Unless Lloyd's agrees otherwise, every standalone cyber-attack policy in risk codes CY and CZ must contain a suitable clause excluding liability for losses from any state-backed cyber-attack, in addition to any war exclusion (in the same clause or a separate one). The requirement applies from 31 March 2023 at the inception or renewal of each policy; in-force policies need not be endorsed unless they expire more than 12 months after 31 March 2023. Lloyd's reasons that state-backed attacks can occur outside a war involving physical force and, with their capacity to spread, create a systemic risk like war. Y5433 extends the scope to multi-line policies with a CY or CZ section and to all business through any distribution method, including existing facilities and other delegated arrangements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.