Cyber Systemic Risk Exclusion (Infrastructure)
The cyber systemic risk exclusion (infrastructure exclusion) removes accumulation losses arising from the large-scale failure of third-party digital infrastructure (e.g. cloud providers, internet backbone, power grid) from cyber cover, irrespective of any war or state nexus.
- Clause type
- Exclusion
- Origin/Market
- London Market (LMA/NMA/Lloyd’s)
- Favours
- Insurer
- Negotiability
- Negotiable
Purpose
Cyber accumulation risk does not only arise from war or state actors, but also from the failure of central infrastructure used simultaneously by many policyholders — for example a major cloud provider, an internet backbone, or a power grid. A single such event can trigger thousands of cyber policies at once and exceed available market capacity. Market bodies such as the Lloyd’s Market Association are developing a dedicated, model infrastructure/systemic-risk exclusion clause to address this accumulation exposure independently of the war and state-attribution question; pending standardisation, individual managing agents already use their own bespoke versions (for example so-called “Type 5” infrastructure exclusions used within Lloyd’s cyber war compliance frameworks).
Effect and limits
The exclusion is triggered by a large-scale failure (“significant impairment”) of infrastructure that the insured neither operates nor controls, regardless of whether the failure results from an attack or a technical fault. It is therefore clearly distinct from the war exclusion (Cyber War Exclusion, LMA5567), which requires a demonstrable state-attribution process: the systemic risk exclusion does not require any war or hostile-act qualification, but turns instead on the scale of the outage and the fact that a third party controls the affected infrastructure. Market wordings typically carve back infrastructure under the insured’s own control and sometimes apply a threshold based on the number of affected users or regions.
Negotiation and practice
Policyholders with heavy reliance on a small number of cloud or network providers should scrutinise the precise definition of “critical infrastructure” as well as thresholds and carve-backs, since wordings vary considerably between underwriters. Because the exclusion is drafted separately from the war exclusion LMA5567, it is worth clarifying whether both clauses appear in the same wording and how they interact in a dispute.