subsequent calendar quarters, including the dates or expected dates of
commencement and completion.\1008\
---------------------------------------------------------------------------

    \1006\ See Proposing Release, supra note 13, at 18122, 18144. As
noted above, one commenter argued that the Commission has not
presented any empirical evidence that major or material technology
changes by SCI entities are in fact the leading cause of market
disruption, and that non-material systems changes have a high
likelihood of causing market disruptions. See supra note 1001 and
accompanying text. The Commission notes that the primary purpose of
Rule 1003(a) is not to prevent market disruptions. Rather, it is to
keep the Commission and its staff informed of the systems changes
that SCI entities determine to be material, which will assist the
Commission with its oversight of U.S. securities market
infrastructure. While the Commission acknowledges that non-material
systems changes could cause market disruptions, the Commission
agrees with this commenter that requiring Commission notification of
all systems changes would be burdensome. See supra note 1002 and
accompanying text (noting this commenter's view that providing 30-
day advance notification of non-material systems changes would
hamstring SCI entities).
    \1007\ As discussed in more detail below, the Commission is also
not adopting the proposed definition of material systems change or
the proposed semi-annual reporting requirement.
    \1008\ Using the quarter ending December 31, 2014 as an example,
an SCI entity would be required to submit a report by January 30,
2015 (i.e., within 30 calendar days after December 31, 2014) that
describes material systems changes that the SCI entity has made
(including the dates when those changes commenced and were
completed), are currently implementing (including the dates when
those changes commenced and are expected to be completed), and plan
to make (including the dates those changes are expected to commence
and complete) for the period from October 1, 2014 (the beginning of
the prior calendar quarter) through June 30, 2015 (the end of the
subsequent calendar quarter). The next report that corresponds to
the quarter ending March 31, 2015 would be required to be submitted
by April 30, 2015. As discussed in more detail below, Rule
1003(a)(2) requires an SCI entity to promptly submit a supplemental
report notifying the Commission of a material error in or material
omission from a report previously submitted under Rule 1003(a)(1).
---------------------------------------------------------------------------

    The Commission believes that elimination of the 30-day advance
notification requirement for material systems changes is responsive to
commenters who were concerned that the proposed approach was unsuited
to the agile systems development methodology that some SCI entities use
today. In particular, an SCI entity will have the ability to implement
material systems changes without having to individually report each
material systems change to the Commission 30 days in advance, which
commenters noted could lead SCI entities to favor the waterfall
methodology of systems changes over the agile methodology.\1009\ The
Commission also believes that the adopted quarterly reporting
requirement provides more flexibility to SCI entities with respect to
the timing of implementing material systems changes. In particular, SCI
entities will not be required to wait 30 calendar days after notifying
the Commission in order to implement a material systems change.
Therefore, the adopted rule is responsive to commenters who stated that
the proposed rule would stifle innovation, interfere with an entity's
planning and development process, and expose SCI entities' systems to
risk. Moreover, the Commission believes that elimination of the
proposed 30-day advance notification requirement is responsive to
commenters' concern that ATSs are already required to report material
changes to the operation of the ATSs at least 20 calendar days prior to
implementation, and that proposed Regulation SCI would extend the
advance notification period to 30 calendar days.\1010\
---------------------------------------------------------------------------

    \1009\ At the same time, because systems changes utilizing the
waterfall methodology are often planned well in advance, these
systems changes would generally be included in the quarterly report,
as Rule 1003(a) requires the quarterly report to describe, among
other things, planned material systems changes during the subsequent
calendar quarter. However, this requirement of Rule 1003(a) is not
limited to planned material systems changes utilizing the waterfall
methodology, but also would apply to planned material systems
changes utilizing other development methodologies, including the
agile methodology.
    \1010\ The Commission notes that the adoption of Rule 1003(a)
does not affect an SCI ATS's existing obligation under Rule
301(b)(2)(ii) of Regulation ATS to file amendments on Form ATS at
least 20 calendar days prior to implementing material change to the
operation of the ATS. Therefore, with respect to a material systems
change, an SCI ATS may be required to describe such change in a
quarterly report under Rule 1003(a) and submit an amendment to Form
ATS.
---------------------------------------------------------------------------

    The Commission also believes that adopting the quarterly reporting
requirement instead of the 30-day advance notification requirement
lessens SCI entities' burden of compliance as compared to the
proposal.\1011\ For example, rather than submitting a Form SCI for each
material systems change, an SCI entity is now required to submit four
reports each year pursuant to Rule 1003(a)(1) and, as applicable,
supplemental reports pursuant to Rule 1003(a)(2). To the extent certain
material systems changes are related or similar, an SCI entity will not
be required to separately notify the Commission of each change.
Instead, the SCI entity can describe such related changes within the
single quarterly report. The Commission also believes that this
quarterly report process will provide the Commission and its staff with
a more efficient framework to review material systems changes that are
described in the larger context afforded by such periodic reports,
rather than parsing every submission that reports a material systems
change.\1012\
---------------------------------------------------------------------------

    \1011\ See supra notes 996-997 and accompanying text.
    \1012\ The Commission acknowledges that some systems changes
deployed by an SCI entity may not by themselves be considered
material by the SCI entity, but that, in the aggregate, can be
considered material by the SCI entity (e.g., making a series of
small systems changes over time in order to implement a broad
systems change). The Commission believes that the adopted quarterly
reporting requirement is better suited to capture such changes than
the proposed 30-day advance notification requirement (i.e., 30-day
advance notification for each single systems change that is by
itself considered material by the SCI entity).
---------------------------------------------------------------------------

    One commenter expressed concern that the proposed exception for
exigent circumstances was too narrow.\1013\ Because adopted Rule
1003(a)(1) requires quarterly reports of material systems changes
rather than 30-day advance notification of each material systems
change, the Commission is not adopting the proposed ``exigent
circumstances'' exception. Specifically, the Commission notes that the
purpose of the exception was to accommodate situations where it would
not be prudent or desirable for an SCI entity to delay a systems change
simply to provide 30-day advance notification of the change. At the
same time, the Commission notes that, because Rule 1003(a)(1) requires
in part a description of completed, ongoing, and planned material
systems changes during the prior and current calendar quarters, an SCI
entity's quarterly report will be required to include a description of
all material changes to its SCI systems or the security of its indirect
SCI systems, including those that have been implemented in response to
exigent circumstances during the prior and current calendar quarters.
---------------------------------------------------------------------------

    \1013\ See BATS Letter at 15.
---------------------------------------------------------------------------

    Several commenters suggested possible alternatives to the proposed
requirements related to material systems changes. Some commenters
suggested eliminating the proposed advance notification requirement for
material systems changes.\1014\ One of these commenters explained that
information regarding material systems changes would be available to
the Commission during an inspection, but stated that, if an advance
notification requirement is adopted, it should be folded into the
proposed semi-annual reporting requirement.\1015\ Another commenter
similarly urged that the Commission require only semi-annual reporting
of material systems changes, as proposed in Rule 1000(b)(8).\1016\ One
commenter supported the reporting of material systems changes in the
annual SCI review report.\1017\ One commenter believed that information
related to systems changes should be reported periodically.\1018\
Another commenter noted that if the Commission retains the 30-day
advance notification requirement, it should be limited to material
systems changes of only higher priority SCI systems and that

notifications of changes to lower criticality systems could be provided
at the time of the change or periodically.\1019\
---------------------------------------------------------------------------

    \1014\ See MFA Letter at 7 and ITG Letter at 13-14. See also
Joint SROs Letter at 8 (stating that material systems changes should
be reported in a periodic, post-hoc basis, as was required under
ARP).
    \1015\ See MFA Letter at 7.
    \1016\ See Direct Edge Letter at 8.
    \1017\ See CME Letter at 11.
    \1018\ See NYSE Letter at 27.
    \1019\ See SIFMA Letter at 15.
---------------------------------------------------------------------------

    Some commenters suggested that the Commission provide more
flexibility and allow SCI entities more time to report material systems
changes.\1020\ One commenter supported giving SCI entities discretion
to determine the appropriate timing and format for reporting changes to
the Commission, and stated that the current practice under ARP to
submit quarterly reports that cover changes for the previous and
upcoming quarters has proven effective in keeping the Commission staff
apprised of planned and completed systems changes.\1021\
---------------------------------------------------------------------------

    \1020\ See NYSE Letter at 27; FINRA Letter at 27; and MSRB
Letter at 22. See also CME Letter at 11 (stating ``instead of
setting firm time limits under which an entity is required to submit
notifications of material systems changes under Rule 1000(b)(6), the
Commission should instead simply require `timely advance notice of
all material planned changes to SCI systems that may impact the
reliability, security, or adequate scalable capacity of such
systems''').
    \1021\ See FINRA Letter at 27.
---------------------------------------------------------------------------

    One commenter suggested that SCI entities be required to keep
records of all systems changes and technical issues, and make that
information available to the Commission upon request.\1022\ If the
Commission decides to retain the notification requirement, this
commenter recommended that it be satisfied through periodic (ideally,
quarterly) reporting of material systems changes.\1023\ One commenter
believed the Commission should allow all 30-day advance notifications
regarding pending material systems changes to be communicated orally,
and only submitted in writing after development and testing is
completed and the feature is finalized.\1024\
---------------------------------------------------------------------------

    \1022\ See OTC Markets Letter at 20.
    \1023\ See id. This commenter also noted that this would allow
for the elimination of proposed Rule 1000(b)(6)(ii), which required
notices for material inaccuracies in prior notifications. See OTC
Markets Letter at 20-22. According to this commenter, quarterly
updates would disclose material deviations from plans described in a
previous report, whether stemming from inaccuracies in prior reports
or new information that prompts beneficial deviations from a systems
implementation plan. See id.
    \1024\ See Omgeo Letter at 22.
---------------------------------------------------------------------------

    The Commission believes that the adopted quarterly reporting
requirement is responsive to commenters who requested additional
flexibility or time for material systems change notifications, as well
as to commenters who suggested that such notices be submitted on a
periodic or quarterly basis.\1025\ The Commission does not agree with
the commenters who suggested that the Commission completely eliminate
the advance notification requirements. The Commission believes that
advance notifications of planned material systems changes will help
ensure that the Commission has up-to-date information regarding
important future systems changes at an SCI entity, to aid in its
understanding of the operations and functionality of the systems post-
change.\1026\ As adopted, Rule 1003(a)(1) requires an SCI entity to
provide the Commission with advance notification of planned material
systems changes in the current and subsequent quarters through the
quarterly reports. As noted above, after considering the views of
commenters, the Commission is not adopting the proposed 30-day advance
notification requirement for each material systems change.
---------------------------------------------------------------------------

    \1025\ Because the Commission is only adopting a quarterly
reporting requirement for material systems changes, the adopted
approach is responsive to a commenter's suggestion that
notifications of changes to lower criticality systems could be
provided at the time of the change or periodically. See supra note
1019 and accompanying text.
    \1026\ The Commission acknowledges that there may occasionally
be unexpected material systems changes that are not reported to the
Commission in advance, but expects that material systems changes
generally will be planned well in advance and reported in the
quarterly report accordingly.
---------------------------------------------------------------------------

    The Commission is also not adopting commenters' suggestion that
material systems changes be reported semi-annually or annually.\1027\
As noted in the SCI Proposal, proposed Rule 1000(b)(8)(ii) required
semi-annual reports because the proposal would have separately required
information relating to each planned material systems change to be
submitted at least 30 calendar days before its implementation.\1028\
Thus, in the SCI Proposal, the Commission stated its preliminary view
that requiring ongoing summary reports more frequently would not be
necessary.\1029\ At the same time, the Commission expressed the concern
that a longer period of time would permit significant updates and
milestones relating to systems changes to occur without notice to the
Commission.\1030\ Because the Commission is not adopting the 30-day
advance notification requirement, the Commission believes that it is
appropriate to require more frequent reports of material systems
changes than on a semi-annual basis. Further, as noted above, some
commenters suggested quarterly reports, which is consistent with the
practice of some entities under the ARP Inspection Program.\1031\
---------------------------------------------------------------------------

    \1027\ See supra notes 1015-1017 and accompanying text.
    \1028\ See Proposing Release, supra note 13, at 18124.
    \1029\ See id.
    \1030\ See id.
    \1031\ See supra notes 1021, 1023 and accompanying text.
---------------------------------------------------------------------------

    The Commission does not agree with the commenter who suggested that
Regulation SCI should only require SCI entities to keep records of all
systems changes and make that information available to the Commission
upon request.\1032\ Similarly, the Commission does not agree with
commenters who suggested that SCI entities be given discretion to
determine the timing of the reports.\1033\ The Commission believes that
quarterly reporting of material systems changes will help ensure that
the Commission has, on an ongoing basis, a comprehensive view and up-
to-date information regarding material systems changes at an SCI
entity.
---------------------------------------------------------------------------

    \1032\ See supra note 1022 and accompanying text. As discussed
above, this commenter also stated that, if the Commission decides to
retain the notification requirement for material systems changes,
the Commission should require periodic (ideally, quarterly)
reporting. See supra note 1023 and accompanying text. Adopted Rule
1003(a)(1) is consistent with this commenter's alternative
suggestion.
    \1033\ See supra note 1021 and accompanying text. See also supra
note 1020.
---------------------------------------------------------------------------

    With respect to the commenter who suggested that all 30-day advance
material systems change notifications should be provided orally, and
submitted in writing only after the changes are fully tested and
implemented,\1034\ the Commission notes that it is not adopting the
proposed 30-day advance notification requirement for material systems
changes.
---------------------------------------------------------------------------

    \1034\ See supra note 1024 and accompanying text.
---------------------------------------------------------------------------

    With respect to the commenter who suggested giving SCI entities
discretion to determine the format for reporting changes to the
Commission,\1035\ the Commission notes that Rule 1003(a) does not
prescribe a specific style that the quarterly reports should take. The
Commission intends for the quarterly report to allow the Commission and
its staff to gain a sufficient level of understanding of the material
systems changes that have been implemented, are on-going, and are
planned for the future, which would aid the Commission and its staff in
understanding the operations and functionality of the systems of an SCI
entity and any changes to such systems. In particular, the Commission
notes that Rule 1003(a)(1) only specifically requires the quarterly
reports to ``describe'' the material systems changes and the dates or
expected dates of their commencement and completion. Therefore, Rule
1003(a)(1) gives each

SCI entity reasonable flexibility in determining precisely how to
describe its material systems changes in the report in a manner that
best suits the needs of that SCI entity as well as the needs of the
Commission and its staff.\1036\ In addition, to the extent the
Commission seeks additional information about a given change noted in a
quarterly report, an SCI entity would be required to provide Commission
staff with such information in accordance with Rule 1005 (Recordkeeping
Requirements Related to Compliance with Regulation SCI).\1037\
---------------------------------------------------------------------------

    \1035\ See supra note 1021 and accompanying text.
    \1036\ See also Omgeo Letter at 43 (requesting that the
Commission specify in the final rule the required content for a
planned material systems change notification).
    \1037\ See infra Section IV.C.
---------------------------------------------------------------------------

    The Commission also notes that the quarterly reports are required
to include descriptions of material systems changes during the prior
calendar quarter that were completed, ongoing, or planned. Therefore,
if a report for the first quarter of a given year discusses the SCI
entity's plan to implement a particular series of material changes to
an SCI system, Rule 1003(a)(1) requires that, in the report for the
second quarter of that year, the SCI entity describe the material
systems changes that were completed, ongoing, and planned in the first
quarter, including the planned changes discussed in the prior quarter's
report, as applicable.
    Several commenters expressed concern that the proposed 30-day
advance notification requirement would potentially give the Commission
new authority to ``reject'' a Form SCI filing describing material
systems changes, similar to the way the Commission may reject an
improperly filed proposed rule change pursuant to Rule 19b-4 under the
Exchange Act.\1038\ Three commenters requested that the Commission
clarify how proposed Rule 1000(b)(6) would relate to Rule 19b-4,
suggesting that there may be unnecessary redundancy between the two
processes.\1039\ Another commenter suggested limiting the types of
changes that would require 30-day advance notification to those changes
that are already required to be filed with the Commission as proposed
rule changes for immediate effectiveness under Section 19(b)(3)(A) of
the Exchange Act (excluding those filings that would not become
operative for 30 days after the date of the filing because those
filings would already provide the Commission with 30 days' advance
notification of the material systems changes).\1040\ This commenter
also noted that where a material systems change would be filed for
approval under Section 19(b)(2) of the Exchange Act, the Section
19(b)(2) approval process provides the Commission sufficient
notification of the systems change.\1041\ One commenter stated that
proposed Rule 1000(b)(6) was improperly premised on the notion that the
Commission should be responsible for a minutely-detailed understanding
of the IT infrastructure of SCI entities and for assessing prospective
changes in advance of their implementation.\1042\
---------------------------------------------------------------------------

    \1038\ See Omgeo Letter at 23; and SIFMA Letter at 16. See
Section 19(b) of the Exchange Act, 15 U.S.C. 78s(b).
    \1039\ See KCG Letter at 19; Joint SROs Letter at 8; and FIF
Letter at 5.
    \1040\ See MSRB Letter at 22.
    \1041\ See MSRB Letter at 22. This commenter also suggested that
material systems changes (other than those filed pursuant to Rule
19b-4 under the Exchange Act) be reported semi-annually, or that de
minimis changes be excepted from the notice requirement altogether
if the Commission continues to require 30-day advance notification.
See MSRB Letter at 22-23. As discussed above, the Commission is
adopting a quarterly reporting requirement for systems changes that
an SCI entity determines to be material.
    \1042\ See Direct Edge Letter at 1, 8. See also ITG Letter at
13-14 (stating that the Exchange Act does not enable the Commission
to ``bootstrap its SRO rule review authority or its national market
system authority to force regulated entities to submit upcoming
material systems changes for agency approval'' and that ``the
Commission need only receive notifications when they are a
significant part of proposed rule changes by SROs or amendments to
Form ATS of material changes to the operation of the ATS'').
---------------------------------------------------------------------------

    The Commission disagrees with commenters who believed that material
systems change reports are redundant given the rule filing requirements
of Rule 19b-4 under the Exchange Act, or that material systems change
reports should not be required if the SCI entity submitted certain
types of rule filings regarding the same change.\1043\ The Commission
acknowledges that some systems changes require proposed rule changes
under Rule 19b-4, and some Rule 19b-4 proposed rule changes result in
systems changes. However, based on Commission staff's experience with
the ARP Inspection Program and the rule filing process, the Commission
believes that the type of information regarding systems changes
included in rule filings is different from the type of information that
will be included in reports on material systems changes. In particular,
the technical details or specifications of SCI systems and indirect SCI
systems are generally not specifically set forth in the rules of an SCI
SRO. Therefore, technical information regarding systems changes is
usually not set forth in rule filings. In addition, the Commission
notes that the rule filing process and the material systems change
reports serve different purposes. In particular, the material systems
change reports are intended to inform the Commission and its staff of
important technical changes to an SCI entity's systems. On the other
hand, the rule filing process provides notice of changes to an SCI
entity's rules, including, for example, the statutory basis for such
changes, and in some cases seeks approval by the Commission of the rule
changes. Therefore, if an SCI SRO submits a rule filing regarding a
particular systems change and the change is also included in a material
systems change report, the information included in the rule filing may
not necessarily further the goal of the material systems change
reporting requirement, and the information included in the material
systems change report may not necessarily assist in the Commission's
review of the rule filing. Moreover, commenters' concern regarding the
redundancy between the rule filing process and the material systems
change reports stemmed from concerns regarding the 30-day advance
notification requirement. As discussed above, the Commission is not
adopting a 30-day advance notification requirement.
---------------------------------------------------------------------------

    \1043\ See supra notes 1039-1041 and accompanying text. The
Commission notes that the requirement under Regulation SCI to submit
reports of material systems changes does not alter an SRO's
obligation to file proposed rule changes, the obligation of
participants of an SCI Plan to file a proposed amendment to such SCI
Plan, or any other obligation any SCI entity may have under the
Exchange Act or rules thereunder.
---------------------------------------------------------------------------

    The Commission also reiterates that the material systems change
reports are intended to inform the Commission and its staff of such
changes and help the Commission in its oversight of U.S. securities
market infrastructure. Regulation SCI does not provide for a new
approval process for SCI entities' material systems changes. As such,
Commission staff will not use material systems change reports to
require any approval of prospective systems changes in advance of their
implementation pursuant to any provision of Regulation SCI,\1044\ or to
delay implementation of material systems changes pursuant to any
provision of Regulation SCI.\1045\
---------------------------------------------------------------------------

    \1044\ See supra note 1042 and accompanying text.
    \1045\ See supra note 1038 and accompanying text.
---------------------------------------------------------------------------

    Three commenters questioned the Commission's legal authority to
adopt the proposed material systems change notification requirements,
including, in particular, those set forth in proposed Rule
1000(b)(6).\1046\ For the reasons

discussed above in Section IV.B.3.c, the Commission disagrees with
these comments and believes that adopted Rule 1003(a) will assist the
Commission in its oversight of U.S. securities market infrastructure
consistent with its legal authority under the Exchange Act.
---------------------------------------------------------------------------

    \1046\ See NYSE Letter at 4 (stating the belief that
``[a]uthority to facilitate a national market or assure economically
efficient execution of securities transaction is remote from close,
minute regulation of computer systems and computer security''); ITG
Letter at 13 (stating the belief that the proposed notification
requirement for material systems changes ``would extend the SEC's
reach far beyond that of a securities regulator and instead enable
it to regulate the IT process of marketplace participants'' and that
the Exchange Act does not enable the Commission to ``bootstrap its
SRO rule review authority or its national market system authority to
force regulated entities to submit upcoming material systems changes
for agency approval''); and KCG Letter at 19 (stating the belief
that ``[t]he Commission does not have authority to stop
implementation of systems changes by ATSs or systems changes that
exchanges are not required to submit under Section 19(b) of the
Exchange Act'').
---------------------------------------------------------------------------

    In light of the 30-day advance notification requirement in proposed
Rule 1000(b)(6), some commenters suggested eliminating the semi-annual
reporting requirement in proposed Rule 1000(b)(8)(ii) because they
considered it duplicative and unnecessary.\1047\ One commenter believed
that the required semi-annual reporting requirement was excessive and
should instead be incorporated into the annual reporting obligations in
proposed Rule 1000(b)(8)(i).\1048\ As discussed above, the Commission
is adopting a quarterly reporting requirement under Rule 1003(a)(1) and
is not adopting the proposed 30-day advance notification requirement.
Therefore, the Commission is not adopting the requirement in proposed
Rule 1000(b)(8)(ii) for semi-annual progress reports.
---------------------------------------------------------------------------

    \1047\ See Omgeo Letter at 24-25; and OCC Letter at 16.
    \1048\ See CME Letter at 11.
---------------------------------------------------------------------------

ii. Definition of Material Systems Change
    Commenters generally opposed the proposed definition of material
systems change. Many commenters stated their belief that the term was
too broad and would therefore necessitate an excessive number of
notifications of material systems changes.\1049\ Some commenters
believed that the definition should be revised and offered a variety of
suggestions.\1050\ Several commenters advocated for creating a risk-
based definition whereby, for example, notifications are only required
for those material systems changes that pose a risk to critical
operations of an entity.\1051\ One commenter suggested that the
requirement focus on SCI systems only.\1052\ One commenter stated that
SCI entities should be afforded flexibility to establish reasonable
standards for defining material systems changes for their
systems.\1053\
---------------------------------------------------------------------------

    \1049\ See, e.g., BATS Letter at 14; MFA Letter at 6; ICI Letter
at 4; BIDS Letter at 14; Liquidnet Letter at 3; FINRA Letter at 24-
26; MSRB Letter at 22; NYSE Letter at 26-27; Joint SROs Letter at 7;
CME Letter at 5; Oppenheimer Letter at 3; OTC Markets Letter at 20-
21; and Direct Edge Letter at 3.
    \1050\ See, e.g., BATS Letter at 14-15 (recommending that only
those material systems changes that are reported to an SCI entity's
board of directors or similar body should be required to be reported
to the Commission, which BATS stated is the standard it uses
currently for the ARP Inspection Program); OCC Letter at 15 (stating
that the reporting of systems changes to the board of directors, or
to a similar governing body, is a more appropriate standard for
determining materiality than reporting to ``senior management'');
BIDS Letter at 14-15 (stating its belief that the Commission should
define a ``material systems change'' to be a large-scale
architectural upgrade, the implementation of industry-wide rules or
other market structure changes, or other technology changes that may
be required because of changes in trading rules defined in the
exchange's or the ATS's trading rule book); and FIF Letter at 5
(recommending that the term be defined to include significant
functional enhancements, major technology infrastructure changes, or
changes requiring member/participant notifications).
    \1051\ See, e.g., OCC Letter at 15; DTCC Letter at 16; Liquidnet
Letter at 3; MFA Letter at 6; ICI Letter at 4; CME Letter at 5; and
Direct Edge at 4.
    \1052\ See NYSE Letter at 27.
    \1053\ See FINRA Letter at 27.
---------------------------------------------------------------------------

    Several commenters sought guidance from the Commission on the
materiality threshold, which commenters believed was unclear,
explaining, for example, that the term ``material'' appears both in the
term ``material systems change'' and in the definition of that
term.\1054\ Similarly, several commenters requested that the Commission
provide more guidance on the meaning of ``material'' in the context of
systems changes because, although the wording of the proposed
definition contained the concept of ``materiality,'' the commenters
believed some of the examples provided in the SCI Proposal to be non-
material.\1055\ One commenter asked that the Commission clearly define
what types of systems changes are not subject to the prior notification
requirement in order to avoid receiving notices of all systems changes,
material or otherwise.\1056\ One commenter asked that the Commission
clarify the meaning of ``material'' and confirm that prior notification
would not be required for changes that do not pertain to the production
environment.\1057\
---------------------------------------------------------------------------

    \1054\ See Direct Edge Letter at 3-4; OCC Letter at 15; and NYSE
Letter at 26.
    \1055\ See, e.g., Joint SROs Letter at 7; DTCC Letter at 15-16;
Omgeo Letter at 23; OCC Letter at 15; FINRA Letter at 27; OTC
Markets Letter at 20-21; BIDS Letter at 14; Direct Edge Letter at 3-
4; and ISE Letter at 8. See also supra note 1050.
    \1056\ See KCG Letter at 20.
    \1057\ See SIFMA Letter at 15-16.
---------------------------------------------------------------------------

    Rather than adopting a detailed definition of material systems
change as proposed, Rule 1003(a)(1) requires an SCI entity to establish
reasonable written criteria for identifying a change to its SCI systems
and the security of indirect SCI systems as material and to report to
the Commission those changes the SCI entity identified as material in
accordance with such criteria. This change is responsive to a
commenter's suggestion that SCI entities should be granted flexibility
to establish reasonable standards for determining whether a systems
change is material. In addition, the Commission does not believe that
it is appropriate to adopt a precise definition for the term ``material
systems change'' because SCI entities differ in nature, size,
technology, business model, and other aspects of their businesses. The
Commission notes that there currently is no industry definition of
``material systems change'' that is applicable to all SCI entities that
can serve as the basis for a precise definition of the term ``material
systems change'' in Regulation SCI, and believes that whether a systems
change is material is dependent on the facts and circumstances, such as
the reason for the change and how it may impact operations. Moreover,
requiring SCI entities to establish their own reasonable criteria for
identifying material systems changes reflects the Commission's view
that an SCI entity is in the best position to determine, in the first
instance, whether a change, or series of changes, is material in the
context of its systems. Because adopted Rule 1003(a)(1) allows each SCI
entity to identify material systems changes, it is responsive to
commenters' concern that the proposed definition was too broad and
would result in an excessive number of notifications, and to
commenters' suggestion that the definition should be revised.
    Further, the Commission's determination to not adopt the proposed
definition of material systems change mitigates commenters' concern
that the proposed definition was unclear. In particular, by eliminating
the proposed definition of material systems change, the Commission
seeks to eliminate the confusion caused by the proposed definition of
this term, which contained the word ``material.'' Moreover, some
commenters requested additional clarity on the definition of material
systems change because they believed that some of the examples the
Commission provided in the SCI Proposal were not material systems
changes. Because adopted Rule 1003(a)(1) requires SCI entities to
establish reasonable written criteria for identifying material systems
changes, SCI entities will not be required to identify material systems
changes in accordance with the detailed definition and examples from
the SCI

Proposal. Rather, an SCI entity will have reasonable discretion in
establishing the written criteria in order to capture the systems
changes that it believes are material. Specifically, the Commission
believes that adopted Rule 1003(a) is sufficiently flexible to allow
each SCI entity to identify changes that it believes are material,
which may include some of the suggestions identified by the commenters
if an SCI entity determines such changes to be appropriate to include
in its criteria for identifying material systems changes. For example,
if an SCI entity reasonably believes that its systems changes are
material if they involve significant functional enhancements, major
technology infrastructure changes, or changes requiring member/
participant notifications, and such criteria is set forth in the SCI
entity's reasonable written criteria, the SCI entity may identify
material systems changes in accordance with such written criteria.
Likewise, if an SCI entity reasonably believes that some of the
examples of material systems changes identified in the SCI Proposal can
appropriately serve as criteria for identifying material systems
changes, and such criteria is set forth in the SCI entity's reasonable
written criteria, the SCI entity may identify material systems changes
in accordance with such written criteria.
    In response to a commenter's suggestion that the Commission clearly
define what types of systems changes are not subject to the prior
notification requirement in order to avoid notification of all systems
changes, material or otherwise, the Commission notes that Rule
1003(a)(1) specifically requires SCI entities to identify material
systems changes and report only material systems changes. With respect
to a commenter's question regarding whether prior notification would be
required for changes that do not pertain to the production environment,
the Commission notes that SCI systems do not include development and
testing systems, although indirect SCI systems could include
development and testing systems if they are not walled-off from SCI
systems. Therefore, Rule 1003(a) could apply to material changes to the
security of development and testing systems that are not walled-off
from SCI systems. Finally, with respect to a commenter's suggestion
that Rule 1003(a) focus only on SCI systems, the Commission believes
that notifications of material systems changes regarding the security
of indirect SCI systems is important to the Commission's oversight of
U.S. securities market infrastructure. At the same time, the Commission
notes that Rule 1003(a)(1) provides that each SCI entity establish its
own reasonable criteria for identifying a change to the security of its
indirect SCI systems as material. Therefore, to the extent that an SCI
entity determines that certain changes to the security of its indirect
SCI systems are not material in accordance with its reasonable written
criteria, such changes are not required to be reported to the
Commission.
    As with an SCI entity's other policies and procedures under
Regulation SCI, Commission staff may review an SCI entity's established
criteria relating to the materiality of a systems change (e.g., in the
course of an examination) to determine whether it agrees with the SCI
entity's assessment that such criteria is reasonable and in compliance
with the requirements of Rule 1003(a). The Commission believes that, by
providing SCI entities flexibility in establishing the criteria and
reviewing SCI entities' established criteria, it strikes the proper
balance between granting discretion to SCI entities and ensuring that
SCI entities carry out their obligations under Regulation SCI.
iii. Adopted Rule 1003(a)(2): Supplemental Material Systems Change
Reports
    A commenter who advocated for a quarterly reporting requirement
noted that quarterly updates would disclose material deviations from
plans described in a previous report, including those stemming from
inaccuracies in prior reports.\1058\ Another commenter similarly noted
that periodic reporting of any inaccuracies is sufficient for oversight
purposes.\1059\ The Commission believes that there may be circumstances
in which an SCI entity realizes that information previously provided to
the Commission in a quarterly report was materially inaccurate or that
the quarterly report omitted material information. The Commission
believes that it should, on an ongoing basis, have complete and correct
information regarding material systems changes at an SCI entity, rather
than waiting until the next quarterly report to receive corrected
information, as suggested by these commenters. The Commission is
therefore adopting Rule 1003(a)(2), which requires an SCI entity to
promptly submit a supplemental report to notify the Commission of a
material error in or material omission from a report previously
submitted under Rule 1003(a)(1). The Commission notes that the
supplemental report requirement applies only if the error or omission
in a prior report is material.
---------------------------------------------------------------------------

    \1058\ See OTC Markets Letter at 22.
    \1059\ See NYSE Letter at 28.
---------------------------------------------------------------------------

5. SCI Review--Rule 1003(b)
    Proposed Rule 1000(b)(7) required an SCI entity to conduct an SCI
review of the SCI entity's compliance with Regulation SCI not less than
once each calendar year, and submit a report of the SCI review to
senior management of the SCI entity no more than 30 calendar days after
completion of such SCI review.\1060\ Further, proposed Rule
1000(b)(8)(i) required an SCI entity to submit to the Commission a
report of the SCI review required by paragraph (b)(7), together with
any response by senior management, within 60 calendar days after its
submission to senior management of the SCI entity.\1061\
---------------------------------------------------------------------------

    \1060\ See proposed Rule 1000(b)(7) and Proposing Release, supra
note 13, at Section III.C.5.
    \1061\ See proposed Rule 1000(b)(8)(i) and Proposing Release,
supra note 13, at Section III.C.6.
---------------------------------------------------------------------------

    Proposed Rule 1000(a) defined the term ``SCI review'' to mean a
review, following established procedures and standards, that is
performed by objective personnel having appropriate experience in
conducting reviews of SCI systems and SCI security systems, and which
review contains: (1) A risk assessment with respect to such systems of
the SCI entity; and (2) an assessment of internal control design and
effectiveness to include logical and physical security controls,
development processes, and information technology governance,
consistent with industry standards.\1062\ In addition, the proposed
definition provided that such review must include penetration test
reviews of the SCI entity's network, firewalls, and production systems
at a frequency of not less than once every three years.\1063\
---------------------------------------------------------------------------

    \1062\ See proposed Rule 1000(a) and Proposing Release, supra
note 13, at Section III.C.5.
    \1063\ See id.
---------------------------------------------------------------------------

    The Commission is adopting the provisions relating to SCI reviews
with modifications in response to comment. In addition, the Commission
is adopting a definition of ``senior management'' in Rule 1000 for
purposes of the SCI review requirement.
    Some commenters expressed support for the proposed requirements for
SCI reviews,\1064\ with a few advocating that the SCI review be
conducted by an independent third party, rather than ``objective
personnel.'' \1065\ One commenter noted that it agreed that annual SCI
reviews and reports can have a meaningful impact on improving

technology and business practices.\1066\ Another commenter expressed
support for proposed Rule 1000(b)(7), but asked for clarification that
any review of a processor under an NMS plan be performed independently
of reviews of the same entity in other capacities (e.g., as an exchange
or other SCI entity).\1067\
---------------------------------------------------------------------------

    \1064\ See, e.g., MSRB Letter at 23; Lauer Letter at 5; Better
Markets Letter at 5; and Direct Edge Letter at 9.
    \1065\ See Lauer Letter at 5; Better Markets Letter at 5; and
BlackRock Letter at 4.
    \1066\ See FIF Letter at 6 (expressing support for the SCI
review requirement while also providing suggestions for
modifications to the rule).
    \1067\ See Direct Edge Letter at 9.
---------------------------------------------------------------------------

    With regard to the suggestion that the Commission adopt a
requirement that SCI reviews be conducted by an independent third party
rather than ``objective personnel'' as proposed,\1068\ the Commission
continues to believe that it is appropriate to permit SCI reviews to be
performed by personnel of the SCI entity or an external firm, provided
that such personnel are, in fact, objective and, as required by rule,
have the appropriate experience to conduct reviews of SCI systems and
indirect SCI systems. Experienced personnel should have the knowledge
and skills necessary to conduct such reviews. In the SCI Proposal, the
Commission noted that to satisfy the criterion that an SCI review be
conducted by ``objective personnel,'' it should be performed by persons
who have not been involved in the development, testing, or
implementation of such systems being reviewed.\1069\ The Commission
continues to believe that persons who were not involved in the process
for development, testing, and implementation of the systems being
reviewed would generally be in a better position to identify weaknesses
and deficiencies that were not identified in the development, testing,
and implementation stages. The Commission believes that, given the
requirement that such personnel be ``objective,'' any personnel with
conflicts of interest that have not been adequately mitigated to allow
for objectivity should be excluded from serving in this role. In
particular, the Commission believes that a person or persons conducting
an SCI review should not have a conflict of interest that interferes
with their ability to exercise judgment, express opinions, and present
recommendations with impartiality. While the Commission recognizes
that, as one commenter asserted, all personnel of an SCI entity could
be viewed as having some level of conflict of interest,\1070\ the
Commission believes that SCI entities can have appropriate policies and
procedures in place to mitigate such conflicts or to help ensure that
certain departments and/or specified personnel (such as internal audit
departments) are appropriately insulated from such conflicts so as to
be able to objectively conduct SCI reviews.\1071\
---------------------------------------------------------------------------

    \1068\ See supra note 1065 and accompanying text.
    \1069\ See Proposing Release, supra note 13, at 18123.
    \1070\ See Better Markets Letter at 5.
    \1071\ For example, the Commission believes that many entities
implement a reporting structure pursuant to which internal audit
employees or departments report directly to the board of directors
or an audit committee of the board. The Commission notes that, while
utilizing external personnel (i.e., third parties) to conduct an SCI
entity's SCI review generally would not raise the same concerns
regarding objectivity, the SCI entity would likewise need to
mitigate any conflicts of interest that would prevent such personnel
from meeting the objectivity standard required for an SCI review.
For example, among the factors an SCI entity may consider in
evaluating the objectivity of a third party review could be who
within the SCI entity is managing the third party review, is setting
the scope of review, is authorizing payment for such review, and has
the authority to review and comment on the third party report, among
others. Further, an SCI entity may consider the third party's
ability to remain objective in light of any other services provided
by the third party to the SCI entity.
---------------------------------------------------------------------------

    Accordingly, the Commission believes that the goals of Regulation
SCI can be achieved through reviews by either internal objective
personnel or external objective personnel. Taking into consideration
the advantages and disadvantages associated with each approach, each
SCI entity should make its own determination regarding the levels of
review or assurance that can be provided by different personnel, the
best means to ensure their objectivity, and whether it is appropriate
to incur the additional costs of an independent third party review. An
SCI entity may, for example, determine that it is appropriate to
utilize personnel not employed by the SCI entity (i.e., third parties)
to conduct such review each year or only on a less frequent, periodic
basis (e.g., every three years), or only with regard to certain of its
systems. In addition, with regard to one commenter's suggestion that an
SCI review should be performed independently for each capacity in which
an SCI entity acts, the Commission notes that the definition of SCI
review and provisions of Rule 1003(b) require that an SCI entity
perform a review, following established procedures and standards, for
compliance with Regulation SCI that includes a risk assessment of the
SCI entity's SCI systems and indirect SCI systems and an assessment of
internal control design and effectiveness of such systems and does not
require an SCI entity that serves in two different capacities with
respect to Regulation SCI to conduct two independent SCI reviews. The
Commission believes that, as a practical matter, an SCI entity may
determine that, to comply with these requirements, it is necessary to
conduct separate assessments and analysis for each capacity of the SCI
entity, because the standards used, risk assessments, applicable
policies and procedures, and assessment of internal control design and
effectiveness are different with regard to the distinct and differing
functions of the SCI entity in each capacity. For example, an entity
that meets both the definition of an SCI SRO and a plan processor may
determine that it is necessary to conduct separate reviews for each
function performed, because, for instance, the findings of a risk
assessment determine that certain SCI systems fall into the category of
``critical SCI systems'' with regard to the functions of the plan
processor, but not with regard to the functions of the SRO. At the same
time, the Commission notes that, even where separate reviews are
conducted, there may be certain overlap in conducting such reviews (for
example, the entity may use the same objective reviewer for each
function performed), such reviews may be conducted at the same time,
and a single SCI review report may contain findings for each capacity.
    While other commenters also supported some form of review, many of
these commenters stated that the term SCI review is defined too broadly
and/or that the SCI review requirements should allow more
flexibility.\1072\ Some commenters expressed concerns about the need to
review all systems on an annual basis, which they argued could be
costly, burdensome, and unnecessary.\1073\ Several commenters suggested
the adoption of a risk-based approach for determining the scope of the
review, which would entail conducting a risk assessment to determine
which systems should be reviewed and how often.\1074\ Under such an
approach, the highest risk systems would be reviewed more frequently
than other, less critical systems, which could be reviewed less
frequently than annually or on a rotational basis. Similarly, one

commenter recommended that SCI reviews should be focused only on those
core systems capable of having a material impact on members or
participants, and ``adjacent'' systems should not be subject to the
review process.\1075\
---------------------------------------------------------------------------

    \1072\ See, e.g., FINRA Letter at 39-41; Omgeo Letter at 23-24;
OCC Letter at 19; NYSE Letter at 35; SIFMA Letter at 17; DTCC Letter
at 16-17.
    \1073\ See, e.g., FINRA Letter at 39-41; Omgeo Letter at 23-24;
OCC Letter at 19; NYSE Letter at 35; DTCC Letter at 16-17; and BIDS
Letter at 11.
    \1074\ See, e.g., FINRA Letter at 39-41; OCC Letter at 19; NYSE
Letter at 35; SIFMA Letter at 17; DTCC Letter at 16-17; LiquidPoint
Letter at 3; and Omgeo Letter at 24. One commenter noted that the
proposed SCI review requirement essentially eliminated the ability
to utilize its current risk assessment approach to determine the
frequency of review for each system (ranging from annually to once
every four years). See FINRA Letter at 40.
    \1075\ See FIF Letter at 6.
---------------------------------------------------------------------------

    After considering the views of commenters, the Commission has
determined to adopt the provisions relating to SCI reviews with
modifications in response to comment.\1076\ Thus, adopted Rule 1003(b)
requires an SCI entity to conduct an SCI review of the SCI entity's
compliance with Regulation SCI not less than once each calendar
year.\1077\ However, the Commission notes that, because it has revised
the scope of the definition of ``SCI systems'' as described above,
fewer systems of each SCI entity will be subject to the SCI review,
thereby focusing the overall scope of the SCI review requirement.\1078\
Further, to address some commenters' concerns about the burdens and
inflexibility of the proposed rule and the recommendation that the
proposed rule utilize a more risk-based approach, the adopted rule is
being revised to allow assessments of SCI systems directly supporting
market regulation or market surveillance to be conducted, based upon a
risk-assessment, at least once every three years, rather than
annually.\1079\ SCI entities would be required to determine the
specific frequency with which to conduct assessments of these systems
depending on the risk assessment that they conduct as part of the
annual SCI review, provided that these systems are assessed at least
once every three years. The Commission believes that market regulation
and market surveillance systems have the potential to pose less risk to
an entity or the market than other SCI systems. While the Commission
believes that these systems are essential to investor protection and
market integrity and that they can pose a significant risk to the
markets in the event of a systems issue, the Commission also believes
that certain market regulation and market surveillance systems may not
have as immediate or widespread of an impact on the maintenance of fair
and orderly markets or an entity's operational capability as the other
categories of systems included within the definition of SCI systems.
While a systems issue affecting a trading system could result in the
immediate inability of a market, and thus market participants, to
continue trading on such system and potentially impact trading on other
markets as well, the Commission believes that the temporary disruption
or failure of a SCI entity's market regulation and/or market
surveillance systems in the wake of a wide-scale disruption would
likely not have as direct an impact on market participants' ability to
continue to trade. Thus, after considering commenters' views regarding
the costs and burdens of the proposed SCI review requirements, as well
as the suggestion that the Commission incorporate more of a risk-based
approach in Regulation SCI, the Commission believes that a longer
frequency of review of these systems may be appropriate in cases where
the risk assessment conducted as part of the SCI review results in such
a determination. The Commission also notes that, as originally proposed
the rule would have required penetration test reviews of the SCI
entity's network, firewalls and development, testing, and production
systems at a frequency of not less than once every three years in
recognition of the potentially significant costs that may be associated
with the performance of such tests.\1080\ However, consistent with
modifications to the definition of SCI systems, references to
development and test systems have been deleted in adopted Rule
1003(b)(1)(i).\1081\ The Commission notes that SCI entities may,
however, determine that based on its risk assessment, it is appropriate
and/or necessary to conduct such penetration test reviews more
frequently than once every three years.
---------------------------------------------------------------------------

    \1076\ See adopted Rule 1003(b). However, the Commission is
moving the clause regarding penetration test reviews from the
definition of SCI review into Rule 1003(b), which addresses the
timing of reviews. Further, the adopted definition of SCI review
will require that the objective reviewer have ``appropriate
experience to conduct reviews'' rather than ``appropriate experience
in conducting reviews'' as proposed. The Commission believes this
revision is appropriate given that, prior to the adoption of
Regulation SCI today, no individual or entity would have experience
in conducting the specific SCI reviews required by Rule 1003(b).
Rather, the Commission believes that there are individuals or
entities that have experience in conducting reviews, audits, and/or
testing similar to the functions that would be necessary to address
certain aspects of the SCI review requirement, and thus, the
objective reviewer should have this type of appropriate experience
that would allow them to conduct SCI reviews in accordance with the
requirements of Regulation SCI. Thus, as adopted, the term ``SCI
review'' means ``a review, following established procedures and
standards, that is performed by objective personnel having
appropriate experience to conduct reviews of SCI systems and
indirect SCI systems, and which review contains: (1) A risk
assessment with respect to such systems of an SCI entity; and (2) An
assessment of internal control design and effectiveness of its SCI
systems and indirect SCI systems to include logical and physical
security controls, development processes, and information technology
governance, consistent with industry standards.'' See Rule 1000.
Further, the Commission is moving the requirement relating to
reports to the Commission on SCI reviews from proposed Rule
1000(b)(8) into Rule 1003(b) so that all provisions regarding SCI
reviews are in the same rule.
    \1077\ See adopted Rule 1003(b)(1).
    \1078\ The Commission also notes that it has clarified that the
definition of ``indirect SCI systems'' includes only those systems
that have not been effectively logically or physically separated
from SCI systems. Thus, the scope of the SCI review is also more
focused than what some commenters may have believed. It is also
further focused by the elimination of references to development and
test systems from the penetration test requirement in adopted in
Rule 1003(b)(1)(i).
    \1079\ See adopted Rule 1003(b)(1)(ii).
    \1080\ As noted by some commenters, penetration tests are highly
technical and would require special expertise, and thus the
Commission believes such testing could potentially require
substantial costs. See, e.g., DTCC Letter at 17; and Omgeo Letter at
44. See also infra Sections V.D.2.d and VI.C.2.b.vi (discussing
estimated costs associated with the SCI review requirement, which
takes into consideration the costs of penetration testing) and
Proposing Release, supra note 13, at 18123 (stating that the
Commission seeks to balance the frequency of such tests with the
costs associated with performing the tests). As noted in the SCI
Proposal, the Commission believes that the penetration test reviews
should help an SCI entity evaluate the system's security and
resiliency in the face of attempted and successful intrusions. See
id.
    \1081\ See supra Section IV.A.2.b (discussing elimination of
development and test systems from the definition of SCI systems).
---------------------------------------------------------------------------

    The Commission is not, however, adopting a broader risk-based
approach to determine the required frequency of an SCI review (i.e.,
for SCI systems other than market regulation and market surveillance
systems), as suggested by some commenters.\1082\ The Commission
believes that a critical element to ensuring the capacity, integrity,
resiliency, and availability of SCI systems and indirect SCI systems is
conducting an annual objective review to assess the risks of an SCI
entity's systems and the effectiveness of its internal information
technology controls and procedures. Such reviews will not only assist
the Commission in improving its oversight of the technology
infrastructure of SCI entities, but also each SCI entity in assessing
the effectiveness of its information technology practices, helping to
ensure compliance with the safeguards provided by the requirements of
Regulation SCI, identifying potential areas of weakness that require
additional or modified controls, and determining where to best devote
resources. Further, the Commission believes that the competitive
environment of today's securities markets drives SCI entities to
continually update, modify, and introduce new technology and systems,
often in an effort to meet specific business needs and achieve ``quick-
to-market'' results, potentially without

adequate focus on ensuring the continuous integrity of its systems. In
addition, given today's fast-paced nature of technological advancement,
existing controls can quickly become obsolete or ineffective and the
relative criticality or risk nature of a system can change over time as
well.\1083\ Further, as one commenter noted, it is not uncommon for
entities to experience repeated unsuccessful attempts to gain access to
their systems,\1084\ which the Commission believes can expose certain
vulnerabilities not identified previously and, if successful, also
create new vulnerabilities and risk. For these reasons, the Commission
believes that it is appropriate to require an SCI entity to conduct an
SCI review of its applicable systems not less than once every 12
months.\1085\
---------------------------------------------------------------------------

    \1082\ See supra note 1074 and accompanying text.
    \1083\ In addition, the Commission believes changes in personnel
with access to SCI systems throughout the year can create additional
risk that should be considered in evaluating the risks of any
particular system.
    \1084\ See SIFMA Letter at 11.
    \1085\ The Commission notes that, while the rule requires that
an SCI review be conducted ``not less than once each calendar
year,'' an SCI entity may determine that it is appropriate to
conduct an assessment of an SCI system more frequently, particularly
for critical SCI systems. See adopted Rule 1003(b)(1).
---------------------------------------------------------------------------

    Further, the Commission notes that, as described in detail above,
Regulation SCI is consistent with a risk-based approach in several
areas, and thus, a risk assessment is appropriate in order to determine
the standards and requirements applicable to a given SCI system. As
such, the Commission believes that it is appropriate to require SCI
entities to conduct a risk-based assessment with regard to its SCI
systems and indirect SCI systems as part of its SCI review at least
annually to help ensure that SCI entities are meeting the requirements
of Regulation SCI.\1086\
---------------------------------------------------------------------------

    \1086\ See adopted Rule 1003(b) and Rule 1000 (definition of
``SCI review'').
---------------------------------------------------------------------------

    For the reasons noted above, the Commission believes it is
appropriate to require that SCI reviews be conducted at least annually,
rather than utilizing a risk-based approach to determine the frequency
of the required SCI review.\1087\ At the same time, the Commission
notes that this provision is consistent with a risk-based approach in
that SCI entities may design the scope and rigor of the SCI review for
a particular system based on its risk assessment of such system,
provided that the review meets the requirements of the rule, such as
including an assessment of internal control design and effectiveness to
include logical and physical security controls, development processes,
and information technology governance, consistent with industry
standards \1088\ and performing penetration test reviews at least once
every three years.\1089\
---------------------------------------------------------------------------

    \1087\ However, as discussed above, an SCI entity may conduct an
SCI review of its market regulation and market surveillance systems
based upon its risk assessment of such systems, but not less than
once every three years. See adopted Rule 1003(b)(1)(ii).
    \1088\ See adopted Rule 1000 (definition of ``SCI review'').
    \1089\ See adopted Rule 1003(b)(1)(i).
---------------------------------------------------------------------------

    Some commenters sought clarification on various aspects of the SCI
review requirement. One commenter stated that the term SCI review, as
proposed, expanded significantly on what is required under ARP and
asked for greater specificity as to the objectives and intended scope
of the SCI review.\1090\ This commenter suggested, as an alternative,
that the Commission establish an ``agreed upon procedures'' approach,
which would involve outlining specific SCI review objectives and
procedures that would be performed by an objective reviewer.\1091\ One
commenter also requested that the Commission clarify whether there is a
distinction between the existing ARP report and the SCI review and
whether the ARP practice of on-site inspections would be
eliminated.\1092\
---------------------------------------------------------------------------

    \1090\ See FINRA Letter at 39-40.
    \1091\ See id. at 40.
    \1092\ See OCC Letter at 19.
---------------------------------------------------------------------------

    With regard to the comment seeking clarity on the scope of the
review as compared to what is done under the current ARP Inspection
Program,\1093\ as noted in the SCI Proposal, the requirement for an
annual SCI review was intended to formalize a practice in place under
the current ARP Inspection Program in which SROs conduct annual systems
reviews following established audit procedures and standards that
result in the presentation of a report to senior SRO management on the
recommendations and conclusions of the review.\1094\ Specifically, the
ARP Policy Statements called for each SRO to have its automated systems
reviewed annually by an ``independent reviewer'' \1095\ and stated that
independent reviews and analysis should: ``(1) Cover significant
elements of the operations of the automation process, including the
capacity planning and testing process, contingency planning, systems
development methodology and vulnerability assessment; (2) be performed
on a cyclical basis by competent and independent audit personnel
following established audit procedures and standards; and (3) result in
the presentation of a report to senior SRO management on the
recommendations and conclusions of the independent reviewer, which
report should be made available to Commission staff for its review and
comment.'' \1096\ Similar to (1) above, the definition of SCI review
requires the review to contain an assessment of internal control design
and effectiveness of its SCI systems and indirect SCI systems to
include logical and physical security controls, development processes,
and information technology governance, consistent with industry
standards. Consistent with element (2), an SCI review must be performed
by objective personnel having appropriate experience to conduct reviews
of SCI systems and indirect SCI systems and must be performed following
established procedures and standards. Finally, like item (3), Rule
1003(b)(2)-(3) requires SCI entities to submit a report of the SCI
review to senior management after completion of the review, and
following submission to senior management, to submit a report of the
SCI review to the Commission, along with any response by senior
management. Senior management, after reviewing the report, should note,
in addition to any other response that may be made, any material
inaccuracy or omission that, to their knowledge, is in the report. In
this regard, the Commission recognizes that senior managers, by virtue
of their positions and experience, may have differing levels of
knowledge regarding their entity's SCI systems and indirect SCI systems
and compliance with Regulation SCI.
---------------------------------------------------------------------------

    \1093\ See supra note 1092 and accompanying text. See also supra
note 1090 and accompanying text.
    \1094\ See Proposing Release, supra note 13, at 18123.
    \1095\ See ARP I, supra note 1, at 48706-07. ARP I provided that
an ``independent reviewer'' could be either an internal auditor
group or an external audit firm so long as the independent reviewer
had the competence, knowledge, consistency, and independence
sufficient to perform the role.
    \1096\ See ARP II, supra note 1, at 22491. In ARP II, the
Commission also explained that, in its view, ``a critical element to
the success of the capacity planning and testing, security
assessment and contingency planning processes for [automated]
systems is obtaining an objective review of those planning processes
by persons independent of the planning process to ensure that
adequate controls and procedures have been developed and
implemented.'' Id.
---------------------------------------------------------------------------

    While the SCI review requirement in Rule 1003 is based on the ARP
review and report, a greater number of automated systems meeting the
definition of SCI system or indirect SCI system would be subject to the
SCI review requirements because the scope of Regulation SCI expands
upon the current ARP Inspection Program. The Commission notes that the
SCI review is not a substitute for inspections and

examinations conducted by Commission staff, and therefore SCI entities
should expect that technology systems inspections and examinations will
continue following the adoption of Regulation SCI. Along with
notifications of material systems changes under adopted Rule 1003(a)
and SCI event notifications pursuant to adopted Rule 1002(b), one
purpose of SCI reviews will be to aid the Commission and its staff in
understanding the operations and risks associated with the applicable
systems of an SCI entity.
    In addition, as noted above, one commenter, in seeking further
clarity on the scope of the SCI review requirement, suggested that the
Commission take an ``agreed upon approach'' which would outline more
specific review objectives and procedures that would be performed by
the objective reviewer. The Commission believes that an SCI entity
should have the ability to design the specific parameters of an SCI
review within the confines of the general framework of the rule,
including identifying its own review objectives and procedures, given
the SCI entity's in-depth knowledge of, and familiarity with, its own
systems and their attendant risks. As such, the adopted rule is
designed to provide a general framework for the scope of the SCI review
by specifying that the review must include a risk assessment of SCI
systems and indirect SCI systems and an assessment of the internal
control design and effectiveness of its systems in certain areas.\1097\
At the same time, the rule provides flexibility by permitting the
review to be conducted ``following established procedures and
standards,'' which would be identified and established by the SCI
entity itself.\1098\
---------------------------------------------------------------------------

    \1097\ See adopted Rule 1000 (defining ``SCI review'').
    \1098\ See id.
---------------------------------------------------------------------------

    Some commenters expressed views on the provisions requiring SCI
entities to submit reports of the SCI review to senior management of
the SCI entity and to the Commission. Specifically, two commenters
supported the proposed requirement that reports of the SCI review be
submitted to senior management of the SCI entity no later than 30 days
after completion of the SCI review.\1099\ One commenter urged that
senior management of an SCI entity certify the report before it is
submitted to the Commission in order to promote accountability at the
highest ranks of the SCI entity.\1100\ Another commenter believed that
45 days for submission of such reports to senior management would be
more appropriate as a target timeframe given the complexity of the
issues addressed in an SCI review, and that should this target fail to
be met, the Board of Directors Audit Committee (or similar governing
body) should be informed of the reason therefor.\1101\ Two commenters
recommended that the distribution cycle within proposed Rule
1000(b)(8)(i) be modified so that individual, focused audit reports
resulting from rotational reviews could be bundled and distributed to
the Commission on a regular basis (semi-annually or quarterly).\1102\
---------------------------------------------------------------------------

    \1099\ See MSRB Letter at 23; and FIF Letter at 6.
    \1100\ See Better Markets Letter at 6.
    \1101\ See DTCC Letter at 17.
    \1102\ See OCC Letter at 19; and DTCC Letter at 17.
---------------------------------------------------------------------------

    The Commission does not believe that it is necessary to require
senior management certification of the report of the SCI review, as
suggested by one commenter.\1103\ Adopted Rules 1003(b)(2)-(3) require
that the SCI entity submit a report of the SCI review to senior
management of the SCI entity no more than 30 calendar days after
completion of such SCI review, and that the SCI entity submit a report
of the SCI review, together with any response by senior management, to
the Commission and the board of directors of the SCI entity or the
equivalent of such board within 60 calendar days after its submission
to senior management. Because reports of SCI reviews and any responses
by senior management are required to be filed using Form SCI under the
Exchange Act and Regulation SCI, it is unlawful for any person to
willfully or knowingly make, or cause to be made, a false or misleading
statement with respect to any material fact in such reports or
responses.\1104\
---------------------------------------------------------------------------

    \1103\ See supra note 1100 and accompanying text.
    \1104\ See, e.g., Section 32(a) of the Exchange Act, 15 U.S.C.
78ff(a).
---------------------------------------------------------------------------

    The Commission recognizes that senior management certifications are
used in other regulatory contexts, including in some Commission rules
and regulations.\1105\ However, at this time, the Commission believes
that, in light of the other requirements for an SCI entity, the goals
of Regulation SCI can be achieved without the imposition of an
additional requirement on SCI entities for senior management
certification. Specifically, the Commission believes that the adopted
requirements promote the responsibility and accountability of senior
management of an SCI entity by helping to ensure that senior management
receives and reviews reports of SCI reviews, is made aware of issues
relating to compliance with Regulation SCI, and is encouraged to
promptly establish plans for resolving such issues.
---------------------------------------------------------------------------

    \1105\ See, e.g., 17 CFR 240.15c3-5(e)(2) (chief executive
officer certification under the Market Access Rule); and 17 CFR
240.13a-14 (principal executive and principal financial officer
certification of disclosure in annual and quarterly reports).
---------------------------------------------------------------------------

    The Commission is also adopting a definition of ``senior
management'' in Rule 1000 to make clear which individuals at an SCI
entity must receive and review the report of the SCI review. The
Commission believes that, in the context of the SCI review requirement,
senior management should not be limited to a single individual or
officer of an SCI entity. Thus, ``senior management,'' for purposes of
adopted Rule 1003(b) is defined as an SCI entity's Chief Executive
Officer, Chief Technology Officer, Chief Information Officer, General
Counsel, and Chief Compliance Officer, or the equivalent of such
employees or officers of an SCI entity. The Commission believes that,
in order to achieve the goals of the rule to promote increased
awareness and oversight of the technology infrastructure at an SCI
entity by its most senior employees and officers, it is important that
the SCI entity's senior management team receive and carefully review
reports of SCI reviews. The Commission believes that these employees
and officers, or their functional equivalent, represent the executive,
technology, legal, and compliance functions that are necessary to
effectively review the reports of SCI reviews. The Commission also
believes that awareness by an SCI entity's senior management of SCI
reviews and issues with Regulation SCI compliance should help to
promote a focus by senior management on such reviews and issues,
enhance communication and coordination regarding such reviews and
issues among business, technology, legal, and compliance personnel,
and, in turn, strengthen the capacity, integrity, resiliency, and
availability of the systems of SCI entities. To help ensure that
persons at the highest levels of an SCI entity are made aware of any
issues raised in the SCI review, the Commission is also adopting a
requirement for each SCI entity to submit to its board of directors or
the equivalent of such board a report of the SCI review and any
response by senior management within 60 calendar days after the
submission of the report to senior management of the SCI entity.
    With regard to one commenter's suggestion that SCI entities should
be given 45 days rather than 30 days to submit the report of the SCI
review to senior management (and that it should be only a target
timeframe rather than a

requirement),\1106\ the Commission notes that the 30-day timeframe is
based on the Commission's experience with the current ARP Inspection
Program that an ARP entity is able to consider the review and prepare a
report for senior management consideration prior to the submission to
the Commission.\1107\ The Commission acknowledges that a greater number
of systems will be subject to the SCI review requirement than the
current ARP Inspection Program given the definitions of SCI system and
indirect SCI system,\1108\ and that the issues addressed in an SCI
review may be complex. However, the Commission notes that the adopted
timeframe, while based on experience with the current ARP Inspection
Program, also takes into account these factors.\1109\ Further, the
Commission believes that the complexity of the issues presented during
an SCI review would more likely affect the timing of conducting and
completing the SCI review, rather than the timing for submitting a
report of the review to senior management. The Commission, therefore,
continues to believe that this requirement is appropriate. The
Commission also notes that the requirement to submit the annual report
to the Commission within 60 calendar days after its submission to
senior management is similarly based on the Commission's experience
with the ARP Inspection Program that this time period is a sufficient
period to enable senior management to consider such review or report
before submitting it to the Commission.\1110\ Because an SCI entity
will already have prepared the report and any response by senior
management for filing with the Commission, the Commission believes that
an SCI entity will not need significant additional time to submit the
same report and response to its board of directors or the equivalent of
such board.
---------------------------------------------------------------------------

    \1106\ See supra note 1101 and accompanying text.
    \1107\ See Proposing Release, supra note 13, at 18123.
    \1108\ The Commission also notes, however, that as discussed
above, the scope of systems subject to Regulation SCI has been
refined from what was proposed.
    \1109\ The Commission notes that, while the ARP II Release
recommended that an SRO's independent review should result in the
presentation of a report to senior SRO management on the
recommendations and conclusions of the independent review and such
report should be made available to Commission staff, it did not
provide recommended time periods for the submission of such reports.
See ARP II Release, supra note 1. The adopted 30-day time period is
based on experience with the ARP Inspection Program, as well as a
consideration of the scope of the review required under Regulation
SCI.
    \1110\ See Proposing Release, supra note 13, at 18124.
---------------------------------------------------------------------------

    Contrary to the suggestion of some commenters, the Commission does
not believe it is appropriate to allow an SCI entity to delay the
submission of SCI review reports to the Commission in order to bundle
several reports together and submit them on a quarterly or semi-annual
basis. Rather, the Commission believes that it is important to receive
such reports in a timely manner after completion of the SCI review, so
that the Commission is made aware of potential areas of weakness in an
SCI entity's systems that may pose risk to the entity or the market as
a whole, as well as areas of non-compliance with the provisions of
Regulation SCI, without undue delay.
    With respect to clearing agencies, two commenters noted that the
SCI review requirement potentially might overlap with staff guidance
for clearing agencies that calls for an annual report on internal
controls and recommended that the Commission consider further
coordination on potential redundancies.\1111\ The Commission notes that
the section in the guidance provided in the Announcement for Standards
for the Registration of Clearing Agencies referenced by commenters is
distinct from the adopted SCI review requirement, as such section in
the guidance relates to the review and evaluation of clearing agencies'
accounting controls.\1112\ In contrast, the SCI review requirement
involves a risk assessment and assessment of internal control design
and effectiveness of all of an SCI entity's SCI systems and indirect
SCI systems.
---------------------------------------------------------------------------

    \1111\ See OCC Letter at 19-20; and DTCC Letter at 18 (citing
Securities Exchange Act Release No. 16900, 45 FR 41920, available
at: http://sec.gov/rules/other/34-16900.pdf).
    \1112\ See Securities Exchange Act Release No. 16900 (June 17,
1980), 45 FR 41920 (June 23, 1980).
---------------------------------------------------------------------------

    Finally, it should be noted that the required review and timely
reporting to the Commission will enable the Commission and Commission
staff to monitor the quality of compliance with Regulation SCI,
thoroughness and robustness of SCI reviews, and the responses of senior
management to such reviews. Accordingly, the Commission will be in a
position to consider enhancing these regulatory requirements in the
future, if necessary.
6. SCI Entity Business Continuity and Disaster Recovery Plans Testing
Requirements for Members or Participants--Rule 1004
    Adopted Rule 1004 addresses testing of SCI entity business
continuity and disaster recovery plans, including backup systems, by
SCI entity members or participants. Rule 1004 corresponds to proposed
Rule 1000(b)(9), and is adopted with certain modifications in response
to comment, as discussed below.
a. Proposed Rule 1000(b)(9)
    Proposed Rule 1000(b)(9)(i) required each SCI entity, with respect
to its BC/DR plans, to require participation by designated members or
participants in scheduled functional and performance testing of the
operation of such plans, in the manner and frequency specified by the
SCI entity, at least once every 12 months. Proposed Rule 1000(b)(9)(ii)
further required each SCI entity to coordinate the testing of such
plans on an industry- or sector-wide basis with other SCI entities.
Proposed Rule 1000(b)(9)(iii) would have additionally required each SCI
entity to designate those members or participants it deems necessary,
for the maintenance of fair and orderly markets in the event of the
activation of its BC/DR plans, to participate in the testing of such
plans, and notify the Commission of such designations and its standards
for such designation on Form SCI.
b. Comments and Commission Response
    The Commission received significant comment on proposed Rule
1000(b)(9) and is adopting it with revisions, as Rule 1004. As more
fully discussed below, the adopted rule requires designation of a more
limited set of SCI entity members and participants for mandatory
participation in BC/DR testing than the proposed rule. Further, the
adopted rule does not require an SCI entity to file designation
standards or member/participant designations with the Commission on
Form SCI, as was proposed, but instead an SCI entity must keep records
of its standards and designations. The scope, frequency, and
coordination aspects of the proposed rule are adopted as proposed.
i. Mandatory BC/DR Testing Generally
    Some commenters expressed general support for the goals of proposed
Rule 1000(b)(9).\1113\ One commenter in particular stated that ``[i]t
is vital that as many firms as possible participate in [market-wide]
testing with conditions as realistic as possible.'' \1114\ According to
this commenter, broader mandatory participation in testing would be
``one of the most valuable parts of Regulation SCI and will do the most
to ensure improved market network reliability.''\1115\ Another
commenter

expressed support for broad participation in BC/DR testing, but also
expressed concern that the testing requirement would put SCI entities
at a competitive disadvantage versus non-SCI entities.\1116\
---------------------------------------------------------------------------

    \1113\ See, e.g., Angel Letter at 9; UBS Letter at 4-5; and FIF
Letter at 6-7.
    \1114\ See Angel Letter at 9.
    \1115\ See id. at 10.
    \1116\ See FIF Letter at 7.
---------------------------------------------------------------------------

    Several commenters objected to the proposed mandatory testing
requirement for SCI ATSs.\1117\ For example, two commenters suggested
that few ATSs are critical enough to warrant inclusion in the proposed
mandatory testing requirement.\1118\ One commenter urged that only SCI
entities that provide market functions on which other market
participants depend be subject to the requirements for separate backup
and recovery capabilities.\1119\ Another commenter stated that the
added benefit of requiring fully redundant backup systems is almost
impossible to measure while the cost of implementation is significant,
and added further that fully redundant systems and increased testing do
not guarantee a flawless backup plan.\1120\
---------------------------------------------------------------------------

    \1117\ See SIFMA Letter at 17; BIDS Letter at 8; and ITG Letter
at 15.
    \1118\ See BIDS Letter at 5, 8; and ITG Letter at 15.
    \1119\ See KCG Letter at 8.
    \1120\ See Group One Letter at 3.
---------------------------------------------------------------------------

    Two commenters stated that the current voluntary coordinated
testing organized by SIFMA \1121\ already attracts significant
participation without any mandate in place.\1122\ However, a different
commenter noted the difficulties it has encountered in fostering
participation in its voluntary disaster recovery exercises, and stated
that, despite encouraging users to participate in its disaster recovery
exercises, participation levels were only 20 percent of its targeted
high volume client base.\1123\ One commenter sought clarification on
whether the requirements of proposed Rule 1000(b)(9) would apply only
to trading and clearance systems, or would extend to other SCI systems
as well.\1124\ Two commenters asked whether third parties that perform
critical market functions for an SCI entity, such as data vendors and
service bureaus, would be subject to the proposed requirement.\1125\
One commenter stated that testing by an SCI entity of its business
continuity capabilities should not be required to be coordinated with
members.\1126\ According to this commenter, ``[t]he entire point of
[business continuity plan testing] would be to not coordinate it with
customers, and assess whether operations out of [backup] facilities was
seamless to members and other market participants.'' \1127\ One
commenter stated that it would be more appropriate for SCI entities'
members and participants to be responsible for their own business
continuity plans and testing.\1128\ The Commission has carefully
considered commenters' views on the need for all SCI entities to be
subject to the proposed mandatory testing requirement. The Commission
continues to believe that adopted Rule 1004 should apply to all SCI
entities.
---------------------------------------------------------------------------

    \1121\ SIFMA organizes an annual industry-wide testing exercise
for firms and exchanges to submit and process test orders using
their backup facilities. Participation is voluntary. See http://www.sifma.org/services/bcp/industry-testing/.
    \1122\ See CME Letter at 13; and Tellefsen Letter at 7-8.
    \1123\ See Omgeo Letter at 26 (noting also that it lacks the
ability to require participation by its clients).
    \1124\ See FINRA Letter at 37.
    \1125\ See FINRA Letter at 39; and MSRB Letter at 25.
    \1126\ See Direct Edge Letter at 9.
    \1127\ See id.
    \1128\ See SIFMA Letter at 17. In addition, some commenters
believed that ATSs should be excluded from requiring members or
participants to test, given that ATSs and their broker-dealer
participants are already subject to FINRA Rule 4370, which relates
to BC/DR plans. See FIA PTG Letter at 5; and BIDS Letter at 9.
---------------------------------------------------------------------------

    Whereas adopted Rule 1001(a)(2)(v) requires that each SCI entity's
policies and procedures include BC/DR plans and specifies recovery
goals and geographic diversity requirements for such plans,\1129\
adopted Rule 1004 sets forth certain minimum requirements for SCI
entity testing of its BC/DR plans. Adopted Rule 1004, like proposed
Rule 1000(b)(9), aims to reduce the risks associated with an SCI
entity's decision to activate its BC/DR plans and help to ensure that
such plans operate as intended, if activated, by requiring that an SCI
entity include participation by certain members and participants in
testing of the SCI entity's BC/DR plans. Although some commenters,
including several ATSs, argued that ATSs should be excluded from
requiring members or participants to test because, according to these
commenters, ATSs are less critical to the orderly functioning of the
markets than other SCI entities,\1130\ the Commission believes that
eliminating any category of SCI entity--including SCI ATSs--from the
testing requirement would undermine the goal of maintaining fair and
orderly markets in the wake of a wide-scale disruption, and assuring
the smooth and effective implementation of an SCI entity's BC/DR
plans.\1131\ The Commission continues to believe that a testing
participation requirement will help an SCI entity to ensure that its
efforts to develop effective BC/DR plans are not undermined by a lack
of participation by members or participants that the SCI entity
believes are necessary to the successful activation of such
plans.\1132\ As stated in the SCI Proposal, the Commission believes
that a factor in the shutdown of the equities and options markets in
the wake of Superstorm Sandy was the exchanges' belief regarding the
inability of some market participants to adequately operate from the
backup facilities of all market centers.\1133\ And, although testing
protocols were in place and the chance to participate in such testing
was available, the member participation rate was low.\1134\ The
Commission does not agree with comments that seamless operation of
backup facilities should not require coordination of testing, or that
the fact that members and participants have their own BC/DR plans and
testing means that they should not be required, if designated, to
participate in the testing of an SCI entity's BC/DR plans.\1135\ The
Commission continues to believe that testing of the effectiveness of
back-up arrangements in recovering from a wide-scale disruption is a
sound principle, and that, without the participation of significant
members or participants of SCI entities, the effectiveness of such
testing could be

undermined. Based on its experience with the ARP Inspection Program,
the Commission understands that many SCI entities have already made
significant investments in their backup facilities.\1136\ The
Commission believes that the requirements of Rule 1004 will help to
ensure that such facilities will be effective in the event they are
needed.\1137\
---------------------------------------------------------------------------

    \1129\ See supra Section IV.B.1.b (discussing the requirement
that an SCI entity have reasonable policies and procedures that
include business continuity and disaster recovery plans that include
maintaining backup and recovery capabilities sufficiently resilient
and geographically diverse and that are reasonably designed to
achieve next business day resumption of trading and two-hour
resumption of critical SCI systems following a wide-scale
disruption).
    \1130\ See supra note 1118 and accompanying text.
    \1131\ See supra Section IV.A.1 (discussing the Commission's
rationale for adopting the definition of SCI entity as proposed).
See supra Section IV.B.1.b (discussing the BC/DR requirements in
Rule 1001(a)(2)(v) for SCI entities). See also infra Sections
VI.C.1.c and VI.C.2.b.vii (discussing competitive concerns raised by
requiring SCI entities to require members or participants to
participate in the SCI entities' BC/DR testing).
    \1132\ See Proposing Release, supra note 13, at 18125.
    \1133\ See id. at 18158. See also id. at 18091. The Commission
notes that its basis for adopting a mandatory testing rule is
independent of whether the market closures in the wake of Superstorm
Sandy were appropriate to protect the health and safety of exchange
personnel.
    \1134\ See id. at 18158 and text accompanying n. 83 at 18091. In
addition, based on the discussions of Commission staff with market
participants in the months following Superstorm Sandy, the
Commission understands that many market participants had previously
engaged in connectivity testing with backup facilities, and yet
remained uncomfortable about switching over to the use of backup
facilities in advance of the storm.
    \1135\ Nor does the Commission agree that Rule 1004 would be
duplicative of FINRA Rule 4370, as Rule 1004 relates to
participation by members or participants in the testing of an SCI
entity's business continuity plans, whereas FINRA Rule 4370 relates
to the testing of the member's or participant's own business
continuity plan. See supra note 539 and accompanying text.
    \1136\ See infra Section VI.B.2 (stating that nearly all
national securities exchanges already have backup facilities that do
not rely on the same infrastructure components as those used by
their primary facility).
    \1137\ See 2003 BCP Policy Statement, supra note 512, at 56658
(stating: ``The effectiveness of back-up arrangements in recovering
from a wide-scale disruption should be confirmed through
testing.''). See also Interagency White Paper, supra note 512, at
17811 (identifying ``a high level of confidence, through ongoing use
or robust testing, that critical internal and external continuity
arrangements are effective and compatible'' as one of three
important business continuity objectives). See also supra Section
IV.B.1.b (discussing adopted Rule 1001(a)(2)(v)).
---------------------------------------------------------------------------

    In response to commenters who questioned the need for mandatory
participation by SCI entity members and participants,\1138\ the
Commission believes that current voluntary industry-led testing has
been useful because it annually brings together a wide variety of
market participants, including many SCI entities, and involves a range
of asset classes.\1139\ The current industry-led testing program
coordinated by SIFMA therefore could provide a foundation for the
development of the testing required by Rule 1004. However, because
participation rates by members and participants in voluntary testing
generally has been low, the Commission believes that a mandatory
participation requirement is the best means to achieve effective and
coordinated BC/DR testing with assured participation by the more
significant SCI entity members and participants.\1140\ In addition,
although the Commission generally agrees with the comment that ``[i]t
is vital that as many firms as possible participate in [market-wide]
testing with conditions as realistic as possible,'' \1141\ because of
the burden and costs of requiring participation by all SCI entity
members and participants, regardless of their market significance, the
Commission believes it is appropriate to adopt a more measured approach
to mandatory participation in BC/DR testing.\1142\ The Commission is
therefore adopting a BC/DR testing designation requirement that applies
to all SCI entities, but does not apply to all members and participants
of SCI entities, as discussed below.\1143\
---------------------------------------------------------------------------

    \1138\ See supra notes 1117-1122 and accompanying text.
    \1139\ See http://www.sifma.org/services/bcp/industry-testing/
(in which SIFMA describes its annual BC/DR test held annually in
October, which includes assets classes such as commercial paper,
equities, options, futures, fixed-income, settlement, payments,
Treasury auctions and market data).
    \1140\ See supra note 1123 (noting Omgeo's comment that
voluntary participation levels are low). See also Proposing Release,
supra note 13, at 18091, n. 83 and accompanying text (noting that
press reports indicated that a large number of NYSE members did not
participate in NYSE's contingency plan testing that occurred seven
months prior to Superstorm Sandy).
    \1141\ See supra note 1114 and accompanying text.
    \1142\ In addition, because the Commission recognizes that the
coordination of such testing is complex and time-consuming, it has
provided for a compliance date for the coordination requirement of
Rule 1004(d) that is 12 months after the compliance date required
for other provisions of Regulation SCI. See Section IV.F.
    \1143\ In response to commenters seeking clarification on the
types of systems that would be subject to the mandatory testing
requirement (see supra notes 1124-1125 and accompanying text),
because the required testing is BC/DR testing, all systems necessary
for an SCI entity to successfully activate it BC/DR plan would be
included.
---------------------------------------------------------------------------

ii. SCI Entity Designation of Members or Participants for Participation
in BC/DR Testing--Rules 1004(a)-(c)
    Several commenters raised concerns about the proposed requirement
that SCI entities exercise discretion to designate members or
participants for participation in coordinated BC/DR testing under
proposed Rule 1000(b)(9).\1144\ After careful consideration of the
views of commenters, the Commission is adopting the requirement that
SCI entities designate certain members or participants to participate
in testing BC/DR plans with certain modifications from the proposal. As
proposed, the rule would have required each SCI entity to designate
those members or participants it ``deems necessary, for the maintenance
of fair and orderly markets in the event of the activation of its
business continuity and disaster recovery plans . . .'' The Commission
has determined instead to require that each SCI entity designate those
members or participants ``that the SCI entity reasonably determines
are, taken as a whole, the minimum necessary for the maintenance of
fair and orderly markets in the event of the activation of such
plans.'' This change is broadly consistent with the suggestion of one
commenter to revise the criteria for designation to those firms
``critical to the operation of the SCI entity.'' \1145\ However, the
Commission believes that the adopted standard is more appropriate in
that it focuses on the ability of the SCI entity to maintain fair and
orderly markets under its BC/DR plan.\1146\
---------------------------------------------------------------------------

    \1144\ See NYSE Letter at 33; FIF Letter at 6-7; Omgeo Letter at
26; Fidelity Letter at 6; and Angel Letter at 10.
    \1145\ See ISE Letter at 9.
    \1146\ As discussed more fully in Section IV.B.6.b.iv infra, the
Commission also believes that the adopted standard could, but would
be unlikely to, cause members or participants to elect to withdraw
from participation in an SCI entity (particularly a smaller SCI
entity) to save on the cost of connectivity fees.
---------------------------------------------------------------------------

    Several commenters suggested eliminating SCI entity discretion and
setting forth in the rule clear, objective criteria (such as trading
volume) for which members or participants would be required to
participate in testing.\1147\ One commenter suggested that the
Commission require that all members or participants that represent a
meaningful percentage of the volume in the marketplace participate in
the testing in order to capture the more significant market
participants, while recognizing the financial burden such testing may
pose for smaller entities.\1148\ This commenter believed that giving
discretion to SCI entities in this area might lead to regulatory
arbitrage and a race to the bottom regarding how many and which members
or participants are designated to participate in testing.\1149\ On the
other hand, another commenter commented that the discretion
contemplated by the proposal keeps the rule flexible enough to
accommodate SCI entities conducting a diverse range of business
activities.\1150\ This commenter also suggested that SCI entities
should not be required to report to the Commission who they have
designated to test, and instead should only be required to keep a
record of who they have designated.\1151\
---------------------------------------------------------------------------

    \1147\ See NYSE Letter at 33; Omgeo Letter at 26; Angel Letter
at 10; and FIF Letter at 6.
    \1148\ See NYSE Letter at 33.
    \1149\ See NYSE Letter at 33.
    \1150\ See CME Letter at 12.
    \1151\ See id. at 13.
---------------------------------------------------------------------------

    In response to commenters who were concerned about the
discretionary aspect of the designation requirement,\1152\ the
Commission believes the SCI entity is in the best position to determine
which of its members or participants collectively represent sufficient
liquidity for the SCI entity to maintain fair and orderly markets in a
BC/DR scenario following a wide-scale disruption. The Commission
believes such determinations require the exercise of reasonable
judgment by each SCI entity, and are not well-suited for a ``one-size-
fits-all'' objective measure determined by the Commission. For example,
if the Commission were to establish an objective measure (e.g., based
on a specified percentage of trading volume),

it might represent a meaningful percentage for some SCI entities, but
not for others. Thus, the rule requires that each SCI entity establish
standards for the designation of those members or participants that the
SCI entity ``reasonably'' determines are, taken as a whole, the minimum
necessary for the maintenance of fair and orderly markets in the event
of the activation of its BC/DR plans. This adopted provision is in lieu
of the proposed requirement, which would have required an SCI entity to
designate those members or participants it ``deems necessary'' for the
maintenance of fair and orderly markets in the event of the activation
of its BC/DR plans. Because the adopted rule requires an SCI entity's
determination to be reasonable, it provides some degree of flexibility
to SCI entities but also imposes a check on SCI entity discretion,
which the Commission believes should help prevent an SCI entity's
designations from being overly limited. In response to concerns that a
discretionary designation requirement would lead to regulatory
arbitrage and a race to the bottom regarding how many and which members
or participants are designated to participate in testing, the
Commission believes that this is unlikely to occur because each SCI
entity will be subject to the same requirement and will be required to
make a reasonable determination that the designated members or
participants are those that are the minimum necessary for it to
maintain fair and orderly markets in the event of activation of its BC/
DR plans. Further, the Commission believes that broad participation in
BC/DR testing will enhance the utility of the testing, and that
allowing non-designated members or participants the opportunity to
participate in such testing generally will further this goal.
Therefore, the Commission encourages SCI entities to permit non-
designated members or participants to participate in the testing of the
SCI entity's BC/DR plans if they request to do so.
---------------------------------------------------------------------------

    \1152\ See supra notes 1144, 1147-1149 and accompanying text.
---------------------------------------------------------------------------

    Consistent with the recommendation of one commenter, however, the
Commission has determined not to require that each SCI entity notify
the Commission of its designations and its standards for designation on
Form SCI as proposed. Instead, an SCI entity's standards, designations,
and updates, if applicable, would be part of its records and therefore
available to the Commission and its staff upon request.\1153\ Unlike de
minimis systems disruptions and de minimis systems intrusions, which
may occur with regularity (and for which a quarterly summary report
would aid Commission oversight of systems whose proper functioning is
central to the maintenance of fair and orderly markets), the
establishment of standards for designation, the designations
themselves, and updates to such standards or designations are likely to
occur less frequently. Thus, the Commission believes it is sufficient
for the Commission to review records relating to such designations when
the Commission determines that it is necessary to do so to fulfill its
oversight role, such as during its examination of an SCI entity.\1154\
More broadly, the Commission believes this revision is generally
consistent with modifications that the Commission has made in response
to comment that proposed Regulation SCI would have required unnecessary
and burdensome notice and reporting submissions.
---------------------------------------------------------------------------

    \1153\ See infra Section IV.C.1 (discussing SCI entity
recordkeeping requirements).
    \1154\ See supra Sections IV.A.3 and IV.B.3.c (discussing the
rationale for quarterly reporting of de minimis systems disruptions
and de minimis systems intrusions).
---------------------------------------------------------------------------

    Some commenters questioned whether many SCI entities, particularly
non-SROs and ATSs, have the authority to require their members or
participants to participate in such testing.\1155\ Another commenter
more generally stated that it was unclear how an SCI entity could
enforce a requirement that its customers engage in BC/DR testing.\1156\
In response to these comments, the Commission believes that SCI SRO
rulemaking authority and non-SRO contractual arrangements would enable
SCI entities to implement this requirement.\1157\ Specifically, SROs
have the authority, and legal responsibility, under Section 6 of the
Exchange Act, to adopt and enforce rules (including rules to comply
with Regulation SCI's requirements relating to BC/DR testing)
applicable to their members or participants that are designed to, among
other things, foster cooperation and coordination with persons engaged
in regulating, clearing, settling, processing information with respect
to, and facilitating transactions in securities, to remove impediments
to and perfect the mechanism of a free and open market and a national
market system, and, in general, to protect investors and the public
interest.\1158\ Further, SCI entities that are not SROs have the
ability to include provisions in their contractual agreements with
their participants (such as their subscriber or participant agreements)
requiring such parties to engage in BC/DR testing.
---------------------------------------------------------------------------

    \1155\ See Omgeo Letter at 26; MSRB Letter at 24; BIDS Letter at
8; LiquidNet Letter at 4; and SIFMA Letter at 17. See also ITG
Letter at 15-16.
    \1156\ See SIFMA Letter at 17-18 (suggesting that the Commission
instead adopt a ``BCP testing requirement more akin to the `best
practices' described in the Interagency White Paper'').
    \1157\ While some designated members or participants of SCI
entities might choose to withdraw from membership or participation
in an SCI entity if they assess the cost of participating in BC/DR
testing to be too great, the Commission believes that other aspects
of their involvement with the SCI entity, including an interest in
maintaining a profitable business relationship, will factor
significantly into any decision regarding their continued membership
or participation in the SCI entity. See also infra Sections VI.C.1.c
and VI.C.2.b.vii (discussing competition between SCI entities and
non-SCI entities in relation to the requirements under Rule 1004).
    \1158\ See Section 6 of the Exchange Act, 15 U.S.C. 78f.
---------------------------------------------------------------------------

    Other commenters focused on the potential impact of the rule on the
members or participants designated to participate in testing. One
commenter pointed out that, without clearly defined industry level
coordination, some members or participants may be overburdened by being
subject to multiple individual tests with various SCI entities.\1159\
Another commenter asked the Commission to clarify what the obligation
is for firms that are members or participants at multiple SCI
entities.\1160\ Several commenters expressed concern that the
Commission underestimated the costs and burdens of the proposed
testing.\1161\ According to some of these commenters, under the
proposal, certain firms, such as market makers and other firms
performing important market functions, could be required to maintain
connections to the backup sites of a number of SCI entities, at
significant cost.\1162\ A group of commenters requested that the scope
be targeted to only cover those instances in which an SCI entity
determines to enact its disaster recovery plans.\1163\ One commenter
agreed that the designation requirement could be relaxed and still
achieve the provision's aim, because the bulk of the liquidity at a
market center is provided by a small number of firms.\1164\ Another
commenter asked the Commission to give designated firms the

ability to opt-out if they have a good reason.\1165\
---------------------------------------------------------------------------

    \1159\ See OCC Letter at 18.
    \1160\ See DTCC Letter at 13.
    \1161\ See FINRA Letter at 37-39; OCC Letter at 18; Fidelity
Letter at 6; Joint SROs Letter at 15-16; ISE Letter at 9; and Group
One Letter at 3. See also infra Section VI (discussing the costs and
burdens of the requirement, including the costs for members or
participants to participate in BC/DR testing).
    \1162\ See FINRA Letter at 37-39; OCC Letter at 18; and Fidelity
Letter at 6 (expressing concern an SCI entity might cast a wide net
with its designation powers to include more firms than necessary).
    \1163\ See Joint SROs Letter at 16 (noting the complexity of
testing a scenario in which a market participant may have enacted
its business continuity plan but can still access an SCI entity
through the primary facility).
    \1164\ See Tellefsen Letter at 9.
    \1165\ See Fidelity Letter at 6.
---------------------------------------------------------------------------

    The Commission believes that adoption of a more focused designation
requirement that requires SCI entities to exercise reasonable
discretion to identify those members or participants that, taken as a
whole, are the ``minimum necessary'' for the maintenance of fair and
orderly markets in the event of the activation of such plans is likely
to result in a smaller number of SCI entity members or participants
being designated for participation in testing as compared to the SCI
Proposal. Because the Commission believes that SCI entities have an
incentive to limit the imposition of the cost and burden associated
with testing to the minimum necessary to comply with the rule, it also
believes that, given the option, most SCI entities would, in the
exercise of reasonable discretion, prefer to designate fewer members or
participants to participate in testing, than to designate more. On
balance, the Commission believes that adopted rule will incentivize SCI
entities to designate those members and participants that are in fact
the minimum necessary for the maintenance of fair and orderly markets
in the event of the activation of their BC/DR plans, and that this
should reduce the number of designations to which any particular member
or participant would be subject, as compared to the SCI Proposal, and
would potentially simplify efforts for SCI entities to coordinate BC/DR
testing, as required by adopted Rule 1004(d). Despite the modifications
from the proposal, it remains possible, as some commenters noted, that
firms that are members of multiple SCI entities will be the subject of
multiple designations, and that multiple designations could require
certain firms to maintain connections to and participate in testing of
the backup sites of multiple SCI entities. The Commission believes this
possibility, though real, may be mitigated by the fact that multiple
designations are likely to be made to firms that are already connected
to one or more SCI entity backup facilities, since they represent
significant members or participants of the applicable SCI entities; and
that, because some SCI entity backup facilities are located in close
proximity to each other, multiple connections to such backup facilities
may be less costly than if SCI entity backup facilities were not so
located. The Commission recognizes that there will be greater costs to
a firm being designated by multiple SCI entities to participate in the
testing of their BC/DR plans than to a firm designated by only one SCI
entity. However, the Commission believes that these greater costs are
warranted for such firms, as they represent significant participants in
each of the SCI entities for which they are designated, and their
participation in the testing of each such SCI entity's BC/DR plans is
necessary to evaluate whether such plans are reliable and effective.
The designation of a firm to participate in the BC/DR testing of an SCI
entity means that such firm is significant, as the SCI entity has
reasonably determined it to be included in the set of its members or
participants that is, ``taken as a whole, the minimum necessary for the
maintenance of fair and orderly markets in the event of the activation
of such plans.'' Nonetheless, the Commission acknowledges that there
may be instances in which an SCI entity has reasonably designated a
firm to participate in BC/DR testing, and the firm is unwilling to bear
the cost of participation in BC/DR testing with a given SCI entity. In
such instances, there may be firms that opt out of such testing by
withdrawing as a member or subscriber of one or more SCI entities, but
the Commission believes that is unlikely. In particular, the Commission
believes that it is unlikely that a firm determined to be significant
enough to be designated to participate in testing by an SCI entity
would choose to withdraw its membership or participation in an SCI
entity solely because of the costs and burdens of Regulation SCI's BC/
DR testing provisions. The Commission also believes that such firm is
likely to be a larger firm with greater resources and a significant
level of participation in such SCI entity, and is likely to already be
connected to the backup facility of the SCI SRO that is designating it
to test.\1166\ Moreover, the Commission does not agree with the
suggestion made by one commenter that the Commission give designated
firms the ability to ``opt-out'' if they have a good reason,\1167\
because the ability to opt-out in this manner would render
participation in BC/DR testing voluntary which, as discussed above, is
unlikely to result in adequate BC/DR testing.\1168\ The Commission
continues to believe, as stated in the SCI Proposal, that ``unless
there is effective participation by certain of its members or
participants in the testing of [BC/DR] plans, the objective of ensuring
resilient and available markets in general, and the maintenance of fair
and orderly markets in particular, would not be achieved.'' \1169\
Although the Commission recognizes that testing of a BC/DR plan does
not guarantee flawless execution of that plan, the Commission believes
that a tested plan is likely to be more reliable and effective than an
inadequately tested plan.\1170\
---------------------------------------------------------------------------

    \1166\ See infra Section IV.B.6.b.iv.
    \1167\ See Fidelity Letter at 6.
    \1168\ See supra note 1140 and accompanying text.
    \1169\ See Proposing Release, supra note 13, at 18091, 18125.
    \1170\ Further, because the Commission believes that increased
participation in BC/DR testing is likely to enhance the utility of
the testing, the Commission encourages SCI entities to permit
members or participants that do not meet the SCI entity's reasonable
designation standards to participate in such testing if they request
to do so.
---------------------------------------------------------------------------

iii. Scope, Timing, and Frequency of BC/DR Testing--Rule 1004(b)
    The SCI Proposal specified that the type of testing for which
designees would be required to participate was ``scheduled functional
and performance testing of the operation of [BC/DR] plans, in the
manner and frequency specified by the SCI entity, at least once every
12 months.'' \1171\ After careful consideration of the views of
commenters, the Commission is adopting the scope, frequency, and timing
requirements in the rule as proposed. Specifically, adopted Rule
1004(b) requires that an SCI entity's designees participate in
``scheduled functional and performance testing of the operation of [BC/
DR] plans, in the manner and frequency specified by the SCI entity,
provided that such frequency shall not be less than once every 12
months.''
---------------------------------------------------------------------------

    \1171\ See proposed Rule 1000(b)(9)(i).
---------------------------------------------------------------------------

    In the SCI Proposal, the Commission noted that functional testing
is commonly understood to examine whether a system operates in
accordance with its specifications, whereas performance testing
examines whether a system is able to perform under a particular
workload.\1172\ The Commission added that functional and performance
testing should include not only testing of connectivity, but also
testing of an SCI entity's systems, such as order entry, execution,
clearance and settlement, order routing, and the transmission and/or
receipt of market data, as applicable, to determine if they can operate
as contemplated by its business continuity and disaster recovery
plans.\1173\ With regard to the proposed scope of testing, several
commenters expressed specific concerns about the requirement for
``functional and performance'' testing of BC/DR

plans.\1174\ Specifically, one commenter expressed concern about the
logistical challenges of conducting functional and performance testing
at the same time.\1175\ Two commenters expressed concern that requiring
firms to perform industry-wide, end-to-end testing by processing
transactions in their disaster recovery systems would introduce risk to
the markets because such testing would increase the chance that test
transactions could inadvertently be introduced into production
systems.\1176\ Another commenter stated that a full functional test
across all primary and recovery data centers for any significant number
of members or participants would require substantial time to conduct
and may require market downtime, as would a full performance
test.\1177\ One group of commenters suggested that the scope of the
requirement should be revised to only cover ``functional and
operational testing'' of disaster recovery plans, but requested
additional guidance with regard to the scope of testing required to
establish the effectiveness of disaster recovery plans.\1178\ This
group of commenters expressed concern about the ``complexity and cost
associated with establishing an effective coordinated test script that
captures the significant number of possibilities that may occur to each
significant market participant or SCI entity'' and recommended that the
scope of the coordinated functional and operational testing
requirements be revised to cover those instances in which an SCI entity
determines to enact its disaster recovery plan.\1179\ Two commenters
believed the tests should be ``scenario-based'' to recreate as closely
as possible the actual conditions that would trigger widespread use of
BC/DR plans.\1180\
---------------------------------------------------------------------------

    \1172\ See Proposing Release, supra note 13, at 18125, n. 267.
    \1173\ See id. at 18126.
    \1174\ See, e.g., FINRA Letter at 37; OCC Letter at 18; and DTCC
Letter at 12.
    \1175\ See FINRA Letter at 37 (stating that combining
performance testing with functional testing on weekends would be
difficult and possibly not feasible because an end-to-end functional
test combined with a stress test would require much more time to
accommodate processing volumes than would be afforded in an
abbreviated non-business day session).
    \1176\ See OCC Letter at 17-18 (stating that its systems and
systems of many member firms are configured to prevent test activity
from being processed by production or disaster recovery systems);
and DTCC Letter at 12 (stating similarly that the testing proposed
by Rule 1000(b)(9) (as opposed to communication and connectivity
testing) would not be supported by most SCI entities' current
systems configurations, and encouraging the Commission to consider
this in adopting testing requirements).
    \1177\ See Omgeo Letter at 26-27. This commenter urged a more
limited scope of testing. Specifically, this commenter urged the
Commission to focus on ``smoke testing,'' which it characterized as
a more limited form of testing to validate that system functionality
is fully deployed and operational in the new recovered or resumed
production environment, and with respect to the goals of performance
testing, a more limited set of system operations to assure that the
recovery system would perform those operations at roughly comparable
speeds as those performed on the main production systems. This
commenter further stated that, in both cases, the purpose of these
tests would be to validate that the backup or recovery systems have