USA has a good number of security frameworks. Collaborating with a more advanced education institute (for guidance) and setting a programme/project would be possible if they wanted (or now to prevent the shitshow from happening again).

Any uni that has undergone similar project will have the project charter, resources, skills, timelines, lessons learned (the whole project folder).

Where there is a will there is a way. And I believe thay many organisations DO know that they operate on low/bad security, they just prefer to roll the dice and use the budget for something else..