Target lesson learned why Small business need cyber insurance

http://news.softpedia.com/news/target-to-pay-18-5-million-to-47-states-for-2013-data-breach-516007.shtml

It has always been my opinion  that all business need to plan for unforseen issues via insurance. Just as consumers have car, home and etc.... This TARGET settlement highlights the need for or at the very least demonstrates the liability that business incur when operating in cyber space. Target can absorb this but i imagine my account or cleaners that operate via the WWW as a critical business component and what would be their recourse in a similar instance. Despite recent regulation for POS and health there is no over arching regulation for PII (personable identity information) and small business best business practices. This leaves a considerable gap for the small business that operates in cyber space. As a tangent is there a need for retailers to warn  buyers of vulnerabilities in IOT?