Part 2C—Enhanced cyber security obligations