New requirement calls on firms to report hacks within four days of deciding that the attacks are of material interest to shareholders.