An alternate, market-based solution would be insurance companies who impose requirements for insurance. That increases the chances of finding an economic balance between security and productivity. A government regulation applies to everyone, even if it no longer makes sense: an insurance company whose requirements are out-dated will be out-competed by others, while an insurance company whose requirements are insufficient will go out of business.

The market for cybersecurity insurance is collapsing:

https://www.theinformation.com/articles/companies-are-ditchi...

but the OP's arguments also apply to insurance, yet businesses buy insurance every day. The difference is the fines and liability for data breaches are so paltry it is the rational thing to do not to invest in security. This can only change through legislative action. I wouldn't hold my breath.

> An alternate, market-based solution would be insurance companies who impose requirements for insurance.

This is exactly why the CrowdStrike disaster happened: https://news.ycombinator.com/item?id=41011065

It's interesting that you mention this. It's part of the follow up article coming soon.

agree in spirit. better federal laws to hold companies accountable

Can we not also have really extreme punishments for government officials that break the law?

Checks & balances do not work in the absence of empowered incorruptible entities because of collusion. At best, they just slow things down.