There are levels of "criticality". Credit monitoring is in a different category from, say, spacecraft or nuclear power plants. But if a security breach can lead easily to identity theft, and therefore to a catastrophic compromise of one's financial stability, that should require some higher level of mandatory certification.

I don't know what definition of "critical" we're going with, but the fact that they have the SSN of basically every American makes them an important weak point.

Tell that to people who are denied loans thanks to credit reporting agencies.