I'm curious how policy will shape anything outside of that standard, however. Because for a company, that philosophy (full mitigation is not the goal, risk acceptance is) is sufficient. But for civil function, it stops a little short. It's unacceptable at the policy level if major banks go offline for 48 hours - or if traffic lights stop working on major roads - or if the hospitals go offline.
I don't have a solution, either - I'm just pointing out that when Cybersecurity is talked about, it really isn't understood from this perspective. Really, all we can do is mitigate risk, BUT, there will be a time where all these vectors will be utilized (hopefully not) and when/if that happens, people will debate how we got there. It's a near-impossible thing to avoid.