Lloyd's of London Cyber Insurance Requirements and Underwriting Standards C4: Review cyber strategy, appetite and management information at board level with aggregation stress tests

The board reviews the cyber strategy, appetite statements and management information periodically: non-affirmative strategy and exposure at least annually, affirmative cyber more often. The MI includes at a minimum the appetite statements and measurement against them; aggregate cyber underwriting exposure metrics for affirmative and non-affirmative risk; and cyber underwriting stress tests that explicitly consider loss aggregation (for example through the cloud or across products) at extreme return periods up to 1 in 200 years, consistent with the PRA's periodic general insurance stress tests.