The way enterprises address information security will play an increasingly critical role in how cyber-insurance providers determine coverage and pricing, insurance experts told members of Congress at a recent hearing.