Skip to content

Commit 82b2828

Browse files
kuettaikuettai
authored
Merge pull request #247 from rohinsub/main
Add IRDAI insurance compliance framework with auto-discovery
2 parents 5f892e6 + f561226 commit 82b2828

3 files changed

Lines changed: 562 additions & 0 deletions

File tree

‎frameworks/IRDAI/IRDAI.py‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
import constants as _C
2+
3+
from frameworks.Framework import Framework
4+
5+
6+
class IRDAI(Framework):
7+
def __init__(self, data):
8+
super().__init__(data)
9+
pass

‎frameworks/IRDAI/README.md‎

Lines changed: 212 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
1+
# IRDAI Compliance Framework for Service Screener v2
2+
3+
## Overview
4+
5+
This framework maps AWS service configurations to the **IRDAI Information and Cyber Security Guidelines 2023** (notified April 24, 2023; revised April 6, 2026) and the **Outsourcing of Activities by Indian Insurers Regulations (2017)**.
6+
7+
It enables Indian insurance entities to evaluate their AWS environments against IRDAI regulatory requirements.
8+
9+
## Applicable Entities
10+
11+
| Entity Type | Scope |
12+
|---|---|
13+
| Life and General Insurers | Full compliance |
14+
| Health Insurers | Full compliance + health data protections |
15+
| Reinsurers | Applicable controls for India operations |
16+
| Insurance Intermediaries | Brokers, corporate agents, web aggregators — proportionate compliance |
17+
| TPAs, ISNPs, CSCs | Applicable controls |
18+
| Insurance Repositories | Full compliance + enhanced data protection |
19+
| Insurance Information Bureau (IIB) | Full compliance |
20+
21+
## Regulatory References
22+
23+
- [IRDAI Information and Cyber Security Guidelines 2023](https://www.irdai.gov.in/) — notified April 24, 2023
24+
- [IRDAI 2026 Revised Cybersecurity Guidelines](https://www.irdai.gov.in/) — issued April 6, 2026
25+
- [Outsourcing of Activities by Indian Insurers Regulations 2017](https://www.irdai.gov.in/)
26+
- [AWS Compliance Center - India](https://aws.amazon.com/financial-services/security-compliance/compliance-center/in/)
27+
- [IRDAI Cybersecurity Workbook (AWS Artifact)](https://aws.amazon.com/artifact/)
28+
29+
> **Note on regulatory citations:** The IRDAI section references (e.g., "Sec 3.2") in this document
30+
> are indicative mappings based on the publicly available IRDAI Information and Cyber Security
31+
> Guidelines 2023 and the April 2026 revision circular. Exact clause numbering may vary between
32+
> the original gazette notification and subsequent circulars. Always refer to the official IRDAI
33+
> gazette notifications and circulars available at [irdai.gov.in](https://www.irdai.gov.in/) for
34+
> authoritative clause references.
35+
36+
## Control Categories
37+
38+
| Code | Category | Sub-Controls | Automated | Manual |
39+
|------|----------|:------------:|:---------:|:------:|
40+
| **DS** | Data Security and Privacy | 8 | 6 | 2 |
41+
| **IAM** | Identity and Access Management | 7 | 7 | 0 |
42+
| **NS** | Network Security | 6 | 6 | 0 |
43+
| **ML** | Monitoring, Logging and Incident Response | 6 | 5 | 1 |
44+
| **VAPT** | Vulnerability Assessment and Penetration Testing | 4 | 1 | 3 |
45+
| **BC** | Business Continuity and Disaster Recovery | 6 | 4 | 2 |
46+
| **OT** | Outsourcing and Third-Party Risk | 7 | 2 | 5 |
47+
| **GRC** | Governance, Risk and Compliance | 14 | 4 | 10 |
48+
| **WF** | Workforce and Endpoint Security | 5 | 1 | 4 |
49+
| | **Totals** | **63** | **36** | **27** |
50+
51+
## Detailed Control Mapping
52+
53+
### DS — Data Security and Privacy
54+
| Control | Description | IRDAI Ref |
55+
|---------|-------------|-----------|
56+
| DS.1 | Encryption key management and rotation | Sec 3.2 |
57+
| DS.2 | Data encryption at rest for all storage services | Sec 3.2 |
58+
| DS.3 | Data encryption in transit (TLS/mTLS) | Sec 3.2 |
59+
| DS.4 | Prevention of unintended data exposure | Sec 3.3 |
60+
| DS.5 | Data integrity, versioning, and immutability | Sec 3.3 |
61+
| DS.6 | Cryptographic key rotation and centralised management | Sec 3.4 |
62+
| DS.7 | Data localisation (India residency) — manual | Sec 3.4 |
63+
| DS.8 | Data classification and handling — manual | Sec 3.5 |
64+
65+
### IAM — Identity and Access Management
66+
| Control | Description | IRDAI Ref |
67+
|---------|-------------|-----------|
68+
| IAM.1 | Multi-factor authentication enforcement | Sec 4.1 |
69+
| IAM.2 | Password and credential policy strength | Sec 4.1 |
70+
| IAM.3 | Least privilege and role-based access | Sec 4.2 |
71+
| IAM.4 | Root account security | Sec 4.2 |
72+
| IAM.5 | Policy management (groups, SCPs, org) | Sec 4.3 |
73+
| IAM.6 | Credential rotation and access reviews | Sec 4.3 |
74+
| IAM.7 | Privileged access management (PAM) | Sec 4.4 |
75+
76+
### NS — Network Security
77+
| Control | Description | IRDAI Ref |
78+
|---------|-------------|-----------|
79+
| NS.1 | Security group and firewall controls | Sec 5.1 |
80+
| NS.2 | Network segmentation and isolation | Sec 5.1 |
81+
| NS.3 | VPC and private connectivity | Sec 5.2 |
82+
| NS.4 | DDoS and web application protection (WAF) | Sec 5.3 |
83+
| NS.5 | Network flow log monitoring | Sec 5.4 |
84+
| NS.6 | Intrusion detection (GuardDuty) | Sec 5.4 |
85+
86+
### ML — Monitoring, Logging and Incident Response
87+
| Control | Description | IRDAI Ref |
88+
|---------|-------------|-----------|
89+
| ML.1 | Audit trail via CloudTrail | Sec 6.1 |
90+
| ML.2 | Centralised log management and retention | Sec 6.1 |
91+
| ML.3 | Threat detection (GuardDuty + SecurityHub) | Sec 6.2 |
92+
| ML.4 | Service-level logging for all workloads | Sec 6.2 |
93+
| ML.5 | Enhanced observability (X-Ray, detailed monitoring) | Sec 6.3 |
94+
| ML.6 | Incident reporting to CERT-In (6h) and IRDAI (24h) — manual | Sec 6.4 |
95+
96+
### VAPT — Vulnerability Assessment and Penetration Testing
97+
| Control | Description | IRDAI Ref |
98+
|---------|-------------|-----------|
99+
| VAPT.1 | Bi-annual VAPT by CERT-In empaneled auditor — manual | Sec 7.1 |
100+
| VAPT.2 | Grey/white box PT (2026 Control 96) — manual | Sec 7.1 |
101+
| VAPT.3 | Critical findings remediation within 30 days — manual | Sec 7.2 |
102+
| VAPT.4 | External attack surface management | Sec 7.3 |
103+
104+
### BC — Business Continuity and Disaster Recovery
105+
| Control | Description | IRDAI Ref |
106+
|---------|-------------|-----------|
107+
| BC.1 | High availability (multi-AZ deployments) | Sec 8.1 |
108+
| BC.2 | Automated backups and point-in-time recovery | Sec 8.2 |
109+
| BC.3 | Deletion protection | Sec 8.2 |
110+
| BC.4 | Auto-scaling and capacity management | Sec 8.3 |
111+
| BC.5 | Documented IT continuity/DR plan — manual | Sec 8.4 |
112+
| BC.6 | DR testing and RTO/RPO validation — manual | Sec 8.4 |
113+
114+
### OT — Outsourcing and Third-Party Risk
115+
| Control | Description | IRDAI Ref |
116+
|---------|-------------|-----------|
117+
| OT.1 | AWS Organizations and SCPs for governance | Sec 9.1 |
118+
| OT.2 | Third-party audit trail | Sec 9.2 |
119+
| OT.3 | CSP MeitY empanelment verification — manual | Sec 9.3 |
120+
| OT.4 | Sub-outsourcing written permission — manual | Sec 9.3 (2026 Control 148) |
121+
| OT.5 | Data elimination at contract end — manual | Sec 9.4 (2026 Control 151) |
122+
| OT.6 | NDAs for privacy, security, BCP — manual | Sec 9.4 |
123+
| OT.7 | IRDAI audit rights in cloud agreements — manual | Sec 9.5 |
124+
125+
### GRC — Governance, Risk and Compliance
126+
| Control | Description | IRDAI Ref |
127+
|---------|-------------|-----------|
128+
| GRC.1 | Board-approved CS Policy and ISRMC — manual | Sec 2.1 |
129+
| GRC.2 | CISO independence from IT head (2026) — manual | Sec 2.2 |
130+
| GRC.3 | Quarterly ISRMC reporting to Board — manual | Sec 2.3 |
131+
| GRC.4 | Annual technology risk assessment — manual | Sec 2.4 |
132+
| GRC.5 | Organisational structure and controls | Sec 2.5 |
133+
| GRC.6 | Patch management and version currency | Sec 10.1 |
134+
| GRC.7 | Recommendations and advisories | Sec 10.2 |
135+
| GRC.8 | Compliance evidence and audit readiness | Sec 10.3 |
136+
| GRC.9 | Cybersecurity budget (% of IT spend) — manual | Sec 2.6 |
137+
| GRC.10 | IT Steering Committee governance (2026) — manual | Sec 2.7 |
138+
| GRC.11 | Post-quantum cryptography readiness (2026) — manual | Sec 2.8 |
139+
| GRC.12 | 30-day audit report submission (2026) — manual | Sec 2.9 |
140+
| GRC.13 | Annual cyber-insurance review — manual | Sec 2.10 |
141+
| GRC.14 | Board accountability for cyber incidents (2026) — manual | Sec 2.11 |
142+
143+
### WF — Workforce and Endpoint Security
144+
| Control | Description | IRDAI Ref |
145+
|---------|-------------|-----------|
146+
| WF.1 | Endpoint detection and response (EDR) — manual | Sec 11.1 |
147+
| WF.2 | Device/volume encryption | Sec 11.2 |
148+
| WF.3 | Background checks and HR security — manual | Sec 11.3 |
149+
| WF.4 | Security awareness training — manual | Sec 11.4 |
150+
| WF.5 | Acceptable use and social media policy — manual | Sec 11.5 |
151+
152+
## Controls Requiring Manual Evidence
153+
154+
Controls with empty check arrays (`[]` in `map.json`) cannot be validated automatically via AWS APIs.
155+
The framework's `generateMappingInformation()` method in `Framework.py` automatically displays the
156+
`emptyCheckDefaultMsg` (defined in `map.json` metadata) for these controls, prompting users to
157+
provide evidence or artifacts demonstrating compliance.
158+
159+
Key manual controls include:
160+
161+
- **DS.7-8**: Data localisation evidence and data classification records
162+
- **VAPT.1-3**: Penetration testing reports from CERT-In empaneled auditors
163+
- **ML.6**: Incident notification logs showing 6-hour CERT-In / 24-hour IRDAI reporting
164+
- **BC.5-6**: BCP/DR documentation and testing evidence
165+
- **OT.3-7**: Contractual and governance documentation for outsourcing
166+
- **GRC.1-4, GRC.9-14**: Board approvals, CISO reporting structure, budgets, 2026 governance requirements
167+
- **WF.1, WF.3-5**: HR processes, training records, endpoint tooling
168+
169+
## Installation
170+
171+
Copy the `IRDAI/` folder into `frameworks/` in your service-screener-v2 installation:
172+
173+
```bash
174+
cp -r IRDAI/ /path/to/service-screener-v2/frameworks/
175+
```
176+
177+
## Usage
178+
179+
Run Service Screener with the IRDAI framework:
180+
181+
```bash
182+
# Scan Mumbai region (typical for India-based insurers)
183+
screener --regions ap-south-1 --frameworks IRDAI
184+
185+
# Combine with RBI for dual-regulated entities
186+
screener --regions ap-south-1 --frameworks IRDAI,RBI
187+
188+
# Scan specific services
189+
screener --regions ap-south-1 --services s3,iam,ec2,rds,kms --frameworks IRDAI
190+
```
191+
192+
## File Structure
193+
194+
```
195+
frameworks/IRDAI/
196+
├── IRDAI.py # Framework class (extends Framework base class)
197+
├── map.json # Control-to-check mapping (9 categories, 63 sub-controls)
198+
└── README.md # This file
199+
```
200+
201+
## Key Differences from RBI Framework
202+
203+
| Aspect | RBI | IRDAI |
204+
|--------|-----|-------|
205+
| Applicability | Banks, NBFCs, payment operators | Insurers, intermediaries, TPAs, web aggregators |
206+
| Incident reporting | — | 6 hours to CERT-In, 24 hours to IRDAI |
207+
| VAPT frequency | Annual | Bi-annual (every 6 months) |
208+
| PT methodology | Not specified | Grey/white box mandatory (2026) |
209+
| CISO reporting | — | Must NOT report to Head of IT (2026) |
210+
| Board meeting cadence | — | Quarterly ISRMC meetings (2026) |
211+
| Data localisation | Primary data in India | All ICT logs and critical data in India |
212+
| Outsourcing controls | Basic | Detailed (sub-outsourcing, MeitY empanelment, data elimination) |

0 commit comments

Comments
 (0)