ISO 27001 Under IRDAI's
2026 Cyber Guidelines

Issued on 6 April 2026, they are IRDAI's revised cybersecurity rulebook for the insurance sector, replacing the 2023 guidelines. They apply to insurers, Foreign Reinsurance Branches, and insurance intermediaries. Headline changes: DPDP Act compliance is mandated as part of security obligations, cyber incidents must be reported to CERT-In within six hours (copy to IRDAI), compliance is scored by CERT-In-empanelled auditors against the 347-control Annexure III report structured on NIST CSF functions, and vendor oversight is formalized — including an ISO 27001-based audit waiver.

The provision insurers and their vendors should both know: if a vendor holds a valid ISO 27001 certification covering the scope of the services provided, the insurer may waive periodic vendor audits — subject to the vendor's self-certification and submission of valid certificate copies. For vendors selling into the insurance sector (TPAs, SaaS providers, BPOs, ITeS), a correctly scoped ISO 27001 certificate is now a direct substitute for repeated customer audits — provided the certificate's scope statement actually covers the services delivered.

No — and treating it that way is the classic mistake. The guidelines are assessed via the Annexure III audit by CERT-In-empanelled firms against IRDAI's own 347 controls, and they include obligations an ISMS does not generate by itself (DPDP duties, IRDAI reporting flows, sector-specific categories like Work From Remote Location and the IGDM Rules). What ISO 27001 does: it builds and evidences the security machinery most Annexure III lines score, so the audit becomes a mapping exercise instead of a scramble.

So that the services you deliver to the insurer sit unambiguously inside the certificate's scope statement. The waiver turns on "covering the scope of the services provided" — a certificate scoped to your head-office ISMS while the insurer's workload runs from a different delivery center or cloud environment will not survive scrutiny. State the service, the locations, and the platforms; keep the scope statement current at surveillance audits; and be ready to share the certificate and Statement of Applicability on request.

The six-hour CERT-In clock (with copies to IRDAI) is faster than most incident-response procedures assume, and it also exists independently under CERT-In's 2022 directions. Inside the ISMS, that means A.5.24–A.5.26 procedures with detection-to-classification-to-notification timelines rehearsed against the clock, an on-call reporting owner, pre-drafted notification templates, and log retention that supports rapid triage (A.8.15). Auditors — IRDAI's and yours — increasingly ask for evidence of a drill, not just a procedure.

Run a delta assessment of the 2026 guidelines against your current posture: map existing ISMS evidence to the Annexure III control lines, inventory vendors and collect/verify their ISO 27001 certificates against service scopes (activating the waiver where legitimate), rehearse the 6-hour reporting flow, and fold DPDP obligations into the compliance calendar ahead of enforcement. We run this as a combined ISO 27001 × IRDAI gap engagement — one assessment, both instruments.