IT and Information Security Expectations for Insurers Regulated by NIA

Last reviewed: 20 October 2026

Insurers often look to NIA IT guidelines only when an inspection is near. Yet Nepal Insurance Authority's directives already set clear expectations on cyber risk, information assets and the audit of management information systems. This guide brings together what those documents say about IT and information security for insurers in Nepal, and turns it into a checklist an insurer's management team can use.

The documents that matter

Nepal Insurance Authority publishes its directives and guidelines on its directives page. Three are directly relevant to IT and security:

1. बीमकको सूचना प्रविधि मार्गदर्शन, २०७६ (IT Guideline for Insurers, 2076). The directives page lists it with an issue date of २०७६/११/१४. This article does not summarize its clauses: read it in full from NIA's site, and treat the points below as complementary to it.
2. Risk Management Guidelines for Insurance Company, 2076, issued when the regulator was Beema Samiti. It has a section on "Data integrity and cyber risk."
3. Internal Audit Directive for Insurers, 2079, which sets out what internal audit must cover, including management information systems (MIS).

Cyber risk as part of risk management

The Risk Management Guidelines treat cyber risk as part of operational risk, which they define as "the risk of direct or indirect loss, or damaged reputation resulting from inadequate or failed internal processes, people and systems or external events."

They define two terms that frame the rest:

• Data integrity is "the preservation of confidentiality, integrity and availability of information and/or information systems."
• Cyber resilience is "the ability of an organization to continue to carry out its missions and activities by anticipating and adapting to cyber threats and by withstanding, containing and rapidly recovering from cyber incidents."

The guidelines describe what a proper cyber-security framework requires: "identification (risk exposure and expected losses), protection (third party security capabilities), detection (assessment of vulnerabilities), response (pre-determined incident response capabilities) and recovery (preparedness and effectiveness of business continuity plans)."

They then list five things an insurance company "shall" do to strengthen resilience to cyber risk:

• "incorporate data integrity risk into their governance and risk management framework;"
• "identify their critical information assets;"
• "develop an effective control and response framework for cyber-risk;"
• "promote cyber-security awareness among their staff; and,"
• "collaborate with other institutions in strengthening the financial sector cyber-security."

The governance model behind this is the familiar three lines. The guidelines say a sound operational risk structure "should rely on three lines of defense: the business line management, an independent Risk Management function, and internal audit."

What internal audit must check in IT

The Internal Audit Directive was issued by the Insurance Board "in exercise of the power conferred by clause (d2) of Section 8 of the Insurance Act, 2049" and commenced from Shrawan 2079 (July 2022).

It requires internal audit to cover, at least, a list of areas that includes "Management Information System (MIS)." For MIS, it lists the "areas of audit concern":

• "Whether MIS strategic plan is consistent with the insurers business objectives and goals;"
• "Whether participation from the internal audit department is included if an MIS steering committee is established;"
• whether standards and procedures for systems development, "computer operations and security," teleprocessing and computerized applications "including data integrity and Electronic Fund Transfer are adequate and in compliance with the regulated policy;"
• "Whether the organizational structure of the IS department provides proper reporting line;"
• whether management reporting on MIS activities is adequate;
• "Whether MIS staff and users are adequately trained;" and
• "Whether MIS activities have complied with relevant guidelines issued by statutory bodies if applicable from time to time."

It goes further on operations and security: internal audit "should include adequacy and effectiveness of computer operation procedures and physical control of computer equipments as well as competency of staff handling security functions and adequacy of procedures on security administration." For data integrity, the areas of concern "include adequacy and effectiveness in controls over input of data, programmed controls (e.g. edit checks, reasonable checks) and controls over output distribution."

The directive also protects the auditor's independence: the internal audit function "shall be independent of the internal control process in order to avoid any conflict of interest" and "shall not be assigned the responsibility of performing other accounting or operational functions."

Practical checklist for insurers

This checklist turns the quoted requirements into evidence your team can prepare. Read it alongside the IT Guideline for Insurers, 2076.

RMG = Risk Management Guidelines for Insurance Company, 2076. IAD = Internal Audit Directive for Insurers, 2079.

Where external IS audit fits

The directive sets what internal audit covers. Many insurers also bring in an external information security audit to test technical controls in more depth than an internal audit team can, or to give the board an independent view. If you do, keep the same principle the directive applies to internal audit: the auditor should not be the party that designed or runs the controls it is assessing.

Frequently asked questions

Is there a dedicated IT guideline for insurers in Nepal?

Yes. NIA's directives page lists बीमकको सूचना प्रविधि मार्गदर्शन, २०७६ (IT Guideline for Insurers, 2076), issued on २०७६/११/१४. Read it in full on NIA's site.

Does NIA treat cyber risk as part of risk management?

Yes. The Risk Management Guidelines for Insurance Company, 2076 include a section on "Data integrity and cyber risk" under operational risk, and list five actions insurers "shall" take to strengthen cyber resilience.

Does internal audit have to cover IT?

Yes. The Internal Audit Directive for Insurers, 2079 lists "Management Information System (MIS)" among the minimum areas internal audit must cover, with specific areas of concern including computer operations and security and data integrity.

Can our internal audit team also run IT operations?

The directive says the internal audit function "shall not be assigned the responsibility of performing other accounting or operational functions."

Where should an insurer start?

With the two items most others depend on: an inventory of critical information assets, and data integrity and cyber risk recorded in the risk management framework. Both are explicit requirements in the Risk Management Guidelines.

Next step

Trinity Technology carries out independent information security audits aligned to NRB and NIA requirements. See our NRB and NIA IS audit service, or tell us what you need assessed and we will reply within 24 hours. Banks and payment providers should also read our NRB IS audit preparation guide.