Infrastructure exclusion (cyber)
A cyber policy exclusion that removes losses caused by the failure of infrastructure outside the insured's control, power, telecoms, internet, satellites, because it would hit the whole portfolio at once.
The infrastructure exclusion removes from the cyber policy losses caused by the failure or interruption of infrastructure the insured does not control: the power grid, gas, water, telecommunications networks, the domain name system and core internet services, satellite links. It differs from dependent IT supplier interruption, often covered, because it targets the services on which all suppliers rely at once. Its rationale is actuarial: an infrastructure failure is not an independent loss but an event common to a whole territory, which would turn a diversified portfolio into a single exposure. Drafting is nonetheless delicate. Too broad, and it empties the business interruption cover, since almost any incident ends up touching a network. Too narrow, and it lets through the scenario regulators fear most, a state attack on shared infrastructure. That is why it is always read together with the cyber war exclusion: the first deals with what goes down, the second with who brought it down.
On February 24, 2022, an attack on the KA-SAT satellite network disabled tens of thousands of modems in Europe, notably cutting remote monitoring for about 5,800 German wind turbines. For the operators, the business interruption came from telecommunications infrastructure they did not control, attacked by a state on the day Ukraine was invaded: both exclusions applied together.
- Lloyd's, Market Bulletin Y5381, 16 August 2022 (read with the cyber war exclusion)
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.