It wouldn’t surprise me if at first insurers throw their own internal security teams at this. They’re used to auditing third party systems, because insurers are constantly working with externally developed software and other companies.

You could go a long way just building out a team with both underwriters and security professionals to setup baseline standards and evaluate customers against those.