First of all, you should definitely get cyber insurance! That said, insurance companies have been paying out 5 x more settlements than they’ve been collecting in premiums. Of course that’s a bad business strategy for the insurers. It means the cyber criminals are super effective.  Insurance companies are creating a set of requirements and recommendations they have found keep their costs and losses to a minimum. Obviously, if you don’t have the insurance you need to at least follow their recommended minimum standards.