8

th December 2022

Cyber Underwriting

Non Affirmative Cyber and Systemic Risk

© Lloyd’s 2022
2

Classification: Confidential

Agenda

FACI Presentation 8th December 2022

© Lloyd’s 2022

1. Introductions

2. Cyber Underwriting at Lloyd’s

3. Non Affirmative Cyber exposures

4. Systemic exposures – catastrophic 

nation state attacks.

5. Question and answers 
Cyber Underwriting

Overview at Lloyd’s

Remediation leading to profitability

© Lloyd’s 2022
4

Classification: Confidential

▪ The first cyber policy was produced at Lloyd’s in 1999

▪ The market is 6% of Lloyd’s premiums in 2022

▪ Lloyd’s is committed to this class but it has a number of challenges, including systemic exposures, 

continuously evolving exposures and a relatively new market.

▪ As part of this oversight we aim for a profitable market over the cycle. 

▪ We focus on Managing Agents who invest in expertise across multiple disciplines including Exposure 

Management, Claims, Risk Assessment, Pricing as well as underwriting.

▪ Approximately 89% of cyber insurance written at Lloyd’s is written by Expert Syndicates with the 

remaining business with those developing their expertise.

Background

FACI Presentation 8 © Lloyd’s 2022 th December 2022
5

Classification: Confidential

• The market in 2018 and 2019 was driven by exposure growth and reducing rate

• In 2020 the GWP growth was driven by rate and limited exposure.

• In 2021 there was a meaningful reduction in exposure and a substantial increase in RARC.

• The planning has seen a similar pattern for 2023 - rate increase, inflation and limited exposure 

growth.

Maintaining focus on cyber performance whilst enabling growth

FACI Presentation 8th December 2022

Strong push on pricing adequacy supports profitability

© Lloyd’s
Cyber Underwriting

Non Affirmative cyber

Challenging headwinds and structural challenges

© Lloyd’s 2022
7

Classification: Confidential

Non Affirmative cyber

FACI Presentation 8th December 2022

Providing clarity of coverage and placed with those who have the right level of expertise 

© Lloyd’s 2022

• Lloyd’s view is that it is in the best interests of customers, intermediaries and underwriters for 

all policies to be clear on whether coverage is provided for losses caused by a cyber event. 

• To provide this clarity, Lloyd’s mandated in 2019 that all policies either affirm cyber coverage 

in, or exclude it from, the (re)insurance policy.

• This change was implemented using a phased approach with the fourth and final stage 

completed in July 2021. Lloyd’s instructed the underwriters that policies where no exclusion 

existed and where there was no express grant of cyber coverage should be treated as ‘nonaffirmative’. In all these cases, underwriters were required to provide clarity of coverage for 

customers. 
8

Classification: Confidential

Non Affirmative cyber

FACI Presentation 8th December 2022

Providing clarity of coverage and placed with those who have the right level of expertise 

© Lloyd’s 2022

• A full schedule of classes and the implementation timeline for this exercise are contained in 

Lloyd’s Market Bulletin Y5277 published in January 2020. Lloyd’s definition of the cyber risk 

was aligned with the PRA’s approach 

• Lloyd’s Wording Repository currently contains in excess of 300 clauses used in cyber 

insurance policies. This covers all classes of business written at Lloyd’s

• Following this, Lloyd’s has carried out four attestation exercises (January 2020, January 

2021, July 2021 and January 2022) which sought Lloyd’s underwriters’ confirmation that they 

comply with the requirement to ensure clarity on cyber coverage by either excluding or 

affirming it. 97.2% of policies underwritten at Lloyd’s have a clause clarifying non affirmative 

cyber coverage.
9

Classification: Confidential

• Lloyd’s maintains a set of mandatory Realistic Disaster Scenarios (RDSs) to stress test both 

individual syndicates and the market as a whole. While probabilistic models and third-party 

tools for assessing cyber risk continue to develop, scenario modelling is a key methodology 

for assessing and understanding cyber risk across both affirmative and non-affirmative 

coverages. 

• The event scenarios are regularly reviewed to ensure they represent material catastrophe 

risks. There are currently four cyber RDSs which include Business Blackout, Ransomware 

Contagion, Cloud Cascade and Major Data Breach. 

Monitoring Systemic Exposures

FACI Presentation 8th December 2022

Realistic Disaster Exposures

© Lloyd’s 2022
Catastrophic nation 

state backed attacks.

Clarifying coverage

© Lloyd’s 2022
11

Classification: Confidential

• War is a required exclusion to write business in the Lloyd’s market unless it is written in the War 

market.

• The most commonly used clause NMA 464 was drafted in 1938, we were aware of over 40 

clauses being used.

• Lloyd’s role is to support a competitive and resilient cyber insurance market and this bulletin has 

not mandated clauses for Managing Agents.

• We’re committed to innovating to support the growth of this important class, while navigating the 

unique and complex challenges cyber poses for insurers and customers alike.

• The Lloyd’s Market Association (the association that represents underwriters at Lloyd’s) issued 

guidance on war exclusions last year

Nation State backed attacks

FACI Presentation 8th December 2022

Cyber at Lloyd’s

© Lloyd’s 2022
12

Classification: Confidential

At a minimum, the state backed cyber-attack exclusion must: 

1. exclude losses arising from a war (whether declared or not), where the policy does not have a separate 

war exclusion. 

2. (subject to 3) exclude losses arising from state backed cyber-attacks that (a) significantly impair the ability 

of a state to function or (b) that significantly impair the security capabilities of a state.

3. be clear as to whether cover excludes computer systems that are located outside any state which is 

affected in the manner outlined in 2(a) & (b) above, by the state backed cyber-attack. 

4. set out a robust basis by which the parties agree on how any state backed cyber[1]attack will be attributed 

to one or more states. 

5. ensure all key terms are clearly defined.

The Managing Agent can ask for an exemption if the clause used does not align with the Bulletin.

Nation State backed attacks

FACI Presentation 8th December 2022

The requirements from Bulletin Y5381

© Lloyd’s 2022
13

Classification: Confidential

LMA Cyber War and Cyber Operation exclusions

Lloyds Market Association Bulletin

LMA21-042-PD │ 25 November 2021

Cyber War and Cyber Operation Exclusion Clauses

The LMA Cyber Business Panel has drafted the following clauses

• LMA5564 – War, Cyber War and Cyber Operation Exclusion No.1

• LMA5565 – War, Cyber War and Limited Cyber Operation Exclusion No.2

• LMA5566 – War, Cyber War and Limited Cyber Operation Exclusion No.3

• LMA5567 – War, Cyber War and Limited Cyber Operation Exclusion No.4

In discussion with Lloyds it has been agreed that, in respect of stand alone cyber insurance policies, these clauses meet the requirements set out in the Performance 

Management — Supplemental Requirements & Guidance (July 2020) which state that all insurance and reinsurance policies written at Lloyds must, except in very limited 

circumstances, contain a clause which excludes all losses caused by war.

LMA Homepage

Lloyd‘s Wording Repository (registration required
14

Classification: Confidential

• War • War • War • War

LMA Cyber War and Cyber Operation exclusions

Overview

LMA5567 (No. 4) LMA5566 (No. 3) LMA5565 (No. 2) LMA5564 (No. 1)

▪ Retaliatory Cyber 

operations (“back and 

forth”) between any 

specified states. Two or 

more specified states must 

become impacted states 

(major detrimental impact)

▪ Cyber operations that have 

a major detrimental impact 

on a state Exclusion does 

not apply to by standing 

cyber assets (collateral 

damage)

▪ Retaliatory Cyber 

operations (“back and 

forth”) between any 

specified states. 

▪ Cyber operations that have 

a major detrimental impact 

on a state. 

▪ Retaliatory Cyber 

operations (“back and 

forth”) between any 

specified states. 

▪ Cyber operations that have 

a major detrimental impact 

on a state (sublimits apply)

▪ Cyber operations

Broad Exposure/ 

Coverage

Narrow
Cyber Underwriting

Questions and Answers

© Lloyd’s 2022
16

Classification: Confidential

This document is not intended for distribution to, 

or use by, any person or entity in any jurisdiction 

or country where such distribution or use would 

be contrary to local law or regulation. It is the 

responsibility of any person communicating the 

contents of this document, or any part thereof, to 

ensure compliance with all applicable legal and 

regulatory requirements.

The content of this document does not represent 

a prospectus or invitation in connection with any 

solicitation of capital by Lloyds. Nor does it 

constitute an offer by Lloyd’s to sell securities or 

insurance, a solicitation of an offer to buy 

securities or insurance, or a distribution of 

securities in the United states or to a U.S. 

person, or in any other jurisdiction where it is 

contrary to local law. Such persons should 

inform themselves about and observe any 

applicable legal. 

This document has been produced by Lloyd’s for 

general information purposes only. While care 

has been taken in gathering the data and 

preparing this document, Lloyd’s does not make 

any representations or warranties as to its 

accuracy or completeness and expressly 

excludes to the maximum extent permitted by 

law all those that might otherwise be implied.

Lloyd’s accepts no responsibility or liability for 

any loss or damage of any nature occasioned to 

any person as a result of the acting or refraining 

from acting as a result of, or in reliance on, any 

statement, fact, figure or expression of opinion or 

belief contained in this document. This document 

does not constitute advice of any kind.

Disclaimer

© Lloyd’s 2022