Formation of working groups to come out with comprehensive framework for

[Image omitted. See the official document.]

REF: IRDAI/IT/CIR/MISC/216/10/2016

October 31, 2016

CIRCULAR

To

The CEOs of all insurers

Sub: Formation of working groups to come out with comprehensive framework for cyber security in insurance sector

IRDAI is planning to come out with a comprehensive cyber security framework for Insurance sector of India in the wake of recent cyber-attacks and also implement appropriate mechanism to mitigate cyber risks. In this connection, it has been decided to form two separate working groups for life and non-life sector (including health) comprising of CIOs of insurers to discuss and decide on the issues related cyber security.

The broad terms of reference for the working groups are as follows:

• (a) Suggest recommendations with respect to Cyber security in order to comprehensively provide for a broad framework to mitigate present internal and external threats to insurers.

• (b) Provide recommendations for effective and comprehensive Cyber Security Audit related processes to provide assurance on the level of IT risks.

• (c) Suggest scope for enhancement of measures against Cyber fraud through preventive and detective mechanisms.

• (d) Identify measures to improve business continuity and disaster recovery.

• (e) Assess the impact of legal risks arising out of cyber laws, the need for any specific legislation relating to data protection and privacy.

• (f) Any other matter of importance / relevance

• (g) The working groups may form a sub-group and shall submit its report by the end of Jan'2017

• (h) Based on the report, an exposure draft will be released for comments of stakeholders.

• (i) A Comprehensive guideline on cybersecurity shall be issued by March'2017.

Shri.A.R. Nithiyanantham, CGM(IT), IRDAI would be the Member and convener of the working group.

All insurers are therefore requested to formally nominate their respective Chief Information Officers (CIO) as a Member to the said working group and confirm the same to IRDAI along with the contact details of the CIOs to ciowgrp@irdai.gov.in , latest by $3^{\text{rd}}$ November 2016

[Image omitted. See the official document.]

MEMBER(LIFE)

[Image omitted. See the____________________________________________________________________________________________________]