Cyber Exclusion – Property (LMA5400/CL380)

Purpose

Traditional property policies have historically been silent on cyber risk, creating unpriced “non-affirmative” cyber exposure and unquantified accumulation risk for insurers. Regulators such as the Prudential Regulation Authority and Lloyd’s therefore required cyber risk in all property policies to be either affirmatively covered or explicitly excluded. The cyber exclusion implements that requirement by consistently removing cyber losses from property cover.

Effect and limits

The older CL380 (“Institute Cyber Attack Exclusion Clause”) is drafted narrowly, contains several undefined terms, and has been interpreted inconsistently by courts; it is best suited to marine and transit policies. LMA5400, issued by the Lloyd’s Market Association in 2019, draws a more precise distinction between a malicious “Cyber Act” and a non-malicious, operational “Cyber Incident”: for the latter, a limited write-back applies for resulting fire or explosion, whereas for malicious attacks all resulting damage remains excluded. Costs of repairing or recopying data from back-ups are typically preserved under both scenarios. The stricter sister clause LMA5401 excludes all cyber exposure absolutely, with no write-back for fire or explosion.

Negotiation and practice

Businesses with significant IT dependency should check which variant of the clause (CL380, LMA5400 or LMA5401) applies to their contract, since this determines the residual cover for cyber-caused property damage. A standalone cyber policy with explicit cover for business interruption, remediation costs and liability is generally required to close the gap left by the exclusion.