State regulators release model cybersecurity rule