IRDAI Cybersecurity Compliance: Insurance Companies, ISNP Audit & Broker/TPA Assessments

An ISNP audit is a mandatory pre-launch security audit required by IRDAI for Insurance Self-Network Platforms, which are online insurance distribution platforms that sell and service insurance products digitally. Any insurer launching an ISNP must complete this audit by a CERT-In empanelled auditor before the platform is approved to go live. The audit covers application security, network architecture, data flows, payment integration, KYC and AML controls, and business continuity.

Yes, IRDAI requires cybersecurity audits to be conducted by CERT-In empanelled auditors. CERT-In empanelment is the national certification that validates an auditor's capability to perform security audits for government and regulated entities. Security Brigade has been CERT-In empanelled since 2008, making us one of the longest-standing empanelled cybersecurity auditors in India.

The IRDAI Information and Cybersecurity Guidelines are a comprehensive cybersecurity framework applicable to all insurance companies in India, including life, general, health insurers, and reinsurers. The guidelines mandate cybersecurity governance with board-level oversight, appointment of a CISO, periodic VAPT and IS audits, business continuity planning, incident response procedures, and annual security audits by CERT-In empanelled auditors.

A typical IRDAI cybersecurity audit takes four to six weeks from scoping to final report delivery. The timeline depends on the entity type, scope of systems, and readiness of documentation. ISNP pre-launch audits can be completed in three to four weeks when the platform is ready for assessment. Engagements involving significant remediation before the final report may extend to eight weeks.

Yes, insurance brokers are expected to maintain cybersecurity controls proportionate to the policyholder data they handle. IRDAI extends its cybersecurity expectations to intermediaries including brokers and TPAs. Additionally, insurer partners increasingly require brokers to demonstrate cybersecurity compliance through vendor security assessments. Security Brigade delivers cybersecurity audits for brokers covering IT infrastructure, applications, access controls, and data protection.

An ISNP audit is a one-time pre-launch security audit specifically required before an Insurance Self-Network Platform can go live for online insurance sales. It focuses on the ISNP platform security including application testing, data flows, payment integration, and KYC controls. The annual cybersecurity audit is an ongoing requirement for insurance companies covering their entire IT environment, cybersecurity governance, controls, and incident response readiness. Both require CERT-In empanelled auditors.

If an IRDAI cybersecurity audit identifies significant gaps, the insurance company receives a detailed gap analysis and remediation roadmap. The company is expected to close identified gaps within a defined timeline and undergo revalidation. Persistent non-compliance can result in regulatory action including conditions on license renewal, restrictions on product launches, and financial penalties. For ISNP platforms, failure means the platform cannot receive approval to go live.

Yes, the IRDAI cybersecurity audit covers cloud-hosted insurance platforms including AWS, Azure, and other cloud environments. The audit assesses cloud configuration security, data residency, access controls, encryption, backup and recovery, and cloud vendor security controls. Many modern insurance platforms and ISNP portals are cloud-hosted, and the audit scope is adapted to cover the cloud infrastructure alongside application and network security.

Yes, Security Brigade delivers compliance across multiple regulatory frameworks including IRDAI, RBI, SEBI, CERT-In, UIDAI, NPCI, DPDP Act, and international standards like ISO 27001, SOC 2, and PCI DSS. For insurance groups with multiple regulated entities, we can coordinate compliance across IRDAI cybersecurity guidelines, RBI mandates for bank-owned insurance arms, and SEBI requirements for listed insurance entities in a single coordinated engagement.

A TPA cybersecurity audit covers IT infrastructure security, claims management system security, access controls and privileged access management, encryption of health records and claims data, network security, vendor risk assessment for hospital network integrations, business continuity and disaster recovery, and incident response readiness. TPAs handle sensitive medical and financial data, and the audit validates controls proportionate to this data sensitivity.