ISNP Audit Consulting
Insurance Self-Networking Platforms (ISNPs) operate under IRDAI's cybersecurity guidelines and the IRDAI ISNP regulations. Digital Defense delivers full-scope ISNP audit support — covering customer-facing apps, agent portals, policy-issuance flows, payment integration, claims, KYC/CKYC and data-localisation evidence. Reports are signed by a CERT-In Empanelled auditor.
Who needs this
Direct ISNP operators (web aggregators, online insurance brokers)
Insurance companies running their own ISNP
POSP-based insurance platforms
Insurtech startups partnering with insurers under tied-agent or broker model
Reinsurance brokers operating an electronic platform
Problems we solve
- 01
IRDAI inspection findings on weak access controls between policy issuance and underwriting
- 02
Customer data exposure via under-protected admin or agent portals
- 03
Inadequate logging on policy modifications, claim approvals and rejection
- 04
Lack of evidence on data-localisation for policyholder PII and payment data
- 05
Missing or weak BCP / DR testing artifacts
Our methodology
- 1
ISNP-scope mapping
Inventory of policy issuance, claims, KYC, payment, agent, customer and admin flows.
- 2
IRDAI gap-assessment
Mapping current controls against IRDAI ISNP guidelines + IRDAI cybersecurity circulars.
- 3
VAPT
Customer app, agent portal, policy admin, claims, KYC service, payment gateway integration.
- 4
Data flow & localisation
Evidence pack for policyholder PII, payment data, KYC, claims documents staying in India.
- 5
Reporting
CERT-In Empanelled auditor signed report mapped to IRDAI guidelines + remediation tracker.
What you receive
IRDAI ISNP gap-assessment report
Full VAPT report (customer + agent + admin)
Data-localisation evidence pack
BCP / DR drill report
CERT-In Empanelled auditor signed audit report
Frequently asked questions
Do you audit web aggregators specifically?
Yes. Web aggregators have a tighter scope (no policy issuance) — we run targeted audits on the aggregation flow, KYC, customer data and integration with insurers.
Does IRDAI accept your audit report?
Yes — as a CERT-In Empanelled auditor, our reports are accepted by IRDAI inspections and the insurer onboarding the platform.
How often must ISNP audits happen?
IRDAI requires annual cybersecurity audits for ISNPs, with quarterly VA and event-driven audits after major releases or incidents.
What's the audit duration?
Mid-sized ISNP: 4-6 weeks (assessment + VAPT + reporting + 30-day re-test). Larger multi-product platforms: 8-10 weeks.
Do you cover POSP and bancassurance platforms?
Yes — POSP, bancassurance, broker platforms and aggregator platforms all fall under our ISNP audit practice.
Related services
Ready to scope this engagement?
Talk to Digital Defense — India's CERT-In Empanelled cybersecurity team.
Book a consultation