\597\ See Marsh, Underinvestment in Cyber Insurance Can Leave
Organizations Vulnerable (2022), available at https://www.marsh.com/pr/en/services/cyber-risk/insights/underinvestment-in-cyber-insurance.html.
    \598\ It has long been noted that it is difficult for
governments to commit credibly to not providing support to entities
that are seen as critical to the functioning of the financial
system, resulting in problems of moral hazard. See, e.g., Walter
Bagehot, Lombard Street: A Description of the Money Market (Henry S.
King & Co., 1873). Historically, banking entities seen as ``too big
to fail'' or ``too interconnected to fail'' have been the principal
recipients of such government support. Since the financial crisis of
2007-2009, non-bank financial institutions (such as investment
banks), money market funds, and insurance companies, as well as
specific markets such as the repurchase market have also benefited.
See, e.g., Gary B. Gorton, Slapped by the Invisible Hand: The Panic
of 2007, Oxford Univ. Press (2010); see also Viral V. Acharya, Deniz
Anginer, and A. Joseph Warburton, The End of Market Discipline?
Investor Expectations of Implicit Government Guarantees, SSRN
Scholarly Paper, Rochester, NY: Social Science Research Network (May
1, 2016).
    \599\ ``Advanced persistent threat'' refers to sophisticated
cyberattacks by hostile organizations with the goal of: gaining
access to defense, financial, and other targeted information from
governments, corporations and individuals; maintaining a foothold in
these environments to enable future use and control; and modifying
data to disrupt performance in their targets. See Michael K. Daly,
The Advanced Persistent Threat (or Informationized Force
Operations), Raytheon (Nov. 4, 2009), available at https://www.usenix.org/legacy/event/lisa09/tech/slides/daly.pdf.
    \600\ See Nikos Virvilis and Dimitris Gritzalis, The Big Four--
What We Did Wrong in Advanced Persistent Threat Detection?, 2013
Int'l Conf. on Availability, Reliability and Security 248 (2013).
    \601\ See Lawrence A. Gordon, Martin P. Loeb, and William
Lucyshyn, Cybersecurity Investments in the Private Sector: The Role
of Governments, 15 Geo. J. Int'l Aff. 79 (2014).
---------------------------------------------------------------------------

    Suboptimal spending on cybersecurity also can be the result of
asymmetric information among Market Entities and market participants. A
Market Entity may not know what its optimal cybersecurity expenditures
should be because the nature and scope of future attacks are unknown.
In addition, a Market Entity may not know what its competitors do in
terms of cybersecurity planning, whether they have been subject to
unsuccessful cyberattacks, or have been a victim of one or more
significant cybersecurity incidents. Market Entities also may not be
able to signal credibly to their customers, counterparties, members,
registrants, or users that they are better at addressing cybersecurity
risks than their peers, thus reducing their incentive to bear such
cybersecurity investment costs.\602\ Lastly, Market Entities'
customers, counterparties, members, registrants, or users typically do
not have information about the Market Entities' cybersecurity spending,
the efficacy of the cybersecurity investments made, or their policies
and procedures. Therefore, those market participants cannot make
judgments about Market Entities' cybersecurity preparedness. Because of
this information asymmetry, Market Entities may not have as strong of
an incentive to have robust cybersecurity measures compared to a
scenario in which customers, counterparties, members, registrants, or
users had perfect information about the Market Entities' cybersecurity
practices and the risks that they face.
---------------------------------------------------------------------------

    \602\ See Sanford J. Grossman, The Informational Role of
Warranties and Private Disclosure about Product Quality, 24 J. L.
Econ. 461 (Dec. 1981); see also Michael Spence, Competitive and
Optimal Responses to Signals: An Analysis of Efficiency and
Distribution, 7 J. Econ. Theory 296 (Mar. 1, 1974); George. A.
Akerlof, The Market for ``Lemons'': Quality Uncertainty and the
Market Mechanism, 84 Q. J. Econ. 488 (Aug. 1970).
---------------------------------------------------------------------------

    Underinvestment in cybersecurity also may stem from the principal-
agent problem of divergent goals in economic theory. The relationship
between a Market Entity (i.e., the agent) and the principals (i.e., its
customers, counterparties, members, registrants, or users) can be
affected if the principal relies on the agent to perform services on
the principal's behalf.\603\ Because principals and their agents may
not have perfectly aligned preferences and goals, agents may take
actions that increase their well-being at the expense of principals,
thereby imposing ``agency costs'' on the principals.\604\ Although
private contracts between principals and agents may aim to minimize
such costs, they are limited in their ability to do so in that agents
can decide not enter into such agreements and ultimately not provide
the particular services to the principals. Furthermore, agents can
charge much higher fees that the principals choose not to bear. These
limitations provides one rationale for regulatory intervention.\605\
Market-based incentives alone are unlikely to result in optimal
provision of cybersecurity protection. In this context, having plans
and procedures in place to prepare for and respond to cybersecurity
incidents,\606\ and the rule would help ensure that the infrastructure
of the U.S. securities markets remains robust, resilient, and secure. A
well-functioning financial system is a public good.
---------------------------------------------------------------------------

    \603\ See Michael C. Jensen and William H. Meckling, Theory of
the Firm: Managerial Behavior, Agency Costs and Ownership Structure,
3 J. Fin. Econ. 305 (1976).
    \604\ Id.
    \605\ Such limitations can arise from un-observability or un-
verifiability of actions, transactions costs associated with
including numerous contingencies in contracts, or bounded
rationality in the design of contracts. See, e.g., Jean Tirole,
Cognition and Incomplete Contracts, 99 a.m. Econ. Rev. 265 (Mar.
2009) (discussing a relatively modern treatment of these issues).
    \606\ For example, according to an IBM report, in the context of
system issues arising from cybersecurity events, having an incident
response plan and ``testing that plan regularly can help [each firm]
proactively identify weaknesses in [its] cybersecurity and shore up
[its] defenses'' and ``save millions in data breach costs.'' See
2019 Cost of Data Breach Report; see also Alex Asen et al., Are You
Spending Enough on Cybersecurity (Feb. 19, 2020), available at
https://www.bcg.com/publications/2019/are-you-spending-enough-cybersecurity (noting ``[a]s the world becomes ever more reliant on
technology, and as cybercriminals refine and intensify their
attacks, organizations will need to spend more on cybersecurity'').
---------------------------------------------------------------------------

    Beyond reputational damage to the affected agent (Market Entity),
the principals (the Market Entity's customers, counterparties, members,
registrants, or users) can be negatively affected by a cybersecurity
breach as a result of loss in personal information and/or funds and
assets. Thus the principals and the agents may have different reasons
for needing cybersecurity protocols. Furthermore, the negative effects
of a cybersecurity incident also can spread among Market Entities due
to their interconnectedness.\607\ Those other Market Entities prefer
that the principals employ strong cybersecurity practices that reduce
the chances of a successful breach and its negative cascading effects
throughout the financial sector. All of the preceding negative
externalities are arguments for proposed Rule 10.
---------------------------------------------------------------------------

    \607\ See sections I.A.1. and I.A.2. of this release (discussing
how the interconnectedness of Market Entities creates cybersecurity
risk).
---------------------------------------------------------------------------

    In the production of cybersecurity defenses and controls, the main
input is information. In particular, information about prior attacks
and their degree of success, as well as prior human errors and their
degree of harm, is valuable in mounting effective countermeasures and
controls.\608\ However, Market Entities may be naturally reluctant to
share such information, as doing so could assist future attackers as
well as lead to loss of customers, reputational harm, litigation, or
regulatory scrutiny, which would be costs associated with public
disclosure.\609\ On the other hand, disclosure of such information
creates a positive information externality--the benefits of which
accrue to society at large and are not fully captured by the Market
Entity making the disclosure.

This situation can occur because the disclosure informs the Market
Entity's customers, counterparties, members, registrants, or users--as
well as the Market Entity's competitors--about the cybersecurity
incidents experienced by the Market Entity. As a result, information
disclosures intended to close the information asymmetry gap can have
both positive and negative consequences.
---------------------------------------------------------------------------

    \608\ See Peter W. Singer and Allan Friedman, Cybersecurity:
What Everyone Needs to Know 222 (Oxford Univ. Press, 2014).
    \609\ See, e.g., FTC Equifax Civil Action.
---------------------------------------------------------------------------

    As discussed earlier, sources of market failure in cybersecurity
come from information asymmetries at two different levels: (1) between
Market Entities and their customers, counterparties, members,
registrants, or users; and (2) between Market Entities and threat
actors. These two failures, in turn, create distinct consequences for
each of these stakeholders.
    At the first level, a Market Entity's customers, counterparties,
members, registrants, or users have incomplete information about their
own cybersecurity risks due to incomplete information about the Market
Entity's actual cybersecurity policies and procedures. To exacerbate
the first level of information asymmetry, Market Entities typically
interact with other market participants. For example, investors do
business with broker-dealers, introducing broker-dealers work with
carrying broker-dealers, FINRA supervises broker-dealers, broker-
dealers interact with national securities exchanges, and national
securities exchanges work with clearing agencies.
    When utilizing the services of a Market Entity, other market
participants may not have full information regarding the Market
Entity's exposure to material harm as a result of a cybersecurity
incident. A cybersecurity incident that harms a Market Entity can harm
its customers, counterparties, members, registrants, or users.
Disclosure of information regarding significant cybersecurity incidents
by Market Entities could be used by their customers, counterparties,
members, registrants, or users to manage their own cybersecurity risk
by investing in additional cybersecurity protection, and, to the extent
they have a choice, selecting a different Market Entity with
satisfactory cybersecurity protection with whom to transact or
otherwise conduct business.\610\ That is, a Market Entity with strong
cybersecurity policies and procedures and a clean record in terms of
past significant cybersecurity incidents may be perceived by these
market participants as more desirable to interact with, or obtain
services from, than Market Entities of the same type that do not fit
that profile. Even general details about the cybersecurity incidents,
as well as the number of significant cybersecurity incidents during the
current or previous calendar year, could allow customers,
counterparties, members, registrants, and users to compare Market
Entities.
---------------------------------------------------------------------------

    \610\ As discussed earlier, the public disclosure requirements
of proposed Rule 10 would apply to Market Entities that meet the
proposed rule's definition of ``covered entity.'' See paragraph (d)
of proposed Rule 10; section II.B.3. of this release (discussing the
public disclosure requirements of proposed Rule 10).
---------------------------------------------------------------------------

    As a result, information from the disclosure may permit customers,
counterparties, members, registrants, and users to gauge the riskiness
of doing business with a certain Market Entity when they would not have
been able to without that knowledge, and the disclosures may encourage
those market participants to move their business to competing Market
Entities that would have to disclose information under proposed Rule 10
and are perceived to be more prepared for cybersecurity attacks.\611\
The information disclosed by competitors also can incentivize Market
Entities to increase their investment in cybersecurity protections and
allow them to adjust their defenses when they would not have done so
otherwise, thus increasing overall market stability by further limiting
harmful cybersecurity incidents.
---------------------------------------------------------------------------

    \611\ The firms making the disclosure may be incentivized to
invest more in cybersecurity protection, potentially to the point of
overinvestment in order not to lose customers, counterparties,
members, registrants, and users.
---------------------------------------------------------------------------

    At the second level, there are differences in the capabilities of
threat actors that are external to Market Entities and the assumed
level of cybersecurity preparations needed by Market Entities to
protect against significant cybersecurity incidents. Specifically,
Market Entities cannot fully anticipate the type, method, and
complexity of all types of cyberattacks that may materialize. Moreover,
cyberattacks evolve over time, becoming more complex and using new
avenues to circumvent Market Entities' cybersecurity protections.\612\
Furthermore, Market Entities cannot predict the timing or the target of
a given cyberattack. Though this information asymmetry is impossible to
eradicate fully given the inherent secretive nature of threat actors,
regulation may help to prevent an expansion of information asymmetry by
requiring Market Entities to gather and assess information about
cybersecurity risks and vulnerabilities more often. Doing so would not
only help to contain the negative effects of successful cybersecurity
attacks on any one Market Entity going forward, but it also would aid
in minimizing the growth in negative externalities as the effects of
successful cyberattacks spillover to other Market Entities as well as
to their customers, counterparties, members, registrants, or users.
---------------------------------------------------------------------------

    \612\ See, e.g., Verizon DBIR.
---------------------------------------------------------------------------

    Cybersecurity defenses must constantly evolve in order to keep up
with the threat actors who are exogenous to the Market Entity, and its
ability to anticipate specific attacks on itself is difficult at best.
Within the reasonable scenario of an interconnected market with
multiple points of entry for a potential threat actor, it may be more
costly for Market Entities that are the victims of cascading
cybersecurity breaches than for the initial target itself, as the other
Market Entities within the network ultimately would need to prepare for
a multitude of attacks originating from many different initial
targets.\613\ A strong cybersecurity program can also help Market
Entities to protect themselves from cybersecurity attacks that could
possibly come from one of multiple entry points. Having comprehensive
cybersecurity policies and procedures will aid Market Entities
identifying the source of a breach, which can result in lower detection
costs and the identification of the threat actor in a more expeditious
manner.
---------------------------------------------------------------------------

    \613\ See Cybersecurity and its Cascading Effect on Societal
Systems.
---------------------------------------------------------------------------

C. Baseline

    Each type of Market Entity that would be subject to proposed Rule
10 has a distinct business model and role in the U.S. financial
markets. As a result, the risks and practices, regulation, and market
structure for each Market Entity will form the baseline for the
economic analysis.
1. Cybersecurity Risks and Current Relevant Regulations
a. Cybersecurity Risks
    With the widespread adoption of internet-based products and
services over the last two decades, all businesses have had to address
cybersecurity issues.\614\ For financial services firms, the stakes are
particularly high because they transact, hold custody of, and maintain
ownership records of wealth in the form of cash, securities, or other
liquid assets that cyber threat actors might strive to obtain
illegally. Such entities also represent attack vectors for threat
actors. In addition, Market Entities have linkages with each other as

a result of the business they conduct together. A breach at one Market
Entity may be exploited and serve as a means of compromising other
Market Entities. Cybersecurity threat intelligence surveys consistently
find the financial sector to be one of the most--if not the most--
attacked industries,\615\ and remediation costs for an incident can be
substantial.\616\ As a result, firms in the financial sector need to
invest in cybersecurity to protect their business operations along with
the accompanying assets and data stored on information systems.
---------------------------------------------------------------------------

    \614\ See section I.A.1. of this release (discussing
cybersecurity risks to the U.S. securities markets).
    \615\ See, e.g., IBM, X-Force Threat Intelligence Index 2022
(2022), available at https://www.ibm.com/security/data-breach/threat-intelligence.
    \616\ See, e.g., 2019 Cost of Data Breach Report (noting the
average cost of a data breach in the financial industry in the
United States is $5.97 million).
---------------------------------------------------------------------------

    Further, as discussed earlier, the custody and transfer of crypto
assets depends almost exclusively on the operations of information
systems.\617\ Crypto assets, therefore, are exposed to cybersecurity
risks and they are attractive targets for threat actors. Information
systems that involve crypto assets may be subject to heightened
cybersecurity risks. To the extent that Market Entities engage in
business activities involving crypto assets, they could be exposed to
these heighted cybersecurity risks.
---------------------------------------------------------------------------

    \617\ See section II.G. of this release (discussing
cybersecurity risks related to crypto assets).
---------------------------------------------------------------------------

    The ubiquity and rising costs of cybercrime,\618\ along with
financial services firms' increasingly costly efforts to prevent
it,\619\ have been the motivation behind the growth in the
cybersecurity industry.\620\ Many Market Entities cite the NIST
Framework as the main standard for implementing strong cybersecurity
measures.\621\ The focus that has been placed on cybersecurity also has
led to the development of numerous technologies and standards by
private sector firms aimed at mitigating cybersecurity threats. Many of
these developments, such as multi-factor authentication, secure
hypertext transfer protocol,\622\ and user-access control, are now
commonplace. Practitioners--chief technology officers (``CTOs''), chief
compliance officers (``CCOs''), chief information officers (``CIOs''),
chief information security officers (``CISOs''), and their staffs--
frequently utilize industry standard frameworks \623\ and similar
offerings from cybersecurity consultants and product vendors to assess
and address institutional cybersecurity preparedness. Such frameworks
include information technology asset management, controls, change
management, vulnerability management, incident management, continuity
of operations, risk management, dependencies on third parties,
training, and information sharing. In recent years, companies' boards
of directors and executive management teams have focused on these
areas.
---------------------------------------------------------------------------

    \618\ See FBI internet Crime Report (noting that cybercrime
victims lost approximately $6.9 billion in 2021).
    \619\ See Office of Financial Research, Annual Report to
Congress 2021, available at https://www.financialresearch.gov/annual-reports/files/OFR-Annual-Report-2021.pdf.
    \620\ Sage Lazzaro, The Cybersecurity Industry Is Burning--But
VCs Don't Care, VentureBeat (Sept. 2, 2021), available at https://venturebeat.com/2021/09/02/the-cybersecurity-industry-is-burning-and-vcs-dont-care/ (``VentureBeat'').
    \621\ FCI, Top 5 Ways the Financial Services Industry Can
Leverage NIST for Cybersecurity Compliance, available at https://fcicyber.com/top-5-ways-the-financial-services-industry-can-leverage-nist-for-cybersecurity-compliance/.
    \622\ Hypertext transfer protocol, HTTP, is the primary set of
rules that allow a web browser to communicate with (i.e., send data
to) a website.
    \623\ CISA, Cyber Resilience Review (CRR): Method Description
and Self-Assessment User Guide (Apr. 2020), available at https://www.cisa.gov/sites/default/files/publications/2_CRR%204.0_Self-Assessment_User_Guide_April_2020.pdf.
---------------------------------------------------------------------------

    Unaddressed cybersecurity risks, particularly at Market Entities,
impose negative externalities on the broader financial system. Actions
taken to implement, maintain, and upgrade cybersecurity protections
likely reduce overall risk in the economy. In addition, due to the
potential for large-scale losses with respect to funds, securities, and
customer information, Market Entities have a vested interest in
installing, maintaining, and upgrading cybersecurity-related software
and hardware. Based on staff discussions with market participants,
cybersecurity-related activities can be performed in-house or
contracted out to third parties with expertise in those areas.
Financial services firms may employ a mix of in-house and outsourced
staff and resources to meet their cybersecurity needs and goals.
b. Current Relevant Regulations
i. Broker-Dealers
    Broker-dealers are subject to Regulation S-P \624\ and Regulation
S-ID.\625\ In addition, ATSs that trade certain stocks exceeding
specific volume thresholds are subject to Regulation SCI.\626\ Further,
an ATS is subject to Regulation ATS.\627\ As discussed earlier,
Regulation SCI, Regulation S-P, Regulation ATS, and Regulation S-ID
have provisions requiring policies and procedures to address certain
types of cybersecurity risks.\628\ Regulation SCI also requires
immediate written or telephonic notice and subsequent reporting to the
Commission on Form SCI of certain types of incidents.\629\ Finally,
Regulation SCI has provisions requiring disclosures to persons affected
by certain incidents.\630\
---------------------------------------------------------------------------

    \624\ See 17 CFR 248.1 through 248.30.
    \625\ See 17 CFR 248.201 and 202.
    \626\ See 17 CFR 242.1000 through 1007.
    \627\ See 17 CFR 242.301 through 304.
    \628\ See section II.F.1.c. of this release (discussing in more
detail the existing requirements of Regulation SCI, Regulation S-P,
Regulation ATS, and Regulation S-ID to have policies and procedures
to address certain cybersecurity risks).
    \629\ See section II.F.1.d. of this release (discussing in more
detail the existing immediate notification and subsequent reporting
requirements of Regulation SCI).
    \630\ See section II.F.1.e. of this release (discussing in more
detail the existing disclosure requirements of Regulation SCI).
---------------------------------------------------------------------------

    Broker-dealers are also subject to the Commission's financial
responsibility rules. Rule 15c3-1 requires broker-dealers to maintain
minimum amounts of net capital, ensuring that the broker-dealer at all
times has enough liquid assets to promptly satisfy all creditor claims
if the broker-dealer were to go out of business.\631\ Rule 15c3-3 under
the Exchange Act imposes requirements relating to safeguarding customer
funds and securities.\632\ These rules provide protections for broker-
dealer counterparties and customers and can help to mitigate the risks
to, and impact on, customers and other market participants by
protecting them from the consequences of financial failure that may
occur because of a systems issue at a broker-dealer.
---------------------------------------------------------------------------

    \631\ See 17 CFR 240.15c3-1.
    \632\ See 17 CFR 240.15c3-3.
---------------------------------------------------------------------------

    Under Exchange Act Rule 15c3-4, OTC derivatives dealers must
establish, document, and maintain a system of internal risk management
controls to assist it in managing the risks associated with its
business activities, including market, credit, leverage, liquidity,
legal, and operational risks.\633\ The required risk management system
must include, among other things: a risk control unit that reports
directly to senior management, periodic reviews which may be performed
by internal audit staff, and annual reviews which must be conducted by
independent certified public accountants.\634\ Management must
periodically review the entity's business activities for consistency
with risk management guidelines, including that the data necessary to
conduct the risk monitoring and risk management function as well as the
valuation process

over the entity's portfolio of products is accessible on a timely basis
and information systems are available to capture, monitor, analyze, and
report relevant data.\635\
---------------------------------------------------------------------------

    \633\ See 17 CFR 240.15c3-4(a).
    \634\ See 17 CFR 240.15c3-4(c).
    \635\ Id.
---------------------------------------------------------------------------

    Exchange Act Rules 17a-3 and 17a-4 require broker-dealers to make
and keep current records detailing, among other things, securities
transactions, money balances, and securities positions.\636\ Further, a
broker-dealer that fails to make and keep current the records required
by Rule 17a-3 must give notice to the Commission of this fact on the
same day and, thereafter, within 48 hours transmit a report to the
Commission stating what the broker-dealer has done or is doing to
correct the situation.\637\
---------------------------------------------------------------------------

    \636\ See 17 CFR 240.17a-3; 17 CFR 240.17a-4.
    \637\ See 17 CFR 240.17a-11.
---------------------------------------------------------------------------

    Moreover, with certain exceptions, broker-dealers must file
confidential SARs with FinCEN to report any suspicious transaction
relevant to a possible violation of law or regulation.\638\ The SARs
include information regarding who is conducting the suspicious
activity, what instruments or mechanisms are being used, when and where
the suspicious activity took place, and why the filer thinks the
activity is suspicious. Broker-dealers must make the records available
to FinCEN as well as to other appropriate law enforcement agencies,
federal or state securities regulators, and SROs registered with the
Commission.
---------------------------------------------------------------------------

    \638\ See 31 CFR 1023.320; section IV.A. of this release
(discussing the requirements to file SARs in more detail).
---------------------------------------------------------------------------

    Broker-dealers are generally required to register with the
Commission and join a national securities association or national
securities exchange.\639\ As SROs, national securities associations and
national securities exchanges are required to enforce their members'
compliance with the Exchange Act, the rules and regulations thereunder,
and the SRO's own rules. The vast majority of brokers and dealers join
FINRA. Broker-dealers that are members of FINRA are subject FINRA Rules
3110, 3120, and 4530(b) (among other FINRA rules).\640\ FINRA Rule 3110
requires broker-dealer members to have in place a system to supervise
its activities so that they are in compliance with applicable rules and
regulations. FINRA Rule 3120 requires broker-dealer members to test and
verify that the supervisory procedures are reasonably designed with
respect to the activities of the member and its associated persons, as
well as to achieve compliance with applicable securities laws and
regulations and with applicable FINRA rules. In addition, broker-dealer
members must create additional or amended supervisory procedures where
a need is identified by such testing and verification. The designated
individual(s) must submit to the broker-dealer member's senior
management no less than annually a report detailing each member's
system of supervisory controls, the summary of the test results and
significant identified exceptions, and any additional or amended
supervisory procedures created in response to the test results. FINRA
Rule 4530(b) states that each broker-dealer member shall promptly
report to FINRA, but not later than 30 calendar days after the member
has concluded or reasonably should have concluded, that an associated
person of the member or the member itself has violated any securities-,
insurance-, commodities-, financial- or investment-related laws, rules,
regulations, or standards of conduct of any domestic regulatory body,
foreign regulatory body, or SRO. Furthermore, Commission staff has
issued statements \641\ and FINRA has issued guidance \642\ in the area
of cybersecurity.\643\ The statements and FINRA guidance with respect
to these rules identify common elements of reasonably designed
cybersecurity policies and procedures including risk assessment, user
security and access, information protection, incident response,\644\
and training.\645\
---------------------------------------------------------------------------

    \639\ See 15 U.S.C. 78o(a)(1) and 15 U.S.C. 78o(b)(8).
    \640\ Broker-dealers that are members of national securities
exchanges are also subject to the rules of the national securities
exchanges regarding membership, registration, operation, and
business conduct, among other exchange regulations.
    \641\ See, e.g. EXAMS, Risk Alert, Safeguarding Client Accounts;
EXAMS, Risk Alert, Select COVID-19 Compliance Risks and
Considerations for Broker-Dealers and Investment Advisers (Aug. 12,
2020), available at https://www.sec.gov/files/Risk%20Alert%20-%20COVID-19%20Compliance.pdf; EXAMS,Risk Alert, Ransomeware; EXAMS,
Report on OCIE Cybersecurity and Resiliency Observations (Jan. 27,
2020), available at https://www.sec.gov/files/OCIE%20Cybersecurity%20and%20Resiliency%20Observations.pdf (``EXAMS
Cybersecurity and Resiliency Observations''); EXAMS, Safeguarding
Customer Records and Information in Network Storage--Use of Third
Party Security Features (May 23, 2019), available at https://www.sec.gov/files/OCIE%20Risk%20Alert%20-%20Network%20Storage.pdf;
EXAMS, Investment Adviser and Broker-Dealer Compliance Issues
Related to Regulation S-P--Privacy Notices and Safeguard Policies
(Apr. 16, 2019), available at https://www.sec.gov/files/OCIE%20Risk%20Alert%20-%20Regulation%20S-P.pdf; EXAMS, Observations
from Cybersecurity Examinations (Aug. 7, 2017), available at https://www.sec.gov/files/observations-from-cybersecurity-examinations.pdf
(``EXAMS Observations from Cybersecurity Examinations''); EXAMS,
Cybersecurity: Ransomware Alert (May 17, 2017), available at https://www.sec.gov/files/risk-alert-cybersecurity-ransomware-alert.pdf;
EXAMS, OCIE's 2015 Cybersecurity Examination Initiative (Sept. 15,
2015), available at https://www.sec.gov/files/ocie-2015-cybersecurity-examination-initiative.pdf; EXAMS, Cybersecurity
Examination Sweep Summary (Feb. 3, 2015), available at https://www.sec.gov/about/offices/ocie/cybersecurity-examination-sweep-summary.pdf (``Cybersecurity Examination Sweep Summary''); EXAMS,
OCIE's 2014 Cybersecurity Initiative (Apr. 15, 2014), available at
https://www.sec.gov/ocie/announcement/Cybersecurity-Risk-Alert-Appendix-4.15.14.pdf.
    \642\ See FINRA, Core Cybersecurity Threats and Effective
Controls for Small Firms (May 2022), available at https://www.finra.org/sites/default/files/2022-05/Core_Cybersecurity_Threats_and_Effective_Controls-Small_Firms.pdf;
FINRA, Cloud Computing in the Securities Industry (Aug. 16, 2021),
available at https://www.finra.org/sites/default/files/2021-08/2021-cloud-computing-in-the-securities-industry.pdf; FINRA, 2021 Report
on FINRA's Examination and Risk Monitoring Program (Feb. 1, 2021),
available at https://www.finra.org/sites/default/files/2021-02/2021-report-finras-examination-risk-monitoring-program.pdf (``FINRA 2021
Report on Examination and Risk Monitoring Program''); FINRA, 2019
Report on FINRA Examination Findings and Observations (Oct. 16,
2019), available at https://www.finra.org/sites/default/files/2019-10/2019-exam-findings-and-observations.pdf; FINRA Common
Cybersecurity Threats; FINRA, Report on Selected Cybersecurity
Practices--2018 (Dec. 1, 2018), available at https://www.finra.org/sites/default/files/Cybersecurity_Report_2018.pdf (``FINRA Report on
Selected Cybersecurity Practices''); FINRA, Report on FINRA
Examination Findings (Dec. 6, 2017), available at https://www.finra.org/sites/default/files/2017-Report-FINRA-Examination-Findings.pdf; FINRA, Small Firm Cybersecurity Checklist (May 23,
2016), available at https://www.finra.org/compliance-tools/small-firm-cybersecurity-checklist.
    \643\ Cybersecurity has also been a regular theme of FINRA's
Regulatory and Examination Priorities Letter since 2008 often with
reference to Regulation S-P. Similarly, while risks related to data
compromises were highlighted in the Commission staff's exam
priorities, an official focus on ``cyber'' began in 2014 after the
SEC sponsored a Cybersecurity Roundtable and the Division of
Examination conducted cybersecurity initiative I and II to assess
industry practices and legal and compliance issues associated with
broker-dealer and investment adviser cybersecurity preparedness.
Cybersecurity initiatives I and II were each separate series of
examinations of cybersecurity practices conducted by EXAMS,
concluding in 2014 and 2017. The examinations covered broker-
dealers, investment advisers, and funds. EXAMS released a summary
report for each initiative.
    \644\ See FINRA 2021 Report on Examination and Risk Monitoring
Program (noting that FINRA recommended among effective practices
with respect to incident response: (1) establishing and regularly
testing--often using tabletop exercises--a written formal incident
response plan that outlines procedures for responding to
cybersecurity and information security incidents; and (2) developing
frameworks to identify, classify, prioritize, track and close
cybersecurity-related incidents).
    \645\ These categories vary somewhat in terms of nomenclature
and the specific categories themselves across different Commission
and FINRA publications.
---------------------------------------------------------------------------

    Consistent with these rules, nearly all broker-dealers that
participated in two Commission exam sweeps in 2015 and 2017 reported
\646\ maintaining some

cybersecurity policies and procedures; conducting some periodic risk
assessments to identify threats and vulnerabilities,\647\ conducting
firm-wide systems inventorying or cataloguing, ensuring regular system
maintenance including the installation of software patches to address
security vulnerabilities, performing some penetration testing.\648\ A
separate staff statement observed that at least some firms implemented
capabilities that are able to control, monitor, and inspect all
incoming and outgoing network traffic to prevent unauthorized or
harmful traffic and implemented capabilities that are able to detect
threats on endpoints.\649\ In the two Commission exam sweeps, many
firms indicated that policies and procedures were vetted and approved
by senior management and that firms provided annual cybersecurity
reports to the board while some also provided ad hoc reports in the
event of major cybersecurity events.\650\ Broadly, many broker-dealers
reported relying on industry standards with respect to cybersecurity
\651\ typically by adhering to a specific industry standard or
combination of industry standards or by using industry standards as
guidance in designing policies and procedures.
---------------------------------------------------------------------------

    \646\ See Cybersecurity Examination Sweep Summary (noting that
of 57 examined broker-dealers, the vast majority adopted written
information security policies, conducted periodic audits to
determine compliance with these information security policies and
procedures, conducted risk assessments and reported considering such
risk assessments in establishing their cybersecurity policies and
procedures, and that with respect to vendors, the majority of the
broker-dealers required cybersecurity risk assessments of vendors
with access to their firms' networks and had at least some specific
policies and procedures relating to vendors). See also EXAMS
Observations from Cybersecurity Examinations (noting that nearly all
firms surveyed had incident response plans).
    \647\ See FINRA Report on Selected Cybersecurity Practices. This
report noted that FINRA has conducted a voluntary Risk Control
Assessment (``RCA'') Survey with all active member firms for a
number of years. According to the 2018 RCA, 94% of higher revenue
firms and 70% of mid-level revenue firms use a risk assessment as
part of their cybersecurity program.
    \648\ Id. According to FINRA's 2018 RCA, 100% of higher revenue
firms include penetration testing as a component in their overall
cybersecurity program.
    \649\ See EXAMS Cybersecurity and Resiliency Observations.
    \650\ See FINRA, Report on Cybersecurity Practices (Feb. 2015),
available at https://www.finra.org/sites/default/files/2020-07/2015-report-on-cybersecurity-practices.pdf (``FINRA Report on
Cybersecurity Practices'').
    \651\ Id. Among the firms that were part of the sweep, nearly
90% used one or more of the NIST, International Organization for
Standardization (``ISO'') or Information Systems Audit and Control
Association (``ISACA'') frameworks or standards. More specifically,
65% of the respondents reported that they use the ISO 27001/27002
standard while 25% use the Control Objectives for Information and
Related Technologies (``COBIT'') framework created by ISACA. Some
firms use combinations of these standards for various parts of their
cybersecurity programs. While the report focused on firm utilization
of cybersecurity frameworks specifically, in many cases, the
referenced frameworks were broader IT frameworks.
---------------------------------------------------------------------------

    With respect to broker-dealer reporting to their boards regarding
cybersecurity policies and procedures and cybersecurity incidents, the
board reporting frequency ranged from quarterly to ad-hoc among the
firms FINRA reviewed.\652\ Approximately two-thirds of the broker-
dealers (68%) examined in a 2015 survey had an individual explicitly
assigned as the firm's CISO which might suggest extensive executive
leadership engagement.
---------------------------------------------------------------------------

    \652\ See FINRA Report on Cybersecurity Practices. At a number
of firms, the board received annual cybersecurity-related reporting
while other firms report on a quarterly basis. A number of firms
also provide ad hoc reporting to the board in the event of major
cybersecurity events.
---------------------------------------------------------------------------

    There are no current Commission or FINRA requirements for broker-
dealers to disseminate notifications of breaches to members or clients
although many firms do so \653\ pursuant to various state data breach
laws.\654\ Broker-dealers are subject to state laws known as ``Blue Sky
Laws,'' which generally are regulations established as safeguards for
investors against securities fraud.\655\ All 50 states have enacted
laws in recent years requiring firms to notify individuals of data
breaches. These laws differ by state, with some states imposing
heightened notification requirements relative to other states.\656\
---------------------------------------------------------------------------

    \653\ See Cybersecurity Examination Sweep Summary. Based on a
small sample of firms, the vast majority of broker-dealers
maintained plans for data breach incidents and most had plans for
notifying customers of material events.
    \654\ See Digital Guardian, The Definitive Guide to U.S. State
Data Breach Laws (Nov. 15, 2022), available at https://info.digitalguardian.com/rs/768-OQW-145/images/the-definitive-guide-to-us-state-data-breach-laws.pdf.
    \655\ See, e.g., Office of Investor Education and Advocacy,
Commission, Blue Sky Laws, available at https://www.investor.gov/introduction-investing/investing-basics/glossary/blue-sky-laws.
    \656\ For example, some states may require a firm to notify
individuals when a data breach includes biometric information, while
others do not. Compare Cal. Civil Code Sec.  1798.29 (stating that
notice to California residents of a data breach is generally
required when a resident's personal information was or is reasonably
believed to have been acquired by an unauthorized person and that
``personal information'' is defined to mean an individual's first or
last name in combination with one of a list of specified elements,
which includes certain unique biometric data), with Ala. Stat.
Sec. Sec.  8-38-2, 8-38-4, 8-38-5 (stating that notice of a data
breach to Alabama residents is generally required when sensitive
personally identifying information has been acquired by an
unauthorized person and is reasonably likely to cause substantial
harm to the resident to whom the information relates and that
``sensitive personally identifying information'' is defined as the
resident's first or last name in combination with one of a list of
specified elements, which does not include biometric information).
---------------------------------------------------------------------------

ii. SROs
    National securities exchanges, registered clearing agencies, FINRA,
and the MSRB are all SROs and are all considered to be SCI Entities,
which requires them to comply with Regulation SCI.\657\ As discussed
earlier, Regulation SCI has provisions requiring policies and
procedures to address certain types of cybersecurity risks.\658\
Regulation SCI also requires immediate written or telephonic notice and
subsequent reporting to the Commission on Form SCI of certain types of
incidents.\659\ Finally, Regulation SCI has provisions requiring
disclosures to persons affected by certain incidents.\660\
---------------------------------------------------------------------------

    \657\ See 17 CFR 242.1000 through 1007.
    \658\ See section II.F.1.c. of this release (discussing in more
detail the existing requirements of Regulation SCI to have policies
and procedures to address certain cybersecurity risks).
    \659\ See section II.F.1.d. of this release (discussing in more
detail the existing immediate notification and subsequent reporting
requirements of Regulation SCI).
    \660\ See section II.F.1.e. of this release (discussing in more
detail the existing disclosure requirements of Regulation SCI).
---------------------------------------------------------------------------

    In addition, as described above, Rule 613 of Regulation NMS
requires the Participants to jointly develop and submit to the
Commission a CAT NMS Plan.\661\ The Participants conduct the activities
of the CAT through a jointly owned limited liability company,
Consolidated Audit Trail, LLC. The CAT is intended to function as a
modernized audit trail system that provides regulators with more timely
access to a comprehensive set of trading data, thus enabling regulators
to more efficiently and effectively reconstruct market events, monitor
market behavior, and investigate misconduct. The CAT System accepts
data that are submitted by the Participants and broker-dealers, as well
as data from certain market data feeds like SIP and OPRA.\662\
---------------------------------------------------------------------------

    \661\ See 17 CFR 242.613; see also section II.F.1.c. of this
release (discussing the CAT NMS Plan in general and describing the
roles of the Participants and Plan Processor).
    \662\ CAT data is not public, although some information in the
CAT may be available through public sources (e.g., market data feeds
like the SIP or proprietary exchange feeds).
---------------------------------------------------------------------------

    FINRA CAT, LLC--a wholly-owned subsidiary of FINRA--has entered
into an agreement with the Company to act as the Plan Processor and, as
such, is responsible for building, operating and maintaining the CAT.
However, because the CAT System is owned and operated by FINRA CAT, LLC
on behalf of the national securities exchanges and FINRA, the
Participants remain ultimately responsible for the performance of the
CAT and its compliance with statutes, rules, and regulations.

    Under the Commission approved CAT NMS Plan, the Plan Processor must
develop various policies and procedures related to data security,
including a comprehensive information security program that includes,
among other things, requirements related to: (1) connectivity and data
transfer, (2) data encryption, (3) data storage, (4) data access, (5)
breach management, including requirements related to the development of
a cyber incident response plan and documentation of all information
relevant to breaches, and (6) personally identifiable information data
management.\663\ As part of this requirement, the Plan Processor is
required to create and enforce policies, procedures, and control
structures to monitor and address CAT data security, including reviews
of industry standards \664\ and periodic penetration testing.\665\
Under the CAT NMS Plan the comprehensive information security program
must be updated by the Plan Processor at least annually.\666\
Furthermore, both the Participants and the Plan Processor must also
implement various data confidentiality measures that include safeguards
to secure access and use of the CAT.\667\ The Plan Processor must also
review Participant information security policies and procedures related
to the CAT to ensure that such policies and procedures are comparable
to those of the CAT System.\668\ In addition to these policies and
procedures requirements,\669\ the CAT NMS Plan requires several forms
of periodic review of CAT, including an annual written assessment,\670\
regular reports,\671\ and an annual audit.\672\
---------------------------------------------------------------------------

    \663\ See CAT NMS Plan, appendix D, sections 4 and 6.12.
    \664\ The Company is subject to certain industry standards with
respect to its comprehensive information security program, including
but not limited to: NIST 800-23 (Guidelines to Federal Organizations
on Security Assurance and Acquisition/Use of Test/Evaluated
Products), NIST 800-53 (Security and Privacy Controls for Federal
Information Systems and Organizations), NIST 800-115 (Technical
Guide to Information Security Testing and Assessment), and, to the
extent not otherwise specified, all other provisions of the NIST
cyber security framework. See CAT NMS Plan, Appendix D, section 4.2.
    \665\ Id. at section 6.2(b)(v); Appendix D, sections 4 and 6.12.
    \666\ See CAT NMS Plan at Appendix D, section 4.1.
    \667\ Specifically, the measures implemented by the Plan
Processor must include, among other things: (1) restrictions on the
acceptable uses of CAT Data; (2) role-based access controls; (3)
authentication of individual users; (4) MFA and password controls;
(5) implementation of information barriers to prevent unauthorized
staff from accessing CAT Data; (6) separate storage of sensitive
personal information and controls on transmission of data; (7)
security-driven monitoring and logging; (8) escalation of non-
compliance events or security monitoring; and (9) remote access
controls. Id. at Appendix D, sections 4.1, 5.3, 8.1.1, and 8.2.2;
section 6.2(a)(v)(J)-(L); section 6.2(b)(vii); section 6.5(c)(i);
section 6.5(f).
    \668\ CAT NMS Plan at section 6.2(b)(vii).
    \669\ In August 2020, the Commission proposed certain amendments
to the CAT NMS Plan that are designed to enhance the security of the
CAT. See https://www.sec.gov/rules/proposed/2020/34-89632.pdf.
    \670\ The Participants are required to provide the Commission
with an annual written assessment of the Plan Processor's
performance, which must include, among other things, an evaluation
of potential technology upgrades and an evaluation of the CAT
information security program. Id. at section 6.6(b); section
6.2(a)(v)(G).
    \671\ The Plan Processor is required to provide the operating
committee with regular reports on various topics, including data
security issues and the Plan Processor. Id. at section 6.1(o);
section 6.2(b)(vi); section 6.2(a)(v)(E); and section 4.12(b)(i).
    \672\ The Plan Processor is required to create and implement an
annual audit plan that includes a review of all Plan Processor
policies, procedures, control structures, and tools that monitor and
address data security, in addition to other types of auditing
practices. Id. at section 6.2(a)(v)(B)-(C); Appendix D, section
4.1.3; Appendix D, section 5.3.
---------------------------------------------------------------------------

iii. SBS Entities
    Section 15F(j)(2) of the Exchange Act, among other things, requires
each SBS Entity to establish robust and professional risk management
systems adequate for managing its day-to-day business.\673\
Additionally, certain SBS Entities must comply with specified
provisions of Rule 15c3-4 and, therefore, establish, document, and
maintain a system of internal risk management controls to assist in
managing the risks associated with their business activities.\674\
Further, SBS Entities could be subject to Regulation S-ID if they are
``financial institutions'' or ``creditors.'' \675\
---------------------------------------------------------------------------

    \673\ 15 U.S.C. 78o-10(j). The Commission also requires that
specified SBS Entity trading relationship documentation include the
process for determining the value of each security-based swap for
purposes of complying with, among other things, the risk management
requirements of section 15F(j) of the Exchange Act and paragraph
(h)(2)(iii)(I) of Rule 15Fh-3, and any subsequent regulations
promulgated pursuant to section 15F(j). See 17 CFR 140.15Fi-5(b)(4).
The documentation must include either: (1) alternative methods for
determining the value of the security-based swap in the event of the
unavailability or other failure of any input required to value the
security-based swap for such purposes; or (2) a valuation dispute
resolution process by which the value of the security-based swap
shall be determined for the purposes of complying with the rule. See
17 CFR 140.15Fi-5(b)(4)(ii). Further, SBS Entities must engage in
portfolio reconciliation to resolve discrepancies, among other
things. See 17 CFR 240.15Fi-3(a) and (b). Such discrepancies include
those resulting from a cybersecurity incident.
    \674\ See 17 CFR 240.15c3-1(a)(7)(iii) (applies to broker-
dealers authorized to use models, including broker-dealers dually
registered as an SBSD); 17 CFR 240.15c3-1(a)(10)(ii) (applies to
broker-dealers not authorized to use models that are dually
registered as an SBSD); 17 CFR 240.18a-1(f) (applies to SBSDs that
are not registered as a broker-dealer, other than an OTC derivatives
dealer, and that do not have a prudential regulator); 17 CFR
240.18a-2(c) (applies to MSBSPs); see also 17 CFR 240.15c3-4; see
section IV.C.1.b.i. of this section (discussing requirements of Rule
15c3-4).
    \675\ See 17 CFR 248.201 and 202. The scope of Regulation S-ID
includes any financial institution or creditor, as defined in the
Fair Credit Reporting Act (15. U.S.C. 1681) that is required to be
``registered under the Securities Act of 1934.'' See 17 CFR
248.201(a). Because SBS Entities are required to be so registered,
an SBS Entity that is a ``financial institution'' or ``creditor'' as
defined in the Fair Credit Reporting Act is within the scope of
Regulation S-ID.
---------------------------------------------------------------------------

    SBS Entities are subject to additional Commission rules to have
risk management policies and procedures, to review policies and
procedures, to report information about compliance to the Commission,
and to disclose certain risks to their counterparties. For example,
paragraph (h) of Rule 15Fh-3 requires, among other things, that an SBSD
or MSBSP establish, maintain, and enforce written policies and
procedures regarding the supervision of the types of security-based
swap business in which it is engaged and the activities of its
associated persons that are reasonably designed to prevent violations
of applicable federal securities laws and the rules and regulations
thereunder.\676\ The policies and procedures must include, among other
things: (1) procedures for a periodic review, at least annually, of the
security-based swap business in which the SBS Entity engages and (2)
procedures reasonably designed to comply with duties set forth in
section 15F(j) of the Exchange Act, such as risk management duties set
forth in section 15F(j)(2).\677\
---------------------------------------------------------------------------

    \676\ See 17 CFR 240.15Fh-3(h). An SBS Entity must amend its
written supervisory procedures, as appropriate, when material
changes occur in its business or supervisory system. Material
amendments to the SBS Entity's supervisory procedures must be
communicated to all associated persons to whom such amendments are
relevant based on their activities and responsibilities. See 17 CFR
240.15Fh-3(h)(4).
    \677\ See 17 CFR 240.15Fh-3(h)(2)(iii).
---------------------------------------------------------------------------

    Paragraph (b) of Rule 15Fk-1 requires each SBS Entity's CCO to,
among other things, report directly to the board of directors or to the
senior officer of the SBS Entity and to take reasonable steps to ensure
that the SBS Entity establishes, maintains, and reviews written
policies and procedures reasonably designed to achieve compliance with
the Exchange Act and the rules and regulations thereunder relating to
its business as an SBS Entity by: (1) reviewing its compliance with
respect to the requirements described in section 15F of the Act and the
rules and regulations thereunder, where the review involves preparing
the an annual assessment of its written policies and procedures
reasonably designed to achieve compliance with section 15F of

the Act and the rules and regulations thereunder; (2) taking reasonable
steps to ensure that the SBS Entity establishes, maintains, and reviews
policies and procedures reasonably designed to remediate non-compliance
issues identified by the chief compliance officer through any means;
and (3) taking reasonable steps to ensure that the SBS Entity
establishes and follows procedures reasonably designed for the
handling, management response, remediation, retesting, and resolution
of non-compliance issues.\678\
---------------------------------------------------------------------------

    \678\ See 17 CFR 240.15Fk-1(b)(2). The CCO also must administer
each policy and procedure that is required to be established
pursuant to section 15F of the Exchange Act and the rules and
regulations thereunder. See 17 CFR 240.15Fk-1(b)(4).
---------------------------------------------------------------------------

    Paragraph (c) of Rule 15Fk-1 requires an SBS Entity to submit an
annual compliance report containing, among other things, a description
of: (1) its assessment of the effectiveness of its policies and
procedures relating to its business as an SBS Entity; (2) any material
changes to the SBS Entity's policies and procedures since the date of
the preceding compliance report; (3) any areas for improvement, and
recommended potential or prospective changes or improvements to its
compliance program and resources devoted to compliance; (4) any
material non-compliance matters identified; and (5) the financial,
managerial, operational, and staffing resources set aside for
compliance with the Exchange Act and the rules and regulations
thereunder relating to its business as a SBSD or MSBSP, including any
material deficiencies in such resources.\679\ The compliance report
must be submitted to the Commission within 30 days following the
deadline for filing the SBS Entity's annual financial report.\680\
---------------------------------------------------------------------------

    \679\ See 17 CFR 240.15Fk-1(c)(2).
    \680\ Id.
---------------------------------------------------------------------------

    SBS Entities' operations also are governed, in part, by paragraph
(b) of Rule 15Fh-3 in that they must, at a reasonably sufficient time
prior to entering into a security-based swap, disclose to a
counterparty (other than a SBSD, MSBSP, swap dealer, or major swap
participant) material information concerning the security-based swap in
a manner reasonably designed to allow the counterparty to assess
material risks and characteristics as well as material incentives or
conflicts of interest.\681\ Relevant risks may include market, credit,
liquidity, foreign currency, legal, operational, and any other
applicable risks.\682\ Further, SBSDs must establish, maintain, and
enforce written policies and procedures reasonably designed to obtain
and retain a record of the essential facts concerning each counterparty
whose identity is known to the SBSD that are necessary for conducting
business with such counterparty.\683\ Among other things, the essential
facts regarding the counterparty are facts required to implement the
SBSD's operational risk management policies in connection with
transactions entered into with such counterparty.\684\
---------------------------------------------------------------------------

    \681\ See 17 CFR 240.15Fh-3(b).
    \682\ See 17 CFR 240.15Fh-3(b)(1).
    \683\ See 17 CFR 240.15Fh-3(e).
    \684\ See 17 CFR 240.15Fh-3(e)(2).
---------------------------------------------------------------------------

iv. SBSDRs
    Section 13(n) of the Exchange Act specifies the requirements and
core principles with which SBSDRs are required to comply. The
Commission adopted rules that cover the receiving and maintenance of
security-based swap data, how entities can access such information, and
the maintaining the continued privacy of confidential information.
Security-based swap data repositories must have written policies and
procedures reasonably designed to review any prohibition or limitation
of any person with respect to access to services offered, directly or
indirectly, or data maintained by the SBSDR.\685\
---------------------------------------------------------------------------

    \685\ 17 CFR 240.13n-4(c)(1)(iv).
---------------------------------------------------------------------------

    The SBSDRs must enforce written policies and procedures reasonably
designed to protect the privacy of security-based swap transaction
information.\686\ As a result, they must establish and maintain
safeguards, policies, and procedures reasonably designed to prevent the
misappropriation or misuse, directly or indirectly, of confidential
information, including, but not limited to, trade data; position data;
and any nonpublic personal information about a market participant or
any of its customers, material, nonpublic information, and/or
intellectual property, such as trading strategies or portfolio
positions, by the SBSDR or any person associated with the SBSDR for
personal benefit or for the benefit of others. Such safeguards,
policies, and procedures must address, without limitation: (1) limiting
access to such confidential information, material, nonpublic
information, and intellectual property; (2) standards pertaining to
trading by persons associated with the SBSDR for their personal benefit
or for the benefit of others; and (3) adequate oversight to ensure
compliance with these safeguards. These rules cover potential
unauthorized access from within or outside of the SBSDR, which could
include a cybersecurity breach.\687\
---------------------------------------------------------------------------

    \686\ 17 CFR 240.13n-9(b)(1).
    \687\ 17 CFR 240.13n-9(b)(2).
---------------------------------------------------------------------------

    Additionally, a SBSDR must furnish to a market participant, prior
to accepting its securities-based swap data, a disclosure document that
contains information from which the market participant can identify and
evaluate accurately the risks and costs associated with using the
services of the SBSDR.\688\ Key points include, among other things, the
criteria for providing others with access to services offered and data
maintained by the SBSDR; criteria for those seeking to connect to or
link with the SBSDR; policies and procedures regarding the SBDR's
safeguarding of data and operational reliability, as described in Rule
13n-6; policies and procedures reasonably designed to protect the
privacy of any and all security-based swap transaction information that
the SBSDR receives from a SBSD, counterparty, or any registered entity,
as described in Rule 13n-9(b)(1); policies and procedures regarding its
non-commercial and/or commercial use of the security-based swap
transaction information that it receives from a market participant, any
registered entity, or any other person; dispute resolution procedures
involving market participants, as described in Rule 13n-5(b)(6); and
governance arrangements of the swap-based security data
repository.\689\
---------------------------------------------------------------------------

    \688\ See 17 CFR 240.13n-10.
    \689\ See 17 CFR 240.13n-10(b).
---------------------------------------------------------------------------

v. Transfer Agents
    Transfer agents registered with the Commission (but not transfer
agents registered with another appropriate regulatory agency) are
subject to the Regulation S-P Disposal Rule.\690\ Transfer agents also
may be subject to Regulation S-ID if they are ``financial
institutions'' or ``creditors.'' \691\ As discussed earlier, the
Regulation S-P Disposal Rule and Regulation S-ID have provisions
requiring policies and procedures to address certain types of
cybersecurity risks.\692\
---------------------------------------------------------------------------

    \690\ See 17 CFR 248.30(b)(2).
    \691\ See 17 CFR 248.201 and 202. The scope of Regulation S-ID
includes any financial institution or creditor, as defined in the
Fair Credit Reporting Act (15 U.S.C. 1681) that is required to be
``registered under the Securities Exchange Act of 1934.'' See 17 CFR
248.201(a).
    \692\ See section II.F.1.c. of this release (discussing in more
detail the existing requirements of the Regulation S-P Disposal Rule
and Regulation S-ID to have policies and procedures to address
certain cybersecurity risks).
---------------------------------------------------------------------------

    Rule 17Ad-12 requires transfer agents to ensure that all securities
are held in safekeeping and are handled, in light of all facts and
circumstances, in a manner that is reasonably free from risk of theft,
loss, or destruction. In addition, the transfer agent must ensure that
funds

are protected, in light of all facts and circumstances, against misuse.
In evaluating which particular safeguards and procedures must be
employed, the cost of the various safeguards and procedures as well as
the nature and degree of potential financial exposure are two relevant
factors.\693\
---------------------------------------------------------------------------

    \693\ 17 CFR 240.17Ad-12(a).
---------------------------------------------------------------------------

    Transfer agents are subject indirectly to state corporation law
when acting as agents of corporate issuers, and they are directly
subject to state commercial law, principal-agent law, and other laws,
many of which are focused on corporate governance and the rights and
obligations of issuers and securityholders.\694\ The transfer of
investment securities is primarily governed by UCC Article 8, which has
been adopted by the legislatures of all 50 states,\695\ the District of
Columbia, Puerto Rico, and the Virgin Islands. Transfer agents may also
be subject to the laws of the states of incorporation for both issuers
and their securityholders that apply to specific services provided by
the transfer agent, such as data privacy.\696\
---------------------------------------------------------------------------

    \694\ See, e.g., Del. Code Ann. tit. 8 (Delaware General
Corporation Law), Del. Code Ann. tit. 6, art. 8 (Investment
Securities), Restatement (Third) of Agency (2006).
    \695\ Louisiana has enacted the provisions of Article 8 into the
body of its law, among others, but has not adopted the UCC as a
whole.
    \696\ For example, California's privacy statute which became
effective in 2003, was the first significant effort by a state to
assert substantive regulation of privacy of customer data. See Cal.
Civ. Code Sec. Sec.  [thinsp]1798.80-1798.84. While state
regulations vary across jurisdictions, other states have followed
suit with similar regulatory initiatives. See, e.g., Minn. Stat.
Sec.  [thinsp]325E.61, Neb. Rev. Stat. Sec. Sec.  [thinsp]87-801-
807.
---------------------------------------------------------------------------

c. Market Entities Subject to CFTC Regulations
    Certain types of Market Entities are dually registered with the
Commission and the CFTC. For example, some clearing agencies are
registered with the CFTC as derivative clearing organizations
(``DCOs'') and some SBSDRs are registered with the CFTC as swap data
repositories (``SDRs''). In addition, some broker-dealers are
registered with the CFTC as futures commission merchants (``FCMs'') or
swap dealers. Most currently registered SBSDs are also registered with
the CFTC as swap dealers. As CFTC registrants, these Market Entities
are subject to requirements that pertain to cybersecurity or are
otherwise relevant to the proposals in this release.
i. Requirements for DCOs
    DCOs are subject to a CFTC systems safeguards rule.\697\ This rule
requires them--among other things--to establish and maintain: (1) a
program of risk analysis and oversight with respect to their operations
and automated systems to identify and minimize sources of operational
risk; and (2) a business continuity and disaster recovery plan,
emergency procedures, and physical, technological, and personnel
resources sufficient to enable the timely recovery and resumption of
operations and the fulfillment of each obligation and responsibility of
the DCO, including, but not limited to, the daily processing, clearing,
and settlement of transactions, following any disruption of its
operations.\698\ The safeguards rule also requires vulnerability and
penetration testing (among other things).\699\ Further, it requires
notice to the CFTC staff if the DCO experiences certain exceptional
events.\700\
---------------------------------------------------------------------------

    \697\ See 17 CFR 39.18.
    \698\ See 17 CFR 39.18(b) and (c). The program of risk analysis
and oversight must include--among other elements--information
security, including, but not limited to, controls relating to:
access to systems and data (including, least privilege, separation
of duties, account monitoring and control); user and device
identification and authentication; security awareness training;
audit log maintenance, monitoring, and analysis; media protection;
personnel security and screening; automated system and
communications protection (including, network port control, boundary
defenses, encryption); system and information integrity (including,
malware defenses, software integrity monitoring); vulnerability
management; penetration testing; security incident response and
management; and any other elements of information security included
in generally accepted best practices. See 17 CFR 39.18(b)(2)(i).
    \699\ See 17 CFR 39.18(e).
    \700\ See 17 CFR 39.18(g).
---------------------------------------------------------------------------

ii. Requirements for SDRs
    SDRs are subject to a CFTC systems safeguards rule.\701\ This rule
requires them--among other things--to: (1) establish and maintain a
program of risk analysis and oversight to identify and minimize sources
of operational risk through the development of appropriate controls and
procedures and the development of automated systems that are reliable,
secure, and have adequate scalable capacity; (2) establish and maintain
emergency procedures, backup facilities, and a business continuity-
disaster recovery plan that allow for the timely recovery and
resumption of operations and the fulfillment of their duties and
obligations as an SDR; and (3) periodically conduct tests to verify
that backup resources are sufficient to ensure continued fulfillment of
all their duties under the Commodity Exchange Act and the CFTC's
regulations.\702\ The program of risk analysis and oversight required
by the SDR safeguards rule--among other things--must address: (1)
information security; and (2) business continuity-disaster recovery
planning and resources.\703\ The safeguards rule also requires the SDR
to notify the CFTC promptly of--among other events--all cyber security
incidents or targeted threats that actually or potentially jeopardize
automated systems operation, reliability, security, or capacity.\704\
---------------------------------------------------------------------------

    \701\ See 17 CFR 49.24.
    \702\ See 17 CFR 49.24(a).
    \703\ See 17 CFR 49.24(b)(2) and (3). For the purposes of the
SDR safeguards rule, information security includes, but is not
limited to, controls relating to: access to systems and data
(including least privilege, separation of duties, account monitoring
and control); user and device identification and authentication;
security awareness training; audit log maintenance, monitoring, and
analysis; media protection; personnel security and screening;
automated system and communications protection (including network
port control, boundary defenses, encryption); system and information
integrity (including malware defenses, software integrity
monitoring); vulnerability management; penetration testing; security
incident response and management; and any other elements of
information security included in generally accepted best practices.
See 17 CFR 49.24(b)(2).
    \704\ See 17 CFR 49.24(g)(2).
---------------------------------------------------------------------------

iii. Requirements for FCMs and Swap Dealers
    The CFTC does not have a cybersecurity regime for FCMs and swap
dealers comparable to that being proposed in this release.\705\
However, FCMs and swap dealers are currently subject to information
security requirements by virtue of their membership with the National
Futures Association (NFA).\706\ Specifically, NFA

examines swap dealers and FCMs for compliance with NFA Interpretive
Notice 9070, which establishes general requirements for NFA members
relating to their information systems security programs (ISSPs).\707\
The notice requires members to adopt and enforce a written ISSP
reasonably designed to provide safeguards to protect against security
threats or hazards to their technology systems. The safeguards must be
appropriate to the member's size, complexity of operations, type of
customers and counterparties, the sensitivity of the data accessible
within its systems, and its electronic interconnectivity with other
entities. The notice further provides guidance on how to meet this
requirement, including that members should document and describe the
safeguards in the ISSP, identify significant internal and external
threats and vulnerabilities, create an incident response plan, and
monitor and regularly review their ISSPs for effectiveness, among other
things. Members should also have procedures to promptly notify NFA in
the form and manner required of a cybersecurity incident related to the
member's commodity interest business and that results in: (1) any loss
of customer or counterparty funds; (2) any loss of a member's own
capital; or (3) in the member providing notice to customers or
counterparties under state or federal law.
---------------------------------------------------------------------------

    \705\ Current CFTC requirements relating to information security
for FCMs and swap dealers are more general in nature or limited in
application. See, e.g., 17 CFR 23.600(c)(4)(vi) (providing that swap
dealer's risk management program policies and procedures shall take
into account, among other things, secure and reliable operating and
information systems with adequate, scalable capacity, and
independence from the business trading unit; safeguards to detect,
identify, and promptly correct deficiencies in operating and
information systems; and reconciliation of all data and information
in operating and information systems); 162.21, 160.30 (requiring
FCMs and swap dealers to adopt written policies and procedures
addressing administrative, technical, and physical safeguards with
respect to the information of consumers). The current CFTC Chairman
has, however, announced support for developing cybersecurity
requirements for FCMs and swap dealers. See CFTC, Address of
Chairman Rostin Behnam at the ABA Business Law Section Derivatives &
Futures Law Committee Winter Meeting (Feb. 3, 2023), available at
https://www.cftc.gov/PressRoom/SpeechesTestimony/opabehnam31.
    \706\ See NFA, Interpretive Notice 9070--NFA Compliance Rules 2-
9, 2-36 and 2-49: Information Systems Security Programs (Sept. 30,
2019), available at https://www.nfa.futures.org/rulebooksql/rules.aspx?RuleID=9070&Section=9. NFA has also issued guidance
relating to the oversight of third-party service providers. See NFA,
Interpretive Notice 9079--NFA Compliance Rules 2-9 and 2-36:
Members' Use of Third-Party Service Providers (Sept. 30, 2021),
available at https://www.nfa.futures.org/rulebooksql/rules.aspx?Section=9&RuleID=9079.
    \707\ Id.
---------------------------------------------------------------------------

    The CFTC does require swap dealers to establish and maintain a
business continuity and disaster recovery plan that outlines the
procedures to be followed in the event of an emergency or other
disruption of their normal business activities.\708\ The business
continuity and disaster recovery plan must be designed to enable the
swap dealer to continue or to resume any operations by the next
business day with minimal disturbance to its counterparties and the
market, and to recover all documentation and data required to be
maintained by applicable law and regulation.\709\ The business
continuity and disaster recovery plan must--among other requirements--
be tested annually by qualified, independent internal personnel or a
qualified third party service.\710\ The date the testing was performed
must be documented, together with the nature and scope of the testing,
any deficiencies found, any corrective action taken, and the date that
corrective action was taken.\711\
---------------------------------------------------------------------------

    \708\ See 17 CFR 23.603. The business continuity and disaster
recovery plan must include: (1) the identification of the documents,
data, facilities, infrastructure, personnel and competencies
essential to the continued operations of the swap dealer and to
fulfill its obligations; (2) the identification of the supervisory
personnel responsible for implementing each aspect of the business
continuity and disaster recovery plan and the emergency contacts
required to be provided; (3) a plan to communicate with specific
persons the in the event of an emergency or other disruption, to the
extent applicable to the operations of the swap dealer; (4)
procedures for, and the maintenance of, back-up facilities, systems,
infrastructure, alternative staffing and other resources to achieve
the timely recovery of data and documentation and to resume
operations as soon as reasonably possible and generally within the
next business day; (5) maintenance of back-up facilities, systems,
infrastructure and alternative staffing arrangements in one or more
areas that are geographically separate from the swap dealer's
primary facilities, systems, infrastructure and personnel (which may
include contractual arrangements for the use of facilities, systems
and infrastructure provided by third parties); (6) back-up or
copying, with sufficient frequency, of documents and data essential
to the operations of the swap dealer or to fulfill the regulatory
obligations of the swap dealer and storing the information off-site
in either hard-copy or electronic format; and (7) the identification
of potential business interruptions encountered by third parties
that are necessary to the continued operations of the swap dealer
and a plan to minimize the impact of such disruptions. See 17 CFR
23.603(b).
    \709\ See 17 CFR 23.603(a).
    \710\ See 17 CFR 23.603(g).
    \711\ Id.
---------------------------------------------------------------------------

d. Market Entities Subject to Federal Banking Regulations
    Broker-dealers affiliated with a banking organization \712\ and
some SBS Entities and transfer agents that are banking organizations
are subject to the requirements of prudential regulators such as the
FDIC, Federal Reserve Board, and the OCC. These prudential regulators
have rules requiring banking organizations to notify them no later than
36 hours after learning of a ``computer-security incident,'' which is
defined ``as an occurrence that results in actual harm to the
confidentiality, integrity, or availability of an information system or
the information that the system processes, stores, or transmits.''
---------------------------------------------------------------------------

    \712\ In the simplification of the Volcker Rule, effective Jan.
21, 2020, Commission staff estimated that there were 202 broker-
dealers that were affiliated with banking organizations.
---------------------------------------------------------------------------

    The rule also requires a bank service provider to notify at least
one bank-designated point of contact at each affected customer bank as
soon as possible when it determines it has experienced a computer-
security incident that has materially disrupted or degraded, or is
reasonably likely to disrupt or degrade, covered services provided to
the bank for four or more hours. If the bank has not previously
provided a designated point of contact, the notification must be made
to the bank's chief executive officer (``CEO'') and CIO or to two
individuals of comparable responsibilities.'' \713\ Prudential
regulators have also published guidance for banking organizations
relating to cybersecurity.\714\
---------------------------------------------------------------------------

    \713\ See 12 CFR 53.1 through 53.4 (OCC); 12 CFR 225.300 through
225.303 (Federal Reserve Board); 12 CFR 304.21 through 24 (FDIC).
    \714\ See, e.g., SR 21-14: Authentication and Access to
Financial Institution Services and Systems (Aug. 11, 2021),
available at https://www.federalreserve.gov/supervisionreg/srletters/sr2114.htm; SR 15-9: FFIEC Cybersecurity Assessment Tool
for Chief Executive Officers and Boards of Directors (July 2, 2015),
available at https://www.federalreserve.gov/supervisionreg/srletters/sr1509.htm; SR 05-23/CA 05-10: Interagency Guidance on
Response Programs for Unauthorized Access to Customer Information
and Customer Notice (Dec. 1, 2005), available at https://www.federalreserve.gov/boarddocs/srletters/2005/SR0523.htm.
---------------------------------------------------------------------------

e. Information Sharing
    Information sharing is an important part of cybersecurity. Alerts
that are issued by the Commission or by the securities industry make
Market Entities aware of trends in cybersecurity incidents and
potential threats. This advanced warning can help Market Entities to
prepare for future cybersecurity attacks by testing and upgrading their
cybersecurity infrastructure.
    The value of such information sharing has long been recognized. In
1998, Presidential Decision Directive 63 established industry-based
information sharing and analysis centers (``ISACs'') to promote the
disclosure and sharing of cybersecurity information among firms.\715\
The FS-ISAC provides financial firms with such a forum.\716\ However,
observers have questioned the efficacy of these information-sharing
partnerships.\717\ Although the Commission does not have data on the
extent of Market Entities' use of such forums or their efficacy,
surveys of securities firms conducted by FINRA suggest that there is
considerable variation in firms' willingness to share

information about cybersecurity threats on a voluntary basis, with
larger firms being more likely to do so.\718\ Similarly, a recent
survey of financial firms found that while recognition of the value of
information-sharing arrangements is widespread, the majority of firms
report hesitance to participate due to regulatory restrictions or
privacy concerns.\719\
---------------------------------------------------------------------------

    \715\ See President Decision Directive/NSC-63, Critical
Infrastructure Protection (May 22, 1998); Presidential Decision
Directive 63, Critical Infrastructure Protection: Sector
Coordinators, 98 FR 41804 (Aug. 5, 1998) (notice and request for
expressions of interest); see also National Council of ISACs,
available at https://www.nationalisacs.org.
    \716\ Information about FS-ISAC is available at https://www.fsisac.com.
    \717\ See James A. Lewis and Denise E. Zheng, Cyber Threat
Information Sharing, 2015 Cre. for Strategic and Int'l Stud. 62
(Mar. 2015) (stating that the ``benefits of information sharing,
when done correctly, are numerous'' but that [p]rogrammatic,
technical, and legal challenges, as well as lack of buy-in from the
stakeholder community, are the key impediments'' to effective
information-sharing partnerships).
    \718\ See FINRA Report on Cybersecurity Practices. Survey
respondents included large investment banks, clearing firms, online
brokerages, high-frequency traders, and independent dealers.
    \719\ See Julie Bernard, Mark Nicholson, and Deborah Golden,
Reshaping the Cybersecurity Landscape, Deloitte (Jul. 24, 2020),
available at https://www2.deloitte.com/us/en/insights/industry/financial-services/cybersecurity-maturity-financial-institutions-cyber-risk.html (``Reshaping the Cybersecurity Landscape''). Survey
respondents consisted of CISOs (or equivalent) of 53 members of the
FS-ISAC. Of the respondents, 24 reported being in the retail/
corporate banking sector, 20 reported being in the consumer/
financial services (non-banking) sector, and 17 reported being in
the insurance sector. Other respondents included IT service
providers, financial utilities, trade associations, and credit
unions. Some respondents reported being in multiple sectors.
---------------------------------------------------------------------------

    Market surveillance and regulatory activities--such as enforcement
by SROs--can result in information sharing with--and referrals to--the
Commission and other federal agencies, particularly if the issues being
investigated are cybersecurity related.
f. Adequacy of Current Cybersecurity Policies and Procedures
    While spending on cybersecurity measures in the financial services
industry is considerable, and the growing risk of cybersecurity events
has led many corporate executives to significantly increase their
cybersecurity budget,\720\ the budget levels themselves are not the
most important facet of a cybersecurity program.\721\ In a recent
survey of 20 consumer/financial (non-banking) services firms,
respondents ranked cybersecurity budget levels lower than other facets
of cybersecurity maintenance.\722\ For example, financial companies'
boards and management teams indicated that overall cybersecurity
strategy, the identification threats and cybersecurity risks, the
firm's susceptibility to breaches when other financial institutions are
successfully attacked, and the results of cybersecurity testing all
ranked higher than security budgets themselves.\723\ Surveys of
financial services firms indicate that 10.5% of their information
technology budgets are spent on cybersecurity, and the per-employee
expenditure is approximately $2,348 annually as of 2020.\724\ This per-
employee value can be used to estimate the cybersecurity expenditures
at each of the Market Entities that would be affected by the proposed
rule.\725\
---------------------------------------------------------------------------

    \720\ For example, according to one source, as of 2020, ``55% of
enterprise executives [were planning] to increase their
cybersecurity budgets in 2021 and 51% are adding full-time cyber
staff in 2021.'' Louis Columbus, The Best Cybersecurity Predictions
for 2021 Roundup, Forbes.com (Dec. 15, 2020), available at https://www.forbes.com/sites/louiscolumbus/2020/12/15/the-best-cybersecurity-predictions-for-2021-roundup/?sh=6d6db8b65e8c.
    \721\ See Reshaping the Cybersecurity Landscape.
    \722\ Id.
    \723\ Id.
    \724\ Id.
    \725\ The per-employee expenditure can be multiplied by the
Market Entity's employee head count on a full-time equivalent basis
to estimate its spending on cybersecurity protection.
---------------------------------------------------------------------------

2. Market Structure
a. Broker-Dealers
    The operations and functions of broker-dealers are discussed
earlier in this release.\726\ The following broker-dealers would be
Covered Entities: (1) broker-dealers that maintain custody of
securities and cash for customers or other broker-dealers (i.e.,
carrying broker-dealers); (2) broker-dealers that introduce their
customer accounts to a carrying broker-dealer on a fully disclosed
basis (i.e., introducing broker-dealers); (3) broker-dealers with
regulatory capital equal to or exceeding $50 million; (4) broker-
dealers with total assets equal to or exceeding $1 billion; (5) broker-
dealers that operate as market makers; and (6) broker-dealers that
operate an ATS.\727\ Broker-dealers that do not fall into one of those
six categories would not be Covered Entities (i.e., they would be Non-
Covered Broker-Dealers). As discussed above, broker-dealers that are
Covered Entities would be subject to additional policies and
procedures, reporting, and disclosure requirements under proposed Rule
10.\728\ These additional requirements would not apply to broker-
dealers that are not Covered Entities.\729\
---------------------------------------------------------------------------

    \726\ See section I.A.2.b. of this release.
    \727\ See paragraphs (a)(1)(i)(A) through (F) of proposed Rule
10.
    \728\ See paragraph (b) through (d) of proposed Rule 10 (setting
forth the requirements for Market Entities that meet the definition
of ``covered entity'').
    \729\ See paragraph (e) of proposed Rule 10 (setting forth the
requirements for Market Entities that do not meet the definition of
``covered entity'').
---------------------------------------------------------------------------

    Table 1 presents a breakdown of all broker-dealers registered with
the Commission as of the third quarter of 2022. Based on 2022 FOCUS
Part II/IIA data, there were 3,510 registered broker-dealers with
average total assets of $1.5 billion and average regulatory capital of
$144 million. Of those broker-dealers, 1,541 would be classified as
Covered Entities with average total assets of $3.5 billion and average
regulatory capital of $325 million. Meanwhile, the 1,969 brokers that
would be classified as Non-Covered Broker-Dealers were generally much
smaller than broker-dealers that would be classified as Covered
Entities, having an average total asset level of $4.7 million and
regulatory capital of $3 million. In other words, Non-Covered Broker-
Dealers accounted for only about 0.2 percent of total asset value and
only 0.1 percent of total regulatory capital in the third quarter of
2022.
    The majority of small broker-dealers, as defined by Rule 0-10 \730\
were classified as Non-Covered Broker-Dealers (74%) compared to a
minority of small broker-dealers that were classified as Covered
Entities (26%), which means that most small broker-dealers would be
subject to the less stringent regulatory requirements under the
proposed Rule 10 for Non-Covered Broker-Dealers. The small broker-
dealers that qualified as Covered Entities and would be subject to
additional requirements of proposed Rule 10 generally were broker-
dealers that introduce their customer accounts to carrying broker-
dealers on a fully disclosed basis.
---------------------------------------------------------------------------

    \730\ See 17 CFR 240.0-10 (``Rule 0-10'') for definition of
small entities including small broker-dealers under the Exchange Act
for purposes of the Regulatory Flexibility Act (``RFA''). This
definition is for the economic analysis only. See also section VI of
this release (setting forth the Commission's RFA analysis).

                        Table 1--Broker-Dealers as Covered Entities as of September 2022
                           [Average broker-dealer total assets and regulatory equity]
----------------------------------------------------------------------------------------------------------------
                                                                                Average
                                   Total number      Number of       Number of     Average total    regulatory
    Categories of covered BDs         of BDs         small BDs      retail BDs        assets          equity
                                                     included                       (millions)      (millions)
----------------------------------------------------------------------------------------------------------------
Carrying........................             162               0             145       $28,250.9        $2,528.7
Introducing.....................            1219             195            1106           103.0            44.3
Market making...................              19               0               1           179.2            17.4

ATS.............................              36               0              21             4.1             3.1
>$50 Million Regulatory Equity               105               0              44         6,891.6           351.5
 and/or >$1 billion total assets
----------------------------------------------------------------------------------------------------------------
Covered.........................            1541             195            1317         3,523.3           325.1
----------------------------------------------------------------------------------------------------------------
Non-Covered.....................            1969             569            1115             4.7             3.0
                                 -------------------------------------------------------------------------------
    Total.......................            3510             764            2432         1,549.9           144.4
----------------------------------------------------------------------------------------------------------------

    Covered Broker-Dealers provide a broad spectrum of services to
their clients, including, for example: trade execution, clearing,
market making, margin and securities lending, sale of investment
company shares, research services, underwriting and selling, retail
sales of corporate securities, private placements, and government and
Series K securities sales and trading. In contrast, Non-Covered Broker-
Dealers tend to offer a more focused and limited set of services.
    In terms of specific services offered, as presented in Table 2
below, while the majority of broker-dealers that are Covered Entities
have lines of business devoted to broker and dealer services across a
broad spectrum of financial instruments, Non-Covered Broker-Dealers as
a whole focus on private placements. In addition, a significant
minority of Non-Covered Broker-Dealers also engages in mutual fund
sales and underwriting, variable contract sales, corporate securities
underwriting, and direct investment offerings.

   Table 2--Lines of Business at Broker-Dealers as of September 2022 *
  [Percent of covered entity and non-covered broker-dealers engaged in
                         each line of business]
------------------------------------------------------------------------
                                            Percent of    Percent of non-
                                          covered broker- covered broker-
            Line of business                  dealers         dealers
                                             (percent)       (percent)
------------------------------------------------------------------------
Retailing Corporate Equity Securities               76.4             8.1
 Over The Counter.......................
Corporate Debt Securities...............            69.6             7.9
Mutual Funds............................            62.2            19.5
Private Placements......................            58.1            72.1
Options.................................            58.1             3.7
US Government Securities Broker.........            56.2             3.9
Municipal Debt/Bonds--Broker............            53.1             6.4
Other Securities Business...............            52.0            65.1
Underwriter--Corporate Securities.......            45.0            11.5
Trading Via Floor Broker................            43.4             5.7
Variable Contracts......................            42.4            16.3
Proprietary Trading.....................            40.4             3.8
Investment Advisory Services............            25.8             4.6
Municipal Debt/Bonds--Dealer............            25.4             1.5
Direct investments--Primary.............            21.2            13.2
US Government Securities Dealer.........            20.7             0.9
Other Non-Securities Business...........            18.1            11.2
Time Deposits...........................            16.5             1.2
Commodities.............................            12.5             1.1
Market Making...........................            12.3             0.6
Mortgage or Asset Backed Securities.....            11.9             1.3
Bank Networking/Kiosk Relationship......            11.0             0.4
Internet/Online Trading Accounts........            10.8             0.5
Exchange Non-Floor Activities...........            10.6             0.9
Direct investments--Secondary...........             8.2             2.0
Oil and Gas Interests...................             7.9             3.1
Underwriter--Mutual Funds...............             6.4             7.8
Exchange Floor Activities...............             5.9             1.2
Executing Broker........................             5.5             0.6
Day Trading Accounts....................             4.8             0.3
Insurance Networking/Kiosk Relationship.             4.7             0.6
Non Profit Securities...................             4.2             0.4
Real Estate Syndication.................             2.8             2.8
Prime Broker............................             1.6             0.0
Issuer Affiliated Broker................             1.2             1.1
Clearing Broker in a Prime Broker                    1.2             0.0
 Arrangement............................
Crowdfunding FINRA Rule 4518 (a)........             0.7             1.1
Funding Portal..........................             0.2             0.3
Crowdfunding FINRA Rule 4518 (b)........             0.1             0.3

Capital Acquisition Broker..............             0.1             1.2
------------------------------------------------------------------------
* This information is derived from Form BD, Question 12.

    As of November 2022, there were 33 NMS Stock ATSs with an effective
Form ATS-N on file with the Commission \731\ and 68 non-NMS Stock ATSs
with a Form ATS on file with the Commission.\732\ Most broker-dealer
ATS operators operate a single ATS.
---------------------------------------------------------------------------

    \731\ See Form ATS-N Filings and Information, available at
https://www.sec.gov/divisions/marketreg/form-ats-n-filings.htm.
    \732\ See the current list of registered ATSs on the
Commission's website, available at https://www.sec.gov/foia/docs/atslist.
---------------------------------------------------------------------------

b. Clearing Agencies
    The operations and functions of clearing agencies are discussed
earlier in this release.\733\ A clearing agency (whether registered
with the Commission or exempt) would be considered a Covered Entity
under proposed Rule 10.\734\ There are a total of 16 clearing agencies
that would meet the definition of a Covered Entity under proposed Rule
10. There are seven registered and active clearing agencies: DTC, FICC,
NSCC, ICC, ICEEU, the Options Clearing Corp., and LCH SA. Two clearing
agencies are registered with the Commission but are inactive and
currently do not provide clearing and settlement activities. Those
clearing agencies are the BSECC and SCCP.\735\ In addition, there are
five clearing agencies that are exempt from registering with the
Commission. Those exempt clearing agencies are DTCC ITP Matching U.S.
LLC, Bloomberg STP LLC, and SS&C Technologies, Inc., which provide
matching services; and Clearstream Banking, S.A. and Euroclear Bank SA/
NV, which provide clearing agency services with respect to transactions
involving U.S. government and agency securities for U.S.
participants.\736\
---------------------------------------------------------------------------

    \733\ See section I.A.2.c. of this release.
    \734\ See paragraph (a)(1)(iii). of proposed Rule 10.
    \735\ BSECC and SCCP have not provided clearing services in over
a decade. See BSECC Notice (stating that BSECC ``returned all
clearing funds to its members by September 30, 2010, and [ ] no
longer maintains clearing members or has any other clearing
operations as of that date . . . . BSECC [ ] maintain[s] its
registration as a clearing agency with the Commission for possible
active operations in the future''); SCCP Notice (noting that SCCP
``returned all clearing fund deposits by September 30, 2009; [and]
as of that date SCCP no longer maintains clearing members or has any
other clearing operations . . . . SCCP [] maintain[s] its
registration as a clearing agency for possible active operations in
the future.''). BSECC and SCCP are included in the economic baseline
and must be considered in the benefits and costs analysis due to
their registration with the Commission. They also are included in
the PRA for purposes of the PRA estimate. See section V of this
release (setting forth the Commission's PRA analysis).
    \736\ In addition to the 14 clearing agencies discussed above,
the Commission's expects that two entities may apply to register or
to seek an exemption from registration as a clearing agency in the
next three years. As a result, they were included in the PRA in
section V.
---------------------------------------------------------------------------

    Of the seven operating registered clearing agencies, six provide
CCP clearing services and one provides CSD services. In addition, NSCC,
FICC, and DTC are all registered clearing agencies that are
subsidiaries of the Depository Trust and Clearing Corporation.
Together, this subset of registered clearing agencies offer clearing
and settlement services for equities, corporate, and municipal bonds,
government and mortgage-backed securities, derivatives, money market
instruments, syndicated loans, mutual funds, and alternative investment
products in the United States. ICC and ICEEU are both registered
clearing agencies for credit default swaps (``CDS'') and are both
subsidiaries of ICE. LCH SA, a France-based subsidiary of LCH Group
Holdings Ltd, is a registered clearing agency that also offers clearing
for CDS. The seventh registered clearing agency, the Options Clearing
Corp., offers clearing services for exchange-traded U.S. equity
options.
c. The MSRB
    The operations and functions of the MSRB are discussed earlier in
this release.\737\ The MSRB would be considered a Covered Entity under
proposed Rule 10.\738\ As an SRO registered with the Commission, the
MSRB protects municipal securities investors, municipal entities,
obligated persons, and the public interest. While the MSRB used to only
regulate the activities of broker-dealers and banks that buy, sell, and
underwrite municipal securities, it regulates certain activities of
municipal advisors.
---------------------------------------------------------------------------

    \737\ See section I.A.2.d. of this release.
    \738\ See paragraph (a)(1)(iv) of proposed Rule 10.
---------------------------------------------------------------------------

d. National Securities Associations
    The operations and functions of national securities association are
discussed earlier in this release.\739\ A national securities
association would be considered a Covered Entity under proposed Rule
10.\740\ FINRA currently is the only national securities association
registered with the Commission and is a not-for-profit organization
with 3,700 employees that oversees broker-dealers, including their
branch offices, and registered representatives through examinations,
enforcement, and surveillance.
---------------------------------------------------------------------------

    \739\ See section I.A.2.e. of this release.
    \740\ See paragraph (a)(1)(i)(v) of proposed Rule 10.
---------------------------------------------------------------------------

    FINRA, among other things, provides a forum for securities
arbitration and mediation; conducts market regulation, including by
contract for a majority of the national securities exchanges; regulates
its broker-dealer members; administers testing and licensing of
registered persons; collects and stores regulatory filings; \741\ and
operates industry utilities such as Trade Reporting Facilities.\742\
Through the collection of regulatory filings submitted by broker-
dealers as well as stock options and fixed-income quote, order, and
trade data, FINRA maintains certain confidential information--not only
its own but of other SROs.
---------------------------------------------------------------------------

    \741\ Some of the filings collected include FOCUS reports; Form
OBS; Form SSOI; Form Custody; firm clearing arrangements filings;
Blue Sheets; customer margin balance reporting; short interest
reporting; Form PF; Form 211; public offering and private placement
related filings; FINRA Rules 4311 and 4530 reporting; subordination
agreements; and Regulations M, T, and NMS.
    \742\ These include Trade Reporting and Compliance Engine
(TRACE), OTC ATS and Non-ATS data, Over-the-Counter Reporting
Facility (ORF), Trade Reporting Facility (TRF), Alternative Display
Facility (ADF), and Order Audit Trail System (OATS) (phased out as
of 2021).
---------------------------------------------------------------------------

e. National Securities Exchanges
    The operations and functions of the national securities exchanges
are discussed earlier in this release.\743\ A national securities
exchange would be considered a Covered Entity under proposed Rule
10.\744\ There are 24

national securities exchanges \745\ currently registered with the
Commission that would meet the definition of a Covered Entity under
proposed Rule 10(a)(1): BOX Exchange LLC; Cboe BYX Exchange, Inc.; Cboe
BZX Exchange, Inc.; Cboe C2 Exchange, Inc.; Cboe EDGA Exchange, Inc.;
Cboe EDGX Exchange, Inc.; Cboe Exchange, Inc.; Investors Exchange LLC;
Long-Term Stock Exchange, Inc.; MEMX, LLC; Miami International
Securities Exchange; MIAX Emerald, LLC; MIAX PEARL, LLC; Nasdaq BX,
Inc.; Nasdaq GEMX, LLC; Nasdaq ISE, LLC; Nasdaq MRX, LLC; Nasdaq PHLX
LLC; The Nasdaq Stock Market; New York Stock Exchange LLC; NYSE Arca,
Inc.; NYSE Chicago, Inc.; NYSE American, LLC; and NYSE National,
Inc.\746\
---------------------------------------------------------------------------

    \743\ See section I.A.2.f. of this release.
    \744\ See paragraph (a)(1)(vi) of proposed Rule 10.
    \745\ Exempt securities exchanges governed by section 5 of the
Act are not considered to be national securities exchanges.
    \746\ Two exchanges, The Island Futures Exchange, LLC, and NQLX
LLC, were formerly registered with the Commission as national
securities exchanges.
---------------------------------------------------------------------------

f. SBS Entities and SBSDRs
    Operations and functions of SBS Entities and SBSDRs are discussed
earlier in this release.\747\ An SBS Entity and an SBSDR would be
considered a Covered Entity under proposed Rule 10.\748\ As of January
4, 2023, there were 50 registered SBSDs that would meet the definition
of a Covered Entity under proposed Rule 10(a)(1).\749\ There were no
MSBSPs as of January 4, 2023.
---------------------------------------------------------------------------

    \747\ See sections I.A.2.g. and I.A.2.h. of this release.
    \748\ See paragraphs (a)(1)(iii), (vii), and (viii) of proposed
Rule 10 (defining, respectively, MSBSPs, SBSDRs, and SBSDs as
``covered entities'').
    \749\ See List of Registered Security-Based Swap Dealers and
Major Security-Based Swap Participants (Jan. 4, 2023), available at
https://www.sec.gov/tm/List-of-SBS-Dealers-and-Major-SBS-Participants.
---------------------------------------------------------------------------

    There are three SBSDRs that would meet the definition of a Covered
Entity under proposed Rule 10(a)(1). The Commission has two registered
security-based swap data repositories (ICE Trade Vault, LLC and DTCC
Data Repository (U.S.), LLC). GTR North America provides transaction
reporting services for derivatives in the United States through the
legal entity DTCC Data Repository (U.S.) LLC. DTCC Data Repository
(U.S.), LLC enables firms to meet their reporting obligations under the
Dodd-Frank Act and accepts trade submissions directly from reporting
firms as well as through third-party service providers.\750\ In
addition to the two registered SBSDRs, the Commission expects that an
additional entity may apply to be a registered SBSDR in the next three
years.
---------------------------------------------------------------------------

    \750\ See DTCC, GTR North America, available at https://www.dtcc.com/repository-and-derivatives-services/repository-services/gtr-north-america.
---------------------------------------------------------------------------

g. Transfer Agents
    The operations and functions of transfer agents are discussed
earlier in this release.\751\ Transfer agents would be Covered Entities
under proposed Rule 10.\752\ Transfer agents generally work for issuers
of securities. Among other functions, they may: (1) track, record, and
maintain on behalf of issuers the official record of ownership of each
issuer's securities; (2) cancel old certificates, issue new ones, and
perform other processing and recordkeeping functions that facilitate
the issuance, cancellation, and transfer of securities; (3) facilitate
communications between issuers and registered securityholders; and (4)
make dividend, principal, interest, and other distributions to
securityholders.\753\ Transfer agents are required to be registered
with the Commission, or if the transfer agent is a bank, then with a
bank regulatory agency. As of December 31, 2022, there were 353
registered transfer agents.\754\
---------------------------------------------------------------------------

    \751\ See section I.A.2.i. of this release.
    \752\ See paragraph (a)(1)(ix) of proposed Rule 10.
    \753\ See Transfer Agent Regulations, Exchange Act Release No.
76743 (Dec. 22, 2015), 80 FR 81948, 81949 (Dec. 31, 2015).
    \754\ See Commission, Transfer Agent Data Sets (Dec. 31, 2022),
available at https://www.sec.gov/dera/data/transfer-agent-data-sets.
---------------------------------------------------------------------------

h. Service Providers
    Many Market Entities utilize service providers to perform some or
all of their cybersecurity functions. Market Entities that are large--
relative to other Market Entities--in terms of their total assets,
number of clients or members, or daily transactions processed are
likely to have significant information technology, their own
information technology departments and dedicated staff such that some
functions are performed in-house. Other services may be contracted out
to service providers that cater to Market Entities. Smaller Market
Entities that do not have large technology budgets may rely more
heavily (or completely) on third parties for their cybersecurity needs.
According to a voluntary survey, financial services firms spend
approximately 0.3 percent of revenue or 10% of their information
technology budgets on cybersecurity, highlighting the fact that
identifying vulnerabilities and having cybersecurity policies and
procedures in place are more important than the actual cybersecurity
budget itself, particularly with respect to expensive hardware and
software.\755\
---------------------------------------------------------------------------

    \755\ See Reshaping the Cybersecurity Landscape.
---------------------------------------------------------------------------

    In performing their contracted duties, specialized service
providers may receive, maintain, or process confidential information
from Market Entities, or are otherwise permitted to access Market
Entities' information systems and the information residing on those
systems. Market Entities work with service providers that provide
certain critical functions, such as process payment providers,
regulatory services consultants, data providers, custodians, and
valuation services. However, Market Entities also employ general
service providers, such as email providers, relationship management
systems, cloud applications, and other technology vendors.
    Regardless of their size, Market Entities typically enter into
contracts with service providers to perform a specific function for a
given time frame at a set price. At the conclusion of a contract, it
may be renewed if both parties are satisfied. Because prices typically
increase over time, there may be some need to negotiate a new fee for
continued service. Negotiations also occur if additional services are
requested from a given third-party provider. In the instance where
additional services are required mid-contract, for example, due to
increased regulatory requirements, the service provider may be able to
bill for the extra work that it must incur separately to provide the
additional service, particularly if that party is in a highly
concentrated market for that service and can wield market power. This
may be the case because that condition is specified in the contract
with the Market Entity.
    Service providers that cater to the securities industry with
specialized services are likely to have economies of scale that allow
them to more easily handle requests from Market Entities for additional
services.\756\ Some service providers, however, may not have the
technical expertise to provide a requested additional service or may
refuse to do so for other reasons. In this case, the Market Entity
would need to find another service provider. The costs associated with
service provider contracts, including those of renegotiating them or
tacking on of supplemental fees, are passed on to the Market Entity's
customers, counterparties, members, participants,

or users to the extent that the Market Entities are able to do so.
---------------------------------------------------------------------------

    \756\ See Bharath Aiyer et al., New Survey Reveals $2 Trillion
Market Opportunity for Cybersecurity Technology and Service
Providers (2022), available at https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/cybersecurity/new-survey-reveals-2-trillion-dollar-market-opportunity-for-cybersecurity-technology-and-service-providers.
---------------------------------------------------------------------------

D. Benefits and Costs of Proposed Rule 10, Form SCIR, and Rule
Amendments

    In this section, the Commission considers the benefits and costs of
the rule, form, and amendments being proposed in this release.\757\ As
discussed earlier, proposed Rule 10 would require all Market Entities
(Covered Entities and non-Covered Entities) to establish, maintain, and
enforce written policies and procedures that are reasonably designed to
address their cybersecurity risks.\758\ All Market Entities also, at
least annually, would be required to review and assess the design and
effectiveness of their cybersecurity policies and procedures, including
whether the policies and procedures reflect changes in cybersecurity
risk over the time period covered by the review.\759\ They also would
be required to prepare a report (in the case of Covered Entities) or a
record (in the case of non-Covered Entities) with respect to the annual
review.\760\ Finally, all Market Entities would need to give the
Commission immediate written electronic notice of a significant
cybersecurity incident upon having a reasonable basis to conclude that
the significant cybersecurity incident has occurred or is
occurring.\761\
---------------------------------------------------------------------------

    \757\ Throughout the following, the Commission also considers
benefits and costs related to potential effects on economic
efficiency, competition, and capital formation. The Commission
summarizes these effects in section IV.E. of this release.
    \758\ See paragraphs (b) through (d) of proposed Rule 10
(setting forth the requirements for Market Entities that meet the
definition of ``covered entity''); paragraph (e)(1) of proposed Rule
10; see also sections II.B.1. and II.C. of this release (discussing
these proposed requirements in more detail).
    \759\ See paragraph (b)(2) of proposed Rule 10; paragraph (e)(1)
of proposed Rule 10; see also sections II.B.1.f. and II.C. of this
release (discussing these proposed requirements in more detail).
    \760\ See paragraph (b)(2) of proposed Rule 10; paragraph (e)(1)
of proposed Rule 10; see also sections II.B.1.f. and II.C. of this
release (discussing these proposed requirements in more detail).
    \761\ See paragraph (c)(1) of proposed Rule 10; paragraph (e)(2)
of proposed Rule 10; see also sections II.B.2.a. and II.C. of this
release (discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

    Market Entities that meet the definition of ``covered entity''
would be subject to certain additional requirements under proposed Rule
10.\762\ First, their cybersecurity risk management policies and
procedures would need to include the following elements:
---------------------------------------------------------------------------

    \762\ See paragraph (b) through (d) of proposed Rule 10 (setting
forth the requirements for Market Entities that meet the definition
of ``covered entity''); paragraph (e) of proposed Rule 10 (setting
forth the requirements for Market Entities that do not meet the
definition of ``covered entity'').
---------------------------------------------------------------------------

     Periodic assessments of cybersecurity risks associated
with the Covered Entity's information systems and written documentation
of the risk assessments;
     Controls designed to minimize user-related risks and
prevent unauthorized access to the Covered Entity's information
systems;
     Measures designed to monitor the Covered Entity's
information systems and protect the Covered Entity's information from
unauthorized access or use, and oversight of service providers that
receive, maintain, or process information, or are otherwise permitted
to access the Covered Entity's information systems;
     Measures to detect, mitigate, and remediate any
cybersecurity threats and vulnerabilities with respect to the Covered
Entity's information systems; and
     Measures to detect, respond to, and recover from a
cybersecurity incident and written documentation of any cybersecurity
incident and the response to and recovery from the incident.\763\
---------------------------------------------------------------------------

    \763\ See sections II.B.1.a. through II.B.1.e. of this release
(discussing these proposed requirements in more detail). In the case
of non-Covered Entities, as discussed in more detail below in
Section II.C. of this release, the design of the cybersecurity risk
management policies and procedures would need to take into account
the size, business, and operations of the broker-dealer. See
paragraph (e) of proposed Rule 10.
---------------------------------------------------------------------------

    Second, Covered Entities would need to make certain records
pursuant to the policies and procedures required under proposed Rule
10. In particular, Covered Entities would be required to document in
writing periodic assessments of cybersecurity risks associated with the
Covered Entity's information systems and information residing on those
systems.\764\ Additionally, Covered Entities would be required to
document in writing any cybersecurity incident, including the Covered
Entity's response to and recovery from the cybersecurity incident.\765\
---------------------------------------------------------------------------

    \764\ See paragraph (b)(1)(i)(B) of proposed Rule 10; see also
section II.B.1.a. of this release (discussing this documentation
requirement in more detail).
    \765\ See paragraph (b)(1)(v)(B) of proposed Rule 10; see also
section II.B.1.e. of this release (discussing this documentation
requirement in more detail).
---------------------------------------------------------------------------

    Third, Covered Entities--in addition to providing the Commission
with immediate written electronic notice upon having a reasonable basis
to conclude that the significant cybersecurity incident has occurred or
is occurring--would need to report and update information about the
significant cybersecurity incident by filing Part I of proposed Form
SCIR with the Commission by filing it with the Commission through the
EDGAR system.\766\ The form would elicit information about the
significant cybersecurity incident and the Covered Entity's efforts to
respond to, and recover from, the incident. Covered Entities would be
required to file updated versions of proposed Form SCIR when material
information becomes available or previously reported information is
deemed inaccurate. Lastly, a final proposed Form SCIR would need to be
submitted after a significant cybersecurity incident is resolved.
---------------------------------------------------------------------------

    \766\ See sections II.B.2. and II.B.4. of this release
(discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

    Fourth, Covered Entities would need to disclose publicly summary
descriptions of their cybersecurity risks and the significant
cybersecurity incidents they experienced during the current or previous
calendar year on Part II of proposed Form SCIR.\767\ The form would
need to be filed with the Commission through the EDGAR system and
posted on the Covered Entity's public-facing business internet website
and, in the case of Covered Entities that are carrying or introducing
broker-dealers, provided to customers at account opening and annually
thereafter.
---------------------------------------------------------------------------

    \767\ See sections II.B.3. and II.B.4. of this release
(discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

    Rules 17a-4, 17ad-7, and 18a-6--which apply to broker-dealers,
transfer agents, and SBS Entities respectively--would be amended to
establish preservation and maintenance requirements for the written
policies and procedures, annual reports, Parts I and II of proposed
Form SCIR, and records required to be made pursuant to proposed Rule 10
(i.e., the Rule 10 Records).\768\ The proposed amendments would specify
that the Rule 10 Records must be retained for three years. In the case
of the written policies and procedures to address cybersecurity risks,
the record would need to be maintained until three years after the
termination of the use of the policies and procedures.\769\ In
addition, orders exempting certain clearing agencies from registering
with the Commission are proposed to be amended to establish
preservation and maintenance

requirements for the Rule 10 Records that would apply to the exempt
clearing agencies subject to those orders.\770\ The amendments would
provide that the records need to be retained for five years (consistent
with Rules 13n-7 and 17a-1).\771\ In the case of the written policies
and procedures to address cybersecurity risks, the record would need to
be maintained until three years after the termination of the use of the
policies and procedures.
---------------------------------------------------------------------------

    \768\ See sections II.B.5. and II.C. of this release (discussing
these proposed amendments in more detail). Rule 17a-4 sets forth
record preservation and maintenance requirements for broker-dealers,
Rule 17ad-7 sets forth record preservation and maintenance
requirements for transfer agents, and Rule 18a-6 sets forth record
preservation and maintenance requirements for SBS Entities.
    \769\ See proposed rule 17a-4(e).
    \770\ See section II.B.5. of this release (discussing these
proposed amendments in more detail).
    \771\ As discussed in section II.B.5.a. of this release, the
existing requirements of Rule 13n-7 (which applies to SBSDRs) and
Rule 17a-1 (which applies to registered clearing agencies, the MSRB,
national securities associations, and national securities exchanges)
will require these Market Entities to retain the Rule 10 Records for
five years and, in the case of the written policies and procedures,
for five years after the termination of the use of the policies and
procedures.
---------------------------------------------------------------------------

1. Benefits and Costs of the Proposal to the U.S. Securities Markets
    The Commission is proposing rules to require all Market Entities,
based on the reasons discussed throughout, to take steps to protect
their information systems and the information residing on those systems
from cybersecurity risk.\772\ For example, as discussed above, Market
Entities may not take the steps necessary to address adequately their
cybersecurity risks.\773\ A Market Entity that fails to do so is more
vulnerable to succumbing to a significant cybersecurity incident. As
discussed earlier, a significant cybersecurity incident can cause
serious harm not only to the Market Entity but also to its customers,
counterparties, members, registrants, or users, as well as to any other
market participants (including other Market Entities) that interact
with the impacted Market Entity.\774\ Therefore, it is vital to the
U.S. securities markets and the participants in those markets that all
Market Entities address cybersecurity risk, which, as discussed above,
is increasingly threatening the financial sector.\775\
---------------------------------------------------------------------------

    \772\ See section I.A.1. of this release (discussing the
attractiveness of the U.S. securities market to threat actors).
    \773\ See section IV.B. of this release (discussing broad
economic considerations).
    \774\ See section I.A.2. of this release (discussing how
critical operations of Market Entities are exposed to cybersecurity
risk).
    \775\ See section I.A.1. of this release (discussing threats to
the U.S. financial sector).
---------------------------------------------------------------------------

a. Benefits