There is more to it than just reporting, "essential cybersecurity requirements" presumably would include fixing issues, hardening to reduce impact of issues etc.