The agency released performance-based requirements after extensive industry debate following the May 2021 Colonial Pipeline ransomware attack.