IRDAI - Circular on Cyber Incident or Crisis Preparedness, 2025
AI / PRIVACY / CYBER RELEVANCE
Sets the insurance sector's cyber-incident clock and forensic-readiness rules, directly relevant to breaches of policyholder data and AI or cloud systems used by insurers.
AI: ContextualPrivacy: HighCybersecurity: Very High
READ FIRST
- Paragraph 2(a) - 6-hour cyber incident reporting to IRDAI (Policy 2.10, para 3.5)
- Paragraph 2(b) - 180-day log retention and NTP synchronisation (Policy 2.16)
- Paragraphs 2(c)-(e) - Cyber Crisis Management Plan, forensic investigation and CERT-In directions
- Paragraphs 4 and 5 - pre-empanelled forensic auditors and the conflict-of-interest bar
- Paragraph 6 - Board placement and filing of minutes
PURVIEW
Reiterates the cyber-incident provisions of the IRDAI Information and Cyber Security Guidelines, 2023 and adds new forensic-readiness duties. Regulated entities must report cyber incidents to IRDAI within 6 hours of noticing them; maintain and monitor ICT and application logs for a rolling 180 days with clocks synchronised to NIC or NPL NTP servers; keep a Cyber Crisis Management Plan; perform forensic investigation of severe incidents; and follow CERT-In's 28 April 2022 directions, including incident reporting. New requirements: forensic auditors must be empanelled in advance so they can be onboarded without delay, and the vendor running the SOC, attack-surface monitoring, red teaming or the annual assurance audit may not act as forensic auditor, to avoid conflict of interest. Compliance must be placed before the Board and the minutes filed with IRDAI. Where an incident is also a personal data breach, the separate intimation duties under Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules apply in parallel.
Classification and legal status. Circular IRDAI/GA&HR/CIR/MISC/49/03/2025 dated 24 March 2025 to all Regulated Entities, reiterating and supplementing the IRDAI Information and Cyber Security Guidelines, 2023.