If the federal government wants things to change, they should form an independent red team, running exercises against private companies, and then help companies

If the federal government wants things to change, they should form an independent red team, running exercises against private companies, and then help companies address issues (the US government leaning on a vendor gets a lot more action than Topeka Electric Coop). With fines to increase the cost of inaction. The general consensus of reports thus far has been stupid, 101-level mistakes. And guidelines and recommendations aren't going to help with people who don't read them. E.g. Staff up NCATS [1], empower them with more binding regulation, and turn them loose to conduct non-requested tests of critical infrastructure [1] https://www.us-cert.gov/resources/ncats https://www.us-cert.gov/resources/ncats