cybersecurity law for IT companies