Lloyd's Minimum Standards - Cyber Security P12.3.3: 12.3.3 Cyber governance, protection and identification

Cyber security is governed and systems are protected. Foundational: the organisation has a defined, written cyber security strategy; the IT systems on which Important Business Services depend are identified and shielded from cyber risk; systems are hardened with technical and procedural controls so they are hard to compromise; every member of staff receives security awareness training at intervals; and outdated or unsupported hardware and software is identified and its weaknesses managed. Intermediate: the findings of routine penetration tests and vulnerability scans go to the relevant governance forums, the board included; cyber security is built into procurement of new services and systems; weaknesses in protective controls are identified proactively; vendor security patch status is monitored and patches applied as needed by criticality; data is encrypted at rest or in transit so that a lost, mislaid or wrongly sent item does not turn into a data breach. Established: Risk Management or Internal Audit give assurance on control effectiveness through reporting on testing and on delivery of the strategy; threat intelligence informs the function that delivers the strategy; protective controls are rated, tested and linked at intervals to the cyber risk events they guard against; an industry recognised certification confirms how systems and data are protected. Advanced: cyber capability is formally assessed by independent outsiders, for example through CBEST, STAR-FS, FS-ISAC or red team exercises; each person's cyber responsibilities are understood and embedded; protection is prioritised for all systems, with control effectiveness revisited and weaknesses remediated quickly after incidents; data loss prevention warns or blocks transfers on classification markings or dynamic rules such as content scanning.