The state is a purchaser and regulator - different. Don't join these two issues. Security standards are negative standards. States and industry are looking to each other to provide requirements first. The federal government is doing a CPS now.
Systems is needed that avoids consumer legal problems.
Risk of insurance required security standards in absence of some movement by industry. Insurance company desires someone to evaluate reasonable web security. A next meeting should be industry only. Helps to have at least some government presence at next meeting. Focus on where the crisis exists when trying to solve problems.