I'm not convinced that implementing cybersecurity standards actually improves security.
It's really an interesting idea:
https://www.cato.org/sites/cato.org/files/serials/files/regu...
This creates a "market for effective practices", because companies that follow good security practices would get cheaper insurance.
But it would allow insurances and companies to figure out dynamically what is cost effective and what isn't.
There would be lots of financial incentive to figure out what protects you effectively and what is just security theatre.
The smart insurance companys are all getting out of cybersecurity insurance because the premiums on the policys they wrote 10 years ago when the average attack cost $1,000 to remediate do not look so good when the average attack now costs $100,000 to $1,000,000 to remediate. Since the expected probability of a successful attack in any given year that requires payout is approaching 100% these days the insurance needs to be priced something like 10x-100x the prevailing prices to be survivable.
Eventually it will shake out once the cyberattacking industry becomes mature because at that point backwards looking projections make sense. Until that time, we are in for a wild ride.