IRDAI’s 30 days, on every cloud finding.
The 2026 guidelines give high-risk gaps 30 days and every audit gap two months, with exceptions approved by the right person for how long they last. NxSCORE puts those dates on each cloud finding and keeps the record your committee reviews.
You will recognise this if
- The April 2026 guidelines replaced the 2023 ones, and your cloud controls still point to the old clauses.
- High-risk gaps have 30 days, and the count of days lives in a spreadsheet.
- Exceptions are approved by email, and nobody tracks when they run out.
- Before each ISRMC meeting, someone gathers the cloud figures by hand.
What IRDAI asks of your cloud.
IRDAI Information and Cyber Security Guidelines, 2026 (Version 2.0), IRDAI/GA&HR/CIR/MISC/51/4/2026, 6 April 2026. Each clause beside the figure NxSCORE reports against it every quarter.
| Clause | What it asks | What the quarterly pack shows |
|---|---|---|
| §2.16 ¶3.5.1 (9, 10) | High-risk gaps closed within 30 days and re-validated; all audit gaps within 2 months | Findings closed in the quarter, the share closed by their fix-by date, and what is past it |
| §1.6(1), §1.6(4) | Board-approved gap closure, with vulnerabilities remediated in a timely manner | Resources that failed again after a fix, and prevention plans in place and holding |
| §1.5(II), §1.6(13, 14) | The ISRMC and the IT Steering Committee review security every quarter | The pack itself: found, closed, time to fix, recurrence, exceptions and evidence, per quarter |
| §1.9(II) | Exceptions approved by the CISO for up to 3 months, and by the RMC or the Board for longer | Exceptions active, and those expiring within 90 days |
| §2.5, §2.11 | Minimum baseline security standards, hardening and drift detection | Baseline controls failing in at least one account at the latest assessment |
| §2.2 | A comprehensive asset inventory | The cloud resources NxSCORE knows across the assessed accounts |
| §2.16 ¶3.2 (14) | Logs kept for 180 days within India, as CERT-In directs | Whether the logging controls pass, and which fail |
The 2026 guidelines replace the 2023 guidelines for insurers and the other entities IRDAI regulates.
From the clause to a date on every finding.
The deadline stops being a number in a policy document. Every cloud finding carries its own date, and everyone can see which are past it.
- 01
Fix-by dates from the rule you follow.
Each finding’s fix-by date runs from the day NxSCORE first saw it, by severity. One choice in Settings sets these from §2.16. Your own policy can be stricter.
Fix-by dates, IRDAISettings- High30 days
- Medium60 days
- Low60 days
- 02
What is past its date, today.
Every open finding is overdue, due this week, on track or risk accepted. Your analyst works the overdue and the nearly due first, and writes the fix your engineers run.
A finding closes only when a later assessment no longer sees it, so the date it closed is the date it was really fixed.
PrioritiesExample- Public access on 58 buckets, prod-paymentsDue this week
- IMDSv1 on 44 instances, data-lakeOverdue
- Unused key, svc-reportingOn track
- Port 22 open on bastion-drRisk accepted
- 03
Exceptions with a reason, a decider and an end date.
When a gap cannot be closed in time, anyone can ask to accept the risk. Your security team decides, with a reason and an expiry date no more than 12 months away, and the pack shows every exception that is active and every one expiring in the next 90 days. Each one shows how long it runs, so your committee can see which need the RMC or the Board.
Exception, bastion-drRisk acceptedFinding Port 22 open on bastion-dr Reason Vendor access until the DR site moves to Session Manager Asked by infra team Decided by Security team Expires 31 March 2027, then counts against its fix-by date again - 04
Closed once, and kept closed.
A resource that fails again after a fix is counted as back again, not as new. When the same cause keeps returning, NxSCORE proposes a prevention plan for your team to agree and apply, and marks it verified after 14 days without the problem coming back.
Prevention plan, public bucketsApplied- Came backFixed three times this quarter, failed again each time.
- AgreedA guardrail on new buckets, agreed with the platform team.
- AppliedIn place. Watching for the problem to return.
- VerifiedAfter 14 days without it coming back.
Every date kept in one record. Now, the quarter in one pack.
Every quarter, a pack your committee can sign.
The figures your committee asks for, from the record your team works in, laid out against IRDAI’s clauses.
- 05
Checked every day, not before the meeting.
Every connected account is assessed every day, through read-only access. The baseline controls, the logging controls and the resources seen are part of the record the pack is built from.
The guidelines ask for cloud providers empanelled by MeitY and for the storage location to be in the contract. For AWS, the pack can also show the resources NxSCORE found outside the Mumbai and Hyderabad regions.
Daily assessmentRead-onlyBaseline Controls failing in at least one account Logging CloudTrail in every region, log validation, trail bucket logging and encryption, flow logs Inventory Every resource seen in the assessed accounts - 06
Your figures, laid out against IRDAI.
The pack covers the last four quarters: findings found and closed, the median time to fix, what closed within its fix-by date, what failed again, prevention plans, exceptions, and evidence accepted or waiting.
Its IRDAI sheet says which clause each figure speaks to. It never says you comply: that is for you, your auditors and the regulator.
IRDAI mappingExample§2.16 ¶3.5.1 (9, 10) 41 findings closed this quarter, 88% within fix-by dates; 6 open past their date. Exceptions 9 exceptions active; 2 expire within 90 days. Recurrence 3 resources failed again after a fix; 4 prevention plans in place, 2 verified. - 07
Prepared, reviewed and approved by three people.
Data that arrives after the pack is prepared cannot change what was signed. Set it to run every quarter, and it goes to your committee by email only once an owner has approved it.
Board pack, Q3 2026Signed- PreparedThe workbook is frozen and its SHA-256 recorded.
- ReviewedBy someone who did not prepare it.
- ApprovedBy a workspace owner. The sign-off sheet names all three.
Questions about IRDAI and the cloud.
How long do insurers have to close a high-risk gap under the 2026 guidelines?
30 days, after which the fix is re-validated, under §2.16 ¶3.5.1 of the IRDAI Information and Cyber Security Guidelines, 2026. All audit gaps are to be closed within two months. NxSCORE sets fix-by dates of 30, 60 and 60 days from these.
Who can approve an exception under the IRDAI guidelines?
Under §1.9(II), the CISO for up to three months, the risk management committee for longer, and the Board for more than a year. In NxSCORE your security team records each exception with its reason and expiry, and the quarterly pack lists them for the committee.
Does the quarterly pack say we comply with the guidelines?
No. It lays your own figures for the quarter against the clauses they speak to. Whether you comply is for you, your auditors and IRDAI to judge.
Does NxSCORE check that logs are kept for 180 days in India?
NxSCORE checks that cloud logging is on and protected: CloudTrail in every region, log file validation, access logging and encryption on the trail bucket, and VPC flow logs. How long you keep the logs, and where, is set by your own retention and shown by your team.
See which gaps are past their 30 days.
Connect one cloud account and apply the IRDAI fix-by dates. After the first assessment, your analyst takes you through what is overdue, which exceptions are running out, and how the quarter’s pack reads against the guidelines.