But the statutes--PCII, HIPAA and CISA--are very, very clear in their encouragement of reporting of cybersecurity information during an incident.