If your company suffers a cyberattack, can it keep that information hush-hush?