The U.S. Securities and Exchange Commission on Wednesday finally adopted stringent new cybersecurity disclosure rules for public companies, 16 months after the agency proposed them.