SEC exempts certain companies from ICFR attestation requirement