	Confirm subscriber, activity and IP allocation records, with assignment and release timestamps, were written for new and ended services	CERT-IN	Record write checks
Monthly	Retrieve a sample subscriber record and activity log to prove the 5-year record can be produced	PRACTICE	Retrieval result
On event	When a service is cancelled, flag its records for retention for 5 years from cancellation	CERT-IN	Retention flag
On event	When an insurer customer asks, support its IRDAI duties on logs, incident notice and audit rights as the contract requires	PRACTICE	Customer request log

Audit evidence register

Keep each item where an auditor can retrieve it within a day. Retain logs for 180 days, and subscriber records for 5 years where that duty applies.

Evidence	Proves	Framework	Owner	Refresh
Regulatory register and posture memo	You know which rules apply	Both	Compliance	On each new circular
Incident register with time noticed, time reported, report copy, acknowledgement	6-hour compliance	Both	CISO	Per incident
Registered CERT-In point of contact and on-call roster	Contact duty	CERT-In	CISO	On change, checked monthly
Log source inventory, retention settings, India region proof	180-day retention in India	CERT-In	CTO or CIO	Monthly
NTP configuration and drift report	Clock sync to NIC or NPL	CERT-In	CTO or CIO	Monthly
Annual audit report in CERT-In templates and submission proof	Audit duty	CERT-In	CISO	Yearly
Subscriber and activity records and retrieval test	5-year provider records	CERT-In	Service owner	Monthly sample
Board-approved cyber policy, budget decision and non-conformity review	Board accountability	IRDAI	Company secretary	Yearly
ISRMC and IT Steering Committee minutes and attendance	Committee cadence	IRDAI	CISO, CTO or CIO	Quarterly
CISO appointment letter, reporting line, mandate	CISO independence	IRDAI	HR, CEO	On change
Exception register with approver tier and reassessment date	Exception control	IRDAI	CISO	Weekly
Annual risk assessment and pre-change assessments	Risk management	IRDAI	CISO	Yearly and per change
Data classification policy, PII tagging, encryption configuration	DPDP alignment	IRDAI	Compliance or DPO	Labels every 2 years
Forensic auditor retainer and independence declaration	Empanelment in advance	IRDAI	CISO	Yearly and monthly check
Penetration test reports, scope, auditor empanelment, retest	6-month testing	IRDAI	CISO	Every 6 months
Independent assurance audit report and IRDAI submission receipt	Assurance and submission limits	IRDAI	Compliance	Yearly
Vendor due diligence, NDAs, right-to-audit clauses, sub-outsourcing permissions	Third-party control	IRDAI	Procurement, CISO	Per vendor
Cloud provider MeitY empanelment, STQC status, erasure certificate	Cloud control	IRDAI	CISO	Per provider
Cryptographic asset inventory	Crypto readiness	IRDAI	CTO or CIO	Yearly
BCP and DR test reports, immutable backup and restore tests	Resilience	IRDAI	CTO or CIO	Yearly, restore weekly

Open points to verify and sources

Confirm these against the primary circulars before you publish. Most 2026 IRDAI details come from law-firm, consultant and industry-body summaries, because the official circular text was not available to read in full.

Point	Why it needs checking
IRDAI incident reporting window	Sources conflict between 6 hours and 24 hours. A June 2023 circular set 24 hours for details. Recent summaries and a March 2025 circular describe 6 hours
IT Steering Committee	Described as mandatory in one summary and not mentioned in another. The quarterly cadence is not stated in the body of that summary
Committee names	The Control Management Committee is reported merged into the Risk Management Committee. Confirm exact names and external expert rules
Intermediary tiers and exemptions	The 2023 guidelines graded duties by access and revenue and exempted individual agents. Confirm for 2026
Foreign reinsurance branch scope	Comply-or-explain approach is reported. Confirm which controls it covers
Audit submission deadlines	90 days after year end or 30 days after audit completion, whichever is earlier, for insurers. Confirm in the circular
CERT-In audit report within 5 days	Reported by one summary of the 2025 audit policy. Confirm in the policy
Penalty figures	The section 70B penalty and DPDP penalties come from secondary sources
DPDP timing	Confirm breach notification timing and commencement dates under the current DPDP Rules
RACI	A recommended allocation. The row on exception approval has two accountable roles because approval depends on duration

Sources

Do you have a complete oversight of your Security Posture?

Unlock Insights by Scheduling Your Comprehensive Discovery Call Now

Request a Call