Guides ·
IRDAI Information and Cyber Security Guidelines, 2026 on AWS: a control map for insurers
On 6 April 2026 IRDAI issued the IRDAI Information and Cyber Security Guidelines, 2026 (circular IRDAI/GA&HR/CIR/MISC/51/4/2026), replacing its April 2023 guidelines.
By Upvantix team
On 6 April 2026 IRDAI issued the IRDAI Information and Cyber Security Guidelines, 2026 (circular IRDAI/GA&HR/CIR/MISC/51/4/2026), replacing its April 2023 guidelines. They apply to all insurers, including foreign reinsurance branches (FRBs), and to insurance intermediaries such as brokers, corporate agents, web aggregators and TPAs, along with the Insurance Information Bureau. IRDAI asked them to ensure compliance from the current financial year, which is FY 2026-27.
For cloud, the guidelines' Cloud Security Policy says cloud services shall be taken only from MeitY-empanelled cloud service providers, and the CSP's data centre should hold a valid STQC audit status. Insurers must also sign an NDA with the CSP, and contractually require full data deletion at contract end, data return and no vendor lock-in. The guidelines also require cyber incidents to be reported to CERT-In within 6 hours, with a copy to IRDAI. ICT infrastructure logs must be kept for a rolling 180 days within Indian jurisdiction. Penetration tests must be grey- or white-box, and CERT-In-empanelled auditors carry out the audits and tests. Insurers must also take technical and organisational measures to comply with the DPDP Act.
On AWS, Amazon Web Services India Pvt. Ltd. is on MeitY's empanelled list for cloud services from the Asia Pacific (Mumbai) and Asia Pacific (Hyderabad) Regions. That covers the provider requirement. Everything you build and run on top of it remains your responsibility to configure, operate and evidence.
What changed from the 2023 guidelines
IRDAI's own summary of changes (Annexure A) and the 2026 text include:
- Governance: the Information Security Risk Management Committee (ISRMC) meets at least quarterly. The CISO doesn't report directly to the head of IT and isn't given business targets.
- Exceptions: approval is tiered by duration: the CISO for up to 3 months, the Risk Management Committee (RMC) for longer than 3 months, the Board beyond a year.
- Cloud: CSPs must be MeitY-empanelled with valid STQC audit status. Insurers need an NDA with the CSP and a contractual requirement to erase all data, including backups, at termination.
- Third parties: sub-outsourcing needs the RE's prior written permission.
- Resilience: the annual audit checklist now asks whether immutable backup and failover/resilient components are in place for critical hardware (Annexure III, control 204).
- Testing: external grey- or white-box penetration testing of internet-facing systems every 6 months by a CERT-In-empanelled auditor.
- Crypto: an inventory of cryptographic assets to prepare for post-quantum cryptography.
- DPDP: technical and organisational measures to comply with the Digital Personal Data Protection Act and its rules.
Who the guidelines apply to and when
All insurers, including FRBs, and insurance intermediaries: brokers, corporate agents, web aggregators, TPAs, IMFs, insurance repositories, ISNPs, corporate surveyors, MISPs and CSCs, along with the Insurance Information Bureau of India. Compliance is expected from the current financial year. FRBs may "comply or explain" against the Annexure III checklist. Intermediaries send their audit compliance to the insurers they work with within 30 days of a CERT-In-empanelled audit.
The cloud rules, clause by clause
Section 2.19 (Cloud Security Policy) covers:
- cloud services only from MeitY-empanelled CSPs, with valid STQC audit status for the CSP's data centre
- an NDA covering privacy, confidentiality, security and business continuity
- a service contract that covers the location of storage, primary and secondary data (logs), ownership of data and termination
- SLAs reflecting availability, BCP/DR and backup
- exclusive data ownership, and no use of your data for secondary purposes
- notification of a suspected breach within 4 hours of discovery
- complete elimination of data on disks and backups at termination, sanitisation, return of data and no vendor lock-in
What MeitY actually lists for AWS
MeitY's list of empanelled CSPs (dated 17 Sep 2026) includes Amazon Web Services India Pvt. Ltd.:
- Deployment models: Public Cloud and Virtual Private Cloud, from three data centres each in Mumbai and Hyderabad. It isn't listed for Government Community Cloud.
- Services: Basic and Advanced cloud services. It isn't listed for MeitY's Managed Services category (DR and backup as a service).
- Status: STQC audit status "Audited", with empanelment valid to 31 March 2029. AWS says the Mumbai Region was first fully empanelled in 2017 and Hyderabad in September 2023, and that STQC runs an annual surveillance audit. The empanelment letters are in AWS Artifact.
- Three practical points: 1. The empanelment covers AWS cloud services offered from those two Regions. Workloads, backups or logs in other Regions aren't covered by it.
- 2. The empanelled entity is AWS India. Check which AWS contracting entity your account is with.
- 3. Empanelment covers the provider. Your configuration, access, logging and contracts are still yours to evidence.
Requirement → AWS control → evidence
Check each service's availability in your chosen Region. For example, AWS Audit Manager is available in Mumbai but not Hyderabad.
| Criterion | AWS controls to consider (your side of shared responsibility) | Evidence to keep |
|---|---|---|
| Cloud only from MeitY-empanelled CSP with valid STQC status (2.19) | Use the Mumbai (ap-south-1) and Hyderabad (ap-south-2) Regions. Use an SCP or Control Tower Region deny control to block other Regions. | MeitY list extract (dated); empanelment letters from AWS Artifact; SCP/Region-deny policy export |
| NDA and service contract: location of storage, logs, data ownership, termination (2.19) | AWS agreements and terms; data location fixed by your Region choice | Signed agreement/NDA on file; contract review sign-off by Legal, Compliance and Infosec |
| Delete all data, including backups, at termination; return data; no lock-in (2.19) | Documented exit plan: export (S3, AWS Backup copies), KMS key deletion schedule, resource teardown runbook; AWS media sanitisation described in AWS Artifact reports | Exit runbook; tested data export; key deletion records |
| Encryption by classification; key lifecycle (2.12) | AWS KMS customer-managed keys in-Region; S3/EBS/RDS encryption; TLS | KMS key policy and rotation config; AWS Config encryption rule results |
| Regular data backup, available for timely restoration, with DR kept in sync with production (2.13, 3.2.1). Immutable backup and failover for critical hardware is an audit check (Annexure III, control 204). Critical information not in active use must be stored encrypted and immutable (2.12, 3.1 item 5). BCP/DR tested at least once a year or when significantly changed, with drills covering real disaster scenarios (2.13, 3.3.3) | AWS Backup with Vault Lock; S3 Object Lock; cross-Region copies between Mumbai and Hyderabad | Vault Lock config; restore test reports; DR test results presented to ISRMC |
| Logs: rolling 180 days, within Indian jurisdiction, tamper-protected (2.16) | CloudTrail organisation trail, VPC Flow Logs, application logs to an in-Region log archive account; S3 Object Lock; lifecycle ≥180 days | Trail/bucket config; retention policy; integrity validation output |
| Report cyber incidents to CERT-In within 6 hours, copy to IRDAI (2.10) | Amazon GuardDuty and AWS Security Hub findings routed to the on-call team; incident runbooks | Incident register with detection and report timestamps; CERT-In reports |
| Perimeter, segmentation, WAF for all web apps; MFA for remote access to high-severity systems (2.3, 2.11) | VPC segmentation, security groups, AWS WAF, IAM Identity Center with MFA | Network diagrams; WAF associations; IAM/MFA reports |
| Least privilege, privileged access logged and reviewed (2.3) | IAM roles, permission boundaries, IAM Access Analyzer, CloudTrail for privileged actions | Access reviews; Access Analyzer findings closed |
| Grey/white-box PT every 6 months by CERT-In-empanelled auditor (2.16) | Follow AWS's penetration testing policy for the permitted services | Auditor's PT reports; remediation tracker |
| Annual independent audit; Annexure III to IRDAI within 90 days of FY end or 30 days of audit, whichever is earlier (1.10) | AWS Config conformance packs; Security Hub standards as continuous internal evidence (not a substitute for the audit) | Annexure III; auditor report; Board comments |
| DPDP technical and organisational measures (1.10) | Data classification tags; Amazon Macie for S3 PII discovery where available; access logging | Data inventory; DPIA where needed; breach workflow |
Incidents, logs and the 6-hour clock
The guidelines require cyber incidents to be reported to CERT-In within 6 hours of noticing them, with a copy to IRDAI and other concerned regulators. ICT infrastructure logs must be kept for a rolling 180 days within Indian jurisdiction, protected against tampering and available to IRDAI, CERT-In and CSIRT-Fin. Both mirror CERT-In's directions of 28 April 2022. Note that CERT-In's FAQs allow logs outside India if they can be produced in time, but the IRDAI text says within Indian jurisdiction, so plan for India. See our CERT-In log retention guide.
DPDP: what's in force now and what's coming
The DPDP Rules, 2025 were notified on 13 November 2025, in phases. Most of the obligations on data fiduciaries, including security safeguards and breach intimation, take effect on 13 May 2027. IRDAI already expects insurers to take measures to comply. Plan encryption, access control, processing logs and breach workflows now.
Compliance-prep checklist
- Confirm which entity type you are (insurer, FRB or intermediary) and your audit and reporting path.
- Map every cloud and SaaS service you use to its provider, and check that each one is on MeitY's current empanelled list with valid STQC status.
- Keep regulated workloads, backups and logs in the Mumbai and Hyderabad Regions, and enforce that with Region-deny guardrails.
- Review CSP and SaaS contracts for the NDA, storage location, data ownership, 4-hour suspected-breach notice, deletion at termination, data return and sub-outsourcing consent.
- Set up a central, immutable log archive with at least 180 days of retention in India.
- Build and drill a 6-hour CERT-In reporting runbook, with a copy to IRDAI.
- Turn on immutable backups and test restores and DR at least annually against real disaster scenarios.
- Classify data into the four tiers (Public, Internal, Restricted, Confidential), tag PII, and set encryption and key management by tier.
- Book a CERT-In-empanelled auditor for 6-monthly grey/white-box PT and the annual audit, and rotate the auditor every three years.
- Start a cryptographic asset inventory.
- Plan DPDP Rules obligations before 13 May 2027.
Where Upvantix fits
Upvantix is an AWS Select Tier Services Partner. We help insurance IT and security teams design AWS landing zones in the Mumbai and Hyderabad Regions and set up logging, encryption, backup and detection controls with the evidence your auditor will ask for. We are not a CERT-In-empanelled auditor and don't certify compliance. Your CERT-In-empanelled auditor does that.
This guide is general information as of 13 October 2026. It is not legal or regulatory advice and does not certify compliance. Read the IRDAI circular and guidelines in full, and confirm your obligations with your compliance team, legal counsel and CERT-In-empanelled auditor. Upvantix is not a CERT-In-empanelled auditor. MeitY's empanelled list changes over time, so check the current list on MeitY's site.
Common questions about the IRDAI guidelines on AWS
When were the IRDAI Information and Cyber Security Guidelines, 2026 issued?
On 6 April 2026, by circular IRDAI/GA&HR/CIR/MISC/51/4/2026. They replace the guidelines of 24 April 2023, and IRDAI asked regulated entities to ensure compliance from the current financial year.
Who must follow them?
All insurers, including foreign reinsurance branches, insurance intermediaries such as brokers, corporate agents, web aggregators and TPAs, and the Insurance Information Bureau of India.
Can insurers use AWS under the IRDAI guidelines?
The guidelines allow cloud services from MeitY-empanelled CSPs whose data centres hold valid STQC audit status. MeitY's list includes Amazon Web Services India Pvt. Ltd. for its Mumbai and Hyderabad Regions. You still need the contract terms and controls the guidelines require.
How fast must an insurer report a cyber incident?
To CERT-In within 6 hours of noticing it or being told about it, with a copy to IRDAI and other concerned regulators.
How long must logs be kept?
ICT infrastructure logs for a rolling 180 days, within Indian jurisdiction, in line with CERT-In's directions. Other records follow your retention policy and regulations.
Who audits compliance?
An independent annual audit, with CERT-In-empanelled auditors for intermediary audits and for vulnerability assessment and penetration testing. Insurers file the Annexure III audit report with IRDAI within 90 days of the financial year end or 30 days of the audit, whichever is earlier.
Do the guidelines cover DPDP?
Yes. Regulated entities must take technical and organisational measures to comply with the Digital Personal Data Protection Act and its rules. Most DPDP Rules obligations apply from 13 May 2027.