NRF: Don't broaden cybersecurity legislation