Thats basically the whole point actually... A company pays for insurance for the business. The insurance company says sure we will insure you, but you need to g

Thats basically the whole point actually... A company pays for insurance for the business. The insurance company says sure we will insure you, but you need to go through audits A B and C, and you need certifications X and Y to be insured by us. Those audits are often industry dependent, mostly for topics like HIPAA, PCI, SOC, etc. Insurance company hears about supply chain attacks. Declares that insured must have supply chain validation. Company goes and gets a shiny cert. Now when things go wrong, the company can point to the cert and go "it wasnt us, see we have the cert you told us to get and its up to date". And the company gets to wash their hands of liability (most of the time).