CISA is the one who mandates these controls and who manages the public/private relationship. Who issues the active exploration warnings. Who suggests legislation to prevent this in the future, including mandatory software updates.

If your question was only a trite recitation of the fact that private enterprise consistently refuses to practice cybersecurity then you've added nothing.

If your question was about who watches the watchers and what we're doing about the fact that private enterprise refuses to practice cybersecurity then it was an incredibly relevant statement.