VAPT for Insurance Companies: 6 Complete Rules | Osto<\/title>\n<meta name=\"description\" content=\"VAPT for insurance companies explained: twice-yearly testing, six-monthly external PT, CERT-In empanelled auditors, remediation deadlines, and reporting.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">VAPT for insurance companies is one of the most-checked controls in an IRDAI cyber audit, and it is stricter than most teams assume. Here is exactly how often you must test, who can test, how fast you must fix findings, and how a lean team stays ready.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>IRDAI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>The short answer<\/h2>\n <p>IRDAI VAPT requirements mandate vulnerability assessment and penetration testing at least twice a year on customer-facing systems and critical infrastructure, plus external penetration testing at least once every six months on internet-facing assets. As of 2026, that external test must be grey-box or white-box, not black-box only. All testing must be done by a CERT-In empanelled auditor, and findings are remediated by severity: critical in 30 days, high in 60, medium in 90, each confirmed by a retest. Applies to insurers and intermediaries alike.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What the requirement is<\/a><\/li>\n <li><a href=\"#cadence\">How often you test<\/a><\/li>\n <li><a href=\"#who\">Who can test<\/a><\/li>\n <li><a href=\"#remediation\">Remediation deadlines<\/a><\/li>\n <li><a href=\"#scope\">The scope and evidence<\/a><\/li>\n <li><a href=\"#osto\">How Osto helps you stay ready<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec c-sky\" id=\"what\">What VAPT for insurance companies means<\/h2>\n <p>The IRDAI VAPT requirements sit inside the <a href=\"https:\/\/irdai.gov.in\/\" target=\"_blank\" rel=\"noopener\">Insurance Regulatory and Development Authority of India<\/a> Information and Cyber Security Guidelines, and they bind every regulated entity that handles policyholder data, insurers, reinsurers, and intermediaries such as brokers, corporate agents, web aggregators, and third-party administrators. Because insurance systems hold identity, financial, and often health data, IRDAI treats real security testing as proof that controls work, not a policy document that says they do. In an audit, the VAPT evidence is one of the first things examined.<\/p>\n\n <h2 class=\"sec c-sage\" id=\"cadence\">How often VAPT for insurance companies must run<\/h2>\n <p>The first thing to get right about VAPT for insurance companies is frequency, because two testing rhythms run at once and one of them changed recently.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The cadence<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">How often testing has to happen<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">VAPT for insurance companies starts with frequency, and it is stricter than an annual check. Two rhythms run in parallel, and one of them changed in 2026.<\/div>\n <svg viewBox=\"0 0 800 240\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The IRDAI VAPT cadence: twice-yearly assessments and six-monthly external testing\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">How often you must test<\/text>\n <rect x=\"16\" y=\"60\" width=\"372\" height=\"160\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/>\n <text x=\"46\" y=\"94\" fill=\"#1C267A\" font-size=\"14.5\" font-weight=\"800\">VAPT, twice a year<\/text>\n <line x1=\"46\" y1=\"106\" x2=\"358\" y2=\"106\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"46\" y=\"132\" fill=\"#4a5170\" font-size=\"12.5\">At least two full assessments<\/text>\n <text x=\"46\" y=\"152\" fill=\"#4a5170\" font-size=\"12.5\">a year on customer-facing<\/text>\n <text x=\"46\" y=\"172\" fill=\"#4a5170\" font-size=\"12.5\">systems and critical<\/text>\n <text x=\"46\" y=\"192\" fill=\"#4a5170\" font-size=\"12.5\">infrastructure.<\/text>\n <rect x=\"412\" y=\"60\" width=\"372\" height=\"160\" rx=\"16\" fill=\"#1c267a\"\/>\n <text x=\"442\" y=\"94\" fill=\"#fff\" font-size=\"14.5\" font-weight=\"800\">External PT, six-monthly<\/text>\n <line x1=\"442\" y1=\"106\" x2=\"754\" y2=\"106\" stroke=\"#39439a\" stroke-width=\"1\"\/>\n <text x=\"442\" y=\"132\" fill=\"#c3c9ee\" font-size=\"12.5\">On internet-facing assets,<\/text>\n <text x=\"442\" y=\"152\" fill=\"#c3c9ee\" font-size=\"12.5\">now grey-box or white-box,<\/text>\n <text x=\"442\" y=\"172\" fill=\"#c3c9ee\" font-size=\"12.5\">not black-box only.<\/text>\n <text x=\"442\" y=\"200\" fill=\"#8fa0e8\" font-size=\"11.5\" font-weight=\"700\">By a CERT-In empanelled auditor.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Vulnerability assessment and penetration testing must run at least twice a year on customer-facing systems and critical infrastructure. On top of that, external penetration testing on internet-facing assets is required at least once every six months. The 2026 update to the guidelines sharpened this: the external test must now be grey-box or white-box rather than black-box only, which means the tester works with more knowledge of the system and probes deeper. Annual-only testing does not meet the standard.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Two clocks, not one<\/div>Teams often plan for a single annual test and fall short. The IRDAI VAPT requirements run two cadences in parallel: twice-yearly full VAPT, and six-monthly external penetration testing on anything internet-facing.<\/div>\n\n <h2 class=\"sec c-apri\" id=\"who\">Who can perform the test<\/h2>\n <p>This is non-negotiable and catches teams out. The rules state that testing must be performed by a CERT-In empanelled audit firm, and the annual assurance audit by a qualified external auditor holding recognised certifications such as CISA, DISA, or CERT-In empanelment. A report from an internal team or a non-empanelled vendor will not stand up at an IRDAI inspection. A grounding in the <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">types of VAPT<\/a> helps you scope the engagement correctly before you commission it.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">A scan is not a penetration test<\/div>The guidelines expect real, expert-led exploitation, not an automated scan. Business-logic and authentication flaws that matter in insurance systems are exactly what a scanner misses, our guide on <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">VAPT versus vulnerability scanning<\/a> explains the difference.<\/div>\n\n <h2 class=\"sec c-plum\" id=\"remediation\">Remediation deadlines for insurance VAPT<\/h2>\n <p>Running the test is only half the job. The guidelines set hard, severity-based deadlines for closing what the test finds, and require proof of closure.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">Remediation<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Fixing findings is half the requirement<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">VAPT for insurance companies is as strict about closing findings as about finding them. Each severity has a deadline, and a retest has to prove the fix.<\/div>\n <svg viewBox=\"0 0 800 232\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"IRDAI VAPT remediation deadlines by severity\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Remediation deadlines by severity<\/text><rect x=\"16\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#f9f4f4\" stroke=\"#e6cfcf\" stroke-width=\"1.5\"\/><circle cx=\"107\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#e6cfcf\" stroke-width=\"1.5\"\/><g transform=\"translate(96.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#9a4a54\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"107\" y=\"144\" text-anchor=\"middle\" fill=\"#9a4a54\" font-size=\"13.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Critical<\/text><text x=\"107\" y=\"166\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Fix within 30 days<\/text><rect x=\"214\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"305\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(294.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"305\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">High<\/text><text x=\"305\" y=\"166\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Fix within 60 days<\/text><rect x=\"412\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"503\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(492.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"503\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Medium<\/text><text x=\"503\" y=\"166\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Fix within 90 days<\/text><rect x=\"610\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"701\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(690.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 12a8 8 0 0 1 13.5-5.8L20 8M20 4v4h-4M20 12a8 8 0 0 1-13.5 5.8L4 16M4 20v-4h4\"\/><\/g><text x=\"701\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Then retest<\/text><text x=\"701\" y=\"166\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Confirmatory test<\/text><text x=\"701\" y=\"181\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">proves closure<\/text><\/svg>\n \n<\/div>\n\n <p>Critical findings must be remediated within thirty days, high findings within sixty, and medium findings within ninety. Gaps found in an internal vulnerability scan of ICT infrastructure must be closed immediately, and gaps in internet-facing applications closed within one month, followed by confirmatory testing to prove the fix. Any high-risk issue not resolved in time has to be escalated to the Board’s Risk Management Committee. Findings tracked to closure, with retest evidence, are the real substance of the rule.<\/p>\n\n <h2 class=\"sec c-sky\" id=\"scope\">The scope and the evidence<\/h2>\n <p>A test that only checks the marketing site does not satisfy the IRDAI VAPT requirements. The scope has to reach the systems an attacker would actually target, and the evidence has to be ready for inspection.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The scope<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What a compliant test has to reach<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">A narrow test does not satisfy VAPT for insurance companies. The scope spans your external apps, network and databases, APIs, and the evidence you keep.<\/div>\n <svg viewBox=\"0 0 800 232\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The scope the IRDAI VAPT requirements cover\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">What the VAPT scope must cover<\/text><rect x=\"16\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"107\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(96.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M4 12h16M12 4c2.5 2.2 2.5 13.8 0 16M12 4c-2.5 2.2-2.5 13.8 0 16\"\/><\/g><text x=\"107\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">External apps<\/text><text x=\"107\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Public-facing web and<\/text><text x=\"107\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">portals<\/text><rect x=\"214\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"305\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(294.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4\" y=\"4\" width=\"16\" height=\"7\" rx=\"1.5\"\/><rect x=\"4\" y=\"13\" width=\"16\" height=\"7\" rx=\"1.5\"\/><path d=\"M8 7.5h.01M8 16.5h.01\"\/><\/g><text x=\"305\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Network and infra<\/text><text x=\"305\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Segmentation and<\/text><text x=\"305\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">databases<\/text><rect x=\"412\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"503\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(492.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M8 8l-4 4 4 4M16 8l4 4-4 4M13 6l-2 12\"\/><\/g><text x=\"503\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">APIs<\/text><text x=\"503\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">All externally exposed<\/text><text x=\"503\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">endpoints<\/text><rect x=\"610\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"701\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(690.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><path d=\"M8 13h8M8 16h5\"\/><\/g><text x=\"701\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Evidence<\/text><text x=\"701\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Findings in an<\/text><text x=\"701\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">audit-ready format<\/text><\/svg>\n \n<\/div>\n\n <p>In practice the scope covers external-facing applications, internal network segmentation and database security, and API security for every API exposed to external parties such as agents, brokers, and aggregators, alongside the wider ICT infrastructure. Just as important, remediation evidence must be maintained in a format you can present to IRDAI during an inspection. Intermediaries submit their CERT-In empanelled audit compliance report within thirty days of the audit completing, so this is really an all-year discipline, not a single event.<\/p>\n\n <h2 class=\"sec c-sage\" id=\"osto\">How Osto helps you stay ready<\/h2>\n <p>Meeting VAPT for insurance companies, testing on two cadences, across web, network, and API, with severity-based remediation, retests, and audit-ready evidence, is a heavy lift for a lean insurance or intermediary team without a dedicated security function. Coordinating separate testers, trackers, and reporting is slow and easy to let slip. That is the gap Osto is built to close.<\/p>\n\n <p>Osto is a one-stop security and compliance platform purpose-built for fast-moving teams. Against these requirements, it runs VAPT across your applications, APIs, and infrastructure, categorises findings by severity, generates remediation and retest reports, and keeps organised, audit-ready evidence mapped across the IRDAI expectations, DPDP, and other frameworks in one place. Osto does not act as your CERT-In empanelled auditor or your insurer, it gets you test-ready and keeps the evidence in order, so the audit becomes a verification rather than a scramble.<\/p>\n\n <div class=\"callout\">\n <h3>Stay IRDAI test-ready all year, without a big team.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving teams. Run VAPT on the right cadence, remediate by severity, retest, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>How often does IRDAI require VAPT?<\/summary><p>The IRDAI VAPT requirements mandate vulnerability assessment and penetration testing at least twice a year on customer-facing systems and critical infrastructure, plus external penetration testing at least once every six months on internet-facing assets.<\/p><\/details>\n <details><summary>Does the external penetration test have to be black-box?<\/summary><p>No. As of the 2026 update, external penetration testing must be grey-box or white-box, not black-box only, and conducted at least six-monthly by a CERT-In empanelled auditor. This gives the tester deeper visibility into the system.<\/p><\/details>\n <details><summary>Who can perform VAPT for IRDAI compliance?<\/summary><p>Only a CERT-In empanelled audit firm. The annual assurance audit must be by a qualified external auditor holding certifications such as CISA, DISA, or CERT-In empanelment. Internal or non-empanelled reports are not accepted.<\/p><\/details>\n <details><summary>What are the VAPT remediation deadlines?<\/summary><p>By severity: critical findings within thirty days, high within sixty, medium within ninety. Internal-scan gaps must be closed immediately, and internet-facing application gaps within one month, followed by confirmatory retesting to prove closure.<\/p><\/details>\n <details><summary>What must the VAPT scope cover?<\/summary><p>External-facing applications, internal network segmentation, database security, and API security for every externally exposed API, plus the wider ICT infrastructure. Remediation evidence must be kept in an IRDAI-presentable format.<\/p><\/details>\n <details><summary>Do intermediaries also have to meet the IRDAI VAPT requirements?<\/summary><p>Yes. Brokers, corporate agents, web aggregators, and TPAs are bound alongside insurers, and must submit their CERT-In empanelled audit compliance report within thirty days of the audit completing.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>VAPT for Insurance Companies: 6 Complete Rules | Osto VAPT for insurance companies is one of the most-checked controls in\u2026<\/p>\n","protected":false},"author":8,"featured_media":1319,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[700,701,699,702],"class_list":["post-1318","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-insurance-vapt-requirements","tag-penetration-testing-for-insurance","tag-vapt-for-insurance-companies","tag-vapt-for-insurers"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1318"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1318\/revisions"}],"predecessor-version":[{"id":1320,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1318\/revisions\/1320"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1319"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1318,"date":"2026-09-17T09:04:50","date_gmt":"2026-09-17T09:04:50","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1318"},"modified":"2026-09-17T09:04:50","modified_gmt":"2026-09-17T09:04:50","slug":"vapt-for-insurance-companies","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/vapt-for-insurance-companies\/","title":{"rendered":"VAPT for Insurance Companies"},"content":{"rendered":"\n\n\n\n\n\nVAPT for Insurance Companies: 6 Complete Rules | Osto<\/title>\n<meta name=\"description\" content=\"VAPT for insurance companies explained: twice-yearly testing, six-monthly external PT, CERT-In empanelled auditors, remediation deadlines, and reporting.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">VAPT for insurance companies is one of the most-checked controls in an IRDAI cyber audit, and it is stricter than most teams assume. Here is exactly how often you must test, who can test, how fast you must fix findings, and how a lean team stays ready.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>IRDAI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>The short answer<\/h2>\n <p>IRDAI VAPT requirements mandate vulnerability assessment and penetration testing at least twice a year on customer-facing systems and critical infrastructure, plus external penetration testing at least once every six months on internet-facing assets. As of 2026, that external test must be grey-box or white-box, not black-box only. All testing must be done by a CERT-In empanelled auditor, and findings are remediated by severity: critical in 30 days, high in 60, medium in 90, each confirmed by a retest. Applies to insurers and intermediaries alike.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What the requirement is<\/a><\/li>\n <li><a href=\"#cadence\">How often you test<\/a><\/li>\n <li><a href=\"#who\">Who can test<\/a><\/li>\n <li><a href=\"#remediation\">Remediation deadlines<\/a><\/li>\n <li><a href=\"#scope\">The scope and evidence<\/a><\/li>\n <li><a href=\"#osto\">How Osto helps you stay ready<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec c-sky\" id=\"what\">What VAPT for insurance companies means<\/h2>\n <p>The IRDAI VAPT requirements sit inside the <a href=\"https:\/\/irdai.gov.in\/\" target=\"_blank\" rel=\"noopener\">Insurance Regulatory and Development Authority of India<\/a> Information and Cyber Security Guidelines, and they bind every regulated entity that handles policyholder data, insurers, reinsurers, and intermediaries such as brokers, corporate agents, web aggregators, and third-party administrators. Because insurance systems hold identity, financial, and often health data, IRDAI treats real security testing as proof that controls work, not a policy document that says they do. In an audit, the VAPT evidence is one of the first things examined.<\/p>\n\n <h2 class=\"sec c-sage\" id=\"cadence\">How often VAPT for insurance companies must run<\/h2>\n <p>The first thing to get right about VAPT for insurance companies is frequency, because two testing rhythms run at once and one of them changed recently.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The cadence<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">How often testing has to happen<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">VAPT for insurance companies starts with frequency, and it is stricter than an annual check. Two rhythms run in parallel, and one of them changed in 2026.<\/div>\n <svg viewBox=\"0 0 800 240\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The IRDAI VAPT cadence: twice-yearly assessments and six-monthly external testing\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">How often you must test<\/text>\n <rect x=\"16\" y=\"60\" width=\"372\" height=\"160\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/>\n <text x=\"46\" y=\"94\" fill=\"#1C267A\" font-size=\"14.5\" font-weight=\"800\">VAPT, twice a year<\/text>\n <line x1=\"46\" y1=\"106\" x2=\"358\" y2=\"106\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"46\" y=\"132\" fill=\"#4a5170\" font-size=\"12.5\">At least two full assessments<\/text>\n <text x=\"46\" y=\"152\" fill=\"#4a5170\" font-size=\"12.5\">a year on customer-facing<\/text>\n <text x=\"46\" y=\"172\" fill=\"#4a5170\" font-size=\"12.5\">systems and critical<\/text>\n <text x=\"46\" y=\"192\" fill=\"#4a5170\" font-size=\"12.5\">infrastructure.<\/text>\n <rect x=\"412\" y=\"60\" width=\"372\" height=\"160\" rx=\"16\" fill=\"#1c267a\"\/>\n <text x=\"442\" y=\"94\" fill=\"#fff\" font-size=\"14.5\" font-weight=\"800\">External PT, six-monthly<\/text>\n <line x1=\"442\" y1=\"106\" x2=\"754\" y2=\"106\" stroke=\"#39439a\" stroke-width=\"1\"\/>\n <text x=\"442\" y=\"132\" fill=\"#c3c9ee\" font-size=\"12.5\">On internet-facing assets,<\/text>\n <text x=\"442\" y=\"152\" fill=\"#c3c9ee\" font-size=\"12.5\">now grey-box or white-box,<\/text>\n <text x=\"442\" y=\"172\" fill=\"#c3c9ee\" font-size=\"12.5\">not black-box only.<\/text>\n <text x=\"442\" y=\"200\" fill=\"#8fa0e8\" font-size=\"11.5\" font-weight=\"700\">By a CERT-In empanelled auditor.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Vulnerability assessment and penetration testing must run at least twice a year on customer-facing systems and critical infrastructure. On top of that, external penetration testing on internet-facing assets is required at least once every six months. The 2026 update to the guidelines sharpened this: the external test must now be grey-box or white-box rather than black-box only, which means the tester works with more knowledge of the system and probes deeper. Annual-only testing does not meet the standard.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Two clocks, not one<\/div>Teams often plan for a single annual test and fall short. The IRDAI VAPT requirements run two cadences in parallel: twice-yearly full VAPT, and six-monthly external penetration testing on anything internet-facing.<\/div>\n\n <h2 class=\"sec c-apri\" id=\"who\">Who can perform the test<\/h2>\n <p>This is non-negotiable and catches teams out. The rules state that testing must be performed by a CERT-In empanelled audit firm, and the annual assurance audit by a qualified external auditor holding recognised certifications such as CISA, DISA, or CERT-In empanelment. A report from an internal team or a non-empanelled vendor will not stand up at an IRDAI inspection. A grounding in the <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">types of VAPT<\/a> helps you scope the engagement correctly before you commission it.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">A scan is not a penetration test<\/div>The guidelines expect real, expert-led exploitation, not an automated scan. Business-logic and authentication flaws that matter in insurance systems are exactly what a scanner misses, our guide on <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">VAPT versus vulnerability scanning<\/a> explains the difference.<\/div>\n\n <h2 class=\"sec c-plum\" id=\"remediation\">Remediation deadlines for insurance VAPT<\/h2>\n <p>Running the test is only half the job. The guidelines set hard, severity-based deadlines for closing what the test finds, and require proof of closure.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">Remediation<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Fixing findings is half the requirement<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">VAPT for insurance companies is as strict about closing findings as about finding them. Each severity has a deadline, and a retest has to prove the fix.<\/div>\n <svg viewBox=\"0 0 800 232\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"IRDAI VAPT remediation deadlines by severity\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Remediation deadlines by severity<\/text><rect x=\"16\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#f9f4f4\" stroke=\"#e6cfcf\" stroke-width=\"1.5\"\/><circle cx=\"107\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#e6cfcf\" stroke-width=\"1.5\"\/><g transform=\"translate(96.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#9a4a54\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"107\" y=\"144\" text-anchor=\"middle\" fill=\"#9a4a54\" font-size=\"13.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Critical<\/text><text x=\"107\" y=\"166\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Fix within 30 days<\/text><rect x=\"214\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"305\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(294.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"305\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">High<\/text><text x=\"305\" y=\"166\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Fix within 60 days<\/text><rect x=\"412\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"503\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(492.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M12 8v4l3 2\"\/><\/g><text x=\"503\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Medium<\/text><text x=\"503\" y=\"166\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Fix within 90 days<\/text><rect x=\"610\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"701\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(690.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 12a8 8 0 0 1 13.5-5.8L20 8M20 4v4h-4M20 12a8 8 0 0 1-13.5 5.8L4 16M4 20v-4h4\"\/><\/g><text x=\"701\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13.5\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Then retest<\/text><text x=\"701\" y=\"166\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Confirmatory test<\/text><text x=\"701\" y=\"181\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">proves closure<\/text><\/svg>\n \n<\/div>\n\n <p>Critical findings must be remediated within thirty days, high findings within sixty, and medium findings within ninety. Gaps found in an internal vulnerability scan of ICT infrastructure must be closed immediately, and gaps in internet-facing applications closed within one month, followed by confirmatory testing to prove the fix. Any high-risk issue not resolved in time has to be escalated to the Board’s Risk Management Committee. Findings tracked to closure, with retest evidence, are the real substance of the rule.<\/p>\n\n <h2 class=\"sec c-sky\" id=\"scope\">The scope and the evidence<\/h2>\n <p>A test that only checks the marketing site does not satisfy the IRDAI VAPT requirements. The scope has to reach the systems an attacker would actually target, and the evidence has to be ready for inspection.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The scope<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What a compliant test has to reach<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">A narrow test does not satisfy VAPT for insurance companies. The scope spans your external apps, network and databases, APIs, and the evidence you keep.<\/div>\n <svg viewBox=\"0 0 800 232\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The scope the IRDAI VAPT requirements cover\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">What the VAPT scope must cover<\/text><rect x=\"16\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"107\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(96.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M4 12h16M12 4c2.5 2.2 2.5 13.8 0 16M12 4c-2.5 2.2-2.5 13.8 0 16\"\/><\/g><text x=\"107\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">External apps<\/text><text x=\"107\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Public-facing web and<\/text><text x=\"107\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">portals<\/text><rect x=\"214\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"305\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(294.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4\" y=\"4\" width=\"16\" height=\"7\" rx=\"1.5\"\/><rect x=\"4\" y=\"13\" width=\"16\" height=\"7\" rx=\"1.5\"\/><path d=\"M8 7.5h.01M8 16.5h.01\"\/><\/g><text x=\"305\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Network and infra<\/text><text x=\"305\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Segmentation and<\/text><text x=\"305\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">databases<\/text><rect x=\"412\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"503\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(492.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M8 8l-4 4 4 4M16 8l4 4-4 4M13 6l-2 12\"\/><\/g><text x=\"503\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">APIs<\/text><text x=\"503\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">All externally exposed<\/text><text x=\"503\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">endpoints<\/text><rect x=\"610\" y=\"60\" width=\"182\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"701\" cy=\"98\" r=\"21\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(690.80,87.80) scale(0.85)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><path d=\"M8 13h8M8 16h5\"\/><\/g><text x=\"701\" y=\"144\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Evidence<\/text><text x=\"701\" y=\"164\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">Findings in an<\/text><text x=\"701\" y=\"179\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\" font-family=\"Inter,Arial,sans-serif\">audit-ready format<\/text><\/svg>\n \n<\/div>\n\n <p>In practice the scope covers external-facing applications, internal network segmentation and database security, and API security for every API exposed to external parties such as agents, brokers, and aggregators, alongside the wider ICT infrastructure. Just as important, remediation evidence must be maintained in a format you can present to IRDAI during an inspection. Intermediaries submit their CERT-In empanelled audit compliance report within thirty days of the audit completing, so this is really an all-year discipline, not a single event.<\/p>\n\n <h2 class=\"sec c-sage\" id=\"osto\">How Osto helps you stay ready<\/h2>\n <p>Meeting VAPT for insurance companies, testing on two cadences, across web, network, and API, with severity-based remediation, retests, and audit-ready evidence, is a heavy lift for a lean insurance or intermediary team without a dedicated security function. Coordinating separate testers, trackers, and reporting is slow and easy to let slip. That is the gap Osto is built to close.<\/p>\n\n <p>Osto is a one-stop security and compliance platform purpose-built for fast-moving teams. Against these requirements, it runs VAPT across your applications, APIs, and infrastructure, categorises findings by severity, generates remediation and retest reports, and keeps organised, audit-ready evidence mapped across the IRDAI expectations, DPDP, and other frameworks in one place. Osto does not act as your CERT-In empanelled auditor or your insurer, it gets you test-ready and keeps the evidence in order, so the audit becomes a verification rather than a scramble.<\/p>\n\n <div class=\"callout\">\n <h3>Stay IRDAI test-ready all year, without a big team.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving teams. Run VAPT on the right cadence, remediate by severity, retest, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>How often does IRDAI require VAPT?<\/summary><p>The IRDAI VAPT requirements mandate vulnerability assessment and penetration testing at least twice a year on customer-facing systems and critical infrastructure, plus external penetration testing at least once every six months on internet-facing assets.<\/p><\/details>\n <details><summary>Does the external penetration test have to be black-box?<\/summary><p>No. As of the 2026 update, external penetration testing must be grey-box or white-box, not black-box only, and conducted at least six-monthly by a CERT-In empanelled auditor. This gives the tester deeper visibility into the system.<\/p><\/details>\n <details><summary>Who can perform VAPT for IRDAI compliance?<\/summary><p>Only a CERT-In empanelled audit firm. The annual assurance audit must be by a qualified external auditor holding certifications such as CISA, DISA, or CERT-In empanelment. Internal or non-empanelled reports are not accepted.<\/p><\/details>\n <details><summary>What are the VAPT remediation deadlines?<\/summary><p>By severity: critical findings within thirty days, high within sixty, medium within ninety. Internal-scan gaps must be closed immediately, and internet-facing application gaps within one month, followed by confirmatory retesting to prove closure.<\/p><\/details>\n <details><summary>What must the VAPT scope cover?<\/summary><p>External-facing applications, internal network segmentation, database security, and API security for every externally exposed API, plus the wider ICT infrastructure. Remediation evidence must be kept in an IRDAI-presentable format.<\/p><\/details>\n <details><summary>Do intermediaries also have to meet the IRDAI VAPT requirements?<\/summary><p>Yes. Brokers, corporate agents, web aggregators, and TPAs are bound alongside insurers, and must submit their CERT-In empanelled audit compliance report within thirty days of the audit completing.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>VAPT for Insurance Companies: 6 Complete Rules | Osto VAPT for insurance companies is one of the most-checked controls in\u2026<\/p>\n","protected":false},"author":8,"featured_media":1319,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[700,701,699,702],"class_list":["post-1318","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-insurance-vapt-requirements","tag-penetration-testing-for-insurance","tag-vapt-for-insurance-companies","tag-vapt-for-insurers"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1318"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1318\/revisions"}],"predecessor-version":[{"id":1320,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1318\/revisions\/1320"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1319"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}