India's Insurers Now Need a Cryptographic Inventory. What IRDAI's 2026 Guidelines Ask For, and What to Do First.

· Compliance · 6 min read

What IRDAI published

On 6 April 2026 the Insurance Regulatory and Development Authority of India issued its Information and Cyber Security Guidelines, 2026, replacing the 2023 framework. They apply to insurers, foreign reinsurance branches and intermediaries (brokers, corporate agents, web aggregators, third-party administrators), and compliance runs from the current financial year.

Most of the coverage focused on governance: quarterly meetings of the information security risk management committee, a CISO independent of IT, six-monthly external testing of internet-facing systems by CERT-In empanelled auditors, MeitY-empanelled cloud providers and data deletion at contract exit.

One requirement got less attention and matters more for the next decade: regulated entities must maintain an up-to-date inventory of their cryptographic assets to prepare for post-quantum security. Commentators cite it as Control 110 or Clause 20; check the numbering against the official text before you quote it in an audit response.

Why this one is different

India already has quantum-safe guidance. The DST National Quantum Mission task force roadmap sets advisory milestones for critical infrastructure (foundations by December 2027). RBI set up its Q-SAFE expert committee in May 2026, and its report is due about six months after the committee's first meeting. CERT-In's BOM guidelines define what a CBOM should contain.

IRDAI's line is the first in the Indian financial sector that turns the inventory into an obligation on a regulated entity, with the same supervisory weight as the rest of the guidelines. For an insurer, "we are watching the quantum space" is no longer an answer.

Why insurers carry more harvest-now-decrypt-later risk than they think

Quantum risk is not evenly spread. It is worst where data has to stay confidential for a long time, and insurers hold some of the longest-lived sensitive data in finance:

  • Life and health policies run for decades, and the medical, identity and financial data behind them stays sensitive for the life of the policyholder.
  • Claims and underwriting files combine health records, bank details and KYC documents, and are exchanged with TPAs, hospitals, brokers and reinsurers over links you do not fully control.
  • Policy documents and payouts are signed. Digital signatures do not face harvest-now-decrypt-later, but they do need a migration path before signature forgery becomes possible.

Data intercepted today can be decrypted once a large enough quantum computer exists. For a policy written in 2026 that is still in force in 2046, that matters now.

What a useful inventory contains

An inventory that satisfies an auditor and also drives a migration records, for each use of cryptography:

  1. Where it is: the system, host, application and owner.
  2. What it is: algorithm, key size, protocol and certificate details (RSA-2048, ECDHE P-256, TLS 1.2).
  3. What it protects: the data class and how long that data must stay confidential.
  4. Who controls it: your own code and configuration, or a vendor product, a cloud service or a partner connection.
  5. Its quantum status: vulnerable, hybrid or post-quantum, and what replaces it.

The fourth field is the one most programmes skip, and the one that decides your timeline. Core policy administration systems, payment gateways and TPA integrations are usually vendor products. If the vendor has no post-quantum roadmap, neither do you.

What to do in the next quarter

  1. Start with what faces the internet. Portals, APIs, partner endpoints and email. It is the fastest part to inventory and the part attackers record first.
  2. Add internal systems by reading code and configuration, not by asking teams to fill in spreadsheets. Spreadsheets miss hard-coded crypto and libraries' defaults.
  3. Tag each finding with the data it protects and how long that data lives. That ordering is your migration plan.
  4. Write to your top vendors and ask for their post-quantum dates. Put the answer in the inventory.
  5. Keep it current. IRDAI says up to date. An inventory built once for an audit is stale by the next release.

The bigger picture

Insurers are not alone. Switzerland's FINMA expects board-approved post-quantum roadmaps from banks and insurers by mid-2027, Singapore's CSA has dated milestones for critical infrastructure, and the EU's supervisors named quantum a key risk in September. IRDAI has put Indian insurers in that group. The ones who start with an inventory this year will have a plan to show when the questions get sharper.

Qypher builds the cryptographic inventory across your public perimeter, code, cloud and binaries, records who controls each item, and generates the post-quantum migration artifacts your team deploys. Run a free scan →

Sources: IRDAI Information and Cyber Security Guidelines, 2026 (6 April 2026), as summarised by MediaNama, CyberPeace, FireCompass and K G Somani & Co; RBI press release on the Q-SAFE committee (25 May 2026); FINMA Guidance 05/2026 (9 July 2026). Check clause numbers against IRDAI's official text.