The move follows a government assessment that found glaring gaps in cybersecurity certification, exposing imported products and critical infrastructure to risks of malware and tampered components.