24 Hour Cyber Incident Notification Requirement Is Too Short