IRDAI 2023 Cyber Security Guidelines: SOC, VAPT & Reporting

TL;DR — IRDAI's Information and Cyber Security Guidelines, 2023 superseded the 2017/2022 advisories with a unified, governance-driven model for insurers and intermediaries. The operational core: run a SOC / end-to-end monitoring, conduct VAPT at least twice a year (critical findings fixed within 30 days), retain ICT/application logs for 180 days, and report cyber incidents to IRDAI and CERT-In within 6 hours. An annual audit by a CERT-In-empanelled auditor is required.

For an insurer, the IRDAI guidelines — not a global SIEM vendor's datasheet — are what an audit measures. And unlike much compliance writing, these guidelines are refreshingly concrete about monitoring, testing cadence and timelines, which makes them straightforward to operationalise if you build to them deliberately.

The operational mandates

• SOC / continuous monitoring with end-to-end log visibility
• Log retention of 180 days (rolling) for ICT and application logs
• VAPT at least twice yearly, critical findings remediated within 30 days
• 6-hour incident reporting to IRDAI and CERT-In
• Annual cybersecurity audit via a CERT-In-empanelled auditor
• Board-approved policy, CISO, and a cyber-crisis management plan

The 180-day log retention detail

The 180-day rolling retention requirement is specific and testable. It means your monitoring platform must retain searchable ICT and application logs for six months — a policy question that gets expensive fast on per-GB SIEM pricing, and a residency question under the DPDP framework.

Mapping the guidelines to controls

Frequently asked questions

Does IRDAI apply to intermediaries, not just insurers?

Yes — the 2023 guidelines extend to insurers and licensed intermediaries. Scope varies with size and role; we'll map it to your registration.

Can continuous VA replace the twice-yearly VAPT?

No — they're complementary. Continuous VA keeps exposure visible day-to-day; the formal twice-yearly VAPT is a distinct, deeper assessment IRDAI requires. Ayati One provides the first; our VAPT practice delivers the second.

How does IRDAI relate to the DPDP Act for insurers?

They stack. IRDAI governs your sectoral obligations; the DPDP Act & Rules 2025 govern personal data and breach notification across all sectors.

Meeting IRDAI's 2023 guidelines? Talk to our SOC engineers about a managed SOC with 180-day retention and the 6-hour clock covered, at flat per-asset pricing.