Even though the new incident reporting rules create pressure, they serve as a forcing function for building a strong security foundation.
