Affirmative cyber
Cyber cover explicitly provided for and priced in a policy, as opposed to silent cyber.
PRA Supervisory Statement SS4/17, July 2017, then Lloyd's Market Bulletin Y5258, July 2019: insurers must state for each policy whether cyber risk is covered or excluded, from January 1, 2020 for new contracts. Affirmative cyber is cyber cover that is explicitly provided for, described and priced in an insurance policy, as opposed to silent cyber, where the exposure is neither mentioned nor excluded. Affirmative cover clearly defines the events covered (attacks on systems, data breaches, extortion, business interruption of digital origin), along with the exclusions, sub-limits and conditions for cover to respond. The move toward affirmation, driven by prudential authorities and by Lloyd's from 2019 onward, aims to eliminate the contractual ambiguity that kept insurers from measuring and reserving their actual exposure. The insured gains legal certainty: the scope of the cover is known in advance, rather than settled by litigation after the loss. The insurer can price an identified exposure and manage accumulation better. One caveat: affirmation does not mean broad cover. An affirmative policy may provide narrow cyber cover; the point is that its scope is explicit rather than implicit.
Lloyd's publishes market bulletin Y5258 in July 2019: from 1 January 2020, property policies must either affirm or exclude cyber. An insurer rewrites its policies to exclude cyber, then separately offers an affirmative cyber cover whose limits, exclusions and premiums are clearly defined.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.