This is interesting in many ways. One of the greatest risk responses is transference, and thus why 'cyber insurance' is interesting; it is a relatively undefined area. Though I am a proponent of, and advocate for, cyber insurance, it really is the devil in the details approach to risk response - what I mean is, in order for an org to be properly insured, the org must define 'data' since 'data' is intangible as well as access to said data - ref [EMOI Services LLC](https://law.justia.com/cases/ohio/supreme-court-of-ohio/2022/2021-1529.html). This is also includes that of due diligence and due care on part of the c-suite and those charged with fiduciary responsibly - ref Equifax debacle a few years ago. How this will ultimately affect MSPs (Managed Service Providers), CSPs (Cloud Service Providers) and SMBs (Small-Medium Businesses) will be interesting. It will also be interesting how this plays out when it comes to breach notification and protection for multinationals. If the org cannot - or will not - be insurable, then what recourse to consumers have to protect themselves. Realizing this puts more onus on the org housing the data, this could dramatically increase the 'cost of doing business.' This potential added cost could also steer SMBs away from transference though in some industries it is required.