Revision of IT security rules could cost feds $600M over four years