ISO 27001 in India
For insurers, the ISMS is the engine. IRDAI decides the destination.
The Insurance Regulatory and Development Authority of India (IRDAI) sets information and cyber security expectations for insurers and insurance intermediaries. An ISO 27001 ISMS can carry much of the governance and control work they rest on. It does not answer IRDAI's own requirements on sign-off, reporting and audit, which must be met separately.
Back to ISO 27001 services01 · The instrument
Which IRDAI guidelines apply now
IRDAI has issued three versions in four years. Confirm which one binds you.
IRDAI's guidelines page lists the Guidelines on Information and Cyber Security of 2 September 2022, the IRDAI Information and Cyber Security Guidelines, 2023 of 24 April 2023 (reference IRDAI/GA&HR/GDL/MISC/88/04/2023), and the IRDAI Information and Cybersecurity Guidelines, 2026 of 8 April 2026 (reference IRDAI/GA&HR/CIR/MISC/51/4/2026).
This page describes expectation areas at a general level. Read the current guidelines in full before mapping your controls, and treat any detail below as something to confirm.
The 2023 guidelines applied to insurers, including foreign reinsurance branches, and to insurance intermediaries. Larger insurers and small intermediaries face very different practical burdens, so check whether the current version scales any requirement by entity type.
02 · Mapping
IRDAI expectation areas next to ISMS elements
Most areas have an ISMS home. The regulatory column is what remains.
| Expectation area | ISMS element that supports it | What IRDAI may still add |
|---|---|---|
| Board oversight and policy | Clause 5 leadership, approved security policy | Board approval of the policy and of key appointments |
| Information security officer | Clause 5.3 roles and responsibilities | A designated officer with the independence the guidelines set |
| Risk management | Clause 6.1 and 8 risk assessment and treatment | Risk reporting to the board in the form IRDAI expects |
| Asset and data classification | Annex A asset and classification controls | Classification of policyholder data as the guidelines define |
| Third-party and outsourcing | Annex A supplier controls | Contract clauses and oversight IRDAI specifies |
| Incident management | Annex A incident controls | Reporting to CERT-In and IRDAI on fixed timelines |
| Continuity | Annex A continuity and ICT readiness controls | Drills and recovery evidence in IRDAI's terms |
| Audit | Clause 9.2 internal audit, certification audits | A periodic information and cyber security audit and its submission |
03 · Who signs off
Who signs off, and on what
The guidelines place ultimate responsibility with the board.
- The board
- Carries ultimate responsibility for information security, approves the policy and the appointment of the chief information security officer.
- Chief information security officer
- Runs the security programme day to day and reports on it. In ISMS terms, this is usually the ISMS owner.
- Senior management
- Provides resources and attends the ISMS management review, which can double as a regular security report up to the board.
- Auditors
- The certification body audits the ISMS against the standard; the regulator's audit is a separate engagement with its own scope.
Where the ISMS and the regulatory structure meet, keep the records aligned. A management review that the board receives, minuted, serves both. Two parallel reporting lines invite contradictions.
04 · Audit expectations
Audit expectations beyond certification
A certificate is one audit. IRDAI's is another.
Certification audit
- Against ISO/IEC 27001
- By an accredited certification body
- Scope set by your ISMS scope statement
- Result: a certificate and an audit report
Regulatory security audit
- Against IRDAI's guidelines
- By auditors who meet IRDAI's criteria
- Scope set by the regulator
- Result: a report for the insurer and, where required, the Authority
Plan both in one calendar so the certification audit's fixes close before the regulatory audit samples the same areas.
05 · Incident reporting
Incident reporting: where the ISMS stops
ISO 27001 asks you to manage incidents. It does not set a clock.
Under the 2023 guidelines, insurers were expected to report cyber incidents to CERT-In within a short, fixed window and copy IRDAI. Your incident procedure under Annex A should name these recipients, the timelines and who decides an event is reportable, so the ISMS evidence and the regulatory duty are the same record.
- Reportable-event criteria. Written in the procedure, with examples.
- A decision log. Who classified the event, when, and why.
- Submission records. What was sent, to whom, and at what time.
Sources: IRDAI guidelines listing (titles, dates and reference numbers of the 2022, 2023 and 2026 information and cyber security guidelines, confirmed from IRDAI's site); IRDAI Information and Cyber Security Guidelines, 2023 and IRDAI's June 2023 circular on reporting cyber incidents, at a general level; CERT-In directions of 28 April 2022 under section 70B of the IT Act, named only; ISO/IEC 27001:2022 clause titles and Annex A names.
Questions from insurers and intermediaries
Does ISO 27001 certification meet IRDAI's guidelines?
No. It supports the work but does not replace IRDAI's requirements.
The certificate evidences that your ISMS met the standard on the audit dates. IRDAI's guidelines carry their own approvals, audits and reporting duties. A certified ISMS gives you most of the underlying records; the regulatory items still need to be met and shown.
We are a small broker. Do the guidelines apply to us?
The 2023 version covered intermediaries. Check the current one.
The 2023 guidelines applied to insurance intermediaries as well as insurers. Read the 2026 version for its applicability and any proportionality it allows by entity type.
Can our CISO also be the ISMS owner?
Usually yes, and it keeps reporting aligned.
One person running both makes sense in most firms. Check that the guidelines' independence expectations for the role are met, for example that the officer does not report into the function they oversee.
Should the ISMS scope cover all regulated operations?
For the best reuse, yes.
If the ISMS covers one portal while IRDAI's guidelines cover the whole entity, much of the regulatory evidence must be built separately. A scope that matches the regulated systems saves that duplication.
See how far your ISMS already reaches.
Auditify can map your ISO 27001 controls against IRDAI's guidelines and list what the regulator still requires. Your compliance team or counsel should confirm which version applies to you.