Operators of critical infrastructure will have 12 hours instead of two to alert new commissioner’s office under proposed law, Security Bureau says.