The Department of Defense will soon require contractors to report major cybersecurity breaches. We are as surprised as you are that they didn't.