It’s probably cleaner and easier to run this if the spooks set up a bureau of cyber security standards and fine strategically important companies for non-compliance. The gov can do security audits on these corps.