They require public companies to disclose material cybersecurity incidents within four days, and they also require them to disclose on an annual basis information about their cybersecurity risk management strategies and governance.