A new study shows public companies are making strides in bolstering their cybersecurity programs ahead of new federal rules effective in December. But the recent Deloitte survey of more than 1,300 executives also suggests many companies have a long way to go in updating policies and practices, particularly those involving communication with third-party service providers.

Once a company determines that a cyber breach is material, it will have just four business days to report the incident in an 8-K filed with the Securities and Exchange Commission (SEC). Many survey respondents are concerned about their ability to comply with this expedited reporting timeline when a third party is involved.