Formation of working groups to come out with comprehensive framework for

To irJai ~ Hrl1 ~ ~ ~A~ I 'Hfi 3ITT ~ cfilti ~ INSURANCE REGULATORY AND DEVELOPMENT AUTHORITY OF INDIA October 31, 2016 CIRCULAR The CEOs of all insurers Sub: Formation of working groups to come out with comprehensive framework for cvber security in insurance sector IRDAI is planning to come out with a comprehensive cyber security framework for Insurance sector of India in the wake of recent cyber-attacks and also implement appropriate mechanism to mitigate cyber risks. In this connection, it has been decided to form two separate working groups for life and non-life sector (including health) comprising of CIOs of insurers to discuss and decide on the issues related cyber security. The broad terms of reference for the working groups are as follows: a) Suggest recommendations with respect to Cyber security in order to comprehensively provide for a broad framework to mitigate present internal and external threats to insurers. b) Provide recommendations for effective and comprehensive Cyber Security Audit related processes to provide assurance on the level of IT risks. c) Suggest scope for enhancement of measures against Cyber fraud through preventive and detective mechanisms. d) Identify measures to improve business continuity and disaster recovery. e) Assess the impact of legal risks arising out of cyber laws, the need for any specific legislation relating to data protection and privacy. f) Any other matter of importance / relevance g) The working groups may form a sub-group and shall submit its report by the end of Jan'2017, 1TTPJlP1'cr-!, ;frau"i'fc1, ~. ~ -500004. \1'TUf ro : 91-040-2338 11 oo, ~: 91-040-6682 3334 i-~: irda · ov.in ~: www.trda.gov.in Parisharam Bhavan, 3rd Floor. Basheer Bagh, Hyderabad-500 004. India Ph.: 91-040-2338 1100, Fax'. 91-040-6682 3334 E-mail : 1rda@irda.gov.in Web.: www.irda.gov.in • ~I~ ~mfl4 inn ~~41qcn m-~ ~cn1t1 ~ a,.-.u INSURANCE REGULATORY AND inlai DEVELOPMENT AUTHORITY OF INDIA h) Based on the report, an exposure draft will be released for comments of stakeholders. i) A Comprehensive guideline on cybersecurity shall be issued by March'2017. Shri.A.R. Nithiyanantham, CGM(IT), IRDAI would be the Member and convener of the working group. All insurers are therefore requested to formally nominate their respective Chief Information Officers (CIO) as a Member to the said working group and confirm the same to IRDAI along with the contact details of the CIOs to ciowgrp@irdai.gov.in , latest by 3rd November 2016 ~ MEMBER(LIFE) ~~..m 'llcR, cfmu "ffi1, ~, ~ -500 004. \lRo rt) : 91-040-2338 1100, ~; 91-040-6682 3334 i--m-r: irda@irda.gov.in cf,ii; www.irda.gov.in Parisharam Bhavan, 3rd Floor. Basheer Bagh, Hyderabad-SQQ 004. India. Ph.: 91-040-23381100, Fax· 91-040-6682 3334 E-mail : 1rda@irda.gov.in Web.: www.irda.gov.1n