If he had to ask the largest U.S. companies about their security posture, he clearly did not have any factual basis for trying to push cybersecurity practices upon them.
Wisconsin officials plan to ask the U.S. Department of Education if they can substitute a state-developed accountability policy in place of the law, and Tennessee is considering a similar move.
If it's a headache policing that in the real world--just ask U.S. Trade Representative Charlene Barshefsky--imagine what it would be like in cyberspace, dealing with a rogue site that might be hosted in Iran one day and the Cayman Islands the next.