The question of what's covered and what "reasonable" security looks like is the problem for this industry. If those definition's aren't clear, it'll mean that

The question of what's covered and what "reasonable" security looks like is the problem for this industry. If those definition's aren't clear, it'll mean that every major claim becomes a lawsuit, that's not going to help anyone apart from law firms. Also if a lot of major claims are denied, companies will stop taking out these policies on the grounds that they're worthless. FWIW my feeling is that Information security of a company is too complex and poorly understood to accurately model risk enough for decent insurance policy to be put in place.