The proposed rule would codify regulations adopted after the Colonial Pipeline ransomware attack in May 2021, which prompted agencies to increase their focus on cybersecurity.