Information systems are known and cyber incidents are reported. Foundational: information systems are able to keep information intact, and any significant data breach or cyber incident is notified to Lloyd's and, where appropriate, to the LMA within 72 hours. Intermediate: the information systems on which Important Business Services depend are recorded and understood. Established: a central asset register records almost every information system, the exception being non-critical end user developed applications, and areas of cyber security concern such as residual risks rated red are visible at the risk committee and the board. Advanced: an asset inventory, reviewed regularly, is understood and used throughout the organisation, and asset owners and data stewards control access through a clear process that is itself reviewed regularly. The 2023 edition (carrying MS11 forward) required a Material Cyber Incident to be notified to Lloyd's via the named account manager as soon as the managing agent learned of it, followed by constructive discussion and reasonable steps to mitigate and prevent recurrence; the later guidance set a 72-hour window from detection.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.