Warning, lots of text. Very complicated issue. tl;dr is: we as a nation are not doing much and have not been doing much. The current mentality is "it's up to businesses to fix it before the GOVT has to get involved." Companies don't want to pay, and don't know what to do, and don't see a "market motivator" (yeah, literally hear that all the time. I'm not kidding). Europe is doing much better with the push towards 62443 requirements for all ICS.
I'm primary on ICS/Critical Infrastructure for a company that is involved in the certification of security for devices associated with this. And I have bad news. there is not much requiring most infrastructure to secure itself. Nerc-CIP is related to power grid, but not everything has security requirements. Nuclear has some, through both NEC and IAEA and their overlap with Power Grid. Otherwise... not much.
Every year there are speeches at security conferences about how "squirrels" have done more damage to our infrastructure than hackers. That said, remember there is no honest disclosure rules for infrastructure. We don't really know how much is squirrels and how much is not.
I can tell you this though, as a first hand ICS pen tester who has worked with a slew of products in this space... at least 1/3 of -new- products come in the door critically vulnerable (in my experience. and I'm being generous), and only a very small percent in total have clearly been built with a full "defense in depth" security plan. Good news is when we are done with them they are way more secure and the companies we have worked with are developing better practices (if needed).
Also good news, there are good practices to secure insecure devices inside a network, even if the devices are not secure, but there are not a lot of constant audits and checks for this. In fact, my experience is the HIPPA, PCI, and SOX all have much firmer rules and accountability than securing Crit. Infrastructure. I'm also including 911 response systems in this, which have been shown to be vulnerable also.
There are a myriad of examples from the past 10 years, which really ramped up in the past 4, of nation state style attacks on Crit. Infrastrucutre. The Ukrainian power grid has been attacked multiple times using multiple tools, the thinking being it's a training ground for Russian hackers. The US gov't attacked nuclear facilities in Nitanez using custom malware in a very famous exploit back in 2010-ish. Lots more. Too much for this response.
As far as what's being done... not much. Companies can't afford millions of dollars of renovation, there are no universally agreed upon standards for modern secure ICS protocols (yes, most ICS network protocols are plain text with no verification of devices), ICS teams can't find security professionals who understand ICS because there are -very- few. There is a slew of other issues...
And it gets worse... I literally sat at lunch with the former head of DHS. It was me, him, 2 other people. He was deeply concerned as our current administration is leaving massive staffing holes and seems to be completely uninvested in any sort of push to fix this issue and secure the nation. Yes, it's true they have lots of DC conferences to talk about it... but no one is putting up the money or creating legislation.
The good news is that in general we know how to secure our systems and what are the major weakenesses at every level of the technology stack (from CWE's to Network zoning). ICS-CERT (a branch of US-CERT, the american emergency response team for cyber) has a great articles on it. Along with NIST, IEC 62443, and a smattering of others. Good place to start for anyone in ICS who is now concerned. Google search this are there are multiple, find the one best suits your needs:
[google] filetype:pdf ics-cert best practices