Who it applies to
Insurers and reinsurers regulated by the Insurance Regulatory Authority, under the Guidance Note on Cybersecurity for the Insurance Industry issued in June 2025 (Circular IC & RE 11/2025).
Key obligations
| Requirement | What it means in practice |
|---|---|
| Board accountability | The board and senior management hold ultimate responsibility for cybersecurity. Board-approved policies should be reviewed at least annually, and having at least one director with cyber expertise is recommended.vCISO, GRC & Privacy |
| Cyber risk management | A formal cyber risk management framework and an incident response plan.vCISO, GRC & PrivacyDetection & Response |
| Incident reporting | Report material incidents to the IRA within 24 hours of confirmation or substantive detection, whichever is earlier, and file quarterly incident reports within 15 days of each quarter end.Detection & Response |
| People and resilience | Staff awareness training, phishing simulations and reliable backups.Offensive Security |
Good to know
- Insurers process large volumes of sensitive personal data, so the Data Protection Act's safeguards, DPIA and breach rules apply alongside the IRA guidance.
- We summarized this guidance from reputable secondary sources; confirm details against the circular itself.
How we help
We translate these requirements into practical controls: a gap assessment against your current environment, then the technology, processes and evidence that close the gaps. Start with the area that matters most:
- vCISO, GRC & Privacy: risk and compliance live in spreadsheets.
- Detection & Response: too many alerts and not enough visibility.
- Offensive Security: we don't know where our real weaknesses are.
- vCISO, GRC & Privacy: governance, risk management, DPIAs and DPO-as-a-service.
Sources
This summary is general information, not legal advice. Requirements change; confirm with the regulator or your legal advisers.