New cybersecurity law imposes security and reporting obligations to Operators of Essential Services and Digital Service Providers