Or, alternatively, the NSA could be tasked with constantly pen testing US companies' computer security. If they find a problem then they would mandate fixes and assess a hefty fine. The fine would be used to cover the NSA's costs and to pay a bounty to the individual who discovered the weakness.