At a minimum the exclusion must: (1) exclude losses from a war, declared or not, where the policy has no separate war exclusion; (2) subject to (3), exclude losses from state-backed cyber-attacks that significantly impair the ability of a state to function or significantly impair the security capabilities of a state; (3) be clear whether it excludes computer systems located outside any state affected in that way; (4) set out a robust basis on which the parties agree how a state-backed cyber-attack will be attributed to one or more states; and (5) define all key terms clearly. Lloyd's accepted any of the four LMA model clauses issued as LMA21-042-PD (LMA5564 to LMA5567) as meeting the requirements; the LMA's classification notes add that the B versions without an attribution provision are compliant only if the managing agent explains to Lloyd's how attribution will be handled.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.