The SEC is giving companies four days to report cyberattacks