Proposed Rule 1000(b)(5)(ii) would provide a limited exception to
the proposed requirement of prompt dissemination to members or
participants of information regarding dissemination SCI events for
systems intrusion. Proposed Rule 1000(b)(5)(ii) would require an SCI
entity, promptly after any responsible SCI personnel becomes aware of a
systems intrusion, to disseminate to its members or participants a
summary description of the systems intrusion, including a description
of the corrective action taken by the SCI entity and when the systems
intrusion has been or is expected to be resolved, unless the SCI entity
determines that dissemination of such information would likely
compromise the security of the SCI entity's SCI systems or SCI security
systems, or an investigation of the systems intrusion, and documents
the reasons for such determination.
    Proposed Rule 1000(b)(6) would require an SCI entity, absent
exigent circumstances, to notify the Commission on Form SCI at least 30
calendar days before implementation of any planned material systems
change, including a description of the planned material systems change
as well as the expected dates of commencement and completion of
implementation of such change. If exigent circumstances exist, or if
the information previously provided to the Commission regarding any
material systems change has become materially inaccurate, an SCI entity
would instead be required to notify the Commission, either orally or in
writing on Form SCI, with any oral notification to be memorialized
within 24 hours after such oral notification by a written notification,
as early as reasonably practicable.\353\
---------------------------------------------------------------------------

    \353\ Form SCI would require an SCI entity to provide the date
of the planned change. The SCI entity must also specify whether
exigent circumstances exist, or if the information previously
provided to the Commission regarding any material systems change has
become materially inaccurate, and if so, whether the Commission has
been orally notified. Further, the notification must include an
Exhibit 4.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(7) would require an SCI entity to conduct an
SCI review of the entity's compliance with Regulation SCI not less than
once each calendar year, and to submit a report of the SCI review to
senior management of the SCI entity for review no more than 30 calendar
days after completion of such SCI review.
    Proposed Rule 1000(b)(8) contains two reporting requirements.
Specifically, proposed Rule 1000(b)(8) would require an SCI entity to
submit as an attachment to Form SCI: (i) A report of the SCI review
required by proposed Rule 1000(b)(7), together with any response by
senior management, within 60 calendar days after its submission to
senior management of the SCI entity; \354\ and (ii) a report within 30
calendar days after the end of June and December of each year,
containing a summary description of the progress of any material
systems change during the six-month period ending on June 30 or
December 31, as the case may be, and the date or expected date of
completion of implementation of such change.\355\
---------------------------------------------------------------------------

    \354\ This report would be required to be submitted as Exhibit 5
to Form SCI.
    \355\ This report would be required to be submitted as Exhibit 6
to Form SCI.
---------------------------------------------------------------------------

3. Requirements To Take Corrective Actions, Identify Immediate
Notification SCI Events, and Identify Dissemination SCI Events
    Proposed Rule 1000(b)(3) would require an SCI entity, upon any
responsible SCI personnel becoming aware of an SCI event, to begin to
take appropriate corrective action which would be required to include,
at a minimum, mitigating potential harm to investors and market
integrity resulting from the SCI event and devoting adequate resources
to remedy the SCI event as soon as reasonably practicable. Given these
requirements of proposed Rule 1000(b)(3), SCI entities would likely
work to develop a process for ensuring that they are prepared to comply
with the corrective action requirement and would likely also
periodically review this process.
    In addition, proposed Rule 1000(a) would define a ``dissemination
SCI event'' to mean an SCI event that is a: (1) Systems compliance
issue; (2) systems intrusion; or (3) systems disruption that results,
or the SCI entity reasonably estimates would result, in significant
harm or loss to market participants.
    Under the proposed Commission notification and member or
participant dissemination requirements of proposed Rules 1000(b)(4) and
(b)(5), when an SCI event occurs, an SCI entity must determine whether
an SCI event is an immediate notification SCI event or a dissemination
SCI event. As such, SCI entities would likely work to develop a process
for ensuring that they are able to make determinations regarding the
nature of the SCI event quickly and accurately, and periodically review
this process.
4. Recordkeeping Requirements
    Proposed Rule 1000(c) would set forth recordkeeping requirements
for SCI entities. Under proposed Rule 1000(c)(1), SCI SROs would be
required to make, keep, and preserve all documents relating to their
compliance with Regulation SCI as prescribed in Rule 17a-1 under the
Exchange Act. Under proposed Rule 1000(c)(2), each SCI entity that is
not an SCI SRO would be required to make, keep, and preserve at least
one copy of all documents, including correspondence, memoranda, papers,
books, notices, accounts, and other such records, relating to its
compliance with Regulation SCI including, but not limited to, records
relating to any changes to its SCI systems and SCI security systems,
for a period of not less than five years, the first two years in a
place that is readily accessible to the Commission or its
representatives for inspection and examination. Upon request of any
representative of the Commission, such SCI entities would be required
to promptly furnish to the possession of such representative copies of
any documents required to be kept and preserved by it under proposed
Rule 1000(c)(2). Under proposed Rule 1000(c)(3), upon or immediately
prior to ceasing to do business or ceasing to be registered under the
Exchange Act, an SCI entity must take all necessary action to ensure
that the records required to be made, kept, and preserved by this
section will be accessible to the Commission and its representatives in
the manner required by proposed Rule 1000(c) and for the remainder of
the period required by proposed Rule 1000(c).
    In addition, proposed Rule 1000(e) would provide that, if the
records required to be filed or kept by an SCI entity under proposed
Regulation SCI are prepared or maintained by a service bureau or other
recordkeeping service on behalf of the SCI entity, the SCI entity would
be required to ensure that the records are available for review by the
Commission and its representatives by submitting a written undertaking,
in a form acceptable to the Commission, by such service bureau or other
recordkeeping service and signed by a

duly authorized person at such service bureau or other recordkeeping
service.

B. Proposed Use of Information

1. Requirements To Establish Written Policies and Procedures and
Mandate Participation in Certain Testing
    The proposed requirements that SCI entities establish certain
written policies and procedures with respect to their systems, and that
they require designated members or participants to participate in the
testing of their business continuity and disaster recovery plans, would
further the goals of the national market system and reinforce Exchange
Act obligations by requiring entities important to the functioning of
the U.S. securities markets to carefully design, develop, test,
maintain, and surveil systems integral to their operations, and operate
them in compliance with relevant federal securities laws and the rules
and regulations thereunder, as well as their own rules and policies.
2. Notification, Dissemination, and Reporting Requirements for SCI
Entities
    The information that would be collected pursuant to the proposed
requirements for notifications, disseminations of information, and
reports would assist the Commission in its oversight of SCI entities
and the securities markets, help ensure the orderly operation of the
U.S. securities markets, and help protect investors and the public
interest. In particular, the proposed requirements that SCI entities
notify the Commission of all SCI events, disseminate information to
members or participants, undertake and submit to the Commission an SCI
review not less than once each calendar year, and submit reports of
material systems changes are designed to help ensure compliance with
the other provisions of proposed Regulation SCI and accountability of
SCI entities in the event of systems problems. Further, the Commission
preliminarily believes that the member or participant information
dissemination requirement for dissemination SCI events would make
members or participants aware that their trading activity might have
been or might be impacted by the occurrence of a dissemination SCI
event, so that they could consider that information in making trading
decisions, seeking corrective action, or pursuing remedies, among other
things. The Commission also preliminarily believes that the prospect of
disseminating information regarding dissemination SCI events to members
or participants would provide an incentive for SCI entities to better
focus on improving the integrity and compliance of their systems.
3. Requirements To Take Corrective Actions, Identify Immediate
Notification Events, and Identify Dissemination SCI Events
    The proposed requirement that SCI entities begin to take
appropriate corrective action upon any responsible SCI personnel
becoming aware of an SCI event would help ensure that SCI entities
dedicate adequate resources to timely address an SCI event and place an
emphasis on mitigating potential harm to investors and market
integrity. The proposed threshold for notification of certain SCI
events to the Commission under proposed Rule 1000(b)(4)(i) would help
ensure that the Commission is made aware of significant SCI events when
any responsible SCI personnel becomes aware of such events. The
proposed definition of dissemination SCI event would help ensure
potentially impacted members or participants have basic information
about SCI events so that they might be able to better assess whether
they should use the services of an SCI entity.\356\
---------------------------------------------------------------------------

    \356\ See infra Section III.B.3.d (discussing the threshold for
dissemination SCI events).
---------------------------------------------------------------------------

5. Recordkeeping Requirements
    The proposed recordkeeping requirements in Rules 1000(c) and (e)
would assist Commission staff during an examination of an SCI entity to
assess its compliance with the proposed rules. In addition, access to
the records of SCI entities would help Commission staff to carry out
its oversight responsibilities of SCI entities and the securities
markets. Further, the proposed recordkeeping requirements would aid SCI
entities and the Commission in documenting, reviewing, and correcting
any SCI event, as well as in identifying market participants that may
have been harmed by such an event.

C. Respondents

    The ``collection of information'' requirements contained in
proposed Regulation SCI would apply to SCI entities, as described
below. Currently, there are 26 entities that would satisfy the proposed
definition of SCI SRO,\357\ 15 entities that would satisfy the proposed
definition of SCI ATS,\358\ 2 entities that would satisfy the
definition of plan processor,\359\ and 1 entity that would meet the
definition of exempt clearing agency subject to ARP.\360\ Accordingly,
the Commission estimates that there are currently 44 entities that
would meet the definition of SCI entity and be subject to the
collection of information requirements of proposed Regulation SCI.
---------------------------------------------------------------------------

    \357\ See supra notes 93-96 and accompanying text (listing 17
registered national securities exchanges, 7 registered clearing
agencies, FINRA, and the MSRB).
    \358\ See supra Section III.B.1.
    \359\ See supra note 565.
    \360\ See supra note 133 and accompanying text.
---------------------------------------------------------------------------

    The Commission requests comment on the accuracy of these estimated
figures.

D. Total Initial and Annual Reporting and Recordkeeping Burdens

    As discussed above, all of the national securities exchanges,
national securities associations, registered clearing agencies, and
plan processors currently participate on a voluntary basis in the ARP
Inspection Program.\361\ Under the ARP Inspection Program, Commission
staff conducts on-site inspections and attends periodic technology
briefings by staff of these entities, generally covering systems
capacity and testing, review of systems vulnerability, review of
planned systems development, and business continuity planning.\362\ In
addition, Commission staff monitors systems failures and planned major
systems changes at these entities.\363\
---------------------------------------------------------------------------

    \361\ See supra Section I.A.
    \362\ See id.
    \363\ See id.
---------------------------------------------------------------------------

    Under proposed Regulation SCI, many of the principles of the ARP
policy statements with which SCI SROs are familiar would be codified.
However, because the proposed regulation would have a broader scope
than the current ARP Inspection Program and would impose mandatory
recordkeeping obligations on entities subject to the rules,\364\
proposed Regulation SCI would impose paperwork burdens on all SCI
entities. The Commission's total burden estimates reflect the total
burdens on all SCI entities, taking into account the extent to which
some SCI entities already comply with some of the proposed requirements
of Regulation SCI. As discussed below, the Commission preliminarily
believes that the extent of these burdens will vary for different types
of SCI entities. The Commission notes that the hour figures set forth
in this section are the Commission's preliminary best estimate of the
paperwork burden for compliance with proposed Regulation SCI based on a
variety of sources, including the

Commission's experience with the current ARP Inspection Program and
other similar estimated burdens for analogous rulemakings. However, the
Commission recognizes that commenters may have other informed views of
the actual burdens that would be imposed by these requirements and
thus, the Commission solicits comment on the appropriateness and
accuracy of each of the estimated burdens below.
---------------------------------------------------------------------------

    \364\ As discussed more fully in supra Section III.D and infra
Section IV.D.4, SCI SROs are already subject to existing
recordkeeping and retention requirements under Rule 17a-1 and thus
the Commission believes that the proposed recordkeeping obligations
would not impose any new burden on SCI SROs that is not already
accounted for in the burden estimates for Rule 17a-1.
---------------------------------------------------------------------------

1. Requirements To Establish Written Policies and Procedures and
Mandate Participation in Certain Testing
    The proposed rules that would require an SCI entity to establish
policies and procedures and to mandate member or participant
participation in business continuity and disaster recovery plans
testing are discussed more fully in Section III.C above.
a. Policies and Procedures Required by Proposed Rule 1000(b)(1)
    The Commission preliminarily estimates that an SCI entity that has
not previously participated in the ARP Inspection Program would require
an average of 210 burden hours to develop and draft policies and
procedures reasonably designed to ensure that its SCI systems and, for
purposes of security standards, SCI security systems, have levels of
capacity, integrity, resiliency, availability, and security adequate to
maintain the SCI entity's operational capability and promote the
maintenance of fair and orderly markets, as proposed to be required by
Rule 1000(b)(1) of Regulation SCI (except for policies and procedures
for standards that result in such systems being designed, developed,
tested, maintained, operated, and surveilled in a manner that
facilitates the successful collection, processing, and dissemination of
market data, which are addressed separately).\365\ The estimated 210
hours required for such entities would include the time expended to
draft relevant policies and procedures and the time expended for review
of the draft policies and procedures by the SCI entity's management.
The Commission preliminarily believes that all SCI entities \366\ would
conduct this work internally.\367\
---------------------------------------------------------------------------

    \365\ This estimate is based on the Commission's experience with
the ARP Inspection Program and its preliminary estimate in the SB
SDR Proposing Release for a similar requirement. See SB SDR
Proposing Release, supra note 297, at 77349 (estimating the number
of hours it would take to draft policies and procedures reasonably
designed to ensure that the SDR's systems provide adequate levels of
capacity, resiliency, and security). This estimate is for the number
of hours an SCI entity would require over and above the usual and
customary amount of time it would devote to developing policies and
procedures designed to ensure its systems' capacity, integrity,
resiliency, availability, and security. These estimated burdens may
vary depending on an SCI entity's business and regulatory
responsibilities.
    \366\ The Commission estimates that there are 44 SCI entities.
Of these, 29 entities currently participate in the ARP Inspection
Program and 15 do not. Because the MSRB is not currently a
participant in the ARP Inspection Program, the estimated burden
hours for the MSRB to develop policies and procedures as required by
proposed Rule 1000(b)(1) (except for policies and procedures for
standards that result in such systems being designed, developed,
tested, maintained, operated, and surveilled in a manner that
facilitates the successful collection, processing, and dissemination
of market data) is 210 hours, which is higher than the number
estimated for all other SCI SROs that currently participate in the
ARP Inspection Program, as discussed below.
    \367\ But see infra Section IV.D.6, requesting comment on
whether some SCI entities, particularly those that do not currently
participate in the ARP Inspection Program, would seek to outsource
this work and what the cost to outsource this work would be.
---------------------------------------------------------------------------

    For SCI entities that currently participate in the ARP Inspection
Program (29 entities, nearly all of which are SCI SROs \368\), the
Commission preliminarily believes that in developing their policies and
procedures, these entities would be starting from a baseline of fifty
percent, and therefore the average paperwork burden of developing the
proposed policies and procedures would be 105 burden hours.\369\ The
Commission preliminarily believes that a fifty percent baseline for SCI
entities that participate in the ARP Inspection Program is appropriate
because, although these entities already have substantial policies and
procedures in place, proposed Rule 1000(b)(1) would require these
entities to devote substantial time to reviewing and revising their
existing policies and procedures to ensure that they are sufficiently
robust in the context of a new and expanded regulatory regime. The
Commission preliminarily believes that these entities would conduct
this work internally.\370\
---------------------------------------------------------------------------

    \368\ 17 registered national securities exchanges + 7 registered
clearing agencies + 1 national securities association + 2 plan
processors + 1 exempt clearing agency subject to ARP + 1 ATS = 29
entities.
    \369\ In establishing this baseline estimate, the Commission has
considered what the entities do today; that is, in the absence of
the proposed rule.
    \370\ But see infra Section IV.D.6, requesting comment on
whether some SCI entities, particularly those that do not currently
participate in the ARP Inspection Program, would seek to outsource
this work and what the cost to outsource this work would be.
---------------------------------------------------------------------------

    With regard to the proposed requirement in Rule 1000(b)(1) that an
SCI entity's policies and procedures include standards that result in
such systems being designed, developed, tested, maintained, operated,
and surveilled in a manner that facilitates the successful collection,
processing, and dissemination of market data, the Commission
preliminarily estimates that each SCI entity would spend an average of
130 hours annually to comply with this requirement.\371\ As this
proposed requirement is not currently addressed by the ARP Inspection
Program, the Commission preliminarily estimates that the total initial
and ongoing burden would be the same for all SCI entities and SCI
entities would conduct this work internally.\372\
---------------------------------------------------------------------------

    \371\ This estimate is based on the Commission's experience with
the ARP Inspection Program, and includes the time necessary to
program systems to meet the proposed standard.
    \372\ But see infra Section IV.D.6, requesting comment on
whether some SCI entities, particularly those that do not currently
participate in the ARP Inspection Program, would seek to outsource
this work and what the cost to outsource this work would be.
---------------------------------------------------------------------------

    As noted above, the Commission preliminarily believes that SCI
entities would handle internally most of the work associated with
establishing, maintaining, and enforcing written policies and
procedures as proposed to be required by Rule 1000(b)(1). However,
based on its experience with the ARP Inspection Program, the Commission
preliminarily believes that SCI entities also would seek outside legal
and/or consulting services in the initial preparation of such policies
and procedures, and that the average cost of such outside legal and/or
consulting advice would be $20,000 per respondent,\373\ for a total of
$880,000 for all respondents.\374\
---------------------------------------------------------------------------

    \373\ This estimate is based on the Commission's experience with
the ARP Inspection Program, as well as industry sources. In
addition, the Commission has considered its estimate of the cost
burden under Regulation SDR in connection with the establishment of
certain policies and procedures. See SB SDR Proposing Release, supra
note 297, at 77349 (preliminarily estimating that it would cost
$100,000 to establish, maintain, and enforce five sets of written
policies and procedures, one of which requires policies and
procedures reasonably designed to ensure that the SDR's systems
provide adequate levels of capacity, resiliency, and security).
    \374\ ($20,000 outside legal cost) x (44 SCI entities) =
$880,000.
---------------------------------------------------------------------------

    As noted above, the Commission preliminarily estimates that the
average initial number of burden hours per respondent to comply with
proposed Rule 1000(b)(1) (except for policies and procedures for
standards that result in such systems being designed, developed,
tested, maintained, operated, and surveilled in a manner that
facilitates the successful collection, processing, and dissemination of
market data) would be 105 hours for SCI entities that are current ARP
Inspection Program participants and 210 hours for SCI entities that are
not current ARP

Inspection Program participants, for a total of 6,195 hours.\375\ In
addition, the Commission preliminarily estimates that the average
initial number of burden hours per respondent to comply with the
requirement for policies and procedures for standards that result in
such systems being designed, developed, tested, maintained, operated,
and surveilled in a manner that facilitates the successful collection,
processing, and dissemination of market data would be 130 hours for a
total of 5,720 hours for all respondents.\376\
---------------------------------------------------------------------------

    \375\ The Commission preliminarily believes that an Attorney and
a Compliance Manager working in collaboration would develop and
draft the required policies and procedures, assisted by, and in
consultation with, Senior Systems Analysts and Operational
Specialists. Thus, the Commission estimates: (Compliance Manager
(including Senior Management Review) at 80 hours + Attorney at 80
hours + Senior Systems Analyst at 25 hours + Operations Specialist
at 25 hours) x (15 potential respondents) + (Compliance Manager
(including Senior Management Review) at 40 hours + Attorney at 40
hours + Senior Systems Analyst at 12.5 hours + Operations Specialist
at 12.5 hours) x (29 potential respondents) = 6,195 burden hours.
    \376\ Based on its experience with the ARP Inspection Program,
the Commission estimates: (Compliance Attorney at 30 hours + Senior
Systems Analyst at 100 hours) x (44 potential respondents) = 5,720
burden hours.
---------------------------------------------------------------------------

    The Commission preliminarily estimates that, once an SCI entity has
drafted the policies and procedures proposed to be required by Rule
1000(b)(1) (except for policies and procedures for standards that
result in such systems being designed, developed, tested, maintained,
operated, and surveilled in a manner that facilitates the successful
collection, processing, and dissemination of market data), it would
spend on average approximately 60 hours annually to review its written
policies and procedures to ensure that they are up-to-date and to
prepare any necessary new or amended policies and procedures.\377\
Using a fifty percent baseline for SCI entities that participate in the
ARP Inspection Program and therefore currently review and revise
policies and procedures from time to time, the Commission preliminarily
estimates that the total annual ongoing burden to comply with proposed
Rule 1000(b)(1) (except for policies and procedures for standards that
result in such systems being designed, developed, tested, maintained,
operated, and surveilled in a manner that facilitates the successful
collection, processing, and dissemination of market data) would be 30
hours per respondent for this group of respondents. The Commission
therefore estimates the ongoing burden to comply with proposed Rule
1000(b)(1) (except for policies and procedures for standards that
result in such systems being designed, developed, tested, maintained,
operated, and surveilled in a manner that facilitates the successful
collection, processing, and dissemination of market data) to be 870
hours \378\ for SCI entities that are current ARP Inspection Program
participants and 900 hours \379\ for SCI entities that are not ARP
Inspection Program participants, for a total of 1,770 hours for all
respondents.\380\ As noted above, the Commission preliminarily
estimates that the average ongoing number of burden hours per
respondent to comply with the proposed requirement for policies and
procedures for standards that result in such systems being designed,
developed, tested, maintained, operated, and surveilled in a manner
that facilitates the successful collection, processing, and
dissemination of market data would be 130 hours for each respondent,
for a total of 5,720 hours for all respondents.\381\ The Commission
preliminarily believes that the work associated with updating the
policies and procedures proposed to be required by proposed Rule
1000(b)(1) would be done internally.\382\
---------------------------------------------------------------------------

    \377\ This estimate is based on the Commission's experience with
the ARP Inspection Program. The Commission has also considered its
preliminary estimate in the SB SDR Proposing Release for a similar
requirement. See SB SDR Proposing Release, supra note 297, at 77349
(estimating the ongoing burden associated with maintaining policies
and procedures reasonably designed to ensure that the SDR's systems
provide adequate levels of capacity, resiliency, and security). This
estimate is for the number of hours an SCI entity would require over
and above the usual and customary amount of time it would devote to
maintaining policies and procedures designed to ensure its systems'
capacity, integrity, resiliency, availability, and security.
    \378\ (Compliance Manager at 15 hours + Attorney at 15 hours) x
(29 potential respondents currently participating in the ARP
Inspection Program) = 870 hours.
    \379\ (Compliance Manager at 30 hours + Attorney at 30 hours) x
(15 potential respondents not currently participating in the ARP
inspection Program) = 900 hours.
    \380\ 870 hours for SCI entities that are current ARP Inspection
Program participants + 900 hours for SCI entities that are not
current ARP Inspection Program participants = 1,770 burden hours.
    \381\ (Compliance Attorney at 30 hours + Senior Systems Analyst
at 100 hours) x (44 potential respondents) = 5,720 burden hours.
    \382\ But see infra Section IV.D.6, requesting comment on
whether some SCI entities, particularly those that do not currently
participate in the ARP Inspection Program, would seek to outsource
this work and what the cost to outsource this work would be.
---------------------------------------------------------------------------

b. Policies and Procedures Required by Proposed Rule 1000(b)(2)
    With regard to proposed Rule 1000(b)(2)(i), which would require
each SCI entity to establish, maintain, and enforce written policies
and procedures reasonably designed to ensure that its SCI systems
operate in the manner intended, including in a manner that complies
with the federal securities laws and rules and regulations thereunder
and, as applicable, the entity's rules and governing documents, the
Commission preliminarily believes that each SCI entity would elect to
comply with the safe harbor provisions in proposed Rules 1000(b)(2)(ii)
and (iii), and preliminarily estimates that each SCI entity would
initially spend approximately 180 hours to design their policies and
procedures accordingly. This estimate would include the time necessary
to review and revise any existing policies and procedures to ensure
that they satisfy the proposed safe harbor provisions, and the
Commission preliminarily believes this estimate would be the same for
all SCI entities.\383\ Therefore, the Commission preliminarily
estimates that proposed Rule 1000(b)(2) would carry an initial one-time
burden of 180 hours per respondent, for a total initial one-time burden
of 7,920 hours for all respondents.\384\ The Commission also
preliminarily estimates that each SCI entity that is an SRO would spend
approximately 120 hours annually to review these written policies and
procedures to ensure that they are up-to-date and to prepare any
necessary new or amended policies and procedures, and that other types
of SCI entities would spend approximately 60 hours to do this
work.\385\ Therefore, the

Commission preliminarily estimates that proposed Rule 1000(b)(2) would
carry an ongoing annual burden of 120 hours per SRO respondent and 60
hours per non-SRO respondent, for a total ongoing annual burden of
4,200 hours for all respondents.\386\ These estimated burdens per
respondent also would include the time expended for the review of the
draft policies and procedures by the SCI entity's management.
---------------------------------------------------------------------------

    \383\ This estimate is based on the Commission's experience with
the ARP Inspection Program and OCIE examinations, which review
policies and procedures of registered entities in conjunction with
examinations of such entities for compliance with the federal
securities laws. Although not currently explicitly required under
the existing ARP Inspection Program or other laws or regulations,
the Commission expects that most, if not all, SCI entities already
voluntarily have certain policies and procedures in place as part of
good business management and oversight to ensure that their SCI
systems operate in the manner intended. However, proposed Rule
1000(b)(2)(i) would set forth specific new requirements with respect
to such policies and procedures, and proposed Rules 1000(b)(2)(ii)
and (iii) would specify how an SCI entity and its employees could
satisfy the new requirement through safe harbors. Because proposed
Rule 1000(b)(2)(i) has no analogue in the ARP Inspection Program and
would create a new requirement for all SCI entities, for purposes of
the PRA, the Commission preliminarily estimates that all SCI
entities would elect to comply with the proposed safe harbor of
proposed Rule 1000(b)(2)(ii) and be subject to the same initial
burden to ensure that their policies and procedures satisfy the
requirements of the proposed safe harbor.
    \384\ Based on its experience with OCIE examinations and the ARP
Inspection Program, the Commission estimates: (Compliance Attorney
at 30 hours + Senior Systems Analyst at 150 hours) x (44 potential
respondents) = 7,920 burden hours.
    \385\ These estimates are based on the Commission's experience
with the ARP Inspection Program and OCIE examinations. The
Commission notes that its estimate of 120 hours for SCI SROs to
annually review and update the written policies and procedures
proposed to be required by Rule 1000(b)(2)(i), to satisfy the
elements of the safe harbor provisions in proposed Rules
1000(b)(2)(ii) and (iii), is higher than its estimate for SCI SROs
to review and update the policies and procedures proposed to be
required by Rule 1000(b)(1) and its estimate for SCI entities that
are not SCI SROs to review and update the policies and procedures
proposed to be required by Rule 1000(b)(2)(i), to satisfy the
elements of the safe harbor provisions in proposed Rules
1000(b)(2)(ii) and (iii). This higher estimate is based on the
Commission's preliminary belief that the burden for SCI SROs would
be greater because the rules of such entities generally change their
rules with greater frequency. The Commission solicits comment on the
accuracy of this information.
    \386\ Based on its experience with OCIE examinations and the ARP
Inspection Program, the Commission estimates: (Compliance Attorney
at 20 hours + Senior Systems Analyst at 100 hours) x (26 potential
SCI SRO respondents) + (Compliance Attorney at 10 hours + Senior
Systems Analyst at 50 hours) x (18 potential non-SCI SRO
respondents) = 4,200 burden hours.
---------------------------------------------------------------------------

    As with proposed Rule 1000(b)(1), the Commission preliminarily
believes that SCI entities would handle internally most of the work
associated with establishing and maintaining written policies and
procedures that are reasonably designed to ensure that their SCI
systems operate in the manner intended, including in a manner that
complies with the federal securities laws and rules and regulations
thereunder and, as applicable, the entity's rules and governing
documents, and that meet the requirements of the proposed safe harbor
provisions of proposed Rule 1000(b)(2)(ii).\387\ However, based on its
experience with the ARP Inspection Program, the Commission
preliminarily believes that SCI entities also would seek outside legal
and/or consulting advice in the initial preparation of such policies
and procedures, and that the average cost of outside legal/consulting
advice would be $20,000 per respondent, for a total of $880,000 for all
respondents.\388\
---------------------------------------------------------------------------

    \387\ But see infra Section IV.D.6, requesting comment on
whether some SCI entities, particularly those that do not currently
participate in the ARP Inspection Program, would seek to outsource
this work and what the cost to outsource this work would be.
    \388\ ($20,000 outside legal cost) x (44 entities) = $880,000.
---------------------------------------------------------------------------

c. Mandate Participation in Certain Testing
    Proposed Rule 1000(b)(9) would require each SCI entity, with
respect to its business continuity and disaster recovery plans,
including its backup systems, to require participation by designated
members or participants in scheduled functional and performance testing
of the operation of such plans at specified intervals, and coordinate
such testing on an industry- or sector-wide basis with other SCI
entities. The Commission preliminarily believes that all SCI entities
would be subject to this proposed requirement, and that none of these
entities currently require participation by members or participants in
scheduled functional and performance testing of their business
continuity and disaster recovery plans, as proposed Rule 1000(b)(9)
would have them require.
    Although SCI entities may seek to implement the proposed
requirements in different ways (e.g., for SCI SROs, by submitting
proposed rule changes under Section 19(b) of the Exchange Act; for SCI
ATSs, by revising membership or subscriber agreements and internal
procedures; for plan processors, through an amendment to an SCI Plan
under Rule 608 of Regulation NMS; and, for exempt clearing agencies
subject to ARP, by revising participant agreements and internal
procedures), the Commission preliminarily believes that the average
paperwork burden associated with the proposed rule would be the same
for all SCI entities because they would likely make similar changes to
their rules, agreements, procedures, or SCI Plans, and would likely
take similar actions to implement and coordinate mandatory testing.
Based on its experience with SCI entities, the Commission preliminarily
believes that SCI entities, other than plan processors, would handle
this work internally.
    The Commission preliminarily estimates that each SCI entity (other
than plan processors) would spend approximately 130 hours initially to
meet the requirements of proposed Rules 1000(b)(9)(i) and (ii). This
estimate takes into consideration the requirement to mandate
participation by designated members or participants in testing under
proposed Rule 1000(b)(9)(i), as well as the requirement under proposed
Rule 1000(b)(9)(ii) that an SCI entity coordinate required testing with
other SCI entities. Specifically, the estimated 130 hours assumes that
it would take an SCI entity 35 hours to write a proposed rule, or
revise a membership/subscriber agreement or participant agreement, as
the case may be, to establish the participation requirement for the SCI
entity's designated members or participants,\389\ and an additional 95
hours of follow-up work (e.g., notice and schedule coordination) to
ensure implementation. Therefore, the Commission preliminarily
estimates that proposed Rules 1000(b)(9)(i) and (ii) would carry an
initial burden of 130 hours per respondent, for a total initial burden
of 5,460 hours for all respondents.\390\ For plan processors, the
Commission preliminarily estimates that proposed Rules 1000(b)(9)(i)
and (ii) would carry an initial cost of $52,000 per respondent,\391\
for a total initial cost of $104,000 hours for all plan
processors.\392\
---------------------------------------------------------------------------

    \389\ In establishing this estimate, the Commission considered
its estimate of the burden for an SRO to file an average proposed
rule change. See 2012 Rule 19b-4 collection of information revision
Supporting Statement, Office of Management and Budget, available at:
http://www.reginfo.gov/public/do/PRAViewDocument?ref_nbr=201207-3235-002.
    \390\ Based on Commission staff experience in reviewing SRO
proposed rule change filings and past estimates for Rule 19b-4 and
Form 19b-4, the Commission estimates as follows: (Compliance Manager
at 10 hours + Attorney at 15 hours + Compliance Clerk at 10 hours) x
(42 potential respondents) + (Compliance Manager at 10 hours +
Attorney at 15 hours + Operations Specialist at 70 hours) x (42
potential respondents) = 5,460 hours to comply with proposed Rules
1000(b)(9)(i) and (ii).
    \391\ 130 hours x $400 per hour for outside legal services =
$52,000. See infra note 463.
    \392\ $52,000 x 2 plan processors = $104,000.
---------------------------------------------------------------------------

    The Commission also preliminarily estimates that each SCI entity
(other than plan processors) would spend approximately 95 hours
annually to review the written rules or requirements to ensure that
they remain up-to-date and to prepare any necessary amendments and
undertake necessary coordination to ensure implementation and
enforcement of the requirement.\393\ Therefore, the Commission
preliminarily estimates that proposed Rules 1000(b)(9)(i) and (ii)
would carry an ongoing annual burden of 95 hours per respondent, for a
total ongoing annual burden of 3,990 hours for all respondents.\394\
For plan processors, the Commission preliminarily estimates that
proposed Rules 1000(b)(9)(i) and (ii) would carry an ongoing annual
cost of $38,000 hours per respondent,\395\ for

a total ongoing annual cost of $76,000 for all plan processors.\396\
---------------------------------------------------------------------------

    \393\ As noted above, the initial burden includes 35 hours to
write a proposed rule, revise an agreement, or amend an SCI Plan.
The Commission does not believe this 35-hour burden would be
applicable on an ongoing basis.
    \394\ (Compliance Manager at 10 hours + Attorney at 15 hours +
Operations Specialist at 70 hours) x (42 potential respondents) =
3,990 hours. See supra note 390.
    \395\ 95 hours x $400 per hour for outside legal services =
$38,000. See infra note 463.
    \396\ $38,000 x 2 plan processors = $76,000.
---------------------------------------------------------------------------

    The Commission preliminarily estimates that each SCI entity (other
than plan processors) would spend approximately 35 hours initially to
meet the requirements of proposed Rule 1000(b)(9)(iii). This estimate
takes into consideration the burden for an SCI entity to establish
standards for designating members or participants who must participate
in its business continuity and disaster recovery plans testing and file
such standards with the Commission on Form SCI, as well as the burden
for an SCI entity to determine, compile, and submit its list of
designated members or participants on Form SCI. Specifically, the
Commission estimates that each SCI entity would take 35 hours to write
a proposed rule or an internal procedure, as the case may be, to
establish standards for designating members or participants, to apply
the standards to compile the list of designees, and to file such
standards and the list of designees on Form SCI.\397\ Therefore, the
Commission preliminarily estimates that proposed Rule 1000(b)(9)(iii)
would carry an initial burden of 35 hours per respondent, for a total
initial burden of 1,470 hours for all respondents.\398\ For plan
processors, the Commission preliminarily estimates that proposed Rule
1000(b)(9)(iii) would carry an initial cost of $14,000 per
respondent,\399\ for a total initial cost of $28,000 hours for all plan
processors.\400\
---------------------------------------------------------------------------

    \397\ In establishing this estimate, the Commission considered
its estimate of the burden for an SRO to file an average proposed
rule change. See 2012 Rule 19b-4 collection of information revision
Supporting Statement, Office of Management and Budget, available at:
http://www.reginfo.gov/public/do/PRAViewDocument?ref_nbr=201207-3235-002.
    \398\ Based on Commission staff experience in reviewing SRO
proposed rule change filings and past estimates for Rule 19b-4 and
Form 19b-4, the Commission estimates as follows: (Compliance Manager
at 10 hours + Attorney at 15 hours + Compliance Clerk at 10 hours) x
(42 potential respondents) = 1,470 hours to comply with Rule
1000(b)(9)(iii).
    \399\ 35 hours x $400 per hour for outside legal services =
$14,000. See infra note 463.
    \400\ $14,000 x 2 plan processors = $28,000.
---------------------------------------------------------------------------

    The Commission also preliminarily estimates that each SCI entity
(other than plan processors) would spend approximately 3 hours annually
to review the designation standards to ensure that they remain up-to-
date and to prepare any necessary amendments, to review its list of
designated members or participants, and to update prior Commission
notifications with respect to the standards for designation and the
list of designees.\401\ Therefore, the Commission preliminarily
estimates that proposed Rule 1000(b)(9)(iii) would carry an ongoing
annual burden of 3 hours per respondent, for a total ongoing annual
burden of 126 hours for all respondents.\402\ For plan processors, the
Commission preliminarily estimates that proposed Rule 1000(b)(9)(iii)
would carry an ongoing annual cost of $1,200 hours per respondent,\403\
for a total ongoing annual cost of $2,400 for all plan processors.\404\
---------------------------------------------------------------------------

    \401\ In establishing this estimate, the Commission has
considered its estimate of the burden for an SRO to amend a Form
19b-4. Specifically, the Commission estimated that an amendment to
Form 19b-4 would require approximately 3 hours to complete. See
Securities Exchange Act Release No. 50486 (October 4, 2004), 69 FR
60287, 60294 (October 8, 2004).
    \402\ (Compliance Manager at 1.5 hours + Attorney at 1.5 hours)
x (42 potential respondents) = 126 hours.
    \403\ 3 hours x $400 per hour for outside legal services =
$1,200. See infra note 463.
    \404\ $1,200 x 2 plan processors = $2,400.
---------------------------------------------------------------------------

2. Notice, Dissemination, and Reporting Requirements for SCI Entities
    The proposed rules that would require an SCI entity to notify the
Commission of SCI events, disseminate certain SCI events to members or
participants, and submit specified reports are discussed more fully in
Section III.C above.
a. Notices Required by Proposed Rule 1000(b)(4)
    Proposed Rule 1000(b)(4) would require notice of SCI events to the
Commission.\405\ The burden estimates to comply with proposed Rule
1000(b)(4) include the burdens associated with Commission notification
of immediate notification SCI events and the submission of Form SCI in
accordance with the instructions thereto.
---------------------------------------------------------------------------

    \405\ See supra note 351 and accompanying text for details
regarding the content of Form SCI. Currently, there is no law or
rule specifically requiring SCI entities to notify the Commission of
systems problems in writing or in a specific format. Nevertheless,
voluntary communications of systems problems to Commission staff
occur in a variety of ways, including by telephone and email. The
Commission notes that proposed Rule 1000(b)(4) would impose a new
reporting requirement on SCI entities, regardless of whether they
currently voluntarily notify the Commission of SCI events on an ad
hoc basis. As such, the Commission preliminarily believes that a
history of voluntarily reporting such events to the Commission would
not lessen the future burden of reporting such events to the
Commission on Form SCI as required under proposed Rule 1000(b)(4).
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(4)(i) would require an SCI entity, upon any
responsible SCI personnel becoming aware of a systems disruption that
the SCI entity reasonably estimates would have a material impact on its
operations or on market participants, any systems compliance issue, or
any systems intrusion, to notify the Commission of such SCI event. As
noted above, notification required by proposed Rule 1000(b)(4)(i) may
be done orally or in writing. The Commission preliminarily estimates
that each SCI entity would experience an average of 40 immediate
notification SCI events per year.\406\ The Commission further
preliminarily estimates that one-fourth of the notifications under
proposed Rule 1000(b)(4)(i) would be in writing (i.e., 10 written
notifications and 30 oral notifications), and that each written
notification would require an in-house attorney half an hour to prepare
and submit to the Commission.\407\ Thus, the Commission preliminarily
estimates that the initial and ongoing burden to comply with the
notification requirement of proposed Rule 1000(b)(4)(i) would be 5
hours annually per respondent, and 220 hours annually for all
respondents.\408\
---------------------------------------------------------------------------

    \406\ Because the threshold for immediate notification SCI
events is lower than the threshold for dissemination SCI events, the
estimate for the number of immediate notification SCI events is
higher than the estimate for the number of dissemination SCI events
(i.e., 15 dissemination SCI events). See infra notes 414 and 424 and
accompanying text.
    \407\ The Commission preliminarily believes this estimate is
appropriate because the notification required by proposed Rule
1000(b)(4)(i) would not be submitted through Form SCI, and is
intended to be an immediate initial notification when responsible
SCI personnel becomes aware of an immediate notification SCI event
which contains only information known to the SCI entity at that
time.
    \408\ (Attorney at 0.5 hour for each notice) x (10 notices) = 5
hours. 5 hours x (44 potential respondents) = 220 burden hours. The
Commission preliminarily believes that SCI entities would handle
internally the work associated with the notification requirement of
proposed Rule 1000(b)(4)(i). But see infra Section IV.D.6,
requesting comment on whether some SCI entities, particularly those
that do not currently participate in the ARP Inspection Program,
would seek to outsource this work and what the cost to outsource
this work would be.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(4)(ii) would require an SCI entity, within 24
hours of any responsible SCI personnel becoming aware of any SCI event,
to submit a written notification to the Commission on Form SCI
pertaining to such SCI event. The Commission preliminarily estimates
that each SCI entity would experience an average of 65 SCI events per
year.\409\ Thus, the

Commission preliminarily estimates that there would be an average of 65
SCI event notices per year for each respondent. The Commission
preliminarily estimates that each notification under proposed Rule
1000(b)(4)(ii) would require an average of 20 burden hours,\410\ with a
compliance manager and in-house attorney each spending approximately 10
hours in collaboration to draft, review, and submit the report. Thus,
the Commission preliminarily estimates that the initial and ongoing
burden to comply with the reporting requirement of proposed Rule
1000(b)(4)(ii) would be 1,300 hours annually per respondent, and 57,200
hours annually for all respondents.\411\
---------------------------------------------------------------------------

    \409\ This estimate is based on Commission's experience with the
ARP Inspection Program. Approximately 175 ARP incidents were
reported to the Commission in 2011 by entities that currently
participate in the ARP Inspection Program. Of those entities, the
Commission believes that 28 would fall under the proposed definition
of SCI entity (since 2011, an additional entity has become part of
the ARP Inspection Program, for a total of 29 SCI entities that
participate in the ARP Inspection Program). Thus, each entity
reported an average of approximately 6 incidents in 2011. Because
the proposed definition of ``SCI event'' is broader than the types
of events covered by the current ARP Inspection Program, and SCI
entities are not currently required by law or rule to report systems
issues to the Commission, the Commission preliminarily believes that
the number of SCI events that would be reported to the Commission
would be significantly more than the number of incidents reported in
2011. The Commission acknowledges that, because these types of
incidents are not required to be reported under the current ARP
Inspection Program, this figure is largely an estimate and is
difficult to ascertain. As such, the Commission seeks comment on the
accuracy of this estimate.
    \410\ This estimate includes the burden for attaching an Exhibit
3 (i.e., a copy in pdf or html format of any information
disseminated to date regarding the SCI event to its members or
participants or on the SCI entity's publicly available Web site).
This estimate is based on Commission staff experience with the ARP
Inspection Program. The Commission has also considered its estimate
of the burden to complete Form 19b-4. Specifically, the Commission
has estimated that an SRO would spend approximately 39 hours to
complete a Form 19b-4. See 2012 Rule 19b-4 collection of information
revision Supporting Statement, Office of Management and Budget,
available at: http://www.reginfo.gov/public/do/PRAViewDocument?ref_nbr=201207-3235-002. However, the Commission notes that, unlike Form
19b-4, the information contained in Form SCI would only be factual.
As such, the Commission preliminarily believes that the amount of
time for an SCI entity to complete Form SCI would be less than the
amount of time for an SRO to complete Form 19b-4.
    \411\ (Compliance Manager at 10 hours for each notice + Attorney
at 10 hours for each notice) x (65 notices) = 1,300 hours. 1,300
hours x (44 potential respondents) = 57,200 burden hours. The
Commission preliminarily believes that SCI entities would handle
internally the work associated with the notification requirement of
proposed Rule 1000(b)(4)(ii). But see infra Section IV.D.6,
requesting comment on whether some SCI entities, particularly those
that do not currently participate in the ARP Inspection Program,
would seek to outsource this work and what the cost to outsource
this work would be.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(4)(iii) would require an SCI entity to submit
written updates to the Commission on Form SCI pertaining to SCI events
on a regular basis, or at such frequency as reasonably requested by a
representative of the Commission, until such time as the SCI event is
resolved. Based on Commission staff's experience with the ARP
Inspection Program, the Commission preliminarily estimates that, on
average, each SCI entity would submit 5 updates per year under proposed
Rule 1000(b)(4)(iii), and that each update would require an average of
3 burden hours,\412\ with a compliance manager and in-house attorney
each spending approximately 1.5 hours in collaboration to draft,
review, and submit the update. Thus, the Commission preliminarily
estimates that the initial and ongoing burden to comply with the
continuous update requirement of proposed Rule 1000(b)(4)(iii) would be
15 hours annually per respondent, and 660 hours annually for all
respondents.\413\
---------------------------------------------------------------------------

    \412\ This estimate includes the burden for attaching an Exhibit
3 (i.e., a copy in pdf or html format of any information disclosed
to date regarding the SCI event to its members or participants or on
the SCI entity's publicly available Web site). In determining this
estimate, the Commission has considered its estimate of the burden
for an SRO to amend a Form 19b-4. Specifically, the Commission
estimated that an amendment to Form 19b-4 would require
approximately 3 hours to complete. See Securities Exchange Act
Release No. 50486 (October 4, 2004), 69 FR 60287, 60294 (October 8,
2004).
    \413\ (Compliance Manager at 1.5 hours for each update +
Attorney at 1.5 hours for each update) x (5 updates) = 15 hours. 15
hours x (44 potential respondents) = 660 burden hours. The
Commission preliminarily believes that SCI entities would handle
internally the work associated with the reporting requirement of
proposed Rule 1000(b)(4)(iii). But see infra Section IV.D.6,
requesting comment on whether some SCI entities, particularly those
that do not currently participate in the ARP Inspection Program,
would seek to outsource this work and what the cost to outsource
this work would be.
---------------------------------------------------------------------------

b. Disseminations Required by Proposed Rule 1000(b)(5)
    Proposed Rule 1000(b)(5) would require disseminations of
information to members or participants relating to dissemination SCI
events. Based on the definition of dissemination SCI event, the
Commission preliminarily estimates that each SCI entity would
experience an average of 14 dissemination SCI events each year that are
not systems intrusions, resulting in an average of 14 member or
participant dissemination per respondent per year under proposed Rule
1000(b)(5)(i).\414\
---------------------------------------------------------------------------

    \414\ This estimate is based on the Commission's experience with
the ARP Inspection Program. Specifically, as indicated in the
Economic Analysis Section, approximately 175 ARP incidents were
reported to the Commission in 2011 by entities that currently
participate in the ARP Inspection Program. Of those entities, the
Commission believes that 28 would fall under the proposed definition
of SCI entity (since 2011, an additional entity has become part of
the ARP Inspection Program, for a total of 29 SCI entities that
participate in the ARP Inspection Program). Thus, each entity
reported an average of approximately 6 incidents in 2011. Further,
because proposed Rule 1000(a) would define an SCI event to mean a
systems disruption, systems compliance issue, or systems intrusion,
the scope of proposed Regulation SCI is broader than the scope of
incidents reported to the ARP Inspection Program, which covers
certain systems disruptions and intrusions. As such, the Commission
preliminarily believes that an estimate of 14 dissemination SCI
events per year per SCI entity (other than systems disruptions) is
appropriate.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(5)(i)(A) would require an SCI entity,
promptly after any responsible SCI personnel becomes aware of a
dissemination SCI event other than a systems intrusion, to disseminate
to its members or participants the following information about such SCI
event: (1) The systems affected by the SCI event; and (2) a summary
description of the SCI event.
    In addition to the costs for outside legal advice discussed
below,\415\ the Commission estimates that each initial member or
participant dissemination would require an average of 3 hours to
prepare and make available to members or participants, with an in-house
attorney spending approximately 2.67 hours in drafting and reviewing
the dissemination, and a webmaster spending approximately 0.33 hours in
making the dissemination available to members or participants.\416\
Thus, the Commission preliminarily estimates that the initial and
ongoing burden to comply with the initial member or participant
dissemination requirement of proposed Rule 1000(b)(5)(i)(A) would be
approximately 42 hours annually per respondent, and 1,848 hours
annually for all respondents.\417\
---------------------------------------------------------------------------

    \415\ See infra note 428.
    \416\ This estimate is based on Commission staff's experience
with the ARP Inspection Program. The Commission estimates that each
initial member or participant dissemination would require an average
of 3 hours to prepare and make available the information to members
or participants, instead of 20 hours as estimated for proposed Rule
1000(b)(4)(ii), because the information required to be disseminated
to members or participants would have been used for the initial
written notification on Form SCI. For the same reason, the
Commission preliminarily believes that an in-house attorney will
prepare the dissemination, which will be made available to members
or participants by the webmaster.
    \417\ (Attorney at 2.67 hours for each notification + Webmaster
at 0.33 hour for each notification) x (14 notifications per year) =
42 hours. 42 hours x (44 potential respondents) = 1,848 burden
hours. The Commission preliminarily believes that SCI entities would
handle internally most of the work associated with the notification
requirement of proposed Rule 1000(b)(5)(i)(A). But see infra Section
IV.D.6, requesting comment on whether some SCI entities,
particularly those that do not currently participate in the ARP
Inspection Program, would seek to outsource this work and what the
cost to outsource this work would be.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(5)(i)(B) would require the SCI entity to
further disseminate, when known, the following information to its
members or

participants: (1) A detailed description of the SCI event; (2) the SCI
entity's current assessment of the types and number of market
participants potentially affected by the SCI event; and (3) a
description of the progress of its corrective action for the SCI event
and when the SCI event has been or is expected to be resolved. In
addition to the outside costs discussed below,\418\ the Commission
preliminarily estimates that each update under proposed Rule
1000(b)(5)(i)(B) would require an average of 5 hours to prepare and
make available to members or participants,\419\ with an in-house
attorney spending approximately 4.67 hours in drafting and reviewing
the update, and a webmaster spending approximately 0.33 hour in making
the update available to members or participants. Thus, the Commission
preliminarily estimates that the initial and ongoing burden to comply
with the update requirement of proposed Rule 1000(b)(5)(i)(B) would be
approximately 70 hours annually per respondent, and 3,080 hours
annually for all respondents.\420\
---------------------------------------------------------------------------

    \418\ See infra note 428.
    \419\ The Commission estimates that each update under proposed
Rule 1000(b)(5)(i)(B) would require an average of 5 hours to prepare
and make available to members or participants, instead of 20 hours
as estimated for proposed Rule 1000(b)(4)(ii), because the
information required to be disseminated to members or participants
would have been used for the initial written notification on Form
SCI.
    \420\ (Attorney at 4.67 hours for each update + Webmaster at
0.33 hour for each update) x (14 updates per year) = 70 hours. 70
hours x (44 potential respondents) = 3,080 burden hours. This
estimate is based on Commission staff's experience with the ARP
Inspection Program. The Commission preliminarily believes that SCI
entities would handle internally most of the work associated with
the update requirement of proposed Rule 1000(b)(5)(i)(B). But see
infra Section IV.D.6, requesting comment on whether some SCI
entities, particularly those that do not currently participate in
the ARP Inspection Program, would seek to outsource this work and
what the cost to outsource this work would be.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(5)(i)(C) would require an SCI entity to
provide regular updates to members or participants of any information
required to be disseminated under proposed Rule 1000(b)(5). As noted
above, there were approximately 175 ARP incidents reported to the
Commission in 2011. These incidents had durations ranging from under
one minute to 24 hours, with most incidents having a duration of less
than 2 hours. Based on the relatively short duration of the ARP
incidents reported to the Commission in 2011, the Commission
preliminarily estimates that, on average, each SCI entity would provide
one regular update per year per dissemination SCI event under proposed
Rule 1000(b)(5)(i)(C). In addition to the costs for outside legal
advice discussed below,\421\ the Commission preliminarily estimates
that each update would require an average of 1 hour to prepare and make
available to members or participants,\422\ with an in-house attorney
spending approximately 0.67 hour in drafting and reviewing the update,
and a webmaster spending approximately 0.33 hour in making the update
available to members or participants. Thus, the Commission
preliminarily estimates that the initial and ongoing burden to comply
with the regular update requirement of proposed Rule 1000(b)(5)(i)(C)
would be approximately 14 hours annually per respondent, and 616 hours
annually for all respondents.\423\
---------------------------------------------------------------------------

    \421\ See infra note 428.
    \422\ This estimate is based on the estimated burden to complete
and submit a written update for an SCI event on Form SCI. See supra
note 412. The Commission estimates that each regular update to a
member or participant dissemination would require an average of 1
hour to prepare and make available to members or participants,
instead of 3 hours, because the information required to be provided
to the Commission in the updates on Form SCI would also be used for
updating the member or participation dissemination. For the same
reason, the Commission preliminarily believes that an attorney will
prepare the update, which will be made available by the webmaster.
    \423\ (Attorney at 0.67 hour for each update + Webmaster at 0.33
hour for each update) x (14 updates per year) = 14 hours. 14 hours x
(44 potential respondents) = 616 burden hours. This estimate is
based on Commission staff's experience with the ARP Inspection
Program. The Commission preliminarily believes that SCI entities
would handle internally most of the work associated with the update
requirement of proposed Rule 1000(b)(5)(i)(C). But see infra Section
IV.D.6, requesting comment on whether some SCI entities,
particularly those that do not currently participate in the ARP
Inspection Program, would seek to outsource this work and what the
cost to outsource this work would be.
---------------------------------------------------------------------------

    Under proposed Rule 1000(b)(5)(ii), promptly after any responsible
SCI personnel becomes aware of a systems intrusion, the SCI entity
would be required to disseminate to its members or participants a
summary description of the systems intrusion, including a description
of the corrective action taken by the SCI entity and when the systems
intrusion has been or is expected to be resolved, unless the SCI entity
determines that dissemination of such information would likely
compromise the security of the SCI entity's SCI systems or SCI security
systems, or an investigation of the systems intrusion, and documents
the reasons for such determination. Based on the definition of
dissemination SCI event, the Commission preliminarily estimates that
each SCI entity would experience an average of 1 dissemination SCI
event that is a systems intrusion each year, resulting in an average of
1 member or participant dissemination per respondent per year under
proposed Rule 1000(b)(5)(ii).\424\ In addition to the costs for outside
legal advice discussed below,\425\ the Commission estimates that each
member or participant dissemination under proposed Rule 1000(b)(5)(ii)
would require an average of 3 hours to prepare and make available to
members or participants, with an in-house attorney spending
approximately 2.67 hours in drafting and reviewing the dissemination,
and a webmaster spending approximately 0.33 hours in making the
dissemination available to members or participants.\426\ Thus, the
Commission preliminarily estimates that the initial and ongoing burden
to comply with the member or participant dissemination requirement
under proposed Rule 1000(b)(5)(ii) would be approximately 3 hours
annually per respondent, and 132 hours annually for all
respondents.\427\
---------------------------------------------------------------------------

    \424\ Based on Commission's experience with the ARP Inspection
Program, the Commission preliminarily believes each SCI entity will
experience on average less than one systems intrusion per year.
However, for purposes of the PRA, the Commission preliminarily
estimates one systems intrusion per respondent per year.
    \425\ See infra note 428.
    \426\ This estimate includes any burden for an SCI entity to
document its reason for determining that dissemination of
information regarding a systems intrusion would likely compromise
the security of the SCI entity's SCI systems or SCI security
systems, or an investigation of the systems intrusion. This estimate
is based on Commission staff's experience with the ARP Inspection
Program. In determining this estimate, the Commission considered its
burden estimate for proposed Rule 1000(b)(5)(i)(A) because both
rules would require the dissemination of certain basic information
about a dissemination SCI event. For the same reason, the Commission
preliminarily believes that an in-house attorney will prepare the
dissemination, which will be made available by the webmaster.
    \427\ (Attorney at 2.67 hours for each notification + Webmaster
at 0.33 hour for each notification) x (1 notification per year) = 3
hours. 3 hours x (44 potential respondents) = 132 burden hours. The
Commission preliminarily believes that SCI entities would handle
internally most of the work associated with the dissemination
requirement of proposed Rule 1000(b)(5)(ii). But see infra Section
IV.D.6, requesting comment on whether some SCI entities,
particularly those that do not currently participate in the ARP
Inspection Program, would seek to outsource this work and what the
cost to outsource this work would be.
---------------------------------------------------------------------------

    The Commission preliminarily believes that SCI entities would
internally handle most of the work associated with disseminating
information on dissemination SCI events to members or participants.
However, based on its experience with the ARP Inspection Program, the
Commission preliminarily believes that SCI entities also would seek
outside legal advice in the preparation of the disseminations required
under proposed Rule 1000(b)(5), and that the average cost of outside
legal advice would be

$15,000 per respondent per year, for a total of $660,000 for all
respondents per year.\428\
---------------------------------------------------------------------------

    \428\ ($15,000 outside legal cost) x (44 potential respondents)
= $660,000.
---------------------------------------------------------------------------

c. Notices Required by Proposed Rules 1000(b)(6)
    Proposed Rules 1000(b)(6) would require notification to the
Commission on Form SCI of material systems changes. The Commission
preliminarily believes this work would be conducted internally.\429\
The burden estimates to comply with proposed Rule 1000(b)(6) include
the burdens associated with submission of Form SCI in accordance with
the instructions thereto.
---------------------------------------------------------------------------

    \429\ But see infra Section IV.D.6, requesting comment on
whether some SCI entities, particularly those that do not currently
participate in the ARP Inspection Program, would seek to outsource
this work and what the cost to outsource this work would be.
---------------------------------------------------------------------------

    Specifically, proposed Rule 1000(b)(6) would require the SCI
entity, absent exigent circumstances, to notify the Commission on Form
SCI at least 30 calendar days before the implementation of any planned
material systems change, including a description of the planned
material systems change as well as the expected dates of commencement
and completion of the implementation of such change.\430\ Based on its
experience with the ARP Inspection Program, Commission preliminarily
estimates that there would be an average of 60 planned material systems
changes per respondent per year.\431\ As such, the Commission
preliminarily estimates that there would be an average of 60
notifications per respondent per year, and each notification would
require an average of 2 hours to prepare and submit,\432\ with an
attorney spending approximately 0.33 hours and a senior systems analyst
spending approximately 1.67 hours in drafting and reviewing the
notification. For the 15 SCI entity respondents that do not currently
participate in the ARP Inspection Program, the Commission preliminarily
estimates that the initial and ongoing burden to comply with the notice
requirement of proposed Rule 1000(b)(6) would be approximately 120
hours annually per respondent, and 1,800 hours annually for all
respondents.\433\ Because SCI entities that currently participate in
the ARP Inspection Program already notify the Commission of planned
material systems changes, the Commission preliminarily estimates that
these entities would be starting from a baseline of fifty percent, and
that the increased burden for these 30 SCI entities would be 60 hours
annually per respondent.\434\ The Commission preliminarily estimates
that the total initial and ongoing burden for SCI entities that
currently participate in the ARP Inspection Program would be 60 hours
annually per respondent, for a total burden of 1,740 hours for all of
these respondents.\435\ Thus, the total estimated initial and ongoing
burden to comply with proposed Rule 1000(b)(6) would be 3,540 for all
respondents.\436\
---------------------------------------------------------------------------

    \430\ If exigent circumstances exist, or if the information
previously provided to the Commission regarding any planned material
systems change becomes materially inaccurate, the SCI entity would
be required to notify the Commission, either orally or in writing,
with any oral notification to be memorialized within 24 hours after
such oral notification by a written notification, as early as
reasonably practicable.
    \431\ This estimate includes instances where the information
previously provided to the Commission regarding any planned material
systems change becomes materially inaccurate.
    \432\ In estimating the burden imposed by proposed Rule
1000(b)(6), the Commission also considered its burden estimate for
the same reporting requirement that was proposed for SB SEFs.
Specifically, proposed Rule 822(a)(4) in the SB SEF Proposing
Release would require an SB SEF to notify the Commission in writing
at least 30 calendar days before the implementation of material
systems changes. The Commission estimated that there would be an
average of 60 notifications per respondent per year, and that each
notification would require an average of 2 internal burden hours.
See SB SEF Proposing Release, supra note 297, at 11029.
    \433\ (Attorney at 0.33 hour for each notification + Senior
Systems Analyst at 1.67 hours for each notification) x (60
notifications per year) = 120 hours. 120 hours x (15 potential
respondents) = 1,800 burden hours.
    \434\ (Attorney at 0.33 hour for each notification + Senior
Systems Analyst at 1.67 hours for each notification) x (30
additional notifications per year) = 60 hours. The Commission
preliminarily believes that the burden would result from the
proposed broadened definitions of ``SCI systems'' and ``SCI security
systems'' in Regulation SCI, as well as the shift from a voluntary
to a mandatory regulatory environment.
    \435\ (60 burden hours) x (29 potential respondents) = 1,740
burden hours.
    \436\ (1,800 burden hours for SCI entities that do not currently
participate in the ARP Inspection Program + 1,740 burden hours for
SCI entities that currently participate in the ARP Inspection
Program) = 3,540 burden hours.
---------------------------------------------------------------------------

d. SCI Review Required by Proposed Rule 1000(b)(7)
    Proposed Rule 1000(b)(7) would require each SCI entity to conduct
an SCI review of its compliance with Regulation SCI not less than once
each calendar year, and submit a report of the SCI review to its senior
management for review no more than 30 calendar days after completion of
such SCI review. The Commission preliminarily estimates that the
initial and ongoing burden of conducting an SCI review and submitting
the SCI review to senior management of the SCI entity for review would
be approximately 625 hours for each respondent \437\ and 27,500 hours
annually for all respondents.\438\
---------------------------------------------------------------------------

    \437\ This estimate is the Commission's preliminary best
estimate and is based on Commission staff's experience with SCI
entities participating in the ARP Inspection Program. This estimate
also is the same as the Commission's burden estimate for internal
audits of SB SEFs. See SB SEF Proposing Release, supra note 297, at
11028. Proposed Rule 822 in the SB SEF Proposing Release would
require an SB SEF to submit to the Commission an annual objective
review of the capability of its systems that support or are
integrally related to the performance of its activities, provided
that if a review is performed internally, an external firm shall
report on the objectivity, competency, and work performance with
respect to the internal review. The Commission recognizes that the
annual review requirement proposed for SB SEFs is different, in
certain respects, from the requirement under proposed Rule
1000(b)(7). Specifically, the scopes of the reviews are different
because proposed Rule 1000(b)(7) would require an SCI review of an
SCI entity's compliance with proposed Regulation SCI. Further,
proposed Rule 1000(b)(7) would not require an external review of an
internal SCI review. Nevertheless, the Commission preliminarily
believes that these differences should not result in differences in
the burden estimate for these similar internal audits.
    \438\ (Attorney at 80 hours + Manager Internal Auditor at 170
hours + Senior Systems Analyst at 375 hours) x (44 potential
respondents) = 27,500 burden hours.
---------------------------------------------------------------------------

e. Reports Required by Proposed Rule 1000(b)(8)
    Proposed Rule 1000(b)(8) would require each SCI entity to submit
certain reports to the Commission. The burden estimates to comply with
proposed Rule 1000(b)(8) include the burdens associated with submission
of Form SCI in accordance with the instructions thereto.
    Pursuant to proposed Rule 1000(b)(8)(i), each SCI entity would be
required to submit to the Commission, as an attachment to Form SCI, a
report of the SCI review required by proposed Rule 1000(b)(7), together
with any response by senior management of the SCI entity, within 60
calendar days after its submission to senior management of the SCI
entity. The Commission estimates that each SCI entity would require 1
hour to submit the SCI review using Form SCI, for a total annual
initial and ongoing burden of 44 hours for all respondents.\439\
---------------------------------------------------------------------------

    \439\ (Attorney at 1 hour for each submission) x (1 submission
per year) = 1 burden hour. (1 burden hour) x (44 potential
respondents) = 44 burden hours.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(8)(ii) would require each SCI entity to
submit, using Form SCI, a report within 30 calendar days after the end
of June and December of each year, containing a summary description of
the progress of any material systems changes during the six-month
period ending on June 30 or December 31, as the case may be, and the
date, or expected date, of completion of their implementation.

The Commission preliminarily estimates that the initial and ongoing
burden to comply with proposed Rule 1000(b)(8)(ii) would be
approximately 60 hours per respondent per report or 120 hours
annually,\440\ and 5,280 hours annually for all respondents.\441\
---------------------------------------------------------------------------

    \440\ The Commission notes that SCI entities currently do not
submit to the Commission written semi-annual notifications of
material systems changes. This estimate is based on Commission
staff's experience with various entities through the ARP Inspection
Program.
    \441\ (Attorney at 10 hours for each report + Senior Systems
Analyst at 50 hours for each report) x (2 reports per year) = 120
burden hours. (120 burden hours) x (43 potential respondents) =
5,280 burden hours. The Commission preliminarily believes that SCI
entities would handle internally the work associated with the
reporting requirement of proposed Rule 1000(b)(8)(ii). But see infra
Section IV.D.6, requesting comment on whether some SCI entities,
particularly those that do not currently participate in the ARP
Inspection Program, would seek to outsource this work and what the
cost to outsource this work would be.
---------------------------------------------------------------------------

3. Requirements To Take Corrective Actions, Identify Immediate
Notification SCI Events, and Identify Dissemination SCI Events
    The proposed rules that could result in SCI entities establishing
additional processes for compliance with proposed Regulation SCI are
discussed more fully in Section III.C above.
a. Requirement To Take Corrective Actions
    Proposed Rule 1000(b)(3) would require an SCI entity, upon any
responsible SCI personnel becoming aware of an SCI event, to begin to
take corrective action which shall include, at a minimum, mitigating
potential harm to investors and market integrity resulting from the SCI
event and devoting adequate resources to remedy the SCI event as soon
as reasonably practicable. Based on its experience with the ARP
Inspection Program, the Commission believes that entities that
participate in the ARP Inspection Program already take corrective
actions in response to a systems issue, and believes that other SCI
entities also take corrective actions in response to a systems issue.
Nevertheless, the Commission preliminarily believes that proposed Rule
1000(b)(3) would likely result in SCI entities revising their policies
in this regard, which would help to ensure that their information
technology staff has the ability to access systems in order to take
appropriate corrective actions. As such, proposed Rule 1000(b)(3) may
impose a one-time implementation burden on SCI entities associated with
developing a process for ensuring that they are prepared for the
corrective action requirement. Proposed Rule 1000(b)(3) also may impose
periodic burdens on SCI entities in reviewing that process. The
Commission preliminarily estimates that the initial burden to implement
such a process would be 42 hours per SCI entity \442\ or 1,848 hours
for all SCI entities.\443\ The Commission also preliminarily estimates
that the ongoing burden to review such a process would be 12 hours
annually per SCI entity \444\ or 528 hours annually for all SCI
entities.\445\
---------------------------------------------------------------------------

    \442\ This estimate is based on the Commission's burden estimate
for proposed Rule 1000(b)(1) because both proposed Rule 1000(b)(1)
and proposed Rule 1000(b)(3) would result in certain policies and
procedures or processes. Because proposed Rule 1000(b)(1) (except
for policies and procedures for standards that result in such
systems being designed, developed, tested, maintained, operated, and
surveilled in a manner that facilitates the successful collection,
processing, and dissemination of market data) would require the
establishment of five policies and procedures at a minimum, the
Commission preliminarily estimates that the initial burden to
establish the process to comply with proposed Rule 1000(b)(3) would
be one-fifth of the initial burden to comply with proposed Rule
1000(b)(1) (except for policies and procedures for standards that
result in such systems being designed, developed, tested,
maintained, operated, and surveilled in a manner that facilitates
the successful collection, processing, and dissemination of market
data), or 42 hours (210 hours / 5). Further, the Commission
preliminarily estimates that the hourly breakdown between different
staff of the SCI entity would be in the same ratio as the
Commission's estimate for proposed Rule 1000(b)(1) (except for
policies and procedures for standards that result in such systems
being designed, developed, tested, maintained, operated, and
surveilled in a manner that facilitates the successful collection,
processing, and dissemination of market data)--Compliance Manager at
16 hours, Attorney at 16 hours, Senior Systems Analyst at 5 hours,
and Operations Specialist at 5 hours. These estimates reflect the
Commission's preliminary view that SCI entities would establish the
process for compliance with proposed Rule 1000(b)(3) internally. But
see infra Section IV.D.6, requesting comment on whether some SCI
entities, particularly those that do not currently participate in
the ARP Inspection Program, would seek to outsource this work and
what the cost to outsource this work would be.
    \443\ (42 hours) x (44 potential respondents) = 1,848 burden
hours.
    \444\ This estimate is based on the Commission's burden estimate
for proposed Rule 1000(b)(1) because both proposed Rule 1000(b)(1)
and proposed Rule 1000(b)(3) would result in certain policies and
procedures or processes. Because proposed Rule 1000(b)(1) (except
for policies and procedures for standards that result in such
systems being designed, developed, tested, maintained, operated, and
surveilled in a manner that facilitates the successful collection,
processing, and dissemination of market data) would require the
establishment and review of five policies and procedures at a
minimum, the Commission preliminarily estimates that the ongoing
burden to review the process to comply with proposed Rule 1000(b)(3)
would be one-fifth of the ongoing burden to comply with proposed
Rule 1000(b)(1) (except for policies and procedures for Standards
that result in such systems being designed, developed, tested,
maintained, operated, and surveilled in a manner that facilitates
the successful collection, processing, and dissemination of market
data), or 12 hours (60 hours / 5). Further, the Commission
preliminarily estimates that the hourly breakdown between different
staff of the SCI entity would be in the same ratio as the
Commission's estimate for proposed Rule 1000(b)(1) (except for
policies and procedures for standards that result in such systems
being designed, developed, tested, maintained, operated, and
surveilled in a manner that facilitates the successful collection,
processing, and dissemination of market data)--Compliance Manager at
6 hours and Attorney at 6 hours. These estimates reflect the
Commission's preliminary view that SCI entities would review the
process for compliance with proposed Rule 1000(b)(3) internally. But
see infra Section IV.D.6, requesting comment on whether some SCI
entities, particularly those that do not currently participate in
the ARP Inspection Program, would seek to outsource this work and
what the cost to outsource this work would be.
    \445\ (12 hours) x (44 potential respondents) = 528 burden
hours.
---------------------------------------------------------------------------

b. Requirements To Identify Immediate Notification SCI Events and
Dissemination SCI Events
    Proposed Rule 1000(a) would define a ``dissemination SCI event'' to
mean an SCI event that is a: (1) Systems compliance issue; (2) systems
intrusion; or (3) systems disruption that results, or the SCI entity
reasonably estimates would result, in significant harm or loss to
market participants.
    When an SCI event occurs, an SCI entity would need to determine
whether the event is an immediate notification SCI event or a
dissemination SCI event, because the proposed rules would impose
different obligations on SCI entities for these types of SCI events. As
such, immediate notification SCI events and dissemination SCI events
may impose an initial one-time implementation burden on SCI entities in
developing a process to ensure that they are able to quickly and
correctly make a determination regarding whether the SCI event is
subject to proposed Rule 1000(b)(4)(i) or (b)(5). The definition may
also impose periodic burdens on SCI entities in reviewing that process.

    Because the ARP Inspection Program already provides for the
reporting of ``significant system changes'' and ``significant system
outages'' to Commission staff,\446\ the Commission believes that, as
compared to entities that do not participate in the ARP Inspection
Program, entities that currently participate in the ARP Inspection
Program would already have internal processes for determining the
significance of a systems issue.\447\ Therefore, the Commission
preliminarily estimates that the proposed definition would impose half
as much burden on entities that participate in the ARP Inspection
Program as compared to entities that do not participate in the ARP
Inspection Program.
---------------------------------------------------------------------------

    \446\ See supra notes 33 and 35 and accompanying text.
    \447\ The Commission recognizes that ``significant system
changes'' and ``significant system outages'' differ from the
proposed definitions of ``immediate notification SCI event'' and
``dissemination SCI event.''
---------------------------------------------------------------------------

    For SCI entities that currently do not participate in the ARP
Inspection Program, the Commission preliminarily believes that the
initial burden would be 42 hours per entity \448\ or 630 hours for all
such entities.\449\ For entities that currently participate in the ARP
Inspection Program, the Commission preliminarily believes that the
initial burden would be 21 hours \450\ per entity or 609 hours for all
such entities.\451\ For SCI entities that currently do not participate
in the ARP Inspection Program, the Commission preliminarily believes
that ongoing burden would be 12 hours annually per entity \452\ or 180
hours for all such entities.\453\ For SCI entities that currently
participate in the ARP Inspection Program, the Commission preliminarily
believes that ongoing burden would be 6 hours annually \454\ per entity
or 174 hours for all such entities.\455\
---------------------------------------------------------------------------

    \448\ This estimate is based on the Commission's burden estimate
for proposed Rule 1000(b)(1) because proposed Rule 1000(b)(1), the
proposed definition of ``immediate notification SCI event,'' and the
definition of ``dissemination SCI event'' would result in certain
policies and procedures or processes. Because proposed Rule
1000(b)(1) (except for policies and procedures for standards that
result in such systems being designed, developed, tested,
maintained, operated, and surveilled in a manner that facilitates
the successful collection, processing, and dissemination of market
data) would require the establishment of five policies and
procedures at a minimum, the Commission preliminarily estimates that
the initial burden to establish the process regarding the SCI event
determinations would be one-fifth of the initial burden to comply
with proposed Rule 1000(b)(1) (except for policies and procedures
for standards that result in such systems being designed, developed,
tested, maintained, operated, and surveilled in a manner that
facilitates the successful collection, processing, and dissemination
of market data), or 42 hours (210 hours / 5). Further, the
Commission preliminarily estimates that the hourly breakdown between
different staff of the SCI entity would be in the same ratio as the
Commission's estimate for proposed Rule 1000(b)(1) (except for
policies and procedures for standards that result in such systems
being designed, developed, tested, maintained, operated, and
surveilled in a manner that facilitates the successful collection,
processing, and dissemination of market data)--Compliance Manager at
16 hours, Attorney at 16 hours, Senior Systems Analyst at 5 hours,
and Operations Specialist at 5 hours. These estimates reflect the
Commission's preliminary view that SCI entities would internally
establish the process for determining whether an SCI event is an
immediate notification SCI event or dissemination SCI event. But see
infra Section IV.D.6, requesting comment on whether some SCI
entities, particularly those that do not currently participate in
the ARP Inspection Program, would seek to outsource this work and
what the cost to outsource this work would be.
    \449\ (42 hours) x (15 potential respondents) = 630 burden
hours.
    \450\ 42 burden hours x 50% = 21 burden hours. These estimates
reflect the Commission's preliminary view that SCI entities would
internally establish the process for determining whether an SCI
event is an immediate notification SCI event or dissemination SCI
event. But see infra Section IV.D.6, requesting comment on whether
some SCI entities, particularly those that do not currently
participate in the ARP Inspection Program, would seek to outsource
this work and what the cost to outsource this work would be.
    \451\ (21 burden hours) x (29 potential respondents) = 609
burden hours.
    \452\ This estimate is based on the Commission's burden estimate
for proposed Rule 1000(b)(1) because proposed Rule 1000(b)(1), the
proposed definition of ``immediate notification SCI event,'' and the
proposed definition of ``dissemination SCI event'' would result in
certain policies and procedures or processes. Because proposed Rule
1000(b)(1) (except for policies and procedures for standards that
result in such systems being designed, developed, tested,
maintained, operated, and surveilled in a manner that facilitates
the successful collection, processing, and dissemination of market
data) would require the establishment and maintenance of five
policies and procedures at a minimum, the Commission preliminarily
estimates that the ongoing burden to review the process regarding
the SCI event determinations would be one-fifth of the ongoing
burden to comply with proposed Rule 1000(b)(1) (except for policies
and procedures for standards that result in such systems being
designed, developed, tested, maintained, operated, and surveilled in
a manner that facilitates the successful collection, processing, and
dissemination of market data), or 12 hours (60 hours / 5). Further,
the Commission preliminarily estimates that the hourly breakdown
between different staff of the SCI entity would be in the same ratio
as the Commission's estimate for proposed Rule 1000(b)(1) (except
for policies and procedures for standards that result in such
systems being designed, developed, tested, maintained, operated, and
surveilled in a manner that facilitates the successful collection,
processing, and dissemination of market data)--Compliance Manager at
6 hours and Attorney at 6 hours. These estimates reflect the
Commission's preliminary view that SCI entities would internally
review the process for determining whether an SCI event is an
immediate notification SCI event or dissemination SCI event. But see
infra Section IV.D.6, requesting comment on whether some SCI
entities, particularly those that do not currently participate in
the ARP Inspection Program, would seek to outsource this work and
what the cost to outsource this work would be.
    \453\ (12 burden hours) x (15 potential respondents) = 180
burden hours.
    \454\ 12 burden hours x 50% = 6 burden hours. These estimates
reflect the Commission's preliminary view that SCI entities would
internally review the process for determining whether an SCI event
is an immediate notification SCI event or dissemination SCI event.
But see infra Section IV.D.6, requesting comment on whether some SCI
entities, particularly those that do not currently participate in
the ARP Inspection Program, would seek to outsource this work and
what the cost to outsource this work would be.
    \455\ (6 burden hours) x (29 potential respondents) = 174 burden
hours.
---------------------------------------------------------------------------

4. Recordkeeping Requirements
    As more fully discussed in Section III.D above, proposed Rule
1000(c) would specifically require SCI entities other than SCI SROs to
make, keep, and preserve at least one copy of all documents relating to
its compliance with proposed Regulation SCI. The Commission is not
proposing a new recordkeeping requirement for SCI SROs because the
documents relating to compliance with proposed Regulation SCI are
subject to their existing recordkeeping and retention requirements
under Rule 17a-1 under the Exchange Act.\456\ Because Rule 17a-1 under
the Exchange Act requires every SRO to keep on file for a period of not
less than 5 years, the first 2 years in an easily accessible place, at
least one copy of all documents that it makes or receives respecting
its self-regulatory activities, and that all such documents be made
available for examination by the Commission and its representatives,
the Commission believes that proposed Rule 1000(c) would not result in
any burden that is not already accounted for in the Commission's burden
estimates for Rule 17a-1.
---------------------------------------------------------------------------

    \456\ See 17 CFR 240.17a-1.
---------------------------------------------------------------------------

    For SCI entities other than SCI SROs, Regulation SCI-related
records would be required to be kept for a period of not less than five
years, the first two years in a place that is readily accessible to the
Commission or its representatives for inspection and examination.\457\
Upon the request of any representative of the Commission, an SCI entity
would be required to promptly furnish to the possession of such
representative copies of any documents required to be kept and
preserved by it pursuant to proposed Rule 1000(c).
---------------------------------------------------------------------------

    \457\ Under the proposal, upon or immediately prior to ceasing
to do business or ceasing to be registered under the Exchange Act,
an SCI entity would be required to take all necessary action to
ensure that the records required to be made, kept, and preserved by
Rule 1000(c) would be accessible to the Commission and its
representatives in the manner required and for the remainder of the
period required by proposed Rule 1000(c). See proposed Rule
1000(c)(3).

---------------------------------------------------------------------------

    For SCI entities other than SCI SROs, the Commission preliminarily
estimates that the initial and ongoing burden to make, keep, and
preserve records relating to compliance with proposed Regulation SCI
would be approximately 25 hours annually per respondent \458\ for a
total annual burden of 450 hours for all respondents.\459\ In addition,
the Commission estimates that each SCI entity other than an SCI SRO
would incur a one-time burden to set up or modify an existing
recordkeeping system to comply with proposed Rule 1000(c).
Specifically, the Commission estimates that, for each SCI entity other
than an SCI SRO, setting up or modifying a recordkeeping system would
create an initial burden of 170 hours and $900 in information
technology costs for purchasing recordkeeping software,\460\ for a
total initial burden of 3,060 hours \461\ and a total initial cost of
$16,200.\462\
---------------------------------------------------------------------------

    \458\ This estimate is based on the Commission's experience with
examinations of registered entities, the Commission's estimated
burden for an SRO to comply with Rule 17a-1, and the Commission's
estimated burden for a SB SEF to keep and preserve documents made or
received in the conduct of its business. Specifically, the
Commission estimated 50 burden hours per respondent per year in
connection with Rule 17a-1 and proposed Rule 818(a) and (b) in the
SB SEF Proposing Release. See 2010 Extension of Rule 17a-1
Supporting Statement, Office of Management and Budget, available at:
http://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201007-3235-003
and SB SEF Proposing Release, supra note 297, at 11029. Because the
recordkeeping requirements under Rule 17a-1 and under proposed Rule
818(a) and (b) are broader than the recordkeeping requirement under
proposed Rule 1000(c), the Commission preliminarily believes that an
estimate of 25 burden hours per year per SCI entity is appropriate.
Further, the Commission notes that this burden estimate includes the
burden imposed by proposed Rule 1000(e). Specifically, proposed Rule
1000(e) would provide that, if the records required to be filed or
kept by an SCI entity under proposed Regulation SCI are prepared or
maintained by a service bureau or other recordkeeping service on
behalf of the SCI entity, the SCI entity would be required to ensure
that the records are available for review by the Commission and its
representatives by submitting a written undertaking, in a form
acceptable to the Commission, by such service bureau or other
recordkeeping service, which is signed by a duly authorized person
at such service bureau or other recordkeeping service.
    \459\ (Compliance Clerk at 25 hours) x (18 potential
respondents) = 450 burden hours.
    \460\ This estimate is based on the Commission's experience with
examinations of registered entities and the Commission's estimated
burden for an SB SEF to keep and preserve documents made or received
in the conduct of its business. Specifically, the Commission
estimated that setting up or modifying a recordkeeping system under
proposed Rule 818 would create an initial burden of 345 hours and
$1,800 in information technology costs per respondent. See SB SEF
Proposing Release, supra note 297, at 11030. Because the
recordkeeping requirements under proposed Rule 818 are broader than
the recordkeeping requirement under proposed Rule 1000(c), the
Commission preliminarily believes that the estimates of 170 initial
burden hours and $900 in initial cost are appropriate.
    \461\ (170 burden hours) x (18 potential respondents) = 3,060
burden hours.
    \462\ ($900) x (18 potential respondents) = $16,200.
---------------------------------------------------------------------------

    The Commission preliminarily believes that proposed Rule
1000(c)(3), which would require an SCI entity, upon or immediately
prior to ceasing to do business or ceasing to be registered under the
Exchange Act, to take all necessary action to ensure that the records
required to be made, kept, and preserved by Rule 1000(c)(1) and Rule
(c)(2) remain accessible to the Commission and its representatives in
the manner and for the remainder of the period required by Rule
1000(c), would not result in any additional paperwork burden that is
not already accounted for in the Commission's burden estimates for
proposed Rule 1000(c)(1) and Rule 1000(c)(2).
6. Request for Comment on Extent and Cost of Outsourcing
    209. The Commission's estimates of the hourly burdens discussed
above reflect the Commission's preliminary view that SCI entities would
conduct the work proposed to be required by proposed Rules 1000(a),
1000(b)(1), 1000(b)(2), 1000(b)(3), 1000(b)(4), 1000(b)(5), 1000(b)(6),
1000(b)(7), 1000(b)(8), and 1000(b)(9) internally. The Commission
acknowledges, however, that some SCI entities, particularly smaller SCI
entities, and/or SCI entities that do not currently participate in the
ARP Inspection Program, may elect to outsource the work if it would be
more cost effective to so do. The Commission does not at this time have
sufficient information to reasonably estimate the cost to outsource the
work proposed to be required by proposed Rules 1000(a), 1000(b)(1),
1000(b)(2), 1000(b)(3), 1000(b)(4), 1000(b)(5), 1000(b)(6), 1000(b)(7),
1000(b)(8), and 1000(b)(9), or the number of entities that would choose
to outsource this work, for purposes of the PRA. The Commission seeks
comment, however, on its preliminary view that SCI entities would
conduct such work internally. Further, the Commission seeks comment on
whether some SCI entities would in fact find it more cost effective to
outsource the work that would be required to comply with the proposed
rules, and if so, how many of these SCI entities would therefore
outsource this work and at what cost.
    For purposes of facilitating such comment, presented below are
certain preliminary assumptions and calculations regarding such
potential outsourcing on which the Commission requests comment.
Specifically, for purposes of soliciting comment, the Commission is
assuming that it would take the same number of hours for a consultant
and/or outside attorney to complete the work to be required by proposed
Rules 1000(a), 1000(b)(1), 1000(b)(2), 1000(b)(3), 1000(b)(4),
1000(b)(5), 1000(b)(6), 1000(b)(7), 1000(b)(8), and 1000(b)(9), as it
would take for an SCI entity to complete that work internally (using
the Commission's preliminary estimates above). Further, the Commission
is assuming that work would be conducted at a rate of $400 per
hour.\463\
---------------------------------------------------------------------------

    \463\ This is based on an estimated $400 per hour cost for
outside consulting and/or legal services. This is the same estimate
used for the Commission's consolidated audit trail rule. See
Securities Exchange Act Release No. 67457 (July 18, 2012), 77 FR
45722 (August 1, 2012).
---------------------------------------------------------------------------

    Based on the forgoing assumptions, the estimated cost to outsource
the work that the Commission preliminarily assumed would be done
internally would be as follows:
    For identification of immediate notification SCI events and
dissemination SCI events: The initial cost would be (a) for an SCI
entity that has not participated in the ARP Inspection Program,
$16,800; \464\ and (b) for an SCI entity that currently participates in
the ARP Inspection Program, $8,400.\465\ The ongoing annual cost would
be (a) for an SCI entity that has not participated in the ARP
Inspection Program, $4,800; \466\ and (b) for an SCI entity that
currently participates in the ARP Inspection Program, $2,400.\467\
---------------------------------------------------------------------------

    \464\ 42 hours x $400 = $16,800.
    \465\ 21 hours x $400 = $8,400.
    \466\ 12 hours x $400 = $4,800.
    \467\ 6 hours x $400 = $2,400.
---------------------------------------------------------------------------

    For proposed Rule 1000(b)(1) except proposed Rule 1000(b)(1)(i)(F):
The initial cost would be (a) for an SCI entity that has not
participated in the ARP Inspection Program, $84,000; \468\ and (b) for
an SCI entity that currently participates in the ARP Inspection
Program, $42,000.\469\ The ongoing annual costs would be (a) for an SCI
entity that has not participated in the ARP Inspection Program,
$24,000; \470\ and (b) for an SCI entity that currently participates in
the ARP Inspection Program, $12,000.\471\
---------------------------------------------------------------------------

    \468\ 210 hours x $400 = $84,000.
    \469\ 105 hours x $400 = $42,000.
    \470\ 60 hours x $400 = $24,000.
    \471\ 30 hours x $400 = $12,000.
---------------------------------------------------------------------------

    For proposed Rule 1000(b)(1)(i)(F): The initial cost for each SCI
entity would be $52,000.\472\ The ongoing

annual cost for each SCI entity would be $52,000.\473\
---------------------------------------------------------------------------

    \472\ 130 hours x $400 = 52,000.
    \473\ 130 hours x $400 = 52,000.
---------------------------------------------------------------------------

    For proposed Rule 1000(b)(2): The initial cost for each SCI entity
would be $72,000.\474\ The ongoing annual cost would be (a) for an SCI
entity that is an SCI SRO, $48,000; \475\ and (b) for an SCI entity
that is not an SCI SRO, $24,000.\476\
---------------------------------------------------------------------------

    \474\ 180 hours x $400 = $72,000.
    \475\ 120 hours x $400 = $48,000.
    \476\ 60 hours x $400 = $24,000.
---------------------------------------------------------------------------

    For proposed Rule 1000(b)(3): The initial cost for each SCI entity
would be $16,800.\477\ The ongoing annual cost for each SCI entity
would be $4,800.\478\
---------------------------------------------------------------------------

    \477\ 42 hours x $400 = $16,800.
    \478\ 12 hours x $400 = $4,800.
---------------------------------------------------------------------------

    For proposed Rule 1000(b)(4): The initial and the ongoing annual
cost for each SCI entity would be (a) for proposed Rule 1000(b)(4)(i),
$2,000; \479\ (b) for proposed Rule 1000(b)(4)(ii), $520,000; \480\ and
(c) for proposed Rule 1000(b)(4)(iii), $6,000.\481\
---------------------------------------------------------------------------

    \479\ 5 hours x $400 = $2,000.
    \480\ 1,300 hours x $400 = $520,000.
    \481\ 15 hours x $400 = $6,000.
---------------------------------------------------------------------------

    For proposed Rule 1000(b)(5): The initial and the ongoing annual
cost for each SCI entity would be (a) for proposed Rule
1000(b)(5)(i)(A), $16,800; \482\ (b) for proposed Rule
1000(b)(5)(i)(B), $28,000; \483\ (c) for proposed Rule
1000(b)(5)(i)(C), $5,600; \484\ and (d) for proposed Rule
1000(b)(5)(ii), $1,200.\485\
---------------------------------------------------------------------------

    \482\ 42 hours x $400 = $16,800.
    \483\ 70 hours x $400 = $28,000.
    \484\ 14 hours x $400 = $5,600.
    \485\ 3 hours x $400 = $1,200.
---------------------------------------------------------------------------

    For proposed Rule 1000(b)(6): The initial and ongoing annual cost
would be (a) for SCI entities that do not currently participate in the
ARP Inspection Program, $48,000; \486\ and (b) for SCI entities that
currently participate in the ARP Inspection Program, $24,000.\487\
---------------------------------------------------------------------------

    \486\ 120 hours x $400 = $48,000.
    \487\ 60 hours x $400 = $24,000.
---------------------------------------------------------------------------

    For proposed Rule 1000(b)(7): The initial and ongoing annual cost
would be $250,000 for each SCI entity.\488\
---------------------------------------------------------------------------

    \488\ 625 hours x $400 = $250,000.
---------------------------------------------------------------------------

    For proposed Rule 1000(b)(8): The initial and ongoing annual cost
for each SCI entity would be (a) for proposed Rule 1000(b)(8)(i), $400;
\489\ and (b) for proposed Rule 1000(b)(8)(ii), $48,000 for each SCI
entity.\490\
---------------------------------------------------------------------------

    \489\ 1 hour x $400 = $400.
    \490\ 120 hours x $400 = 48,000.
---------------------------------------------------------------------------

    For proposed Rule 1000(b)(9)(i) and (ii): The initial annual cost
would be $52,000 for each SCI entity.\491\ The ongoing annual cost
would be $38,000 for each SCI entity.\492\
---------------------------------------------------------------------------

    \491\ 130 hours x $400 = $52,000.
    \492\ 95 hours x $400 = $38,000.
---------------------------------------------------------------------------

    For proposed Rule 1000(b)(9)(iii): The initial annual cost would be
$14,000 for each SCI entity.\493\ The ongoing annual cost would be
$1,200 for each SCI entity.\494\
---------------------------------------------------------------------------

    \493\ 35 hours x $400 = $14,000.
    \494\ 3 hours x $400 = $1,200.
---------------------------------------------------------------------------

    210. As discussed above, the Commission requests comment on these
preliminary estimates regarding potential outsourcing and the
underlying assumptions. For example, is it reasonable to assume that
the number of hours for a consultant and/or outside attorney to
complete the work would be the same as the number of hours for internal
staff to complete the work? If not, why not? Are there certain types of
SCI entities (e.g., those having relatively few employees or a smaller
number of systems) that would be more likely to find it cost effective
to outsource the work, either initially or an ongoing basis? Please
explain. Would the cost to outsource vary depending on the extent and
volume of the outsourcing, or the period of time over which such
outsourcing took place? Please explain.
7. Total Paperwork Burden Under Regulation SCI
    Based on the foregoing, the Commission preliminarily estimates that
the total one-time initial burden for all SCI entities to comply with
Regulation SCI would be 133,482 hours \495\ and the total one-time
initial cost would be $2.6 million.\496\ The Commission preliminarily
estimates that the total annual ongoing burden for all SCI entities to
comply with Regulation SCI would be 117,258 hours \497\ and the total
annual ongoing cost would be $738,400.\498\
---------------------------------------------------------------------------

    \495\ 133,482 hours = 26,765 (policies and procedures/mandatory
testing requirements) + 100,120 (notification, dissemination, and
reporting) + 3,087 (requirements to take corrective actions,
identify immediate notification SCI events, and identify
dissemination SCI events) + 3,510 (recordkeeping).
    \496\ $2.6 million = $1.9 million (policies and procedures/
mandatory testing requirements) + $660,000 (notification,
dissemination, and reporting) + $16,200 (recordkeeping).
    \497\ 117,258 hours = 15,806 (policies and procedures/mandatory
testing requirements) + 100,120 (notification, dissemination, and
reporting) + 882 (requirements to take corrective actions, identify
immediate notification SCI events, and identify dissemination SCI
events) + 450 (recordkeeping).
    \498\ $738,400 = $78,400 (policies and procedures/mandatory
testing requirements) + $660,000 (notification, dissemination, and
reporting).
---------------------------------------------------------------------------

    211. The Commission seeks comment on the collection of information
burdens associated with proposed Regulation SCI. Specifically:
    212. Do commenters agree with the Commission's estimate of the
number of respondents required to comply with proposed Regulation SCI?
Why or why not?
    213. Do commenters agree with the Commission's estimate of the
burden for SCI entities to comply proposed Regulation SCI? Why or why
not?
    214. Would there be additional burdens, beyond those described
here, associated with the collection of information under proposed
Regulation SCI? Please explain.
    215. How much additional burden would proposed Regulation SCI
impose upon those SCI entities that already are voluntarily in
compliance with existing ARP Policy Statements?
    216. Would SCI entities generally perform the work required by
proposed Regulation SCI internally or outsource the work?

E. Collection of Information Is Mandatory

    All collections of information pursuant to the proposed rules would
be a mandatory collection of information.

F. Confidentiality

    To the extent that the Commission receives confidential information
pursuant to the reports and submissions that SCI entities would submit
under proposed Form SCI, such information would be kept confidential,
subject to the provisions of applicable law.\499\
---------------------------------------------------------------------------

    \499\ See, e.g., 5 U.S.C. 552. Exemption 4 of the Freedom of
Information Act provides an exemption for ``trade secrets and
commercial or financial information obtained from a person and
privileged or confidential.'' 5 U.S.C. 552(b)(4). Exemption 8 of the
Freedom of Information Act provides an exemption for matters that
are ``contained in or related to examination, operating, or
condition reports prepared by, on behalf of, or for the use of an
agency responsible for the regulation or supervision of financial
institutions.'' 5 U.S.C. 552(b)(8)).
---------------------------------------------------------------------------

G. Retention Period of Recordkeeping Requirements

    SCI entities would be required to retain records and information
under proposed Regulation SCI for a period of not less than five years,
the first two years in a place that is readily accessible to the
Commission or its representatives.\500\
---------------------------------------------------------------------------

    \500\ See proposed Rule 1000(c).
---------------------------------------------------------------------------

H. Request for Comments

    217. Pursuant to 44 U.S.C. 3506(c)(2)(B), the Commission solicits
comment to: (1) Evaluate whether the proposed collection of information
is necessary for the proper performance of

the functions of the agency, including whether the information shall
have practical utility; (2) evaluate the accuracy of the agency's
estimate of the burden of the proposed collection of information; (3)
enhance the quality, utility, and clarity of the information to be
collected; and (4) minimize the burden of collection of information on
those who are to respond, including through the use of automated
collection techniques or other forms of information technology.
    Persons wishing to submit comments on the collection of information
requirements should direct them to the Office of Management and Budget,
Attention: Desk Officer for the Securities and Exchange Commission,
Office of Information and Regulatory Affairs, Room 3208, New Executive
Office Building, Washington, DC 20503; and should send a copy to
Elizabeth M. Murphy, Secretary, Securities and Exchange Commission, 100
F Street NE., Washington, DC 20549-1090 with reference to File No. S7-
01-13. OMB is required to make a decision concerning the collection of
information between 30 and 60 days after publication, so a comment to
OMB is best assured of having its full effect if OMB receives it within
30 calendar days of publication. The Commission will submit the
proposed collection of information to OMB for approval. Requests for
the materials to be submitted to OMB by the Commission with regard to
this collection of information should be in writing, refer to File No.
S7-01-13, and be submitted to the Securities and Exchange Commission,
Office of Investor Education and Advocacy, 100 F Street NE.,
Washington, DC 20549-0213.

I. Reduced Burdens From Proposed Repeal of Rule 301(b)(6) (OMB Control
Number 3235-0509)

    The instant proposal also would amend Regulation ATS under the
Exchange Act, by removing paragraph (b)(6) of Rule 301 thereunder.\501\
Removal of Rule 301(b)(6) would eliminate certain ``collection of
information'' requirements within the meaning of the PRA that the
Commission has submitted to OMB in accordance with 44 U.S.C. 3507 and 5
CFR 1320.11, and that OMB has approved. The approved collection of
information is titled ``Rule 301: Requirements for Alternative Trading
Systems,'' and has a valid OMB control number of 3235-0509.\502\ Some
of the information collection burdens imposed by Regulation ATS would
be reduced by the proposed repeal of Rule 301(b)(6). Specifically, the
paperwork burdens that would be eliminated by the repeal of Rule
301(b)(6) would be: (i) Burdens on ATSs associated with the requirement
to make records relating to any steps taken to comply with systems
capacity, integrity and security requirements under Rule 301 (estimated
to be 20 hours and $2,212); \503\ and (ii) burdens on ATSs associated
with the requirement to provide notices to the Commission to report
systems outages (estimated to be 2.5 hours and $276.50).\504\
---------------------------------------------------------------------------

    \501\ See 17 CFR 242.301(b)(6). See also Securities Exchange Act
Release No. 40760 (December 8, 1998), 63 FR 70844 (December 22,
1998) (``ATS Release'').
    \502\ See Rule 301: Requirements for Alternative Trading Systems
OMB Control No: 3235-0509 (Rule 301 supporting statement), available
at: http://www.reginfo.gov. This approval has an expiration date of
February 28, 2014.
    \503\ The Commission estimated that two alternative trading
systems that register as broker-dealers and comply with Regulation
ATS would trigger this requirement, and that the average compliance
burden for each response would be 10 hours of in-house professional
work at $316 per hour. Thus, the total compliance burden per year
was estimated to be 20 hours (2 respondents x 10 hours = 20 hours).
The total annualized cost burden was estimated to be $2,212 ($316 x
20 hours x 35% = $2,212). See Rule 301: Requirements for Alternative
Trading Systems OMB Control No: 3235-0509 (Rule 301 supporting
statement), available at: http://www.reginfo.gov.
    \504\ The Commission estimated that two alternative trading
systems that register as broker-dealers and comply with Regulation
ATS would meet the volume thresholds that trigger systems outage
notice obligations approximately 5 times a year, and that the
average compliance burden for each response would be .25 hours of
in-house professional work at $316 per hour. Thus, the total
compliance burden per year was estimated to be 2.5 hours (2
respondents x 5 responses each x .25 hours = 2.5 hours). The total
annualized cost burden was estimated to be $276.50 ($316 x .25 hours
per response x 10 responses x 35% = $276.50). See id.
---------------------------------------------------------------------------

    The Commission will submit the proposed amended collection of
information to reflect these reductions to OMB for approval. Requests
for the materials to be submitted to OMB by the Commission with regard
to this collection of information should be in writing, refer to File
No. S7-01-13, and be submitted to the Securities and Exchange
Commission, Office of Investor Education and Advocacy, 100 F Street
NE., Washington, DC 20549-0213.

V. Economic Analysis

A. Background

    As discussed more fully above, the Commission believes that the
convergence of several developments--the evolution of the markets to
become significantly more dependent upon sophisticated automated
systems (driven by regulatory developments and the continual evolution
of technologies for generating, routing, and executing orders), the
limitations of the existing ARP Inspection Program, and the lessons of
recent events (as discussed in Section I.D above)--highlight the need
to consider an updated and formalized regulatory framework for ensuring
that the U.S. securities trading markets develop and maintain systems
with adequate capacity, integrity, resiliency, availability, and
security, and reinforce the requirement that SCI systems operate in
compliance with the Exchange Act. The Commission is also cognizant of
the comments made at the Roundtable and the comment letters submitted
in connection with the Roundtable.\505\ Proposed Regulation SCI would
codify and enhance the Commission's ARP Inspection Program, as well as
establish specific requirements to help ensure that the SCI systems of
SCI entities operate in compliance with the federal securities laws and
rules.
---------------------------------------------------------------------------

    \505\ See supra Section I.D.
---------------------------------------------------------------------------

    Specifically, proposed Regulation SCI would require each SCI entity
to establish, maintain, and enforce written policies and procedures
reasonably designed to ensure that its SCI systems and, for purposes of
security standards, SCI security systems, have levels of capacity,
integrity, resiliency, availability, and security, adequate to maintain
the SCI entity's operational capability and promote the maintenance of
fair and orderly markets, as well as written policies and procedures
reasonably designed to ensure that its SCI systems operate in the
manner intended, including in a manner in compliance with the federal
securities laws and rules, and its own rules or governing documents, as
applicable. Proposed Regulation SCI also would require SCI entities to
provide certain notices and reports to the Commission on Form SCI
regarding, among other things, SCI events and material systems changes.
Further, proposed Regulation SCI would require SCI entities to
disseminate information to members or participants relating to
dissemination SCI events and to begin taking appropriate corrective