IRDAI audit evidence, built into the platform.

IRDAI's Information and Cyber Security Guidelines apply to insurers and to Insurance Self-Network Platforms (ISNPs) — the online policy-issuance and servicing portals insurers and intermediaries run directly. The guidelines require periodic VAPT, a documented information-security policy, and incident reporting, with ISNP operators facing additional platform-specific audit obligations tied to their self-network registration. Insurance is unusual among the regulated sectors here in how much legacy sits underneath the modern surface: core policy-administration frequently still runs on mainframe or mainframe-adjacent systems that predate the current guidelines by decades, while the customer-facing layer — agent portals, broker integrations, bancassurance tie-ups with partner banks — has grown rapidly and often outpaces the security review the legacy core went through years ago. Policyholder PII sits at genuinely large scale, and third-party risk compounds fast: a single bancassurance partnership can expose policyholder data to a partner bank's own security posture, not just the insurer's.