Some commenters also questioned the Commission's legal authority to
require Commission notification of material systems changes.\834\ As
discussed in more detail below, the material systems change reports are
intended to make the Commission and its staff aware of significant
systems changes at SCI entities, and thereby improve Commission
oversight of U.S. securities market infrastructure, which directly
furthers the findings and objectives set forth in Section 11A(a)(1) of
the Exchange Act.\835\ The Commission believes that the adopted
material systems change notification requirement will allow the
Commission to more efficiently and effectively participate in
discussions with SCI entities when systems issues occur and will allow
Commission staff to effectively prepare for inspections and
examinations of SCI entities. Moreover, Rule 1003(a), as adopted,
differs significantly from the proposed requirements as it no longer
requires 30-day advance notification, but rather requires quarterly
reports of material systems changes. As such, the requirement is
designed not to result in ``close, minute regulation of computer
systems and computer security.'' \836\ Additionally, the Commission
notes that Regulation SCI does not provide for a new review or approval
process for SCI entities' material systems changes.\837\
---------------------------------------------------------------------------

    \834\ See infra note 1046 and accompanying text.
    \835\ See infra Section IV.B.4 (discussing the requirement to
notify the Commission of material systems changes).
    \836\ See infra note 1046.
    \837\ As noted below in Section IV.B.4, Commission staff will
not use material systems change reports to require any approval of
prospective systems changes in advance of their implementation
pursuant to any provision of Regulation SCI, or to delay
implementation of material systems changes pursuant to any provision
of Regulation SCI.
---------------------------------------------------------------------------

Immediate Commission Notification--Proposed Rule 1000(b)(4)(i)
    Commenters also specifically discussed proposed Rule 1000(b)(4)(i)
regarding reporting to the Commission on immediate notification SCI
events. One commenter stated that it generally supported the immediate
notification requirement of proposed Rule 1000(b)(4)(i) in the case of
material SCI events,\838\ but other commenters were critical.\839\ For
example, some commenters stated that the Commission should adopt a
materiality threshold which would only require an SCI entity to
immediately report material SCI events.\840\ Similarly, one group of
commenters suggested a tiered method that would reserve immediate
notification to the Commission for truly critical events ``where the
Commission's input would contribute to an expedient resolution,'' while
requiring SCI entities to have written policies and procedures that
focus the SCI entity's attention primarily on taking corrective
measures during an SCI event and maintaining records to provide
information to the Commission and members and participants as
appropriate.\841\ Two commenters suggested that different reporting
standards should apply to different types of systems, suggesting, for
example, that immediate notification should be required only for higher
priority systems.\842\
---------------------------------------------------------------------------

    \838\ See MSRB Letter at 18.
    \839\ See, e.g., NYSE Letter at 22.
    \840\ See SIFMA Letter at 13; FIF Letter at 4; ITG Letter at 12;
NYSE Letter at 23; FINRA Letter at 10, 22; and OCC Letter at 13. One
commenter stated that, in considering factors that would determine
whether or not an SCI event is material, the Commission should
consider the overall market disruption caused by the SCI event, the
length of the event, the financial impact of the event, and the
inability to meet core regulatory obligations regarding order
handling and execution activities. See ITG Letter at 13. Similarly,
two commenters stated that, with respect to systems compliance
issues or systems intrusions, immediate notification SCI events
should be limited to systems compliance issues or systems intrusions
that the SCI entity reasonably estimates would have a material
impact on its operations or on market participants. See MSRB Letter
at 18; and Omgeo Letter at 15. Further, in the case of intrusions,
one commenter stated that notifications could also include
intrusions that would cause a malicious unauthorized access to
confidential data, but recommended that other types of intrusions be
subject to recordkeeping. See Omgeo Letter at 15. One group of
commenters supported implementing a materiality threshold for
systems compliance issues, which it stated should be based on
factors such as the number of members affected, financial impact and
operation impact, and these guidelines should be articulated in the
SCI entities' policies and procedures. See Joint SROs Letter at 9.
    \841\ See Joint SROs Letter at 10.
    \842\ See FINRA Letter at 22 (suggesting, for example, that
immediate Commission notification should not be required for SCI
events that occur in systems that do not provide real-time data to
the market); and SIFMA Letter at 13 (stating that that lower
priority systems should only be reported on an aggregate and
periodic basis).
---------------------------------------------------------------------------

    One commenter questioned the adequacy of the Commission's asserted
basis and purpose for requiring notification for the vast majority of
SCI events.\843\ In this commenter's view, the Commission's asserted
rationale for the Commission notification requirement \844\ would only
support requiring immediate notification for a limited number of SCI
events, where the Commission's involvement is necessary.\845\ For other
SCI events, in which the Commission would only be gathering and
analyzing submitted information, the commenter stated that the
Commission's rationale for requiring immediate notification is
insufficient.\846\
---------------------------------------------------------------------------

    \843\ See NYSE Letter at 21-22.
    \844\ See Proposing Release, supra note 13, at 18119.
    \845\ See NYSE Letter at 22; see also Joint SROs Letter at 10.
    \846\ See NYSE Letter at 22.
---------------------------------------------------------------------------

    Some commenters addressed the use of the term ``immediately'' in
the proposed rule. One commenter characterized the proposed immediate
reporting requirements as rigid, and questioned why reporting could not
occur ``promptly'' with follow-up as reasonably requested by the
Commission staff.\847\ Another commenter stated that immediate
notification is unrealistic and predicted

that it could trigger an innumerable amount of false alarms.\848\
---------------------------------------------------------------------------

    \847\ See BATS Letter at 12.
    \848\ See Direct Edge Letter 8.
---------------------------------------------------------------------------

    Other commenters addressed SCI events that occur outside of normal
business hours. Two commenters believed that an SCI entity should not
be required to notify the Commission of an SCI event outside of normal
business hours.\849\ Other commenters stated that material events
should require immediate notification to the Commission, but all other
types of events should be reported by the next business day.\850\
---------------------------------------------------------------------------

    \849\ See FINRA Letter at 21; and BATS Letter at 12. FINRA also
stated that an SCI entity should have one full business day to
report an SCI event.
    \850\ See, e.g., DTCC Letter at 9 (stating that, outside of
normal business hours, an SCI entity should only be required to
notify the Commission of the most critical events; i.e., those with
the potential to impact the core functions and critical operations
of the SCI entity); and OCC Letter at 14 (stating that when an event
is material because it could have a market-wide impact or impact the
core functions of an SCI entity, immediate notification should be
required even outside of normal business hours, but all other SCI
events should be reported no later than the next business day).
---------------------------------------------------------------------------

    One commenter stated that immediate notification of an SCI event
may be difficult where an SCI entity uses a third party to operate its
systems, and therefore believed that an SCI entity should not be
responsible for reporting an SCI event caused by a third party unless
there is a material impact to the market or the SCI entity's ability to
meet its service level agreements.\851\ This commenter stated that the
rule should permit SCI entities flexibility on how to address third
party issues and requested further guidance from the Commission in this
area.\852\
---------------------------------------------------------------------------

    \851\ See FINRA Letter at 22; see also supra Section IV.A.2.b
(discussing the definition of ``SCI systems'' as it relates to third
parties).
    \852\ See FINRA Letter at 22.
---------------------------------------------------------------------------

Immediate Notification of SCI Events: Adopted Rule 1002(b)(1)
    Adopted Rule 1002(b)(1) requires each SCI entity to notify the
Commission of an SCI event immediately upon any responsible SCI
personnel having a reasonable basis to conclude that an SCI event has
occurred (unless it is a de minimis SCI event). Such notification may
be provided orally (e.g., by telephone) or in writing (e.g., by email
or on Form SCI). Although many commenters were critical of the
immediate notification provision, Rule 1002(b)(1) substantially retains
the requirements of proposed Rule 1000(b)(4)(i), but is modified in
certain respects in response to comments.
    The Commission has considered the views of commenters who stated
that the Commission should require immediate notification only for
material SCI events, or when Commission involvement would contribute to
an expedient resolution.\853\ Given the Commission's oversight
responsibilities over SCI entities and the U.S. securities market
generally, the notification rule is not intended to be limited to
instances in which SCI entities might believe that it would be useful
for the Commission to provide input. SCI event notifications also serve
the function of providing the Commission and its staff with information
about the potential impact of an SCI event on the securities markets
and market participants more broadly, which potential impacts may not
be readily apparent or important to the SCI entity reporting such an
event. Moreover, the Commission believes that there will be instances
in which an SCI entity will not know the significance of an SCI event
at the time of the occurrence of an event, or whether such event (or,
potentially, the aggregated impact of several SCI events occurring, for
example, across many SCI entities) will warrant the Commission's input
or merit the Commission's awareness, nor does the Commission believe it
should be solely within an SCI entity's discretion to make such a
determination. And SCI entities retain the flexibility to revise their
initial assessments should they subsequently determine that the event
in question was incorrectly initially assessed to be a de minimis event
(or incorrectly initially assessed to not be a de minimis event).
Consequently, the Commission does not agree with commenters who stated
that only material SCI events should be reported to the Commission
immediately.\854\
---------------------------------------------------------------------------

    \853\ See supra notes 838-846 and accompanying text.
    \854\ See, e.g., supra note 842 and accompanying text.
---------------------------------------------------------------------------

    The Commission has also considered comments that the term
``immediately'' as used in proposed Rule 1000(b)(4) is rigid and
unrealistic.\855\ The Commission, in adopting Rule 1002(b), has
retained the requirement that SCI entities must notify the Commission
immediately; however, as discussed in detail above,\856\ the triggering
standard has been modified so that the notification obligations of Rule
1002(b) are triggered only upon any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred. The
Commission believes this modification responds to commenters concerns
that the ``immediate'' reporting requirement is too rigid or would pose
practical difficulties, as it allows additional time for escalation to
senior SCI entity personnel and for the performance of preliminary
analysis and assessment regarding whether an SCI event has, in fact,
occurred before requiring notification to the Commission. As such, the
Commission believes that the immediate notification requirement of Rule
1002(b)(1) will not unduly cause ``false alarms,'' as one commenter
stated.\857\ At the same time, the Commission believes that the
immediate notification requirement, as adopted, will help ensure that
the Commission and its staff are kept apprised of SCI events after they
occur, and as their impact unfolds and is mitigated and, ultimately, as
the SCI entity engages in corrective action to resolve the SCI events.
Additionally, the Commission notes that immediate notifications made
pursuant to Rule 1002(b)(1) may be made orally (e.g., by telephone) or
in a written form (e.g., by email or on Form SCI).\858\ The Commission
notes that, by not prescribing the precise method of communication for
an immediate notification, SCI entities are afforded the flexibility to
determine the most effective and efficient method to communicate with
the Commission.
---------------------------------------------------------------------------

    \855\ See supra note 847 and accompanying text.
    \856\ See supra Section IV.B.3.a (discussing the triggering
standard).
    \857\ See supra note 848 and accompanying text. The Commission
notes that, if an SCI entity at some point after submitting an
immediate notification concludes after further investigation and
analysis that it was incorrect in its initial determination that an
SCI event had occurred, the SCI entity should alert the Commission
of its updated assessment pursuant to Rule 1002(b)(3). Relatedly,
Rule 1002(b) is designed to provide SCI entities flexibility in
notifying the Commission of the details regarding an SCI event (for
example, through the ability to provide the Rule 1002(b)(2) written
notification on a good faith, best efforts basis) and time to assess
and analyze the SCI event (for example, by requiring that the Rule
1002(b)(2) written notification only provide a description of the
SCI event, including the system(s) affected, and with additional
information only required to the extent available at that time).
    \858\ The Commission notes that, prior to the compliance date of
Regulation SCI, Commission staff intends to notify SCI entities of
the email addresses, phone numbers, and contact persons that SCI
entities should use when notifying the Commission of SCI events
under Rule 1002(b).
---------------------------------------------------------------------------

    The Commission has also considered comments that immediate
notification should not be required outside of normal business hours,
or that it should only be required outside of normal business hours in
the case of material SCI events.\859\ The Commission notes that the
adopted rule will afford SCI entities considerable flexibility in how
to communicate an immediate notification to the Commission--that is,
SCI entities may satisfy the immediate

notification requirement simply by communicating with the Commission
via telephone or email. In addition, because an SCI entity's obligation
to report to the Commission is not triggered until responsible SCI
personnel has a reasonable basis to conclude that an SCI event has
occurred,\860\ the Commission does not believe that timely
notification, even outside of normal business, is so onerous that it
necessitates allowing a full business day to comply. Particularly
because it has determined to exclude de minimis SCI events from the
immediate notification requirement, the Commission believes that it is
reasonable to require that an SCI event (except those specified in Rule
1002(b)(5)) be reported to the Commission orally (e.g., by telephone)
or in writing (e.g., by email or on Form SCI) when responsible SCI
personnel have a reasonable basis to conclude that an SCI event has
occurred, even if such communication may be outside of normal business
hours. Because the rule provides flexibility to more easily enable
communication--by permitting oral notification--of the fact of an SCI
event to the Commission, and because only non-de minimis SCI events are
subject to this requirement, the Commission believes notice to the
Commission is appropriate sooner rather than later. In addition, as
discussed above, the Commission believes that there may be situations
where the severity of an SCI event may not be immediately apparent to
an SCI entity experiencing the event, but the Commission, from its
unique position, may determine as a result of receiving multiple
immediate notifications, each related to an SCI event of a similar
nature, that the SCI event is part of a pattern of a larger, more
significant occurrence. The Commission is therefore adopting Rule
1002(b) to require that an SCI entity notify the Commission of an SCI
event immediately upon any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred, without an
exception for periods outside of normal business hours.
---------------------------------------------------------------------------

    \859\ See, e.g., supra notes 849 and 794-797 and accompanying
text.
    \860\ See supra Section IV.B.3.a (discussing the triggering
standard).
---------------------------------------------------------------------------

    In addition, as noted above, the information submitted to the
Commission pursuant to Regulation SCI will be treated as confidential,
subject to applicable law \861\ and, as noted in Sections IV.B.1.b.i
and IV.B.2.a, the occurrence of an SCI event does not necessarily mean
that an SCI entity has violated Regulation SCI.
---------------------------------------------------------------------------

    \861\ See supra note 674.
---------------------------------------------------------------------------

    The Commission disagrees with the commenter who stated that the
Commission should not require SCI entities to be responsible for
reporting an SCI event caused by a third party because immediate
notification would be difficult.\862\ An SCI event, whether or not
caused by a third party system, by definition relates to an SCI system
or indirect SCI system. As explained in Section IV.A.2 above
(discussing the definitions of ``SCI systems'' and ``indirect SCI
systems''), the Commission has adopted the definition of SCI systems to
include, specifically, those systems of SCI entities that would be
reasonably likely to impact the protection of investors and the
maintenance of fair and orderly markets and an SCI entity's operational
capability, and has not excluded third party systems from the
definition. As stated above, if an SCI entity is uncertain of its
ability to manage a third-party relationship to satisfy the
requirements of Regulation SCI, then it would need to reassess its
decision to outsource the applicable system to such third party.\863\
---------------------------------------------------------------------------

    \862\ See supra notes 851-852 and accompanying text.
    \863\ See supra note 260 and accompanying text.
---------------------------------------------------------------------------

    In response to comment that SCI entities would be required to
provide notification reports multiple times to different Commission
staff for the same event,\864\ the Commission notes that rule does not
include such a requirement. In addition, the Commission also disagrees
with the commenter who stated that, for systems disruptions,
notifications should not be required from each separate entity where a
disruption impacts multiple SCI entities.\865\ Excusing immediate
notification where a given event seems to be affecting multiple SCI
entities would not be appropriate because the Commission, as the
centralized receiver of notifications, will be the entity that will be
in a position to determine whether, in fact, SCI entities are
concurrently experiencing the same SCI event. Moreover, even if a given
event affects multiple SCI entities, it may be the case that the event
impacts each SCI entity and the affected systems in a different manner,
and thus the Commission believes it is important to receive individual
notifications from each affected SCI entity.
---------------------------------------------------------------------------

    \864\ See, e.g., supra note 805 and accompanying text.
    \865\ See, e.g., id.
---------------------------------------------------------------------------

Written Commission Notification: Proposed Rule 1000(b)(4)(ii)
    Commenters also specifically discussed and suggested alternatives
to proposed Rule 1000(b)(4)(ii), which would have required an SCI
entity, within 24 hours of any responsible SCI personnel becoming aware
of any SCI event, to submit a written notification pertaining to such
SCI event to the Commission. Many commenters stated that the proposed
24-hour time frame was too short or burdensome.\866\ Several commenters
specifically suggested that the Commission extend the time frame to
allow SCI entities to attend to the SCI event without also devoting
resources to notifying the Commission, suggesting different time frames
they believed to be appropriate.\867\ One commenter suggested that SCI
entities be given until 24 to 48 hours after final resolution of the
SCI event to submit a written notification.\868\ Another commenter
similarly recommended that, where real-time notification is needed,
written notification should not be required unless an SCI event remains
unresolved after a reasonable period (such as 10 or 15 days).\869\
---------------------------------------------------------------------------

    \866\ See NYSE Letter at 23; FINRA Letter at 19; BATS Letter at
12; DTCC Letter at 9; MSRB Letter at 18; SIFMA Letter at 13; FIF
Letter at 5; BIDS Letter at 10; Omgeo Letter at 17; and CME Letter
at 9.
    \867\ Commenters suggested time frames of 48 hours (CME Letter
at 9); 72 hours (OCC Letter at 12; DTCC Letter at 9, 11 (noting,
however, that details surrounding an SCI event should not be
required to be provided in writing until after the investigation of
the event is complete and the event has been resolved)); and five
business days (BIDS Letter at 10).
    \868\ See FINRA Letter at 20. This commenter further suggested
that, if an SCI event has not been fully resolved within a
reasonable period, e.g.,10 or 15 days, an SCI entity could be
required to submit written notification based on currently available
information at the end of that period, with periodic status updates
via telephone or email, and a final written submission within 24 to
48 hours after the event has been fully resolved.
    \869\ See SIFMA Letter at 14.
---------------------------------------------------------------------------

    Some commenters also suggested that, if the Commission retains the
24-hour requirement, it should require provision of less information.
For example, one commenter suggested that SCI entities should only be
required to provide whatever information is sufficiently reliable at
that time.\870\ Two other commenters stated that SCI entities should
not be required to include an estimate of the markets and participants

impacted by an SCI event or to quantify such impact because this
requirement may create a risk of civil liability for the SCI
entity.\871\ Another commenter recommended that the rule require only a
brief written summary that is one or two paragraphs, which could be
supplemented by oral communications and a longer summary within 15 days
after an SCI event has been fully resolved.\872\
---------------------------------------------------------------------------

    \870\ See FINRA Letter at 20. This commenter also suggested that
the rule require an SCI entity to assess the ``business impact'' of
an SCI event, noting that this information may provide more context
than requiring an SCI entity to estimate the number of market
participants impacted by an SCI event (which in some cases could be
zero, but still have a negative impact on the SCI entity). See FINRA
Letter at 30.
    \871\ See DTCC Letter at 10; and Omgeo Letter at 30. Omgeo added
that such a calculation would be difficult to compute, likely
inaccurate, and of little use to the Commission.
    \872\ See Omgeo Letter at 17.
---------------------------------------------------------------------------

    With respect to the information provided to the Commission via
notification of an SCI event, one commenter suggested that the rule
provide a safe harbor for entities and employees for either inadvertent
omissions in a submitted report, or when a good faith, documented
determination is made that no report is required.\873\ One commenter
stated that that the Commission should expressly provide that initial
written submissions are to be made on a best efforts basis and SCI
entities will incur no liability or penalty for any unintentional
inaccuracies or omissions contained in these submissions.\874\ Some
commenters stated that entities should not be liable for information
that is later found to be incomplete or inaccurate.\875\
---------------------------------------------------------------------------

    \873\ See id. at 18.
    \874\ See FINRA Letter at 20.
    \875\ See, e.g., SIFMA Letter at 14; and UBS Letter at 4
(stating that SCI entities acting in good faith should not be held
accountable if details offered in reports to the Commission are
substantially different from what is revealed by further analysis).
---------------------------------------------------------------------------

    Some commenters \876\ questioned the purpose of requiring that
information disseminated to members and participants (under proposed
Rule 1000(b)(5)) be copied and attached to Form SCI as part of
notifications to the Commission, and considered it ``an overly broad
inclusion of communications'' that would have ``a chilling effect on
communications between the SCI entities and their members and
participants,'' \877\ while another commenter argued that, when an
exchange is having a technology issue, many members may be reaching out
to the exchange's staff with requests for information and status.
Therefore, that commenter questioned the feasibility, need, and
potential impact of the proposed requirement that SCI entities provide
a copy of any information disseminated to date regarding the SCI event
to their members or participants.\878\
---------------------------------------------------------------------------

    \876\ Because the requirement to provide information
disseminated to an SCI entity's members or participants is now
included in the Final Report (Rule 1002(b)(4)) instead of with the
24-written notification requirement as proposed, the Commission's
response to these comments is discussed below in the subsection
``Final Report: Adopted Rule 1002(b)(4).''
    \877\ See Joint SROs Letter at 11.
    \878\ See Direct Edge Letter at 7-8.
---------------------------------------------------------------------------

    One commenter stated that, to reduce the cost of compliance, the
Commission should accept the same notifications of service
interruptions that an ATS already provides to its subscribers.\879\
---------------------------------------------------------------------------

    \879\ See BIDS Letter at 11.
---------------------------------------------------------------------------

    Commenters also provided suggestions for limiting the circumstances
for which 24-hour written notification would be required under proposed
Rule 1000(b)(4)(ii). One commenter stated that only SCI events that
materially impact an SCI entity's operations or market participants
should be subject to the 24-hour written notification requirement, but
questioned whether 24 hours was realistic even for those events.\880\
One commenter suggested that proposed Rule 1000(b)(4)(ii) only apply to
significant SCI events and that other events only be subject to a
recordkeeping requirement.\881\ In addition, some commenters suggested
that if an SCI entity has provided oral notification to the Commission,
it should not be required to file written notice within 24 hours after
the initial report unless reasonably requested by the Commission.\882\
---------------------------------------------------------------------------

    \880\ See MSRB Letter at 18.
    \881\ See CME Letter at 9.
    \882\ See BATS Letter at 12; and Omgeo Letter at 17. See also
DTCC Letter at 10; and OCC Letter at 14 (suggesting 72 hours to
provide written information after providing verbal notification).
---------------------------------------------------------------------------

Written Notification Within 24 Hours: Adopted Rule 1002(b)(2)
    Adopted Rule 1002(b)(2) requires an SCI entity, within 24 hours of
any responsible SCI personnel having a reasonable basis to conclude
that the SCI event has occurred, to submit a written notification
pertaining to such SCI event to the Commission. Rule 1002(b)(2) allows
for such written notifications to be made on a good faith, best efforts
basis and requires that it include: (i) A description of the SCI event,
including the system(s) affected; and (ii) to the extent available as
of the time of the notification: the SCI entity's current assessment of
the types and number of market participants potentially affected by the
SCI event; the potential impact of the SCI event on the market; a
description of the steps the SCI entity has taken, is taking, or plans
to take, with respect to the SCI event; the time the SCI event was
resolved or timeframe within which the SCI event is expected to be
resolved; and any other pertinent information known by the SCI entity
about the SCI event.
    The Commission has considered comments stating that 24 hours is too
short and burdensome a duration for an SCI entity to submit a compliant
written notification.\883\ The Commission understands commenters'
concerns that SCI entities may still be actively investigating and
working to resolve an SCI event and that information it initially
provides to the Commission about an SCI event may not ultimately prove
correct.\884\ Therefore, in line with commenters' concerns regarding a
good faith and best efforts standard,\885\ the Commission has modified
the 24-hour written notification requirement in adopted Rule 1002(b) to
make clear that the written notification should be provided on a ``good
faith, best efforts basis.'' This modification acknowledges that a
written notification provided within 24 hours may provide only a
preliminary assessment of the SCI event, that additional information
may come to light after the initial 24-hour period, and that the
initial assessment may prove in retrospect to be incorrect or
incomplete. Consequently, the adopted rule requires that the written
notification provided within 24 hours be submitted on a good faith,
best efforts basis, and does not require that the written notification
be a comprehensive or complete assessment of the SCI event (unless, of
course, an SCI entity has completed a full assessment by such time).
The Commission believes that a ``good faith'' standard will help to
ensure that SCI entities will not be accountable for unintentional
inaccuracies or omissions contained in these submissions, and a ``best
efforts'' standard will help to ensure that SCI entities will make a
diligent and timely attempt to provide all the information required by
the written notification requirement. The Commission also notes that an
SCI entity will not need to submit a written notification where an SCI
entity documents that an SCI event is determined to be a de minimis SCI
event, other than including de minimis systems disruptions and de
minimis systems intrusions in the quarterly report required by Rule
1002(b)(5). As discussed in further detail below, in the event that new
information comes to light or previously reported information is found
to be materially incorrect, adopted Rule 1002(b)(3) requires an SCI
entity to update the information at that

time, and does not require that such updates be written.\886\ The
Commission believes these modifications will help ensure that SCI
entities are able to provide the information required by Rule
1002(b)(2) within 24 hours, and therefore the Commission is not
modifying the timeframe to extend beyond 24 hours, as requested by
several commenters.\887\ Moreover, because the information need only be
provided on a good faith, best efforts basis and, pursuant to Rule
1002(b)(3), updates can be provided on a regular basis to correct any
materially incorrect information previously provided or when new
material information is discovered, the Commission disagrees with
commenters that stated that the information required by Rule 1002(b)
should be provided only after resolution of the SCI event. The
Commission continues to believe that Rule 1002(b)(2)'s requirement to
provide information to the Commission within 24 hours is appropriately
tailored to help the Commission and its staff quickly assess the nature
and the scope of an SCI event and will contribute to more timely and
effective Commission oversight of systems whose proper functioning is
central to the maintenance of fair and orderly markets, and that this
would particularly be the case for SCI events that are not yet
resolved.\888\
---------------------------------------------------------------------------

    \883\ See, e.g., supra note 866 and accompanying text.
    \884\ See supra notes 873-875 and accompanying text.
    \885\ See id.
    \886\ See infra note 909 and accompanying text.
    \887\ See supra notes 867-869 and accompanying text; and
Proposing Release, supra note 13, at 18119.
    \888\ See supra notes 868 and 872 and accompanying text.
---------------------------------------------------------------------------

    Adopted Rule 1002(b)(2) is also responsive to comments urging the
Commission to require less information in a 24-hour written
notification.\889\ Specifically, whereas proposed Rule 1000(b)(4)
required a detailed description of the SCI event, adopted Rule
1002(b)(2)(i) specifies that an SCI entity must only provide ``a
description of the SCI event, including the system(s) affected.''
Additional information is only required to the extent available as of
the time of the notification, which includes an ``SCI entity's current
assessment of the types and number of market participants potentially
affected by the SCI event; the potential impact of the SCI event on the
market; a description of the steps the SCI entity has taken, is taking,
or plans to take, with respect to the SCI event; the time the SCI event
was resolved or timeframe within which the SCI event is expected to be
resolved; and any other pertinent information known by the SCI entity
about the SCI event.'' \890\ This information is the type of necessary
information that SCI entities are able to provide in a short timeframe
and that the Commission has come, over time, to rely upon to properly
assess systems issues.
---------------------------------------------------------------------------

    \889\ See supra notes 870-872 and accompanying text.
    \890\ Rule 1002(b)(2)(ii). The information required to be
provided in Rule 1002(b)(2)(ii) is a subset of information proposed
to be required under Rule 1000(b)(4)(iv)(A)(1)-(2) of the SCI
Proposal.
---------------------------------------------------------------------------

    Additionally, the Commission notes that adopted Rule 1002(b) does
not require that an SCI entity provide the Commission, at the time of
the initial notice to the Commission, with its current assessment of
the SCI event, including a discussion of the determination of whether
it is subject to a dissemination requirement, as proposed in Rule
1000(b)(4).
    The Commission has also determined to further refine the scope of
information that needs to be reported in the 24-hour written
notification by requiring that the following items instead be included
in the final report under Rule 1002(b)(4), rather than in the 24-hour
written notification required by Rule 1002(b)(2): A description of the
SCI entity's rule(s) and/or governing document(s), as applicable, that
relate to the SCI event; and an analysis of parties that may have
experienced a loss, whether monetary or otherwise, due to the SCI
event, the number of such parties, and an estimate of the aggregate
amount of such loss.\891\
---------------------------------------------------------------------------

    \891\ At the same time, if such information is known at the time
of the notification, the SCI entity will be required to provide it
pursuant to Rule 1002(b)(2)(ii)'s requirement that the SCI entity
provide ``any other pertinent information known . . . about the SCI
event.'' Additionally, such information would be provided under the
requirement to provide the Commission with regular updates under
Rule 1002(b)(3)'s requirement to provide any of the information
listed in Rule 1002(b)(2)(ii) if it becomes available after the time
of submission of the 24-hour notification. The Commission also notes
that Rule 1002(b)(4)(ii) requires that an SCI entity include in the
final report a copy of any information disseminated pursuant to Rule
1002(c) by the SCI entity to date regarding an SCI event to any of
its members or participants.
---------------------------------------------------------------------------

    In response to commenters who suggested that the Commission limit
the events for which 24-hour written notification would be required to
material events,\892\ the Commission notes that it has partially
responded to such comments by providing an exception to the immediate
notification requirement for de minimis events in Rule 1002(b)(5). The
Commission believes that this exception should reduce the overall
number of SCI events subject to immediate notification requirements as
compared to what would have been required if the SCI Proposal was
adopted without modification and, consequently, the requirement to
submit a written notification within 24 hours of an SCI event, thereby
alleviating some of the burdens about which commenters expressed
concerns. Moreover, the Commission believes that a materiality
threshold would likely exclude from the 24-hour written notification a
large number of SCI events that are not de minimis SCI events but that
the Commission, as part of its oversight role, should be updated on so
that the Commission and its staff can quickly assess the nature and
scope of those SCI events and potentially assist the SCI entity in
identifying the appropriate response, including ways to mitigate the
impact of SCI events on investors and promote the maintenance of fair
and orderly markets. The Commission reemphasizes that the information
to be provided under the 24-hour written notification would represent
the SCI entity's preliminary assessment--performed on a good faith,
best efforts basis--of the SCI event, and only certain key information
is required under the 24-hour written notification, with ``other
pertinent information'' required only where ``known by the SCI entity''
within the 24-hour timeframe. For these reasons, the Commission has
determined not to adopt a materiality threshold for the requirement
that an SCI entity update the Commission within 24 hours after it has a
reasonable basis to conclude that an SCI event has occurred.
---------------------------------------------------------------------------

    \892\ See supra note 880 and accompanying text.
---------------------------------------------------------------------------

    Additionally, the Commission disagrees with those commenters who
stated that written notification should only be required when
reasonably requested by the Commission.\893\ The Commission believes
that it should be notified of all SCI events and that all SCI events
(other than those specified in Rule 1002(b)(5)) should be subject to
the 24-hour written notification requirement because, by articulating
in a single notification what is currently known about an SCI event and
the steps expected to be taken to respond to the SCI event, the
Commission will be better able to assess the nature and scope of, and
respond to, SCI events and potentially assist SCI entities in
identifying the appropriate response, including ways to mitigate the
impact of SCI events on investors and promote the maintenance of fair
and orderly markets.
---------------------------------------------------------------------------

    \893\ See supra note 882 and accompanying text.
---------------------------------------------------------------------------

    In response to the comment that the Commission should accept the
same notifications of service interruptions that an ATS provides to its

subscribers,\894\ the Commission believes that SCI ATSs can use the
types of information contained in ATS notices to subscribers when
completing Form SCI, but nevertheless believes that it is more useful
and efficient for the Commission and its staff to be able to have all
SCI event notifications standardized in a single format (i.e., Form
SCI).
---------------------------------------------------------------------------

    \894\ See supra note 879 and accompanying text.
---------------------------------------------------------------------------

    As discussed above, the information required under the adopted 24-
hour written notification requirement has been refined as compared with
the requirements in the proposal. Consequently, the Commission believes
that SCI entities should be able to provide the Commission with this
information in a written format, and does not agree that such
information should be provided in an oral format, as requested by some
commenters, regardless of the manner in which the immediate
notification was provided to the Commission.\895\ The Commission
emphasizes that regular updates provided under Rule 1002(b)(3) may,
however, be provided either orally or in written form.\896\
---------------------------------------------------------------------------

    \895\ See supra notes 872 and 882 and accompanying text.
    \896\ See infra note 911 and accompanying text.
---------------------------------------------------------------------------

    In response to commenters that stated SCI entities should not be
required to include an estimate of the market participants impacted by
an SCI event or to quantify such impact because this requirement may
create a risk of civil liability for the SCI entity,\897\ the
Commission notes that the information submitted to the Commission
pursuant to Regulation SCI will be treated as confidential, subject to
applicable law, including amended Rule 24b-2.\898\ Moreover, the
requirement to provide a 24-hour written notification does not itself
create a risk of civil liability, but the Commission acknowledges that
the information provided to it may be subject to FOIA requests.
---------------------------------------------------------------------------

    \897\ See supra note 871.
    \898\ See supra notes 802-803 and accompanying text. For a
discussion of the amendment to Rule 24b-2, see infra notes 1245-1248
and accompanying text.
---------------------------------------------------------------------------

    Regarding the comment that the requirement to include an estimate
of the markets and participants impacted by an SCI event or to quantify
such impact would be difficult to compute, likely inaccurate, and of
little use to the Commission,\899\ the Commission disagrees. The rule
requires an SCI entity to provide its current assessment of the types
and number of market participants potentially affected by the SCI event
and the potential impact of the SCI event on the market, to the extent
this information is available as of the time of the notification,
rather than an exact computation. In addition, the rule does not
require that the assessment be submitted only if the SCI entity ensures
that it is free of inaccuracies. Further, contrary to the commenter's
suggestion, the Commission believes that such estimates will be of
significant use to the Commission and its staff in understanding the
potential severity of the SCI event. In addition, because the SCI
entity is likely to be in the best position to assess an SCI event, the
Commission also believes that an assessment of the impact of an SCI
event on markets and participants is useful because it afford the
Commission the opportunity to learn the SCI entity's perspective on the
potential or actual impact of an SCI event.\900\
---------------------------------------------------------------------------

    \899\ See supra note 871 and accompanying text.
    \900\ The Commission notes that SCI entities retain the
flexibility to provide additional information to the Commission as
part of their assessments, such as providing the ``business impact''
of an SCI event, as suggested by one commenter. See supra note 870.
---------------------------------------------------------------------------

Written Commission Updates: Proposed Rule 1000(b)(4)(iii)
    Commenters also addressed proposed Rule 1000(b)(4)(iii), which
required an SCI entity to provide the Commission written updates
pertaining to an SCI event on a regular basis, or at such frequency as
reasonably requested by a representative of the Commission, until the
SCI event was resolved. Some commenters urged the Commission to provide
clarity on the definition of ``resolved.'' \901\ For example, one
commenter suggested that the Commission should define the resolution of
an SCI event to be when the affected SCI systems have been
normalized,\902\ and another commenter stated that there should be a
precise definition of when an SCI event is resolved and that definition
should be linked directly to the definition of the SCI event
itself.\903\ Other commenters expressed concern that the continuing
update requirement could divert resources from resolution of the SCI
event and suggested that updates be required only to the extent they
would not interfere with event resolution.\904\ One commenter stated
that continual updates should only be necessary if the SCI entity had
not resolved the event within a reasonable period, such as 10 to 15
days.\905\
---------------------------------------------------------------------------

    \901\ See DTCC Letter at 11; and Omgeo Letter at 18.
    \902\ See DTCC Letter at 11.
    \903\ See Omgeo Letter at 18.
    \904\ See MSRB Letter at 19; and OCC Letter at 14.
    \905\ See FINRA Letter at 20.
---------------------------------------------------------------------------

    Other commenters addressed the method of providing updates. For
example, one commenter stated that only oral communication should be
required when an SCI event is ongoing, and that the rule should allow a
written supplement to a final or post mortem report if additional
information comes to light regarding the SCI event.\906\ Another
commenter suggested that updates should be permitted to be in writing
or provided orally based on the judgment of the SCI entity.\907\
Finally, one commenter stated that requests for updates regarding SCI
events should only be permitted to come from senior staff at the
Commission.\908\
---------------------------------------------------------------------------

    \906\ See Omgeo Letter at 17.
    \907\ See MSRB Letter at 19.
    \908\ See NYSE Letter at 24.
---------------------------------------------------------------------------

Regular Updates: Adopted Rule 1002(b)(3)
    Rule 1002(b)(3) requires that, until such time as an SCI event is
resolved, and the SCI entity's investigation of the SCI event is
closed, an SCI entity provide the Commission with updates pertaining to
the SCI event on a regular basis, or at such frequency as reasonably
requested by a representative of the Commission. Updates are required
to correct any materially incorrect information previously provided, or
when new material information is discovered, including not limited to,
any of the information listed in Rule 1002(b)(2)(ii).
    While the Commission recognizes that providing the Commission with
such updates imposes an additional reporting requirement on SCI
entities, the Commission also believes that updates are important to
allow the Commission to fully monitor the SCI event. In addition, the
Commission believes that the update requirement will encourage SCI
entities to formalize their processes for gathering information on SCI
events, which will help to ensure that responsible SCI personnel
receive accurate and updated information on SCI events as they are
being resolved, and further, that this process may be helpful to SCI
entities when providing information about SCI events to their members
or participants. Also, because the Commission has revised the
requirements of the 24-hour notification to allow SCI entities to
provide information on a good faith, best efforts basis and has limited
the scope of information required in that report as discussed above,
the Commission believes that updates to the Commission to correct
materially incorrect information previously reported or when new
material information is

discovered as required by the rule is important to keep the Commission
up to date with accurate information, including the following: The SCI
entity's current assessment of the types and number of market
participants potentially affected by the SCI event; the potential
impact of the SCI event on the market; a description of the steps the
SCI entity has taken, is taking, or plans to take, with respect to the
SCI event; the time the SCI event was resolved or timeframe within
which the SCI event is expected to be resolved; and any other pertinent
information known by the SCI entity about the SCI event. Consequently,
the Commission does not agree with the commenter who suggested that
updates should be only required if an SCI event has not been resolved
within a reasonable amount of time, such as 10 to 15 days.\909\
---------------------------------------------------------------------------

    \909\ See supra note 870 and accompanying text.
---------------------------------------------------------------------------

    The Commission believes that updates regarding this information are
important to enhance the Commission's oversight of the securities
markets and its informed and continued understanding of an SCI event.
Moreover, the Commission underscores that updates are only required to
the extent that they correct any materially incorrect information
previously provided or when new material information is discovered,
including but not limited to, any of the information listed in Rule
1002(b)(2)(ii), thereby alleviating the burden to SCI entities of
providing such updates absent such circumstances.\910\ The Commission
has also eased the requirements of the proposed update provision by
eliminating the proposed requirements that an SCI entity attach a copy
of any information disseminated to date regarding the SCI event to its
members or participants or on the SCI entity's publicly available Web
site; a description of the SCI entity's rule(s) and/or governing
document(s), as applicable, that relate to the SCI event; an analysis
of parties that may have experienced a loss, whether monetary or
otherwise, due to the SCI event, the number of such parties, and an
estimate of the aggregate amount of such loss. Instead, these
information requirements must only be provided as part of the final
report required by Rule 1002(b)(4), and the Commission therefore
believes that burdens associated with the continuing update requirement
will be streamlined because SCI entities will not need to devote
resources to providing written updates while an SCI event is ongoing.
---------------------------------------------------------------------------

    \910\ The requirement that updates regarding new or corrected
information be provided on a regular basis (unless an alternative,
specific frequency is reasonably requested by a representative of
the Commission) is designed to take into account the fact that new
or updated information may develop at different frequencies for
different SCI events.
---------------------------------------------------------------------------

    At the same time, the Commission is cognizant of the burdens
associated with requiring written updates and therefore has revised the
update requirement in adopted Rule 1002(b)(3) to remove the proposed
requirement that such updates be provided in written form. Thus,
submission of updates may be provided either orally or in written form,
and will result in a lighter burden on SCI entities than the proposed
requirement, and is responsive to commenters that suggested that SCI
entity resources would be better directed to resolving an SCI
event.\911\
---------------------------------------------------------------------------

    \911\ See supra note 791 and accompanying text. SCI entities
may, but are not required to, utilize Form SCI to submit such
updates. See Section IV.D (discussing Form SCI). The Commission also
believes that, to the extent commenters suggested that the
Commission permit oral updates, they did so because, at least in
part, oral updates are less burdensome to SCI entities than written
updates. See supra notes 906-907 and accompanying text.
---------------------------------------------------------------------------

    In response to comment that the Commission provide guidance to
clarify when an SCI event has been ``resolved'' \912\ and in line with
the particular comment that the concept of resolution should be linked
directly to the definition of the SCI event itself,\913\ the Commission
believes that an SCI event is resolved when the event no longer meets
the definitions of a systems disruption, systems intrusion, or systems
compliance issue, as defined in Rule 1000, and that an SCI entity's
Rule 1002(b) reporting obligations are completed when an SCI entity
submits a final report as required by Rule 1002(b)(4). Further, the
Commission does not believe that it is necessary to prescribe that
requests to SCI entities regarding updates should come solely from
senior Commission staff, as suggested by one commenter.\914\ The
Commission believes that requiring an SCI entity to update the
Commission at such frequency as reasonably requested by a
representative of the Commission provides appropriate flexibility to
the Commission to request additional information as necessary, but does
not anticipate that requests will be made by multiple members of the
Commission staff because the Commission expects that such requests
would be coordinated by a particular group of Commission staff that are
assigned to handle specific reports from SCI entities.
---------------------------------------------------------------------------

    \912\ See supra notes 902-903 and accompanying text.
    \913\ See supra note 903 and accompanying text.
    \914\ See supra note 802 and accompanying text.
---------------------------------------------------------------------------

Final Report: Adopted Rule 1002(b)(4)
    Adopted Rule 1002(b)(4) requires that if an SCI event is resolved
and the SCI entity's investigation of the SCI event is closed within 30
days of the occurrence of the SCI event, then within five business days
after the resolution of the SCI event and closure of the SCI entity's
investigation regarding the SCI event, the SCI entity is to submit a
final written notification pertaining to such SCI event to the
Commission (``final report''). The final report is required to include:
(i) A detailed description of: The SCI entity's assessment of the types
and number of market participants affected by the SCI event; the SCI
entity's assessment of the impact of the SCI event on the market; the
steps the SCI entity has taken, is taking, or plans to take, with
respect to the SCI event; the time the SCI event was resolved; the SCI
entity's rule(s) and/or governing document(s), as applicable, that
relate to the SCI event; and any other pertinent information known by
the SCI entity about the SCI event; (ii) a copy of any information
disseminated pursuant to Rule 1002(c) by the SCI entity to date
regarding the SCI event to any of its members or participants; and
(iii) an analysis of parties that may have experienced a loss, whether
monetary or otherwise, due to the SCI event, the number of such
parties, and an estimate of the aggregate amount of such loss. Rule
1002(b)(4) also specifies that, if an SCI event is not resolved or the
SCI entity's investigation of the SCI event is not closed within 30
days of the occurrence of the SCI event, then, the SCI entity is
required to submit a written notification pertaining to such SCI event
to the Commission within 30 days after the occurrence of the SCI event
containing the information required in Rules 1002(b)(4)(i)-(iii), to
the extent known at the time. Within five business days after the
resolution of such SCI event and closure of the investigation regarding
such SCI event, the SCI entity is required to submit a final written
notification pertaining to such SCI event to the Commission containing
the information specified in the rule.
    As an initial matter, the Commission notes that several of the
items that are specifically required to be described in the final
report (as specified in adopted Rule 1002(b)(4)) were proposed to be
required to be provided to the Commission under proposed Rule
1000(b)(4)(ii), within a shorter time frame.\915\ The Commission
believes that

the adopted rule, by requiring that this information be submitted to
the Commission after resolution of an SCI event and closure of the SCI
entity's investigation, will encourage SCI entities to devote resources
first to resolving the SCI event, and providing status reports when
required, and then to preparing a comprehensive final report. In
particular, as some commenters suggested, certain information would be
more accurate, and therefore more useful, if provided after an SCI
event is resolved.\916\ The Commission believes that the information
required under Rule 1002(b)(4) will provide the Commission with a
comprehensive analysis to more fully understand and assess the impact
caused by the SCI event. In addition, the Commission ordinarily would
expect an SCI entity to include the root cause of an SCI event as part
of ``any other pertinent information'' known about the SCI event. The
Commission also believes that certain of the information requested by
Rule 1002(b)(4) is more suitable to be provided after, rather than
prior to, resolution of an SCI event. Specifically, much of the
information required by Rule 1002(b)(4) (an analysis of parties that
may have experienced a loss, whether monetary or otherwise, due to the
SCI event, the number of such parties, and an estimate of the aggregate
amount of such loss) can only be comprehensively known after the final
resolution of an SCI event.\917\
---------------------------------------------------------------------------

    \915\ The Commission notes that while proposed Rule
1000(b)(4)(iv)(C) specified that an SCI entity was required to
provide a copy of any information disseminated on the SCI entity's
publicly available Web site, adopted Rule 1002(b)(4) specifies that
an SCI entity provide a copy of any information disseminated
pursuant to Rule 1002(c) by the SCI entity to date regarding the SCI
event to any of its members or participants.
    \916\ See supra notes 870-878 and accompanying text.
    \917\ The Commission notes that a notification required pursuant
to proposed Rule 1000(b)(4)(ii) required the SCI entity to provide
information on the ``potential impact of the SCI event on the
market,'' whereas adopted Rule 1002(b)(4)(ii)(A) requires a
description of ``the SCI entity's assessment of the impact of the
SCI event on the market.'' Because adopted Rule 1002(b)(4) requires
a final report upon resolution of an SCI event and the closure of
the SCI entity's investigation of the SCI event, the Commission
believes it is appropriate that an SCI entity provide its assessment
of the impact of the SCI event in the final report, rather than
information on the SCI event's potential impact.
---------------------------------------------------------------------------

    Similarly, the Commission is revising the proposed requirement that
SCI entities provide to the Commission a copy of any information
disclosed by the SCI entity to date regarding the SCI event to any of
its members or participants. First, rather than requiring that SCI
entities provide a copy of ``any information disclosed by the SCI
entity,'' the adopted rule requires that SCI entities provide a copy of
any information ``disseminated pursuant to paragraph (c) of [Rule
1002]'' by the SCI entity to date regarding the SCI event to any of its
members or participants. The Commission believes that this refined
requirement will more appropriately capture only the information needed
for the Commission to assess compliance with the dissemination
requirements of Rule 1002(c). Further, to limit the burden on, and
provide additional flexibility to, SCI entities as they resolve SCI
events, the adopted rule does not require this information to be
included as part of a Form SCI submission until the final report is to
be submitted to the Commission. The Commission believes that it is
sufficient to require that this information be included in the final
report because it is an important part of the record of an SCI event
and SCI entity's response to such event.\918\ As noted above, one
commenter questioned the purpose of this requirement and expressed
concern that it may negatively impact open communication between an SCI
entity and its members and participants,\919\ while another commenter
questioned the feasibility, need, and potential impact of this
requirement in light of the numerous communications that SCI entities
will engage in with their members or participants.\920\ While the
Commission recognizes that it is possible that the requirement could
have some chilling effect on such communications, it believes that this
information is important for SCI entities to share with the Commission
because it is an efficient means for the Commission to assess whether
SCI entities are complying with the dissemination requirements of Rule
1002(c). Further, the Commission believes that, by requiring that SCI
entities provide a copy only of information disseminated pursuant to
Rule 1002(c) (rather than all information disclosed to members or
participants regarding the SCI event), it addresses one commenter's
concern that it would be difficult, unnecessary, and could impede open
communication, to provide the Commission with a copy of all information
disclosed to members or participants, which could include hundreds of
individual communications via email or telephone for each SCI event.
---------------------------------------------------------------------------

    \918\ Under Rule 1002(b)(4), SCI entities are required to
provide a copy of any information disseminated pursuant to Rule
1002(c) by the SCI entity to date regarding the SCI event to any of
its members or participants.
    \919\ See supra note 877.
    \920\ See supra note 878 and accompanying text. Specifically,
this commenter noted that there could be hundreds of communications
between the SCI entity and its members or participants during a
systems incident and questioned the feasibility of, and need for,
recreating and providing to the Commission a copy of all such
communications. Further, the commenter noted that this requirement
could have an unintended effect of discouraging open communication
between the SCI entity and its members.
---------------------------------------------------------------------------

    The Commission also believes that, if an SCI event is not resolved
or the SCI entity's investigation of the SCI event is not closed within
30 days of the occurrence of the SCI event, it is reasonable to require
that an SCI entity submit within thirty business days after the
occurrence of the SCI event the information required in Rule
1002(b)(4)(ii), to the extent known at the time, because this timeframe
provides SCI entities with flexibility to continue their investigation
while also apprising the Commission of relevant information discovered
during the course of the SCI entity's investigation. Moreover, the rule
takes into account the Commission's recognition that an SCI entity's
investigation regarding an SCI may not yet be complete despite the fact
that the SCI event itself has resolved. In such cases, within five
business days after the SCI event has resolved and the investigation
regarding the SCI event has closed, the Commission believes that it is
reasonable and necessary to provide it with a comprehensive and
complete understanding of the SCI event. Consequently, SCI entities are
required to submit a final written notification that contains all
information required by Rule 1002(b).
Goals of Adopted Commission Notification Rule
    As discussed in greater detail above, the Commission has carefully
considered the views of commenters as well as what it believes is
necessary for the Commission and its staff with respect to the timing
and content of notifications regarding SCI events, and believes that
the adopted rule will be less burdensome for SCI entities than if the
proposed rule was adopted without modification, while still resulting
in meaningful notice to the Commission and its staff with information
about SCI events in a timely manner that permits the Commission to
fulfill its oversight role.
    With regard to comments on the resource and efficiency demands of
the notification requirements,\921\ the Commission believes that while
SCI entities will need to devote resources to fulfilling the
notification requirements, the Commission does not believe that these
resources will diminish SCI entities' ability to respond to SCI events
because it is the Commission's

experience that the staff that engages in corrective action is
generally distinct from the staff that has been charged with notifying
the Commission of systems issues. Consequently, the Commission does not
believe that, due to this requirement, staff that engages in corrective
action will be unable to fulfill its responsibilities after
implementation of Regulation SCI.
---------------------------------------------------------------------------

    \921\ See supra notes 790-793.
---------------------------------------------------------------------------

    The Commission believes that adopted Rules 1002(b)(1)-(4) are
responsive to concerns that the proposed Commission notification
requirements would have required SCI entities to notify the Commission
of information before all relevant facts are known.\922\ As discussed,
in tandem with the revised triggering standard, which affords an SCI
entity time to assess whether an SCI event has occurred,\923\ the
adopted rule affords an SCI entity the flexibility to gather
information for the 24-hour written notification on a good faith best,
efforts basis,\924\ and adopted Rule 1002(b)(3) makes clear that an SCI
entity is required to update the Commission to correct any materially
inaccurate information previously provided, or when pertinent new
information is discovered, until such time as the SCI event is
resolved, and the SCI entity's investigation of the SCI event is
closed. Further, the final report for a given SCI event is only
required once, when both the SCI event is resolved and the SCI entity's
investigation of the SCI event is closed, with an interim report
required only when an SCI event is not resolved or the SCI entity's
investigation of the SCI event is not closed within 30 days of the
occurrence of the SCI event. Taken together, the Commission believes
that Rule 1002(b) does not require reporting before all relevant fact
are known, which one commenter suggested would be counterproductive and
harmful.\925\ Instead, the Commission believes that the rule is
designed to provide SCI entities with a process that gives them
sufficient time to submit information to the Commission when known. In
addition, and in response to comment questioning the usefulness of the
notification requirement for the Commission,\926\ the Commission
believes that adopted Rule 1002(b) will foster a system for
comprehensive reporting of SCI events, which should enhance the
Commission's review and oversight of U.S. securities market
infrastructure and foster cooperation between the Commission and SCI
entities in responding to SCI events. The Commission also believes that
the aggregated data that will result from the reporting of SCI events
will enhance its ability to comprehensively analyze the nature and
types of various SCI events and identify more effectively areas of
persistent or recurring problems across the systems of all SCI
entities. Some commenters suggested that the Commission provide to SCI
entities regular summary-level feedback on SCI entities' notifications
\927\ or provide examples of the types of SCI events that warrant
notification.\928\ To the extent it believes that guidance or other
information, including summary-level feedback, publications, or
reference blueprints, would be appropriate to share, the Commission or
its staff may do so in the future.
---------------------------------------------------------------------------

    \922\ See supra note 804 and accompanying text.
    \923\ See supra Section IV.B.3.a (discussing the triggering
standard).
    \924\ See supra discussion of ``good faith, best efforts''
above.
    \925\ See supra note 804.
    \926\ See supra note 793.
    \927\ See supra note 806 and accompanying text.
    \928\ See supra note 807 and accompanying text.
---------------------------------------------------------------------------

d. Dissemination of Information--Rule 1002(c)
i. Proposed Rule 1000(b)(5)
    Proposed Rule 1000(b)(5) would have required an SCI entity to
provide specified information relating to ``dissemination SCI events''
to SCI entity members or participants. The term ``dissemination SCI
event'' was proposed to mean an SCI event that is a: (1) Systems
compliance issue; (2) systems intrusion; or (3) systems disruption that
results, or the SCI entity reasonably estimates would result, in
significant harm or loss to market participants.
    Proposed Rule 1000(b)(5)(i)(A) would have required an SCI entity,
promptly after any responsible SCI personnel becomes aware of a
dissemination SCI event other than a systems intrusion, to disseminate
to its members or participants the following information about such SCI
event: (1) The systems affected by the SCI event; and (2) a summary
description of the SCI event. Proposed Rule 1000(b)(5)(i)(B) would have
required an SCI entity to further disseminate to its members or
participants, when known: (1) A detailed description of the SCI event;
(2) the SCI entity's current assessment of the types and number of
market participants potentially affected by the SCI event; and (3) a
description of the progress of its corrective action for the SCI event
and when the SCI event has been or is expected to be resolved. Proposed
Rule 1000(b)(5)(i)(C) would have further required an SCI entity to
provide regular updates to members or participants on any of the
information required to be disseminated under proposed Rules
1000(b)(5)(i)(A) and (i)(B). In the case of a systems intrusion, the
proposed rule permitted a limited delay in dissemination if the
dissemination would compromise the security of the SCI entity's
systems.\929\ Except for the delay in dissemination of information for
systems intrusions in specified circumstances, the proposed rule did
not distinguish dissemination obligations based on the severity or
impact of a dissemination SCI event.
---------------------------------------------------------------------------

    \929\ See proposed Rule 1000(b)(5)(ii) (permitting a delay in
dissemination of information regarding a systems intrusion if ``the
SCI entity determines that dissemination of such information would
likely compromise the security of the SCI entity's SCI systems or
SCI security systems, or an investigation of the systems intrusion,
and documents the reasons for such determination'').
---------------------------------------------------------------------------

ii. Comments Regarding Information Dissemination
    Two commenters generally supported proposed Rule 1000(b)(5).\930\
One commenter characterized it as ``one of the major benefits of th[e]
proposal.'' \931\ Another commenter suggested broadening the proposal
to require an SCI entity to reveal dissemination SCI events to the
public at large, and not just to its members or participants.\932\ This
commenter believed that public dissemination of the facts of an SCI
event would help enhance investor confidence by preventing speculation
and misinformation, and would provide important learning opportunities
for the industry and other SCI entities.\933\
---------------------------------------------------------------------------

    \930\ See Angel Letter at 5; and MFA Letter at 7.
    \931\ See Angel Letter at 5. This commenter stated: ``Instead of
keeping information about hardware failures, system intrusions, and
software glitches private, sharing the information will alert others
in the industry about such problems and help to reduce system wide
costs of diagnosing problems, as well as result in improved
responses to technology problems. These will serve as warnings to
the other SCI entities to stay vigilant to prevent similar problems
from occurring on their platforms.'' Angel Letter at 5.
    \932\ See MFA Letter at 7.
    \933\ See id.
---------------------------------------------------------------------------

    In contrast, many commenters urged the Commission to revise the
proposed dissemination requirement.\934\ For example, a few commenters
expressed concern that the proposal would require dissemination of too
much information too soon.\935\ One of these commenters stated that the
proposed rule would be counterproductive and harmful because

it would cause the release of information before all relevant facts are
known and suggested dissemination should only be required when the SCI
entity has credible information that can be acted upon.\936\ Another
commenter suggested that dissemination should only be required when the
information to be disseminated is certain and clear.\937\ Another
commenter urged that, if immediate dissemination is required, then the
information required to be disseminated should be limited to
communication of the basic fact that there is a systems issue and
additional information will be provided when known.\938\
---------------------------------------------------------------------------

    \934\ See, e.g., NYSE Letter at 28-29; FINRA Letter at 24; BATS
Letter at 13; DTCC Letter at 11-12; OCC Letter at 16; CME Letter at
9-10; ICI Letter at 4; Oppenheimer Letter at 2; Direct Edge Letter
at 8; Omgeo Letter at 21; ITG Letter at 13; and FIA PTG Letter at 3.
    \935\ See, e.g., DTCC Letter at 12, NYSE Letter at 29; and ITG
Letter at 13.
    \936\ See ITG Letter at 13. See also supra note 804 and
accompanying text.
    \937\ See DTCC Letter at 12.
    \938\ See NYSE Letter at 29 (stating also that the scope of the
information required to be provided is too extensive, particularly
given the timing requirements of the proposed rule).
---------------------------------------------------------------------------

    Several commenters opposed requiring information dissemination to
all members and participants.\939\ For example, some commenters urged
that an SCI entity be required to provide information only to members
or participants actually impacted by an SCI event, or that interact
with the SCI system impacted, rather than to all members or
participants of an SCI entity.\940\ One commenter recommended that an
SCI entity be required to disseminate information only to persons
reasonably likely to be affected by a significant systems issue.\941\
Two commenters stated that SCI entities should have reasonable
discretion to determine who among their members and participants should
receive notification of an SCI event, as well as the manner and timing
for providing notice.\942\ A few commenters more broadly expressed
concern that the proposed rule would result in over-reporting of
information about SCI events and would have limited usefulness.\943\
Some of these commenters stated that the proposed approach would result
in SCI entity members and participants becoming immunized to the
notifications because they would receive too many notifications and
therefore would not focus on the truly significant events.\944\
---------------------------------------------------------------------------

    \939\ See, e.g., MSRB Letter at 20-21; DTCC Letter at 11; CME
Letter at 10; NYSE Letter at 28; FINRA Letter at 24-25; ISE Letter
at 6-7; SIFMA Letter at 15; and OCC Letter at 17.
    \940\ See MSRB Letter at 20-21; DTCC Letter at 11; CME Letter at
9; NYSE Letter at 28; FINRA Letter at 25; and ISE Letter at 6-7. In
addition, one of these commenters sought clarification on whether
the term ``participant'' refers to a formal participant or, more
broadly speaking, any market participant that interacts with the SCI
system in question. See MSRB Letter at 20. See also Omgeo Letter at
21, and infra note 954.
    \941\ See NYSE Letter at 28.
    \942\ See SIFMA Letter at 15 (urging that an SCI entity should
have discretion to determine which participants or members are
affected and how to notify them); and OCC Letter at 17 (urging that
an SCI entity should be able to limit the communication to those
members and participants that are actually affected and to provide
the communication on a confidential and secure basis when the SCI
entity has reasonable certainty of the information that is required
to be provided).
    \943\ See, e.g., CME Letter at 9; FIA PTG Letter at 3; and Omgeo
Letter at 39. See also Fidelity Letter at 5 (requesting that the
Commission provide greater specificity regarding the types of
dissemination SCI events that must be disclosed and to whom
disclosure must be made).
    \944\ See, e.g., Omgeo Letter at 40; FIA PTG Letter at 3; and
CME Letter at 9.
---------------------------------------------------------------------------

    Several commenters suggested that the Commission apply the proposed
dissemination requirement to fewer types of SCI events.\945\ For
example, several commenters stated that information dissemination
should only be required for material or significant SCI events.\946\
One commenter suggested that, for an SCI event that is ``de minimis,''
information dissemination to members or participants should not be
required at all.\947\ This commenter suggested that a de minimis SCI
event would be one that is limited in impact, brief in duration, or
involves little or no member or participant harm.\948\ Another
commenter noted that, as proposed, Commission notification would be
required for a systems disruption if the systems disruption had a
``material impact'' on the SCI entity's operations or on market
participants, whereas information dissemination to members or
participants would be required if an SCI entity reasonably estimated
that the systems disruption would result ``in significant harm or loss
to market participants.'' \949\ This commenter criticized the differing
standards for Commission notification and member/participant
notification and suggested that the Commission clarify the standards or
adopt a uniform standard for both types of notifications.\950\
---------------------------------------------------------------------------

    \945\ See, e.g., NYSE Letter at 28; FIA PTG Letter at 3; FINRA
Letter at 24; BATS Letter at 13; OCC Letter at 16-17; CME Letter at
9-10; ICI Letter at 4; Oppenheimer Letter at 2; and Direct Edge
Letter at 8.
    \946\ See NYSE Letter at 28; FIA PTG Letter at 3; FINRA Letter
at 24; BATS Letter at 13; OCC Letter at 16-17; CME Letter at 9-10;
ICI Letter at 4; Oppenheimer Letter at 2; and Direct Edge Letter at
8.
    \947\ See BATS Letter at 13.
    \948\ See id.
    \949\ See OCC Letter at 16.
    \950\ See id.
---------------------------------------------------------------------------

    Several commenters specifically opposed the proposed dissemination
requirement for systems compliance issues. Some commenters urged that
an SCI entity be required to disseminate information only for material
or significant systems compliance issues.\951\ One of these commenters
stated that prompt dissemination of information regarding systems
compliance issues to members or participants might lead to widespread
dissemination of extraneous and potentially inaccurate
information.\952\
---------------------------------------------------------------------------

    \951\ See, e.g., FINRA Letter at 24; Joint SROs Letter at 9;
SIFMA Letter at 12; BATS Letter at 13; MSRB Letter at 6; and CME
Letter at 10.
    \952\ See Joint SROs Letter at 8.
---------------------------------------------------------------------------

    Regarding systems intrusions, a few commenters stated that
dissemination of systems intrusions information could raise significant
risks and security concerns.\953\ One commenter recommended that a
dissemination requirement apply only in the case of members,
participants, or clients for whom confidential data was disclosed,
processing was impacted, or where such member, participant, or client
could take further action to mitigate the risk of such disclosure.\954\
This commenter also expressed support for the limited exception for
intrusions that would compromise an investigation or resolution of the
systems intrusion, noting that once dissemination would no longer
compromise an investigation or the resolution of the issue, the entity
should notify materially affected members, participants, or clients.
---------------------------------------------------------------------------

    \953\ See DTCC Letter at 11; and NYSE Letter at 29. See also
Direct Edge Letter at 3 (suggesting that, to ensure that sensitive
information does not fall into the wrong hands, the Commission
should require reporting of systems intrusions to the Commission,
and only require public disclosure in instances where there is a
risk of significant harm to the SCI entity's customers).
    \954\ See Omgeo Letter at 21.
---------------------------------------------------------------------------

    One commenter stated that information should not be disseminated
regarding disruptions in regulatory or surveillance systems, nor should
information be disseminated about intrusions or compliance issues,
arguing that the information could be misused, or if disseminated too
soon, could be inaccurate and misleading.\955\ Two other commenters
also expressed concern that information dissemination should not be
required when the information provided might be misused to the
detriment of the markets or investors, such as with respect to systems
intrusions or issues relating to surveillance systems.\956\
---------------------------------------------------------------------------

    \955\ See NYSE Letter at 29. See also supra note 935 and
accompanying text.
    \956\ See ICI Letter at 4; and Oppenheimer Letter at 2.
---------------------------------------------------------------------------

iii. Rule 1002(c)
    In the SCI Proposal, the Commission stated that the intended
purpose of the proposed rule was twofold: To aid members or
participants of SCI entities

in determining whether their trading activity has been or might be
impacted by the occurrence of an SCI event at an SCI entity so that
they could consider that information in making trading decisions,
seeking corrective action or pursuing remedies, or taking other
responsive action; and to provide an incentive for SCI entities to
devote more resources and attention to improving the integrity and
compliance of their systems and preventing the occurrence of SCI
events.\957\ Although commenters generally did not object to the
Commission's stated rationale for proposed Rule 1000(b)(5), several
commenters suggested that the proposed approach did not adequately
consider circumstances in which the proposed information dissemination
might not be helpful to the market or market participants, or could be
detrimental to the markets or market participants. One commenter,
however, urged that public dissemination of information regarding SCI
events would help to prevent speculation and misinformation regarding
such events.\958\
---------------------------------------------------------------------------

    \957\ See Proposing Release, supra note 13, at 18120.
    \958\ See supra note 933 and accompanying text.
---------------------------------------------------------------------------

    The Commission has carefully considered the views of commenters
with respect to proposed Rule 1000(b)(5), and has determined to adopt
it as Rule 1002(c), with several modifications in response to comment.
In particular, the Commission has determined to eliminate the
definition of ``dissemination SCI event'' from the final rule and adopt
an information dissemination requirement that scales dissemination
obligations in accordance with the nature and severity of an SCI event.
In response to comment that the proposed rule would result in over-
reporting of information about SCI events and have limited usefulness,
the Commission has further focused the rule from the proposal by
requiring dissemination of information about SCI events that are not
major SCI events only to affected SCI entity members and participants,
and excepting de minimis SCI events and SCI events regarding market
regulation or market surveillance systems from the information
dissemination requirement.\959\ In the case of a ``major SCI event,''
the Commission agrees with the commenter who stated that requiring
dissemination should help to prevent speculation and misinformation
regarding such events.\960\ Therefore, in the case of a ``major SCI
event,'' the adopted rule requires an SCI entity to disseminate
information to all of its members or participants. At the same time, as
with other SCI events, any SCI event that meets the definition of major
SCI event that has had, or the SCI entity reasonably estimates would
have, no or a de minimis impact on the SCI entity's operations or on
market participants is excepted from the information dissemination
requirement.\961\ The Commission believes the revised approach will
better achieve the purpose of maximizing the utility of information
disseminated to SCI entity members and participants while
simultaneously reducing compliance burdens for SCI entities.
---------------------------------------------------------------------------

    \959\ See supra notes 943-956 and accompanying text.
    \960\ See supra note 933 and accompanying text.
    \961\ See Rule 1002(c)(4)(ii).
---------------------------------------------------------------------------

Rule 1002(c)(1): Information Dissemination for Systems Disruptions and
Systems Compliance Issues
    Adopted Rule 1002(c)(1) generally addresses dissemination
requirements for systems disruptions and systems compliance issues.
Rule 1002(c)(1)(i) requires an SCI entity, promptly after any
responsible SCI personnel has a reasonable basis to conclude that an
SCI event that is a systems disruption or systems compliance issue has
occurred, to disseminate information about such SCI event, unless an
exception applies. When the dissemination obligation is triggered,\962\
Rule 1002(c)(1)(i) requires an SCI entity to disseminate to the persons
specified in Rule 1002(c)(3) information on the system(s) affected by
the SCI event and a summary description of the SCI event. Thereafter,
Rule 1002(c)(1)(ii) provides that, when known, an SCI entity shall
promptly further disseminate: A detailed description of the SCI event;
the SCI entity's current assessment of the types and number of market
participants potentially affected by the SCI event; and a description
of the progress of its corrective action for the SCI event and when the
SCI event has been or is expected to be resolved. Rule 1002(c)(1)(iii)
provides that, until resolved, an SCI entity shall provide regular
updates of any information required to be disseminated under Rules
1002(c)(1)(i) and (ii). The specified types of information and the
update requirements are unchanged from the proposal. The Commission
continues to believe that, for the dissemination of information to be
meaningful, it is necessary for an SCI entity to describe the SCI event
in sufficient detail to permit a member or participant to determine
whether and how it was affected by the SCI event and make appropriate
decisions based on that determination.\963\ Adopted Rule 1002(c)(1)(i)
requires that the information initially disseminated include the
systems affected by the SCI event and a summary description of the SCI
event, and only after responsible SCI personnel have a reasonable basis
to conclude that a systems disruption or systems compliance issue has
occurred. Implicit in this requirement is that the disseminated
information be accurate. Without the dissemination of accurate
information, the impact on the SCI entity's members or participants or
the market may be more pronounced because market participants may not
recognize that an SCI event is occurring, or may mistakenly attribute
unusual market activity to some other cause.
---------------------------------------------------------------------------

    \962\ See supra Section IV.B.3.a (discussing the triggering
standard).
    \963\ See Proposing Release, supra note 13, at 18120.
---------------------------------------------------------------------------

    Adopted Rule 1002(c)(1) also requires that required information be
disseminated ``promptly.'' \964\ Although the Commission agrees that
SCI entities should not prematurely disseminate information regarding
an SCI event, lest it be inaccurate, speculative, misleading, or
otherwise unhelpful, as some commenters were concerned about,\965\ the
Commission does not agree with the commenter who suggested that
information dissemination be provided at a time chosen by the SCI
entity.\966\ The Commission believes that accurate information that is
timely is more likely to aid a market participant in determining
whether its trading activity has been or might be impacted by the
occurrence of an SCI event than accurate information that is delayed.
However, as compared to Commission notification, which is required to
be provided immediately after an SCI entity has a reasonable basis to
conclude that an SCI event has occurred, and which notice may be
provided orally, dissemination of information to SCI entity members or
participants is required to be provided promptly. The requirement for
prompt dissemination, as opposed to immediate dissemination, is
designed to provide some limited flexibility to an SCI entity to
determine an efficient way to disseminate information to multiple
potentially affected members or participants, or all of its members or
participants, as the case may be, in a timely manner. Likewise, as new
information becomes

known, immediate updates are not required, but an SCI entity is
obligated to also disseminate updated information ``promptly'' after it
is known. The Commission believes that adopted Rule 1002(c)(1) strikes
an appropriate balance by requiring an SCI entity to disseminate
specific information about SCI events, but also permits an SCI entity
to have time to check relevant facts before disseminating that
information. The Commission therefore believes that adopted Rule
1002(c)(1) is responsive to comment that the proposed rule would have
required release of information too soon, before it is determined to be
credible, or before relevant facts were known.\967\
---------------------------------------------------------------------------

    \964\ The persons to whom the required information about systems
disruptions and systems compliance issues is to be disseminated are
specified in Rules 1002(c)(3) and (4).
    \965\ See also supra notes 935-938 and 933 and accompanying
text.
    \966\ See supra note 942 and accompanying text.
    \967\ See supra notes 935-938 and accompanying text.
---------------------------------------------------------------------------

Rule 1002(c)(2): Information Dissemination for Systems Intrusions
    Adopted Rule 1002(c)(2) requires an SCI entity, promptly after any
responsible SCI personnel has a reasonable basis to conclude that an
SCI event that is a systems intrusion has occurred, to disseminate a
summary description of the systems intrusion, including a description
of the corrective action taken by the SCI entity and when the systems
intrusion has been or is expected to be resolved, unless the SCI entity
determines that dissemination of such information would likely
compromise the security of the SCI entity's SCI systems or indirect SCI
systems, or an investigation of the systems intrusion, and documents
the reasons for such determination. This rule applies to systems
intrusions that are not de minimis events. In response to commenters
stating that information about a systems intrusion in many cases will
be sensitive and raise security concerns, and those urging that the
dissemination requirement apply only in limited cases,\968\ the
Commission notes that, although it does not wholly exclude systems
intrusions from the dissemination requirement, the rule permits a delay
in dissemination of any information about a systems intrusion if
dissemination would compromise the security of the SCI entity's SCI
systems or indirect SCI systems, or an investigation of the systems
intrusion, and the SCI entity documents the reason for such
determination.\969\ Adopted Rule 1002(c)(2) also provides that the
content of the required disclosure for a systems intrusion is less
detailed than required for other types of SCI events. These provisions
are unchanged from the SCI Proposal.\970\ As stated in the SCI
Proposal, the Commission continues to believe that there may be
circumstances in which the dissemination of information related to a
systems intrusion should be delayed to avoid compromising the
investigation or resolution of a systems intrusion.\971\ Also, as
stated in the SCI Proposal, the affirmative documentation required by
Rule 1002(c)(2) is important to allow the Commission to ensure that SCI
entities are not improperly invoking the limited exception provided by
Rule 1002(c)(2).\972\ This delayed dissemination provision permits an
SCI entity to delay providing information about an intrusion to its
members or participants to protect legitimate security concerns.
However, under Rule 1002(c)(2), if an SCI entity cannot, or can no
longer, determine that information dissemination as required by Rule
1002(c)(2) would likely compromise the security of the SCI entity's SCI
systems or indirect SCI systems, or an investigation of the systems
intrusion, no delay (or further delay, if applicable) in dissemination
is permitted.\973\ Pursuant to Rule 1002(c)(2), information about a
systems intrusion is required to be disseminated eventually, as the
Commission believes that circumstances permitting a delay (i.e.,
dissemination of information would likely compromise the security of
the SCI entity's SCI systems or indirect SCI systems, or an
investigation of the systems intrusion), will not continue
indefinitely.\974\
---------------------------------------------------------------------------

    \968\ See, e.g., supra notes 953-954 and accompanying text.
    \969\ See Rule 1002(c)(4) (excepting de minimis systems
intrusions and intrusions into market regulation or market
surveillance systems from the dissemination requirement) and Rule
1001(c)(2) (permitting a delay in dissemination).
    \970\ The persons to whom the required information about a
systems intrusion is to be disseminated (provided the circumstances
warranting a delay do not apply) is specified in Rules 1002(c)(3)
and (4).
    \971\ See Proposing Release, supra note 13, at 18120.
    \972\ See id.
    \973\ See id.
    \974\ Some commenters urged modifications to the proposed rule
that would further circumscribe the proposed dissemination
requirement for systems intrusions. See, e.g., supra notes 953-954
and accompanying text (urging that dissemination for systems
intrusions only be required for affected persons and only if
material). These comments are addressed in the discussion of adopted
Rules 1002(c)(3) and (4).
---------------------------------------------------------------------------

Rule 1002(c)(3): To Whom Information Is To Be Disseminated
    Adopted Rule 1002(c)(3) provides that the information required to
be provided under Rules 1002(c)(1) and (2) promptly after any
responsible SCI personnel has a reasonable basis to conclude that an
SCI event has occurred, shall be promptly disseminated by the SCI
entity to those members or participants of the SCI entity that any
responsible SCI personnel has reasonably estimated may have been
affected by the SCI event, and promptly disseminated to any additional
members or participants that any responsible SCI personnel subsequently
reasonably estimates may have been affected by the SCI event. The rule
further requires that, for major SCI events, such information shall be
disseminated by the SCI entity to all of its members or participants.
As noted, several commenters urged that an SCI entity be required to
disseminate information relating to an SCI event only to those members
or participants affected by the SCI event.\975\ Some suggested that an
SCI entity have discretion to determine who should receive information
regarding SCI events,\976\ and one suggested that SCI events warrant
public disclosure.\977\ Others expressed more general concern that the
breadth of the proposed dissemination requirement would result in over-
reporting of information about SCI events because they believed that
SCI entities would over-report out of an abundance of caution \978\ or
that SCI entity members and participants would become immunized to
reports of SCI events and not focus on significant events.\979\
---------------------------------------------------------------------------

    \975\ See supra note 940 and accompanying text.
    \976\ See supra note 942 and accompanying text.
    \977\ See supra notes 932-933 and accompanying text.
    \978\ See supra note 943 and accompanying text.
    \979\ See supra notes 943-944 and accompanying text.
---------------------------------------------------------------------------

    After careful consideration of the comments, the Commission
believes that, to maximize the utility of information dissemination, a
more tailored approach to who should receive information about an SCI
event is warranted, based on an SCI event's impact. Because information
about an SCI event is likely to be of greatest value to those market
participants affected by it, who can use such information to evaluate
the event's impact on their trading and other activities and develop an
appropriate response, adopted Rule 1002(c)(3) requires prompt
dissemination to those members or participants of the SCI entity that
any responsible SCI personnel has reasonably estimated may have been
affected by the SCI event. With respect to more serious SCI events,
however, the Commission believes that dissemination to all members or
participants of an SCI entity is warranted. Accordingly, under adopted
Regulation SCI, certain SCI events will be defined as ``major SCI
events.''
    Adopted Rule 1000 defines ``major SCI event'' as ``an SCI event
that has

had, or the SCI entity reasonably estimates would have: (1) Any impact
on a critical SCI system; or (2) a significant impact on the SCI
entity's operations or on market participants.'' The Commission
believes that dissemination of information regarding a major SCI event
to all members or participants of an SCI entity is appropriate because
major SCI events are likely to impact a large number of market
participants (e.g., with respect to critical SCI systems, a disruption
of consolidated market data or the clearance and settlement system, or
an event significantly impacting the operations of an exchange).\980\
As noted, one commenter suggested broadening the proposed rule to
generally require an SCI entity to reveal dissemination SCI events
(other than intrusions) to the public at large. This commenter
expressed the view that public dissemination of the facts of an SCI
event would help ``enhance investor confidence by presenting the facts
of the SCI event, preventing speculation and misinformation, and
informing the public of corrective action being taken'' and would
``serve as an important collective learning opportunity'' that would
allow for ``SCI [e]ntities and market participants [to] learn from [the
event] . . . and build upon their policies and controls as
appropriate.'' This commenter stated further that such an ``industry
protocol would help strengthen and enhance the integrity and security
of our markets.'' \981\ The Commission agrees with this commenter that
it is appropriate for an SCI entity to present the facts, prevent
speculation and misinformation, and provide transparency about
corrective action being taken when the impact of an SCI event is most
likely to be felt by many market participants (i.e., when it is a major
SCI event). In the context of a major SCI event, the Commission
believes these goals can be achieved by requiring an SCI entity to
disseminate information to all of its members or participants (as
opposed to the ``public at large''). Moreover, the Commission believes
it is appropriate to require dissemination of information on major SCI
events to all of the SCI entity's members or participants because these
market participants are the most likely to act on this information.
Based on the experience of the Commission and its staff, when an entity
disseminates information about a systems issue to all of its members or
participants (e.g., on the entity's Web site), and that information has
the potential to affect the market and investors more broadly
(including market participants that may not be members or participants
of the SCI entity reporting the event), such information is routinely
picked up by financial or other media outlets, and also may be relayed
to market participants for whom such information is relevant (e.g., by
members or participants of SCI entities to their own clients).
Therefore, the Commission believes that when information about a
systems issue with broad potential impact is disseminated to all of an
SCI entity's member or participants, such dissemination is tantamount
to public dissemination.\982\ As such, the Commission believes that it
can achieve the purposes of the rule without requiring public
dissemination, and believes that any additional gain in benefits from
public dissemination would be minimal. Rule 1002(c)(3) does not specify
how an SCI entity is to disseminate information to all of its members
or participants when required to do so, but the Commission believes
that posting the information on a Web site accessible to, at a minimum,
all of its member or participants (for example, on a ``systems status
alerts'' page) would meet the rule's requirements.\983\
---------------------------------------------------------------------------

    \980\ At the same time, the Commission recognizes that some SCI
events that meet the definition of ``major SCI event'' could also
qualify as de minimis SCI events. Like other de minimis SCI events,
they are excepted from the information dissemination requirement.
See Rule 1002(c)(4).
    \981\ See supra notes 932-933.
    \982\ The Commission notes that one commenter referred to the
dissemination provision in the SCI Proposal as the ``public
dissemination provision of Proposed Reg SCI.'' See NYSE Letter at
28. See also ICI Letter at 4 and Oppenheimer Letter at 4 (each
supporting ``transparency of SCI events to members and participants
of an SCI entity'' but recommending that the Commission only require
``public dissemination'' where such information enhances investor
protection).
    \983\ The Commission notes that, irrespective of the medium
chosen to disseminate information to the SCI entity members or
participants, the SCI entity would also be required to submit the
disseminated information to the Commission as part of the report
submitted pursuant to Rule 1002(b)(4). See supra Section IV.B.3.c.
---------------------------------------------------------------------------

    For an SCI event that is neither a major SCI event nor an event
identified in Rule 1002(c)(4), however, the information specified in
Rule 1002(c)(1) or (2), as applicable, is required to be disseminated
by the SCI entity to those members or participants of the SCI entity
that any responsible SCI personnel has reasonably estimated may have
been affected by the SCI event.\984\ The Commission believes that an
SCI entity is generally in the best position to identify those of its
members or participants that are or are reasonably likely to be
affected by such events. Under this approach, as commenters urged,
members or participants not reasonably estimated to be affected by such
events will not be the recipients of information likely to be
irrelevant to them. The Commission believes that SCI entities will be
able to analyze which members or participants are or reasonably likely
will be impacted, and the rule requires SCI entities to disseminate
information to such members or participants. The requirement that
information is to be disseminated only to those members or participants
that any responsible SCI personnel has reasonably estimated may have
been affected by the SCI event (other than a major SCI event or a de
minimis SCI event) addresses the concern raised by some commenters that
members and participants will become immunized by receiving irrelevant
notifications \985\ because, under the adopted approach, members or
participants should only receive notifications relevant to them.
---------------------------------------------------------------------------

    \984\ In response to the commenter seeking clarification on
whether the term ``participant'' refers to a formal participant or,
more broadly speaking, any market participant that interacts with
the SCI system in question (see supra note 940), for purposes of
adopted Rule 1002, the term ``participant'' refers to a formal
participant. The Commission also notes that, with respect to the
MSRB, the term ``members'' as used in Regulation SCI includes
entities that are registered with the MSRB, but does not include ``a
member of the Board,'' which is the definition of ``member'' in MSRB
Rule D-5.
    \985\ See supra notes 944 and 952 and accompanying text.
---------------------------------------------------------------------------

    Whereas the proposed rule would have required dissemination of
information about certain SCI events to all SCI entity members and
participants, the adopted rule requires dissemination only to those
members and participants reasonably estimated to be affected by an SCI
event (other than a major SCI event or a de minimis SCI event). Because
it is possible that an SCI entity's reasonable estimate of members or
participants affected may change as an SCI event unfolds, the adopted
rule also requires prompt dissemination of information to newly
identified members or participants reasonably estimated to be affected
by an SCI event.\986\ This provision reflects the view that newly
identified affected members or participants should receive prompt
dissemination of information about an SCI event, just as those
originally identified as affected members or participants. Although
compliance with this requirement may result in an SCI entity
disseminating information at several different times to

different members and participants, consistent with commenters'
suggestions, the Commission believes that this requirement is
appropriately tailored to result in information dissemination being
provided to the relevant members or participants of an SCI entity.\987\
---------------------------------------------------------------------------

    \986\ Rule 1002(c)(1) requires that, among other things, the SCI
entity must disseminate the SCI entity's current assessment of the
types and number of market participants potentially affected by the
SCI event, and until resolved, provide regular updates of this and
any other information required to be disseminated under the rule.
    \987\ The Commission notes that an SCI entity would be in
compliance with the rule if it disseminated the required information
to all members or participants, rather than disseminating only to
those members and participants it reasonably initially estimated to
be affected by the event (which might require subsequent
dissemination(s) to additional members or participants if its
estimate regarding those members or participants that were affected
by a given SCI event changes over time).
---------------------------------------------------------------------------

    If an SCI event is a de minimis event--i.e., is an SCI event that
has had, or the SCI entity reasonably estimates would have, no or a de
minimis impact on the SCI entity's operations or on market
participants--the adopted rule does not impose any dissemination
requirement.\988\
---------------------------------------------------------------------------

    \988\ See discussion of adopted Rule 1002(c)(4) below
(excepting, among other things, de minimis systems SCI events from
the dissemination requirement). See also supra Section IV.B.3.c
(discussing Rule 1002(b)(5), which requires that, for de minimis SCI
events, an SCI entity is required to: (i) Make, keep, and preserve
records relating to all such SCI events; and (ii) submit to the
Commission a report, within 30 calendar days after the end of each
calendar quarter, containing a summary description of such systems
disruptions and systems intrusions, including the SCI systems and,
for systems intrusions, indirect SCI systems, affected by such
systems disruptions and systems intrusions during the applicable
calendar quarter).
---------------------------------------------------------------------------

Adopted Rule 1002(c)(4): Exceptions to the General Rules on Information
Dissemination
    Adopted Rule 1002(c)(4) provides that the requirements of Rules
1002(c)(1)-(3) shall not apply to: (i) SCI events to the extent they
relate to market regulation or market surveillance systems; or (ii) any
SCI event that has had, or the SCI entity reasonably estimates would
have, no or a de minimis impact on the SCI entity's operations or on
market participants. The Commission has added the exception in adopted
Rule 1002(c)(4)(i) in response to comments that information should not
be disseminated regarding disruptions in regulation and surveillance
systems, because dissemination of such information to an SCI entity's
members or participants or the public at large could encourage
prohibited market activity.\989\ The Commission notes that the
exception for market regulation or market surveillance systems is
limited to dissemination of information about SCI events related to
market regulation or market surveillance systems. Information about an
SCI event that impacts other SCI systems would still be required to be
disseminated in accordance with Rule 1002(c) even if that same SCI
event also impacts market regulation or market surveillance systems.
---------------------------------------------------------------------------

    \989\ See supra notes 955-956 and accompanying text.
---------------------------------------------------------------------------

    The exception in Rule 1002(c)(4)(ii) for de minimis SCI events is
consistent with the Commission's approach to excluding de minimis SCI
events from the immediate Commission notification requirements in Rule
1002(b), and is therefore responsive to comment that notification and
dissemination of systems disruptions were subject to differing
standards under the proposal,\990\ as well as to the comment that a de
minimis SCI event should not be subject to dissemination.\991\ With
respect to the comment that dissemination should only be required for
material or significant SCI events,\992\ while the Commission is not
limiting the dissemination requirement as suggested by these
commenters, the exception for de minimis SCI events is responsive to
this comment, to an extent. Moreover, the Commission believes that a
materiality threshold would likely exclude from the information
dissemination requirement a large number of SCI events that are not de
minimis SCI events, but that an SCI entity's members or participants
should be made aware of so that they can quickly assess the nature and
scope of those SCI events and identify the appropriate response,
including ways to mitigate the impact of the SCI events. The Commission
also believes that, even without adopting a materiality threshold, the
adopted definitions of SCI systems and indirect SCI systems
significantly focus the scope of the Commission dissemination
requirements from the SCI Proposal.
---------------------------------------------------------------------------

    \990\ See supra notes 949-950 and accompanying text.
    \991\ See supra notes 947-948 and accompanying text; Section
IV.B.3.c (discussing Rule 1002(b)) and supra note 988 and
accompanying text. The Commission notes that, because major SCI
events are a subset of SCI events, the exception in Rule
1002(c)(4)(ii) also applies to major SCI events that meet the
requirements of that rule.
    \992\ See supra note 946 and accompanying text; see also supra
notes 941 and 944 and accompanying text.
---------------------------------------------------------------------------

    Consistent with its statements in the SCI Proposal, the Commission
notes that the requirements relating to dissemination of information in
Regulation SCI relate solely to Regulation SCI.\993\ Nothing in adopted
Regulation SCI should be construed as superseding, altering, or
affecting the reporting obligations of SCI entities or their affiliates
under other federal securities laws or regulations. Accordingly, in the
case of an SCI event, SCI entities or their affiliates subject to the
public company reporting requirements of Section 13 or Section 15(d) of
the Exchange Act would need to comply with their disclosure obligations
pursuant to those provisions (including, for example, with respect to
Regulation S-K and Forms 10-K, 10-Q, and 8-K) in addition to their
disclosure and reporting obligations under Regulation SCI.\994\ In
addition, the Commission also wishes to highlight that the requirements
of Rule 1002(c) address to whom and when SCI entities are obligated
under Regulation SCI to disseminate information. Subject to any
applicable laws or regulations, SCI entities still retain the
flexibility to disseminate information--e.g., to their members or
participants, the public, or market participants that interact with the
affected SCI systems--at any time they determine to be appropriate.
---------------------------------------------------------------------------

    \993\ See Proposing Release, supra note 13, at 18119, n. 235.
    \994\ As an additional example, nothing in adopted Regulation
SCI should be construed as superseding any obligations under
Regulation FD. SCI entities may also wish to consider staff guidance
on this topic. See CF Disclosure Guidance: Topic No. 2,
Cybersecurity (October 13, 2011), available at: http://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm.
---------------------------------------------------------------------------

4. Notification of Systems Changes--Rule 1003(a)
a. Proposed Definition of Material Systems Change, Proposed Rules
1000(b)(6) and (b)(8)(ii)
    Proposed Rule 1000(a) would have defined the term ``material
systems change'' as a change to one or more: (1) SCI systems of an SCI
entity that: (i) Materially affects the existing capacity, integrity,
resiliency, availability, or security of such systems; (ii) relies upon
materially new or different technology; (iii) provides a new material
service or material function; or (iv) otherwise materially affects the
operations of the SCI entity; or (2) SCI security systems of an SCI
entity that materially affects the existing security of such systems.
In the SCI Proposal, the Commission set forth examples that it
preliminarily believed could be included within the proposed definition
of material systems change.\995\
---------------------------------------------------------------------------

    \995\ These examples included: Major systems architecture
changes; reconfiguration of systems that would cause a variation
greater than five percent in throughput or storage; the introduction
of new business functions or services; changes to external
interfaces; changes that could increase susceptibility to major
outages; changes that could increase risks to data security; changes
that were, or would be, reported to or referred to the entity's
board of directors, a body performing a function similar to the
board of directors, or senior management; and changes that could
require allocation or use of significant resources. See Proposing
Release, supra note 13, at 18105-06. These examples were cited in
the 2001 Staff ARP Interpretive Letter. The Commission also stated
its preliminary belief that any systems change occurring as a result
of the discovery of an actual or potential systems compliance issue
would be material. See id.

---------------------------------------------------------------------------

    Proposed Rule 1000(b)(6)(i) would have required an SCI entity,
absent exigent circumstances, to notify the Commission in writing at
least 30 calendar days before implementation of any planned material
systems changes, including a description of the planned material
systems changes as well as the expected dates of commencement and
completion of implementation of such changes. If exigent circumstances
existed, or if the information previously provided to the Commission
regarding any planned material systems change had become materially
inaccurate, proposed Rule 1000(b)(6)(ii) would have required the SCI
entity to notify the Commission, either orally or in writing, with any
oral notification to be memorialized within 24 hours after such oral
notification by a written notification, as early as reasonably
practicable. A written notification to the Commission made pursuant to
proposed Rule 1000(b)(6) would have been required to be made
electronically on Form SCI and include all information as prescribed in
Form SCI and the instructions thereto.
    Proposed Rule 1000(b)(8)(ii) would have required each SCI entity to
submit to the Commission a report, within 30 calendar days after the
end of June and December of each year, containing a summary description
of the progress of any material systems change during the six month
period ending on June 30 or December 31, as the case may be, and the
date, or expected date, of completion of implementation of such
changes. A written notification to the Commission made pursuant to
proposed Rule 1000(b)(8)(ii) would have been required to be made
electronically on Form SCI and include all information as prescribed in
Form SCI and the instructions thereto.
b. Quarterly and Supplemental Material Systems Change Reports--Rule
1003(a)
i. Adopted Rule 1003(a)(1): Quarterly Material Systems Change Reports
    Many commenters viewed the proposed 30-day advance notification
requirement for material systems changes as burdensome.\996\ For
example, one commenter believed that the Commission significantly
underestimated the number of material systems changes, and suggested
that the proposal might require reporting of as many as 60 material
systems changes per week, rather than that same amount per year, as the
Commission estimated in the SCI Proposal.\997\ Some commenters stated
that many SCI entities implement frequent agile modifications rather
than major episodic or ``waterfall'' changes, and therefore viewed the
proposed 30-day advance notification requirement as favoring a model
that employs waterfall changes over agile changes.\998\ Several
commenters stated more broadly that the proposed requirement would
mandate constant reporting that would stifle innovation, interfere with
an SCI entity's natural planning and development process, and
potentially do more harm than good by curtailing an SCI entity's
ability to respond to systems issues with appropriate fixes.\999\
Several commenters also expressed concern that the burden of reporting
would incentivize an SCI entity to change its systems less often
instead of making smaller and more frequent iterative systems
adjustments, which they believed would be inconsistent with current
software best practices, curtail innovation, and expose their systems
to increased risk.\1000\ One commenter questioned the purpose of the
proposed requirement, stating that the Commission has not presented any
empirical evidence that major or material technology changes by SCI
entities are in fact the leading cause of market disruption, and that
non-material systems changes by SCI entities and non-SCI entities have
a high likelihood of causing market disruptions, but they are not
captured by the proposal.\1001\ At the same time, this commenter stated
that providing 30-day advance notification of these non-material
systems changes would hamstring SCI entities.\1002\
---------------------------------------------------------------------------

    \996\ See, e.g., NYSE Letter at 26; BATS Letter at 14; ISE
Letter at 8; BIDS Letter at 14; UBS Letter at 3-4; SIFMA Letter at
15; ITG Letter at 8 and 13; FIF Letter at 5; MFA Letter at 5-6; CME
Letter at 11; FINRA Letter at 27; Joint SROs Letter at 7; and OTC
Markets Letter at 20.
    \997\ See BATS Letter at 14. See also NYSE Letter at 26; and ISE
Letter at 8 (stating that the proposal would require reporting of
too many routine changes), and infra discussion of the definition of
material systems change.
    \998\ See KCG Letter at 19; FIF Letter at 5; UBS Letter at 4;
and ITG Letter at 8. ``Agile'' software development, which involves
smaller, more frequent changes in software code, is contrasted with
the ``waterfall'' methodology, which involves larger, episodic
software overhauls.
    \999\ See KCG Letter at 19; FIF Letter at 5; UBS Letter at 4;
BATS Letter at 14; and ITG Letter at 8. See also SunGard Letter at
3.
    \1000\ See KCG Letter at 19; FIF Letter at 5; UBS Letter at 4;
BATS Letter at 14; and ITG Letter at 8. See also SIFMA Letter at 16.
    \1001\ See SunGard Letter at 3.
    \1002\ See id.
---------------------------------------------------------------------------

    Some commenters also noted that Regulation ATS already requires an
ATS to report material changes to the operation of the ATS at least 20
calendar days prior to their implementation.\1003\ One of these
commenters noted that it is common for an ATS to finalize the systems
specifications for a change close to when the ATS wants to go live with
the change, but the ATS must wait 20 days before implementation, and
occasionally the questions from Commission staff can further delay
implementation.\1004\ This commenter expressed concern that Regulation
SCI would lengthen the notification requirement to 30 calendar days and
broaden the requirement to include any significant systems change, not
just a material change to the operation of the ATS.\1005\
---------------------------------------------------------------------------

    \1003\ See BIDS Letter at 14; and ITG Letter at 8.
    \1004\ See ITG Letter at 8.
    \1005\ See id.
---------------------------------------------------------------------------

    The Commission continues to believe that it is important to receive
notifications of planned and implemented material changes to SCI
systems or the security of indirect SCI systems in connection with its
oversight of U.S. securities market infrastructure.\1006\ However,
after considering the views of commenters regarding the 30-day advance
notification requirement, the Commission is instead adopting a
quarterly reporting requirement, which will permit the Commission and
its staff to have up-to-date information regarding an SCI entity's
systems development progress and plans, to aid in understanding the
operations and functionality of the systems and any material changes
thereto, without requiring SCI entities to submit a notification to the
Commission for each

material systems change.\1007\ Specifically, Rule 1003(a)(1) requires
an SCI entity, within 30 calendar days after the end of each calendar
quarter, to submit to the Commission a report describing completed,
ongoing, and planned material systems changes to its SCI systems and
security of indirect SCI systems, during the prior, current, and