A new cybersecurity law would mandate important new security requirements, but could place burdens on small businesses, the ADA says.