Insurance Regulatory and Development Authority of India.
Ref. No: IRDA/IT/ORD/MISC/034/02/2021
FORMATION OF COMMITTEE TO REVIEW IRDAI’S INFORMATION & SECURITY GUIDELINES
The economic situation owing to COVID-19 pandemic has seen an exponential increase in cyber-attacks across the globe and in particular, the financial sector. This situation has necessitated Regulators to re-look into their Cyber Security Guidelines applicable to all regulated entities in an effort to protect the financial systems. IRDAI issued Guidelines on Cyber Security vide IRDA/IT/GDL/MISC/082/04/2017 Dt. 7th Apr, 2017 as a part of Governance mechanism, which amongst other requirements mandate:
1. Information Security Committee (ISC)
2. Board approved Information & Cyber Security Policy
3. Appointment of Chief Information Security Officer (CISO),
4.Cyber Crisis management plan (CCMP)
Apart from the above, the Guidelines mandate that the Insurers’ Risk Management Committee should be responsible for an Annual Comprehensive Assurance audit including conducting of Vulnerability Assessment & Penetration Test (VA&PT) and should report the findings to IRDAI.
In the light of Cyber Attacks which the financial sector has been witnessing and in the process of having a structured reporting to analyse the issues to be addressed in a holistic manner at the Industry level, it is considered necessary to review IRDAI’s Information & Cyber security Guidelines inter alia, for the following:
1. Whether to extend the applicability of Guidelines for insurers to other entities, which are regulated by IRDAI, with or without modification.
2. Whether and how to apply the Guidelines to the extent applicable to entities which access Insurers IT Systems.
3. How to ascertain that minimum Security Standards are followed by those entities which access Insurers IT Systems, though those are not regulated by IRDAI.
4. Whether to update the Guidelines to cover Cyber Security issues in Fintech Solutions, Mobile based applications, Work from Remote location and Cloud Sourcing.
5. To address base-line requirements for Critical Information Infrastructures (CIIs) to sync with NCSI (National Security Council of India) Guidelines.
6. To specifically address applicability of Guidelines for foreign Re-insurance branches (FRBs) which have interface with overseas parent Companies and other Global re-insurers.
7. To prepare a Comprehensive Audit Checklist and Certification model
To deliberate on the above and to submit concrete recommendations, the following committee is hereby constituted:
Prof. Janakiram – Director, IDRBT, Chairman
Prof H. Krishnamurthy, Formerly Chief Research Scientist, IISc., Bangalore, Member
Prof G. Sivakumar, IIT, Mumbai – Member
Mr. Vital Raj, CA, CISA – Member
Mr. Vinayak Godse, Vice President, Data Security Council of India – Member
Mr. Dayanivas Sharma, Vice Chairman, ICAI, Member
Mr.V.Vijayakumar, CA, CISA – Member
Mr. Sunder Krishnan, Chief Risk Officer, CISA Reliance Life – Member
Mr. Venkata Krishnan, ACA –Member
Mr. S.N. Jayasimhan- General Manager, IRDAI – Member
Mr. Jayakumar- General Manager,CISO, IRDAI – Member
Mr. Sachin Jadhav CTO/CIO, Edelweiss Life Ins. Co., Ltd.- Member
Mr. Siddharth Bhat, CTO/CIO, Aditya Birla Health Ins. Co., Ltd.
Mr. Saurabh Chatterjee, CTO/CIO, Bajaj Allianz General Ins. Co., Ltd
Mr. AR Nithiyanantham, CGM-IT, IRDAI shall be Member Convenor of the Working Group. The Committee shall submit its report in 2 months.
This is issued with the approval of the Competent Authority.