Large public companies felt largely prepared to comply with the disclosure requirements of the Securities and Exchange Commission’s (SEC) new cybersecurity incident rule in the weeks before it took effect in December, though many felt only somewhat prepared.



