Cybernerds, a CERT-In Empanelled Information Security Auditor, conducts independent security audits for Insurance Self-Network Platforms in alignment with IRDAI's e-commerce guidelines and cybersecurity requirements.

  • Not sure if your platform is audit-ready?
  • What Is an ISNP?

An Insurance Self-Network Platform (ISNP) is any digital platform , website, mobile application, or both , set up by an insurer or insurance intermediary to sell, service, or manage insurance products online, with prior IRDAI approval.

Operating an ISNP comes with a direct compliance obligation: an annual independent security audit covering your platform's controls, data handling practices, and operational governance.

Who Needs This Audit

  • Insurers operating their own digital portals
  • Insurance brokers and corporate agents with customer-facing platforms
  • Web aggregators
  • Third-party administrators (TPAs) with policyholder self-service portals
  • Insurtechs and digital-first insurance distribution platforms

A note on classification: Under IRDAI's 2026 cybersecurity guidelines, every entity operating an ISNP is automatically classified as Category 2 , regardless of revenue size. This means higher control intensity applies even to smaller platforms.

What the Audit Covers

The ISNP audit evaluates your platform across six core areas:

  • Platform and Infrastructure Security
  • Data Protection and Privacy
  • Application and API Security
  • KYC, Transactions, and Onboarding
  • Grievance Management and Transparency
  • Governance and Operational Resilience

Our Audit Methodology

A structured, evidence-based approach across five phases:

  • Scope and Applicability Review — Confirm ISNP registration, category classification, and applicable control requirements
  • Document and Policy Review — Board approvals, IT architecture, data flow diagrams, DR plan, grievance mechanism documentation
  • Platform and Technical Assessment — Hosting compliance, encryption configuration, access controls, API security, and VAPT review
  • KYC and Transaction Controls Validation — e-Policy issuance, payment security, consent mechanisms, and transaction log completeness
  • Observation and Reporting — Gaps documented with reference to applicable IRDAI guideline; adverse findings identified for regulatory reporting
  • Typical Gaps We Find

Real observations from ISNP audit engagements:

  • Mobile app excluded from VAPT scope , web-only testing is insufficient
  • Servers hosted outside India or domain not registered , a direct non-compliance
  • Grievance mechanism non-functional or not accessible to policyholders
  • VAPT conducted once at go-live and not repeated annually
  • Third-party vendors processing policyholder data with no security assessment
  • DPDP Act measures absent despite being embedded in the 2026 guidelines

What You Receive

  • ISNP Audit Report — Platform-level findings, control observations, and evidence references structured for IRDAI submission
  • Evidence Mapping Document — Control-to-evidence mapping across all six audit areas
  • Adverse Findings Summary — Where applicable, documented for mandatory IRDAI reporting alongside an action plan

Our Perspective

We treat the ISNP audit as an assessment of whether your platform genuinely protects the policyholders using it , not just whether it passes a checklist.

As a CERT-In Empanelled Information Security Auditor, Cybernerds brings:

  • Independence from your platform and technology vendors
  • Evidence-backed assessment of live platform controls
  • Regulatory interpretation grounded in IRDAI's actual expectations
  • Practical observations that go beyond documentation compliance
  • Explore the Preparation Guide
  • Want to know what documentation, configurations, and evidence your platform needs before the audit begins?

Review a Sample Audit Output

See how ISNP audit findings, platform control evaluations, and evidence mapping is structured.

Speak With Our Experts

If your organization operates an ISNP or is preparing for its annual audit, connect with our team for an independent and structured assessment.