Congress passes 72-hour cyberattack reporting requirement