proposed requirements set forth for SAWs.\528\ However, as noted above,
the Commission preliminarily believes that only 6 Participants will
apply for an exception to use a non-SAW environment, such that the Plan
Processor will only need to evaluate 6 non-SAW environments.\529\ As
the above estimates set forth for SAWs assume that the Plan Processor
will need to perform this task for 25 SAWs,\530\ instead of for 6
environments, the Commission has correspondingly reduced the
preliminary estimates described above for the Plan Processor to
evaluate each Participant's SAW and notify the Operating Committee.
Accordingly, the Commission preliminarily estimates that the
Participants would incur an initial, one-time expense of approximately
$111,300, or that each Participant would incur an initial, one-time
expense of $4,452, based on a preliminary estimate that Plan Processor
staff would need approximately 45 hours per non-SAW environment to
perform the required evaluation and notification.\531\
---------------------------------------------------------------------------

    \528\ See, e.g., proposed Section 6.13(b); see also Part
III.D.3.b. supra.
    \529\ See note 513 and associated text supra.
    \530\ See note 509 and associated text supra.
    \531\ The estimated 45 hours of Plan Processor staff time
include 20 hours by a senior systems analyst, 20 hours by the chief
information security officer, and 5 hours by a compliance attorney.
Assuming only 6 Participants will apply for an exception to use a
non-SAW environment, the Commission preliminarily estimates that the
Participants would together incur an initial, one-time expense of
$111,300. (20 hours for senior systems analyst = $5,820) + (20 hours
for chief information security officer = $10,860) + (5 hours for
compliance attorney = $1,870) = $18,550 per non-SAW environment.
$18,550 * 6 Participants = $111,300. Each Participant would
therefore incur an initial, one-time expense of $4,452. $111,300/25
Participants = $4,452 per Participant. To the extent that the CISO
consults with the Security Working Group regarding the evaluation of
the non-SAW environments, those costs have already been accounted
for elsewhere. See Part III.D.2. supra.
---------------------------------------------------------------------------

    The requirement that the Plan Processor monitor the non-SAW
environment in accordance with the detailed design specifications
submitted with the exception (or continuance) application and notify
the Participant of any identified non-compliance with such detailed
design specifications largely mirrors the proposed requirements set
forth for SAWs.\532\ However, as explained above, the Commission
preliminarily believes that only 6 Participants will apply for an
exception to use a non-SAW environment and has correspondingly reduced
the preliminary estimates described above for the Plan Processor to
monitor each SAW and notify Participants of any identified non-
compliance.\533\ Accordingly, for the Plan Processor to monitor non-SAW
environments for compliance with the detailed design specifications
submitted with the exception (or continuance) application, the
Commission preliminarily estimates that the Participants would incur an
ongoing annual expense of approximately $302,640, or that each
Participant would incur an ongoing annual expense of approximately
$12,106, based on a preliminary estimate that Plan Processor staff
would need approximately 1,040 hours to conduct such monitoring.\534\
For the Plan Processor to notify the Participant of any identified non-
compliance with the detailed design specifications, the Commission
preliminarily estimates that the Participants would incur an ongoing
annual expense of approximately $14,153, or that each Participant would
incur an ongoing annual expense of approximately $566, based on a
preliminary estimate that Plan Processor staff would need approximately
1.5 hours for each notification of non-compliance.\535\
---------------------------------------------------------------------------

    \532\ See proposed Section 6.13(c)(i); see also Part III.D.3.b.
supra.
    \533\ For the purposes of this section, the Commission
preliminarily estimates that all Participants will choose to utilize
a SAW in some capacity, but that only 6 Participants will choose to
apply for an exception to use a non-SAW environment to access CAT
Data through the user-defined direct query and bulk extraction
tools. See note 513 and associated text supra.
    \534\ Because Participants seeking an exception are required to
demonstrate the extent to which non-SAW environments are consistent
with the detailed design specifications developed by the Plan
Processor for SAWs, the Commission preliminarily believes that much
of the monitoring required by the proposed amendments could be
automated. Therefore, the Commission preliminarily believes that a
senior systems analyst working 20 hours per week could perform the
required monitoring for all non-SAW environments. Accordingly, the
Commission preliminarily estimates that the Participants would
together incur an ongoing annual expense of $302,640. 20 hours * 52
weeks = 1,040 hours. 1,040 hours for senior systems analyst =
$302,640. Each Participant would therefore incur an ongoing annual
expense of $12,105.60. $302,640/25 Participants = $12,105.60.
    \535\ The Commission preliminarily estimates that the Plan
Processor would identify 5 non-compliance events per year for each
non-SAW environment, or, assuming that only 6 Participants have non-
SAW environments, 30 non-compliance events across all non-SAW
environments. 5 events per non-SAW environment * 6 non-SAW
environments = 30 events. For each non-compliance event, the
Commission preliminarily estimates that the Plan Processor will
spend 1.5 hours notifying the Participant of the identified non-
compliance, including 0.5 hours by a senior systems analyst, 0.25
hours by a compliance manager, 0.25 hours by an attorney, and 0.5
hours by a senior business analyst. (0.5 hours for senior systems
analyst = $145.50) + (0.25 for compliance manager = $79.25) + (0.25
for attorney = $106.50) + (0.5 hours for senior business analyst =
$140.50) = $471.75 per event. This estimate is based on estimates
set forth in the Regulation SCI Adopting Release for oral
notifications of SCI events, as the Commission preliminarily
believes that such notifications would typically be provided orally
on a conference call or in a short email to all relevant parties.
See Regulation SCI Adopting Release, supra note 498, at 72384.
Accordingly, the Commission preliminarily estimates that the
Participants would together incur an ongoing annual expense of
$14,152.50. 30 events * $471.75 = $14,152.50. Each Participant would
therefore incur an ongoing annual expense of $566.10. $14,152.50/25
Participants = $566.10. To the extent that the CISO consults with
the Security Working Group regarding any non-compliance events,
those costs have already been accounted for elsewhere. See Part
III.D.2. supra.
---------------------------------------------------------------------------

    Finally, with respect to the requirement that each Participant
using a non-SAW environment simultaneously notify the Plan Processor,
the members of the Security Working Group (and their designees), and
Commission observers of the Security Working Group of any material
changes to its security controls for the non-SAW environment, the
Commission preliminarily believes that 6 Participants would apply for
an exception to use a non-SAW environment and that each of these
Participants would need to simultaneously notify the Plan Processor,
the members of the Security Working Group (and their designees), and
Commission observers of the Security Working Group of a material change
to its security controls approximately 4 times a year. The Commission
also preliminarily believes that each such notification would require
15 burden hours.\536\

Accordingly, the Commission preliminarily estimates that the
Participants would incur an ongoing annual burden of approximately 360
hours, or that each Participant would incur an ongoing annual burden of
approximately 60 hours.\537\
---------------------------------------------------------------------------

    \536\ This estimate includes 10 hours by a senior systems
analyst, 3 hours by a compliance attorney, and 2 hours by the chief
information security office. To the extent that the CISO consults
with the Security Working Group regarding notifications of material
changes to security controls, those costs have already been
accounted for elsewhere. See Part III.D.2. supra.
    \537\ 15 hours per notification * 4 notifications per year = 60
hours per year. 60 hours per year * 6 non-SAW environments = 360
hours.
---------------------------------------------------------------------------

4. Online Targeted Query Tool and Logging of Access and Extraction
    The CAT NMS Plan currently states that the logs required by
Appendix D, Section 8.1.1 of the CAT NMS Plan are to be submitted to
the Operating Committee on a monthly basis. The Commission
preliminarily estimates that the ongoing burden of Participants to
review the newly required information in these logs, through the
Operating Committee, would be an estimated 10 aggregate internal burden
hours each month. The Commission preliminarily believes it is
reasonable to estimate aggregate internal burden hours because the
obligation to receive and review the logs required by Appendix D,
Section 8.1.1 is with the Operating Committee itself and is not an
obligation of individual Participants. This results in an estimated
annual ongoing total burden of 120 burden hours for Participants,\538\
or an annual burden of 4.8 burden hours for each Participant.\539\
---------------------------------------------------------------------------

    \538\ 12 months x 10 hours = 120 burden hours.
    \539\ 120 burden hours/25 Participants = 4.8 burden hours per
Participant.
---------------------------------------------------------------------------

    The Commission preliminarily estimates that the Participants would
incur an initial, one-time external expense of $87,960, or a per
Participant expense of $3,518.40 \540\ for Plan Processor staff time
required to make the initial necessary programming and systems changes
to log delivery of results and the access and extraction of CAT Data,
based on a preliminarily estimate that it would take 260 hours of Plan
Processor staff time to implement these changes.\541\ The Commission
preliminarily estimates that the Participants would incur an annual
ongoing external expense of $5,100, or $204 per Participant,\542\ for
Plan Processor staff time required to generate and provide the
additional information required by proposed Section Appendix D, Section
8.1.1, which the Commission preliminarily estimates to be 2 hours for
each monthly report or 24 hours annually.\543\
---------------------------------------------------------------------------

    \540\ $87,960/25 Participants = $3,518.40 per Participant.
    \541\ The estimated 260 hours of Plan Processor staff time
include 160 hours by a Senior Programmer, 40 hours by a Senior
Database Administrator, 40 hours for a Senior Business Analyst and
20 hours for an Attorney. The Commission is basing this figure on
the estimated internal burden for a broker-dealer that handles
orders subject to customer specific disclosures required by Rule
606(b)(3) to both update its data capture systems in-house and
format the report required by Rule 606. See Securities Exchange Act
Release No. 84528 (November 2, 2018), 83 FR 58338, 58383 (November
19, 2018) (``Rule 606 Adopting Release''). The Commission
preliminarily estimates that the initial, one-time external expense
for Participants will be $87,960 = (Senior Programmer for 160 hours
at $339 an hour = $54,240) + (Senior Database Administrator for 40
hours at $349 an hour = $13,960) + (Senior Business Analyst for 40
hours at $281 an hour = $11,240) + (Attorney for 20 hours at $426 an
hour = $8,520).
    \542\ $5,100/25 Participants = $204 per Participant.
    \543\ The estimated 2 hours of Plan Processor staff time include
1 hour by a Programmer Analyst and 1 hour by a Junior Business
Analyst. This estimate would apply monthly, meaning the annual
ongoing estimate would be 24 hours of Plan Processor staff time,
which would include 12 hours by a Programmer Analyst and 12 hours by
a Junior Business Analyst. The Commission is basing this figure on
the estimated internal burden for broker-dealer that handle relevant
orders and respond in-house to a customer request under Rule
606(b)(3). See Rule 606 Adopting Release, supra note 541, at 58385.
The Commission preliminarily estimates the annual ongoing external
cost to generate and provide the proposed information on logs would
be $5,100 = (Programmer Analyst for 12 hours at $246 per hour =
$2,952) + (Junior Business Analyst for 12 hours at $179 an hour =
$2,148).
---------------------------------------------------------------------------

5. CAT Customer and Account Attributes
    The Commission preliminarily estimates that the one-time burden to
Industry Members to modify systems to report a Transformed Value to the
CAT instead of SSNs or ITINs per the proposed amendment to Section
6.4(d)(ii)(D), will be minimal. However, the Commission preliminarily
believes there will be a cost to install and test the transformation
logic. As proposed, Industry Members would use the CCID Transformation
Logic in conjunction with an API provided by the Plan Processor and the
only cost to Industry Members will be installation and testing of the
transformation logic. The Commission estimates that the one-time burden
to each Industry Member to install and test this technology will be 80
staff burden hours per Industry Member or 120,000 hours in the
aggregate.\544\ The Commission believes that the on-going annual burden
to report the Transformed Value will be the same as the burden to
report a SSN or ITIN once the CCID Transformation Logic is installed.
---------------------------------------------------------------------------

    \544\ 80 burden hours x 1,500 Industry Members = 120,000.
---------------------------------------------------------------------------

    The Commission estimates that the modifications necessary to the
CAT System to develop the CCID Subsystem to generate Customer-IDs using
Transformed Values, as opposed to SSNs or ITINs, would result in an
initial, one-time aggregate external cost of $650,052 for the
Participants,\545\ or $26,002 for each Participant.\546\ This estimated
one-time aggregate external cost represents ten percent of Commission's
estimate in the CAT NMS Approval Order to develop the Central
Repository, of which the CCID Subsystem is a part.\547\
---------------------------------------------------------------------------

    \545\ The Commission preliminarily estimates the one-time
aggregate external cost to update the CAT System to ingest and use
the Transformed Value reported by Industry Members would be
$650,052. The Commission preliminarily believes that this
modification will take an estimated 2,101 hours of Plan Processor
staff time including 130 hours by the CCO, 130 hours by the CISO,
602 hours by a Senior Programmer and 1239 hours by a Program
Analyst. Accordingly, the Commission preliminarily estimates that
the Participants would together incur a one-time aggregated external
cost $650,052. (Chief Compliance Officer for 130 hours at $543 per
hour = $70,590) + (Chief Information Security Officer for 130 hours
at $543 per hour = $70,590) + (Senior Programmer for 602 hours at
$339 = $204,078) + (Program Analyst for 1239 hours at $246 =
$304,794) = $650,052. $650,052/25 Participants = $26,002/
Participant.
    \546\ $650,052/25 Participants = $26,002 per Participant.
    \547\ See CAT NMS Approval Order, supra note 3, at 84918.
(``[T]he Commission estimates that the initial one-time cost to
develop the Central Repository would be an aggregate initial
external cost to the Participants of $65 million, or $3,095,238.09
per Participant.'')
---------------------------------------------------------------------------

    The CAT NMS Plan, Article VI, Section 6.6(b)(ii)(A), currently
requires the CCO to oversee the Regular Written Assessment of the Plan
Processor's performance, which must be provided to the Commission at
least annually and which must include an evaluation of the performance
of the CAT.\548\ As proposed, Appendix D, Section 9.1 requires an
evaluation of the overall performance and design of the CCID Subsystem
and the process for creating Customer-ID(s) to be included in each such
annual Regular Written Assessment of the Plan Processor's Performance.
---------------------------------------------------------------------------

    \548\ See CAT NMS Plan, supra note 3, Section 6.6(b)(ii)(A).
---------------------------------------------------------------------------

    In the CAT NMS Plan Adopting Release, the Commission estimated that
the annual on-going cost of preparing the Regular Written Assessment
would be 171.43 ongoing burden hours per Participant, plus $1,000 of
external costs for outsourced legal counsel per Participant per year,
for an estimated aggregate annual ongoing burden of approximately
3,600.03 hours and an estimated aggregate ongoing external cost of
$21,000.\549\ The amendments propose a new method for creating a
Customer-ID that involve a new CCID

Subsystem, which performs a two-phase transformation of a Customer's
ITIN/SSN in order to create a Customer-ID; thus, the Commission
preliminarily believes there is added complexity to the process for
creating a Customer-ID. Due to this increase in complexity, the
Commission preliminarily estimates that assessment the CCID subsystem
require an additional 50 ongoing burden hours of internal legal,
compliance, business operations, and information technology, per
Participant, for an aggregate ongoing burden of approximately 1,250
hours.\550\
---------------------------------------------------------------------------

    \549\ See CAT NMS Plan Approval Order, supra note 3, at 84925-6
    \550\ 50 burden hours x 25 Participants = 1,250 hours.
---------------------------------------------------------------------------

6. Customer Identifying Systems Workflow
    The Commission preliminarily believes that the requirement that the
Plan Processor maintain a full audit trail of access to Customer
Identifying Systems by each Participant and the Commission (who
accessed what data within each Participant, and when) and provide such
audit trail of each Participant's and the Commission's access to each
the Participant and the Commission for their respective users on a
monthly basis, and the requirement to provide the Operating Committee
with the daily reports that list all users who are entitled to Customer
Identifying Systems access on a monthly basis \551\ will require 4
hours of Plan Processor Staff time per report and will result in an
aggregate ongoing annual external cost to the Participants of $373,464
per year or $14,939 per Participant.\552\ This cost represents
approximately $700 per monthly report--one monthly report to the
Operating Committee, and the daily reports of all users to the
Operating Committee on a monthly basis. This estimate recognizes that
Plan Processor currently is required to collect the audit trail
information and create the daily reports of all users entitled to
access Customer and Account Attributes. The Commission does not believe
that the compilation of new reports will require the Plan Processor to
gather any new information, but would however require the re-packaging
of information to provide to the Participants and the Operating
Committee according to the amended requirements of Appendix D, Section
9.1.\553\
---------------------------------------------------------------------------

    \551\ See proposed Appendix D, Section 4.1.6.
    \552\ The Commission estimates that each monthly report will
require 2 hours by an Operations Specialist, 1 hour by an Attorney,
and 1 hour by the Chief Compliance Officer. The ongoing aggregate
cost for Participants is preliminarily estimated to be $373,464. (2
hours for Operational Specialist x $140 = $280) + (1 hours for
compliance attorney x $374 = $374) + (1 hour for chief compliance
officer x $543 = $543) = $1,197. $1,197 x 12 months = $14,364.
$14,364 x 25 Participants + the Commission = $373,464. Each
Participant would therefore incur an ongoing annual expense of
$14,939 ($373,464/25 Participants).
    \553\ The Commission preliminarily believes that creation of the
monthly reports documentation necessary for ``allow listing'' could
require legal advice, discussions with staff familiar with CAT
security and higher level discussions and analysis. The estimated 30
hours of Plan Processor staff time include 5 hours by an Attorney, 5
hours by an Operations Specialist, 10 hours by the Chief Compliance
Officer and 10 hours by the Chief Information Security Officer. The
initial, one-time aggregate external cost for Participants is
preliminarily estimated to be $13,690 = (Attorney for 5 hours at
$426 per hour = $2,130) + (Operations Specialist for 5 hours at $140
per hour = $700) + (Chief Compliance Officer for 10 hours at $543
per hour = $5,430) + (Chief Information Security Officer for 10
hours at $543 per hour = $5,430).
---------------------------------------------------------------------------

    The Commission cannot precisely estimate the number of Participants
that will apply for authorization to use Programmatic CAIS Access and/
or Programmatic CCID Subsystem Access.\554\ As noted above, the
Commission does not believe that all the Participants require
programmatic access to conduct effect surveillance. The Commission
preliminarily believes that number of Participants that may apply for
such access will range from 1 to 25 Participants. The Commission is
taking a conservative approach and preliminarily estimating that 25
Participants will submit an application.
---------------------------------------------------------------------------

    \554\ See proposed Appendix D, Section 4.1.6 (Customer
Identifying Systems Workflow).
---------------------------------------------------------------------------

    In connection with the application for authorization, the
Commission preliminarily estimates that each of these Participants
would incur a one-time burden of 50 burden hours to prepare each
application for authorization to use Programmatic CAIS Access or
Programmatic CCID Subsystem Access and have that application approved
by the Participant's Chief Regulatory Officer (or similarly designated
head(s) of regulation).\555\ Accordingly, with respect to preparation
and review of the application that seeks Programmatic CAIS and/or
Programmatic CCID Subsystem Access, the Commission preliminarily
estimates that the Participants would incur a one-time burden of
approximately 1,250 hours per application.\556\
---------------------------------------------------------------------------

    \555\ This estimate of 50 burden hours include 15 hours by an
Attorney, 10 hours by a Compliance Manager, 10 hours by an
Operations Specialist, 15 hours by a Chief Compliance Officer.
    \556\ 50 hours per application x 25 Participants = 1,250 hours.
---------------------------------------------------------------------------

7. Proposed Confidentiality Policies, Procedures and Usage Restrictions
    The Commission preliminarily believes that proposed Section 6.5(g)
creates three different types of paperwork burdens: (i) A third-party
disclosure burden relating to preparation, review and public disclosure
of the Proposed Confidentiality Policies; (ii) a recordkeeping burden
associated with the related documentation, procedures, and usage
restriction controls required by the Proposed Confidentiality Policies;
and (iii) a reporting burden associated with the annual requirement to
provide the Commission an examination report in Section 6.5(g)(v).
Data Confidentiality Policies--Identical Policies
    The Commission preliminarily estimates that the hourly burden of
preparing, reviewing and approving the Proposed Confidentiality
Policies would be an aggregate 500 hours for the Participants, or 20
hours for each individual Participant.\557\ This estimation includes
burden hours associated with: (i) Preparing and reviewing the identical
policies required by Section 6.5(g)(i); (2) making the policies
publicly available on each of the Participant websites, or collectively
on the CAT NMS Plan website, redacted of sensitive proprietary
information as required by Section 6.5(g)(iv); and (3) Operating
Committee review and approval as required by Section 6.5(g)(vi).\558\
The Commission believes that Participants already have individual
policies and procedures relating to the confidentiality of CAT Data, as
required by existing provisions of the CAT NMS Plan, and Participants
can use these existing policies and procedures in order to help
prepare, review and approve the policies and procedures required by
proposed Section 6.5(g)(i).
---------------------------------------------------------------------------

    \557\ 500 hours/25 Participants = 20 hours per Participant.
    \558\ To the extent that the CISO consults with the Security
Working Group regarding the development and approval of the Proposed
Confidentiality Policies, those burdens and costs have already been
accounted for elsewhere. See Part III.D.2. supra.
---------------------------------------------------------------------------

    The Commission preliminarily estimates that it would require 10
hours by the CCO and 10 hours by the CISO, both employees of the Plan
Processor and not the Participants, to review the Proposed
Confidentiality Policies, as required by proposed Sections 6.2(a)(v)(R)
and 6.2(b)(viii). The Commission preliminarily estimates that this
would result in a one-time external cost of $10,860 for
Participants,\559\ or $434.40 for each Participant.\560\ The Commission
also

preliminarily believes that the Participants will consult with outside
legal counsel in the drafting of the Proposed Confidentiality Policies,
and estimates this external cost to be $50,000, or $2,000 \561\ for
each Participant.\562\ The Commission believes that the total initial
one-time external cost burden for each Participant will be $2,434.40,
or $60,860 for all Participants.\563\
---------------------------------------------------------------------------

    \559\ $10,860 = (Chief Compliance Officer for 10 hours at $543
per hour = $5,430) + (Chief Information Security Officer for 10
hours at $543 per hour = $5,430).
    \560\ $10,860/25 Participants = $434.40 per Participant.
    \561\ $50,000/25 Participants = $2,000 per Participant.
    \562\ $50,000 = (100 hours at $500 an hour). For purposes of
this Paperwork Reduction Act analysis, the Commission is estimating
the cost of outside legal counsel to be $500 an hour.
    \563\ $2,434.40 x 25 Participants = $60,860.
---------------------------------------------------------------------------

    The Commission preliminarily estimates that Participants will
require 100 burden hours annually to comply with proposed Section
6.5(g)(ii), which requires the Participants to periodically review the
effectiveness of the policies required by Section 6.5(g)(i), including
by using the monitoring and testing protocols documented within the
policies pursuant to Section 6.5(g)(i)(J), and take prompt action to
remedy deficiencies in such policies. The Commission preliminarily
believes it is appropriate to estimate that review of and updates to
the Proposed Confidentiality Policies should be one-fifth the burden
hours necessary for initially creating and approving the Proposed
Confidentiality Policies because the Commission preliminarily believes
it should take substantially less time and effort to review and update
the Proposed Confidentiality Policies than in initially creating and
approving them. This estimated burden includes any updates to the
Proposed Confidentiality Policies initiated by the Participants, based
on their review pursuant to proposed Section 6.5(g)(ii) or based on
changed regulatory needs.
    For purposes of this Paperwork Reduction Act analysis only, the
Commission preliminarily estimates that the Participants would revise
the Proposed Confidentiality Policies once a year, which would require
review by the CCO and CISO of the Plan Processor, as required by
proposed Sections 6.2(a)(v)(R) and 6.2(b)(viii). The Commission
preliminarily believes that the CCO and CISO would require less time to
review subsequent updates to the Proposed Confidentiality Policies, so
the Commission preliminarily estimates that it would require 5 hours of
review by the CCO and 5 hours of review by the CISO, which would result
in an external cost of $5,430 for the Participants,\564\ and $217.20
for each Participant annually.\565\ In addition, the Commission
preliminarily estimates that Participants will consult with outside
legal counsel in updating the Proposed Confidentiality Policies, and
preliminarily estimates this external cost to be $5,000.\566\ In total,
the Commission preliminarily estimates an aggregate external cost of
$10,430 for all Participants related to reviewing and updating the
Proposed Confidentiality Policies, or $417.20 per Participant.\567\
---------------------------------------------------------------------------

    \564\ $5,430 = (Chief Compliance Officer for 5 hours at $543 per
hour = 2,715) + (Chief Information Security Officer for 5 hours at
$543 per hour = $2,715).
    \565\ $5,430/25 Participants = $217.20 per Participant.
    \566\ $5,000 = (outside legal counsel for 10 hours at $500 an
hour).
    \567\ $10,430/25 Participants = $417.20 per Participant.
---------------------------------------------------------------------------

Data Confidentiality Policies--Procedures and Usage Restriction
Controls
    The Commission preliminarily estimates that each Participant would
require an average of 282 burden hours to initially develop and draft
the procedures and usage restriction controls required by proposed
Section 6.5(g)(i).\568\ The Commission preliminarily believes that this
estimation should include all initial reporting burdens associated with
the procedures and usage restriction controls required by Section
6.5(g)(i), such as the requirement to implement effective information
barriers between such Participants' Regulatory Staff and non-Regulatory
Staff with regard to access and use of CAT Data, the requirement to
document each instance of access by non-Regulatory Staff as proposed in
Section 6.5(g)(i)(E) and the requirement that Participants must be able
to demonstrate that a Participant's ongoing use of Programmatic CAIS
and/or CCID Subsystem access is in accordance with the Customer
Identifying Systems Workflow as proposed in Section 6.5(g)(i)(I).
---------------------------------------------------------------------------

    \568\ This estimate of 282 burden hours include 96 hours by an
Attorney, 96 hours by a Compliance Manager, 30 hours by a Senior
Systems Analyst, 30 hours by an Operations Specialist, 20 hours by a
Chief Compliance Officer and 10 hours by a Director of Compliance.
The Commission is basing this estimate on the estimated burden for
SCI entities, that participated in the ``ARP Inspection Program,''
to initially develop and draft the policies and procedures required
by Rule 1001(a) (except for the policies and procedures for
standards that result in systems being designed, developed, tested,
maintained, operated, and surveilled in a matter that facilitates
the successful collection, processing, and dissemination of market
data). See Regulation SCI Adopting Release, supra note 54 at 72377.
The Commission believes this comparison is appropriate because
Participants should already have some internal policies and
procedures that could be enhanced to comply with the new proposed
requirements of Section 6.5(g)(i).
---------------------------------------------------------------------------

    The Commission preliminarily estimates that the ongoing annual
burden of maintaining and reviewing the procedures and usage
restriction controls required by Section 6.5(g)(i), including by using
monitoring and testing protocols documented within the policies
pursuant to Section 6.5(g)(i)(J), and taking prompt action to remedy
deficiencies in such policies, procedures and usage restriction
controls as required by proposed Section 6.5(g)(ii), would be 87 burden
hours for each Participant,\569\ or 2,175 burden hours for all
Participants.\570\ The Commission preliminarily believes that this
estimation includes all ongoing reporting burdens associated with the
procedures and usage restriction controls required by Section
6.5(g)(i), such as the requirement to document each instance of access
by non-Regulatory Staff as proposed in Section 6.5(g)(i)(E) or the
requirement that Participants must be able to demonstrate that a
Participant's ongoing use of Programmatic CAIS and/or CCID Subsystem
access is in accordance with the Customer Identifying Systems Workflow
as proposed in Section 6.5(g)(i)(I). This estimation also includes the
hourly burden associated with proposed Section 6.5(g)(iii), which
requires each Participant, as reasonably practicable, and in any event
within 24 hours of becoming aware, report to the Chief Compliance
Officer, in accordance with the guidance provided by the Operating
Committee, any instance of noncompliance with the policies, procedures,
and usage restriction controls adopted by such Participant pursuant to
Section 6.5(g)(i).\571\
---------------------------------------------------------------------------

    \569\ This estimate of 87 hours includes 28 hours by an
Attorney, 28 hours by a Compliance Manager, 8 hours by a Senior
Systems analyst, 8 hours by an Operations Specialist, 10 hours by a
Chief Compliance Officer and 5 hours by a Director of Compliance.
This estimate of 87 hours annually is based on the estimated burden
for SCI entities, that participated in the ``ARP Inspection
Program,'' to review and update policies and procedures required by
Rule 1001(a) (except for the policies and procedures for standards
that result in systems being designed, developed, tested,
maintained, operated, and surveilled in a matter that facilitates
the successful collection, processing, and dissemination of market
data). See Regulation SCI Adopting Release, supra note 54, at 72377.
    \570\ 87 burden hours x 25 Participants = 2,175 burden hours.
    \571\ Proposed Section 6.5(g)(iii) also requires reporting of
any instance a Participant becomes aware of a breach of the security
of the CAT, but this obligation is a pre-existing obligation and not
a new information collection requirement. See CAT NMS Plan, supra
note 3, at Section 6.5(f)(iii).

---------------------------------------------------------------------------

Data Confidentiality Policies--Examination Report
    The Commission preliminarily believes that Participants will incur
annual hour burdens to comply with proposed Section 6.5(g)(v), which
the Commission preliminarily estimates to be 15 hours for each
Participant, or 375 hours for all Participants.\572\ The Commission
believes that this burden hour estimation includes the staff time
necessary to engage an independent accountant, staff time required to
allow the independent auditor to review compliance and prepare the
examination report and the staff time required to submit the
examination report to the Commission. The Commission believes that
proposed Section 6.5(g)(v) does not require Participants to review and
respond to the examination report, and only requires a Participant to
submit the prepared examination report to the Commission. However, the
Commission notes that such examination report may require Participants
to take action pursuant to proposed Section 6.5(g)(ii) or Section
6.5(g)(iii), including updating policies, procedures and usage
restrictions, but such burdens are accounted for in other areas of this
Paperwork Reduction Act analysis.\573\
---------------------------------------------------------------------------

    \572\ 15 hours x 25 Participants = 375 hours.
    \573\ See supra Part III.D.5.
---------------------------------------------------------------------------

    The Commission preliminarily estimates that the external cost of
compliance with Section 6.5(g)(v), which requires each Participant to
engage an independent accountant to perform an examination of
compliance with the policies required by Section 6.5(g)(i) and submit
the examination report to the Commission, would be $57,460 for each
Participant,\574\ or $1,436,500 for all Participants.\575\ The
Commission preliminarily believes that this would be the average cost
of engaging an independent accountant to perform the necessary
examination on an annual basis.
---------------------------------------------------------------------------

    \574\ The Commission is basing this estimate based on the number
of estimated hours of work by a Manager Internal Audit would be
required to comply with Rule 1003(b)(1) of Regulation SCI, which
requires each SCI entity to conduct an SCI review of its compliance
with Regulation SCI not less than once each calendar year, with
certain exceptions. See Regulation SCI Adopting Release, supra note
54, at 72391. Specifically, the Commission preliminarily estimates
it would require 170 hours by a Manager Internal Audit to perform
the examination. The preliminary estimated cost of engaging an
independent accountant to perform the examination of compliance and
submit an examination report is $57,460 (Manager Internal Audit at
$338 an hour for 170 hours).
    \575\ $57,460 x 25 Participants = $1,436,500.
---------------------------------------------------------------------------

8. Secure Connectivity--``Allow Listing''
    The Commission estimates that the proposed amendment to Appendix D,
Section 4.1.1 of the CAT NMS Plan, requiring the Plan Processor to
implement capabilities to allow access (i.e., ``allow list'') only to
those countries or more granular access points where CAT reporting or
regulatory use is both necessary and expected would result in an
initial, one-time aggregate external cost of $13,690 for the
Participants, or $547.60 for each Participant.\576\ This cost
represents expenses associated with Plan Processor staff time required
to develop the list of discrete access points that are approved for
use, which the Commission estimates would be 30 hours of staff
time.\577\ In addition, the Commission estimates that Participants will
incur an aggregate ongoing external cost burden of $1,226, or $49.04
for each Participant,\578\ for Plan Processor staff time required to
maintain and update the list of discrete access points, which the
Commission estimates would be 3 hours of staff time.\579\
---------------------------------------------------------------------------

    \576\ $13,690/25 Participants = $547.60 per Participant.
    \577\ The Commission preliminarily believes that creation of the
documentation necessary for ``allow listing'' could require legal
advice, discussions with staff familiar with CAT security and higher
level discussions and analysis. The estimated 30 hours of Plan
Processor staff time include 5 hours by an Attorney, 5 hours by an
Operations Specialist, 10 hours by the Chief Compliance Officer and
10 hours by the Chief Information Security Officer. The initial,
one-time aggregate cost for Participants is preliminarily estimated
to be $ = $13,690 (Attorney for 5 hours at $426 per hour = $2,130) +
(Operations Specialist for 5 hours at $140 per hour = $700) + (Chief
Compliance Officer for 10 hours at $543 per hour = $5,430) + (Chief
Information Security Officer for 10 hours at $543 per hour =
$5,430).
    \578\ $1,226/25 Participants = $49.04 per Participant.
    \579\ The Commission believes it is appropriate to estimate that
the Plan Processor staff time required to maintain and update the
list as approximately one-tenth the staff time required to initially
create the list. Specifically, the estimated aggregate ongoing
external cost is based on an estimate of 3 hours of Plan Processor
staff time include 1 hour by an Operations Specialist, 1 hour by the
Chief Compliance Officer and 1 hour by the Chief Information
Security Officer. The estimated aggregate ongoing external cost is
preliminarily estimated to be $1,226 = (Operations Specialist for 1
hour at $140) + (Chief Compliance Officer for 1 hour at $543) +
(Chief Information Security Officer for 1 hour at $543).
---------------------------------------------------------------------------

    The Commission estimates that the proposed requirement that the
Plan Processor develop policies and procedures to allow access if the
source location for a particular instance of access cannot be
determined technologically, as required by proposed Appendix D, Section
4.1.1 of the CAT NMS Plan, would require an aggregate one-time initial
external cost of $19,430 for the Participants, or $777.20 for each
individual Participant.\580\ This cost represents expenses associated
with Plan Processor staff time required to create these policies and
procedures, which the Commission estimates would be 50 hours of staff
time.\581\ Further, the Commission estimates that the Participants will
incur an aggregate ongoing external cost of $1,943, or $77.72 for each
individual Participant,\582\ for Plan Processor staff time required to
maintain, update and enforce these policies and procedures, which the
Commission estimates would be 5 hours of staff time.\583\
---------------------------------------------------------------------------

    \580\ $19,430/25 Participants = $777.20 per Participant.
    \581\ The estimate 50 hours of Plan Processor staff time include
10 hours by an Attorney, 10 hours by a Senior Systems Analyst, 10
hours by an Operations Specialist, 10 hours by the Chief Compliance
Officer and 10 hours by the Chief Information Security Officer. The
initial, one-time aggregate cost for Participants is preliminarily
estimated to be $19,430 = (Attorney for 10 hours at $426 per hour =
$4,260) + (Senior Systems Analyst for 10 hours at $291 per hour =
$2,910) + (Operations Specialist for 10 hours at $140 per hour =
$1,400) + (Chief Compliance Officer for 10 hours at $543 per hour =
$5,430) + (Chief Information Security Officer for 10 hours at $543
per hour = $5,430).
    \582\ $1,943/25 Participants = $77.72 per Participant.
    \583\ The Commission believes it is appropriate to estimate that
the Plan Processor staff time required to maintain, update and
enforce these policies and procedures should be approximately one-
tenth the staff time required to initially create these policies and
procedures. Specifically, the Commission estimates 5 hours of Plan
Processor staff time that includes 1 hour by an Attorney, 1 hour by
a Senior Systems Analyst, 1 hour by an Operations Specialist, 1 hour
by the Chief Compliance Officer and 1 hour by the Chief Information
Security Officer. The ongoing external cost is preliminarily
estimated to be $1,943 = (Attorney for 1 hour at $426) + (Senior
Systems Analyst for 1 hour at $291) + (Operations Specialist for 1
hour at $140) + (Chief Compliance Officer for 1 hour at $543) +
(Chief Information Security Officer for 1 hour at $543).
---------------------------------------------------------------------------

9. Breach Management Policies and Procedures
    The Commission preliminarily believes that the proposed changes to
Section 4.1.5 of the CAT NMS Plan creates new information collections
associated with revising, maintaining and enforcing the policies and
procedures and the cyber incident response plan in a manner consistent
with the proposed requirements of Section 4.1.5 and the breach
notification requirement.
    The Plan Processor is already required to establish policies and
procedures and a cyber incident response plan pursuant to Section 4.1.5
of the CAT NMS Plan, so the Commission believes it is appropriate to
estimate a burden of revising breach management policies and procedures
and the cyber incident response plan relate to the new

elements required by proposed Section 4.1.5 of the CAT NMS Plan. The
Commission preliminarily believes that these requirements would result
in a one-time external cost of $49,805 for Participants, or $1,992.20
per Participant,\584\ based on the Commission's estimation that it
would require approximately 124 Plan Processor staff hours to
incorporate the new elements required by proposed Section 4.1.5 of the
CAT NMS Plan.\585\ The Commission believes that there would be an
initial internal burden of 25 hours for the Participants, or 1 hour per
Participant \586\ for review and approval of the updated cyber incident
response plan by the Operating Committee.
---------------------------------------------------------------------------

    \584\ $49,805/25 Participants = $1,992.20 per Participant.
    \585\ The estimate of 124 hours of Plan Processor staff time
include 32 hours by an Attorney, 32 hours by a Compliance Manager,
10 hours by a Senior Systems Analyst, 10 hours by an Operations
Specialist, 20 hours by the Chief Compliance Officer and 20 hours by
the Chief Information Security Officer. The Commission is basing
this estimation on the estimated initial burden to implement
corrective action processes required by Rule 1002(a) of Regulation
SCI. See Regulation SCI Adopting Release, supra note 54, at 72393.
The total estimated one-time external cost for Participants is
$49,805 = (Attorney for 32 hours at $426 per hour = $13,631) +
(Compliance Manager for 32 hours at $317 per hour = $10,144) +
(Senior Systems Analyst for 10 hours at $291 per hour = $2,910) +
(Operations Specialist for 10 hours at $140 per hour = $1,400) +
(Chief Compliance Officer for 20 hours at $543 per hour = $10,860) +
(Chief Information Security Officer at $543 per hour = $10,860).
    \586\ 25 hours/25 Participants = 1 hour per Participant.
---------------------------------------------------------------------------

    Further, the Commission estimates that the Participants will incur
an aggregate ongoing external cost of $42,205, or $1,688.20 for each
individual Participant,\587\ for Plan Processor staff time required to
maintain, update and enforce these policies and procedures and the
cyber incident response plan, which the Commission estimates would be
103 hours of Plan Processor staff time annually.\588\ This external
cost estimate includes enforcement of the requirements of the cyber
incident response plan relating to the proposed breach notification
requirement,\589\ as well as staff time for documenting breaches that
the Plan processor reasonably estimates would have no impact or a de
minimis impact on the Plan Processor's operations or on market
participants.\590\
---------------------------------------------------------------------------

    \587\ $42,205/25 Participants = $1,688.20 per Participant.
    \588\ The estimated aggregate ongoing external cost is based on
an estimate of 103 hours of Plan Processor staff time that includes
23 hours by an Attorney, 23 hours by a Compliance Manager, 16 hours
by a Senior Systems Analyst, 3 hours by an Operations Specialist, 9
hours by an Assistant General Counsel, 17 hours by the Chief
Compliance Officer and 12 hours by the Chief Information Security
Officer. The Commission is basing this estimate on the ongoing
burden to implement corrective action processes required by Rule
1002(a) of Regulation SCI and estimated burden for providing written
notifications of Regulation SCI events under Rule 1002(b)(2). See
Regulation SCI Adopting Release, supra note 54 at 72384 and 72393-
94. The estimated aggregate ongoing external cost is preliminarily
estimated to be $42,205 = (Attorney for 23 hours at $426 per hour =
$9,798) + (Compliance Manager for 23 hours at $317 per hour =
$7,291) + (Senior Systems Analyst for 16 hours at $291 per hour =
$4,656) + (Operations Specialist for 3 hours at $140 per hour =
$420) + (Assistant General Counsel for 9 hours at $477 per hour =
$4,293) + (Chief Compliance Officer for 17 hours at $543 per hour =
$9,231) + (Chief Security Officer for 12 hours at $543 per hour =
$6,516).
    \589\ The Commission preliminarily estimates that this
requirement will require 34 hours of staff time annually from the
Plan Processor, resulting in an ongoing annual external cost burden
of $13,756 for the Participants, or $550.24 for each Participant
($13,756/25 Participants). The 34 hours include 8 hours by an
Attorney (Attorney for 8 hours at $426 an hour = $3,408), 8 hours by
a Compliance Manager (Compliance Manager for $317 an hour = $2,536),
7 hours by a Senior Systems Analyst (Senior Systems Analyst for 7
hours at $291 an hour = $2,037), 3 hours by an Assistant General
Counsel (Assistant General Counsel for 3 hours at $477 per hour =
$1,431), 4 hours by a Chief Compliance Officer (Chief Compliance
Officer for 4 hours at $543 per hour = $2,172) and 4 hours by the
Chief Information Security Officer (Chief Information Security
Officer for 4 hours at $543 per hour = $2,172) = $13,756. This
estimate relates only to the proposed requirement that the Plan
Processor provide breach notifications and does not include other
costs related to breaches, such as determination of whether a breach
has occurred or assessing the scope of any breach, which is already
required by the CAT NMS Plan.
    \590\ The Commission preliminarily estimates that this
requirement will require 30 hours of staff time annually from the
Plan Processor, resulting in an ongoing annual external cost of
$12,324 to the Participants, or $492.96 per Participant ($12,324/25
Participants). The 30 hours include 6 hours by an Attorney, 6 hours
by a Compliance Manager, 6 hours by a Senior Systems Analyst, 6
hours by an Assistant General Counsel, 3 hours by the Chief
Compliance Officer and 3 hours by the Chief Information Security
Officer. The ongoing external cost of this obligation is
preliminarily estimated to be $12,324 = (Attorney for 6 hours at
$426 per hour = $2,556) + (Compliance Manager for 6 hours at $317
per hour = $1,902) + (Senior Systems Analyst for 6 hours at $291 per
hour = $1,746) + (Assistant General Counsel for 6 hours at $477 per
hour = $2,862) + (Chief Compliance Officer for 3 hours at $543 per
hour = $1,629) + (Chief Information Security Officer for 3 hours at
$543 per hour = $1,629).
---------------------------------------------------------------------------

    Cumulatively, the Commission preliminarily estimates that to
implement the changes proposed in Section 4.1.5 of the CAT NMS Plan,
each Participant will incur an initial hourly burden of 1 hour, or 25
hours for all Participants, an initial one-time external cost burden of
$1,992.20, or $49,805 for all Participants, and an ongoing annual
external cost burden of $42,205 for all Participants, or $1,688.20 for
each individual Participant.\591\
---------------------------------------------------------------------------

    \591\ $42,205/25 Participants = $1,688.20 per Participant.
---------------------------------------------------------------------------

10. Customer Information for Allocation Report Firm Designated IDs
    The Commission preliminarily believes that this requirement is
already accounted for in the existing information collections burdens
associated with Rule 613 and the CAT NMS Plan Approval Order submitted
under OMB number 3235-0671.\592\ Specifically, the CAT NMS Plan
Approval Order takes into account requirements on broker-dealer members
to record and report CAT Data to the Central Repository in accordance
with specified timelines, including customer information.
---------------------------------------------------------------------------

    \592\ See, CAT NMS Plan Approval Order, supra note 3, at 84911-
43.
---------------------------------------------------------------------------

E. Collection of Information Is Mandatory

    Each collection of information discussed above would be a mandatory
collection of information.

F. Confidentiality of Responses to Collection of Information

    The Commission preliminarily believes that all information required
to be submitted to the Commission under the proposed amendments,
including the evaluation of the Plan Processor's performance under
proposed Section 6.6(b)(ii)(B)(3), the examination reports required by
proposed Section 6.5(g)(v), the application materials for non-SAW
environments as required under proposed Section 6.13(d), the annual
Regular Written Assessment of the Plan Processor under proposed Section
6.6(b)(ii)(A) and the application for Programmatic CAIS Access and
Programmatic CCID Subsystem Access under proposed Appendix D, Section
4.1.6 should be protected from disclosure subject to the provisions of
applicable law.\593\
---------------------------------------------------------------------------

    \593\ See, e.g., 5 U.S.C. 552 et seq.; 15 U.S.C. 78x (governing
the public availability of information obtained by the Commission).
---------------------------------------------------------------------------

    Public disclosure of other collections of information could raise
concerns about the security of the CAT and therefore the Commission
preliminarily believes that the Plan Processor and the Participants, as
applicable, would keep these materials confidential.\594\ Such

collections of information include the development of SAW-specific
provisions for the CISP and related policies, procedures, and security
controls required pursuant to proposed Section 6.13(a); the development
of the detailed design specifications required pursuant to proposed
Section 6.13(b)(i); the evaluation of each Participant's SAW and
related notification to the Operating Committee under proposed Section
6.13(b)(ii), the monitoring of SAWs and non-SAW environments and
notification of non-compliance events required by proposed Section
6.13(c)(i) and proposed Section 6.13(d)(iii); the collection of
application materials for an exception to the proposed SAW usage
requirements pursuant to proposed Section 6.13(d); the development of
policies and procedures for review of such applications and the
issuance of exceptions to the SAW usage requirements by the CISO and
the CCO pursuant to proposed Section 6.13(d); and the audit trail of
access to Customer Identifying Systems and the daily reports of users
entitled to access Customer Identifying Systems as required by the
proposed amendments to Section 4.1.6 of Appendix D.
---------------------------------------------------------------------------

    \594\ The Participants must comply with the security plan
developed by the Plan Processor pursuant to Appendix D, Section 4.1
of the CAT NMS Plan and any security-related policies and procedures
developed pursuant to Regulation SCI. See CAT NMS Plan, supra note
3, at Appendix D, Section 4.1 (requiring the Plan Processor to
provide to the Operating Committee a comprehensive security plan,
including a process for responding to security incidents and
reporting of such incidents); 17 CFR 242.1001 (requiring each SCI
entity to establish, maintain, and enforce written policies and
procedures reasonably designed to ensure that its SCI systems have
levels of security adequate to maintain operational capabilities and
promote the maintenance of fair and orderly markets). In some cases,
non-member invitees of the Security Working Group may be given
access to otherwise confidential information, but the Commission
believes that the CISO and the Operating Committee should consider
requiring any non-member invitees sign a non-disclosure agreement or
adhere to some other protocol designed to prevent the release of
confidential information regarding the security of the CAT System.
Members of the Security Working Group (and their designees) would be
subject to the confidentiality obligations set forth in Section 9.6
of the CAT NMS Plan.
---------------------------------------------------------------------------

    Finally, the policies required by proposed Section 6.5(g)(i) would
not be confidential. Rather, the proposed rule would require
Participants to make the policies required by Section 6.5(g)(i)
publicly available on each of the Participant websites, or collectively
on the CAT NMS Plan website, redacted of sensitive proprietary
information.

G. Retention Period for Recordkeeping Requirements

    National securities exchanges and national securities associations
would be required to retain records and information pursuant to Rule
17a-1 under the Exchange Act.\595\ The Plan Processor would be required
to retain the information reported to Rule 613(c)(7) and (e)(6) for a
period of not less than five years.\596\
---------------------------------------------------------------------------

    \595\ See 17 CFR 242.17a-1.
    \596\ See 17 CFR 242.613.
---------------------------------------------------------------------------

H. Request for Comments

    Pursuant to 44 U.S.C. 3506(c)(2)(B), the Commission solicits
comments to:
    175. Evaluate whether the proposed collections of information are
necessary for the proper performance of the functions of the agency,
including whether the information shall have practical utility;
    176. Evaluate the accuracy of our estimates of the burden of the
proposed collection of information;
    177. Determine whether there are ways to enhance the quality,
utility, and clarity of the information to be collected; and
    178. Evaluate whether there are ways to minimize the burden of
collection of information on those who are to respond, including
through the use of automated collection techniques or other forms of
information technology.
    Persons submitting comments on the collection of information
requirements should direct them to the Office of Management and Budget,
Attention: Desk Officer for the Securities and Exchange Commission,
Office of Information and Regulatory Affairs, Washington, DC 20503, and
should also send a copy of their comments to Secretary, Securities and
Exchange Commission, 100 F Street NE, Washington, DC 20549-1090, with
reference to File Number 4-698. Requests for materials submitted to OMB
by the Commission with regard to this collection of information should
be in writing, with reference to File Number 4-698 and be submitted to
the Securities and Exchange Commission, Office of FOIA/PA Services, 100
F Street NE, Washington, DC 20549-2736. As OMB is required to make a
decision concerning the collection of information between 30 and 60
days after publication, a comment to OMB is best assured of having its
full effect if OMB receives it within 30 days of publication.

IV. Economic Analysis

    Section 3(f) of the Exchange Act requires the Commission, whenever
it engages in rulemaking and is required to consider or determine
whether an action is necessary or appropriate in the public interest,
to consider, in addition to the protection of investors, whether the
action would promote efficiency, competition, and capital
formation.\597\ In addition, Section 23(a)(2) of the Exchange Act
requires the Commission, when making rules under the Exchange Act, to
consider the impact such rules would have on competition.\598\ Exchange
Act Section 23(a)(2) prohibits the Commission from adopting any rule
that would impose a burden on competition not necessary or appropriate
in furtherance of the purposes of the Exchange Act. The discussion
below addresses the likely economic effects of the proposed rule,
including the likely effect of the proposed rule on efficiency,
competition, and capital formation.
---------------------------------------------------------------------------

    \597\ 15 U.S.C. 78c(f).
    \598\ 15 U.S.C. 78w(a)(2).
---------------------------------------------------------------------------

    The Commission is proposing amendments to the CAT NMS Plan that
would (1) define the scope of the current information security program;
(2) require the Operating Committee to establish and maintain a
security-focused working group; (3) require the Plan Processor to
create SAWs, direct Participants to use such workspaces to access and
analyze PII and CAT Data obtained through the user-defined direct query
and bulk extract tools described in Section 6.10(c)(i)(B) of the CAT
NMS Plan, set forth requirements for the data extraction, security,
implementation and operational controls that will apply to such
workspaces, and provide an exception process that will enable
Participants to use the user-defined direct query and bulk extract
tools in other environments; (4) limit the amount of CAT Data that can
be extracted from the Central Repository outside of a secure analytical
workspace through the online targeted query tool described in Section
6.10(c)(i)(A) of the CAT NMS Plan and require the Plan Processor to
implement more stringent monitoring controls on such data; (5) impose
requirements related to the reporting of certain PII; (6) define the
workflow process that should be applied to govern access to customer
and account attributes that will still be reported to the Central
Repository; (7) modify and supplement existing requirements relating to
Participant policies and procedures regarding the confidentiality of
CAT Data; (8) refine the existing requirement that CAT Data be used
only for regulatory or surveillance purposes; (9) codify existing
practices and enhance the security of connectivity to the CAT
infrastructure; (10) require the formal cyber incident response plan to
incorporate corrective actions and breach notifications; (11) amend
reporting requirements relating to Firm Designated IDs and Allocation
Reports; and (12) clarify that Appendix C of the CAT NMS Plan has not
been updated to reflect subsequent amendments to the CAT NMS Plan.

A. Analysis of Baseline, Costs and Benefits

    The Commission preliminarily believes the proposed amendments would
improve the security of CAT Data through a number of mechanisms. The
amendments are likely to reduce the attack surface of CAT by further
limiting the extraction of CAT Data beyond the security perimeter of
the CAT System. In addition, the proposed amendments may increase the
uniformity of security monitoring across environments from which CAT
Data is accessed and analyzed by facilitating centralized monitoring by
the Plan Processor. In addition, the Commission preliminarily believes
that provisions allowing for exceptions to the SAW usage requirement
may allow Participants to achieve or maintain the security standards
required by the CAT NMS Plan more efficiently. Additional effects upon
efficiency and competition are discussed in Part IV.B.
    The Commission preliminarily believes that provisions of the
proposed amendments outside of the SAW use requirement will result in
one-time costs of approximately $2.0MM.\599\ In addition, these
provisions of the proposed amendments would result in ongoing annual
costs of approximately $5.9MM.\600\ The Commission also preliminarily
estimates that depending on the number of Participants that choose to
work within SAWs, the SAW or exception requirement will entail $4.9MM
to $61.6MM in initial costs and $4.7MM to $32.8MM in ongoing annual
costs. These costs are summarized in Table 1 and Table 2 \601\ below,
and discussed further in the sections that follow.
---------------------------------------------------------------------------

    \599\ ($1,165,400 + $812,300) = $1,977,700.
    \600\ ($3,613,800 + $1,451,500 + $869,200) = $5,934,500.
    \601\ See infra Part IV.A.3.

                               Table 1--Summary of Costs Other Than SAW Costs ($)
----------------------------------------------------------------------------------------------------------------
                                                           Participants                   Plan Processor
                    Activity                     ---------------------------------------------------------------
                                                       Labor         External          Labor         External
----------------------------------------------------------------------------------------------------------------
Initial
    OTQT logging................................  ..............  ..............          88,000  ..............
    CAIS programmatic access....................  ..............  ..............         620,200  ..............
    Policies and procedures.....................       1,155,900          50,000          10,900  ..............
    Regulator and Plan Processor access.........  ..............  ..............          10,300  ..............
    Secure connectivity.........................  ..............  ..............          33,100  ..............
    Breach management policies and procedures...           9,500  ..............          49,800  ..............
                                                 ---------------------------------------------------------------
        Total One-Time Costs....................       1,165,400  ..............         812,300  ..............
----------------------------------------------------------------------------------------------------------------
Annual
    CISP........................................         106,400           9,000         129,900  ..............
    Security Working Group......................       2,056,600  ..............         310,000  ..............
    OTQT logging................................         970,200  ..............           5,100  ..............
    Customer Identifying Systems Workflow.......  ..............  ..............         373,500  ..............
    Policies and procedures.....................         480,600       1,442,500           5,400  ..............
    Secure connectivity.........................  ..............  ..............           3,100  ..............
    Breach management policies and procedures...  ..............  ..............          42,200  ..............
                                                 ---------------------------------------------------------------
        Total ongoing annual costs..............       3,613,800       1,451,500         869,200  ..............
----------------------------------------------------------------------------------------------------------------

1. CISP
    In Section 6.12, the Plan requires the Plan Processor to develop
and maintain an information security program for the Central
Repository. Section 4 of Appendix D sets out information security
requirements that cover ``all components of the CAT System'' and is not
limited to the Central Repository.\602\
---------------------------------------------------------------------------

    \602\ See supra Part II.A.
---------------------------------------------------------------------------

    To more explicitly define the scope of the information security
program referenced in Section 6.12, the proposed amendments would
define the term ``Comprehensive Information Security Program'' \603\
(CISP) to encompass the Plan Processor and the CAT System, including
any systems provided or managed by external contractors, organizations
or other sources. Additionally, the scope of the CISP would include the
SAWs.\604\
---------------------------------------------------------------------------

    \603\ ``Comprehensive Information Security Program'' includes
the organization-wide and system-specific controls and related
policies and procedures required by NIST SP 800-53 that address
information security for the information and information systems
that support the operations of the Plan Processor and the CAT
System, including those provided or managed by an external
organization, contractor, or source, inclusive of Secure Analytical
Workspaces. See supra Part II.A.
    \604\ Id.
---------------------------------------------------------------------------

    The Commission preliminarily believes that the benefit of this
provision of the proposed amendments is a potential improvement to the
efficiency of CAT implementation by specifically defining the scope of
the information security program required by the CAT NMS Plan to the
extent that the Participants did not understand that these requirements
applied to the Plan Processor, the entire CAT System, and external
parties. Section 6.12 of the CAT NMS Plan requires the Plan Processor
to develop and maintain an information security program for the Central
Repository that, at a minimum, meets the security requirements set
forth in Section 4 of Appendix D to the CAT NMS Plan.\605\ If
Participants do not apply the Plan Processor's information security
program to the Plan Processor and the entire CAT System, including any
components of the CAT System managed by external providers, the
proposed amendments may increase the efficiency by which the CAT is
implemented by preventing Participants from investing in initial
implementations that do not meet CAT NMS Plan requirements.
---------------------------------------------------------------------------

    \605\ See supra Part II.A.
---------------------------------------------------------------------------

    The proposed amendments would newly require the CCO to evaluate
elements of the CISP that relate to SAWs as part of the regular written
assessment and, in collaboration with the CISO, to include a review of
the quantity and type of CAT Data extracted from the CAT System to
assess the security risk

of permitting such CAT Data to be extracted.\606\ The Commission
preliminarily believes that the Plan Processor \607\ will incur
expenses of $129,900 \608\ annually to execute this requirement.
---------------------------------------------------------------------------

    \606\ See supra Part III.D.1.
    \607\ Costs attributed to the Plan Processor will be passed on
to Participants and Industry Members according to a fee schedule
that has not yet been approved by the Commission. See CAT NMS Plan,
supra note 3, at Section 11.3.
    \608\ See supra note 489.
---------------------------------------------------------------------------

    The Plan provides for the Participants to review and comment on the
regular written assessment provided by the Plan Processor.\609\ The
proposed amendments newly require the CCO to evaluate the CISP, which
includes SAWs, as part of the regular written assessment which the
Participants must review each year.\610\ The Commission preliminarily
believes that Participants that are part of a larger exchange group
will perform this task at the group (``Participant Group'') level of
organization because doing so will reduce duplication of effort.\611\
The Commission preliminarily believes that Participants would spend
$106,400 \612\ in labor costs to perform this review, as well as
incurring $9,000 in external legal costs in performing this review and
providing comments upon it.
---------------------------------------------------------------------------

    \609\ Id.
    \610\ See supra Part II.A.
    \611\ See infra Part IV.B.1 for a discussion of organization of
exchanges into groups. There are nine Participant Groups. Four of
these groups operate a single exchange while four control multiple
exchanges. FINRA, the sole national securities association,
comprises the final Participant Group.
    \612\ Throughout this Economic Analysis, the Commission derives
estimated costs associated with staff time based on per hour figures
from SIFMA's Management & Professional Earnings in the Securities
Industry 2013, modified by Commission staff to account for an 1800-
hour work-year, and multiplied by 5.35 to account for bonuses, firm
size, employee benefits and overhead, and adjusted for inflation
based on Bureau of Labor Statistics data on CPI-U between January
2013 and January 2020 (a factor of 1.12). Labor costs include 15
hours of attorney labor and 10 hours of chief compliance officer
labor per Participant Group. (15 hours x $426/hour + 10 hours x
$543/hour) = $11,820. ($11,820 per group x 9 groups) = $106,380.
($1,000 per group x 9 groups) = $9,000.
---------------------------------------------------------------------------

2. Security Working Group
    Although the Plan does not require formation of a Security Working
Group, the Operating Committee has established such a group, which
currently includes the CISO, and chief information security officers
and/or other security experts from each Participant.\613\ The extant
Security Working Group makes recommendations to the Operating Committee
regarding technical issues related to the security of the CAT, but has
no formal charter or mandate outlining its responsibilities or ensuring
its continued existence.
---------------------------------------------------------------------------

    \613\ See https://www.catnmsplan.com/sites/default/files/2020-01/FINRA-CAT-Security-Approach-Overview_20190828.pdf.
---------------------------------------------------------------------------

    To provide support and additional resources to the CISO, the
proposed amendments would require the Operating Committee to establish
and maintain a security working group composed of the CISO and the
chief information security officer or deputy chief information security
officer of each Participant.\614\ Currently, the Plan does not include
a requirement for the Security Working Group. The Plan also does not
require that the membership of this group will have a sufficient level
of security expertise. Further, without language in the Plan describing
the group's role, there is no requirement that the group will
participate in decisions that will affect CAT Data security, such as in
evaluating exception requests. Consequently, the Commission
preliminarily believes that the degree to which this group will improve
decisions affecting CAT Data at present and in the future is uncertain.
The Commission preliminarily believes that the provisions of the
proposed amendments that codify the existence of the Security Working
Group and describe its role will improve the security of CAT Data in
several ways.
---------------------------------------------------------------------------

    \614\ See supra Part II.B.
---------------------------------------------------------------------------

    First, although a security working group has been established by
the Participants already, its existence is not codified in the Plan.
Including these provisions in the Plan will assure the group's
continued activity.
    Second, the Commission preliminarily believes that these proposed
amendments may improve CAT Data security because they provide the
Security Working Group with a broad mandate to advise the CISO and the
Operating Committee on critical security-related issues. Further,
defining the membership of the Security Working Group may improve the
quality of recommendations emanating from the Security Working Group,
as the group already established by the Operating Committee does not
currently require the participation of the chief information security
officer or deputy chief information security officer of each
Participant. The proposed amendments also permit the CISO to invite
non-Security Working Group members to attend. Including subject matter
experts outside of the Participants and Plan Processor that are
knowledgeable about security may broaden or deepen the level of
expertise brought to bear.
    Because the Security Working Group is not required by the Plan, the
Plan has no defined role as it would under the proposed amendments. For
example, the proposed amendments require that the Security Working
Group advise the CISO and the Operating Committee with information
technology matters that pertain to the development of the CAT System.
Such issues are likely to be complex and technical. To the extent that
the proposed amendments result in the involvement of a range of
individuals with expertise in assessing organizational-level security
issues for complex information systems, the proposed amendments may
result in additional security issues being considered and considered
more thoroughly by the CISO and Operating Committee.
    The Commission preliminarily believes however, that there are
potential conflicts of interest in involving the Security Working Group
in the review of certain issues. For example, the proposed amendments
call for the members of the Security Working Group (and their
designees) to receive application materials for exceptions to the
requirement that Participants use Plan Processor provided SAWs to
access and analyze CAT Data using the user defined direct query tool
and bulk extract tools. To the extent that the Participant members of
the Security Working Group (and their designees) also plan to obtain or
maintain exceptions to the SAW requirement, they may be less critical
of other Participants' application materials. Alternatively, to the
extent that Participant members of the Security Working Group (and
their designees) plan to use the Plan Processor's SAWs, they may be
more critical of other Participants' exception application materials.
Competitive relationships between Participants may also affect how
Security Working Group members (and their designees) evaluate such
applications. The Commission preliminarily believes that this concern
is largely mitigated by its preliminary belief that Participants will
adopt a variety of approaches to complying with the SAW usage
requirement,\615\ so reviews of these application materials are likely
to reflect a variety of viewpoints. To the extent that Participants'
decisions do not reflect a variety of approaches, the Commission
recognizes that the potential conflicts of interest may be more
pronounced. Furthermore, the exception application procedure does not
require a vote of the Security Working Group, so the

Commission preliminarily believes that in the Security Working Group's
advisory role to the CISO and Operating Committee, a conflict of
interest in providing feedback on a competitor's SAW exception
application is less likely to be a significant factor in a
Participant's ability to secure an exception. Finally, the Commission
believes that the Participants are incentivized to avoid security
problems in all environments from which CAT Data is accessed and
analyzed. Consequently, the Commission preliminarily believes that even
if exceptions are widely sought by Participants, their Security Working
Group members are likely to bring forward any problems they identify in
their review of exception application materials because a data breach
concerning CAT Data irrespective of its source is likely to be costly
to all Participants both in remediation costs and reputation.
---------------------------------------------------------------------------

    \615\ See infra Part IV.A.3.a.
---------------------------------------------------------------------------

    The Commission preliminarily estimates Participants will incur
costs of approximately $2,056,600 \616\ annually to comply with
provisions of the proposed amendments related to participation in the
Security Working Group. In addition, requiring the Plan Processor CISO
to keep the Security Working Group apprised of relevant developments,
to provide it with all information and materials necessary to fulfill
its purpose, and to prepare for and attend meetings of the Security
Working Group will cause the Plan Processor to incur approximately
$310,000 \617\ per year in labor costs.
---------------------------------------------------------------------------

    \616\ The proposed amendments require the CISO to participate in
the Security Working Group. Because the Participants have already
formed a security working group that the Commission preliminarily
believes meets weekly, some of the labor costs associated with this
group are in the baseline. To estimate the costs attributable to the
proposed amendments, the Commission assumes that on average the
current security working groups' participants have hourly labor
rates equivalent to a Compliance Manager ($317 per hour). To the
extent that the current Security Working Group participants have
hourly labor rates that are greater than this rate, the estimated
additional costs of the amendments would be reduced. Consequently,
the Commission preliminarily estimates that the incremental hourly
labor cost of the proposed amendments would the difference between
the estimated hourly rate of the CISO and a Compliance Manager
($543/hour-$317/hour) = $226 per hour. For the CISO hourly rate
calculations, the Commission uses the hourly rate for Chief
Compliance Officer. 7 hours per week x 52 weeks = 364 hours of CISO
labor per Participant. (364 hours per Participant x 25 Participants
x $226/hour) = $2,056,600.
    \617\ See supra note 495.
---------------------------------------------------------------------------

3. Secure Analytical Workspaces
    The Commission understands that the Participants have recently
authorized the Plan Processor to build analytic environments for the
Participants.\618\ Use of such environments is currently optional; the
Participants are not required to use the analytic environments built by
the Plan Processor when accessing and analyzing Customer and Account
Attributes and, without the proposed amendments, could continue to
access large amounts of CAT Data outside of these controlled
environments.\619\ The Commission also understands that the security
controls for these analytic environments would not be implemented by
one centralized party. Rather, each Participant would be responsible
for the selection and implementation of security controls for its own
analytic environment(s).\620\
---------------------------------------------------------------------------

    \618\ See Simon Letter, supra note 52, at 4-5.
    \619\ See id.
    \620\ See id.
---------------------------------------------------------------------------

    The central repository is hosted in an Amazon Web Services
(``AWS'') cloud environment.\621\ The Commission is aware of two
Participant Groups that have presences in this environment.\622\
---------------------------------------------------------------------------

    \621\ See https://aws.amazon.com/blogs/publicsector/finra-cat-selects-aws-for-consolidated-audit-trail/.
    \622\ See http://technology.finra.org/articles/video/trade-analytics-and-surveillance-on-aws.html and https://aws.amazon.com/solutions/case-studies/nasdaq-data-lake/.
---------------------------------------------------------------------------

    The CAT NMS Plan requires that the Plan Processor CISO ``review the
information security policies and procedures of the Participants that
are related to the CAT to ensure that such policies and procedures are
comparable to the information security policies and procedures
applicable to the Central Repository.'' \623\ If the CISO finds that a
Participant is not meeting this standard and if the deficiency is not
promptly addressed, the CISO, in consultation with the CCO, is required
by the CAT NMS Plan to notify the Operating Committee. Consequently,
security within the Participants' analytic environments that access CAT
Data is expected to be comparable to that of the Central Repository.
---------------------------------------------------------------------------

    \623\ See CAT NMS Plan, supra note 3 at Section 6.2(b)(vii).
---------------------------------------------------------------------------

    The Commission preliminarily believes that provisions of the
proposed amendments that require Participants to work within SAW or
non-SAW environments that have been granted an exception for the
proposed SAW usage requirements set forth in proposed Section
6.13(a)(i)(B) (``Excepted Environments'') would provide a number of
benefits. First, to the extent that the Plan Processor implements
common security controls for SAWs more uniformly than they would be
under the current approach, wherein each Participant would be allowed
to implement selected security controls for its own analytic
environment(s), security may improve by reducing variability in
security control implementation, potentially preventing relatively
weaker implementations. Second, because implementation of common
security controls will be uniform, the proposed amendments may increase
the ability of the Plan Processor to conduct centralized and uniform
monitoring across all environments from which CAT Data is accessed and
analyzed. Third, the Commission preliminarily believes that exceptions
to the proposed SAW usage requirements may allow Participants to
achieve or maintain the security standards required by the Plan more
efficiently. Fourth, the Commission preliminarily believes that
provisions in the proposed amendments that provide for a third-party
annual review process for the continuance of any exceptions that are
granted would provide a procedure and timeline for remedying security
deficiencies in Excepted Environments.
    Finally, to the extent that policies and procedures governing data
security \624\ are less rigorous in application than the security
provisions for SAWs in the proposed amendments, data downloaded to SAWs
would be more secure than it might be in other analytic environments
permitted under the CAT NMS Plan.
---------------------------------------------------------------------------

    \624\ See supra text accompanying note 623.
---------------------------------------------------------------------------

    As discussed below, each Participant will choose whether to access
CAT Data from the Plan Processor provided SAW accounts or to obtain an
exception from the SAW usage requirement.\625\ The Commission cannot
predict how each Participant will approach this decision, but it
preliminarily believes approaches will vary across Participants due to
differences in size, operations, use of RSAs and 17d-2 agreements to
satisfy regulatory responsibilities, current AWS cloud presence, and
membership in a Participant Group that controls multiple exchanges.
Consequently, in its cost estimates the Commission includes the Plan
Processor's costs of designing and implementing the SAWs, but estimates
ongoing operational costs to the Participants as a range. At one end of
the range, the Commission assumes that all Participants obtain
exceptions to the SAW usage requirements. At the other end, the
Commission assumes that all Participants work within the Plan
Processor's SAWs.
---------------------------------------------------------------------------

    \625\ See infra Part IV.A.3.a.
---------------------------------------------------------------------------

    The Commission recognizes that the costs the Participants incur due
to the requirements of the proposed amendment is likely an overestimate

because the Commission is unable to identify costs included in the
analysis that would be incurred in the absence of the proposed
amendments. For example, some Participants would likely work in the
Plan Processor's planned analytic environments without the proposed
amendments. For those Participants, some of the costs they incur to
implement their operations within the SAWs under the proposed
amendments would be incurred in the baseline case, as would at least
some of their ongoing costs of using SAWs. Similarly, the Plan
Processor's costs to implement SAWs under the proposed amendments may
include costs that would have been incurred to implement similar
analytic environments without the proposed amendments.
    The Commission further believes that this range does not encompass
the costs that Participants incur to perform their regulatory duties
using CAT Data because Participants that seek exceptions will perform
those duties in another manner, such as by working within their current
analytic environments or through RSAs and 17d-2 agreements. Both of
those approaches carry costs, but those costs are not consequences of
the proposed amendments because the Participants currently perform
their regulatory duties in a non-SAW environment. Consequently, those
costs are part of the baseline.
    Table 2 presents a summary of estimated costs for compliance with
the proposed amendments' requirement that Participants work within a
Plan Processor provided SAW or obtain an exception. The table
summarizes $274,600 \626\ in initial base costs and $860,200 in ongoing
annual base costs that are required to develop and implement the SAWs;
these costs must be incurred regardless of whether any Participants
choose to work within SAWs. The table then presents marginal costs for
all Participants working within SAWs versus all Participants working
within Excepted Environments. The Commission preliminarily estimates a
range of costs for the SAW or exception requirements.\627\ All
Participants working within a SAW would entail $61.6MM \628\ in initial
costs and $32.8MM \629\ in ongoing annual costs including base costs.
All Participants working in Excepted Environments would entail $4.9MM
\630\ in initial costs and $4.7MM \631\ in ongoing annual costs. These
costs are broken down and discussed further in the sections that
follow.
---------------------------------------------------------------------------

    \626\ $200,600 + $74,000 = $274,600.
    \627\ It is possible that this range may overestimate the costs
Participants incur if some Participants can comply with the proposed
amendments at a lower cost by employing 17d-2 or RSAs to avoid
obtaining an exception or contracting for a SAW.
    \628\ ($61,200,200 + $167,000 + $200,600 + $74,000) =
$61,641,600.
    \629\ ($19,000,000 + $12,900,000 + $860,200) = $32,760,200.
    \630\ ($1,289,600 + $2,250,000 + $1,048,800 + $200,600 +
$74,000) = $4,863,000.
    \631\ ($417,400 + $2,250,000 + $1,160,100 + $860,200) =
$4,687,700.

                               Table 2--Costs for SAW or Exception Requirement ($)
----------------------------------------------------------------------------------------------------------------
                                                           Participants                   Plan processor
                    Activity                     ---------------------------------------------------------------
                                                       Labor         External          Labor         External
----------------------------------------------------------------------------------------------------------------
Initial base costs
    Incorporate SAW requirements into CISP......  ..............  ..............          89,000          27,000
    Develop detailed design specifications for    ..............  ..............          56,200          47,000
     SAWs.......................................
    Provide Participants with detailed design     ..............  ..............           3,000  ..............
     specifications.............................
    Develop automated monitoring systems........  ..............  ..............          52,400  ..............
                                                 ---------------------------------------------------------------
        Total base initial costs................  ..............  ..............         200,600          74,000
----------------------------------------------------------------------------------------------------------------
Annual Base Costs
    Maintain and monitor CISP SAW requirements..  ..............  ..............          56,600  ..............
    Maintain detailed design specifications.....  ..............  ..............          48,300  ..............
    Additional costs for third party annual       ..............  ..............         150,000  ..............
     audit......................................
    Maintain automated monitoring systems and     ..............  ..............         605,300  ..............
     monitor....................................
                                                 ---------------------------------------------------------------
        Total base annual costs.................  ..............  ..............         860,200  ..............
----------------------------------------------------------------------------------------------------------------
                                  Additional Costs for All Participants in SAWs
----------------------------------------------------------------------------------------------------------------
Initial.........................................
    Technical development costs.................      39,500,000  ..............  ..............
    Evaluate nine SAWs for compliance...........  ..............  ..............         167,000  ..............
    SAW operations implementation costs.........      21,700,000  ..............  ..............  ..............
                                                 ---------------------------------------------------------------
        Total Additional Initial Costs..........      61,200,000  ..............         167,000  ..............
----------------------------------------------------------------------------------------------------------------
Annual..........................................
    SAW usage costs.............................  ..............      12,900,000  ..............  ..............
    Technical maintenance costs.................      19,000,000  ..............  ..............  ..............
                                                 ---------------------------------------------------------------
        Total Annual Additional Costs...........      19,000,000      12,900,000  ..............  ..............
----------------------------------------------------------------------------------------------------------------
                                 Additional Costs for All Participants Excepted
----------------------------------------------------------------------------------------------------------------
Additional Initial Costs........................       1,289,600       2,250,000       1,048,800  ..............
Additional Ongoing Costs........................         417,400       2,250,000       1,160,100  ..............
----------------------------------------------------------------------------------------------------------------

a. SAW Versus Exception Decisions
    Under the proposed amendments, each Participant will be required to
limit some of its use of CAT Data to SAWs provided by the Plan
Processor unless it obtains an exception to certain SAW usage
requirements.\632\ Consequently, each Participant will likely meet its
regulatory obligations using one or more of three approaches. First,
the Participant may decide to use the Plan Processor provided SAWs that
would be established under the proposed amendments. Second, the
Participant may decide to apply for an exception to allow it to use a
different analytic environment to access and analyze CAT Data. Third,
the Participant may decide to employ a 17d-2 or RSA to discharge its
regulatory responsibilities. Each of these potential approaches has
direct and indirect costs to the Participant that are discussed below.
---------------------------------------------------------------------------

    \632\ Participants will be able to use the online direct query
tool from their own analytic environments under certain
restrictions, but the number of records of CAT Data they extract,
and their access to Customer Information, would be limited for this
manner of access. See supra Part II.C and Part II.D.
---------------------------------------------------------------------------

    In the first approach, a Participant may elect to use a SAW
provided by the Plan Processor. The costs of operating and maintaining
this SAW would be paid by the Participant, and the magnitude of these
costs would be dependent on the resources used by the Participant
within the SAW.\633\ If a Participant adopts this approach, it may have
lower expenses associated with maintaining its private analytic
environment. However, to the degree that the Participant currently uses
IT resources that it also uses for operational activities to perform
its regulatory activities, this may create inefficiencies because those
resources may be less utilized during hours when operational demands
are lower, such as when exchanges are not operating, if it performs
regulatory activities in the SAW. Under this approach, to the degree
that the lack of excess operational resources limit the Participant's
ability to perform its regulatory activities in-house, the Participant
may be able to insource more of its regulatory activities when working
in the SAW, reducing its dependence on and costs associated with 17d-2s
and RSAs.\634\ Utilizing a SAW may also open competitive opportunities
to the Participant to perform regulatory services for other
Participants within its SAW.\635\ Moving regulatory activities to the
SAW is likely to entail significant implementation costs: the
Participant would need to develop or license analytic tools for that
environment or adapt its current analytical tools to that environment,
and train its regulatory staff in using the SAW environment. The
Commission preliminarily believes this approach is more likely to be
adopted by Participants in Participant Groups that operate multiple
exchanges because these costs might be spread over more exchanges,\636\
and by Participants that already have a significant cloud presence
because their implementation costs would likely be lower than those for
a Participant that did not have a cloud presence.
---------------------------------------------------------------------------

    \633\ The estimated costs of SAWs are discussed further below.
    \634\ RSAs are discussed further below.
    \635\ See infra Part IV.B.1.
    \636\ Participants that operate multiple exchanges often have
commonalities in data structures and rules across their exchanges
that allow economies of scale in performing regulatory activities.
---------------------------------------------------------------------------

    In the second approach, a Participant may apply to use a private
analytical environment through the exception procedure. In this
approach, the Participant would incur costs to document that its
private analytic environment meets the security requirements of the
proposed amendments, and to adapt its analytic tools to those
requirements. Further, the Participant would incur costs associated
with applying for and obtaining the exception, and complying with
annual renewal requirements. The Participant may also encounter certain
inefficiencies in accessing CAT Data to the extent that download speeds
between the Central Repository and the private analytic environment are
inferior to those within the SAW.\637\ A Participant that adopts this
approach may also choose to change the scope of its use of 17d-2s and
RSAs as a provider or user of regulatory services through such
agreements. For example, a Participant may choose to pursue an
exception to the SAW use requirement and add additional 17d-2 and RSA
coverage for functions that are more difficult to perform within its
private analytic environment. Alternatively, there may be analytic
tools that are more efficient to use outside of SAWs, allowing a
Participant to provide regulatory services to other Participants that
would be less efficient to provide in the SAWs. The Commission
preliminarily believes this approach is more likely to be adopted by
Participants that have a significant investment in private analytic
workspaces, and proprietary tools for regulatory activities that are
optimized for those workspaces.
---------------------------------------------------------------------------

    \637\ See infra Part IV.B.2.
---------------------------------------------------------------------------

    In the third approach, a Participant would change its use of RSAs
and 17d-2 agreements to avoid using a SAW or obtaining an exception to
the SAW use requirement. This approach is likely to increase a
Participant's expenses associated with RSAs and 17d-2 agreements, but
may allow a Participant to avoid SAW expenses entirely. It is possible
that even with maximal use of RSAs and 17d-2 agreements, a Participant
may want to perform some regulatory functions that would not be
possible with only use of the online targeted query tool. In this case,
a minimal SAW would also have to be supported if the Participant did
not wish to seek an exception to the SAW use requirement. The
Commission preliminarily believes that this approach is most likely to
be adopted by Participants that operate a single venue, and
Participants that currently outsource much of their regulatory
activities to other Participants. The Commission recognizes it is
possible that many Participants will take this approach considering
that many Participants make broad use of RSAs and 17d-2 agreements to
discharge their regulatory responsibilities.
    Finally, the Commission recognizes that a Participant may take a
mixed approach to this decision. A Participant may elect to use the SAW
for some regulatory activities, and outsource other activities that
would significantly increase its use of resources in the SAW, and thus
its costs of using the SAW. It is also possible that a Participant may
choose to invest heavily in the SAW to compete in the market for
regulatory services as an RSA provider, while also obtaining an
exception to the SAW use requirement to allow it to capitalize on its
current infrastructure.
b. Amendments for SAWs
    The Commission is proposing amendments to the CAT NMS Plan that
will require (1) the provision of SAW accounts; (2) data access and
extraction policies and procedures, including SAW usage requirements;
(3) security controls, policies, and procedures for SAWs; (4)
implementation and operational requirements for SAWs.\638\ The
Commission preliminarily believes that the proposed amendments may
improve the security of CAT Data in two ways.
---------------------------------------------------------------------------

    \638\ See supra Part II.C.
---------------------------------------------------------------------------

    First, to the extent that CISP security controls are implemented
more uniformly than they would be under the CAT NMS Plan, security may
improve

by reducing variability in security control implementation.\639\
Currently, each Participant would be responsible for implementing
security controls in their analytic environments and their approaches
are likely to vary if each Participant designs those implementations to
accommodate their current operations and analytic environments. This
variability might result in some environments being more secure than
others.\640\ To the extent that having the Plan Processor provide SAWs
that implement common security controls reduces this variability,\641\
these provisions may increase CAT Data security by preventing
relatively weaker implementations. The Commission recognizes it is also
possible that the Plan Processor's implementation might be relatively
less secure than an implementation designed by an individual
Participant under the current CAT NMS Plan. The Commission
preliminarily believes these provisions should improve security by
reducing the variability of implementations as long as the Plan
Processor's implementation of common security controls is relatively
secure compared to other possible approaches. Further, the Commission
preliminarily believes that the requirement that the Plan Processor
must evaluate and notify the Operating Committee that each
Participant's SAW has achieved compliance with the detailed design
specifications before that SAW may connect to the Central Repository
will further increase uniformity of security control
implementations.\642\
---------------------------------------------------------------------------

    \639\ See supra Part II.C.3.
    \640\ The Commission preliminarily believes that different
environments that satisfy the CISP might vary in their overall level
of security due to differences in implementation, third-party
software and policies and procedures for monitoring the security of
the environments. To the extent that a bad actor would focus an
incursion attempt upon the least secure environment, reducing
variability between environments may improve CAT Data security by
reducing vulnerabilities within environments from where CAT Data is
accessed and analyzed.
    \641\ See supra Part II.C.1.
    \642\ See supra Part II.C.4
---------------------------------------------------------------------------

    Second, the proposed amendments may increase the uniformity of
security monitoring across all environments from which CAT Data is
accessed and analyzed.\643\ By assigning this duty to a single entity,
the Plan Processor, and making provisions for the uniformity of this
monitoring through detailed design specifications, the proposed
amendments may enhance the security of CAT Data by ensuring that
security monitoring is uniform. Currently under the CAT NMS Plan, most
security monitoring of environments other than the Central Repository
would fall to the Participants that controlled those environments.\644\
To the extent that the rigor of this monitoring and the manner in which
requirements were implemented varied across Participants and the Plan
Processor, some environments might be more robustly monitored than
others, potentially delaying the identification of security issues
within less robustly monitored environments. In addition, having a
single entity perform this security monitoring may improve its quality
by facilitating development of expertise of the single entity
performing the monitoring. To the extent that the Security Working
Group participates in the development of this monitoring, expertise
from the wider group of Participants might also improve the quality of
monitoring. Further, the Commission preliminarily believes that
standardizing implementation of security protocols through the common
detailed design specifications may be more efficient than having each
Participant that implements a SAW or private environment for CAT Data
do so independently because it avoids duplication of effort. This may
also improve efficiency by reducing the complexity of security
monitoring of environments from which CAT Data is accessed and analyzed
because the detailed design specifications will include provisions that
facilitate this central monitoring.
---------------------------------------------------------------------------

    \643\ See supra Part II.C.4.
    \644\ See supra Part IV.A.3.a.
---------------------------------------------------------------------------

    Finally, the Commission preliminarily believes that provisions of
the proposed amendments that establish security controls, policies, and
procedures for SAWs may improve CAT Data security. Currently, under the
CAT NMS Plan, Participants must establish security protocols comparable
to those required for the central repository for all environments from
which Participants access CAT Data.\645\ The proposed amendments
require that SAWs comply with the same security standards as the
Central Repository, including compliance with and common implementation
of certain NIST SP 800-53 security controls, policies, and procedures.
To the extent that the security controls, policies and procedures
required for SAWs in the proposed amendments are more rigorous than
what the Participants would implement under the current CAT NMS Plan,
the security of CAT Data may be improved.
---------------------------------------------------------------------------

    \645\ See supra text accompanying note 623.
---------------------------------------------------------------------------

    Table 3 summarizes the Commission's preliminarily cost estimates if
all Participants were to work within SAWs. The Commission estimates
that Participants would collectively incur $61.2MM in initial costs and
$31.9MM \646\ in ongoing annual costs, while the Plan Processor would
incur $441,600 \647\ in initial costs and $860,200 in ongoing annual
costs. These costs are discussed further in the analysis that follows.
---------------------------------------------------------------------------

    \646\ ($19,000,000 + $12,900,000) = $31,900,000.
    \647\ ($367,600 + $74,000) = $441,600.

                               Table 3--Costs for All Participants To Use SAWs ($)
----------------------------------------------------------------------------------------------------------------
                                                           Participants                   Plan processor
                    Activity                     ---------------------------------------------------------------
                                                       Labor         External          Labor         External
----------------------------------------------------------------------------------------------------------------
Initial
    Incorporate SAW requirements into CISP......  ..............  ..............          89,000          27,000
    Develop detailed design specifications for    ..............  ..............          56,200          47,000
     SAWs.......................................
    Provide Participants with detailed design     ..............  ..............           3,000  ..............
     specifications.............................
    Evaluate nine SAWs for compliance...........  ..............  ..............         167,000  ..............
    Technical development costs.................      39,500,000  ..............  ..............  ..............
    Develop automated monitoring system.........  ..............  ..............          52,400  ..............
    SAW operations implementation costs.........      21,700,000  ..............  ..............  ..............
                                                 ---------------------------------------------------------------
        Total initial costs.....................      61,200,000  ..............         367,600          74,000
----------------------------------------------------------------------------------------------------------------
Annual
    Maintain and monitor CISP SAW requirements..  ..............  ..............          56,600  ..............

    Maintain detailed design specifications.....  ..............  ..............          48,300  ..............
    Maintain automated monitoring system and      ..............  ..............         605,300  ..............
     monitor....................................
    Additional costs for third party annual       ..............  ..............         150,000  ..............
     audit......................................
    Technical maintenance of SAWs...............      19,000,000  ..............  ..............  ..............
    SAW usage costs.............................  ..............      12,900,000  ..............  ..............
                                                 ---------------------------------------------------------------
        Total ongoing costs.....................      19,000,000      12,900,000         860,200  ..............
----------------------------------------------------------------------------------------------------------------

    Under the proposed amendments, the Plan Processor would be required
to incorporate SAW-specific additions into the CISP.\648\ The
Commission preliminarily estimates the Plan Processor will incur
approximately $89,000 \649\ in initial labor and $27,000 \650\ in
external consulting costs to fulfill this requirement. The Commission
preliminarily estimates the Plan Processor will also incur $56,600
\651\ in recurring annual costs to meet those provisions.
---------------------------------------------------------------------------

    \648\ See supra Part III.D.3.a.
    \649\ See supra note 498.
    \650\ See supra Part III.D.3.a.
    \651\ See supra note 501.
---------------------------------------------------------------------------

    The Commission preliminarily estimates that the Plan Processor will
incur initial, one-time costs of approximately $56,200 \652\ in labor
costs and $47,000 \653\ in external legal and consulting costs to
develop detailed design specifications for the technical implementation
of the access, monitoring and other controls required for SAWs.\654\
The Commission preliminarily believes the Plan Processor will incur
$3,000 \655\ in labor costs to make the required detailed design
specifications available to the Participants, and will incur an
additional $48,300 \656\ per year to maintain those detailed design
specifications.
---------------------------------------------------------------------------

    \652\ See supra note 503.
    \653\ See supra Part III.D.3.a.
    \654\ Id.
    \655\ See supra note 506.
    \656\ See supra note 508.
---------------------------------------------------------------------------

    For the Plan Processor to evaluate each Participant Group's \657\
SAW to confirm that the SAW has achieved compliance with the detailed
design specifications and to notify the Operating Committee, the
Commission preliminarily estimates that the Plan Processor would incur
an initial, one-time expense of approximately $167,000.\658\
---------------------------------------------------------------------------

    \657\ The Commission preliminarily believes that each
Participant Group will contract for a single SAW because it
preliminarily believes that each Participant Group largely
centralizes its regulatory functions that would require CAT Data.
    \658\ See supra note 509. $18,550 per group x 9 groups =
$166,950.
---------------------------------------------------------------------------

    For the Plan Processor to build automated systems that will enable
monitoring of the SAWs and Excepted Environments, the Commission
preliminarily estimates that the Plan Processor would incur an initial,
one-time expense of $52,400.\659\ For the Plan Processor to maintain
such systems and to monitor each Participant's SAW in accordance with
the detailed design specifications, the Commission preliminarily
estimates the Plan Processor would incur annual recurring costs of
$605,300.\660\ For each instance of non-compliance with the CISP or
detailed design specifications, the Plan Processor would incur costs of
$500 to notify the non-compliant Participant.\661\
---------------------------------------------------------------------------

    \659\ See supra note 510.
    \660\ See supra note 511.
    \661\ See supra note 512.
---------------------------------------------------------------------------

    The Plan currently requires that the Plan Processor conduct a
third-party annual security audit.\662\ The Commission preliminarily
estimates the proposed amendments would increase the cost of that
security assessment by $150,000 per year because of its increased scope
and complexity due to the addition of the SAWs.
---------------------------------------------------------------------------

    \662\ See CAT NMS Plan, supra note 3, at Section 6.2(a).
---------------------------------------------------------------------------

    The Participants would incur additional technical implementation
costs to set-up and configure their SAWs, develop tools for interacting
with CAT Data, develop and implement cluster computing capabilities if
applicable,\663\ and implement technical monitoring. The Commission
estimates the Participants will incur labor costs of $39.5MM \664\ for
these one-time development costs. These activities will also entail
ongoing labor costs to the Participants that the Commission
preliminarily estimates at $19.0MM \665\ annually.
---------------------------------------------------------------------------

    \663\ The Commission preliminarily believes Participant Groups
that operate a single exchange are unlikely to use cluster computing
capabilities because these Participants tend to use RSA and 17d-2
agreements to satisfy their regulatory responsibilities that would
require CAT Data.
    \664\ Setting up and configuring SAWs includes license
procurement, development of the SAW environment, development of
cluster computing capabilities if applicable, development of tools
to interact with CAT Data, and implementation of technical
monitoring. Costs for transitioning from a private analytic
environment to the SAW are accounted for separately below. See infra
note 674. Labor estimates include 900 hours from operations
specialists and 900 hours from systems analysts. Labor estimates to
develop tools include 2,700 hours from senior programmers and 2,700
hours from senior systems analysts. Labor costs to implement cluster
computing capabilities include 7,200 hours from senior programmers
and 7,200 hours from senior systems analysts. Labor estimates to
implement technical monitoring include 2,700 hours from operations
specialists. ((900 + 2,700) hours x $140/hour + (900 x $269/hour) +
(2,700 + 7,200) hours x $339/hour + (2,700 + 7,200) x $291/hour =
$6,983,100. The Commission preliminarily believes that Participant
Groups that operate a single exchange are unlikely to implement
cluster computing capabilities. Consequently, the Commission
preliminarily estimates these single exchange Participant Groups
will have technical development costs of ($6,983,100--(7,200 hours x
$339/hour + 7,200 hours x $291/hour)) = $2,447,100. The Commission
preliminarily believes that FINRA has already completed most of this
technical development work because FINRA is already working within
an AWS analytic cloud. Thus, the Commission preliminarily believes
that FINRA's technical development costs will be approximate 25% of
those of a Participant Group that operates multiple exchanges.
Consequently, the Commission's estimate of total technical
development costs for the nine Participant Groups is ((4 single
exchange groups x $2,447,100/group) + (4 multiple exchange groups x
$6,983,100/group) + ($6,983,100 x 25%)) = $39,466,575.
    \665\ Ongoing labor estimates to maintain the SAW's technical
environment include 1 senior programmer and 1 senior systems
analyst. Ongoing labor costs to maintain cluster computing
capabilities include 1 senior programmer and 2 senior systems
analysts. Labor estimates to maintain technical monitoring include
1.25 operations specialists. Assuming an 1,800 hour work year, for a
Participant Group with multiple exchanges, these costs would total
(1.25 x 1,800 hours x $140/hour + 2 x 1,800 hours x $339/hour + 3 x
1,800 hours x $291) = $3,106,800 annually. For a Participant Group
with a single exchange that does not implement cluster computer
capabilities, these costs would total (1.25 x 1,800 hours x $140/
hour + 1 x 1,800 hours x $339/hour + 1 x 1,800 hours x $291) =
$1,449,000 annually. The Commission preliminarily believes that
FINRA is already maintaining most of this functionality in its
current AWS environment, and thus believes its additional annual
costs associated with maintaining its SAW technical environment
would be approximate 25% of those incurred by a Participant Group
that operates multiple exchanges. Consequently, to maintain their
SAW's technical environment, the Commission preliminarily estimates
that the nine Participant Groups would incur annual ongoing costs of
((4 single exchange groups x $1,449,000/group) + (4 multiple
exchange groupsx$3,106,800/group) + ($3,106,800 x 25%)) =
$18,999,900.

---------------------------------------------------------------------------

    The Participants would incur additional costs from their usage of
the SAWs.\666\ The Commission preliminarily believes these estimates
may overestimate actual costs the Participants might incur in moving
their operations to SAWs because it does not recognize cost savings
that might be obtained by retiring redundant resources that they would
no longer require for operations being conducted in SAWs.\667\ The
Commission preliminarily believes that the Plan Processor would be
billed for SAW usage and would pass those costs on to Participants
directly such that each Participant Group's SAW costs would reflect its
own usage of SAW resources. To the extent that the Plan Processor marks
up those costs before passing them on to Participant Groups, actual
costs would exceed what the Commission estimates. To estimate the
magnitude of these costs, the Commission assumes three scenarios of SAW
use that vary in the types of instances employed within the SAW.\668\
These estimates assume that supporting more advanced instances
increases costs due to greater demands on computing resources. Certain
general \669\ and technical \670\ assumptions are common across all SAW
usage cost estimates.
---------------------------------------------------------------------------

    \666\ The Commission estimated SAW usage costs through the AWS
Simple Monthly Cost estimator at https://calculator.s3.amazonaws.com/index.html.
    \667\ For example, Participants may maintain servers, cloud
environments, and IT personnel that support operations such as
surveillance and investigations. If these functions are performed
within a SAW, such IT resources may be retired and personnel may be
reassigned to support SAW technical operations. If Participants
perform these functions using resources that cannot be retired, such
as the servers they use to operate exchanges, such savings may be
limited. The Commission notes that such savings would not apply to
FINRA because its ongoing SAW costs are considered to be baseline
costs.
    \668\ For its cost estimates, the Commission assumes different
virtual computers: a basic instance involves a single node on a AWS
EC2- t2.2xlarge virtual computer; a cluster computing instance
involves a group of AWS EC2--p2.16xlarge virtual computers; an
advanced instance involves a AWS EC2- x1e.32xlarge virtual computer;
and each instance is associated with a shared services and common
charge of $6,000 per year.
    \669\ Data transfers cost eliminated by hosting the SAWs in the
same region as the Central Repository. AWS usage based on minimum
and peak instance with daily spike traffic for 8.5 hours Monday
through Friday using Compute Savings Plan. One AWS instance can
support more than one user depending on the complexity of work when
leveraging cluster computing.
    \670\ The following technical options were used in all scenario
estimates: Operating system (Linux), Storage for each EC2 instance
(General Purpose SSD (gp2)), Snapshot Frequency (2x Daily), Data
transfer cost (0), Pricing strategy (Compute Savings Plans 3 Year
None upfront).
---------------------------------------------------------------------------

    The Commission assumes three levels of usage for its estimates.
Participant Groups can be classified in their SAW usage as single-
exchange, exchange group or association.\671\ Table 4 presents
preliminarily estimated Participant Group SAW use costs.\672\
Consequently, the Commission preliminarily estimates that Participants
will incur $12.9MM \673\ annually in SAW use costs. The Commission
further estimates that Participants will incur one-time costs of
$21.7MM \674\ to adapt current systems and train personnel to perform
regulatory duties in the SAWs.
---------------------------------------------------------------------------

    \671\ Single exchange usage assumes 5 basic instances and 100
terabytes of SAW storage. Exchange group assumes 25 basic instances,
30 cluster computing instances, and 15 advanced instances as well as
2 petabytes of SAW storage; 10 of these cluster instances and 10 of
these advanced instances proxy for exchange groups' expected higher
use of computing resources to conduct surveillance activities.
Association assumes 150 basic instances, 120 cluster computing
instances and 30 advanced instances as well as 5 petabytes of SAW
storage. The Commission preliminarily believes FINRA, the sole
national securities association, will have significantly higher CAT
usage than exchange groups because the CAT NMS Plan anticipates the
retirement of OATS, which is the data source FINRA currently uses to
perform many of its regulatory activities, and many of those
regulatory activities involve cross market data. With the retirement
of OATS, FINRA will be unable to perform these activities without
CAT Data.
    \672\ The Commission preliminarily believes that the four
Participant Groups that operate single exchanges are likely to
outsource regulatory duties that would regularly require external
data and thus use RSAs to fulfill those requirements. Consequently,
their use of the SAW would be situational. The Commission
preliminarily believes its cost estimate for FINRA is a significant
overestimate because FINRA already has established and is working in
an AWS environment. Consequently, the Commission preliminarily
believes that FINRA's SAW usage costs would be in the baseline
because FINRA is already performing its regulatory duties in an AWS
workspace. Although FINRA's use might increase with the retirement
of OATS, the Commission preliminarily believes this would be a
consequence of the CAT NMS Plan rather than the proposed amendments.
    \673\ (4 x $67,000 + 4 x $3,146,000) = $12,852,000.
    \674\ In its economic analysis of the Plan, the Commission
estimated the cost of the Plan as approximately $2.4 billion in
initial aggregate implementation costs and recurring annual costs of
$1.7 billion. See CAT NMS Plan Approval Order, supra note 3, at Part
V.B. The Commission preliminarily estimates SAW implementation costs
for all Participant Groups other than FINRA by using the same ratio
of implementation to ongoing costs as estimated for the Plan. (2.4/
1.7 x $12,852,000) = $18,144,000. The Commission preliminarily
believes this approach is likely to significantly overestimate