A service essential to the maintenance of vital functions of a sovereign state, including financial institutions, health services and utility services, whose disruption may trigger the impacted state qualification.
The essential service is defined, in LMA 5565, 5566 and 5567 clauses, as a service essential to the maintenance of vital functions of a sovereign state, including but not limited to financial institutions and associated financial market infrastructure, health services and utility services. The list is not exhaustive, leaving interpretive scope. The concept's importance lies in the fact that it is central to the impacted state definition: a state only becomes impacted if the cyber operation has had a major detrimental impact on the availability, integrity or delivery of an essential service (or on its security or defense). The concept thus serves as a threshold of systemic criticality for the exclusion. A state-backed cyberattack that does not disrupt an essential service does not render the target state impacted, and losses suffered by insureds whose systems are in that state therefore do not fall under the impacted state exclusion. Interpretation remains open: does a disruption to the regional electricity grid constitute an attack on an essential service? Will an incident affecting a mid-size banking network be sufficient?
The 2015 attack on the Ukrainian power grid, attributed to the Sandworm group linked to the GRU, cut power to hundreds of thousands of customers. The electricity network falls within the utility services listed in the LMA definition. Had the attack occurred after 2023, it would likely have qualified Ukraine as an impacted state under LMA 5565 to 5567 clauses.
essential service, infrastructure critique, services vitaux, fonctions vitales