Lloyd’s extends cyberwar risk exclusions to tackle non-physical attacks

Lloyd’s has told its syndicates that they must add cyber policy clauses that exclude state-backed cyberattacks linked to both physical and non-physical conflict. The market said the potential for systemic risk arising from such cyberattacks is simply too great for individual syndicates and the insurance market as a whole to bear. Therefore the risk must be excluded, it added. Lloyd’s said it remains “strongly supportive” of writing cover for cyberattacks but added that, if not managed properly, this has the potential to expose the market to systemic risks. “In particular, the ability of hostile actors to easily disseminate an attack, the ability for harmful code to spread, and the critical dependency that societies have on their IT infrastructure, including to operate physical assets, means that losses have the potential to greatly exceed what the insurance market is able to absorb,” explains Lloyd’s in a market bulletin. For this reason, Lloyd’s has consistently emphasised that underwriters need to be clear about what cyber cover they are providing. From 2020, it required all policies to specify whether cyber cover is provided by either including or excluding affirmative cover. The market then published four new war, cyberwar and cyber operation exclusion clauses In November last year. Now Lloyd’s wants to go one step further to protect the market from this potentially huge risk. “In particular, when writing cyberattack risks, underwriters need to take account of the possibility that state-backed attacks may occur outside of a war involving physical force. The damage that these attacks can cause and their ability to spread creates a similar systemic risk to insurers,” it stated in its latest market bulletin. “We recognise that many managing agents in the market are already including clauses in their policies specifically tailored to exclude cyberattack exposure arising both from war and non-war, state-backed cyberattacks. We wish to ensure, however, that all syndicates writing in this class are doing so at an appropriate standard, with robust wordings,” it continued. Lloyd’s said “robust” wordings also provide clarity of cover, which means risks can be properly priced and reduces the likelihood of disputes. The market has therefore instructed that all standalone cyberattack policies must include, unless agreed by Lloyd’s, a suitable clause excluding liability. This must be in addition to any war exclusion, which can form part of the same or a separate clause, explained Lloyd’s. At a minimum, the state backed cyberattack exclusion must: Exclude losses arising from a war (whether declared or not), where the policy does not have a separate war exclusion. (subject to 3) Exclude losses arising from state-backed cyberattacks that (a) significantly impair the ability of a state to function, or (b) that significantly impair the security capabilities of a state. Be clear as to whether cover excludes computer systems that are located outside any state which is affected in the manner outlined in 2(a) and (b) above, by the state-backed cyberattack. Set out a robust basis by which the parties agree on how any state-backed cyberattack will be attributed to one or more states. Ensure all key terms are clearly defined. Lloyd’s also said that, given the complexities that can arise in drafting suitable exclusion clauses, managing agents must be able to show that these exclusions have been legally reviewed. The market said it will discuss the clauses managing agents want to use in standalone cyberattack policies during the 2023 year of account business-planning process. “Managing agents will be expected to demonstrate that the clauses they will be adopting meet the requirements… Where managing agents wish to diverge from the requirements set out in this guidance, they will need to provide a robust explanation for their approach and receive agreement from Lloyd’s,” explained the bulletin. The requirements will take effect from 31 March 2023 at the inception or renewal of each policy. There is no requirement to endorse existing, in-force policies, unless the expiry date is more than 12 months from 31 March 2023, said Lloyd’s. It pointed out that managing agents will also need to take a close look at their reinsurance programmes to ensure they provide appropriate, back-to-back cover.

Lloyd’s extends cyberwar risk exclusions to tackle non-physical attacks

Want to read this article?

Read Next

Marsh launches global alternative risk solutions practice

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

Marsh launches global alternative risk solutions practice

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

Want to read this article?

Read Next

Marsh launches global alternative risk solutions practice

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

Related Articles