Public companies that fail to tighten their cybersecurity controls could be violating federal law says SEC.