Lloyd's of London Cyber Insurance Requirements and Underwriting Standards C2: Assess and actively manage non-affirmative cyber exposure

Firms robustly assess and actively manage their products for non-affirmative cyber exposure, across all property and casualty covers that could give rise to cyber losses from physical or non-physical damage, and reduce unintended exposure so that the residual risk matches the board-agreed appetite and strategy. Besides holding adequate capital clearly linked to the risk, options include adjusting premium and offering explicit cover, robust wording exclusions and specific limits. If a firm decides to give cyber cover at no extra premium for a product or line, the board confirms that a comprehensive assessment of potential losses was carried out and that total non-affirmative exposure is within appetite, and the contract may be reworded to make the cover explicit. The approach is proportionate, led by the underwriting and risk management functions.