I don’t know what insurers will allow but I imagine that covering them might be prohibitively expensive on your own policy. Requiring them to carry cyber-insurance might be a good idea as long as you are sensitive to the last bullet I addressed in the first question above.