Lloyd's of London Cyber Insurance Requirements and Underwriting Standards
The requirements Lloyd's places on managing agents writing cyber (re)insurance: every policy must affirm or exclude cyber cover (Market Bulletins Y5258 and Y5277, phased 2020 to 2021); standalone cyber policies must exclude state-backed cyber-attacks to five minimum standards, legally reviewed and attested by clause type, with Type 4 and Type 7 clauses ended from 2025 (Y5381, Y5433); cyber underwriting risk is managed to PRA SS4/17, which Lloyd's adopted in Y5147 (non-affirmative exposure, board-owned strategy and appetite, 1-in-200 aggregation stress tests, expertise); cyber business is coded CY, CZ, CG, CH, RY, RZ and (from 2027) WY; and cyber exposure is reported through the compulsory cyber Realistic Disaster Scenarios and the annual Cyber Aggregates Data Collection.
Lloyd's of London Cyber Insurance Requirements and Underwriting Standards is a compliance framework from United Kingdom (Lloyd's market) with 4 domains and 20 controls that map to 63 other frameworks. The largest domains are State-backed cyber-attack exclusions in standalone cyber business (Y5381, Y5433) – Lloyd's of London Cyber Insurance Requirements and Underwriting Standards (8 controls), Cyber insurance underwriting risk management (PRA SS4/17 adopted by Y5147) – Lloyd's of London Cyber Insurance Requirements and Underwriting Standards (5 controls), Clarity of cyber cover in every policy (Y5258, Y5277) – Lloyd's of London Cyber Insurance Requirements and Underwriting Standards (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
Clarity of cyber cover in every policy (Y5258, Y5277) – Lloyd's of London Cyber Insurance Requirements and Underwriting Standards
| Code | Title |
|---|---|
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::A1 | Every policy affirms or excludes cyber cover |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::A2 | Apply the requirement on each class's phase date |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::A3 | Bring delegated and facility business into line at renewal or as soon as contractually possible |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::A4 | Treat policies that local law prevents from being clarified as affirmative for exposure management |
Cyber insurance underwriting risk management (PRA SS4/17 adopted by Y5147) – Lloyd's of London Cyber Insurance Requirements and Underwriting Standards
| Code | Title |
|---|---|
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::C1 | Comply with PRA SS4/17 and attest compliance for each syndicate |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::C2 | Assess and actively manage non-affirmative cyber exposure |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::C3 | Maintain a board-owned cyber strategy with quantitative and qualitative risk appetite |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::C4 | Review cyber strategy, appetite and management information at board level with aggregation stress tests |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::C5 | Develop cyber expertise across the three lines of defence and retain accountability |
Cyber risk coding and exposure reporting – Lloyd's of London Cyber Insurance Requirements and Underwriting Standards
| Code | Title |
|---|---|
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::D1 | Code cyber business to the Lloyd's cyber risk codes |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::D2 | Complete the compulsory cyber Realistic Disaster Scenarios for every syndicate |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::D3 | Submit the Cyber Aggregates Data Collection and the Cyber RDS refresh data collections |
State-backed cyber-attack exclusions in standalone cyber business (Y5381, Y5433) – Lloyd's of London Cyber Insurance Requirements and Underwriting Standards
| Code | Title |
|---|---|
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::B1 | Include a state-backed cyber-attack exclusion in every standalone cyber policy |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::B2 | Meet the five minimum elements of the state-backed cyber-attack exclusion |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::B3 | Obtain legal review of the exclusion and agree any divergence with Lloyd's |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::B4 | Align reinsurance programmes back to back with the exclusions |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::B5 | Classify every clause and file the clause adoption attestation twice a year |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::B6 | Stop using non-compliant (Type 7) clauses and let dispensations (Type 6) expire |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::B7 | Restrict and then end Type 4 clauses; write war cyber cover only as a distinct affirmative product |
| lloyd-s-of-london-cyber-insurance-requirements-and-underwriting-standards::B8 | Apply the same rules to cyber treaty reinsurance and blended treaties |
Your Compliance Coverage
If you comply with Lloyd's of London Cyber Insurance Requirements and Underwriting Standards, you already cover:
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
7%
2 controls mapped
Compare →Vietnam Law on Cybersecurity (No. 116/2025/QH15)
7%
2 controls mapped
Compare →Vermont Data Privacy and Online Surveillance Act
7%
2 controls mapped
Compare →+ 60 more: US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule (7%), UK Defence Standard 05-138 - Cyber Security for Defence Suppliers (7%)
See all 63 mapped frameworks ↓Maps to 63 other frameworks
Coverage is not the same as your position
This page shows what Lloyd's of London Cyber Insurance Requirements and Underwriting Standards overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Lloyd's of London Cyber Insurance Requirements and Underwriting Standards and who does it apply to?
Lloyd's of London Cyber Insurance Requirements and Underwriting Standards is a compliance framework from United Kingdom (Lloyd's market) with 4 domains and 20 controls. The requirements Lloyd's places on managing agents writing cyber (re)insurance: every policy must affirm or exclude cyber cover (Market Bulletins Y5258 and Y5277, phased 2020 to 2021); standalone cyber policies must exclude state-backed cyber-attacks to five minimum standards, legally reviewed and attested by clause type, with Type 4 and Type 7 clauses ended from 2025 (Y5381, Y5433); cyber underwriting risk is managed to PRA SS4/17, which Lloyd's adopted in Y5147 (non-affirmative exposure, board-owned strategy and appetite, 1-in-200 aggregation stress tests, expertise); cyber business is coded CY, CZ, CG, CH, RY, RZ and (from 2027) WY; and cyber exposure is reported through the compulsory cyber Realistic Disaster Scenarios and the annual Cyber Aggregates Data Collection. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Lloyd's of London Cyber Insurance Requirements and Underwriting Standards actually require?
Lloyd's of London Cyber Insurance Requirements and Underwriting Standards has 20 controls organised across 4 domains. The largest domains are State-backed cyber-attack exclusions in standalone cyber business (Y5381, Y5433) – Lloyd's of London Cyber Insurance Requirements and Underwriting Standards (8 controls), Cyber insurance underwriting risk management (PRA SS4/17 adopted by Y5147) – Lloyd's of London Cyber Insurance Requirements and Underwriting Standards (5 controls), Clarity of cyber cover in every policy (Y5258, Y5277) – Lloyd's of London Cyber Insurance Requirements and Underwriting Standards (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Lloyd's of London Cyber Insurance Requirements and Underwriting Standards do I already cover?
Lloyd's of London Cyber Insurance Requirements and Underwriting Standards maps to 63 other compliance frameworks. The top mapping partners are Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) (7% coverage), Vietnam Law on Cybersecurity (No. 116/2025/QH15) (7% coverage), Vermont Data Privacy and Online Surveillance Act (7% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Lloyd's of London Cyber Insurance Requirements and Underwriting Standards?
Start your Lloyd's of London Cyber Insurance Requirements and Underwriting Standards compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Lloyd's of London Cyber Insurance Requirements and Underwriting Standards requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 20 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,111 frameworks.
Get Started Free →Free forever, no credit card required