From my POV all I can come up with that feels concrete is somehow trying to figure out a plan / system where we can ensure companies that should have a certain

From my POV all I can come up with that feels concrete is somehow trying to figure out a plan / system where we can ensure companies that should have a certain level of security can be held liable (no question) in a way that prevents things from being handled in a reactionary way. The problem I keep running into is that each and every scenario and company this type of system will effect will be a case-by-case basis. I can't brainstorm many simple solutions that blanket cover many different types of businesses, markets and scenarios.