Nobody likes admitting they have been hacked. It can scare away customers and investors, invite lawsuits, and lead to regulatory scrutiny. For years, a patchwork of federal and state rules governed when and how organizations disclose cyber breaches. Layered atop those rules, for government contractors and program participants, have been the specific and evolving standards in contracts and rules for reporting cyber incidents and implementing safeguards. But law enforcement has lamented the low levels of reporting and asked the business community to come forward and report breaches, so that law enforcement can better understand and assess cyber threats.