A new study shows public companies are making strides in bolstering their cybersecurity programs ahead of new federal rules effective in December, including one giving them just four days to report a cyber incident.