SCI entity would be able to determine which method(s) are most
appropriate for each SCI system (or indirect SCI system, as applicable)
or particular functionality of a given system, as well as the frequency
with which such method(s) should be employed.\496\ In addition, in
response to commenters advocating that SCI entities should focus on
identifying structural vulnerabilities or weaknesses,\497\ an SCI
entity may also find it useful to conduct reviews of its software and
systems architecture and design to assess whether they have flaws or
dependencies that constitute structural risks that could pose a threat
to SCI systems' operational capability.\498\ Likewise, an inspection by
an SCI entity of its physical premises may be a method of assessing
some of the vulnerabilities listed in the rule (such as physical
hazards).
---------------------------------------------------------------------------

    \496\ Rule 1001(a)(2)(iv) would also permit an SCI entity to
engage personnel independent of the team that designed and developed
the systems in testing, or to employ a process audit role, to comply
with this requirement, as some commenters suggested. See supra notes
493-494 and accompanying text. Like other methods of review and
testing, such engagements could identify vulnerabilities in a number
of ways, such as through assessments of the SCI entity's compliance
with applicable standards, its risk management and control
framework, or its use of resources.
    In response to the comment suggesting that process audits be
conducted at least annually for each SCI system, and more often for
SCI systems with operational problems, a record of non-compliance,
or those being developed, tested, or operated by an inexperienced
staff, the Commission notes that Rule 1001(a)(2)(iv) does not
specify the precise manner or frequency of reviews and tests.
Rather, Rule 1001(a)(2)(iv) provides flexibility to an SCI entity in
determining the precise manner and frequency of reviews and/or
tests. For example, an SCI entity could determine that, in order for
its policies and procedures to be reasonably designed, as required
by Rule 1001(a), its policies and procedures should provide that
process audits be conducted at least annually for some SCI systems,
and more frequently for certain other SCI systems.
    \497\ See supra note 492 and accompanying text.
    \498\ As noted by one commenter, static analysis could be a
technique SCI entities could choose to utilize to help uncover
structural weaknesses in software. See supra note 480 and
accompanying text.
---------------------------------------------------------------------------

Business Continuity and Disaster Recovery
    Proposed item (E) would have required an SCI entity to have
business continuity and disaster recovery plans that include
maintaining backup and recovery capabilities sufficiently resilient and
geographically diverse to ensure next business day resumption of
trading and two-hour resumption of clearance and settlement services
following a wide-scale disruption. The Commission received significant
comment on this aspect of the proposal, with several commenters
questioning or challenging the principle that securities market
infrastructure resilience is achieved by requiring both geographic
diversity and specific recovery times for the backup and recovery
capabilities of all SCI entities.\499\ Although several commenters were
supportive of the broad goals of the proposed requirement,\500\ others
maintained that, because the national market system has built-in
redundancies, the proposed geographic diversity and resumption
requirements need not apply to all SCI entities to ensure securities
market resilience.\501\ Some of these commenters urged that the
specific redundancy requirement implicit in the proposed geographic
diversity provision should apply to a more limited set of SCI
entities.\502\ In addition, some commenters stated that proposed time
frames were too inflexible.\503\
---------------------------------------------------------------------------

    \499\ See, e.g., BIDS Letter at 8; FIA PTG Letter at 4; FIF
Letter at 3; Group One Letter at 2-3; KCG Letter at 6-8, 11-14;
FINRA Letter at 35-36; Angel Letter at 12; and ITG Letter at 15.
    \500\ See Direct Edge Letter at 4; FINRA Letter at 35; ISE
Letter at 2; and MSRB Letter at 10.
    \501\ See, e.g., BIDS Letter at 8; FIA PTG Letter at 4; FIF
Letter at 3; Group One Letter at 2-3; and KCG Letter at 6-8, 11-14.
According to these commenters, because of the ease with which market
participants are able to shift their order flow when there is an
issue at one or more markets, the proposed requirements are
burdensome and unnecessary. See also Angel Letter at 12 (stating
that, if an exchange experiences an issue, other exchanges have more
than enough capacity to handle the trading volume, and suggesting
that it is not necessary for each exchange to have totally redundant
backup facilities if the market network as a whole has sufficient
capacity).
    \502\ See, e.g., FIA PTG Letter at 4. See also supra note 53 and
accompanying text.
    \503\ See, e.g., SIFMA Letter at 13; and Joint SROs Letter at
17.
---------------------------------------------------------------------------

    The Commission has carefully considered commenters' views and is
revising this provision from the proposal to: (i) Specify that the
stated recovery timeframes in Regulation SCI are goals, rather than
inflexible requirements; \504\ and (ii) provide that the stated two-
hour recovery goal applies to critical SCI systems generally. In
addition, the Commission is adopting the geographic diversity
requirement, which does not specify any minimum distance for an SCI
entity's backup and recovery facilities, as proposed. As explained
below, the Commission continues to believe that geographic diversity of
physical facilities is an important component of every SCI entity's BC/
DR plan.
---------------------------------------------------------------------------

    \504\ See Interagency Paper on Sound Practices to Strengthen the
Resilience of the U.S. Financial Systems, Securities Exchange Act
Release No. 47638 (April 7, 2003), 68 FR 17809, 17812 (April 11,
2003) (``Interagency White Paper''), stating: ``Recovery-time
objectives provide concrete goals to plan for and test against. They
should not be regarded as hard and fast deadlines that must be met
in every emergency situation;'' and 2003 Policy Statement on
Business Continuity Planning for Trading Markets, Securities
Exchange Act Release No. 48545 (September 25, 2003), 68 FR 56656,
56658 (October 1, 2003) (``2003 BCP Policy Statement''), stating:
``Consistent with the approach taken in the Interagency Paper, the
next-day resumption objective should provide a concrete goal to plan
for and test against. This should not be regarded as a hard and fast
deadline that must be met in every emergency situation.''
---------------------------------------------------------------------------

Recovery Timeframes as Goals
    Several commenters addressing proposed item (E) focused their
comments specifically on the proposed recovery timeframes.\505\ A few
commenters that are clearing agencies specifically expressed concern
about the proposed requirement for the two-hour resumption of clearance
and settlement services, urging that the two-hour standard be a goal
rather than a requirement.\506\ One commenter noted

that the ``Interagency White Paper itself recognizes that `various
external factors surrounding a disruption such as time of day, scope of
disruption, and status of critical infrastructure--particularly
telecommunications can affect actual recovery times,' and concludes
that `[r]ecovery-time objectives provide concrete goals to plan for and
test against . . . they should not be regarded as hard and fast
deadlines that must be met in every emergency situation.' '' \507\
Several commenters suggested that SCI entities generally be given more
discretion to decide when to resume trading following a wide-scale
disruption.\508\ Other commenters stated more broadly that the proposed
recovery timeframes were too rigid and inconsistent with the
Interagency White Paper and the 2003 BCP Policy Statement.\509\ Other
commenters similarly noted that it might be in the public interest and
consistent with the protection of investors and the maintenance of fair
and orderly markets for the markets to remain closed following a wide-
scale disruption.\510\
---------------------------------------------------------------------------

    \505\ See, e.g., SIFMA Letter at 3, 13, 18; KCG Letter at 11-12;
DTCC Letter at 15; OCC Letter at 9-10; Omgeo Letter at 27-28; Angel
Letter at 16-17; Direct Edge Letter at 4-5; ISE Letter at 2-5; Joint
SROs Letter at 16-17; FINRA Letter at 36; MSRB Letter at 10;
Tellefsen Letter at 6; and Group One Letter at 2.
    \506\ See DTCC Letter at 15 (``[P]roposed Rule 1000(b)(l)(i)(E)
has made what is currently a target within the 2003 Interagency
White Paper that clearing and settling services be resumed within 2
hours of a disruption into a requirement that may not be attainable
in all circumstances. . . .''); OCC Letter at 9-10 (``While a two-
hour recovery time objective is a laudable goal . . . current
guidelines remain appropriate to recover and resume clearing and
settlement activities within the business day on which the
disruption occurs, with the overall aspiration of achieving recovery
and resumption within two hours''); and Omgeo Letter at 27-28
(``While Omgeo agrees that SCI entities should be required to
rapidly recover from a wide-scale disruption and resume operations
to avoid disrupting the critical markets beyond a single business
day, it is unreasonable to require these operations to be resumed
within two hours.'').
    \507\ See Omgeo Letter at 27-28.
    \508\ See Angel Letter at 16-17; Direct Edge Letter at 4-5; ISE
Letter at 2; Joint SROs Letter at 16-17; and Group One Letter at 2.
    \509\ See SIFMA Letter at 13 (noting that the Interagency White
Paper recommends that ``core clearing and settlement organizations
develop the capacity to recover and resume clearing and settlement
activities within the business day on which the disruption occurs
with the overall goal of achieving recovery and resumption within
two hours after an event.'' See also Joint SROs Letter at 17 (noting
that the 2003 BCP Policy Statement, supra note 504, provides that
rapid recovery should not be regarded as a hard and fast deadline
that must be met in every emergency situation).
    \510\ See, e.g., Angel Letter at 16-17; Direct Edge Letter at 4-
5, 9; ISE Letter at 2-5; and Joint SROs Letter at 16-17.
---------------------------------------------------------------------------

    In response to comments that the proposed two-hour recovery time
frame was too inflexible,\511\ the Commission is eliminating the
proposed requirement that an SCI entity must ``ensure'' next business
day resumption of trading and two-hour resumption of clearance and
settlement services following a wide-scale disruption. The Commission
acknowledges that a hard and fast resumption timeframe may not be
achievable in each and every case, given the variety of disruptions
that potentially could arise and pose challenges even for well-designed
business continuity and disaster recovery. For this reason, the
Commission is revising the proposed requirement by replacing it with a
requirement that an SCI entity have policies and procedures that
include ``business continuity and disaster recovery plans that include
maintaining backup and recovery capabilities sufficiently resilient and
geographically diverse and that are reasonably designed to achieve next
business day resumption of trading and two-hour resumption of critical
SCI systems following a wide-scale disruption.'' Replacement of the
phrase ``to ensure'' with the phrase ``reasonably designed to achieve''
means that Regulation SCI's enumerated recovery timeframes are concrete
goals, consistent with the Interagency White Paper and 2003 BCP Policy
Statement.\512\ As such, the rule's specified recovery timeframes are
the standards against which the reasonableness of business continuity
and disaster recovery (``BC/DR'') plans will be assessed by the
Commission and its inspection staff. Moreover, as recovery goals,
rather than hard and fast deadlines, the enumerated time frames in the
rule will continue to allow for SCI entities to account for the
specific facts and circumstances that arise in a given scenario to
determine whether it is appropriate to resume a system's operation
following a wide-scale disruption.
---------------------------------------------------------------------------

    \511\ See supra notes 506-510 and accompanying text.
    \512\ See Interagency White Paper, supra note 504, at 17812-13,
and the 2003 BCP Policy Statement, supra note 504, at 56658.
---------------------------------------------------------------------------

Recovery Timeframe Distinctions
    In the SCI Proposal, the Commission solicited comment on whether
the proposed next business day resumption of trading following a wide-
scale disruption and proposed two-hour resumption of clearance and
settlement services following a wide-scale disruption were
appropriate.\513\ The Commission also solicited comment on whether it
should consider revising the proposed next business day resumption
requirement for trading to a shorter period for certain entities that
play a significant role within the securities markets.\514\ One
commenter stated that it agreed with imposing more stringent
requirements for resumption of clearance and settlement services than
for trading services following a wide-scale disruption.\515\ However,
this commenter also urged more broadly that the Commission take into
account the criticality of the functions performed by an SCI entity to
the maintenance of fair and orderly markets in order to tailor the
obligations of the rule more effectively.\516\ According to this
commenter, ``[n]otification and remediation requirements . . . should
be tailored to the time sensitivity of each of the functions performed,
not applied uniformly across all activities of an SCI entity.'' This
commenter identified ``highly critical functions'' as including the
primary listing exchanges, trading of securities on an exclusive basis,
securities information processors, clearance and settlement agencies,
distribution of unique post-trade transparency information, and real-
time market surveillance,'' and urged the Commission to ``leverage the
best practices of the Interagency White Paper, and expand them to
include the [highly] critical functions. . . .'' \517\ Other commenters
also urged the Commission to consider the criticality of SCI systems
functionality and tailor requirements accordingly.\518\ One

commenter noted that the August 2013 Nasdaq SIP outage revealed each of
SIAC and Nasdaq (in their roles as plan processors) as a potential
``single point of failure'' in the national market system, and
specifically urged improved backup capabilities for these systems.\519\
Another commenter, in the context of questioning the need for all
markets to have geographically diverse backups, acknowledged that
specific redundancy might be appropriate in certain areas, such as
where an instrument is traded only on one exchange or in the case of a
primary market during the open and closing periods of the market.\520\
---------------------------------------------------------------------------

    \513\ See Proposing Release, supra note 13, at 18112, question
73.
    \514\ See id. at 18112, question 76.
    \515\ See SIFMA Letter at 12-13. Specifically, this commenter
noted that the Interagency White Paper, supra note 504,
distinguishes between ``core clearing and settlement organizations''
and firms that play ``significant roles in the financial markets''
and recommended that the Commission continue to distinguish between
SCI entities that are responsible for the highly critical function
of centralized counterparties (e.g., clearing agencies registered
with the Commission) and SCI entities that are not.
    \516\ See SIFMA Letter at 4.
    \517\ See id. at 4, 18. SIFMA also listed the distribution of
unique post-trade transparency information and real-time market
surveillance as highly critical functions. While such systems are
not specifically identified in the first prong of the definition of
critical SCI systems (as are SCI systems that directly support
functionality relating to: (1) Clearance and settlement systems of
clearing agencies; (2) openings, reopenings, and closings on the
primary listing market; (3) trading halts; (4) initial public
offerings; (5) the provision of consolidated market data; or (6)
exclusively-listed securities), the Commission notes that systems
that provide functionality to the securities markets for which the
availability of alternatives is significantly limited or nonexistent
and without which there would be a material impact on fair and
orderly markets are considered critical SCI systems under its second
prong. See supra Section IV.A.2.c (discussing the definition of
``critical SCI systems'').
    \518\ See, e.g., KCG Letter at 8, 13-14 (suggesting that
proposed item (E) apply only to SCI entities that perform critical,
unique functions in the market), and at 5 (stating ``when critical
services are provided, additional heightened regulatory
requirements, as proposed in Regulation SCI, may be appropriate'').
See also UBS Letter at 3 (urging the Commission to take into
consideration the difference between ``interruptions of activities
that hold significant implications for the National Market System''
and ``low criticality activities [that] are much more manageable and
localized in impact . . . because market participants are not
directly touched or are equipped to quickly route around the
problem''). According to this commenter, activities that hold such
significant implications would include: ``disruption at primary
exchange during [the] open/close, [a] problem with protected quote
data, [an] outage at listing exchange during [an] IPO, [and] SIP
data disruptions.''
    \519\ See Angel Letter 2 at 3-4.
    \520\ See FIA PTG Letter at 4.
---------------------------------------------------------------------------

    The Commission has carefully considered these comments and believes
they support revising the proposed rule to provide that the two-hour
recovery goal specified in the adopted rule, as the standard against
which BC/DR plans are to be assessed, should apply not only to
``clearance and settlement services,'' but more generally to the
functions performed by critical SCI systems. Given that the securities
markets are dependent upon the reliable operation of critical SCI
systems, the Commission believes it is reasonable to distinguish the
two-hour and next-business day recovery goals in a manner consistent
with other provisions of adopted Regulation SCI: Specifically, to have
the shorter recovery goal apply to critical SCI systems, and the longer
recovery goal apply to resumption of trading by non-critical SCI
systems. The Commission also notes that, because the proposed recovery
timeframes are being adopted as concrete goals that the policies and
procedures must be reasonably designed to achieve, rather than hard and
fast requirements, the adopted approach is somewhat more flexible than
that proposed. Accordingly, adopted Rule 1001(a)(2)(v) holds BC/DR
plans for critical SCI systems (as defined in Rule 1000) to a higher
standard than BC/DR plans for resumption of trading operations more
generally. Specifically, an SCI entity responsible for a given critical
SCI system will be expected to design BC/DR plans that contemplate
resumption of critical SCI system functionality to meet a recovery goal
of two hours or less. The Commission believes that this approach is
consistent with the broader risk-based approach urged by
commenters.\521\ The Commission also believes that its approach to
holding critical SCI systems to stricter resiliency standards than
other systems is an appropriate measure that responds not only to
comments received, but also to recent events highlighting the effects
of malfunctions in critical SCI systems.\522\
---------------------------------------------------------------------------

    \521\ See supra notes 53-57 and accompanying text (summarizing
commenters' recommendations with regard to adopting a risk-based
approach generally).
    \522\ See supra Section II.B (discussing recent systems issues,
including a systems problem that resulted in certain exclusively-
listed securities being unable to trade for over three hours, and a
systems problem affecting the SIP that halted trading in all Nasdaq-
listed securities for more than three hours).
---------------------------------------------------------------------------

    Two commenters requested clarification on the expectations for
resumption of SCI systems that are not related to trading, clearance,
or settlement.\523\ In response to this comment, the Commission notes
that the adopted definition of SCI systems has been refined from the
proposed definition of SCI systems and that all SCI systems could be
considered to be ``related to'' trading. However, systems that directly
support market regulation and/or market surveillance will not be held
to the resumption goals of Rule 1001(a)(2)(v) (unless they are critical
SCI systems) because the Commission believes that the resumption of
trading and critical SCI systems could occur following a wide-scale
disruption without the immediate availability of market regulation and/
or market surveillance systems (unless they are critical SCI systems).
However, systems that directly support trading, order routing, and
market data would be subject to the next-business day resumption goal,
unless they are also critical SCI systems, in which case they would be
subject to the two-hour resumption goal.
---------------------------------------------------------------------------

    \523\ See FINRA Letter at 36; and MSRB Letter at 10.
---------------------------------------------------------------------------

    One commenter questioned what the expectations are with respect to
next-day resumption if an SCI entity loses functionality towards the
end of the trading day.\524\ In response to this comment, the
Commission notes that neither the next-business day resumption of
trading goal nor the two-hour recovery goal for critical SCI systems is
dependent on the time of day that the loss of functionality occurs.
Consistent with the Interagency White Paper and 2003 BCP Policy
Statement, however, the Commission acknowledges that the time of day of
a disruption can affect actual recovery times.\525\ The Commission
believes it is important, particularly with respect to clearing
agencies, that SCI entities endeavor to take all steps necessary to
effectuate end of day settlement.
---------------------------------------------------------------------------

    \524\ See Tellefsen Letter at 6.
    \525\ See Interagency White Paper, supra note 504, at 17812, and
the 2003 BCP Policy Statement, supra note 504, at 56658.
---------------------------------------------------------------------------

Geographic Diversity To Ensure Resilience
    Several commenters addressing proposed item (E) expressed concern
about the proposed geographic diversity requirement.\526\ Some
commenters cited a reluctance on the part of SCI entity members or
participants to incur the cost or assume the risk of connecting to a
backup site that would only be used infrequently.\527\ In addition,
some commenters cited concerns, such as challenges to market makers
generating quotes, if a backup site did not have the same low latency
as the primary site.\528\ One of these commenter suggested that
allowing other fully operational exchanges to fill in and perform the
duties of an exchange experiencing an outage would offer the advantages
of continued operation on tested systems and the introduction of fewer
variables.\529\ Another of these commenters argued that, in many
respects, the goal of resilient and redundant markets is already in
place due to the existence of multiple competing and interconnected
venues, operating as a collective system under Regulation NMS.\530\
---------------------------------------------------------------------------

    \526\ See, e.g., KCG Letter at 13; FIA PTG Letter at 3-4; Group
One Letter at 2-3; ISE Letter at 2-5; BIDS Letter at 8; and ITG
Letter at 15.
    \527\ See KCG Letter at 13; FIA PTG Letter at 3-4; and Group One
Letter at 2-3.
    \528\ See KCG Letter at 13; and FIA PTG Letter at 3-4.
    \529\ See Group One Letter at 2-3.
    \530\ See FIA PTG Letter at 4. See also Angel 2 Letter at 3.
---------------------------------------------------------------------------

    One commenter agreed that it is a best business practice for a
market to have backup disaster recovery facilities and robust BC/DR
plans, but stated that ``significant geographic diversity'' should not
be an absolute requirement,'' because a wide-scale disruption in New
York or Chicago would make next day resumption difficult, even with a
geographically diverse backup.\531\ This commenter noted that the more
remote the backup, the more difficult it would be to staff such a
facility, and even more so in a surprise disaster, unless the backup
was fully staffed at all times.\532\ Several commenters also argued
that SCI entities that are ATSs are less critical to market stability,
and therefore

should be subject to less stringent geographic diversity and recovery
requirements.\533\ One commenter suggested eliminating the reference to
``geographic diversity'' in favor of requiring ``comprehensive business
continuity and disaster recovery plans with recovery time objectives of
the next business day for trading and two hours for clearance and
settlement,'' and emphasizing as guidance that geographic diversity of
physical facilities would be an expected component of any such
plan.\534\
---------------------------------------------------------------------------

    \531\ See ISE Letter at 2-5.
    \532\ See id.
    \533\ See BIDS Letter at 8; FIA PTG Letter at 4; ITG Letter at
15; and KCG Letter at 8, 13. These commenters believed that the
proposed geographic diversity requirements are burdensome and
unnecessary because of the ease with which market participants are
able to shift their order flow when there is an issue at one or more
markets. In addition, two commenters argued that, because ATSs are
subject to FINRA regulations with respect to BC/DR plans, further
regulation would be redundant and unnecessary. See ITG Letter at 15;
and OTC Markets Letter at 9.
    \534\ See Direct Edge Letter at 4.
---------------------------------------------------------------------------

    The Commission has carefully considered commenters' views on the
proposed geographic diversity requirement and continues to believe that
geographic diversity of physical facilities is an important component
of every SCI entity's BC/DR plan.\535\ The Commission believes that
challenges to recovery are increased when a disruption impacts a broad
geographic area, and therefore that an SCI entity's arrangements to
assure resilience in the event of a wide-scale disruption cannot
reliably be achieved without geographic diversity of its BC/DR
resources.\536\ The Commission does not agree with commenters who
argued that the existence of multiple competing and interconnected
venues operating as a collective system under Regulation NMS obviates
the need for geographic diversity at the individual SCI entity
level.\537\ For example, a wide-scale disruption, such as a natural
disaster or man-made attack, could affect a large number of SCI
entities, and absent individual SCI entity responsibility for
maintaining geographic diversity, there could be a greater likelihood
that a critical mass of SCI entities would not be operational, so that
the continued maintenance of fair and orderly markets could be
impacted. The Commission notes that some of the practical difficulties
commenters cited as the basis for objecting to a backup site
requirement, such as the cost and operational risk of maintaining a
redundant connection to an SCI entity backup facility that would be
used infrequently, are concerns raised on behalf of SCI entity members
and participants.\538\ In response to commenters who expressed concern
regarding the cost for members or participants to co-locate their
systems at backup sites to replicate the speed and efficiency of the
primary site, the Commission emphasizes that adopted Rule 1001(a)(2)(v)
does not require an SCI entity to require members or participants to
use the backup facility in the same way it uses the primary facility.
Rather, the assessment of the effectiveness of a BC/DR plan that
includes geographically diverse backup facilities is whether it is
reasonably designed to achieve next business day resumption of trading
and two-hour resumption of critical SCI systems following a wide-scale
disruption.
---------------------------------------------------------------------------

    \535\ The Commission's view is consistent with the 2003 BCP
Policy Statement. See 2003 BCP Policy Statement, supra note 504, at
56658. See also infra Section VI.C.2.b (discussing the benefits of
geographic diversity).
    \536\ See, e.g., 2003 BCP Policy Statement, supra note 504, at
56657 (stating that a critical ``lesson learned'' from the events of
September 11, 2001 is the need for more rigorous business continuity
planning in the financial sector to address problems of wider
geographic scope and longer duration than those previously
addressed).
    \537\ See supra notes 530 and 533 and accompanying text.
    \538\ See infra Section IV.B.6 (discussing SCI entity BC/DR
testing requirements for members or participants).
---------------------------------------------------------------------------

    In response to comments that geographic diversity should be
encouraged but not required for all SCI entities, the Commission does
not believe that it would be appropriate to eliminate the proposed
requirement that SCI entities maintain geographically diverse backup
and recovery capabilities (which the Commission understands many SCI
entities already have) because, as stated, absent individual SCI entity
responsibility for maintaining geographic diversity, there could be a
greater likelihood that a critical mass of SCI entities would not be
operational following a wide-scale disruption. In response to comment
that ATSs are less critical to market stability, and therefore should
be subject to less stringent geographic diversity and recovery
requirements, the Commission notes that ATSs that do not have critical
SCI systems will be subject to less stringent geographic diversity and
recovery requirements than SCI entities that do.\539\ However, because
the Commission believes that SCI ATSs have the potential to
significantly impact investors, the overall market, and the trading of
individual securities as a result of an SCI event, the Commission
believes that these entities are appropriate for inclusion in the
definition of SCI entity and for the application of the geographic
diversity requirement.\540\
---------------------------------------------------------------------------

    \539\ In addition, in response to commenters who argued that,
because ATSs are subject to FINRA regulations with respect to BC/DR
plans further regulation would be redundant and unnecessary (see
supra note 533), the Commission notes that FINRA Rule 4370 generally
requires that a member maintain a written continuity plan
identifying procedures relating to an emergency or significant
business disruption. Unlike Regulation SCI, however, the FINRA rule
does not include the requirement that the business continuity and
disaster recovery plans be reasonably designed to achieve next
business day resumption of trading and two-hour resumption of
critical SCI systems following a wide-scale disruption, nor does it
require the functional and performance testing and coordination of
industry or sector-testing of such plans, which the Commission
believes to be instrumental in achieving the goals of Regulation SCI
with respect to SCI entities. See also supra note 115.
    \540\ See supra notes 107-109 and accompanying text.
---------------------------------------------------------------------------

    Like the proposed rule, the adopted rule does not specify any
particular minimum distance or geographic location that would be
necessary to achieve geographic diversity.\541\ However, as stated in
the SCI Proposal, the Commission continues to believe that backup sites
should not rely on the same infrastructure components, such as for
transportation, telecommunications, water supply, and electric
power.\542\ The Commission also continues to believe that an SCI entity
should have a reasonable degree of flexibility to determine the precise
nature and location of its backup site depending on the particular
vulnerabilities associated with those sites, and the nature, size,
technology, business model, and other aspects of its business.'' \543\
In response to comment that a geographically diverse backup facility is
impractical if key personnel do not live sufficiently close to the
backup facility, the Commission notes that adopted Regulation SCI does
not require an SCI entity to have a geographically diverse backup
facility so distant from the primary facility that the SCI entity may
not rely primarily on the same labor pool to staff both facilities if
it believed it to be appropriate.\544\ Given that the Commission did
not propose a specified minimum distance to achieve geographic
diversity, the Commission believes that the geographic diversity
requirement is reasonable and appropriate for all SCI entities. The

geographic diversity requirement is therefore adopted as proposed.
---------------------------------------------------------------------------

    \541\ See Proposing Release, supra note 13, at 18108, n. 182 and
accompanying text.
    \542\ See id.
    \543\ See id.
    \544\ An SCI entity with critical SCI systems subject to a two-
hour recovery goal may, however, find it prudent to establish back-
up facilities a significant distance away from their primary sites,
or otherwise address the risk that a wide-scale disruption could
impact either or both of the sites and their labor pool. See
Interagency White Paper, supra note 504, at 17813.
---------------------------------------------------------------------------

    In sum, the Commission believes that adopted Rule 1001(a)(2)(v),
requiring an SCI entity to have business continuity and disaster
recovery plans that include maintaining backup and recovery
capabilities sufficiently resilient and geographically diverse and that
are reasonably designed to achieve next business day resumption of
trading and two-hour resumption of critical SCI systems following a
wide-scale disruption, is consistent with, and builds upon, both the
Interagency White Paper and the 2003 BCP Policy Statement by applying
their principles to SCI entities in today's trading environment, one
with a heavy reliance on technological infrastructure. The Commission
believes that individual SCI entity resilience is fundamental to
achieving the goal of improving U.S. securities market infrastructure
resilience.
Robust Standards for Market Data
    Proposed item (F), requiring an SCI entity to have standards that
result in systems being designed, developed, tested, maintained,
operated, and surveilled in a manner that facilitates the successful
collection, processing, and dissemination of market data, received
little comment. One commenter supported the proposed requirement,
subject to further clarification about what constitutes market
data.\545\ Another commenter believed that this proposed requirement is
redundant because SROs and other market participants are already
subject to substantial requirements for market data.\546\
---------------------------------------------------------------------------

    \545\ See MSRB Letter at 8.
    \546\ See Angel Letter at 19.
---------------------------------------------------------------------------

    While consolidated market data is collected and distributed
pursuant to a variety of Exchange Act rules and joint industry
plans,\547\ the Commission does not believe that existing requirements
have the same focus on ensuring the operational capability of the
systems for collecting, processing, and disseminating market data.
Thus, the Commission believes that this provision, while consistent
with existing rules, acts as a complement to such requirements and is
not redundant. Further, as explained above, the term ``market data'' is
not intended to include only consolidated market data, but proprietary
market data as well and, as such, SCI systems directly supporting
proprietary market data or consolidated market data are subject to the
requirements of item (F). As stated in the SCI Proposal, the Commission
believes that the accurate, timely, and efficient processing of data is
important to the proper functioning of the securities markets. The
Commission continues to believe that it is important that each SCI
entity's market data systems are reasonably designed to maintain market
integrity and that the proposed requirement would facilitate that
goal.\548\ This element, requiring that an SCI entity's policies and
procedures include standards that result in systems being designed,
developed, tested, maintained, operated, and surveilled in a manner
that facilitates the successful collection, processing, and
dissemination of market data, is adopted as proposed, as Rule
1001(a)(2)(vi).
---------------------------------------------------------------------------

    \547\ See, e.g., Rules 601-604 of Regulation NMS and Rule
301(b)(3) of Regulation ATS. See also supra Section IV.A.1.c
(discussing definition of plan processor) and Concept Release on
Equity Market Structure, supra note 4, at 3600 (discussing various
rules and requirements relating to consolidated market data).
    \548\ See Proposing Release, supra note 13, at 18108.
---------------------------------------------------------------------------

Monitoring
    The Commission is adopting an additional provision, designated as
Rule 1001(a)(2)(vii), that requires an SCI entity's policies and
procedures to provide for monitoring of SCI systems, and, for purposes
of security standards, indirect SCI systems, to identify potential SCI
events. Several commenters argued that Regulation SCI should allow
entities to adopt and follow escalation procedures instead of providing
that obligations under Regulation SCI are triggered by one employee's
awareness of a systems issue.\549\ The Commission is modifying
Regulation SCI in three respects in response to these comments:
revising the definition of responsible SCI personnel to focus on senior
managers; requiring that an SCI entity have policies and procedures to
identify, designate, and escalate potential SCI events to responsible
SCI personnel; and explicitly requiring policies and procedures for
monitoring.\550\ The requirement that an SCI entity have policies and
procedures to provide for monitoring of SCI systems and, for purposes
of security standards, indirect SCI systems, is added to make explicit
that escalation of a systems problem should occur not only if a systems
problem is identified by chance, but rather that an SCI entity should
have a monitoring process in place so that systems problems are able to
be identified as a matter of standard operations and pursuant to
parameters reasonably established by the SCI entity. In addition, the
Commission believes that the reliability of escalation of potential SCI
events to designated responsible SCI personnel for determination as to
whether they are, in fact, SCI events is likely to be more effective
when it occurs in connection with established procedures for monitoring
of SCI systems and indirect SCI systems and pursuant to a process for
the communication of systems problems by those who are not responsible
SCI personnel to those who are. The Commission notes that several
commenters discussed the role that technology staff play in monitoring
and identifying potential systems problems and escalating issues up the
chain of command to management as well as legal and/or compliance
personnel. Although systems monitoring may already be routine in many
SCI entities, there are expected benefits of monitoring and thus it is
appropriate to require an SCI entity's policies and procedures to
provide for monitoring of SCI systems, and, for purposes of security
standards, indirect SCI systems, to identify potential SCI events. The
Commission believes that monitoring in tandem with escalation to
responsible SCI personnel is an appropriate approach to ensuring SCI
compliance. As noted, the requirement that an SCI entity have policies
and procedures for monitoring provides an SCI entity with flexibility
to establish parameters that define the types of systems problems to
which technology personnel should be alert, as well as the frequency
and duration of monitoring. The Commission also believes this
requirement is consistent with a risk-based approach, and that an SCI
entity's policies and procedures for monitoring may be tailored to the
relative criticality of SCI systems, with critical SCI systems likely
to be subject to relatively more rigorous policies and procedures for
monitoring than other SCI systems.
---------------------------------------------------------------------------

    \549\ See, e.g., OCC Letter at 12; FINRA Letter at 25-26; Omgeo
Letter at 13; FIF Letter at 5; and NYSE Letter at 19-20. See also
infra notes 758-761 and accompanying text (discussing comments on
the proposed ``becomes aware'' standard).
    \550\ See infra Section IV.B.3.a (discussing the Commission's
determination to further focus the definition of ``responsible SCI
personnel'').
---------------------------------------------------------------------------

iii. Policies and Procedures Consistent With ``Current SCI Industry
Standards''--Rule 1001(a)(4)
    Proposed Rule 1000(b)(1)(ii) stated that an SCI entity's policies
and procedures would be deemed to be reasonably designed if they are
consistent with ``current SCI industry standards,'' such as those
listed on proposed Table A. ``Current SCI industry standards'' were not
limited to those listed on proposed Table A, but

were proposed to be required to be: (A) Comprised of information
technology practices that are widely available for free to information
technology professionals in the financial sector; and (B) issued by an
authoritative body that is a U.S. governmental entity or agency,
association of U.S. governmental entities or agencies, or widely
recognized organization. The rule further stated that ``compliance with
such current SCI industry standards . . . shall not be the exclusive
means to comply with the requirements of paragraph (b)(1).''
    The goal of proposed Rule 1000(b)(1)(ii) was to provide guidance to
SCI entities on policies and procedures that would meet the articulated
standard of being ``reasonably designed to ensure that their systems
have levels of capacity, integrity, resiliency, availability, and
security, adequate to maintain their operational capability and promote
the maintenance of fair and orderly markets.'' The proposal sought to
provide this guidance by identifying example information technology
publications describing processes, guidelines, frameworks, and/or
standards that SCI entities could elect to look to in developing its
policies and procedures. Proposed Table A set forth an example of one
set of technology publications that the Commission preliminarily
believed was an appropriate set of reference documents. The SCI
Proposal acknowledged that ``current SCI industry standards'' would not
be limited to the publications identified on proposed Table A. As such,
an SCI entity's choice of a current SCI industry standard in a given
domain or subcategory thereof could appropriately be different from
those contained in the publications identified in proposed Table
A.\551\ Many commenters, however, objected to the proposed objective
criteria for reference publications, and/or one or more of the specific
publications listed on proposed Table A. The Commission has carefully
considered commenters' views and is adopting Rule 1000(b)(1)(ii),
renumbered as Rule 1001(a)(4), with certain modifications as described
below.
---------------------------------------------------------------------------

    \551\ See Proposing Release, supra note 13, at 18109.
---------------------------------------------------------------------------

Criteria for Identifying SCI Industry Standards: Comments Received and
Commission Response
    Some commenters disagreed with the Commission's proposal to require
SCI industry standards to be ``comprised of information technology
practices that are widely available for free to information technology
professionals in the financial sector.'' Several commenters argued that
there were significant disadvantages to requiring that standards be
available free of charge.\552\ One of these commenters stated that
requiring standards to be available for free ``may encourage SCI
entities to use standards that may be outdated when more suitable
standards may be available and would be more appropriate.'' \553\
Another of these commenters stated that ``the cost or lack thereof of a
technology standard or standard framework has no bearing on the quality
or appropriateness of such standard or framework and bears no
significance to the maintenance of fair and orderly markets.'' \554\
---------------------------------------------------------------------------

    \552\ See ANSI Letter at 1; DTCC Letter at 15; OCC Letter at 9;
Omgeo Letter at 33-34; and X9 Letter at 1.
    \553\ See OCC Letter at 9.
    \554\ See Omgeo Letter at 33 (noting also that the proposed
criteria would eliminate appropriate standards such ITIL and ISO
27000).
---------------------------------------------------------------------------

    Two standard setting organizations commented regarding the use of
consensus standards, citing OMB Circular No. A-119, which directs
agencies to use voluntary consensus standards (i.e., standards
developed by professional standards organizations), and urged the
Commission to eliminate the requirement that SCI industry standards be
``available for free.'' \555\ Another commenter similarly urged that it
was important for SCI entities to use publications generated by
professional organizations that regularly update their standards and
employ open processes for gathering industry input.\556\
---------------------------------------------------------------------------

    \555\ See ANSI Letter at 1; and X9 Letter at 1.
    \556\ See CISQ2 Letter at 6. See also Angel Letter at 8
(suggesting that the proposed criteria could potentially result in
the creation of race-to-the-bottom standards organizations that
establish lax standards).
---------------------------------------------------------------------------

    The Commission agrees that the cost or lack thereof of a technology
standard or standard framework has no bearing on the quality or
appropriateness of such standard, and also that SCI entities should be
encouraged to use appropriate standards developed by professional
organizations that regularly update their standards and employ open
processes for gathering industry input. While the Commission did not
propose to require that particular standards be used, in response to
comment, the Commission is adopting Rule 1001(a)(4) without the
criterion in the SCI Proposal that a technology standard be available
free of charge. The other criteria are adopted as proposed. Thus, to
qualify as an ``SCI industry standard,'' a publication must be
comprised of information technology practices that are widely available
to information technology professionals in the financial sector and
issued by an authoritative body that is a U.S. governmental entity or
agency, association of U.S. governmental entities or agencies, or
widely recognized organization. The Commission believes that this
criterion is sufficiently flexible to include technology practices
issued by professional organizations, including the professional
organizations referenced by commenters.\557\
---------------------------------------------------------------------------

    \557\ See infra notes 583-601 and accompanying text. The
Commission expresses no view, however, on any particular publication
that is not specifically identified in infra notes 584-601, or
standards that remain in development (e.g., a standard being drafted
by AT 9000) (see infra note 601 and accompanying text).
---------------------------------------------------------------------------

Proposed Table A: Comments Received
    The SCI Proposal stated that written policies and procedures that
are consistent with the relevant examples of SCI industry standards
contained in the publications identified in Table A would be deemed to
be ``reasonably designed'' for purposes of proposed Rule
1000(b)(1).\558\ Proposed Table A listed publications covering nine
inspection areas, or ``domains,'' that Commission staff historically
has evaluated under the ARP Inspection Program.\559\
---------------------------------------------------------------------------

    \558\ See Proposing Release, supra note 13, at 18109.
    \559\ See id.
---------------------------------------------------------------------------

    Proposed Table A elicited significant and varied comment. Some
commenters objected generally to the Table A framework.\560\ Others
objected more specifically to Table A's proposed content,\561\ and some
commenters objected to Table A as a premature attempt to establish
consensus on SCI industry standards where consensus has not yet
emerged.\562\
---------------------------------------------------------------------------

    \560\ See, e.g., Angel Letter at 8-9; BATS Letter at 6-7; BIDS
Letter at 7; Direct Edge Letter at 2; Joint SROs Letter at 4; MSRB
Letter at 11-12; and NYSE Letter at 20-21.
    \561\ See, e.g., Angel Letter at 8-9; BATS Letter at 6-7; FIF
Letter at 3-4; ISE Letter at 11-12; CAST Letter at 10; MSRB Letter
at 11-12; DTCC Letter at 15; FINRA Letter at 31; Omgeo Letter at 33;
CISQ Letter at 1-2; OCC Letter at 9; Lauer Letter at 5-7; BIDS
Letter at 7; and Liquidnet Letter at 3-4.
    \562\ See, e.g., FIF Letter at 3-4; Liquidnet Letter at 3-4; UBS
Letter at 7; and ISE Letter at 11-12.
---------------------------------------------------------------------------

Table A Framework and Process

    One group of commenters suggested that, in lieu of the publications
identified in Table A, the Commission should characterize policies and
procedures as reasonably designed if they comply with ``generally
accepted standards.'' \563\ Another commenter similarly suggested that
the Commission replace the proposed rule's reference to ``current SCI
industry standards'' with

the phrase ``generally accepted technology principles,'' and delete
Table A and the proposed Table A criteria.\564\ These commenters viewed
proposed Table A as flawed in concept.\565\ Specifically, one of these
commenters expressed concern that the standards set forth in Table A
might not keep pace with a constantly evolving technological landscape
and that, despite this evolution, Commission staff might take a
checklist approach to its review of policies and procedures, which
would result in unintended consequences.\566\
---------------------------------------------------------------------------

    \563\ See Joint SROs Letter at 4.
    \564\ See NYSE Letter at 20-21.
    \565\ See Joint SROs Letter at 4; and NYSE Letter at 20.
    \566\ See Joint SROs Letter at 4. Other commenters similarly
expressed concern that SCI entities would closely adhere to the
publications listed in Table A (even though the SCI Proposal
specified that such adherence would not be the exclusive means to
comply with the requirements of proposed Rule 1000(b)(1)), rather
than take advantage of the flexibility built into the proposed rule
out of concern that if they did not, they would expose themselves to
potential regulatory action for failure to comply with Regulation
SCI. See, e.g., MSRB Letter at 11; Angel Letter at 8; BATS Letter at
6; and NYSE Letter at 20-21.
---------------------------------------------------------------------------

    The other commenter stated that it was more common, and more
appropriate in any industry that relies heavily on technology, for an
entity to review a variety of different standards for frameworks or
best practices, and then adopt a derivative of multiple standards,
customizing them for the systems at issue.\567\ According to this
commenter, SCI entities would be unlikely to comply with all aspects of
any particular standard in Table A at any particular time, thereby
``obviating its usefulness.'' \568\
---------------------------------------------------------------------------

    \567\ See NYSE Letter at 20.
    \568\ See id.
---------------------------------------------------------------------------

    Other commenters argued that the Table A concept was flawed because
Table A would always be on the verge of being outdated. For example,
one commenter characterized the proposed Table A publications as
``soon-to-be outdated'' and stated that it is crucial that SCI entity
policies and procedures be ``forward-looking'' and able to respond to
future threats.\569\ Another commenter stated that the proposed process
for updating Table A \570\ would not be sufficiently nimble to assure
that SCI entities adhere to the best possible then-current standards,
and suggested that the Commission defer to the expertise of the
organizations that have established the listed standards and rely on
the updates provided by these organizations.\571\ Another commenter
stated that any ``hard coded'' solutions are likely to become obsolete
very quickly.\572\
---------------------------------------------------------------------------

    \569\ See id. See also ISE Letter at 10 (stating that the
standards listed in Table A are not the most current or appropriate
standards). See also infra notes 577-578 and accompanying text.
    \570\ In the SCI Proposal, the Commission stated that it
``preliminarily believes that, following its initial identification
of one set of SCI industry standards . . . it would be appropriate
for Commission staff, from time to time, to issue notices to update
the list of previously identified set of SCI industry standards
after receiving appropriate input from interested persons. . . .
However, until such time as Commission staff were to update the
identified set of SCI industry standards, the then-current set of
SCI industry standards would be the [relevant] standards. . . .''
Proposing Release, supra note 13, at 18111.
    \571\ See MSRB Letter at 11-12.
    \572\ See Direct Edge Letter at 2.
---------------------------------------------------------------------------

    After careful consideration of these comments, the Commission
acknowledges that the proposed framework for identifying and updating
publications on Table A may not be sufficiently nimble to assure that
its list of publications does not become obsolete as technology and
standards change. The Commission agrees that, in an industry that
relies heavily on technologies that are constantly evolving, the
prescription of hard-coded solutions that may become quickly outdated
is not the better approach. However, because several commenters stated
that there is currently a lack of consensus on what constitutes
generally accepted standards or principles in the securities
industry,\573\ the Commission continues to believe that there is value
in identifying example publications for SCI entities to consider
looking to in establishing policies and procedures that are consistent
with ``current SCI industry standards.'' \574\
---------------------------------------------------------------------------

    \573\ See supra note 633 and accompanying text.
    \574\ See Rule 1001(a)(4), which states: ``For purposes of
[complying with Rule 1001(a)], such policies and procedures shall be
deemed to be reasonably designed if they are consistent with current
SCI industry standards, which shall be comprised of information
technology practices that are widely available to information
technology professionals in the financial sector and issued by an
authoritative body that is a U.S. governmental entity or agency,
association of U.S. governmental entities or agencies, or widely
recognized organization. Compliance with such current SCI industry
standards, however, shall not be the exclusive means to comply with
[Rule 1001(a)].''
---------------------------------------------------------------------------

    After considering the potential disadvantages of ``hard-coding''
Table A in a Commission release, and the potential benefits of
providing further guidance to SCI entities on the meaning of ``current
SCI industry standards,'' the Commission has determined that, rather
than the Commission issuing Table A in this release, Commission staff
should issue guidance to assist SCI entities in developing policies and
procedures consistent with ``current SCI industry standards'' in a
manner that is consistent with the Commission's response to comments
received on proposed Table A, as discussed in this Section
IV.B.1.b.iii, and periodically update such guidance as appropriate. The
Commission believes that guidance issued by the Commission staff will
have the advantage of easier updating and allow for emerging consensus
on standards more focused on the securities industry. Thus, concurrent
with the Commission's adoption of Regulation SCI, Commission staff is
issuing guidance to SCI entities on developing policies and procedures
consistent with ``current SCI industry standards.'' \575\
---------------------------------------------------------------------------

    \575\ Staff Guidance on Current SCI Industry Standards will be
available on the Commission's Web site at: www.sec.gov.
---------------------------------------------------------------------------

Table A Publications

    Many commenters who did not urge elimination of Table A altogether
addressed the content of proposed Table A. Those commenters did not
express opposition to the identification of certain inspection areas or
domains on proposed Table A, but some commenters identified issues with
specific publications listed on Table A.\576\ Specifically, two
commenters stated that the NIST publication listed for the Systems
Development Methodology domain was outdated.\577\ One of these
commenters objected to this publication as reflecting a burdensome
staged process to software development that favors the ``waterfall
methodology'' over ``agile'' software development, which generally uses
more ``nimble processes'' and is more typical in the financial services
industry today.\578\ Another commenter noted that this publication had
both strengths and weaknesses.\579\ Two commenters objected to the
FFIEC's Operations IT Examination Handbook in the capacity planning
domain as too generic.\580\ One commenter objected to the inclusion of
FFIEC's Audit IT Examination Handbook.\581\ Another commenter stated
more broadly that the proposed Table A publications focus too heavily

on firm-level risks and do not take into account the technological and
economic stability of the U.S. market as a whole.\582\
---------------------------------------------------------------------------

    \576\ See, e.g., Angel Letter at 9; BATS Letter at 6-7; FIF
Letter at 3-4; and ISE Letter at 10.
    \577\ See BATS Letter at 6; and ISE Letter at 10 (objecting to
the inclusion of NIST Security Considerations in the System
Development Life Cycle (Special Publication 800-64 Rev. 2) as a
suitable ``current SCI industry standard'' in the systems
development methodology domain).
    \578\ See BATS Letter at 6-7.
    \579\ See CISQ2 Letter at 4-5 (stating that NIST Special
Publication 800-64, Rev. 2 and any derivative standard should ``be
reviewed and if necessary revised by a panel of industry
practitioners and technical experts to balance the requirement for
rigor with the amount of practices and documentation specified in
the standard'').
    \580\ See ISE Letter at 10; and FIF Letter at 3-4 (both
described this publication as setting forth a process for conducting
capacity planning).
    \581\ See ISE Letter at 10.
    \582\ See Angel Letter at 9.
---------------------------------------------------------------------------

    In addition, several commenters suggested specific additions to the
proposed list of publications on Table A.\583\ For example, more than
one commenter suggested the following standards as appropriate for
inclusion on Table A: COBIT/ISACA; \584\ ISO-27000; \585\ ISO 25000;
\586\ and NFPA-1600.\587\ Other standards or publications mentioned by
commenters as useful, particularly in the area of software quality or
software security, include the CISQ Software Quality
Specification,\588\ the Capability Maturity Model Integration (CMMI)
framework, \589\ ``SANS 20 Critical Security Controls,'' \590\ ``CWE/
SANS Top 25 Most Dangerous Software Errors,'' \591\ the Open Source
Security Testing Methodology Manual (OSSTMM),\592\ the BITS Financial
Services Roundtable Software Assurance Framework (January 2012),\593\
the ``Build Security In Maturity Model'' (BSTMM),\594\ Microsoft's
SDL,\595\ and resources for defining secure software development
practices from organizations such as OWASP, WASC and SAFECode,\596\ and
publications issued by Scrum Alliance,\597\ the Association for
Software Testing (AST),\598\ the Institute of Electrical and
Electronics Engineers (IEEE),\599\ and the Association for Computing
Machinery (ACM).\600\ In addition, one commenter suggested a standard
currently being drafted by AT 9000, a working group which focuses on
trading safety, regulatory requirements, and achieving efficiency and
effectiveness of systems involved in automated trading.\601\
---------------------------------------------------------------------------

    \583\ See, e.g., CAST Letter; ISE Letter; MSRB Letter; DTCC
Letter; FINRA Letter; Omgeo Letter; CISQ2 Letter; OCC Letter; BIDS
Letter; Liquidnet Letter; and X9 Letter.
    \584\ See CAST Letter at 10; ISE Letter at 11; and MSRB Letter
at 11. COBIT (formerly known as Control Objectives for Information
and related Technology) is an enterprise information technology
governance framework developed by ISACA (formerly known as the
Information Systems Audit and Control Association).
    \585\ See DTCC Letter at 15; ISE Letter at 11; FINRA Letter at
31; and Omgeo Letter at 33. FINRA recommended ISO-27000 series
because it provides ``greater specificity'' and may be ``less
burdensome'' than the standards identified in proposed Table A. ISE
and DTCC recommended ISO 27000 specifically for application
controls, information security and networking, and physical security
controls. Omgeo stated more broadly that it models aspects of its
program on widely accepted international standards and frameworks
such as ITIL and ISO 27000.
    \586\ See CAST Letter and CISQ2 Letter. CAST suggested
supplementing the SCI industry standards with standards that address
development, as well as standards that pertain to structural
software quality, such as ISO 25010 and CISQ Software Quality
Specification. See CAST Letter at 5. CISQ2 agreed that standards
addressing structural software quality are needed and suggested
including CISQ Specification for Automated Quality Characteristic
Measures: CISQ-TR-2012-01 in Table A. CISQ also pointed to the
Capability Maturity Model Integration (CMMI) as another potential
option, noting that it was the most widely adopted process standard
for rigorous software development practices. See CISQ2 Letter at 3-
4.
    \587\ See OCC Letter at 9; and ISE Letter at 11. ISE also
specifically recommended BS 25999 as an alternative contingency
planning standard.
    \588\ See CAST Letter at 5; and CISQ Letter at 1.
    \589\ See CAST Letter at 10.
    \590\ See FIF Letter at 4.
    \591\ See id.
    \592\ See Lauer Letter at 5-7.
    \593\ See BIDS Letter at 7.
    \594\ See id.
    \595\ See id.
    \596\ See id.
    \597\ See Liquidnet Letter at 4.
    \598\ See id.
    \599\ See id.
    \600\ See id.
    \601\ See X9 Letter at 2.
---------------------------------------------------------------------------

    A few commenters opposed referencing standards in Regulation SCI at
the outset and instead supported establishing a process that they
believed would, after a certain period of time, yield a coherent set of
standards.\602\ One of these commenters urged that best practices
should evolve from the Commission's experience with the annual SCI
review process and experience with the ARP program, because such best
practices will be specific to the securities industry and reflect the
actual practices of SCI entities.\603\ Finally, several commenters
suggested that the Commission establish a working group to develop SCI
industry standards.\604\
---------------------------------------------------------------------------

    \602\ See, e.g., FIF Letter at 4, 6; Liquidnet Letter at 3; UBS
Letter at 7; and ISE Letter at 11.
    \603\ See FIF Letter at 4, 6.
    \604\ See, e.g., Liquidnet Letter at 3 (urging that a working
group consisting of regulators, industry participants (from
exchanges, ATSs and broker-dealers) and security and controls
experts be established to develop a security and controls framework
for the industry). See also UBS Letter at 7 (urging the Commission
to convene a ``cross-industry, multi-disciplinary Working Group'' to
be responsible for developing recommendations for appropriate
standards); and ISE Letter at 11 (recommending that the Commission
authorize SCI entities to establish a standards committee to review
and recommend specific sets of standards). See also CISQ Letter at
2, 6 (supporting the Table A approach but also seeing value in
tailoring existing standards from professional organizations into an
industry-specific set of standards for SCI entities).
---------------------------------------------------------------------------

    The Commission has carefully considered these comments, and
continues to believe that there is value in identifying publications
for SCI entities to consider looking to in establishing reasonable
policies and procedures, because doing so will provide guidance on how
an SCI entity may comply with adopted Rule 1001(a). The Commission
therefore believes that issuance of staff guidance that does this, as
discussed above, will be useful for SCI entities. However, after
careful consideration of commenters' views regarding the publications
on proposed Table A, the Commission believes it is useful to
characterize how such staff guidance should be used by SCI entities. In
particular, the Commission understands that some commenters who
objected to the proposed Table A concept and/or the proposed Table A
content were more broadly taking issue with the characterization of
certain of the documents on proposed Table A, such as the NIST 800-53
document, as a ``standard,'' rather than a ``framework'' or a
``process.'' \605\ The Commission believes that many commenters
implicitly were questioning why certain identified technology
frameworks (such as NIST 800-53) were being labeled as, and thereby
elevated to, an example of ``current SCI industry standards'' when many
SCI entities were already following ISO 27000, COBIT, or other
technology standards that they viewed as more specific, relevant, and/
or cost effective than the NIST frameworks identified on proposed Table
A.\606\ In response to these comments, the Commission believes it is
appropriate that the staff's guidance be characterized as listing
examples of publications describing processes, guidelines, frameworks,
or standards for an SCI entity to consider looking to in developing
reasonable policies and procedures, rather than strictly as listing
industry standards. Thus, the Commission believes it is appropriate if
Commission staff were to list publications that provide guidance to SCI
entities on suitable processes for developing, documenting, and
implementing policies and procedures for their SCI systems (and
indirect SCI systems, as applicable), taking into account the
criticality of each such system.
---------------------------------------------------------------------------

    \605\ The Commission also notes that this point was made by a
member of the third panel at the Cybersecurity Roundtable, supra
note 39. See also FINRA Letter at 31.
    \606\ See supra notes 577-601 and accompanying text.
---------------------------------------------------------------------------

    With respect to the publications commenters suggested for inclusion
on proposed Table A, the Commission is not disputing the value of such
standards, and believes that each, when considered with respect to a
particular system at an SCI entity, may contain appropriate standards
for the SCI entity to use as, or incorporate within, its

policies and procedures.\607\ The Commission notes that the guidance is
intended to be used as a baseline from which the staff may work with
SCI entities and other interested market participants to build
consensus on industry-specific standards, as discussed more fully
below. Further, the Commission believes that the goal of providing
general and flexible guidance to SCI entities does not necessitate
providing a lengthy list of all the publications that meet the criteria
set forth in Rule 1001(a)(4).\608\
---------------------------------------------------------------------------

    \607\ See supra notes 577-601 and accompanying text.
    \608\ See supra note 557 and accompanying text.
---------------------------------------------------------------------------

    The Commission continues to believe that it may be appropriate for
an SCI entity to choose to adhere to a standard or guideline in a given
domain or subcategory thereof that is different from those contained in
the staff guidance, and emphasizes that nothing that the staff may
include in its guidance precludes an SCI entity from adhering to
standards such as ISO 27000, COBIT, or others referenced by commenters
to the extent they result in policies and procedures that comply with
the requirements of Rule 1001(a).\609\ Moreover, adopted Rule
1001(a)(4) explicitly provides that compliance with current SCI
industry standards (i.e., including those publications identified by
the Commission staff) is not the exclusive method of compliance with
Rule 1001(a). Accordingly, an SCI entity's determination not to adhere
to some or all of the publications included in the staff guidance in
developing its policies and procedures does not necessarily mean that
its policies and procedures will be deficient or unreasonable for
purposes of Rule 1001(a)(1). Importantly, the publications listed by
Commission staff should be understood to provide guidance to SCI
entities on selecting appropriate controls for applicable systems, as
well as suitable processes for developing, documenting, and
implementing policies and procedures for their SCI systems (and
indirect SCI systems, as applicable), taking into account the
criticality of each such system. Thus, for example, the Commission
believes it would be reasonable for the most robust controls to be
selected and implemented for ``critical SCI systems,'' as compared to
other types of SCI systems, and the Commission believes it would be
appropriate that the staff's guidance include publications that require
more rigorous controls for higher-risk systems. The staff guidance is
not intended to be static, however. As the Commission staff works with
SCI entities, as well as members of the securities industry, technology
experts, and interested members of the public, and as technology
standards continue to evolve, the Commission anticipates that the
Commission staff will periodically update the staff guidance as
appropriate.
---------------------------------------------------------------------------

    \609\ Likewise, such guidance would not preclude an SCI entity
from adopting a derivative of multiple standards, and/or customizing
one or more standards for the particular system at issue, as one
commenter suggested. See supra note 567 and accompanying text. In
assessing whether an SCI entity's use of such an approach in
designing its policies and policies and procedures would be
``deemed'' to be reasonably designed, the Commission's inquiry would
be into whether its policies and procedures were consistent with
standards meeting the criteria in adopted Rule 1001(a)(4).
---------------------------------------------------------------------------

    Another way in which the publications identified by Commission
staff should provide guidance to SCI entities is by providing
transparency on how the staff will, at least initially, prepare for and
conduct inspections relating to Regulation SCI. As discussed in the SCI
Proposal and above,\610\ for over two decades, ARP staff has conducted
inspections of ARP entity systems, with a goal of evaluating whether an
ARP entity's controls over its information technology resources in each
domain are consistent with ARP and industry guidelines,\611\ as
identified by ARP staff from a variety of information technology
publications that ARP staff believed were appropriate for securities
market participants.\612\ With the adoption of Regulation SCI, and the
resultant transition away from the voluntary ARP Inspection Program to
an inspection program under Regulation SCI, the Commission believes it
is helpful to establish consistency in its approach to examining SCI
entities for compliance with Regulation SCI. Importantly, establishing
consistency does not mean that the Commission will take a one-size-
fits-all or checklist approach. Because the publications identified by
Commission staff should be general and flexible enough to be compatible
with many widely-recognized technology standards that SCI entities
currently use, the Commission believes the publications identified by
Commission staff should provide guidance for an SCI entity to self-
assess whether its policies and procedures comply with Rules
1001(a)(1)-(2). Moreover, because use of the publications identified by
Commission staff is not mandatory, the staff guidance should not be
regarded as establishing a checklist, the use of which could result in
unintended consequences, but rather a basis for considering how an SCI
entity's selected standards relate to the guidance provided by
Commission staff and whether they are appropriate standards for use by
that particular SCI entity for a given system.
---------------------------------------------------------------------------

    \610\ See supra Section II.A.
    \611\ As stated in the SCI Proposal, the domains covered during
an ARP inspection depend in part upon whether the inspection is a
regular inspection or a ``for-cause'' inspection. Typically,
however, to make the most efficient use of resources, a single ARP
inspection will cover fewer than nine domains. See Proposing
Release, supra note 13, at 18086.
    \612\ See id. and supra Section II.A (discussing the ARP
Inspection Program).
---------------------------------------------------------------------------

    The Commission believes that it would be appropriate that the
publications initially identified by Commission staff at a minimum
include the nine inspection areas, or ``domains,'' that the Commission
identified on Table A in the SCI Proposal and that are relevant to SCI
entities' systems capacity, integrity, resiliency, availability, and
security, namely: Application controls; capacity planning; computer
operations and production environment controls; contingency planning;
information security and networking; audit; outsourcing; physical
security; and systems development methodology.
    The Commission believes it would be appropriate that each
publication identified by Commission staff be identified with
specificity and include the particular publication's date, volume
number, and/or publication number, as the case may be. Thus, for SCI
entities that establish or self-assess their policies and procedures in
reliance on the guidance provided by the publications identified by
Commission staff, the Commission believes that the publications should
be the relevant publications until such time as the list is updated by
Commission staff. Of course, SCI entities may elect to use publications
describing processes, guidelines, frameworks, and/or standards other
than those identified by Commission staff to develop policies and
procedures that satisfy the requirements of Rules 1001(a)(1)-(2).
    As stated in the SCI Proposal, however, the Commission continues to
believe that the development of securities-industry specific standards
is a worthy goal. Although some commenters urged the Commission not to
adopt Table A at the outset, and instead establish a process to achieve
that end,\613\ the Commission believes that the better approach is for
Commission staff to provide examples of publications through its
guidance that form a baseline and remain open to emerging consensus on
industry-specific standards. In response to the

commenter that suggested that the Commission leverage the annual SCI
review process and the SCI inspection process to yield a coherent set
of industry-specific standards that could be referenced on Table A, the
Commission believes that such an approach could serve as an appropriate
input into the future development of such standards.\614\ In response
to the commenter who stated that the proposed Table A publications do
not take into account the technological and economic stability of the
U.S. market as a whole,\615\ the Commission notes that the
technological stability of individual SCI entities, in tandem with a
heightened focus on critical SCI systems, are necessary prerequisites
to achieving such market-wide goals. Accordingly, the Commission
believes that the publications identified by Commission staff today
should serve as an appropriate initial set of publications, processes,
guidelines, frameworks, and standards for SCI entities to use as
guidance to develop their policies and procedures under Rule 1001(a).
With this guidance as a starting point, the Commission expects that the
Commission staff will seek to work with members of the securities
industry, technology experts, and interested members of the public
towards developing standards relating to systems capacity, integrity,
resiliency, availability, and security appropriately tailored for the
securities industry and SCI entities, and periodically issue staff
guidance that updates the guidance with such standards.
---------------------------------------------------------------------------

    \613\ See supra note 604 and accompanying text.
    \614\ See supra note 602 and accompanying text.
    \615\ See supra note 582 and accompanying text.
---------------------------------------------------------------------------

2. Policies and Procedures To Achieve Systems Compliance--Rule 1001(b)
    Proposed Rule 1000(b)(2)(i) would have required each SCI entity to
establish, maintain, and enforce written policies and procedures
reasonably designed to ensure that its SCI systems operate in the
manner intended, including in a manner that complies with the federal
securities laws and rules and regulations thereunder and the SCI
entity's rules and governing documents, as applicable.
    Proposed Rule 1000(b)(2) also would have included safe harbors for
an SCI entity and its employees. Specifically, proposed Rule
1000(b)(2)(ii) provided that an SCI entity would be deemed not to have
violated proposed Rule 1000(b)(2)(i) if the SCI entity: (1) Established
policies and procedures reasonably designed to provide for specified
elements; (2) established and maintained a system for applying such
policies and procedures which would reasonably be expected to prevent
and detect, insofar as practicable, any violations of such policies and
procedures by the SCI entity or any person employed by the SCI entity;
and (3) reasonably discharged the duties and obligations incumbent upon
it by such policies and procedures, and was without reasonable cause to
believe that such policies and procedures were not being complied with
in any material respect. The safe harbor for SCI entities in proposed
Rule 1000(b)(2)(ii) specified that the SCI entity's policies and
procedures must be reasonably designed to provide for: (1) Testing of
all SCI systems and any changes to such systems prior to
implementation; (2) periodic testing of all SCI systems and any changes
to such systems after their implementation; (3) a system of internal
controls over changes to SCI systems; (4) ongoing monitoring of the
functionality of SCI systems to detect whether they are operating in
the manner intended; (5) assessments of SCI systems compliance
performed by personnel familiar with applicable federal securities laws
and rules and regulations thereunder and the SCI entity's rules and
governing documents, as applicable; and (6) review by regulatory
personnel of SCI systems design, changes, testing, and controls to
prevent, detect, and address actions that do not comply with applicable
federal securities laws and rules and regulations thereunder and the
SCI entity's rules and governing documents, as applicable.
    In addition, proposed Rule 1000(b)(2)(iii) set forth a safe harbor
for individuals. It provided that a person employed by an SCI entity
would be deemed not to have aided, abetted, counseled, commanded,
caused, induced, or procured the violation by any other person of
proposed Rule 1000(b)(2)(i) if the person employed by the SCI entity
has reasonably discharged the duties and obligations incumbent upon
such person by the policies and procedures, and was without reasonable
cause to believe that such policies and procedures were not being
complied with in any material respect.
    After careful consideration of the comments, proposed Rule
1000(b)(2) is adopted as Rule 1001(b) with modifications, as discussed
below.
a. Reasonable Policies and Procedures To Achieve Systems Compliance
    The Commission received significant comment on its proposal to
require that SCI entities establish, maintain, and enforce written
policies and procedures reasonably designed to ensure systems
compliance. Some commenters supported the broad goals of a policies and
procedures requirement to help ensure that SCI systems operate as
intended.\616\ Other commenters questioned whether any set of policies
and procedures could guarantee perfect operational compliance.\617\ One
commenter emphasized that no set of policies and procedures can
guarantee 100% operational compliance and that, historically, the
Commission has allowed entities to use a reasonableness standard so
that policies and procedures are required to be reasonably designed to
promote compliance, and the same should be used for the underlying
predicate requirement in Regulation SCI.\618\ A few commenters
expressed concern that, in instances where an SCI entity's policies and
procedures failed to prevent SCI events, the Commission might use such
failures as the basis for an enforcement action, charging that the
policies and procedures were not reasonable.\619\ One commenter
believed that compliance with Regulation SCI should be measured against
a firm's adherence to its own set of policies and procedures that are
in keeping with SCI system objectives, and such policies should be
reviewed and updated as part of the annual SCI review process.\620\
Another commenter requested that the Commission more clearly
distinguish between liability under Regulation SCI and liability for
SCI events, stating that compliance with Regulation SCI and compliance
with other federal securities laws and rules must remain distinct.\621\
---------------------------------------------------------------------------

    \616\ See MSRB Letter at 12-13; SIFMA Letter at 12; and MFA
Letter at 3. Two of these commenters believed that SCI entities that
perform critical market functions should be required to have more
stringent policies and procedures than less critical SCI entities.
See SIFMA Letter at 12; and MFA Letter at 3-4.
    \617\ See ITG Letter at 14. See also BATS Letter at 3-4, 6.
    \618\ See ITG Letter at 14.
    \619\ See BATS Letter at 3-4; Angel Letter at 4; and FSR Letter
at 5. One of these commenters considered this possibility as, in
effect, imposing a strict liability standard with respect to systems
issues, and was concerned that the proposed approach would result in
``finger-pointing'' and constant enforcement actions for immaterial
violations that desensitize people to actual material violations.
See FSR Letter at 3-8.
    \620\ See FIF Letter at 4.
    \621\ See FSR Letter at 6.
---------------------------------------------------------------------------

    Whereas adopted Rule 1001(a) \622\ concerns the robustness of the
SCI entity's systems, adopted Rule 1001(b) \623\ concerns the
operational compliance of an SCI entity's SCI systems with the Exchange
Act, the rules and regulations thereunder, and

the SCI entity's governing documents. The Commission continues to
believe, as stated in the SCI Proposal, that a rule requiring SCI
entities to establish, maintain, and enforce policies and procedures
reasonably designed to ensure operational compliance will help to:
ensure that SCI SROs comply with Section 19(b)(1) of the Exchange Act;
\624\ reinforce existing SRO rule filing processes to assist market
participants and the public in understanding how the SCI systems of SCI
SROs are intended to operate; and assist SCI SROs in meeting their
obligations to file plan amendments to SCI Plans under Rule 608 of
Regulation NMS.\625\ It will similarly help other SCI entities (i.e.,
SCI ATSs, plan processors, and exempt clearing agencies subject to ARP)
to achieve operational compliance with the Exchange Act, the rules and
regulations thereunder, and their governing documents.
---------------------------------------------------------------------------

    \622\ Adopted Rule 1001(a) was proposed as Rule 1000(b)(1).
    \623\ Adopted Rule 1001(b) was proposed as Rule 1000(b)(2).
    \624\ See 15 U.S.C. 78s(b)(1) (requiring each SRO to file with
the Commission copies of any proposed rule or any proposed change
in, addition to, or deletion from the rules of the SRO).
    \625\ See Proposing Release, supra note 13, at 18115.
---------------------------------------------------------------------------

    The Commission notes that Rule 1001(b) is intended to help prevent
the occurrence of systems compliance issues at SCI entities. The
Commission discussed in Section IV.A.3.b the rationale for further
focusing the definition of systems compliance issue (i.e., replacing
the reference to operating ``in the manner intended, including in a
manner that complies with the federal securities laws'' with a
reference to operating ``in a manner that complies with the Act''). To
provide consistency between the definition of systems compliance issue
and the requirement for policies and procedures to ensure systems
compliance, the Commission is similarly revising Rule 1001(b)(1) to
require each SCI entity to establish, maintain, and enforce written
policies and procedures reasonably designed to ensure that its SCI
systems operate ``in a manner that complies with the Act'' and the
rules and regulations thereunder and the entity's rules and governing
documents, as applicable.
    As noted above, some commenters expressed concern that an SCI
entity would be found to be in violation of Rule 1001(b) if an SCI
event occurs.\626\ Consistent with the discussion above regarding Rule
1001(a), the Commission emphasizes that the occurrence of a systems
compliance issue at an SCI entity does not necessarily mean that the
SCI entity has violated Rule 1001(b) of Regulation SCI. As stated in
the SCI Proposal, an SCI entity will not be deemed to be in violation
of Rule 1001(b) solely because it experienced a systems compliance
issue.\627\ The Commission also notes that Rule 1001(b) requires
systems compliance policies and procedures to be reasonably
designed.\628\ The Commission acknowledges that reasonable policies and
procedures will not ensure the elimination of all systems issues,
including systems compliance issues. While a systems compliance issue
may be probative as to the reasonableness of an SCI entity's policies
and procedures, it is not determinative. Further, the occurrence of a
systems compliance issue also does not necessarily mean that the SCI
entity will be subject to an enforcement action. Rather, the Commission
will exercise its discretion to initiate an enforcement action if the
Commission determines that action is warranted, based on the particular
facts and circumstances of an individual situation.
---------------------------------------------------------------------------

    \626\ See supra notes 617-620 and accompanying text. One of
these commenters believed that compliance with Regulation SCI should
be measured against a firm's adherence to its own set of policies
and procedures that are in keeping with SCI systems objectives. See
supra note 620 and accompanying text. The Commission understands
this commenter to be expressing the same concern as other commenters
that an SCI entity would be found to be in violation of Rule 1001(b)
if an SCI event occurs. This commenter also noted that policies and
procedures should be reviewed and updated as part of the annual SCI
review process. See supra note 620 and accompanying text. The
comment regarding reviews and updates of policies and procedures is
addressed below. See infra note 673 and accompanying text.
    \627\ Also, as noted in the SCI Proposal, an employee of an SCI
entity would not be deemed to have aided, abetted, counseled,
commanded, caused, induced, or procured the violation by any other
person of Rule 1001(b) merely because the SCI entity at which the
employee worked experienced a systems compliance issue. See
Proposing Release, supra note 13, at 18116.
    \628\ As stated above, one commenter noted that no set of
policies and procedures can guarantee 100% operational compliance
and that historically, the Commission has allowed entities to use a
reasonableness standard so that policies and procedures are required
to be reasonably designed to promote compliance, and the same
approach should be used for Regulation SCI. See supra note 618 and
accompanying text. The Commission agrees with this commenter that
reasonably designed policies and procedures might not completely
eliminate the occurrence of systems compliance issues. Also, adopted
Rule 1001(b) is consistent with this commenter's suggestion, because
it requires policies and procedures that are ``reasonably designed''
to ensure systems compliance.
---------------------------------------------------------------------------

    In response to one commenter's request that the Commission more
clearly distinguish between liability under Regulation SCI and
liability for SCI events,\629\ the Commission notes that liability
under Regulation SCI is separate and distinct from liability for other
violations that may arise from the underlying SCI event. In particular,
whether an SCI entity violated Regulation SCI does not affect the
determination of whether the underlying SCI event also caused the SCI
entity to violate other laws or rules, and compliance with Regulation
SCI is not a safe harbor or other shield from liability under other
laws or rules. Thus, even if the occurrence of an SCI event does not
cause an SCI entity to be found to be in violation of Regulation SCI,
the SCI entity may still be liable under other Commission rules or
regulations, the Exchange Act, or SRO rules for the underlying SCI
event.\630\
---------------------------------------------------------------------------

    \629\ See supra note 621 and accompanying text.
    \630\ For example, it is possible for an SCI SRO to have
established, maintained, and enforced reasonably designed systems
compliance policies and procedures consistent with the requirements
of Rule 1001(b) of Regulation SCI, but still potentially violate
Section 19(g) of the Exchange Act if the operation of its systems is
inconsistent with its own rules. See 15 U.S.C. 78s(g) (requiring
every SRO to comply with the Exchange Act, the rules and regulations
thereunder, and its own rules).
---------------------------------------------------------------------------

b. Proposed Safe Harbor for SCI Entities
i. Comments Received
    In the SCI Proposal, the Commission solicited comment on the
proposed approach to include safe harbor provisions in proposed Rule
1000(b)(2) and specifically asked whether commenters agreed with the
proposed inclusion of safe harbors.\631\ Many commenters specifically
addressed the safe harbors in proposed Rule 1000(b)(2). Two commenters
urged elimination of the proposed safe harbors.\632\ One of these
commenters stated that the safe harbors were framed so generally that
they would be easy to invoke.\633\ This commenter also stated that
inclusion of a safe harbor provision for compliance standards would
unnecessarily and severely limit the Commission's ability to deter
violations through meaningful enforcement actions.\634\ The other
commenter stated that, if a safe harbor is adopted, the Commission
should be as specific as possible in establishing how to qualify for
the safe harbor, and recommended that Commission guidance ensure that
SCI entities are actively building and improving upon safety systems
and not simply checking boxes and doing the minimal amount necessary to
ensure compliance.\635\
---------------------------------------------------------------------------

    \631\ See Proposing Release, supra note 13, at 18117, question
104.
    \632\ See Better Markets Letter at 5-6; and Lauer Letter at 7-8.
    \633\ See Better Markets Letter at 5-6.
    \634\ See id. at 6.
    \635\ See Lauer Letter at 7-8.
---------------------------------------------------------------------------

    In contrast, several commenters supported the inclusion of a safe
harbor in proposed Rule 1000(b)(2) in theory, but objected to the
proposed

approach.\636\ Some commenters stated that the proposed safe harbor,
with its prescriptive requirements, would evolve into the de facto rule
itself as SCI entities decide to adhere to the requirements of the safe
harbor rather than risk a potential enforcement action stemming from an
SCI event.\637\ One of these commenters noted that the safe harbor
merely further defined the elements that the policies and procedures
must have by providing a list of points that reasonably designed
policies and procedures must cover.\638\ This commenter believed that
including a requirement for reasonably designed policies and procedures
and providing a safe harbor when those policies and procedures are
reasonably designed is inherently circular, and expressed concern about
liability under Regulation SCI whenever there is a systems or
technology malfunction or error.\639\ This commenter also compared the
proposed SCI entity safe harbor to other rules, stating that the other
rules requiring policies and procedures recognize the need for those
policies and procedures to be reasonably designed in light of the
manner in which business is conducted.\640\ This commenter further
noted that, if the Commission intends that all SCI entities conform to
the standards articulated in the safe harbor, the Commission should set
them forth as express provisions of the rule, although this commenter
believed that such an approach would be misguided because it would
create strictures that impose protocols that may not be suitable for
certain market participants.\641\
---------------------------------------------------------------------------

    \636\ See, e.g., Angel Letter; Direct Edge Letter; FSR Letter;
ITG Letter; MSRB Letter; NYSE Letter; OCC Letter; OTC Markets
Letter; and Joint SROs Letter.
    \637\ See ITG Letter at 14 (stating that ``[t]he safe harbor
contains so many requirements that it operates as a rule by
itself''); and FSR Letter at 8.
    \638\ See FSR Letter at 4-5.
    \639\ See id. at 5-6.
    \640\ See FSR Letter at 8-9 (expressing concern that the safe
harbor will become the sole yardstick by which conduct is measured
and, even if the safe harbor were non-exclusive, it could become the
de facto standard to the exclusion of other, legitimate approaches).
    \641\ See FSR Letter at 9.
---------------------------------------------------------------------------

    Several other commenters expressed concern that the proposed safe
harbors were unclear.\642\ One group of commenters noted that the
provisions in the proposed safe harbors were vague, subjective, and
merely duplicate elements that would result from a logical
interpretation of Rule 1000(b)(1),\643\ which these commenters believed
offered no safe harbor protection at all.\644\ Another commenter stated
that the use of a reasonableness standard with respect to the design of
systems and the discharge of duties under an SCI entity's policies and
procedures would mean that an SCI entity and its employees would never
know with certainty whether they met the terms of the safe harbor.\645\
Another commenter similarly stated that SCI entities cannot know if
they have complied with the safe harbor unless more guidance is
provided on the concept of ``reasonable policies and procedures'' and
the Commission explains what constitutes adequate testing, monitoring,
assessments, and review for each system.\646\ One commenter agreed with
the need for a safe harbor but stated that the proposed safe harbor is
not sufficiently robust because it contains ``vague and extensive
requirements that are overly subjective'' and the Commission therefore
would be ``likely to review an SCI entity's interpretation of the safe
harbor in the event of a systems issue with the benefit of 20/20
hindsight.'' \647\ This commenter expressed concern that the occurrence
of a significant systems event would mean that an exchange did not have
reasonable policies and procedures and would be outside the terms of
the proposed safe harbor.\648\
---------------------------------------------------------------------------

    \642\ See, e.g., FSR Letter; OCC Letter; and OTC Markets Letter.
    \643\ See Joint SROs Letter at 13 (stating that the proposed
safe harbor should provide a more objective and transparent
approach, and provide SCI entities a clear, affirmative defense from
allegations of having violated Regulation SCI).
    \644\ See Joint SROs Letter at 13.
    \645\ See OCC Letter at 11. This commenter also questioned the
value of the safe harbors as proposed and requested that the
Commission consider including bright-line tests and minimum
standards in the safe harbor provisions to better guide SCI entities
and their employees in avoiding liability under Regulation SCI. See
OCC Letter at 11. See also NYSE Letter at 30 (noting that the
Commission provided no guidance on the phrase ``policies and
procedures reasonably designed'').
    \646\ See OTC Markets Letter at 15.
    \647\ See NYSE Letter at 30.
    \648\ See id.
---------------------------------------------------------------------------

    A few commenters suggested specific alternatives to the proposed
safe harbors.\649\ One commenter recommended that the Commission adopt
a safe harbor with objective criteria to protect SCI entities from
enforcement actions under Regulation SCI except in cases of intentional
or reckless non-compliance or patterns of non-compliance with
Regulation SCI, or if an SCI entity fails to implement reasonable
corrective action in response to a written communication from the
Commission regarding Regulation SCI.\650\ This commenter urged that,
even if the Commission does not include the suggested safe harbor, the
adopting release should clearly state that the Commission will not
pursue enforcement actions against SCI entities that establish,
maintain, and enforce compliance policies and procedures or act in good
faith, notwithstanding a violation of Regulation SCI.\651\
---------------------------------------------------------------------------

    \649\ See, e.g., FSR Letter; ITG Letter; OTC Markets Letter;
Joint SROs Letter; and NYSE Letter.
    \650\ See NYSE Letter at 29, 31-32. This commenter also
suggested that SCI entity employees be protected except in instances
where employees intentionally or recklessly fail to discharge their
duties and obligations under the SCI entity's policies and
procedures. See NYSE Letter at 29, 31-32. This comment and the
individual safe harbor are addressed in Section IV.B.2.d below.
Another commenter, expressing support for NYSE's suggested approach
for SCI entities and their employees, stated that an objective
standard would provide the proper incentives for compliance and
allow SCI entities to reasonably evaluate their potential exposure
when an SCI event occurs and act quickly in the critical moments
following an SCI event. See OTC Markets Letter at 16.
    \651\ See NYSE Letter at 32, n. 41.
---------------------------------------------------------------------------

    One group of commenters similarly recommended that the Commission
adopt an objective safe harbor.\652\ These commenters noted that minor
mistakes and unintentional errors occur in the daily operations of
running a business, and a safe harbor should provide protection to SCI
entities that follow the policies and procedures as intended, including
in the resolution and containment of such mistakes and errors.\653\
These commenters believed that it should be sufficient for an SCI
entity to qualify for the safe harbor if it adopts policies and
procedures reasonably designed to comply with Regulation SCI and does
not knowingly violate such policies and procedures.\654\ These
commenters further requested that the Commission clarify its views on
the protections of the safe harbor for inadvertent violations of other
laws and rules despite compliance with Regulation SCI and expand the
safe harbor to explicitly cover such instances.\655\
---------------------------------------------------------------------------

    \652\ See Joint SROs Letter at 13-14.
    \653\ See id.
    \654\ See id. These commenters suggested a parallel safe harbor
for employees of SCI entities. See id. at 14.
    \655\ See id.
---------------------------------------------------------------------------

    One commenter suggested simplifying the safe harbor to require only
that an SCI entity adopt reasonable policies and procedures to comply
with proposed Regulation SCI, which should include reasonable ongoing
responsibilities related to testing and monitoring.\656\ Another
commenter believed that the safe harbor should grant immunity from
enforcement penalties for all problems that are self-reported by SCI
entities and individuals.\657\ One commenter suggested that Regulation
SCI should: (1) Encourage parties to discover and

remediate technology errors and malfunctions, and/or deficiencies in
their policies and procedures; (2) avoid ipso facto liability under
Regulation SCI for failures by technology or systems; and (3) require
some form of causation in order for liability to attach.\658\ This
commenter also recommended that the Commission provide safe harbors
from liability under both proposed Rules 1000(b)(1) and (2) where
either: (1) The SCI entity or SCI personnel discovers and remediates a
problem without regulatory intervention and assuming no underlying
material violation; or (2) no technology error or problem has occurred,
but the policies and procedures might benefit from improvements.\659\
According to this commenter, the remediation safe harbor should also
apply to underlying technology problems if the SCI entity had complied
with Regulation SCI.\660\ One commenter expressed concern that, without
a safe harbor and a guarantee of immunity, the disclosures to the
Commission required under Regulation SCI would provide a roadmap for
litigation against non-SRO entities.\661\
---------------------------------------------------------------------------

    \656\ See ITG Letter at 14.
    \657\ See Angel Letter at 4.
    \658\ See FSR Letter at 9.
    \659\ See id. at 9-10.
    \660\ See id. at 3, 9-10.
    \661\ See OTC Markets Letter at 15-16 (stating that ``entities
that do not have SRO immunity, such as ATSs, may be subject to
liability based on information reported under Reg. SCI's Rule
1000(b)(4)(iv) . . . [w]ithout a safe harbor and a guarantee of
immunity, this kind of disclosure provides a roadmap for litigation
against non-SRO SCI entities'').
---------------------------------------------------------------------------

ii. Elimination of Proposed Safe Harbor for SCI Entities and
Specification of Minimum Elements
    As discussed in greater detail below, after careful consideration
of the comments, and in light of the more focused scope of Regulation
SCI, the Commission has determined not to adopt the proposed safe
harbor for SCI entities.\662\ Rather, Rule 1001(b) sets forth non-
exhaustive minimum elements that an SCI entity must include in its
systems compliance policies and procedures. The Commission recognizes
that the precise nature, size, technology, business model, and other
aspects of each SCI entity's business vary. Therefore, the minimum
elements are intended to be general in order to accommodate these
differences, and each SCI entity will need to exercise judgment in
developing and maintaining specific policies and procedures that are
reasonably designed to achieve systems compliance. The Commission also
believes that SCI entities should consider the evolving nature of the
securities industry, as well as industry practices and standards, in
developing and maintaining such policies and procedures. As such, the
elements specified in Rule 1001(b) are non-exhaustive, and each SCI
entity should consider on an ongoing basis what steps it needs to take
in order to ensure that its policies and procedures are reasonably
designed.
---------------------------------------------------------------------------

    \662\ The Commission's decision not to adopt an SCI entity safe
harbor also addresses a commenter's concern that the inclusion of a
safe harbor provision in Rule 1001(b) could unnecessarily and
severely limit the Commission's ability to deter violations through
meaningful enforcement actions. See supra notes 633-634 and
accompanying text. As discussed in Section IV.B.2.d below, however,
the Commission is adopting a safe harbor for personnel of SCI
entities.
---------------------------------------------------------------------------

    In the SCI Proposal, the Commission stated that, ``[b]ecause of the
complexity of SCI systems and the breadth of the federal securities
laws and rules and regulations thereunder and the SCI entities' rules
and governing documents, the Commission preliminarily believes that it
would be appropriate to provide an explicit safe harbor for SCI
entities and their employees in order to provide greater clarity as to
how they can ensure that their conduct will comply with [Rule
1000(b)(2)].'' \663\
---------------------------------------------------------------------------

    \663\ See Proposing Release, supra note 13, at 18115.
---------------------------------------------------------------------------

    One reason that the Commission is not adopting the proposed safe
harbor for SCI entities is that the Commission has focused the scope of
Regulation SCI as adopted. For example, adopted Rule 1001(b) requires
policies and procedures that are reasonably designed to ensure
compliance with ``the Act''--rather than operating ``in the manner
intended, including in a manner that complies with the federal
securities laws'' as was proposed--and the rules and regulations
thereunder, and the SCI entity's rules and governing documents.
Therefore, the requirement under adopted Rule 1001(b) is more targeted
than the requirement under proposed Rule 1000(b)(2), and alleviates
some of the concern regarding the ``breadth of the federal securities
laws and rules and regulations thereunder'' that was expressed in the
SCI Proposal. The Commission expects that SCI entities are familiar
with their obligations under the Exchange Act, the rules and
regulations thereunder, and their own rules and governing documents. In
addition, as discussed in Section IV.A.2.b above, the Commission has
further focused the scope of SCI systems, which also alleviates some of
the concern regarding the ``complexity of SCI systems'' that was
expressed in the SCI Proposal.\664\
---------------------------------------------------------------------------

    \664\ See id.
---------------------------------------------------------------------------

    Further, as noted above, in the SCI Proposal, the Commission stated
its preliminary belief that it would be appropriate to provide an
explicit safe harbor for SCI entities in order to provide greater
clarity on how they could comply with proposed Rule 1000(b)(2).\665\
Rather than achieving this goal, commenters argued that the proposed
safe harbor merely further defined the elements that the policies and
procedures must have, and did not include sufficient guidance or
specificity to SCI entities seeking to rely on it.\666\ For example,
one commenter noted that the policies and procedures specified in the
safe harbor would still need to be ``reasonably designed.'' \667\
Further, the Commission acknowledges some commenters' concern that the
proposed safe harbor, ``with its prescriptive requirements,'' could
evolve into the de facto rule itself.\668\
---------------------------------------------------------------------------

    \665\ See id.
    \666\ See supra notes 638-639, 643-648 and accompanying text.
With respect to the group of commenters who suggested that the safe
harbor should give SCI entities a clear, affirmative defense from
allegations of having violated Regulation SCI, as discussed above,
the Commission is eliminating the proposed safe harbor for SCI
entities. See supra note 643. As discussed below, the Commission
believes that, by specifying non-exhaustive minimum elements that an
SCI entity must include in its systems compliance policies and
procedures, the rule will encourage SCI entities to actively build
and improve upon the compliance of their systems, rather than limit
their compliance to some fixed elements of a safe harbor.
    \667\ See supra notes 638-639 and accompanying text. This
commenter also compared the proposed SCI entity safe harbor to other
rules, stating that the other rules requiring policies and
procedures recognize the need for those policies and procedures to
be reasonably designed in light of the manner in which business is
conducted. See supra note 640 and accompanying text. Rule 1001(b),
as adopted, requires policies and procedures to be ``reasonably
designed'' to ensure the compliance of SCI systems. Therefore, Rule
1001(b) recognizes the need for policies and procedures to be
reasonably designed in light of the manner in which an SCI entity's
business is conducted.
    \668\ See supra note 637 and accompanying text and supra note
640. The Commission acknowledges that some commenters who believed
that the proposed safe harbor was inadequate also advocated for
alternative safe harbors, such as those that require knowledge or
recklessness for liability. These comments are discussed below in
Section IV.B.2.b.iii.
---------------------------------------------------------------------------

    As discussed above, the Commission is not adopting a safe harbor
for SCI entities. Rather, adopted Rule 1001(b)(1) requires an SCI
entity to have reasonably designed policies and procedures to achieve
systems compliance and adopted Rule 1001(b)(2) specifies non-
exhaustive, general minimum elements that an SCI entity must include in
its systems compliance policies and procedures. These minimum elements
are based on the elements contained in the proposed safe harbor for SCI
entities, but modified in

response to concerns raised by commenters. As adopted, Rules 1001(b)(1)
and (b)(2) specify the minimum elements of reasonably designed policies
and procedures to achieve systems compliance, and at the same time
provide flexibility by permitting an SCI entity to establish policies
and procedures that are reasonably designed based on the nature, size,
technology, business model, and other aspects of its business.
Moreover, the Commission believes that, by specifying non-exhaustive,
general minimum elements of systems compliance policies and procedures,
the rule will encourage SCI entities to actively build and improve upon
the compliance of their systems rather than limit their compliance to
bright-line tests or the fixed elements of a safe harbor, and encourage
the evolution of sound practices over time. In addition, the Commission
notes that there currently are no publicly available written industry
standards regarding systems compliance that are applicable to all SCI
entities that can serve as the basis for a clear, objective safe
harbor, as there is with current SCI industry standards (e.g., the
publications listed in staff guidance) relating to operational
capability. Even if such standards existed, the Commission believes
that the specificity necessary to achieve the goal of a clear,
objective safe harbor would disincentivize SCI entities from continuing
to improve their systems over time. Finally, the Commission believes
that, because the minimum elements specified in Rule 1001(b)(2) are
non-exhaustive, Rule 1001(b) can accommodate the possibility that, as
technology evolves, additional or updated elements could become
appropriate for SCI entities to include in their systems compliance
policies and procedures to ensure that such policies and procedures
remain reasonably designed on an ongoing basis.
iii. Response to Other Comments on the SCI Entity Safe Harbor
    With respect to commenters who requested clarification on the
protection of the safe harbor for inadvertent violations of other laws
and rules despite compliance with Regulation SCI,\669\ as noted above,
the Commission clarifies that liability under Regulation SCI is
separate and distinct from liability for other violations that may
arise from the underlying SCI events under other laws and rules.
Specifically, Regulation SCI imposes new requirements on SCI entities
and is not intended to alter the standards for determining liability
under other laws or rules. Therefore, if an SCI entity is in compliance
with Regulation SCI but inadvertently violates another law or rule,
whether or not the SCI entity will be liable under the other law or
rule depends on the standards for determining liability under such law
or rule. Because the new requirements under Regulation SCI are separate
and distinct from existing requirements under other laws or rules,
Regulation SCI is not a shield from liability under such laws or rules.
---------------------------------------------------------------------------

    \669\ See supra notes 655 and 660 and accompanying text.
---------------------------------------------------------------------------

    The Commission also does not believe that it would be appropriate
to provide a safe harbor for all problems that are self-reported by SCI
entities and individuals or that are discovered and remediated without
regulatory intervention, as suggested by commenters.\670\ In
particular, Rule 1001(b) is intended to help ensure that SCI entities
operate their systems in compliance with the Exchange Act and relevant
rules in the first place, and thus is not only focused on helping to
ensure that SCI entities appropriately respond to a compliance issue
(e.g., by taking corrective action or reporting the issue to the
Commission) after it has occurred and impacted the market or market
participants. Therefore, the Commission does not believe that the
suggested self-report or remediation safe harbors will effectively
further this intent of Rule 1001(b). In particular, the Commission
notes that reporting and remediation of SCI events are separately
required under Rules 1002(b) and (a) of Regulation SCI, respectively.
The purposes of Rule 1002(b) include keeping the Commission informed of
SCI events after they have occurred. Moreover, Rule 1002(a) is intended
to ensure that SCI entities remedy a systems issue and mitigate the
resulting harm after the issue has already occurred. The Commission
believes that, if an SCI entity is protected from liability under Rule
1001(b) simply because it self-reported systems compliance issues or
discovered and remediated systems compliance issues without regulatory
intervention, the SCI entity will not be effectively incentivized to
have reasonably designed policies and procedures to ensure systems
compliance in the first place. As discussed above, the occurrence of an
SCI event will not necessarily cause a violation of Regulation SCI.
Further, the occurrence of a systems compliance issue also does not
necessarily mean that the SCI entity will be subject to an enforcement
action. Rather, the Commission will exercise its discretion to initiate
an enforcement action if the Commission determines that action is
warranted, based on the particular facts and circumstances of an
individual situation.
---------------------------------------------------------------------------

    \670\ See supra notes 657 and 659 and accompanying text.
---------------------------------------------------------------------------

    As discussed above, some commenters expressed concern that the
occurrence of a significant systems issue would mean that an SCI entity
did not have reasonable policies and procedures and therefore suggested
``objective'' safe harbors.\671\ The Commission notes that all SCI
entities are required to comply with the Exchange Act, the rules and
regulations thereunder, and their own rules and governing documents, as
applicable, and the purpose of Rule 1001(b) is to effectively help
ensure compliance of the operation of SCI systems with these laws and
rules. The Commission does not believe that Rule 1001(b) would further
this goal to the same degree if the Commission were to adopt
commenters' safe harbor suggestions (i.e., an SCI entity is deemed to
be in compliance with Rule 1001(b) so long as: The SCI entity is not
knowingly out of compliance; such non-compliance is not intentional,
reckless, or in bad faith; or there is no pattern of non-compliance)
because, with these suggested ``objective'' safe harbors, SCI entities
may not be effectively incentivized to establish, maintain, and enforce
reasonably designed policies and procedures to ensure systems
compliance. Moreover, the Commission notes that Rule 1001(b) requires
``reasonably designed'' policies and procedures, which already provides
flexibility to SCI entities in complying with the rule. The Commission
also emphasizes again that, while it is eliminating the safe harbor for
SCI entities, the occurrence of a systems compliance issue may be
probative, but is not determinative, of whether an SCI entity violated
Regulation SCI. As noted above, an SCI entity would not be

deemed to be in violation of Rule 1001(b)(1) merely because it
experienced a systems compliance issue. Further, the occurrence of a
systems compliance issue also does not necessarily mean that the SCI
entity will be subject to an enforcement action. Rather, the Commission
will exercise its discretion to initiate an enforcement action if the
Commission determines that action is warranted, based on the particular
facts and circumstances of an individual situation.
---------------------------------------------------------------------------

    \671\ See supra notes 650-654 and accompanying text. As
discussed above, some of these commenters suggested that the safe
harbor should protect SCI entities from enforcement action except in
cases of intentional or reckless non-compliance, or patterns of non-
compliance with Regulation SCI. See supra note 650 and accompanying
text. As an alternative to the intentional and recklessness
standard, one of these commenters requested that the Commission
specifically state that the Commission will not pursue enforcement
actions against SCI entities that establish, maintain, and enforce
systems compliance policies and procedures or act in good faith,
notwithstanding a violation of Regulation SCI. See supra note 651
and accompanying text. One commenter noted that it should be
sufficient for an SCI entity to qualify for the safe harbor if it
adopts policies and procedures reasonably designed to comply with
Regulation SCI and does not knowingly violate such policies and
procedures. See supra note 654 and accompanying text.
---------------------------------------------------------------------------

    Further, as noted above, one commenter recommended that the
Commission provide a safe harbor where no technology error or problem
has occurred, but the policies and procedures might benefit from
improvements.\672\ The Commission believes that there may be instances
where an SCI entity's policies and procedures might benefit from
improvement, even though they are reasonably designed. In such
instances, the SCI entity is in compliance with Rule 1001(b) and
therefore does not need a safe harbor. At the same time, the Commission
notes that there may be instances where no technology error or problem
has occurred, but an SCI entity's policies and procedures with regard
to systems compliance might nonetheless be deficient and not satisfy
the requirements of Rule 1001(b). The Commission does not believe that
it would be appropriate to provide a safe harbor in these instances. As
noted above, Rule 1001(b) is intended to help ensure that SCI entities
operate their SCI systems in compliance with the Exchange Act and
relevant rules. The Commission does not believe that a safe harbor that
effectively insulates deficient policies and procedures will further
the intent of this rule. Further, the Commission notes that one
requirement of Rule 1001(b)(1) is that an SCI entity ``maintain'' its
policies and procedures. To explicitly set forth an SCI entity's
obligation to review and update its policies and procedures, similar to
Rule 1001(a), the Commission is adopting a requirement for periodic
review by an SCI entity of the effectiveness of its systems compliance
policies and procedures, and prompt action by the SCI entity to remedy
deficiencies in such policies and procedures.\673\ The Commission notes
that an SCI entity will not be found to be in violation of this
maintenance requirement solely because it failed to identify a
deficiency immediately after the deficiency occurred, if the SCI entity
takes prompt action to remedy the deficiency once it is discovered, and
the SCI entity had otherwise appropriately reviewed the effectiveness
of its policies and procedures and took prompt action to remedy those
deficiencies that were discovered.
---------------------------------------------------------------------------

    \672\ See supra note 659 and accompanying text.
    \673\ See Rule 1001(b)(3). The adoption of this review and
update requirement is consistent with the views of some commenters.
See supra notes 620 and accompanying text (discussing a commenter's
suggestion that policies and procedures should be reviewed and
updated as part of the annual SCI review process) and 658 and
accompanying text (discussing a commenter's suggestion that
Regulation SCI should encourage parties to discover and remediate
deficiencies in policies and procedures). The Commission notes that
Rule 1001(b)(3) requires SCI entities to review and update their
systems compliance policies and procedures rather than simply
``encourage'' the discovery and remediation of deficiencies because,
in order to achieve the intended benefits of Rule 1001(b), an SCI
entity's systems compliance policies and procedures must remain
reasonably designed. If the Commission simply encourages SCI
entities to review and update their systems compliance policies and
procedures, the Commission believes that there would be a greater
likelihood that such policies and procedures might become outdated
and less effective in preventing systems compliance issues.
---------------------------------------------------------------------------

    Finally, as noted above, one commenter believed that, without a
safe harbor and a guarantee of immunity (such as the regulatory
immunity of SROs), information provided to the Commission pursuant to
Rule 1000(b)(4)(iv) would provide a roadmap for litigation. As
discussed below in Section IV.B.3.c, the Commission acknowledges that,
if an SCI entity experiences an SCI event, it could become the subject
of litigation (including private civil litigation). At the same time,
the Commission notes that the information submitted to the Commission
pursuant to Regulation SCI will be treated as confidential, subject to
applicable law.\674\ On the other hand, the Commission acknowledges
that it could consider the information provided to the Commission
pursuant to Rule 1002(b) in determining whether to initiate an
enforcement action. The Commission notes that all SCI entities are
required to comply with the Exchange Act, the rules and regulations