Policyholder data at an insurer is spread across policy administration, underwriting, claims and CRM systems. In-house IT teams maintain those systems, and so do software vendors and third-party administrators (TPAs), the outside firms that handle claims work for insurers. Access held by TPAs and vendors is rarely supervised from start to finish.
IRDAI's 2023 Information and Cyber Security Guidelines for insurers and intermediaries require insurers to control and monitor privileged access, enforce multi-factor authentication, review access periodically and retain logs. Incidents are reported to a board-level governance structure. Tanflow PAM and the Tanflow IAM Suite run on the insurer's own servers and are designed to align with the access-control parts of the guidelines.
How the guideline areas map to the two products
Tanflow's compliance mapping for the IRDAI guidelines covers five areas. User access and access review sit with the IAM Suite, privileged access with PAM, and authentication and logging with both.
- Access to policy administration systems follows the HR record. It is granted at joining, changed with the role and removed at exit.
- Application logins and privileged logins both require multi-factor authentication.
- Privileged access to systems holding policyholder data is vaulted, approved and recorded.
- Access certification campaigns leave a record of who reviewed each entitlement and what they decided.
- Log retention is set by policy, so it can match the period the guidelines and CERT-In require.
Privileged sessions on policy, claims and underwriting databases
Tanflow PAM puts a gateway with no agents in front of the policy administration, claims and underwriting databases. Administrators, TPA staff and vendor engineers open their sessions in a browser tab through it. The gateway takes the credential from the vault and injects it into the session, so the person connecting never sees, copies or types it. Vaulted passwords rotate on a schedule or after each use.
Every command in a privileged session is checked against policy before it runs. The policies understand SQL, so an insurer can block DROP and TRUNCATE on the production claims database and require a typed business reason before a bulk SELECT on a table of policyholder PII. The reason is stored next to the command in the audit trail, and the whole session is recorded.
MFA on staff, agent-portal and partner logins
The authentication requirement covers application logins as well as privileged ones. The IAM Suite applies multi-factor authentication to employee and agent-portal logins, and the same MFA engine protects PAM gateway logins, including remote TPA and vendor access. Methods include TOTP apps, email or SMS one-time codes, and FIDO2 security keys and passkeys, and the insurer chooses which ones users may enrol.
Supervising a TPA analyst on the claims database
Take a TPA analyst who has to reconcile a batch of claims against the policy database. The analyst raises a request that names the target connection, gives the reason and sets a time window, and the claims-operations head approves a time-boxed just-in-time (JIT) window. Targets are arranged into connection groups, so the analyst reaches only the systems in the TPA's contract.
The analyst signs in with MFA and connects through the browser gateway with credentials they never see. Bulk exports of policyholder data are blocked, and every query is recorded against the request. A supervisor can watch the live session through a read-only share link that accepts no input. When the batch is done the window closes, the session ends and the credential rotates. The TPA identity in the IAM Suite can carry an end date that matches the contract.
Access reviews routed to data owners
Scheduled reviews of who can reach policyholder PII go to the data owners, who certify or revoke each entry, and every decision is recorded against the reviewer. Campaigns can run on quarterly or annual cycles. Privileged access granted through JIT windows has usually expired before a review starts, so there are fewer standing entitlements to certify.
What an IRDAI inspector or DPDP reviewer can be given
Session replays, command logs and access-review reports are kept in an append-only audit store with integrity checks. The PAM report library includes reports for IRDAI evidence requests, and records can be exported for an inspection. An inspector can be given a scoped, read-only auditor role to search logs and watch replays for the period of the engagement.
Under the DPDP Act 2023, vendor and data processor access that runs only through approved, recorded gateway windows gives evidence for the security safeguards in Section 8(5). After a breach, logs and replays help establish what was accessed before the Data Protection Board and the people affected are informed under Section 8(6).
Log retention and the CERT-In overlap
CERT-In's April 2022 Directions ask for logs to be kept for a rolling 180 days. Tanflow keeps identity and privileged-access logs for 180 days or longer on the insurer's own infrastructure in India. Clock synchronisation with NIC or NPL time servers, which the same Directions require, is configured on the servers Tanflow runs on and sits outside the product.