Introduction
IRDAI ICS Annexure III contains detailed endpoint security requirements that are among the most technically specific in the guidelines. Items 11, 15, 28, and 31 address session lockout, removable media controls, peripheral device restrictions, and URL filtering respectively. Together they define an endpoint security baseline that applies to every managed device across the insurer’s environment.
Most insurance IT teams have policies addressing these requirements. Session lockout is documented in the IT security policy. USB use is described as restricted. Bluetooth connections to corporate devices are stated as controlled. URL filtering is listed as a security measure. The compliance gap is almost always between the policy statement and technical enforcement. A session lockout policy that relies on users configuring their own screen saver settings is not a technically-enforced control. A USB restriction policy that requires users to request exceptions is not the same as a GPO that blocks USB storage devices at the operating system layer.
IRDAI IS auditors examining these items assess technical enforcement, not policy documentation. Item 11’s session lockout requirement is examined by testing whether devices actually lock after the defined inactivity period, not by reading the policy. Item 15’s removable media requirement is examined by attempting to connect a USB storage device and verifying it is blocked, not by reviewing the acceptable use policy.
This blog covers what each of the four items requires technically, how GPO Manager and MDM implement the controls, and what evidence each control produces for IS audit examination.
Item 11: Session Lockout Requirements
Item 11 requires automatic session lockout after a defined period of inactivity on managed endpoints. The lockout must be technically enforced, not user-configured.
What Item 11 requires technically
Automatic session lockout requires a centrally-configured policy that applies a screen lock after a defined inactivity timeout. The policy must be enforced at the operating system layer, not relying on users to configure their own lock screen settings. Users must not be able to disable or extend the lockout timeout without administrative approval.
The inactivity threshold must be defined in the IT security policy and technically configured to match. Common thresholds at insurance organisations are five minutes for devices in shared or public areas and ten to fifteen minutes for individual workstations in secure office environments. The threshold should be shorter for devices with access to sensitive customer or policy data.
The lockout must require re-authentication before the session resumes. A screen that locks but can be dismissed without entering credentials does not satisfy the security objective of Item 11. The re-authentication requirement connects Item 11 to the centralised authentication infrastructure: the lockout screen should require the user to re-authenticate through the same identity layer as the initial login.
How Akku addresses it
GPO Manager enforces session lockout policies centrally across Windows, macOS, and Linux endpoints from a single dashboard. The inactivity timeout is configured at the organisational unit or group level, ensuring consistent enforcement regardless of individual user configuration. Users cannot modify the lockout timeout without administrative access to the GPO configuration.
For mobile devices managed through MDM, equivalent passcode lock policies enforce automatic device lock after a defined inactivity period. MDM-enforced passcode requirements ensure that the lock screen requires credential entry to resume the session.
The GPO configuration record constitutes the technical enforcement evidence Item 11 requires. IS auditors examining Item 11 can verify the configured timeout in the GPO policy and test enforcement on a sample of managed endpoints. Akku’s IRDAI mapping shows GPO Manager and MDM together address Item 11 within the combined 31-mapping endpoint security coverage.
Item 15: Removable Media Controls
Item 15 requires controls on the use of removable media including USB storage devices on managed endpoints. The control must prevent data exfiltration through USB storage without authorised exception management.
What Item 15 requires technically
USB storage device restrictions must block the mounting of USB storage devices at the operating system layer. A policy stating that USB storage is restricted does not prevent a user from connecting a USB drive and copying files to it. A GPO that blocks USB storage device class at the driver level prevents the device from mounting regardless of user intent.
The restriction must apply to USB storage specifically. USB peripherals that are not storage devices, keyboards, mice, headsets, and similar devices, should not be blocked unless specific policy requires it. A well-configured USB restriction blocks the USB Mass Storage device class while permitting other USB device classes.
Exception management requires a formal approval process for temporary USB access where legitimate business need exists. The exception must be time-bound, logged, and revoked automatically at expiry. Standing exceptions that persist indefinitely undermine the control.
How Akku addresses it
GPO Manager enforces USB storage restrictions at the operating system layer across Windows, macOS, and Linux endpoints. The USB Mass Storage device class is blocked by default. USB peripherals of other classes continue to function normally. The restriction applies consistently across all managed endpoints in the organisational unit or group the policy targets.
For mobile devices, MDM enforces equivalent data transfer restrictions, blocking file transfer through USB connections and restricting AirDrop and Bluetooth-based file sharing.
The GPO enforcement record and audit log of USB connection attempts provide the IS audit evidence for Item 15. An auditor testing Item 15 compliance by connecting a USB storage device to a managed endpoint will find the device does not mount. Akku’s IRDAI mapping shows Items 15 and 201 among the 31 endpoint-related mappings covered by the combined GPO Manager and MDM module pair.
Item 28: Bluetooth and Peripheral Device Controls
Item 28 requires controls on Bluetooth usage and peripheral device connections to reduce data transfer and unauthorised pairing risks. Insurance environments where agents and intermediaries carry mobile devices create specific Bluetooth risk scenarios that Item 28 addresses.
What Item 28 requires technically
Bluetooth restrictions on managed endpoints must prevent unauthorised device pairing and data transfer through Bluetooth connections. The restriction can be implemented at two levels: disabling Bluetooth entirely on managed endpoints where business need does not require it, or restricting Bluetooth to approved device categories and pairing to pre-approved devices.
For insurance agent environments where mobile devices may need Bluetooth connectivity for legitimate purposes, selective restriction is more operationally viable than blanket disabling. Restricting Bluetooth file transfer while permitting Bluetooth audio and input device connections addresses the data exfiltration risk without blocking legitimate usage.
For workstations in secure data processing environments, complete Bluetooth disabling is the appropriate control. A customer data processing workstation has no legitimate business requirement for Bluetooth connectivity.
Camera and microphone controls, also addressed within the Item 28 context, require restrictions on camera and microphone usage on managed endpoints in sensitive areas. Covert capture through endpoint cameras and microphones is a data security risk in environments processing confidential insurance data.
How Akku addresses it
GPO Manager enforces Bluetooth limitations on Windows, macOS, and Linux endpoints. Bluetooth can be disabled entirely for specific organisational units or restricted to specific permitted device categories. Camera and microphone access can be blocked through GPO controls restricting application access to these peripherals.
MDM enforces equivalent controls on Android and iOS devices. Camera access can be restricted per device or per organisational group. Bluetooth settings can be controlled to prevent file transfer while permitting other Bluetooth usage categories.
The GPO and MDM configuration records, combined with audit logs of policy enforcement events, constitute the IS audit evidence for Item 28. Akku’s IRDAI mapping covers Items 27, 28, 73, 75, 81, and 86 within the endpoint control section of the combined GPO Manager and MDM mapping.
Item 31: URL Filtering Requirements
Item 31 requires URL filtering to restrict access to high-risk or non-business web categories from managed endpoints. URL filtering is a dual-purpose control: it reduces malware exposure from high-risk web categories and prevents data exfiltration through web-based channels including personal cloud storage, personal email, and file-sharing services.
What Item 31 requires technically
URL filtering must be enforced at the DNS or proxy layer, not relying on browser settings that users can modify. DNS-based filtering blocks resolution of domains in restricted categories before any connection is established. This is more robust than browser-level filtering, which can be bypassed by changing browser settings or using an alternative browser.
The filtering must cover the categories that represent the highest risk in an insurance environment. At minimum, this includes malware and phishing domains, personal cloud storage services such as consumer Dropbox and Google Drive personal accounts, personal email services, file-sharing and upload services, and categories associated with policy data exfiltration.
The filtering should produce access attempt logs that record blocked requests with the user identity, the attempted URL or domain, the blocking category, and the timestamp. These logs are both an operational security signal and an IS audit evidence source.
For remote workers accessing the internet from outside the corporate network, URL filtering through a cloud-based DNS filtering service extends the control to off-network endpoints. Corporate network-only filtering leaves remote endpoints unprotected during the majority of their operational time.
How Akku addresses it
GPO Manager implements DNS-based URL filtering across managed endpoints. Category-based filtering blocks domains in configured restricted categories. The filtering applies regardless of which browser the user is using or what browser settings they have configured. For remote endpoints, DNS filtering through the endpoint’s DNS resolver extends the control to off-network access.
In addition to DNS-based category filtering, GPO Manager enforces specific application-level blocks on personal cloud drives, personal email access through browser interfaces, FTP client usage, and upload services. These targeted controls address the specific data exfiltration channels that Item 31 is designed to prevent.
Access attempt logs from the filtering infrastructure record blocked requests with user identity, domain, category, and timestamp. These logs are queryable from the Akku admin console and constitute the IS audit evidence for Item 31 enforcement. Akku’s IRDAI mapping covers Items 31, 44, 107, 185, 193, 194, 197, 216, 217, 261, 280, and 305 within the network and data control section of the combined GPO Manager and MDM mapping.
Why Endpoint Controls Are the Largest Single Coverage Area in Akku’s IRDAI Mapping
GPO Manager and MDM together carry 31 of the 97 total IRDAI control mappings in Akku’s compliance documentation, the highest combined module count. This reflects the IRDAI ICS Guidelines’ detailed and specific endpoint security requirements across session management, peripheral controls, network access, data protection, and device governance.
The 31 mappings span Items 11, 15, 18, 27, 28, 31, 36, 37, 44, 73, 75, 81, 86, 87, 102, 106, 107, 111, 154, 177, 185, 193, 194, 197, 201, 216, 217, 261, 270, 280, and 305. Together these items define the IRDAI ICS endpoint security baseline across device enrollment, session security, peripheral restrictions, data transfer controls, network access governance, and system configuration requirements.
The concentration of IRDAI requirements in the endpoint layer reflects the guidelines’ recognition that insurance environments, particularly those with field agent networks, BYOD programmes, and distributed branch operations, face significant data security risk at the device layer. Controls at the identity and application layer are necessary but not sufficient. Endpoint-level enforcement is required to address the data exfiltration, device compromise, and configuration drift risks that identity controls alone cannot prevent.
Diagnostic Questions
Do managed endpoints in your organisation lock automatically after a defined inactivity period with a centrally-configured GPO policy, or does the lockout rely on individual user screen saver settings?
When a USB storage device is connected to a managed endpoint in your environment, is it blocked at the OS layer by a GPO restricting the USB Mass Storage device class, or is the restriction enforced through a policy statement that users are expected to follow?
Does your URL filtering apply to remote endpoints accessing the internet from outside the corporate network, or only to devices on the corporate network?
Are access attempt logs from URL filtering available for IS audit examination, showing blocked requests with user identity, domain, category, and timestamp, or does the filtering operate without producing queryable logs?
For mobile devices used by insurance agents and intermediaries, do MDM policies enforce the same data transfer and peripheral controls as GPO policies on corporate workstations, or are mobile endpoints subject to weaker controls?
CTAs
See how Akku’s GPO Manager and MDM address IRDAI ICS endpoint security requirements across session lockout, removable media, peripheral controls, and URL filtering.
Book a conversation with the Akku team to assess your current endpoint security posture against IRDAI ICS Annexure III requirements.
FAQs
What is the difference between a policy-stated USB restriction and a technically-enforced USB restriction for IRDAI Item 15 purposes?
A policy-stated restriction is a document stating that USB storage devices should not be used without authorisation. It relies on user compliance and manual enforcement. A technically-enforced restriction is a GPO that blocks the USB Mass Storage device class at the operating system driver layer, preventing any USB storage device from mounting regardless of user intent. IRDAI IS auditors examining Item 15 test technical enforcement, not policy existence. They connect a USB storage device to a managed endpoint and verify it does not mount. A policy document does not prevent the device from mounting. A GPO does.
Why does Item 31 require DNS-based URL filtering rather than browser-level filtering?
Browser-level filtering can be bypassed by changing browser settings, using an alternative browser, or using a browser extension that overrides filter settings. DNS-based filtering operates below the browser layer: it blocks the DNS resolution of restricted domains before any TCP connection is established, regardless of which browser or application initiates the request. This makes DNS-based filtering significantly more robust against user circumvention. For insurance environments where data exfiltration risk through web channels is a compliance concern, DNS-based filtering is the technically appropriate implementation of Item 31’s URL filtering requirement.
How should insurance organisations handle legitimate business exceptions to USB storage restrictions under Item 15?
Legitimate business exceptions to USB storage restrictions require a formal approval process documented in IT security policy. The exception must specify the user, the device, the business justification, and the time period. The exception should be implemented as a time-bound GPO exception for the specific device or user rather than a blanket policy relaxation. The exception request, approval decision, implementation, and expiry must all be logged. IS auditors examining Item 15 will look for evidence that exceptions are governed through a formal process, not informally granted. Uncontrolled exception proliferation that effectively negates the USB restriction control is a finding.
Does Item 28’s Bluetooth restriction apply to all managed devices or only to devices in specific risk categories?
IRDAI ICS Item 28 applies to managed endpoints without specifying a subset. The practical implementation should be risk-stratified: devices in secure data processing environments handling confidential policyholder data should have Bluetooth disabled entirely. Devices used by field agents and intermediaries may permit Bluetooth for legitimate operational purposes such as connecting to printers or headsets, with file transfer capabilities restricted. MDM and GPO allow organisational-unit-level policy assignment, enabling different Bluetooth restriction levels to be applied to different device populations based on their risk profile and operational requirements.
How does Akku’s GPO Manager differ from Microsoft’s Group Policy for IRDAI compliance purposes?
Microsoft’s Group Policy is designed for Windows Active Directory environments. It provides endpoint policy management for Windows-domain-joined devices but requires Active Directory infrastructure and does not natively extend to macOS, Linux, or mobile devices. Akku’s GPO Manager is platform-agnostic and cloud-delivered. It applies consistent policies across Windows, macOS, and Linux endpoints from a single dashboard without requiring Active Directory infrastructure. For insurance organisations with mixed-OS environments or those that have migrated away from on-premises Active Directory, Akku’s GPO Manager provides the same endpoint policy enforcement capability across the full device estate. For IRDAI compliance purposes, the platform-agnostic coverage is significant because Items 11, 15, 28, and 31 apply to all managed endpoints regardless of operating system.
Can GPO Manager and MDM controls satisfy both IRDAI ICS and SEBI CSCRF endpoint security requirements simultaneously?
Yes. IRDAI ICS Items 11, 15, 28, and 31 and SEBI CSCRF PR.AA.S15, PR.DS.S1 to S3, and PR.DS.S4 address overlapping endpoint security requirements including session lockout, removable media controls, peripheral restrictions, and data transfer controls. The same GPO Manager and MDM configuration that enforces IRDAI Item 15’s USB storage restriction simultaneously satisfies SEBI CSCRF PR.DS.S1 to S3’s data protection requirements. Akku’s GPO Manager and MDM carry 31 IRDAI mappings and 21 SEBI CSCRF mappings respectively, reflecting the substantial overlap between the two frameworks’ endpoint security requirements. A single endpoint policy configuration satisfies both frameworks from the same technical control.
