I'm not an expert at this, but wouldn't it be better to impose regulation+penalties on best practices and force organizations to abide by a minimal set of stand

I'm not an expert at this, but wouldn't it be better to impose regulation+penalties on best practices and force organizations to abide by a minimal set of standards (e.g., no clear-text passwords; no SSNs as IDs; breaches must be announced)