> "And the government has a responsibility to prevent attacks by foreign actors on critical infrastructure."

I replied explicitly to "crime", not "foreign actors", let's not conflate those just for a straw-man argument.

Preventing attacks by foreign actors is part of National intelligence and military, this is an entirely different matter. Both are entities facing outwards of a country, not inwards.

But more importantly, their job is not to fulfill the required security duties of a critical infrastructure company to prevent physical/digital attacks against the operation and resilience of its infrastructure.

And even IF they protect such a company in case of an imminent external threat, this is not a replacement for the legally required security compliance.

The critical infrastructure act (US) and directive (EU) mandate strategic measures to take explicitly against terrorist attacks, even natural disasters.

The government won't come to your company and do this job FOR you, they will lock you up and, in the EU, charge you up to xx% of your global annual revenue if they find out you're not doing it.