Organization's Information and Cyber Security Policy (ICSP) identifies responsibilities and establishes the goals for consistent and appropriate protection of the organization's critical data and Information Assets. Impl

Organization's Information and Cyber Security Policy (ICSP) identifies responsibilities and establishes the goals for consistent and appropriate protection of the organization's critical data and Information Assets. Implementing this policy shall reduce risk of accidental or intentional disclosure, modification, destruction, delay, or misuse of Information Assets. This policy enables the Information Security Officer to provide direction for implementing, maintaining and improving the security of Critical data and Information Assets Implementing this policy shall also protect information and information infrastructure in cyberspace, build capabilities to prevent and respond to cyber threats, reduce vulnerabilities and minimize damage from cyber incidents through a combination of institutional structures, people, processes and technology. By implementing this policy, the organization will be able to consistently establish and maintain controls for ensuring confidentiality, integrity and availability of all information assets. Additionally, it also safeguards working environment for its employees and partners who facilitate and support the goals in services. Vision: To provide a user-centric trusted and secure set of resources and environment to employees to conduct business, while ensuring protection of organization's information assets including customer data. Mission: Ensuring the security of all Organization's information assets through implementation of up-to-date security mechanisms for prevention and monitoring of threats; governance of information security related activities and awareness of all employees. Information Assets comprise data or information recorded in electronic, printed, written, facsimile or other systems as well as the 'system' itself, required for Organization's business purpose or operations. Information Assets include business data, system logs, servers, desktops, network equipment, network media, storage media, paper, people etc. Organization's Information and Cyber Security Policy applies to Information Assets throughout their lifecycle, including creation, distribution, transmission, storage and disposal such as: Information Assets in all forms: electronic, printed, written, facsimile, or spoken etc. Individuals or organization accessing the information assets like vendors, service providers, distributors, franchisee, customers, service providers, etc. The guidelines issued by IRDAI are applicable to all Insurers including Foreign Re-Insurance Branches (FRBs) and Insurance Intermediaries regulated by the Insurance Regulatory and Development Authority of India (IRDAI). Insurance Agents, Micro-Insurance Agents, Point of Sale Persons and Individual Surveyors will not fall under purview of these guidelines. However, it is responsibility of Insurers to ensure that these entities follow minimum security framework as defined under Insurers' Board approved policy in this regard. These guidelines are applicable to all data created, received or maintained by regulated entities wherever these data records are and whatever form they are in, in the course of carrying out their designated duties and functions. The Applicability of NIST Framework to All Regulated Entities. The classification of Insurance Intermediaries based on gross insurance revenue. The Auditors report comprising of Audit Summary, overall findings, non-compliances, risk rating. The Eligibility Criteria for the Audit firm. The Text of Audit Certificate to be certified by the Audit Firm. The Text of Audit Certificate to be certified by the Audit Firm for FRBs. Based on the above passage answer the following questions: Enumerate the Internal Audit Guidelines issued by IRDAI Information Security Function of the Insurance Companies.