IUA drafts broad exclusion to tackle silent cyber exposures

The International Underwriting Association (IUA) has drafted a broad clause to address silent cyber risk. The clause can be inserted into almost any P&C insurance policy to totally exclude cyber exposures, although it includes a provision that would allow the contractual parties to agree to include cyber-related exposures on a case-by-case basis. According to the IUA, the exclusion is not an attempt by insurers to avoid covering cyber risk but a move to clarify cover. It should be a starting point for discussions between underwriters, brokers and clients about what is, and what is not, covered by a traditional commercial or specialty insurance policy. The Cyber Loss Exclusion Clause has been drafted by a sub-group of the IUA’s Clauses Committee practitioners and other interested parties. It will be considered further by the trade body’s Clauses Group at a meeting scheduled for 20 September. If the clause is signed off, it will be published on the IUA’s website shortly after, Chris Jones, director of legal and market services at the IUA, told CRE. The model cyber loss exclusion has been drafted in response to the growing relevance of cyber exposures to insurers and policyholders, as well as regulatory pressure to clarify so-called ‘silent cyber’ cover in traditional insurance coverage. In July 2017, the UK’s Prudential Regulation Authority (PRA) issued Supervisory Statement SS4/17, setting out its views on silent cyber cover – also known as non-affirmative cover. This considered how traditional insurance policies can respond to cyber losses even where this is not the intention of the insurer. The statement marked a gear-change in regulatory oversight from the PRA, which is now encouraging insurers to clarify where and to what extent cyber cover is provided in insurance policies. The PRA’s supervisory statement called on insurers to identify silent cyber exposures and to accordingly adjust premiums, limits and/or use “robust wordings”. The PRA also called on insurers to produce cyber risk appetite statements and increase their cyber technical expertise. A number of cyber exclusions already exist in the London specialty and commercial insurance market. For example, the Institute Cyber Attack Exclusion Clause CL 380 is widely used in the marine and energy markets – and to a lesser degree other lines such as UK commercial and liability markets – to exclude damage from a malicious cyberattack. However, many market exclusions are dated (CL 380 was drafted in 2003) and are typically limited to aspects of cyber risk, such as malicious acts or physical damage. The new IUA cyber loss exclusion clause is designed to be as broad as possible and totally remove any cyber-related losses from the scope of primary policy, although it could also be incorporated into reinsurance contracts. The clause is not specific to any class of business, and is intended as a ‘catch-all’ exclusion. While the clause aims to exclude all silent cyber losses, it leaves the door open for underwriters to provide affirmative cyber cover. The model cyber exclusion also uses revised and updated definitions, which could also be adopted by insurers on a case-by-case basis. The cyber exclusion is a model clause. It will therefore be applied, either in its entirety or adapted, at the discretion of each insurer, and depending on negotiations with brokers and clients. Although developed by the London market, the clause could also be used by insurers in other markets, explained Mr Jones. “The cyber loss exclusion clause is designed to clarify what is covered and what is not under a [traditional non-cyber] insurance policy. At present, as highlighted by the PRA, in some classes it is not 100% certain where the policy is silent on cyber or where there is cover. The exclusion should help clear this up,” he said. Adding: “Where there is a total exclusion with potential affirmative cover write-backs, it requires a conversation as to what cover a client requires and how that fits with the policy. It [the clause] is a starting point for a discussion. It should raise awareness of silent cyber, as well as help the debate and encourage a policy response.” The London market has already been moving to clarify cyber cover in standard wordings, mostly through the market’s many committees. For example, earlier this year the London market’s Aviation Insurance Clauses Group published a model wording that excluded data breaches and IT systems outages from hull and liability policies. However, the exclusion does not apply to physical loss or physical damage to an aircraft or bodily injury. According to Mr Jones, this appears to be the direction of travel for insurers. Underwriters of traditional lines are increasingly likely to exclude silent cyber exposures, but provide affirmative cover where appropriate. Exclusions should also raise awareness of broader or more specialist cover being made available in the standalone cyber insurance market, such as cover for data breaches and contingent cyber business interruption, said Mr Jones. In related news, a survey by Willis Re finds that more insurers across the globe are expecting to report silent cyber losses across all lines of business except workers’ compensation in the next 12 months.

IUA drafts broad exclusion to tackle silent cyber exposures

Want to read this article?

Read Next

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Want to read this article?

Read Next

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Related Articles