The SEC has proposed amendments to its cybersecurity rules for private companies. If enacted, some boards may require cultural and structural changes to address governance gaps.