Lloyd's Minimum Standards - Cyber Security P12.R1: Report significant cyber incidents and data breaches to Lloyd's and the LMA within 72 hours

Under the Foundational expectations of Principle 12, managing agents tell Lloyd's and the LMA about any significant data breach or cyber incident no later than 72 hours after it occurs. The managing agent applies its own incident classification and severity framework to decide whether an incident is significant, but significant incidents can reasonably be expected to include at least any that significantly affect customers or policyholders, could affect delivery of Important Business Services, or could reach other participants in the market or the wider market at Lloyd's. Lloyd's prescribes no format: the managing agent's own incident reporting forms or templates are used, carrying enough information for an initial assessment, and notifications go to the Lloyd's operational risk mailbox. The glossary defines a Cyber Incident as an event threatening the confidentiality, availability or integrity of the managing agent's networks, information systems or data, covering cyber-attacks, every Personal Data Breach and comparable breaches of commercial data that is not personal, underwriting data for example. This notice to Lloyd's comes on top of, and does not replace, any report required by law or by another regulator.