FCA, PRA and Lloyd’s: Do Insurers Need a Penetration Test?

No rule from the FCA, the PRA or Lloyd’s tells an insurer, broker or MGA to commission a penetration test. The FCA and PRA operational resilience rules call for important business services, impact tolerances and scenario testing, and Lloyd’s sets minimum standards for managing agents. A penetration test is one way to produce the technical evidence those regimes lead firms to want.

Does the FCA or PRA require an insurer to have a penetration test?

No. Neither regulator names a penetration test as a rule for insurers. What they do ask is that in-scope firms identify their important business services, set impact tolerances and test whether they can stay within those tolerances. Whether a penetration test belongs in that testing is the firm’s decision.

The FCA’s rules sit in SYSC 15A of the FCA Handbook. The chapter applies to a list of firm types that includes a Solvency II firm, an enhanced scope SM&CR firm, a bank and a building society. A broker or MGA should read the application section for its own permissions before assuming it is inside or outside the chapter.

The PRA’s equivalent is Supervisory Statement SS1/21. The PRA says it is relevant to UK Solvency II firms, the Society of Lloyd’s and its managing agents. SS1/21 sets out expectations on important business services, impact tolerances and scenario testing, and it names no penetration test.

What do the FCA and PRA actually ask for?

They ask for three connected things: a list of important business services, an impact tolerance for each one, and scenario testing that shows the firm can stay within that tolerance in a severe but plausible disruption. SYSC 15A states each as a rule, and none of the three is a technical test.

• On services, the chapter says “A firm must identify its important business services”. For an insurer that usually means services such as taking a policy, paying a claim or servicing a policyholder, as the firm itself defines them.
• On tolerances, it says a firm must set an impact tolerance for each of those services.
• On testing, it says “A firm must carry out scenario testing to assess its ability to remain within its impact tolerance” for each important business service, in the event of a severe but plausible disruption of its operations.

Scenario testing is wider than a penetration test. It includes paper exercises, tabletop sessions and recovery drills. A penetration test is the part that answers a narrower question: can an attacker exploit the systems that an important business service depends on, such as the claims platform or the broker portal? In our experience that is how insurers use it, as technical evidence that feeds their scenario testing and self-assessment. It is practice, not a rule.

We cover the FCA side in more detail in our guide to penetration testing under FCA operational resilience.

What does Lloyd’s ask of managing agents?

Lloyd’s publishes Minimum Standard MS11 on cyber resilience and data management for managing agents. It asks agents to make sure appropriate security testing takes place on all new systems, and it names technical penetration testing as one example of that testing. It does not set a test frequency.

The wording is in MS11 itself. Under cyber protection it says managing agents shall “ensure appropriate security testing takes place on all new systems and any findings are remediated in line with the managing agent’s risk appetite”. Elsewhere it says a key part of assuring secure design is “appropriate security testing, such as technical penetration testing, build reviews or application security testing, by competent ethical hackers”.

Two details help when you scope. For systems the managing agent builds or heavily customises, Lloyd’s expects the agent to start the security testing. For software-as-a-service products, it expects the vendor to have tested during design and build. MS11 also asks agents to obtain Cyber Essentials accreditation each year, which is a separate assessment from a penetration test. If you are a broker or MGA working with a syndicate, ask your managing agent which of its MS11 duties it expects you to evidence.

Who else asks an insurance business for a test?

Beyond the regulators, the requests we see come from three places: the firm’s own cyber insurer, the capacity provider or managing agent behind a delegated authority, and large commercial clients. These are private parties, so there is no public rule to cite, and the exact wording differs from one to the next.

Your own cyber insurance. Insurers are buyers of cover too. One published cyber proposal form asks whether you “conduct penetration tests of your network at least annually”, and whether all high and critical findings have been remediated. Requirements vary by insurer and policy. Our guide to cyber insurance renewals that ask for penetration testing goes through the questions.

Capacity providers and managing agents. In our experience, a broker or MGA that binds risks on behalf of a syndicate or insurer is usually asked for security evidence in the due diligence and in the periodic review that follows. The ask is often a recent report on the platform that handles bordereaux, policy binding and customer data.

Commercial clients and partners. Large corporate clients and comparison or aggregator partners send security questionnaires before they connect to a quote engine or broker API. Read the wording closely: some ask for Cyber Essentials Plus, some for an independent test report, and some for both.

Who can carry out the test?

Insurance organisations can use a CREST-accredited company or a CBEST provider, depending on what their requirement states. EJN Labs is CREST-accredited. SYSC 15A, SS1/21 and MS11 do not name an accreditation for ordinary penetration testing, so start with the document that triggered your request.

CBEST is a different thing from an ordinary penetration test. The Bank of England describes it as “an intelligence-led security testing framework”, and its guide for CBEST participants says “The PTSP must be CBEST accredited”. If your firm is taking part in CBEST, use a CBEST-accredited provider. For testing you commission yourself, a regulator’s rule does not set a scheme, and the question is what your customer, insurer or managing agent asks for in writing.

The details are in the Bank of England’s CBEST implementation guide. Ask any provider which legal entity holds its accreditation and check the scheme’s own register.

What should an insurance business test?

Test the systems behind your important business services first, then the places where an insurer, a broker and a policyholder meet. Start with whatever would hurt most if it failed: the quote engine, the claims platform and the broker and reinsurance connections. Each has its own failure modes, so each needs its own scope.

• Policy quote and buy. Customer-facing quote engines, buy flows and payment integration, including pricing-engine manipulation and access to other customers’ records.
• Claims platforms. Claims-management systems, first notification of loss journeys and loss-adjuster portals, including claim-amount tampering, payment destination changes and document upload.
• Underwriting and policyholder apps. Underwriting workbenches and policyholder apps, including delegated authority limits, rating-input tampering and quote expiry.
• Broker and reinsurance APIs. Broker-portal integrations, reinsurance data feeds and MGA or aggregator connections. See API penetration testing.
• Network and Active Directory. Separation between underwriting, claims and finance, and remote-access routes.
• Cloud. AWS and Azure configuration for the environments that hold insurance data.

What evidence do you hand back?

Hand back a dated report that names the systems tested, the method, each finding with a CVSS score, and what was fixed. No public rule sets a format for insurers, so match the evidence to the person asking. A managing agent and an underwriter usually want different things from the same test.

For your operational resilience self-assessment, keep the scope document and the retest result next to the scenario testing plan, and link each tested system to the important business service it supports. For a managing agent, a short letter naming the scope, the date and the outcome of the retest is usually where the conversation starts. For a cyber insurance form, the date of the last test and confirmation that high and critical findings were fixed answer the question that is asked. The full report can sit under a confidentiality agreement.

What does it cost?

Price follows the number of testing days, and the number of days follows the scope. UK day rates for CREST-accredited penetration testing typically run £1,100 to £1,400. The pricing page shows typical engagement lengths for each type of test, and the quote form gives an exact figure for your scope.

How EJN Labs approaches testing for insurance businesses

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated insurance penetration testing service for insurers, brokers, MGAs, insurtech firms, claims management companies and comparison sites. We scope each system by what it does and who uses it, and we test the boundaries between insurer, broker and policyholder.

Testing is safe by default on production, with no denial of service, and out of hours slots are available. The work is done by UK-based, CREST-certified testers. You get a fixed price for a defined scope, findings in a client portal as they are confirmed, CVSS-scored findings with a walkthrough call, and the report on the last day of testing. Retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees.

Frequently Asked Questions

Is a penetration test mandatory for an insurer under FCA or PRA rules?

No. SYSC 15A and PRA SS1/21 call for important business services, impact tolerances and scenario testing. Neither names a penetration test. A penetration test can give technical evidence about the systems those services depend on, but demonstrating resilience also needs broader scenario testing and evidence of response and recovery.

What does Lloyd’s MS11 say about penetration testing?

MS11 asks managing agents to ensure appropriate security testing takes place on all new systems, and names technical penetration testing as one example of such testing, carried out by competent ethical hackers. It sets no frequency and names no accreditation for the testing company.

Do brokers and MGAs need a penetration test?

No public rule says so for every broker or MGA. Whether SYSC 15A applies depends on the firm’s permissions. In our experience the request comes from a managing agent, insurer or client during due diligence or a periodic review, so read the wording of that request and scope the test to it.

Does the testing company need to be CREST-accredited or a CBEST provider?

Insurance organisations can use a CREST-accredited company or a CBEST provider, depending on what their requirement states. EJN Labs is CREST-accredited. CBEST applies where the firm is taking part in that assessment. Otherwise, use the accreditation named by the customer, insurer or managing agent asking.

How often should an insurance business run a penetration test?

No FCA, PRA or Lloyd’s text sets a frequency. No rule for insurers sets a testing frequency. One published cyber proposal form asks whether network penetration tests are run at least annually. Once a year, and again after a major change to a quote, claims or broker system, is a common starting point.

Get a quote for your insurance systems

Tell us which systems are in scope and who has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Penetration Testing Cost for UK Insurers, Brokers and MGAs, Best Penetration Testing Companies for UK Insurance Firms, penetration testing for UK insurance firms, penetration testing under FCA operational resilience, where penetration testing sits in PRA SS2/21 vendor reviews and what underwriters accept at a cyber insurance renewal.