I'd submit we also need more cyber talent - staffing Congress (or elected to Congress).
And we need more cyber talent rotating in and out of NIST - the National Institutes of Standards and Technology.
The reason why are three-fold:
1.) It's easy for Congress to position themselves as outraged and concerned if/when something goes wrong (and things will go wrong - in the case of OPM it was valuable information being targeted by what appears to have been PRC for potentially intel-related purposes) - however Congress has both the authorization and appropriations function. Which means they can authorize (and thus request) agencies to do 100+ things and appropriate funds to do only 25 of them. Remember that the OPM breach happened around the time that government had experienced the "do more with less" rubric and so sure there are plenty of more things they could have done - the question that you never see an IG nor a Congressional heading ask, was whether the agency had been given enough money to do all those things by their Congressional committees?
2.) NIST usually puts out great audience on all the things that need to be done to secure systems. However they're usually again missing the realpolitik of 100+ priorities and only funds for 25+ of them. Auditing firms, who usually do the work of IGs (they contract out to them) love NIST checklists as they can take anywhere between 8-10 months to do, tying up the cybersecurity and other IT Team resources of an agency's team to answer all the questions and reviews. Then the findings are shared - and you can be sure there's always "more needed here" because the auditing firm wants to come back next year and the IG exists to find things wrong - and usually the agency's management team has 2-4 months to mitigate whatever was found before the process will continue again next year. When we're spending more time auditing vs. fixing the things the audit found, I don't think that's a recipe for "winning"?
3.) So how do we fix this?
* Rotate people from operational agencies to NIST to balance the "if you had perfect time, perfect budgets, and no other priorities" with the realpolitik of none of those things are true. Also tie this to a mechanism to link any IG findings of serious issues needing to be fix to an immediate presentation by the IG themselves to the Congress on why Congress should authorize and appropriate funds *now* to fix the issue asap. Yes, ask the IG to do this - not the poor management team who has to get dinged by the IG and then go to Congress and ask for funds to fix the issue - only to be told either not now or sure, however you still have to do these 25+ other things with the same budget we already gave you.
* Rotate cyber talent between Congress and the Executive Branch too. This way Congress can learn what it's really like in the Executive Branch + the Exec Branch can appreciate the priorities of Congress (to include Congress exists to get re-elected). Also fix the fact that while there's plenty of "Oversight" committees for bad things, the other part of Congress - namely Ways and Means - does not have a forum for when things go well. It's almost like Congress is perfectly designed to focus on all the bad things that go wrong in the Executive Branch but lack any mechanisms to celebrate and spotlight goodness in the Executive Branch. And so this creates the dysfunctions - and bad perceptions - we see today.
* Find ways to do cybersecurity reviews that aren't checklists. The checklists continue to grow - while NIST tries to do its best - things get more and more voluminous each year and we're now at 8-10 months for an audit which leaves precious little time for remediation and fixes. Require any annual audit done by an IG and third-party firm to not consume more than 1/3rd of the year to leave 2/3rd of the year for fixes before it's repeated again. Also deconflict the new executive order on Artificial Intelligence which (at 110+ pages) adds tons of new responsibilities and checklists to executive branch agencies - with **no** additional funding for this and **no** deconfliction of the existing FISMA, FITARA, and other annual IT audits government agencies have to do.
Hope this helps.