Aditya Birla Health Insurance (ABHICL) is certified to ISO 27001:2013 Standards and its associated approach to implement Information Security Management System (ISMS), IRDAI regulations and all AADHAAR regulations from time to time, which will provide information security framework for ABHICL to maintain Confidentiality, Integrity & Availability of its information assets.

The objectives of Information Security Policy are to:

• Accountability: Users and Custodians of Organization’s Information Assets are responsible for the appropriate use, protection and privacy of these assets. All Organization’s system will generate and maintain appropriate audit trails to identify Users, IT assets and document security-related events and processes. Ensure that the employees understand their responsibilities and roles regarding information security.
• Integrity: Reduce the risks due to human error, theft, fraud or misuse of information assets and facilities. Information Assets must be adequately protected to ensure completeness and accuracy. Validation measures will allow detection of inappropriately modified, deleted, or corrupted information.
• Incident Management: Reduce the number of adverse incidents.
• User Authentication and Authorization: All Users must be uniquely identifiable with access permissions specifically and individually authorized based on their business needs. User access methods should stress strong authentication, appropriate authorization and reliable audit-ability. Restrict access to the information assets as per the business requirement.
• Information Protection: Information Assets will be protected at a level commensurate with their value and the risk of loss to the organization. Protection should stress the confidentiality, integrity, and availability of Information Assets.
• Availability: Information Assets must be available to support Organization’s business objectives. Appropriate measures must be taken to ensure the timely recovery of all information and access by authorized individuals. Regularly conduct the preventive maintenance of the utility equipment to ensure their faultless services.
• Continuity: Organization must demonstrate the ability to maintain continuity of operations from business and technology perspectives. All information assets and related policies and procedures of Insurance Company, shall be evaluated from a continuity perspective to support Organization’s business objectives. Partners, vendors and service providers must all demonstrate the ability to meet or exceed Organization’s continuity objectives at all times.
• Cyber Security Resilience: To enable effective prevention, investigation and prosecution of cybercrime and enhancement of law enforcement capabilities through appropriate legislative intervention.
• Vulnerability Management: Remediate of identified critical activities within an agreed timeframe. Management of technical vulnerabilities of information systems being used in the organization.
• Trust: Partners, vendors and service providers must demonstrate ability to meet or exceed Organization’s security requirements and justify confidence in their ability to secure Organization’s Information Assets. Trust becomes increasingly important when Organization’s Information Assets are shared with business partners and service providers.
• Regulatory Compliance: Adhere to ABHICL’s client, contractual, legal and regulatory (including IRDAI and UIDAI) requirements.

Information Security Policy covers all of the management decisions, intentions, definitions, and rules relating to information security in place, at a particular time. This policy provides management, directive for information security and recommend appropriate security controls that need to be implemented to maintain and manage the Information Security in Aditya Birla Health Insurance Co. Limited.

ISRMC review the Information Security Policy annually or at the time of any major change(s) in the existing environment as per the regulatory requirement affecting policies and procedures, whichever is earlier.

The Information Security Policy has been detailed out in Aditya Birla Health Insurance Co. Limited’s Information Security Policy and is available for reference with Information Security Team.