INDUSTRY FACT FILE · INSURANCE

Cybersecurity FAQs for Insurers and Reinsurers

Forty frequently asked questions and answers in five categories, written for Boards, ISRMC members, CXOs, CISOs, claims, compliance and technology teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: IRDAI 2026 guidelines, audit and compliance 3.  Category 3: Applications, partners and claims 4.  Category 4: SOC, incident response and resilience 5.  Category 5: Cloud, privacy, data and emerging technology

Audience: Boards, ISRMC members, CEOs and CISOs

Q1. Why is cybersecurity critical for insurers?

Insurers hold highly sensitive health, financial and personal data and run time-critical claims services. Breaches harm policyholders, interrupt claims and attract regulatory action. IRDAI's 2026 guidelines make cybersecurity a quarterly governance responsibility.

Q2. What are the biggest cyber risks for insurers?

Ransomware, health and personal data leakage, claims fraud with cyber elements, policyholder scams, payout diversion, BEC, TPA and partner compromise, cloud misconfiguration and slow detection.

Q3. What is the ISRMC and how often must it meet?

The Information Security Risk Management Committee oversees information and cyber security risk; under the 2026 guidelines it meets at least quarterly.

Q4. Where should the CISO sit?

The 2026 guidelines require the CISO to have no direct reporting line to the Head of IT and no business targets.

Q5. How should security exceptions be approved?

The 2026 guidelines set tiered approvals—CISO for short exceptions, ISRMC for up to a year and the Board beyond a year—with reassessment of long-running exceptions.

Q6. What should the Board see?

Compliance status against the 2026 guidelines, audit findings and closure, PT results, incidents and root causes, SOC performance, partner risks and BCP/DR results.

Q7. Do the guidelines apply to agents and POSPs?

Agents, POSPs and individual surveyors are outside the direct scope, but insurers must ensure they follow a minimum security framework under the insurer's Board-approved policy.

Q8. How can Codec Networks help?

Codec Networks provides gap assessments and audit support against IRDAI's 2026 guidelines, six-monthly external PT, managed SOC, privacy programmes, cloud reviews, ransomware resilience testing, claims-fraud forensics and incident exercises.

Audience: Compliance, internal audit and CISOs

Q9. When were the 2026 guidelines issued?

IRDAI issued the revised Information and Cyber Security Guidelines on 6 April 2026, replacing the 2023 guidelines, with compliance required from the current financial year.

Q10. Who is covered?

Insurers, Foreign Reinsurance Branches (on a comply-or-explain basis) and intermediaries such as brokers, corporate agents, web aggregators and TPAs.

Q11. What audit is required?

An annual audit by an independent assurance team, presented to the Audit Committee, Risk Management Committee or Board as applicable, with the auditor rotated every three years.

Q12. When must audit reports be submitted?

Insurers submit audit reports to IRDAI within 90 days of the financial year-end or 30 days of audit completion, whichever is earlier.

Q13. How often is external penetration testing required?

At least once every six months, using grey-box or white-box methods, by a CERT-In empanelled auditor.

Q14. How quickly must incidents be reported?

To CERT-In within six hours of detection, with copies to IRDAI and other relevant regulators.

Q15. How should audit gaps be handled?

Track gaps to closure with Board oversight; reported summaries indicate closure is expected within defined timelines, so maintain a remediation tracker and evidence.

Q16. Can Codec Networks perform the external PT?

Yes. Codec Networks is CERT-In empanelled and performs grey- and white-box external penetration testing and supports independent audits.

Audience: CIOs, digital, claims and partnership teams

Q17. What should insurance application testing cover?

Customer portals and apps, agent and partner portals, issuance and payment flows, servicing and payout changes, claims workflows and backend APIs.

Q18. How should partner APIs be secured?

Strong authentication, object-level authorisation, data minimisation, rate limiting, monitoring and regular testing, with security obligations in partner agreements.

Q19. How do we protect against payout diversion?

Cooling periods and alerts after payout-detail changes, verification of surrenders and refunds, and monitoring for unusual payout patterns.

Q20. How should TPAs and hospitals be assessed?

Assess their portals, interfaces and data handling, require security and right-to-audit clauses and monitor their access to insurer systems.

Q21. How can claims fraud be detected?

Combine document-tamper checks, link analysis across claimants, providers and accounts, anomaly detection and forensic audits.

Q22. What about legacy policy systems?

Inventory them, segment them, restrict and monitor access, apply compensating controls and include them in VAPT and audits.

Q23. How do we fight fake helplines and scams?

Monitor for impersonation, take down fakes quickly, publish official contact channels and educate policyholders.

Q24. How should vendor privileged access be controlled?

The 2026 guidelines require vendors not to gain privileged access without close supervision and monitoring; use just-in-time access and session recording.

Audience: SOC, incident response, operations and BCP teams

Q25. Do insurers need a SOC?

Continuous monitoring is essential to meet the six-hour reporting requirement; many insurers use managed or co-managed SOC services.

Q26. What should the SOC monitor?

Critical systems, portals, claims and payout systems, privileged and vendor access, data exports and fraud signals.

Q27. What should incident response plans include?

Classification, roles, escalation, containment, recovery, evidence preservation, communication with policyholders and partners, and reporting to CERT-In and IRDAI within six hours.

Q28. How often must BCP and DR be tested?

At least annually under the 2026 guidelines, using realistic disaster scenarios, with results reported to the ISRMC.

Q29. How should insurers prepare for ransomware?

Segment critical systems and medical data, isolate and test backups, monitor endpoints 24x7 and rehearse a ransomware scenario end to end.

Q30. Can the CISO engage external forensic experts?

Yes; the 2026 guidelines allow the CISO to engage externally certified forensic experts for investigations.

Q31. How long must logs be retained?

CERT-In requires ICT logs for a rolling 180 days within India; align internal retention with investigation needs.

Q32. How should tabletop exercises be run?

Involve the Board or ISRMC, claims, operations, communications and partners, using realistic scenarios such as ransomware during peak claims.

Audience: Cloud, data protection and innovation teams

Q33. What cloud requirements apply?

The 2026 guidelines require cloud providers empanelled by MeitY with valid STQC audit status, NDAs covering privacy, security and continuity, and contractual erasure of data on termination.

Q34. What data classification is required?

A four-tier classification with personally identifiable information flagged separately, and labels reviewed at least every two years.

Q35. What encryption is expected?

Confidential information must be encrypted when sent outside the network and when stored on mobile or removable media.

Q36. When do DPDP obligations apply?

The DPDP Rules, 2025 were notified on 13 November 2025 with phased commencement; most obligations take effect in May 2027. The 2026 guidelines require appropriate measures to comply with the DPDP Act.

Q37. Can vendor audits be waived?

Reported summaries indicate periodic vendor audits may be waived where the vendor holds a valid ISO 27001 certification covering the relevant services, subject to self-certification and certificate submission.

Q38. What AI risks should insurers consider?

Model manipulation, bias, data leakage and prompt-injection risks in AI used for underwriting, claims and customer service.

Q39. How do deepfakes affect insurers?

Deepfakes can support fraudulent claims, onboarding or executive impersonation; verification controls and simulations reduce the risk.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your products, partners, systems and audit calendar; Codec Networks will propose a gap assessment against the 2026 guidelines and a testing plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. IRDAI requirements are summarised from reported sources; confirm against the official IRDAI circular.