The whole field is evolving, there is the EU Cyber Resiliency Act and some provisions for critical infrastructure.

There’s nothing as far as I know, even in industrial settings. Some companies are better than others, and some fields are better than others, but at the low level everyone does whatever the fuck they want. Always-connected teleservice routers and similar devices are everywhere, with outdated firmwares just waiting to be hacked. It’s improving but very slowly.

Erh we have the NIS2 directive… requirements are skyyyyyy high for critical infrastructure which is surprisingly a lot of industries. Among other things vulnerability management is a topic companies subject to NIS2 must cover. Not saying that it cannot happen to have outdated crap connected somewhere but the exposure is getting fast smaller and smaller.

Very limited scope

As in what?

As in for example this case isn’t covered

Food food supply chain isn’t covered? Isn’t it under « important entities »?

Distribution not retail

The problem as that these directives and standards are completely beside the point. They do manage a lot of security-relevant stuff, but in the end what’s hacked isn’t the documentation the standards require but the actual code running on the machine.

And there’s pretty little that the standard can do against actual honest bugs and mistakes in the code.

We do, but companies are given a billion years to implement that because The Economy ™️