Cybersecurity for Web Aggregators: 6 Complete Rules | Osto<\/title>\n<meta name=\"description\" content=\"Cybersecurity requirements for insurance web aggregators: the ISNP audit, tier classification, VAPT, incident reporting, and vendor risk, and how to comply.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">Cybersecurity requirements for insurance web aggregators are among the strictest for any IRDAI intermediary, because your platform sells insurance and holds policyholder data. Here is exactly what the guidelines demand, and how a lean team meets it.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>IRDAI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>The short answer<\/h2>\n <p>Cybersecurity requirements for insurance web aggregators come from the IRDAI Information and Cyber Security Guidelines. Because an aggregator runs an Insurance Self-Network Platform, it must pass an annual ISNP security audit covering its web app, mobile app, APIs, and infrastructure, appoint an independent CISO, run VAPT at least twice a year with critical findings closed in 30 days, report critical incidents to CERT-In within six hours, and manage third-party risk. Under the 2026 tier classification, aggregators sit at a higher control tier regardless of revenue.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">Why aggregators are high-scrutiny<\/a><\/li>\n <li><a href=\"#isnp\">The ISNP platform audit<\/a><\/li>\n <li><a href=\"#tier\">Your tier and the special rule<\/a><\/li>\n <li><a href=\"#obligations\">The core obligations<\/a><\/li>\n <li><a href=\"#reporting\">Testing and reporting<\/a><\/li>\n <li><a href=\"#osto\">How Osto helps aggregators comply<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec c-sky\" id=\"what\">Why the cybersecurity requirements for insurance web aggregators are strict<\/h2>\n <p>A web aggregator is a customer-facing platform that compares and sells insurance online, which means it sits directly on the flow of policyholder data. The <a href=\"https:\/\/irdai.gov.in\/\" target=\"_blank\" rel=\"noopener\">Insurance Regulatory and Development Authority of India<\/a> names web aggregators explicitly as an intermediary bound by its Information and Cyber Security Guidelines, so these requirements apply to aggregators in full. Unlike an agent, an aggregator operates its own digital platform, so it carries the heavier, platform-level obligations rather than a minimum baseline.<\/p>\n\n <h2 class=\"sec c-sage\" id=\"isnp\">The ISNP platform audit<\/h2>\n <p>The requirement that most defines these obligations is the Insurance Self-Network Platform audit. An ISNP is the website or app an aggregator runs with IRDAI permission to transact insurance online, and it must be security-reviewed at least once a year, and often before go-live.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The platform<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What an ISNP audit actually examines<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Web aggregators run an Insurance Self-Network Platform, so the requirements centre on that platform. The audit reaches four connected surfaces, not just the website.<\/div>\n <svg viewBox=\"0 0 800 232\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"What the ISNP security audit covers for an insurance web aggregator\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">What the ISNP security audit covers<\/text><rect x=\"16\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"107\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(96.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M4 12h16M12 4c2.5 2.2 2.5 13.8 0 16M12 4c-2.5 2.2-2.5 13.8 0 16\"\/><\/g><text x=\"107\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Web application<\/text><text x=\"107\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">The public aggregator<\/text><text x=\"107\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">site and portal<\/text><rect x=\"214\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"305\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(294.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"7\" y=\"3\" width=\"10\" height=\"18\" rx=\"2\"\/><path d=\"M11 18h2\"\/><\/g><text x=\"305\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Mobile app<\/text><text x=\"305\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">The customer-facing<\/text><text x=\"305\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">app and journeys<\/text><rect x=\"412\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"503\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(492.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M8 8l-4 4 4 4M16 8l4 4-4 4M13 6l-2 12\"\/><\/g><text x=\"503\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">APIs<\/text><text x=\"503\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Data pipelines to<\/text><text x=\"503\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">insurers and partners<\/text><rect x=\"610\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"701\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(690.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4\" y=\"4\" width=\"16\" height=\"7\" rx=\"1.5\"\/><rect x=\"4\" y=\"13\" width=\"16\" height=\"7\" rx=\"1.5\"\/><path d=\"M8 7.5h.01M8 16.5h.01\"\/><\/g><text x=\"701\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Infrastructure<\/text><text x=\"701\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Servers, cloud, and<\/text><text x=\"701\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">access controls<\/text><\/svg>\n \n<\/div>\n\n <p>The ISNP audit is not a website scan. It covers the web application, the mobile app and its customer journeys, the APIs that pipe data between the aggregator, insurers, and partners, and the underlying infrastructure and access controls. API security matters especially here, because an aggregator’s whole model is moving data between parties. A grounding in the <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">types of VAPT<\/a> helps scope this correctly across all four surfaces.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The platform is the product, and the audit knows it<\/div>For an aggregator, the ISNP is the business. An audit that only checks the marketing site and skips the APIs and mobile app gives false comfort, and will not satisfy an IRDAI review of your platform.<\/div>\n\n <h2 class=\"sec c-apri\" id=\"tier\">Your tier and the web-aggregator special rule<\/h2>\n <p>The cybersecurity requirements for insurance web aggregators also scale with size. The 2026 version of the guidelines added a formal three-tier classification of intermediaries by gross insurance revenue, and your tier sets how intense your controls must be.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">Where you sit<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Your tier sets the intensity<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The 2026 guidelines classify intermediaries into three tiers by gross insurance revenue, and the tier decides how heavy your controls are. There is one exception aggregators need to know.<\/div>\n <svg viewBox=\"0 0 800 256\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"How the IRDAI intermediary tier classification applies to web aggregators\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Intermediaries are tiered by revenue<\/text>\n <rect x=\"16\" y=\"60\" width=\"240\" height=\"120\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/>\n <text x=\"36\" y=\"92\" fill=\"#1C267A\" font-size=\"13.5\" font-weight=\"800\">Category 1<\/text>\n <text x=\"36\" y=\"114\" fill=\"#5b6178\" font-size=\"11\">Largest by gross<\/text><text x=\"36\" y=\"130\" fill=\"#5b6178\" font-size=\"11\">insurance revenue<\/text>\n <text x=\"36\" y=\"158\" fill=\"#1C267A\" font-size=\"11\" font-weight=\"700\">Heaviest controls<\/text>\n <rect x=\"276\" y=\"60\" width=\"240\" height=\"120\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/>\n <text x=\"296\" y=\"92\" fill=\"#1C267A\" font-size=\"13.5\" font-weight=\"800\">Category 2<\/text>\n <text x=\"296\" y=\"114\" fill=\"#5b6178\" font-size=\"11\">Mid-tier by<\/text><text x=\"296\" y=\"130\" fill=\"#5b6178\" font-size=\"11\">revenue<\/text>\n <text x=\"296\" y=\"158\" fill=\"#1C267A\" font-size=\"11\" font-weight=\"700\">Core controls<\/text>\n <rect x=\"536\" y=\"60\" width=\"248\" height=\"120\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/>\n <text x=\"556\" y=\"92\" fill=\"#1C267A\" font-size=\"13.5\" font-weight=\"800\">Category 3<\/text>\n <text x=\"556\" y=\"114\" fill=\"#5b6178\" font-size=\"11\">Smallest in scope<\/text>\n <text x=\"556\" y=\"158\" fill=\"#1C267A\" font-size=\"11\" font-weight=\"700\">Baseline controls<\/text>\n <rect x=\"16\" y=\"196\" width=\"768\" height=\"44\" rx=\"12\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.4\"\/>\n <text x=\"400\" y=\"223\" text-anchor=\"middle\" fill=\"#0a6558\" font-size=\"12.5\" font-weight=\"700\">Special rule: web aggregators and ISNP operators sit at a higher control tier, whatever their revenue<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Larger intermediaries by revenue fall into the higher categories with the heaviest controls, and smaller ones into lighter tiers. But there is a special rule that matters directly to aggregators: because aggregators and ISNP operators run a public transaction platform, they are placed at a higher control tier regardless of their revenue. In short, you do not get the light-tier treatment just because you are small, running the platform is what sets your obligations.<\/p>\n\n <h2 class=\"sec c-plum\" id=\"obligations\">The core cybersecurity requirements for insurance web aggregators<\/h2>\n <p>Alongside the platform audit, a common set of controls completes the picture. These formalise strong practice into mandatory, evidenced duties.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The obligations<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What you have to run and evidence<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Beyond the platform audit, a recognisable core of controls makes up the cybersecurity requirements for insurance web aggregators. These are the duties an inspection checks first.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core cybersecurity obligations for insurance web aggregators\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core obligations for web aggregators<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"9\" cy=\"8\" r=\"3\"\/><path d=\"M3.5 20a5.5 5.5 0 0 1 11 0\"\/><path d=\"M16 6a3 3 0 0 1 0 6\"\/><path d=\"M17 14.5a5.5 5.5 0 0 1 3.5 5.5\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Independent CISO<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Not reporting to the head of IT<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"7\"\/><path d=\"M12 2v4M12 18v4M2 12h4M18 12h4\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">VAPT twice a year<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Web, mobile, and API testing<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Six-hour reporting<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Critical incidents to CERT-In<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Annual audit<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">CERT-In empanelled, ISNP review<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M8 11l2-2 3 3 2-2 3 3\"\/><path d=\"M3 8l4-2 5 3M21 8l-4-2-3 2\"\/><path d=\"M6 12l3 3M18 12l-3 3\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Vendor risk<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Assess every data partner<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4.5\" y=\"10.5\" width=\"15\" height=\"9.5\" rx=\"2\"\/><path d=\"M8 10.5V7a4 4 0 0 1 8 0v3.5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Data protection<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Encryption and access control<\/text><\/svg>\n \n<\/div>\n\n <p>In practice that means an independent Chief Information Security Officer who does not report to the head of IT and carries no business targets, a vulnerability assessment and penetration testing programme run at least twice a year across web, mobile, and API surfaces, cyber incident reporting to CERT-In within six hours, an annual audit by a CERT-In empanelled auditor, third-party risk management for every data partner, and data protection with encryption and access control. Together these are the operating core of the obligations.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">CISO independence is now structural<\/div>The guidelines are explicit that the CISO must not sit under the head of IT or carry business targets, and must brief the board and risk committee regularly. For an aggregator, that separation is one of the first things an inspection verifies.<\/div>\n\n <h2 class=\"sec c-sky\" id=\"reporting\">Testing cadence and incident reporting<\/h2>\n <p>Two timelines sit at the heart of day-to-day compliance. VAPT must run at least twice a year, and any critical or high-severity finding has to be remediated within thirty days. An internet-facing platform carrying an open high finding past that window is a common failure.<\/p>\n<p>On incidents, critical events such as a breach or ransomware must be reported to CERT-In within six hours of detection, with a copy to IRDAI, and other incidents within twenty-four hours. Because the clock starts at detection, meeting it is really a demand for monitoring good enough to catch and confirm an incident fast. An automated scan alone will not satisfy the testing requirement, our guide on <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">VAPT versus vulnerability scanning<\/a> explains why skilled, human-led testing is what an ISNP audit expects.<\/p>\n\n <h2 class=\"sec c-sage\" id=\"osto\">How Osto helps aggregators comply<\/h2>\n <p>Meeting all of this, an ISNP-grade platform audit, a twice-yearly VAPT cadence across web, mobile, and API, six-hour-ready incident detection, vendor risk, and an audit-ready file, is a heavy lift for a lean aggregator without a dedicated security team. Piecing it together from separate tools and consultants is slow and hard to keep current, which is the gap Osto is built to close.<\/p>\n\n <p>Osto is a one-stop security and compliance platform purpose-built for fast-moving teams. For a web aggregator, it runs VAPT across your web application, mobile app, and APIs, correlates security events so incidents surface fast enough to report on time, supports encryption, data-handling, and third-party risk controls, and keeps organised, audit-ready evidence mapped across the IRDAI expectations, DPDP, and other frameworks in one place. Osto does not act as your CERT-In empanelled auditor or your insurer, it gets your platform audit-ready and keeps it there, so the ISNP audit becomes a verification rather than a scramble.<\/p>\n\n <div class=\"callout\">\n <h3>Get your ISNP audit-ready without a big team.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving teams. Test your web, mobile, and API surfaces, stand up monitoring for fast incident reporting, manage vendor risk, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>Do IRDAI cybersecurity rules apply to web aggregators?<\/summary><p>Yes. Web aggregators are named explicitly as an insurance intermediary bound by the IRDAI Information and Cyber Security Guidelines. Because they run a public platform, they carry heavier, platform-level obligations than agents.<\/p><\/details>\n <details><summary>What is an ISNP security audit?<\/summary><p>An Insurance Self-Network Platform audit is a security review of the platform an aggregator runs with IRDAI permission to sell insurance online. It covers the web application, mobile app, APIs, and infrastructure, and is required at least annually, often before go-live.<\/p><\/details>\n <details><summary>How often must a web aggregator run VAPT?<\/summary><p>At least twice a year, across web, mobile, and API surfaces, with critical and high-severity findings remediated within thirty days. Evidence of remediation is checked at the annual audit.<\/p><\/details>\n <details><summary>Does the tier classification affect web aggregators?<\/summary><p>Yes, but with a special rule. Intermediaries are tiered by gross insurance revenue, yet web aggregators and ISNP operators are placed at a higher control tier regardless of revenue, because they run a public transaction platform.<\/p><\/details>\n <details><summary>What is the incident reporting timeline for aggregators?<\/summary><p>Critical incidents must be reported to CERT-In within six hours of detection, with a copy to IRDAI, and all other incidents within twenty-four hours, in the prescribed format. The clock runs from detection.<\/p><\/details>\n <details><summary>Who conducts the audit, and can Osto do it?<\/summary><p>The annual audit is conducted by a CERT-In empanelled auditor. Osto gets your platform audit-ready, running VAPT, monitoring, and evidence, but it does not act as the empanelled auditor or as an insurer.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>Cybersecurity for Web Aggregators: 6 Complete Rules | Osto Cybersecurity requirements for insurance web aggregators are among the strictest for\u2026<\/p>\n","protected":false},"author":8,"featured_media":1313,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[696],"class_list":["post-1312","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-insurance-web-aggregator"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1312"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1312\/revisions"}],"predecessor-version":[{"id":1314,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1312\/revisions\/1314"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1313"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1312,"date":"2026-09-17T07:01:47","date_gmt":"2026-09-17T07:01:47","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1312"},"modified":"2026-09-17T07:01:47","modified_gmt":"2026-09-17T07:01:47","slug":"insurance-web-aggregators","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/insurance-web-aggregators\/","title":{"rendered":"Cybersecurity Requirements for Insurance Web Aggregators"},"content":{"rendered":"\n\n\n\n\n\nCybersecurity for Web Aggregators: 6 Complete Rules | Osto<\/title>\n<meta name=\"description\" content=\"Cybersecurity requirements for insurance web aggregators: the ISNP audit, tier classification, VAPT, incident reporting, and vendor risk, and how to comply.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">Cybersecurity requirements for insurance web aggregators are among the strictest for any IRDAI intermediary, because your platform sells insurance and holds policyholder data. Here is exactly what the guidelines demand, and how a lean team meets it.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>IRDAI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>The short answer<\/h2>\n <p>Cybersecurity requirements for insurance web aggregators come from the IRDAI Information and Cyber Security Guidelines. Because an aggregator runs an Insurance Self-Network Platform, it must pass an annual ISNP security audit covering its web app, mobile app, APIs, and infrastructure, appoint an independent CISO, run VAPT at least twice a year with critical findings closed in 30 days, report critical incidents to CERT-In within six hours, and manage third-party risk. Under the 2026 tier classification, aggregators sit at a higher control tier regardless of revenue.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">Why aggregators are high-scrutiny<\/a><\/li>\n <li><a href=\"#isnp\">The ISNP platform audit<\/a><\/li>\n <li><a href=\"#tier\">Your tier and the special rule<\/a><\/li>\n <li><a href=\"#obligations\">The core obligations<\/a><\/li>\n <li><a href=\"#reporting\">Testing and reporting<\/a><\/li>\n <li><a href=\"#osto\">How Osto helps aggregators comply<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec c-sky\" id=\"what\">Why the cybersecurity requirements for insurance web aggregators are strict<\/h2>\n <p>A web aggregator is a customer-facing platform that compares and sells insurance online, which means it sits directly on the flow of policyholder data. The <a href=\"https:\/\/irdai.gov.in\/\" target=\"_blank\" rel=\"noopener\">Insurance Regulatory and Development Authority of India<\/a> names web aggregators explicitly as an intermediary bound by its Information and Cyber Security Guidelines, so these requirements apply to aggregators in full. Unlike an agent, an aggregator operates its own digital platform, so it carries the heavier, platform-level obligations rather than a minimum baseline.<\/p>\n\n <h2 class=\"sec c-sage\" id=\"isnp\">The ISNP platform audit<\/h2>\n <p>The requirement that most defines these obligations is the Insurance Self-Network Platform audit. An ISNP is the website or app an aggregator runs with IRDAI permission to transact insurance online, and it must be security-reviewed at least once a year, and often before go-live.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The platform<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What an ISNP audit actually examines<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Web aggregators run an Insurance Self-Network Platform, so the requirements centre on that platform. The audit reaches four connected surfaces, not just the website.<\/div>\n <svg viewBox=\"0 0 800 232\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"What the ISNP security audit covers for an insurance web aggregator\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">What the ISNP security audit covers<\/text><rect x=\"16\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"107\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(96.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M4 12h16M12 4c2.5 2.2 2.5 13.8 0 16M12 4c-2.5 2.2-2.5 13.8 0 16\"\/><\/g><text x=\"107\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Web application<\/text><text x=\"107\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">The public aggregator<\/text><text x=\"107\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">site and portal<\/text><rect x=\"214\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"305\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(294.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"7\" y=\"3\" width=\"10\" height=\"18\" rx=\"2\"\/><path d=\"M11 18h2\"\/><\/g><text x=\"305\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Mobile app<\/text><text x=\"305\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">The customer-facing<\/text><text x=\"305\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">app and journeys<\/text><rect x=\"412\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"503\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(492.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M8 8l-4 4 4 4M16 8l4 4-4 4M13 6l-2 12\"\/><\/g><text x=\"503\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">APIs<\/text><text x=\"503\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Data pipelines to<\/text><text x=\"503\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">insurers and partners<\/text><rect x=\"610\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"701\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(690.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4\" y=\"4\" width=\"16\" height=\"7\" rx=\"1.5\"\/><rect x=\"4\" y=\"13\" width=\"16\" height=\"7\" rx=\"1.5\"\/><path d=\"M8 7.5h.01M8 16.5h.01\"\/><\/g><text x=\"701\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Infrastructure<\/text><text x=\"701\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Servers, cloud, and<\/text><text x=\"701\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">access controls<\/text><\/svg>\n \n<\/div>\n\n <p>The ISNP audit is not a website scan. It covers the web application, the mobile app and its customer journeys, the APIs that pipe data between the aggregator, insurers, and partners, and the underlying infrastructure and access controls. API security matters especially here, because an aggregator’s whole model is moving data between parties. A grounding in the <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">types of VAPT<\/a> helps scope this correctly across all four surfaces.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The platform is the product, and the audit knows it<\/div>For an aggregator, the ISNP is the business. An audit that only checks the marketing site and skips the APIs and mobile app gives false comfort, and will not satisfy an IRDAI review of your platform.<\/div>\n\n <h2 class=\"sec c-apri\" id=\"tier\">Your tier and the web-aggregator special rule<\/h2>\n <p>The cybersecurity requirements for insurance web aggregators also scale with size. The 2026 version of the guidelines added a formal three-tier classification of intermediaries by gross insurance revenue, and your tier sets how intense your controls must be.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">Where you sit<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Your tier sets the intensity<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The 2026 guidelines classify intermediaries into three tiers by gross insurance revenue, and the tier decides how heavy your controls are. There is one exception aggregators need to know.<\/div>\n <svg viewBox=\"0 0 800 256\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"How the IRDAI intermediary tier classification applies to web aggregators\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Intermediaries are tiered by revenue<\/text>\n <rect x=\"16\" y=\"60\" width=\"240\" height=\"120\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/>\n <text x=\"36\" y=\"92\" fill=\"#1C267A\" font-size=\"13.5\" font-weight=\"800\">Category 1<\/text>\n <text x=\"36\" y=\"114\" fill=\"#5b6178\" font-size=\"11\">Largest by gross<\/text><text x=\"36\" y=\"130\" fill=\"#5b6178\" font-size=\"11\">insurance revenue<\/text>\n <text x=\"36\" y=\"158\" fill=\"#1C267A\" font-size=\"11\" font-weight=\"700\">Heaviest controls<\/text>\n <rect x=\"276\" y=\"60\" width=\"240\" height=\"120\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/>\n <text x=\"296\" y=\"92\" fill=\"#1C267A\" font-size=\"13.5\" font-weight=\"800\">Category 2<\/text>\n <text x=\"296\" y=\"114\" fill=\"#5b6178\" font-size=\"11\">Mid-tier by<\/text><text x=\"296\" y=\"130\" fill=\"#5b6178\" font-size=\"11\">revenue<\/text>\n <text x=\"296\" y=\"158\" fill=\"#1C267A\" font-size=\"11\" font-weight=\"700\">Core controls<\/text>\n <rect x=\"536\" y=\"60\" width=\"248\" height=\"120\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/>\n <text x=\"556\" y=\"92\" fill=\"#1C267A\" font-size=\"13.5\" font-weight=\"800\">Category 3<\/text>\n <text x=\"556\" y=\"114\" fill=\"#5b6178\" font-size=\"11\">Smallest in scope<\/text>\n <text x=\"556\" y=\"158\" fill=\"#1C267A\" font-size=\"11\" font-weight=\"700\">Baseline controls<\/text>\n <rect x=\"16\" y=\"196\" width=\"768\" height=\"44\" rx=\"12\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.4\"\/>\n <text x=\"400\" y=\"223\" text-anchor=\"middle\" fill=\"#0a6558\" font-size=\"12.5\" font-weight=\"700\">Special rule: web aggregators and ISNP operators sit at a higher control tier, whatever their revenue<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Larger intermediaries by revenue fall into the higher categories with the heaviest controls, and smaller ones into lighter tiers. But there is a special rule that matters directly to aggregators: because aggregators and ISNP operators run a public transaction platform, they are placed at a higher control tier regardless of their revenue. In short, you do not get the light-tier treatment just because you are small, running the platform is what sets your obligations.<\/p>\n\n <h2 class=\"sec c-plum\" id=\"obligations\">The core cybersecurity requirements for insurance web aggregators<\/h2>\n <p>Alongside the platform audit, a common set of controls completes the picture. These formalise strong practice into mandatory, evidenced duties.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The obligations<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What you have to run and evidence<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Beyond the platform audit, a recognisable core of controls makes up the cybersecurity requirements for insurance web aggregators. These are the duties an inspection checks first.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core cybersecurity obligations for insurance web aggregators\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core obligations for web aggregators<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"9\" cy=\"8\" r=\"3\"\/><path d=\"M3.5 20a5.5 5.5 0 0 1 11 0\"\/><path d=\"M16 6a3 3 0 0 1 0 6\"\/><path d=\"M17 14.5a5.5 5.5 0 0 1 3.5 5.5\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Independent CISO<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Not reporting to the head of IT<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"7\"\/><path d=\"M12 2v4M12 18v4M2 12h4M18 12h4\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">VAPT twice a year<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Web, mobile, and API testing<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Six-hour reporting<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Critical incidents to CERT-In<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Annual audit<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">CERT-In empanelled, ISNP review<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M8 11l2-2 3 3 2-2 3 3\"\/><path d=\"M3 8l4-2 5 3M21 8l-4-2-3 2\"\/><path d=\"M6 12l3 3M18 12l-3 3\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Vendor risk<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Assess every data partner<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4.5\" y=\"10.5\" width=\"15\" height=\"9.5\" rx=\"2\"\/><path d=\"M8 10.5V7a4 4 0 0 1 8 0v3.5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Data protection<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Encryption and access control<\/text><\/svg>\n \n<\/div>\n\n <p>In practice that means an independent Chief Information Security Officer who does not report to the head of IT and carries no business targets, a vulnerability assessment and penetration testing programme run at least twice a year across web, mobile, and API surfaces, cyber incident reporting to CERT-In within six hours, an annual audit by a CERT-In empanelled auditor, third-party risk management for every data partner, and data protection with encryption and access control. Together these are the operating core of the obligations.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">CISO independence is now structural<\/div>The guidelines are explicit that the CISO must not sit under the head of IT or carry business targets, and must brief the board and risk committee regularly. For an aggregator, that separation is one of the first things an inspection verifies.<\/div>\n\n <h2 class=\"sec c-sky\" id=\"reporting\">Testing cadence and incident reporting<\/h2>\n <p>Two timelines sit at the heart of day-to-day compliance. VAPT must run at least twice a year, and any critical or high-severity finding has to be remediated within thirty days. An internet-facing platform carrying an open high finding past that window is a common failure.<\/p>\n<p>On incidents, critical events such as a breach or ransomware must be reported to CERT-In within six hours of detection, with a copy to IRDAI, and other incidents within twenty-four hours. Because the clock starts at detection, meeting it is really a demand for monitoring good enough to catch and confirm an incident fast. An automated scan alone will not satisfy the testing requirement, our guide on <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">VAPT versus vulnerability scanning<\/a> explains why skilled, human-led testing is what an ISNP audit expects.<\/p>\n\n <h2 class=\"sec c-sage\" id=\"osto\">How Osto helps aggregators comply<\/h2>\n <p>Meeting all of this, an ISNP-grade platform audit, a twice-yearly VAPT cadence across web, mobile, and API, six-hour-ready incident detection, vendor risk, and an audit-ready file, is a heavy lift for a lean aggregator without a dedicated security team. Piecing it together from separate tools and consultants is slow and hard to keep current, which is the gap Osto is built to close.<\/p>\n\n <p>Osto is a one-stop security and compliance platform purpose-built for fast-moving teams. For a web aggregator, it runs VAPT across your web application, mobile app, and APIs, correlates security events so incidents surface fast enough to report on time, supports encryption, data-handling, and third-party risk controls, and keeps organised, audit-ready evidence mapped across the IRDAI expectations, DPDP, and other frameworks in one place. Osto does not act as your CERT-In empanelled auditor or your insurer, it gets your platform audit-ready and keeps it there, so the ISNP audit becomes a verification rather than a scramble.<\/p>\n\n <div class=\"callout\">\n <h3>Get your ISNP audit-ready without a big team.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving teams. Test your web, mobile, and API surfaces, stand up monitoring for fast incident reporting, manage vendor risk, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>Do IRDAI cybersecurity rules apply to web aggregators?<\/summary><p>Yes. Web aggregators are named explicitly as an insurance intermediary bound by the IRDAI Information and Cyber Security Guidelines. Because they run a public platform, they carry heavier, platform-level obligations than agents.<\/p><\/details>\n <details><summary>What is an ISNP security audit?<\/summary><p>An Insurance Self-Network Platform audit is a security review of the platform an aggregator runs with IRDAI permission to sell insurance online. It covers the web application, mobile app, APIs, and infrastructure, and is required at least annually, often before go-live.<\/p><\/details>\n <details><summary>How often must a web aggregator run VAPT?<\/summary><p>At least twice a year, across web, mobile, and API surfaces, with critical and high-severity findings remediated within thirty days. Evidence of remediation is checked at the annual audit.<\/p><\/details>\n <details><summary>Does the tier classification affect web aggregators?<\/summary><p>Yes, but with a special rule. Intermediaries are tiered by gross insurance revenue, yet web aggregators and ISNP operators are placed at a higher control tier regardless of revenue, because they run a public transaction platform.<\/p><\/details>\n <details><summary>What is the incident reporting timeline for aggregators?<\/summary><p>Critical incidents must be reported to CERT-In within six hours of detection, with a copy to IRDAI, and all other incidents within twenty-four hours, in the prescribed format. The clock runs from detection.<\/p><\/details>\n <details><summary>Who conducts the audit, and can Osto do it?<\/summary><p>The annual audit is conducted by a CERT-In empanelled auditor. Osto gets your platform audit-ready, running VAPT, monitoring, and evidence, but it does not act as the empanelled auditor or as an insurer.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>Cybersecurity for Web Aggregators: 6 Complete Rules | Osto Cybersecurity requirements for insurance web aggregators are among the strictest for\u2026<\/p>\n","protected":false},"author":8,"featured_media":1313,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[696],"class_list":["post-1312","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-insurance-web-aggregator"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1312"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1312\/revisions"}],"predecessor-version":[{"id":1314,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1312\/revisions\/1314"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1313"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}