All (re)insurance policies written at Lloyd's must be clear whether losses caused by a cyber event are covered, by either excluding the cover or granting it affirmatively. A policy with no exclusion and no express grant of cyber cover is treated by Lloyd's as non-affirmative and must be brought into line. For implementing the requirement, and consistent with the PRA, cyber risk means any risk where the losses are cyber-related, from malicious acts (for example a cyber-attack or infection of an IT system with malicious code) or non-malicious acts (for example loss of data or accidental acts or omissions), involving tangible or intangible assets. The requirement applies to new and renewal business, to standalone policies and to the relevant element of blended products, and compliance is monitored through Lloyd's oversight activity and market attestations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.