ISNP Security Audit: Quick Overview
What it is
Who performs it
When
What comes out of it
What the ISNP Security Audit Is
An Insurance Self-Network Platform is the electronic platform — a website or mobile application — through which an insurer or a registered intermediary sells and services insurance policies online. Because that platform carries proposal data, KYC and medical records, premium payments and policy issuance, IRDAI does not treat it as ordinary technology. Its controls have to be independently reviewed before it is put in front of policyholders.
The audit is that review. It is scoped around the platform itself: the issuance and payment path end to end, the applications and APIs that sit on it, the infrastructure underneath, and the integrations on either side. It is an assurance exercise against the regulator’s expectations, not a badge the platform displays.
A Note on the Term “ISNP Certification”
Regulatory Basis
| Element | Position |
|---|---|
| Framework for ISNP itself | IRDAI Guidelines on Insurance e-Commerce dated 9 March 2017 |
| Permission to operate a platform | Granted by IRDAI on application in Form ISNP-1 |
| Security expectation | Independent review of the platform’s controls by an external, suitably qualified auditor |
| Auditor qualification | CERT-In empanelled organisation, or equivalently qualified CISA or DISA (ICAI) professional |
| Data protection overlay | Digital Personal Data Protection Act, 2023 alongside the Information Technology Act, 2000 |
IRDAI’s information and cyber security guidance has been revised since the 2017 e-commerce guidelines were issued, and it names ISNPs as a category with their own audit scope. Confirm the current version of both before relying on any specific wording.
Who Needs an ISNP Security Audit
The obligation follows whoever operates the platform:
- ✔Insurers running their own online sale and servicing platform
- ✔Insurance brokers operating an ISNP
- ✔Corporate agents operating an ISNP
- ✔Insurance web aggregators selling through their own platform
- ✔Any regulated entity whose ISNP has materially changed since its last review
A tied individual agent cannot set up an independent ISNP and so does not commission this audit; they transact on the insurer’s platform, which the insurer has had reviewed.
Who Can Perform the Audit
Two things matter, and they are separate. The auditor must be external and independent of the entity being reviewed, and must be suitably qualified. Internal security testing is useful preparation but does not meet the first condition, however competent the team.
In practice the recognised qualification is CERT-In empanelment — a status granted to an auditing firm by the Indian Computer Emergency Response Team, and the benchmark used across Indian financial-sector supervision. An equivalently qualified professional, such as a CISA or DISA (ICAI) holder, is the stated alternative.
What the Audit Covers
Scoping normally settles on five areas. The distinguishing feature is that they are examined as one connected path rather than as separate tests.
| Area | What is examined |
|---|---|
| Application security and VAPT | Web portal, mobile applications and APIs, tested against the OWASP Top 10 |
| Payment and premium flows | Payment gateway integration, premium collection, refunds and settlement paths |
| Policyholder data protection | Proposal, KYC, medical, financial and policy data — encryption and access controls |
| Logging, monitoring and audit trail | Evidence of continuous visibility over data processing |
| Network, infrastructure and ISMS | Network architecture hardening, server and cloud configuration, ISMS alignment |
Application Security and VAPT
Vulnerability assessment and penetration testing across every interface a policyholder or an insurer touches: the web portal, the mobile applications, and the APIs behind both. Testing is normally framed against the OWASP Top 10, with findings rated by severity rather than listed flat.
Undocumented APIs are the usual source of scope creep here. An API inventory that is complete before scoping starts is the single most useful thing a platform team can prepare.
Payment and Premium Flows
The issuance and payment path is scoped end to end, including the integrations on either side of it, because that is where regulatory harm concentrates. A payment page tested in isolation tells the regulator very little about whether a premium can be collected, reconciled and refunded correctly under failure conditions.
Refunds and settlement are part of this, not an afterthought — a platform that collects reliably but cannot evidence a clean refund path has a finding.
Policyholder Data Protection
An ISNP holds some of the most sensitive categories of personal data a financial platform handles: proposal details, KYC documents, medical reports, financial information and the policy record itself. The audit examines how that data is encrypted at rest and in transit, and who can reach it.
Read the controls against the Digital Personal Data Protection Act, 2023 as well as the Information Technology Act, 2000. Access control, retention and breach handling are where the two frameworks meet in practice.
Logging, Monitoring and Audit Trail
The expectation is evidence of continuous visibility over data processing, not a log file that exists somewhere. That means logging that captures the events that matter, alerting that fires on them, and an audit trail that can reconstruct what happened to a given proposal or policy after the fact.
A trail that cannot be reconstructed is treated as absent, however much data is being written.
Network, Infrastructure and ISMS
Network architecture hardening and configuration review of the servers or cloud environment the platform runs on, together with alignment to a recognised information security management system. Entities already holding ISO 27001 generally find this portion straightforward to evidence — but it is not a substitute for the audit, because ISO certifies a management system while this reviews one platform against IRDAI’s expectations.
Where a third-party vendor supplies or hosts the platform, vendor and third-party risk widens the scope rather than narrowing it. The obligation stays with the regulated entity.
What You Receive
- ✔Audit report setting out scope, methodology and findings
- ✔Risk-rated findings with severity and remediation guidance
- ✔Executive summary written for the board
- ✔Independent retesting of critical and high findings
- ✔Signed audit certificate from the empanelled firm
- ✔Report structured for filing, with evidence references and attestation
The certificate is issued by the auditor, not by IRDAI and not by the entity being audited. Findings capable of harming policyholders are escalated rather than simply recorded.
Step-by-Step Audit Process
Scoping
Applications, APIs, payment path, hosting model and integrations are inventoried, and the boundary of the review is agreed.
Documentation review
Architecture, data-flow, access-control and vendor documentation are examined before testing begins.
Testing
Vulnerability assessment and penetration testing across the portal, mobile applications and APIs, plus configuration and network review.
Findings and rating
Findings are rated by severity with remediation guidance, and escalated where policyholders could be harmed.
Remediation
The platform team closes findings, with critical and high items prioritised because they gate the report.
Retesting
The auditor independently re-examines critical and high findings to confirm they are actually closed.
Report and certificate
The final report is issued in filing-ready form, with the signed certificate from the empanelled firm.
Timeline
| Stage | Indicative duration |
|---|---|
| Scoping and documentation review | Roughly 1 week |
| Testing | Roughly 1–2 weeks, depending on the number of applications and APIs |
| Remediation | Driven by findings, not by the auditor |
| Retesting and final report | Roughly 1 week |
| Total, scoping to final report | Typically 3–6 weeks |
Engagements needing substantial remediation run longer, because critical and high findings are normally retested before the report closes. The remediation row is the one that moves — plan launch dates around it rather than around the testing window.
Annual Re-Audit and Continuing Obligations
The review is not a one-off clearance. The framework expects the platform’s controls to be independently reviewed before it is operated and on a recurring annual basis thereafter, with the report available to the regulator.
Between cycles, a material change to the platform, its payment path or its hosting normally warrants re-scoping rather than relying on the previous report. Treat the audit as a standing annual obligation and confirm the current position for your category of applicant.
How This Fits With ISNP Registration
These are two distinct steps and they are easy to conflate.
| ISNP Registration | ISNP Security Audit | |
|---|---|---|
| What it is | IRDAI permission to set up the platform | Independent review of the platform’s security controls |
| Who grants or issues it | IRDAI | The CERT-In empanelled auditor |
| How it is applied for | Form ISNP-1, with the prescribed fee | Commissioned directly from a qualified auditor |
| When | Before the platform is set up | Before it goes live, and annually thereafter |
| Recurs? | Permission, subject to continuing conditions | Yes, on an annual cycle |
For the permission itself — eligibility, who may apply, Form ISNP-1 and the application process — see the ISNP Registration guide.
Findings That Commonly Delay Launch
- ✔Undocumented or undiscovered APIs surfacing mid-test
- ✔A test environment that does not mirror production
- ✔Access controls that are role-based on paper but permissive in practice
- ✔Audit trails that record events but cannot reconstruct a transaction
- ✔Refund and settlement paths untested under failure conditions
- ✔Third-party or white-labelled components with no vendor assurance
- ✔Remediation without named owners, producing repeated retest cycles
How to Prepare Before Scoping
Four things move the timeline more than anything else, and all four are within the platform team’s control before the auditor is engaged:
- ✔Current architecture and data-flow documentation
- ✔A complete API inventory, including internal and partner APIs
- ✔A test environment that genuinely mirrors production
- ✔Named owners for remediation, with authority to ship fixes
Closing documentation gaps before testing starts is considerably cheaper than discovering them as findings.
How Estabizz Helps
We work on the compliance side of the engagement rather than replacing the auditor:
- ✔Scoping support and readiness assessment before testing begins
- ✔Documentation and policy gap closure
- ✔Coordination with the CERT-In empanelled auditor
- ✔Remediation tracking through to retesting
- ✔Preparing the report for filing
- ✔Planning the annual review cycle
FAQs
What is an ISNP security audit?
It is the independent security review of an Insurance Self-Network Platform that IRDAI expects before the platform is used to sell or service insurance, and on a recurring basis afterwards. It examines the platform as an operating system end to end rather than as a generic web application.
Is the audit mandatory?
For an entity operating an ISNP, an independent security review is part of the compliance expectation rather than an optional assurance exercise. Confirm the current requirement and its exact wording against the applicable IRDAI guidance for your category of applicant.
Who can carry out the audit?
IRDAI expects an external, independent and suitably qualified auditor. In practice this means a CERT-In empanelled organisation, or an equivalently qualified professional such as a CISA or DISA (ICAI) holder.
What is CERT-In empanelment?
It is a status granted to an auditing firm by the Indian Computer Emergency Response Team. It is the auditor qualification recognised across Indian financial-sector supervision, which is why it is the usual benchmark for ISNP work.
When does the audit have to happen?
Before the platform goes live, and then on a recurring annual cycle. A platform that has changed materially since its last review is usually re-scoped rather than carried forward on the old report.
How long does an audit take?
Typically three to six weeks from scoping to final report. Engagements that uncover substantial remediation work run longer, because critical and high findings are normally retested before the report is closed.
What does the audit cover?
Five areas in the usual scoping:
- Application security and VAPT across the web portal, mobile apps and APIs
- Payment gateway integration, premium collection, refunds and settlement paths
- Policyholder data protection across proposal, KYC, medical, financial and policy data
- Logging, alerting and audit trail
- Network architecture, server and cloud configuration, and ISMS alignment
Does it include penetration testing?
Yes. Application security work is normally vulnerability assessment and penetration testing against the OWASP Top 10, covering the web portal, mobile applications and the APIs behind them.
Why are payment flows scoped separately?
Because the issuance and payment path is where regulatory harm concentrates. The scope usually follows that path end to end, including the integrations on either side of it, rather than testing the payment page in isolation.
What is delivered at the end?
The usual deliverable set is:
- An audit report setting out scope, methodology and findings
- Risk-rated findings with severity and remediation guidance
- An executive summary written for the board
- Independent retesting of critical and high findings
- A signed audit certificate from the empanelled firm
Is the report filed with IRDAI?
The report is prepared in a form suitable for filing, covering scope, methodology, control status, findings, evidence references and attestation. Confirm the filing route and timing that applies to your entity before submission.
What happens if findings are severe?
Findings capable of harming policyholders are escalated rather than simply logged. Severe findings ordinarily have to be remediated and retested before the platform is treated as ready.
Does this replace ISNP registration?
No. Registration is the IRDAI permission to set up the platform. The security audit is the assurance step that sits inside that compliance picture and recurs after approval.
Is this the same as ISO 27001?
No. ISO 27001 certifies an information security management system against an international standard. The ISNP audit is a sector-specific review of one platform against IRDAI’s expectations. ISMS alignment often forms part of the audit scope, but the two are not interchangeable.
Do we need ISO 27001 as well?
It is not a substitute for the ISNP audit. Many insurers and intermediaries hold it because it makes the network and ISMS portion of the audit considerably easier to evidence.
Can our internal security team do the audit?
No. The review has to be external and independent. Internal testing is useful preparation but does not satisfy the independence expectation.
What if we use a third-party platform vendor?
The obligation sits with the regulated entity operating the ISNP, not the vendor. Vendor and third-party risk is itself an area the audit looks at, so a shared or white-labelled platform tends to widen scope rather than narrow it.
Does the audit cover our cloud environment?
Yes, where the platform runs on it. Server and cloud configuration review is part of the infrastructure portion of the scope.
How does the DPDP Act affect this?
The Digital Personal Data Protection Act, 2023 applies to the personal data an ISNP processes, alongside the IT Act, 2000. Data protection controls examined in the audit should be read against both, not against the IT Act alone.
What is retesting?
After remediation, the auditor independently re-examines the critical and high findings to confirm they are actually closed, rather than accepting a written assurance that the fix has been applied.
How much does it cost?
It is scoped work, so cost depends on the number of applications and APIs, the complexity of the payment path, the hosting model and how much remediation is expected. We quote after scoping rather than from a rate card.
What delays audits most often?
Incomplete environment access, a test environment that does not mirror production, undocumented APIs, and remediation cycles that need more than one round of retesting.
Do we need a separate audit for the mobile app?
Not a separate engagement, but the mobile application is its own scope item within the audit, alongside the web portal and the APIs.
What if the platform changes after the audit?
A material change to the platform, its payment path or its hosting usually warrants re-scoping rather than relying on the previous report.
Who signs the audit certificate?
The CERT-In empanelled firm that performed the work. The certificate is issued by the auditor, not by IRDAI, and not by the entity being audited.
Can a startup intermediary get through this?
Yes. The scope follows the platform, so a smaller, simpler platform is a smaller engagement. The independence and qualification expectations are the same regardless of size.
What should we do before scoping?
Have the architecture and data-flow documentation current, the API inventory complete, a test environment that mirrors production, and named owners for remediation. These four things move the timeline more than anything else.
Is an annual audit really required every year?
The framework expects the platform’s controls to be independently reviewed on a recurring basis, with the report available to the regulator. Treat it as an annual cycle and confirm the current position for your category.
Does the audit look at KYC and AML controls?
Yes, where they are implemented in the platform. KYC and AML controls form part of the integrated review of the issuance path.
Where can I read the underlying framework?
ISNP itself sits under the IRDAI Guidelines on Insurance e-Commerce dated 9 March 2017. The security expectations are read together with IRDAI’s information and cyber security guidance, which has been revised since. Confirm the current versions before relying on either.
Reviewer and Disclaimer
This guide is general information, not engagement-specific advice. ISNP requirements, audit expectations and the applicable IRDAI guidance change, and the scope of any particular review depends on the platform. Confirm the current position with IRDAI, your auditor and your professional adviser before acting.
Speak to Our Compliance Expert
If you are preparing an Insurance Self-Network Platform for launch, or the annual review is due, get in touch and we will help you scope it.