Minimum security standards for cyber insurance