A cyber breach is bad enough. Increasingly, companies are finding that those breaches are getting them entangled in compliance trouble with the Securities and Exchange Commission.

And satisfying the commission is getting increasingly tricky, as it amasses new powers and raises the bar on what companies must do to mitigate risks and reveal to the public when things go wrong.