“The SEC is in an interesting situation here because, on the one hand, they obviously are dealing with their own security issues. On the other hand, they are responsible to enforce disclosure of incidents to the market to investors,” said Jake Olcott, a former legal adviser to the Senate Commerce Committee who now works for security ratings firm BitSight.