Well... the government couldn't even really fix anything besides catch the hackers. At the end of the day it was the limited scope of the attack and some preper

Well... the government couldn't even really fix anything besides catch the hackers. At the end of the day it was the limited scope of the attack and some preperation on the companies part that restored functionality as I understand it. Alternitively, these industries are already heavily regulated including extensive safetly regulations - so perhaps a basic level of security practices should also be required. We regulated how high of a ladder an employee can climb without safety equipment but we don't really do anything if a company reuses passwords, runs known vulnerable software, etc. Occasionally there are fines after the fact but that is too late.