A money-grab hack prompted executive orders to get cybersecurity under control at firms supplying the government. Private companies will have to comply even if they aren’t the primary contractor.