a radical thought: how about hiring some engineers to contribute to oss that's being used in critical infrastructure?

I believe that most of the assessment stuff is covered by many NIST recommendations anyways.