If the federal government wants things to change, they should form an independent red team, running exercises against private companies, and then help companies address issues (the US government leaning on a vendor gets a lot more action than Topeka Electric Coop). With fines to increase the cost of inaction.

The general consensus of reports thus far has been stupid, 101-level mistakes.

And guidelines and recommendations aren't going to help with people who don't read them.

E.g. Staff up NCATS [1], empower them with more binding regulation, and turn them loose to conduct non-requested tests of critical infrastructure

[1] https://www.us-cert.gov/resources/ncats