Higher education institutions have until Aug. 2 to comment on rule changes that would rapidly require extensive new cybersecurity programs.