The U.S. government needs to clearly enunciate a policy that protects more critical systems from hackers, an expert said.