If you want to give critical utilities incentives, then use the stick. Put together a pentest and audit state sponsored entity that conducts regular testing and

If you want to give critical utilities incentives, then use the stick. Put together a pentest and audit state sponsored entity that conducts regular testing and assigns numeric scores with strict criteria. Have anything other than high results lead to a significant tax of the concern's revenue, and they will comply lickety split. Self-policing, incentives, and voluntary standards are optional and so won't ensure comprehensive compliance. Like medical devices and building codes, the security of electric grid infrastructure is too important to not regulate.