Do CISOs Have to Report Security Flaws to the SEC?

The new SEC rules make it seem that there is no need to report the presence of security vulnerabilities, but that doesn't quite tell the full story.