Should Operational Technology (OT) cybersecurity controls (like NIST) be required by law, or remain as recommendations to businesses?

I went with business recommendations purely because any regulation would need to take into account company size. Smaller companies just don't have the resourcing to implement comprehensive, documented security.

The landscape is a living place that is constantly changing and i believe there should be a body that develops cybersecurity standards that provides and supports all industries as a foundational framework. From that point it's a business decision to follow those standards to protect their interests. 

Operational technology is a very broad space. I think we need to reclassify devices and "things" so that those that may impact human health and safety fall under regulated cybersecurity mandate and those that have little impact are suggested but not mandated.

I have a view that the requirement by law should be descriptive, not prescriptive.

The extent should be a mandate that each business has someone accountable for Cyber Security, much like jurisdictions have for privacy officers