The checklist problem behind critical infrastructure cyber safety