Policy Management for Security solution

A

What are the ramifications of a private company failing to implement the guiding framework or update/maintain their system in accordance with the guiding framework?

B

Does the public have legal recourse if government systems fail to fill gaps in their framework implementation resulting in harm to a citizen? Explain.