All publicly traded companies in the U.S., including foreign private issuers, are affected by new SEC cybersecurity rules.