The cybersecurity requirement under the Biden administration was a response to the Chinese hacking campaigns. The declaration was not prescriptive and amounted to "do something!" Which is fine because that's how these things get started.
The evolution of NERC CIP over the last twenty years is a good example of how this things are supposed to work. CIP started off as a "do something" declaration and initially rolled out a "best effort" requirement similar to the FCC one. Overtime a framework and standards were established based on NIST until eventually a mature security framework was established.
From what I understand, CSRIC was following the NERC process by utilizing NIST to build industry specific guidelines and standards. USTelcom has also been pushing the FCC to adopt NIST standards but for some weird reason the whole thing is being thrown in the trash.
I've seen NERC CIP evolve from a vague guideline to a very prescriptive and mature framework and I do find the maturation process pretty impressive. There are regular iterations of more prescriptive controls and guidelines to adapt to non-standard situations but this took a couple of decades to accomplish. Really, things didn't pick up speed until the last 12 years. It took a long time to lay the ground work.
You don't scrap an effort like this without an alternative plan. These things really do take years to be developed, by ending the cybersecurity declaration Carr is putting the U.S. behind schedule when it's already way behind schedule.