The regulation on insurers’ cyber security criticized