I think requiring mandatory insurance against "cyber-disaster" for qualifying types of companies would be the best way to accomplish this. Insurance premiums o

I think requiring mandatory insurance against "cyber-disaster" for qualifying types of companies would be the best way to accomplish this. Insurance premiums of all types are based on risk factors, so the policy would be written against a checklist of best practices. Similar to how having a fire extinguisher in your kitchen reduces your home insurance premiums by small percentage, the same could be said for each security practice. Encrypted passwords: -2%. Mandatory 2FA in place: -3%. Etc.