Lloyd's Minimum Standards - Cyber Security P12.1: 12.1 Operate a robust operational resilience framework

The managing agent runs an operational resilience framework. Foundational (the baseline every managing agent is expected to meet): the framework satisfies the applicable regulatory requirements and covers identifying and managing Important Business Services (IBS); an impact tolerance set for each IBS that reflects the risk to the managing agent's safety and soundness as well as possible harm to consumers; IBS and their impact tolerances kept current as business strategy and mix change; testing against severe but plausible scenarios, and exercises in responding to incidents; management of the risks from key suppliers and outsource providers; and mapping of the critical resources, third parties included, that each IBS depends on. Intermediate: the framework is matured further, for example with more sophisticated and complex scenarios, and the design of business changes and strategic initiatives takes operational resilience into account. Established: the framework is reviewed continuously for development needs with improvement plans in place, for example defined intervention points at which operational issues or events are reported to the operational resilience team and how they are reported. Advanced: the framework is well understood and integrated at every level of the organisation.