Everything is going to be a cost-benefit analysis. First of all, there's no such thing as absolute, perfect security. To achieve even close to perfect security will impact not only the financial aspect but also the utility of a service, so you have to really take a balanced approach.
Canada Health Infoway is an example I would urge the government to look to in terms of the way it established a process for vendors to present a solution for health care services. There is oversight and there is governance around the vendors who become certified through that process. That, then, would be a model the government could look to as a potential way of framing how you certify a vendor or a service provider to engage with government services.
Having minimum standards would be absolutely critical, in addition to having an assessment process to assess the various vendors wanting to become part of that ecosystem and then having ongoing monitoring. To speak to your example about airplanes, it is really about having oversight. It doesn't just happen once. It's no longer just about a project; it's now about a product and about a process and having a governance framework around it. Having it be ongoing is really critical.