Amendments to the Guidelines on Information and Cyber Security for Insurers

Last updated: 31 December 2020

Save Share

Quick Summary

The Insurance Regulatory and Development Authority of India (IRDAI) has updated its Information and Cyber Security Guidelines for insurers. These amendments focus on enhancing the Vulnerability Assessment and Penetration Testing (VAPT) process for ICT infrastructure and applications, introducing more frequent testing cycles and stricter timelines for closing identified security gaps. Additionally, the guidelines clarify the procedures and frequency for conducting annual Information System Audits and closing any audit-related gaps.

Insurance Regulatory and Development Authority of India Ref. No: IRDA/IT/CIR/MISC/301/12/2020 Date:30-12-2020 Amendments to the Guidelines on Information and Cyber Security for Insurers dated 07.04.2017 To All insurers, Re:Amendments to the Guidelines on Information and Cyber Secur

Daily Limit Reached

You have reached your daily limit of 2 Free Notice & Circular

Subscribe to CCI PRO for unlimited access

Why Upgrade to CCI PRO?

No Ads
WhatsApp Broadcasts
Daily E-Newsletter
Unlimited Notice & Circular Access

BEST VALUE

2 YEAR PLAN

3,499

(Inclusive of GST)

1 YEAR PLAN

1,999

(Inclusive of GST)

View all CCI PRO benfits

Already a PRO member? Login here for an ad-free experience.

FAQ :

The amendments primarily concern the frequency and procedure for Vulnerability Assessment and Penetration Testing (VAPT) of ICT infrastructure and applications, as well as the process and timelines for closing identified audit gaps.

VAPT of the entire ICT infrastructure must be conducted annually. Critical applications require annual VAPT, while other applications need it once every two years. Internet-facing applications and infrastructure components must be tested at least every six months.

Gaps in critical applications must be closed within one month, and in other applications within two months. For internet-facing applications and infrastructure, external black box penetration testing and closure must be done within one month. Gaps from internal scans should be closed immediately.

An Assurance Audit must be carried out annually for every financial year by a qualified external systems auditor.

The outer time limit for closing audit gaps is two months from the completion of the Annual Assurance Audit, though insurers are encouraged to close gaps as soon as they are identified.

If any high-risk VAPT issue is not resolved within the prescribed timeline, the matter should be reported to the Risk Management Committee of the Board for deliberation and guidance.

Guest

Notification No : Ref. No: IRDA/IT/CIR/MISC/301/12/2020
Published in Miscellaneous
Source : https://www.irdai.gov.in/ADMINCMS/cms/whatsNew_Layout.aspx?page=PageNo4315&flag=1

Share Report Abuse

Comments