Organizations with weak cybersecurity policies will be penalized