IRDAI · CYBER SECURITY GUIDELINES 2023
IRDAI cyber security audits for insurers and intermediaries
Annual assurance audits under IRDAI's Information and Cyber Security Guidelines, with the VAPT and SOC evidence to back them up.
What is an IRDAI cyber security audit?
An IRDAI cyber security audit is the annual independent assurance audit that insurers and insurance intermediaries need under IRDAI's Information and Cyber Security Guidelines, 2023. It checks governance, the information security policy, the CISO function, technical controls, incident management and third-party risk against the guidelines.
An annual audit, and a deadline that doesn't move.
IRDAI requires an independent assurance audit every year, submitted within 90 days of the financial year end or within 30 days of completing the audit, whichever is earlier. HostX plans backwards from that date, so testing, fixes and the final report land on time.
Audit mapped to each section of the guidelines
VAPT and SOC evidence gathered in the same engagement
Report timed for the submission deadline
What our IRDAI audit covers
Governance
Board oversight, IS risk management committee and CISO role.
Policy & risk
Board-approved information and cyber security policy and risk assessment.
Technical controls
Access, network, endpoint, data and cloud controls.
VAPT
Testing of critical applications and infrastructure.
Incident management
Detection, response and regulatory reporting readiness.
Third parties
Outsourcing, vendor and cloud service provider risk.
How an IRDAI audit runs
Plan
Scope, entity type and submission date.
Document review
Policies, committee records and registers.
Technical testing
VAPT and configuration reviews.
Walkthroughs
Interviews with IT, security and business teams.
Report
Findings rated and mapped to the guidelines.
Submit & close
Board-ready report; closure tracking.
IRDAI guidelines at a glance
| Item | Detail |
|---|---|
| Guideline | IRDAI Information and Cyber Security Guidelines, 2023 |
| Applies to | Insurers (incl. foreign reinsurance branches) and intermediaries such as brokers, corporate agents, web aggregators, TPAs, IMFs and insurance repositories |
| Generally exempt | Individual insurance agents, micro-insurance agents, POS persons and individual surveyors |
| Audit | Independent assurance audit every year |
| Submission | Within 90 days of financial year end, or within 30 days of audit completion, whichever is earlier |
| Incident reporting | Report cyber incidents to the authorities within the timelines set by IRDAI and Indian law |
What you get
Who needs IRDAI Audit?
Life, general and health insurers
Insurance brokers and corporate agents
Web aggregators and ISNPs
TPAs, IMFs and insurance repositories
Why teams choose HostX for IRDAI Audit
Deadline-driven
Planned backwards from your submission date.
Evidence-backed
VAPT and SOC data behind findings.
Closure support
We help fix, then verify.
One partner
Audit, VAPT, SOC and vCISO together.
Related services
Frequently asked questions
Meet your IRDAI deadline without the scramble.
Book a consultation and we will plan your audit backwards from your submission date.