Why is cyber insurance not a good way of treating information risk?

a. The insurance company will insist upon the implementation of additional, expensive controls

b. Cyber insurance usually does not cover the actual loss

c. The insured party remains liable for breaches of privacy law

d. The premiums are too expensive