Lloyd's Minimum Standards - Cyber Security P12.2: 12.2 Maintain oversight of operational resilience through governance processes and the risk and control environment

Operational resilience is governed and overseen. Foundational: the managing agent's operational resilience is owned and overseen by senior management and the board, and is monitored through the control environment and the risk management framework; senior management understand which external communications an operational disruption may require; and they understand what escalation and remediation may be needed during a disruption before any impact tolerance is breached. Intermediate: what internal committees are to receive on operational resilience is defined and understood, and scenario testing plans are reviewed and amended at the appropriate committees so that, for example, they look beyond a twelve-month horizon and take in lessons from earlier tests. Established: reports of risk or operational incidents to governance committees cover the effect on operational resilience, and the operational resilience self-assessment is laid out consistently and accessibly so that the board and senior management can examine and challenge it in depth. Advanced: senior management and the board are closely engaged, with clear senior accountability and ownership for changes, issues and developments that affect the framework.