Applicability This framework is applicable to all organizations which are regulated by Insurance Regulatory and Development Authority of India (IRDAI). This framework is also applicable to entities/individuals dealing with the regulated organizations to the extent specified in these guidelines. This framework is applicable to all information/records/data created, received or maintained by insurers, intermediates and other registered entities who have access to the policyholder’s information, wherever these data records are and whatever form they are in, in the course of carrying out their designated duties and functions. This frame work also applicable to overseas offices of the organization subject to laws of the country in which they operate and the guidelines issued by the respective regulatory authorities. 4. Terms & Definitions ‘Organization’ means entities registered with IRDAI IRDAI – Insurance Regulatory and Development Authority of India. BCM/BCP – Business Continuity Management/Plan. Threat – A Potential cause of an unwanted incident, which may result in harm to a system or organization. Vulnerability – A Weakness of an asset or group of assets that can be exploited by one or more threats. CISO – Chief Information Security Officer CISA – Certified Information Security Auditor ISC – Information Security Committee.
Take appropriate corrective and preventive actions Communicate the results and actions to concerned teams and consult with CISO on improvement plans Ensure that the improvements achieve their intended objective 6.2 Information Security Policy - Acceptable Use Information, regardless of its form, is a valuable asset for the organization. The objective of the information security policy is to ensure confidentiality, integrity and availability of information. To instill security culture among all employees that supports the organization’s information security policy and information security strategy. The information security policy shall cover elements on the acceptable use for the end users which will help build a secure environment across the organization. The acceptable use policy shall cover: Information classification and labelling Password management Endpoints (desktop/laptop and mobile devices) Standard configuration disabling vulnerable services and resources Virus/Malware protection Controls to prevent installation unauthorized/non- standard software Logical access Clear desk Internet access policy Email policy Usage of external/portable storage devices Instant messaging and social media Remote access Wireless access 6.3 Business Continuity & Disaster Recovery Framework Business continuity policy& Management The Organization shall have a Business continuity policy, with clearly identified responsibilities
Such withdrawal of the consent shall be sent in writing to the body corporate. The Information not to be retained for longer than is required for the purposes for which the information may lawfully be used or is otherwise required under any other law for the time being in force. Disclosure of information Prior permission of the provider of information must be obtained in case of disclosure to any third party either in form of the contract or otherwise obtained specifically for disclosing the same. Such consent would be not be necessary in case of sharing with Government agencies or where such disclosure is necessary for compliance of a legal obligation Transfer of information The following conditions must be satisfied while undertaking the transfer: The same of data protection that is adhered to by the body corporate (transferor) is adhered to by the receiving party (transferee) it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information such person has consented to data transfer. Grievance handling Body corporate to designate a Grievance Officer Publish his name and contact details on its website
Unauthorized access of IT systems/data Defacement of website or intrusion into a website and unauthorized changes such as inserting malicious codes, link to external websites etc. Malicious code attacks such as spreading of Attacks on servers such as Database, Mail and DNS and network devices such as Routers Identity Theft, Spoofing and Phishing attacks Denial of Service (DOS) and Distributed Denial of Service (DDOS) attacks Attacks on Critical Infrastructure, SCADA Systems and Wireless networks Attacks on Applications such as E-Governance, E-Commerce etc. 20.6 Data Data theft involves issues of copyright violation, violation of privacy under IT Act 2000, as well criminal breach of trust and dishonest misappropriation under Indian Penal Code, 1860 Section 43(b), read with Section 66 of the Information Technology Act 2000 and Section 379, 405 & 420 of Indian Penal Code deals with framework of data theft and penal provisions thereto. 20.7 Penalty and Compensation for damage to computer, computer system Section 43 clearly provides for the provisions of damages by way of compensation against the person who without the permission of the owner or any other person who is in charge of a computer, computer system or computer network (a) accesses or secures access to such computer, computer system or computer network or computer resource (b) downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium; (c) introduces or causes to be introduced any computer contaminant or computer virus into any computer, computer system or computer network; (d) damages or causes to be damaged any computer, computer system or computer
The time of receipt shall be based on the principle - the receipt occurs when the electronic record enters the designated computer in case specified. In other case, the receipt occurs at the time electronic record is retrieved by the addressee. Secure electronic record, electronic signature and security procedure (Sec 14, 15 & 16) Security procedure to be used in connection with the electronic record then such electronic record shall be considered as Secure Information Technology Act, 2000 (Penalties and Compensation and Offences) Damage to computer and computer system due to unauthorized access (Sec. 43) Failure to protect data compensation (Sec. 43A) Cyber Crime related offences (Sec. 65,66,67) Breach of Confidentiality and Privacy (Sec. 72) Punishment for disclosure of information and breach of lawful contract (Sec 72A) Offences by Companies (Sec 85) Covered above Act/Statute Requirement The Information Technology Procedure for collection, transfer, storing, disclosure Covered
(Reasonable Security Practice and Procedure and Sensitive Personal Data or Information) & processing of sensitive personal data and information Implementation of reasonable security practices & code of best practices on a regular basis through independent Auditor once in a year The Information Technology (Intermediary Guidelines) Rules, 2011 Due diligence by Intermediary and their liability Implementation of reasonable security practices by Intermediary Reporting of Cyber Security Incident to ICERT Covered above The Information Technology (Security Procedure) 2004 Requirements to be fulfilled to constitute a secure Digital Signature for authentication of secure electronic records by means of secure digital signature. Public Key / Private card The Information Technology ( Procedure and Safeguards for Interception, monitoring of Information) Rules 2009 Interception and decryption of information Authorization to Govt. Agency to intercept, monitor or decrypt information generated, transmitted, received or stored in computer resources
place outside India, back up should be kept on servers physically located in India on periodic basis up in case of records are kept outside India. In case books of accounts are maintained other the Reguired office location, the details of server to be provided to ROC Trademark Protection against cyber squatting Infringement of trademark/Passing of Sec 135 TM Act ICANN domain name dispute resolution policy Meta tagging and linking Legal remedies available for infringement and passing off Caution while linking of website etc. Relief can be obtained ICANN in case (i) respondent domain name is identical (ii) respondent has no legitimate interest (iii) respondent domain name was registered in bad faith IP risk to be assessed and appropriate strategy to be adopted to deal with IP infringement Copyright Law Protection of data base Data bases are protected as literally work Sec 13 CA Act Software programmes can be protected under CA Act. Literary work includes computer programme Sec 2(1)(o)