Formation of Committee to Review IRDAI’S Information & Security Guidelines

Insurance Regulatory and Development Authority of India

Ref. No:IRDA/IT/ORD/MISC/034/02/2021

Date:24-02-2021

ORDER

FORMATION OF COMMITTEE TO REVIEW IRDAI’S INFORMATION & SECURITY GUIDELINES

The economic situation owing to COVID-19 pandemic has seen an exponential increase in cyber-attacks across the globe and in particular, the financial sector. This situation has necessitated Regulators to re-look into their Cyber Security Guidelines applicable to all regulated entities in an effort to protect the financial systems. IRDAI issued Guidelines on Cyber Security vide IRDA/IT/GDL/MISC/082/04/2017 Dt. 7th Apr, 2017 as a part of Governance mechanism, which amongst other requirements mandate:

1. Information Security Committee (ISC)

2. Board approved Information & Cyber Security Policy

3. Appointment of Chief Information Security Officer (CISO),

4. Cyber Crisis management plan (CCMP)

Apart from the above, the Guidelines mandate that the Insurers’ Risk Management Committee should be responsible for an Annual Comprehensive Assurance audit including conducting of Vulnerability Assessment & Penetration Test (VA&PT) and should report the findings to IRDAI.

In the light of Cyber Attacks which the financial sector has been witnessing and in the process of having a structured reporting to analyse the issues to be addressed in a holistic manner at the Industry level, it is considered necessary to review IRDAI’s Information & Cyber security Guidelines inter alia, for the following:

1. Whether to extend the applicability of Guidelines for insurers to other entities, which are regulated by IRDAI, with or without modification.

2. Whether and how to apply the Guidelines to the extent applicable to entities which access Insurers IT Systems.

3. How to ascertain that minimum Security Standards are followed by those entities which access Insurers IT Systems, though those are not regulated by IRDAI.

4. Whether to update the Guidelines to cover Cyber Security issues in Fintech Solutions, Mobile based applications, Work from Remote location and Cloud Sourcing.

5. To address base-line requirements for Critical Information Infrastructures (CIIs) to sync with NCSI (National Security Council of India) Guidelines.

6. To specifically address applicability of Guidelines for foreign Re-insurance branches (FRBs) which have interface with overseas parent Companies and other Global re-insurers.

7. To prepare a Comprehensive Audit Checklist and Certification model

To deliberate on the above and to submit concrete recommendations, the following committee is hereby constituted:

Prof. Janakiram – Director, IDRBT, Chairman

Prof H. Krishnamurthy, Formerly Chief Research Scientist, IISc., Bangalore, Member

Prof G. Sivakumar, IIT, Mumbai – Member

Mr. Vital Raj, CA, CISA – Member

Mr. Vinayak Godse, Vice President, Data Security Council of India – Member

Mr. Dayanivas Sharma, Vice Chairman, ICAI, Member

Mr.V.Vijayakumar, CA, CISA – Member

Mr. Sunder Krishnan, Chief Risk Officer, CISA Reliance Life – Member

Mr. Venkata Krishnan, ACA –Member

Mr. S.N. Jayasimhan- General Manager, IRDAI – Member

Mr. Jayakumar- General Manager,CISO, IRDAI – Member

Mr. Sachin Jadhav CTO/CIO, Edelweiss Life Ins. Co., Ltd.- Member

Mr. Siddharth Bhat, CTO/CIO, Aditya Birla Health Ins. Co., Ltd.

Mr. Saurabh Chatterjee, CTO/CIO, Bajaj Allianz General Ins. Co., Ltd

Mr. AR Nithiyanantham, CGM-IT, IRDAI shall be Member Convenor of the Working Group. The Committee shall submit its report in 2 months.

This is issued with the approval of the Competent Authority.

 Sd/-
MEMBER (LIFE)