Lloyd's of London Cyber Insurance Requirements and Underwriting Standards D2: Complete the compulsory cyber Realistic Disaster Scenarios for every syndicate

The cyber scenarios are among the twenty compulsory Realistic Disaster Scenarios that managing agents must complete for all syndicates: Business Blackout II (a cascading power outage across the US Eastern Interconnection, half restored after three days, fully after three weeks), Cloud Cascade (a 48-hour outage of a major cloud provider in December, triggered by misconfigured cluster management software and worsened by malicious code, with dependent customers disrupted for up to 20 days), Ransomware Contagion (an operating-system vulnerability exploited by ransomware that spreads worldwide over three days) and Major Data Security Breach (simultaneous attacks on the syndicate's ten largest cyber-exposed clients in its most exposed sector, 24 hours of disruption, class actions; losses split into breach costs, business interruption, contingent business interruption, third-party liability, regulatory costs and other, plus crime, E&O with cyber endorsements, technology E&O, D&O and general liability, and calculated as one event and as ten events with the larger net loss returned; a syndicate may substitute its own data breach scenario with narrative in the supplementary information template). The cyber scenarios are run assuming none of the events is an act of war and, for Business Blackout II, that critical infrastructure exclusions do not hold. Lloyd's supplies technical specifications and simple calculation templates (confidential to managing agents); agents may interpret the scenarios for their portfolios and adjust template parameters but must notify Lloyd's when they do. In-force RDS returns are made twice a year through CMR (as at 1 January, due 26 March 2026; the RDL as at 1 July, due 27 August 2026), projected and in-force RDS losses must stay within the franchise guidelines (gross 80% and final net 30% of ECA plus profit), and an anticipated breach must be notified to Lloyd's Exposure Management in advance.