Hacker News new | ask | show | jobs
by mr_overalls 2665 days ago
I think requiring mandatory insurance against "cyber-disaster" for qualifying types of companies would be the best way to accomplish this.

Insurance premiums of all types are based on risk factors, so the policy would be written against a checklist of best practices.

Similar to how having a fire extinguisher in your kitchen reduces your home insurance premiums by small percentage, the same could be said for each security practice. Encrypted passwords: -2%. Mandatory 2FA in place: -3%. Etc.