Lloyd's of London Cyber Insurance Requirements and Underwriting Standards C3: Maintain a board-owned cyber strategy with quantitative and qualitative risk appetite

Firms that write affirmative cyber or are exposed to non-affirmative cyber risk have clear, board-owned strategies for managing the associated risks. The strategy contains clearly articulated risk appetite statements with quantitative and qualitative elements, for example target industries, the approach to non-affirmative cyber, rules for line sizes, aggregate limits by industry and the split between direct and reinsurance business.