For insurance brokers, corporate agents & intermediaries

IRDAI Compliance, Cyber Audit & Technology

One partner to keep your broking firm compliant, audit-ready and running on secure, modern technology.

Book your free compliance check Explore services

IRDAI Cyber Audit Ready · 3 min 25 sec

01

Regulatory Compliance

IRDAI returns, renewals, ISNP, DPDP Act, ROC, tax and GST

Details 02

Cyber Security Audit

Annual IRDAI audit, VAPT, policies and dark pattern review

Details 03

Web & Software

Compliant websites, ISNP portals, broker CRM and apps

Details
Who we are

Your compliance, cyber and tech partner

We work with IRDAI-regulated intermediaries across India, handling the filings, the audit preparation and the technology, so your team can focus on clients and insurers.

Who we help

  • Direct, reinsurance and composite brokers
  • Corporate agents and web aggregators
  • ISNP and other intermediaries
  • Corporates and B2B merchants

Why clients choose us

  • Dedicated IRDAI, legal, tax, audit and IT teams
  • One partner for compliance, cyber and tech
  • You share a few details, we do the rest
  • Practical pricing, sized to your business

Why this matters to your business

01Insurer partnersInsurers ask for a current cyber audit report before they continue business.
02Regulatory actionMissed returns or gaps can lead to penalties or action on your registration.
03DPDP Act, 2023Weak data safeguards can attract penalties of up to ₹250 crore.
04Incident reportingCERT-In expects cyber incidents to be reported within 6 hours.
05Fraud in your nameEmail and domain security stops most fake emails and websites.
The 2023 rule

One cyber security standard for every insurance intermediary

IRDAI Information and Cyber Security Guidelines, 2023

Ref IRDAI/GA&HR/GDL/MISC/88/04/2023 · dated 24 April 2023 · replaces the 2017, 2020 and 2022 cyber circulars

Brokers Corporate Agents Web Aggregators ISNP TPAs IMFs

The audit checks five things

Identify

Do you know what data, devices and software you have, and the risks to them?

Protect

Are access, passwords, encryption and backups in place?

Detect

Would you notice unusual access or an attack quickly?

Respond

Is there a plan to contain an incident and report it on time?

Recover

Can you restore systems and data from tested backups?

Also covered: Work From Remote Location requirements and the IT Rules, 2021.

What IRDAI expects

6 hours

to report a cyber incident to CERT-In

180 days

of logs retained

India

for storing logs and critical data

MFA

on every account

Brokers with a website also need a privacy policy and a grievance officer who acknowledges complaints within 24 hours.

Which type are you?

Three kinds of broker, three levels of controls

Type 1

Customer data kept online

The essentials:

  • Strong passwords and MFA
  • Encryption of customer data
  • Need-based access
  • Tested backups
  • 180-day logs stored in India
Type 2

Data online plus a website

Everything in Type 1, plus:

  • Website VAPT
  • Web application firewall
  • Secure email (SPF, DKIM, DMARC)
  • Website backups and reviewed updates
  • Privacy policy and a grievance officer
Type 3

Selling online through an ISNP

Always Category 1 — the strictest level, whatever your revenue

Everything in Type 2, plus:

  • Penetration testing at least every 6 months
  • A designated CISO
  • SOC and SIEM monitoring
  • Red team exercises
  • Board-approved policies
  • Backup restore tests twice a year

The three types at a glance

RequirementType 1Type 2Type 3 (ISNP)
Data protection and MFA
Penetration testingYearlyYearlyHalf-yearly
Website security (VAPT, WAF)
IT Rules, 2021 duties
SOC / SIEM monitoring
Designated CISO

A simplified guide. The exact scope depends on your IRDAI revenue category.

Service 01 · Regulatory compliance

Every IRDAI filing, on time

Licence, returns, governance and data protection for your broking firm, tracked on one calendar with reminders before every due date.

01Registration and renewalNew broker licence and renewal · category change · ISNP approval · Principal Officer and director changes
02Returns and filingsQuarterly, half-yearly and annual returns · net worth and capital certificates · shareholding filings
03Internal audit and governanceInternal audit · Board policies and code of conduct · grievance redressal · AML, KYC and outsourcing policies
04DPDP Act, 2023Personal data mapping · consent and privacy notices · retention rules · breach response
05Dark pattern assessmentWebsite and app review under the CCPA Dark Patterns Guidelines, 2023, with written findings and fixes
06Corporate, tax and accountsROC and secretarial · rights issues · Income Tax, TDS and GST · accounting and due diligence
RetainerOne annual fee covers your returns, filings, Board documents and reminders.
Service 02 · Cyber security audit

Audit-ready, end to end

Your annual audit under the IRDAI Information and Cyber Security Guidelines, 2023, from the first gap check to the report your insurers receive.

01Gap assessmentCheck against the IRDAI guidelines · inventory of devices, data and software · risk register
02Policies and Board documentsSecurity and cyber crisis policies · incident response, backup and BCP · CISO appointment
03Technical review and VAPTWebsite and server testing · SSL, hosting and admin access · laptop security
04Email and domain securitySPF, DKIM and DMARC · two-factor login · anti-spoofing and phishing protection
05Vendors and data flowsRemote-access review · NDAs and vendor records · secure data sharing with insurers
06Dark pattern assessmentWebsite and app review under the CCPA Dark Patterns Guidelines, 2023 · false urgency, pre-ticked boxes, hidden charges
07Incident readinessCERT-In 6-hour reporting procedure · 180-day log retention · contact sheet
08Audit and certificationAudit with a qualified auditor · closure of findings · report to your insurers
You receiveAudit report for insurers · ready-to-sign policies · gap list with fixes · dark pattern report.

How the audit works, step by step

  1. 1

    Free discovery call

    A short questionnaire — data online, website, ISNP, revenue — tells you your type and category (e.g. “Type 2 · Category 2”).

  2. 2

    Gap assessment

    A clear report of what is in place and what is missing, such as a cyber security policy, incident response plan or tested backup restore.

  3. 3

    We draft your policies

    Ready for your review and Board approval.

    Cyber Security Policy
    Cyber Risk Management
    BCP and DR Plan
    Incident Response and Crisis Plan
    Access Control and Passwords
    Data Retention and Disposal
    Patch Management
    Vendor Security
    Work From Remote
  4. 4

    Independent cyber audit

    As IRDAI requires, we don't rely on management's word alone: interviews, document checks and control testing.

  5. 5

    Your certificate, in IRDAI's format

    Certificate on Cyber Security Controls (Annexure V format) with a Compliant / Not compliant / Not applicable summary — plus VAPT reminders, gap-closure tracking and next year's audit.

Service 03 · Web & software

Technology built for brokers

Websites, portals and software made for insurance broking, built secure from day one so they help you grow and pass your cyber audit.

01IRDAI-compliant websiteRegistration details · Principal and Grievance Officer · privacy policy and consent · mobile-friendly and SSL secured
02ISNP and sales portalQuote comparison and purchase · insurer integrations · payment gateway · DPDP-ready consent
03Broker CRMLeads, clients and policies in one place · renewal reminders · brokerage tracking · exports for IRDAI returns
04Claims and serviceClaim tracking · secure document vault · WhatsApp, SMS and email updates · customer portal
05POSP managementOnboarding · training and certification records · sales and payout dashboards
06Apps, hosting and supportAndroid and iOS apps · secure hosting with daily backups · monitoring and annual maintenance
One teamThe same team audits and builds, so gaps found in your audit are fixed directly.
Our process

Six steps to audit-ready

From first call to final report. Most of the effort is on our side.

01

Understand

We check which IRDAI, DPDP and cyber rules apply to you.

02

Review

We assess your filings, website, email and systems.

03

Prepare

We draft every policy, return and Board document.

04

Fix

Our tech team closes the gaps, or works with your IT vendor.

05

Assess

We review your website and app for dark patterns.

06

Certify and file

We coordinate the audit, submit reports and file returns.

Choose what you need

Service

Compliance

IRDAI returns and filings, DPDP Act, governance, ROC, tax and GST.

Service

Cyber Audit

Annual IRDAI cyber audit, VAPT, policies and dark pattern review.

Recommended

Complete Package

Compliance, cyber audit and web and software support under one yearly plan.

FAQs

Common questions

Who must follow the IRDAI Information and Cyber Security Guidelines, 2023?+

All IRDAI-regulated entities, including insurance brokers, corporate agents, web aggregators, ISNPs, TPAs and IMFs. The guidelines (Ref IRDAI/GA&HR/GDL/MISC/88/04/2023, dated 24 April 2023) replace the earlier 2017, 2020 and 2022 cyber circulars.

How quickly must a cyber incident be reported?+

Cyber incidents must be reported to CERT-In within 6 hours of noticing them. Logs must be kept for 180 days and stored in India.

Does selling policies through an ISNP change my obligations?+

Yes. Selling online through an ISNP puts you in the strictest level (Category 1) regardless of revenue, adding half-yearly penetration testing, a designated CISO, SOC/SIEM monitoring, red team exercises and twice-yearly backup restore tests.

What do I receive at the end of the cyber audit?+

An audit report for your insurers, ready-to-sign policies, a gap list with fixes, a dark pattern report and a Certificate on Cyber Security Controls in IRDAI's format.

Don't wait for an IRDAI notice or a data breach.

Let's talk

A 15-minute call is enough to tell you what applies and what it will cost.

Book your free compliance check

Yogesh Naatani

Compliance & Regulatory Consultant

Yogesh Natani & Associates