Cybersecurity Policy Report, Lloyd's: Cyber Insurance Must Exclude Nation-State Attacks, (Aug 18, 2022)
Organizations Mentioned:Lloyd's of London
Lloyd's of London will require all stand-alone cyber insurance policies issued by its members to exclude from coverage any cyber attacks attributable to nation-states, according to a bulletin issued by Lloyd's.
"Lloyd's remains strongly supportive of the writing of cyber-attack cover but recognises also that cyber related business continues to be an evolving risk. If not managed properly it has the potential to expose the market to systemic risks that syndicates could struggle to manage," the bulletin said.
"In particular, the ability of hostile actors to easily disseminate an attack, the ability for harmful code to spread, and the critical dependency that societies have on their IT infrastructure, including to operate physical assets, means that losses have the potential to greatly exceed what the insurance market is able to absorb," it added.
"More recently, exposure to cyber-attack losses has been an area of market focus in circumstances where the losses arise from attacks sponsored by sovereign states," the bulletin said.
It noted that policies already generally excluded coverage for losses caused by acts of war. But stand-alone cyber insurance policies don't always "take account of the possibility that state backed attacks may occur outside of a war involving physical force. The damage that these attacks can cause and their ability to spread creates a similar systemic risk to insurers," it said.
"It is important that Lloyd's can have confidence that syndicates are managing their exposures to liabilities arising from war and state backed cyber-attacks," the bulletin said. "We are therefore requiring that all standalone cyber-attack policies ... must include, unless agreed by Lloyd's, a suitable clause excluding liability for losses arising from any state backed cyber-attack."
Lloyd's offered suggested language that should be added to policies regarding state-backed cyber attacks and said the new requirement would go into effect for all new policies and renewals issued after March 31, 2023.
News: InternationalLegislation DataSecurity