Note: The full Annexure III control list is publicly available as part of the IRDAI release package on the IRDAI website. Internal compliance teams should download it directly and begin the NIST mapping exercise as part of their first 90 days under the new framework.

The audit report is structured in three parts — and each one matters

Annexure III is structured in three parts.

Part A (Background Information) captures the auditor’s identity, the activities performed by the regulated entity, and the applicable sections of the framework.

Part B (Overall Status of Findings) is the scoring table — the auditor records, for each of the 347 controls, whether it is Not Applicable (NA), Applicable (AC), and if applicable, whether the rating is High (H), Medium (M), Low (L), or Complied (C).

Part C (Details of Non-Compliances) documents each non-compliance individually with the control number, the audit questionnaire, the auditor’s observation, and the assigned risk rating.

The risk scoring is not subjective — it is formula-driven

Every audit produces a numeric risk score, calculated by an explicit formula in Annexure III: Risk Mark = (H × 3) + (M × 2) + (L × 1) + (C × 0). This means the audit does not produce a pass/fail verdict; it produces a number that the Board, the ISRMC, and IRDAI can track over time. A regulated entity with a Risk Mark of 50 is in a measurably worse position than one with a Risk Mark of 20. Year-on-year improvement in the Risk Mark becomes a Board-level KPI.

The risk rating logic itself depends on two dimensions: whether the control is designed adequately and whether it is operating effectively. A control that is neither designed nor operating earns a High rating (must be designed and implemented). A control designed but not operating effectively earns High or Medium depending on the auditor’s judgement. A control operating but not designed adequately earns Low or Medium. A control both designed and operating earns Complied.

Auditor eligibility is narrowly defined

Annexure IV defines who can perform the audit. The eligible firms are narrow. A Chartered Accountant firm must be a Partnership or LLP, with at least five years of continuous practice and a minimum of four partners. At least one partner must hold the CISA or DISA certification, at least one must be a Fellow Member of ICAI, and at least one must have three or more years of experience in cybersecurity audit specifically in Insurance Companies, Banks, or Mutual Funds. The alternative path is a CERT-In empanelled external systems auditing organisation also holding CISA or DISA certifications.

There are two practical consequences for CXOs. First, your existing statutory auditor almost certainly cannot perform this audit — these are specialised firms, and the eligible pool is small. Engagement letters need to be in place well before the audit window. Second, the audit cannot rely on management representations or on the work of other auditors. Annexure IV explicitly states that the auditor must perform interviews, document verification, compliance checks, and substantive testing personally. There are no shortcuts.

Filing timelines matter more than most teams realise

Insurers must submit the Annexure III audit report — duly signed by the auditor and accompanied by Board comments — to IRDAI within 90 days of the end of the financial year, or within 30 days of audit completion, whichever is earlier. Intermediaries must file Annexure III with their insurers within 30 days of audit completion. The compounding effect is that an insurer’s audit posture now depends not only on its own filing but on receiving filings from every intermediary in its distribution network.

Governance and Board obligations

The 2026 framework treats cyber security governance as a Board-owned function. The Board approves the Information and Cyber Security Policy, allocates budget proportionate to the threat landscape (a new explicit obligation in V2.0), and reviews the status of non-conformities from the annual cyber security assurance audit. Audit gaps must be closed within 12 months of reporting, and the Board owns that timeline.

The CISO role has been substantially strengthened. The CISO must report directly to the top executive overseeing the risk management function, or in their absence to the CEO directly. The CISO shall not have a direct reporting relationship with the Head of IT Function and shall not be given any business targets. This is a control independence requirement, equivalent in spirit to the independence required of internal audit. The CISO is also a permanent invitee to the IT Steering Committee, ensuring that IT execution decisions are visible to the security function.

The Information Security Risk Management Committee (ISRMC) now meets at least quarterly (up from twice yearly under 2023), with a quorum of the CISO and at least two members. The newly mandated IT Steering Committee operates at senior management level, is convened by the CTO, also meets at least quarterly, and provides updates to the RMC and CEO. And the Risk Management Committee itself must now include at least one Independent External Expert with substantial IT or cybersecurity expertise — a structural check on management’s self-reporting.

Exceptions follow a new approval hierarchy: exceptions not exceeding three months are approved by the CISO, exceptions exceeding three months are approved by the RMC, and exceptions exceeding one year require Board approval. Any exception request exceeding twelve months must undergo a reassessment and re-approval process. All exceptions must formally document the associated risk.

Cross-regulation interactions

The 2026 framework does not exist in isolation. It explicitly cross-references and layers on top of several other regulatory regimes that CXOs must satisfy simultaneously.

Digital Personal Data Protection Act (DPDP): Section 1.10 of the guidelines makes DPDP compliance an explicit obligation for regulated entities. This is new in V2.0. The interaction matters because DPDP creates obligations around consent, data principal rights, breach notification, and data fiduciary responsibilities that overlap with the IRDAI incident reporting and data protection clauses. CXOs are now accountable to two laws simultaneously through these guidelines.

CERT-In directives: The 6-hour incident reporting requirement, the 180-day log retention obligation within Indian jurisdiction, the Responsible Disclosure Framework, and CERT-In’s role as a CVE Numbering Authority are all incorporated by reference. CERT-In directives can change independently of the IRDAI framework, and the guidelines require continuous adherence.

NIST Cybersecurity Framework: Annexure I of the guidelines confirms the applicability of the NIST framework to all regulated entities, and the audit structure in Annexure III is built directly on NIST function codes. NIST is not optional context — it is the framework the auditor will use.

IT Act and IGDM Rules 2021: The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 are inside the audit scope as a dedicated 13-control category in Annexure III. CXOs at intermediaries with digital touchpoints must satisfy IGDM compliance as part of the IRDAI audit, even though IGDM is a separate regulation.

Compliance with IRDAI 2026 is no longer an isolated obligation — it is the intersection of four overlapping regulatory regimes.

Consequences of non-compliance

The guidelines and the cover circular together establish a clear compliance enforcement chain, even without invoking IRDAI’s broader powers under the Insurance Act. The chain works as follows.

Audit results are filed with IRDAI within 90 days of FY-end, signed by both the auditor and accompanied by Board comments. Non-conformities observed in the annual cyber security assurance audit are tracked at director level — the Board receives the status of non-conformities and is responsible for approving timelines for gap closure. Gaps must be closed within 12 months of reporting. The ISRMC reports the status of non-conformities to the RMC, which in turn escalates serious non-conformities to the Board.

Two consequences follow directly from the framework itself, before any IRDAI enforcement action is required. First, the Risk Mark calculated under Annexure III becomes a year-on-year tracked metric visible to the Board and to IRDAI. A worsening Risk Mark is not a private problem. Second, intermediaries file their Annexure III with insurers as well as with IRDAI, which means an insurer with weak intermediaries inherits their gaps in its own compliance posture. The downstream cascade is structural.

The cover circular language is explicit: “shall strictly adhere to the said guidelines and ensure compliance from the current financial year.” This is the regulator’s standard formulation for a binding obligation, and it leaves no room for interpretation about whether compliance is optional in year one.

The first 90 days: a CXO action plan

For CXOs at insurers, intermediaries, and IIB-related entities, the next 90 days are the window in which the foundation for the first audit cycle gets laid. The action plan below is organised by phase, with each phase building on the previous one.