INDUSTRY FACT FILE · INSURANCE INTERMEDIARIES

Cybersecurity FAQs for Insurance Intermediaries and Insurtechs

Forty frequently asked questions and answers in five categories, written for founders, principal officers, CXOs, CISOs, compliance, engineering and claims teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: IRDAI 2026 guidelines, audit and compliance 3.  Category 3: Platforms, APIs and claims 4.  Category 4: SOC, incident response and resilience 5.  Category 5: Cloud, vendors, privacy and AI

Audience: Founders, Boards, principal officers and CISOs

Q1. Why is cybersecurity critical for intermediaries?

Intermediaries hold customer identity, health and payment data and connect directly to insurers' systems. A breach harms customers, triggers regulatory reporting and can cost insurer partnerships.

Q2. What are the biggest cyber risks for intermediaries?

Customer data leakage, broken API authorisation, phishing and brand impersonation, premium diversion and BEC, ransomware, distributor credential theft, vendor compromise and slow detection.

Q3. Do IRDAI's cyber guidelines apply to us?

IRDAI's 2026 guidelines apply to intermediaries including insurance brokers, corporate agents, web aggregators and TPAs, with compliance required from the current financial year.

Q4. Do the guidelines apply to agents and POSPs?

Individual agents, POSPs and surveyors are outside the direct scope, but insurers must ensure they follow a minimum security framework. Intermediaries working with POSPs should apply similar controls.

Q5. Why do insurers send us security questionnaires?

Insurers remain accountable for policyholder data they share and assess intermediaries as third parties. Audit reports and test evidence answer most of these questions.

Q6. What should leadership review regularly?

Audit findings and closure, PT results, incidents, SOC performance, vendor risks, insurer partner requirements and DPDP readiness.

Q7. How much should a small intermediary invest?

Start with an audit and gap assessment, six-monthly external PT, MFA everywhere and a tested incident plan; then add managed monitoring as the business grows.

Q8. How can Codec Networks help?

Codec Networks provides cyber audits against IRDAI's 2026 guidelines, six-monthly external PT, API and platform testing, claims platform testing, vendor risk assessments, managed SOC and incident response.

Audience: Principal officers, compliance and audit teams

Q9. When were the 2026 guidelines issued?

IRDAI issued the revised Information and Cyber Security Guidelines on 6 April 2026, replacing the 2023 guidelines.

Q10. Who must perform our cyber audit?

Published summaries indicate audits by CERT-In empanelled auditors. Confirm the exact eligibility for your category against the official circular.

Q11. When is the compliance report due?

Published summaries indicate compliance reports within 30 days of audit completion. Confirm the recipient and format for your category against the circular.

Q12. How often is external penetration testing required?

At least once every six months, using grey-box or white-box methods, by a CERT-In empanelled auditor.

Q13. How quickly must incidents be reported?

CERT-In requires reporting within six hours of noticing an incident; insurer contracts typically require prompt notification as well.

Q14. Does an ISO 27001 certificate replace the IRDAI audit?

No. ISO 27001 supports good governance and some vendor-audit waivers, but it does not replace the audit and testing required under the guidelines.

Q15. How should audit gaps be handled?

Prioritise by risk, assign owners and deadlines, retest fixes and keep evidence for IRDAI, insurers and the next audit.

Q16. Can Codec Networks perform our audit and PT?

Yes. Codec Networks is CERT-In empanelled and performs cyber audits and grey- and white-box external penetration testing.

Audience: CTOs, engineering, product and claims teams

Q17. What should platform testing cover?

Websites, mobile apps, distributor and POSP portals, e-KYC and onboarding, payment flows, customer servicing and every API that connects to insurers.

Q18. What is the most common API flaw?

Broken object-level authorisation—an API checks that a user is logged in but not that the record belongs to them—which can expose every customer.

Q19. How do we stop scraping of lead and quote data?

Rate limiting, bot detection, authentication for sensitive endpoints, minimal responses and monitoring for unusual query patterns.

Q20. How should TPAs secure claims platforms?

Test portals and hospital interfaces, control document uploads, encrypt and classify medical data, segment claims servers and monitor 24x7.

Q21. How do we protect distributor logins?

MFA, device binding, session limits, monitoring of downloads and issuance, and prompt offboarding of inactive distributors.

Q22. How do we prevent premium diversion?

Verify bank-detail changes by call-back on known numbers, enforce DMARC, protect finance mailboxes with MFA and train client-facing teams.

Q23. How often should we test after releases?

Test major releases and new APIs before go-live, and integrate security testing into the development pipeline.

Q24. What about embedded insurance partners?

Assess partner platforms that collect insurance data, define security obligations in contracts and test shared APIs.

Audience: IT, SOC, operations and incident response teams

Q25. Do intermediaries need a SOC?

Continuous monitoring is the practical way to meet the six-hour reporting requirement; managed SOC services suit most intermediaries.

Q26. What should the SOC monitor?

Internet-facing systems, APIs, email, privileged and vendor access, distributor activity, data exports and fraud signals.

Q27. What should incident response plans include?

Roles, escalation, containment, recovery, evidence preservation, CERT-In reporting within six hours and notification to every affected insurer partner.

Q28. How should TPAs prepare for ransomware?

Patch internet-facing systems, isolate and test backups, monitor endpoints 24x7 and rehearse a scenario covering all insurer clients.

Q29. How long must logs be retained?

CERT-In requires ICT logs for a rolling 180 days within India; align retention with investigation needs.

Q30. Should we run tabletop exercises?

Yes. Exercises involving leadership, technology, operations and communications reveal gaps before a real incident.

Q31. What do insurers expect after an incident?

Prompt notification, containment details, root-cause analysis, remediation evidence and, often, an independent review.

Q32. When should we call in forensics?

As soon as compromise is suspected—early forensic support preserves evidence and speeds root-cause analysis.

Audience: Cloud, data protection, vendor management and innovation teams

Q33. What cloud requirements apply?

The 2026 guidelines require cloud providers empanelled by MeitY with valid STQC audit status and contractual erasure of data on termination.

Q34. What should vendor contracts include?

Security obligations, right-to-audit, approval for sub-outsourcing, incident notification and data return or erasure on exit.

Q35. How should vendor privileged access be managed?

Vendors should not gain privileged access without close supervision; use just-in-time access, session recording and regular reviews.

Q36. When do DPDP obligations apply?

The DPDP Rules, 2025 were notified on 13 November 2025 with phased commencement; most obligations take effect in May 2027.

Q37. What data should we minimise?

Collect and return only what each journey needs—especially health details, identity documents and bank data—and delete it when no longer required.

Q38. What AI risks should insurtechs consider?

Prompt injection, data leakage, misleading answers and excessive data access by AI assistants.

Q39. How should AI assistants be secured?

Test them before launch, give them least-privilege data access, filter outputs, monitor conversations and include them in incident playbooks.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your licence type, platforms, insurer partners and audit calendar; Codec Networks will propose an audit and testing plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. IRDAI requirements are summarised from reported sources; confirm against the official IRDAI circular.