Lloyd's Market Bulletin Y5381, dated 17 August 2022, requires standalone cyber policies written at Lloyd's to include a clause excluding losses from state backed cyber attacks, effective from 31 March 2023 at inception or renewal, unless Lloyd's agrees otherwise. This is educational, not legal advice, and not a reading of your policy.
What the bulletin says
The bulletin states its purpose as setting out requirements for state backed cyber attack exclusions in standalone cyber attack policies. It says these risks can spread widely and create systemic exposure, and that wordings need to be clear so risk can be priced and disputes reduced.
The exclusion applies to policies in risk codes CY and CZ. It must be in addition to any war exclusion. At a minimum it must:
- exclude losses from a war, declared or not, where the policy has no separate war exclusion
- exclude losses from state backed cyber attacks that significantly impair a state's ability to function or its security capabilities
- be clear about whether cover excludes computer systems located outside a state affected in that way
- set out a basis for how attacks are attributed to one or more states
- define key terms clearly
Managing agents must show legal review of the wording. The bulletin says that adopting any of four LMA model clauses (published as LMA21-043-PD) meets the requirements. Existing policies need not be endorsed unless the expiry is more than 12 months after 31 March 2023.
Why it matters to a buyer
The bulletin binds Lloyd's syndicates, not every insurer. Other markets use their own wording. Still, it shows how the market thinks, and the same questions are fair to ask of any policy.
Questions worth putting to your broker:
- How does the policy define a state backed attack?
- Who decides attribution, and on what standard?
- If an attack is aimed at a state but spreads, are your systems covered?
- What happens to your claim while attribution is unresolved?
What engineering can and cannot influence
Attribution is a legal and governmental matter. Engineers cannot control it. What they can do is reduce the chance that an attack of any origin becomes a large loss: segmentation, tested backups, patching known exploited flaws, identity controls. Insurers also ask about these controls at application time. See our application evidence map.
Read the actual policy
Do not infer your coverage from a bulletin. The wording, endorsements, and definitions in your own policy control. A broker or insurance counsel should read them with you, ideally before renewal rather than during a claim.
Quick check
Does the bulletin apply to every cyber insurer?
No. It sets requirements for Lloyd's syndicates writing standalone cyber attack policies. Other insurers may use different wording.
Does it say all cyber losses are excluded?
No. It requires an exclusion clause for state backed attacks meeting minimum standards. What is excluded depends on the clause adopted.
Sources
Last reviewed: 19 October 2026.
