IRDAI 2026 Cybersecurity Guidelines for Insurance Companies

The post summarizes IRDAI's 2026 cybersecurity guideline updates for insurers, marking a shift from static compliance to continuous cyber resilience. Key changes include expanded board and CISO responsibilities, separation of CISO from IT, introduction of an IT Steering Committee, removal/merging of certain roles and committees, mandatory external cybersecurity experts, an exception management framework, stricter audit and reporting timelines, and enhanced technical controls (regular penetration testing, infrastructure segregation, MeitY-empaneled cloud use, cryptographic inventory, immutable backups). The article concludes with a practical compliance checklist for insurers to align with the new requirements.