The SEC’s disclosure guidelines are still new enough that we are witnessing a feeling-out period among companies unfortunate enough to be hit by a data breach.