A new study shows public companies are making strides in bolstering their cybersecurity programs ahead of new federal rules effective in December, including one giving them just four days to report a cyber incident.

But Deloitte’s survey of more than 1,300 executives also suggests that legal departments may still have to crack the whip on management to update policies and practices, particularly those involving communications with third-party service providers.