The order follows a similar decree by the Securities and Exchange Commission for publicly traded firms to disclose incidents they deem “material.”