Listen to this article
IRDAI has asked insurance companies and insurance intermediaries like brokers, corporate agents, insurance marketing firms and web aggregators to report cyber incidence to IRDAI and Indian Computer Emergency Response Team (Cert-In) within 6 hours of the incident.
Thus far, insurers and intermediaries were required to report cyber incidence within 24 hours.
Insurers will have to maintain and monitor all Information and Communication (ICT) infrastructure and application logs for a rolling period of 180 days.
As per these rules:
- All ICT systems must follow the official Network Time Protocol (NTP) of India
- Insurers must have a Cyber Crisis Plan to handle cyber threats
- If a serious cyber issue happens, only certified experts must investigate
- Insurers must follow CERT-In rules on cyber safety
- Insurers should ensure there is no conflict of interest. The company checking for cyber issues should not also be the one investigating them
- All intermediaries and companies must present their compliance of these rules in their board meetings and send meeting minutes to IRDAI