I had to help a friend with a small business through a "cyber insurance" policy compliance questionnaire once and it was an incredible exercise in frustration.

I had to help a friend with a small business through a "cyber insurance" policy compliance questionnaire once and it was an incredible exercise in frustration. I would have felt certain the policy was a scam if it wasn't being mandated by a real insurance company the small business did other policies through. The questions didn't seem to have been written by someone with technical experience. Many of the questions wanted Yes/No binary answers for things that are complex technically. Some of the questions led to good discussions about security improvements for a small business, but most of them seemed "cargo culted" from large enterprises without real application to a small business. That did not leave me a strong impression of "cyber insurance policies". I suppose it also did leave me wondering how much we've left very small businesses behind in security as a culture.