The three big questions Equifax hasn’t answered

As pressure builds on Equifax to explain how criminals hacked into a massive trove of data on 143 million Americans, the list of unanswered questions is long. But most boil down to three big ones:
#1: What measures did Equifax take to protect our personal information?
#2: What measures should Equifax have taken to protect our personal information?
#3: What’s the gap between the answers to questions #1 and #2?