No. However there will be written requirements into the policy on security expectations. When the incident happens, there will be a post mortem review of whet

No. However there will be written requirements into the policy on security expectations. When the incident happens, there will be a post mortem review of whether the security best practices were implemented and how they contributed or hindered to the incident The insurer will use that to either deny some coverage, increase premiums or worst case, advice that the policy will not be renewed. The way requirements are handled is true for small or medium clients. I dont have experience with large firms but i would not expect those clients to be different. (One does not go about winning business by asking new clients to submit to an audit prior to switching) That being said, there may be audit requirements at renewals.