IRDAI’s cyber-security and outsourcing framework
The Insurance Regulatory and Development Authority of India publishes the cyber-security guidelines and outsourcing regulations that bind Indian insurers. Vihaya’s pilot SOW template for health, life, and general insurers includes the IRDAI artefacts — board pack, audit-evidence schema, exit-management plan. No insurer engagement has been delivered yet; Vihaya is pre-revenue.
How Vihaya is designed to map to IRDAI requirements
| IRDAI requirement | Vihaya design posture |
|---|---|
| Board-approved outsourcing policy | Board-pack template included in the pilot SOW |
| Cyber-incident reporting | Detected events designed to surface into your reporting workflow with required metadata |
| Right-to-audit | Clause in pilot SOW template |
| Data accessibility in India | Customer data designed to sit in the customer’s India-region VPC |
| Material-activity controls | Confidence-floor escalation routes material decisions to human reviewers |
| BCP / DR | Runbook with RPO/RTO targets designed for handoff |
IRDAI FAQ
Which IRDAI direction governs AI?
Two are most relevant: IRDAI’s Information and Cyber Security Guidelines (most recent: 2023) and the IRDAI Outsourcing of Activities regulations. Both apply to life, general, and standalone health insurers.
What does board-level oversight require?
The board (or a designated committee) must approve the outsourcing policy, review material risk events, and sign off on critical-activity outsourcing. Vihaya’s pilot SOW template includes a board-pack: scope, risks, controls, exit plan.
What’s the incident-reporting requirement?
Insurers must report cyber incidents to IRDAI within prescribed timelines. Vihaya’s audit trail is designed to surface detected incident events to the insurer’s reporting workflow with the required metadata.
Does IRDAI require data localisation?
IRDAI is less prescriptive on localisation than RBI but expects records of policyholders to be accessible in India and recoverable on demand. Vihaya is designed to run in the insurer’s India-region VPC, satisfying this structurally — no insurer has deployed Vihaya yet.
Want to see this in your environment?
30-minute discovery call. We follow up with a draft SOW shortly after.
Talk to us about a pilot