Part of the decision feels like the FCC is looking for whatever leverage they have over telcos and just using that as a vehicle. I'd also like to think that telco companies already due risk assessments (maybe not frequently updated or rigorous as people would like), so how much of an impact would this really be?
(I know...when you "assume" you make an ass of 'u' and me and it also depends on what both sides think "minimum" means).