President Biden signed a directive aimed at improving cybersecurity for critical infrastructure systems like energy and food — but it's up to private companies to actually follow those standards.