Smaller, publicly-owned utilities are leaning on cybsersecurity insurance to mitigate risk, according to the ratings agency.