Cyber hygiene is one of those terms that sounds good but doesn’t work. Because we all have different ideas of what hygiene is. Some people wash daily, other people wash their towels and sheets once a year. There is no “standard” and so how do people keep tech “clean”? They don’t.
Their conclusion about what this all means is better cyber hygiene. I would suggest policymakers might also wish to come back to questions of agent liability and who is responsible when things go wrong