If there is a major breach it seems likely that it is going to become known in time, whether it is reported or not. Not reporting it gets the company in even w

If there is a major breach it seems likely that it is going to become known in time, whether it is reported or not. Not reporting it gets the company in even worse trouble. Principal agents do not avoid legal liability by changing jobs. The plan is something of a high level wish list, but the intent seems to be to make larger companies and states get more serious about security. If they take on that responsibility they probably have little to worry about, though likely some higher expenses. The international aspect and making it a national security problem and the critical infrastructure aspect seem long overdue to be addressed. Who wants that chemical plant at the edge of town to blow up? Or all the chemical plants across the country to blow up.