I’m not talking about big war rooms with supercomputers breaking firewalls and gigabit encryption.  Let’s focus on the average small business that needs to make sure they have the latest updates in Drupal applied and know the CEO changed his password from “Golf”.
This is a nice subscription-based business that fits a market that cannot afford the super big guys.  You need to have an IT expertise and the ability to actually fix and deliver on what you promise.  Most small business liability insurance has some type of ‘data loss’ coverage so partnering with commercial insurance agents can be a great marketing relationship.   You provide a level of comfort above ‘my nephew does my computer work when I need it’.   They do not have large security budgets so designing a service that fits their unique needs is important.   These businesses have a responsibility to protect their customer’s information as well as protect the valuable digital assets of their shareholders or owners.   You can provide the tools and support to achieve this need.

Be sure to work with a good attorney to create a contract that does not make you responsible for any data breach or the damages from a data loss.  You need to add value and take responsibility for what you can control.  Then be sure to stop and clearly spell this out.  You do not want to be on the hook for the CEO not changing his password.