Voluntary cybersecurity disclosure reduces penalties but not liability. In compliance, honesty helps—but it’s no safe harbor.