"But, especially in critical industries, balloons the cost of their systems due to #2, because they must now cover a risk they can't even model (unknown unknown)."

This is where "best current practices" and "standards of care" egg get the picture.