Companies that run essential infrastructure shouldn't get to handle their own cyber security without government overwatch. They will never invest in the amount necessary to defend against attacks without a forced incentive (shareholders don't give a fuck after all).