The agency has signalled that it’s taking a harder line on cyber risk. Here’s how to be sure you’re compliant.