facilitating future attacks.\225\ As discussed in section III.C.1, the
challenge of effective information sharing has long been recognized,
and government efforts at encouraging such sharing on a voluntary basis
have had only limited success.\226\ The proposed reporting requirement,
by channeling incident reports through the Commission, would create the
opportunity for sharing of information valuable in preventing future
cyberattacks, while preserving confidentiality and limiting the
cybersecurity risks of public disclosure. For example, a series of
reports detailing the compromise of a system commonly employed by small
advisers could result in the Commission issuing a notice to similar
advisers of the risks of the particular system. On the other hand, a
general uptick in ``phishing'' style attacks using particular language
and originating from similar addresses could lead the Commission to
issue a risk alert to all registrants. Of course, in some cases, it may
not be possible for the Commission to disclose any information
discovered from a report without violating the confidentiality of the
reporting entity or without exacerbating cybersecurity risks for some
entities.\227\ In such cases, the Commission may still be able to share
information with relevant law enforcement or national security
agencies.
---------------------------------------------------------------------------

    \224\ See, e.g., Denise E. Zheng and James A. Lewis, Cyber
Threat Information Sharing, Center for Strategic and International
Studies (Mar. 2015), available at https://www.csis.org/analysis/cyber-threat-information-sharing (recommending that regulators
encourage information sharing).
    \225\ Although ``security through obscurity'' as a cybersecurity
philosophy has long been derided, ``obscurity,'' or more generally
``deception,'' has been recognized as an important cyber resilience
technique. See Ross, Ron, Victoria Pillitteri, Richard Graubart,
Deborah Bodeau, and Rosalie McQuaid, Developing Cyber Resilient
Systems: A Systems Security Engineering Approach, National Institute
of Standards and Technology (Dec. 2021), available at https://doi.org/10.6028/NIST.SP.800-160v2r1. See also supra section III.D.2
(discussion of costs associated with disclosure).
    \226\ See supra section III.C.1 (discussion of information
sharing).
    \227\ For example, sharing information about the type of attack
can be used to draw inferences about the type of system that was
targeted, which may imply a particular target entity (i.e., the
entity known to use that system).
---------------------------------------------------------------------------

    In addition to facilitating information sharing, the proposed
reporting requirements could also allow the Commission to coordinate
market-wide responses to cybersecurity incidents. For example, an
incident that affects the ability of an important money market fund
could be used by the Commission to initiate an inter-agency response
aimed at ensuring stability in the money markets.\228\ Alternatively,
patterns discovered through the reports may trigger referral to
national security agencies for further investigation.
---------------------------------------------------------------------------

    \228\ Depending on the circumstances, such responses could be
coordinated through FSOC or through bilateral contacts with other
regulators.
---------------------------------------------------------------------------

    The aforementioned benefits arising from improved information
sharing and response coordination are contingent on the Commission
creating effective schemes to do so as well as the utility of the
required reports in mounting effective regulatory responses. In
particular, delays in registrants' discovery of cybersecurity incidents
may hinder the utility of such reports in triggering a ``real-time''
regulatory response.\229\ Thus the utility of such reports may be
confined to information sharing and referrals to law enforcement and
national security agencies.
---------------------------------------------------------------------------

    \229\ Under the proposed rules registrants would have to report
incidents within 48 hours. See proposed rule 204-6(a).
---------------------------------------------------------------------------

b. Costs
    The proposed requirements for advisers and funds to adopt and
implement reasonably designed cybersecurity policies and procedures
include provisions related to ongoing monitoring of threats and
vulnerabilities \230\ as well as provisions related to cybersecurity
incident response and recovery.\231\ Compliance with the aforementioned
provisions effectively requires the collection of information that is
solicited on proposed Form ADV-C.\232\ Thus, we do not believe that the
proposed reporting requirement would impose compliance costs beyond
those related to developing and implementing reasonably designed
policies and procedures discussed in section III.D.1. The proposed
filing requirements would entail certain administrative costs, and
these are discussed in the Paperwork Reduction Act analysis in section
IV. Other costs that could arise from the reporting provisions would be
the potential for the unintended release of information disclosed on
Form ADV-C through the Commission's response to such disclosures.
Unintended release of such details could facilitate future cyberattacks
against funds and advisers as well as against advisers and fund with
similar vulnerabilities.
---------------------------------------------------------------------------

    \230\ See supra section II.A.1.d.
    \231\ See supra section II.A.1.e.
    \232\ See proposed rules 206(4)-9(a)(5) and 38a-2(a)(5).
---------------------------------------------------------------------------

4. Recordkeeping
    Under the new recordkeeping requirements advisers and funds would
be required to maintain, for five years records of: (1) Cybersecurity
policies and procedures; \233\ (2) annual reviews thereof; (3)
documents related to the annual reviews; (4) regulatory filings \234\
related to cybersecurity incidents required under the proposed
amendments; \235\ (5) any cybersecurity incident; and (6) cybersecurity
risk assessments.
---------------------------------------------------------------------------

    \233\ See proposed rules 204-2 and 38a-2(e).
    \234\ For advisers, copies of any Form ADV-C filed. For funds,
reports provided to the Commission pursuant to proposed rule 38a-
2(a)(5).
    \235\ See proposed rules 204-2 and 38a-2(e).
---------------------------------------------------------------------------

a. Benefits
    These proposed amendments would help facilitate the Commission's
inspection and enforcement capabilities. As a result, the Commission
would be better able to detect deficiencies in the advisers' and funds'
cybersecurity hygiene so that such deficiencies could be remedied.
Insofar as correcting deficiencies results in material improvement in
the cybersecurity practices of individual advisers and funds that would
reduce the risk and/or magnitude of future cybersecurity incidents, the
proposed amendments would benefit clients and investors.
b. Costs
    We do not expect the proposed recordkeeping requirements to impose
additional compliance costs not covered elsewhere in this analysis. The
compliance costs related to the creation of records subject to the
recordkeeping provisions are covered in section III.D.1. As advisers
and funds are currently subject to substantially similar recordkeeping
requirements applicable to other required policies and procedures, we
do not expect registrants will need to invest in new recordkeeping
staff, systems, or procedures to satisfy the new recordkeeping
requirements.\236\ The marginal administrative costs arising from
maintaining additional records related to these provisions using
existing systems are covered in the Paperwork Reduction Act analysis in
section IV.
---------------------------------------------------------------------------

    \236\ See proposed rules 204-2(a)(17) and 38-2(e).
---------------------------------------------------------------------------

E. Effects on Efficiency, Competition, and Capital Formation

    As discussed in the foregoing sections, market imperfections could
lead to underinvestment in cybersecurity by advisers and funds, and
information asymmetry could

contribute to inefficient production of cybersecurity defenses. The
proposed rules and amendments aim to mitigate the inefficiencies
resulting from these imperfections by: (1) Imposing mandates on
cybersecurity policies and procedures that could reduce cybersecurity
underinvestment; \237\ (2) providing additional disclosure to inform
clients and investors about advisers' and funds' cybersecurity efforts,
reducing information asymmetry; \238\ and (3) creating a reporting
framework that could improve information sharing and improved
cybersecurity defense production.\239\ While the proposed rules and
amendments have the potential to mitigate inefficiencies resulting from
market imperfections, the scale of the overall effect will depend on
numerous factors, including: The state of existing of cybersecurity
preparations,\240\ the degree to which the proposed provisions induce
increases to these preparations,\241\ the effectiveness of additional
preparations at reducing cybersecurity risks,\242\ the degree to which
clients and investors value additional cybersecurity preparations,\243\
the degree of information asymmetry and bargaining power between
clients and investors vis-[agrave]-vis advisers and funds,\244\ the
bargaining power of registrants vis-[agrave]-vis service
providers,\245\ service providers' willingness to provide bespoke
contractual provisions to registrants,\246\ the informativeness of the
proposed disclosures, the scale of the negative externalities on the
broader financial system,\247\ the effectiveness of existing
information sharing arrangements, and the informativeness of the
required regulatory reports (as well as the Commission's ability to
make use of them).\248\ As discussed earlier in this section, it is not
practicable to measure most of these factors. As such, it is also not
practicable to quantify the overall effect of the proposed provisions
on economic efficiency. Although any increased efficiency resulting
from the proposed provisions can generally be expected to lead to
improved capital formation,\249\ quantifying such effects is similarly
impracticable.\250\
---------------------------------------------------------------------------

    \237\ See supra footnotes 92-96 and accompanying text; section
III.D.1.
    \238\ See supra footnotes 92-96 and accompanying text; section
III.D.2.
    \239\ See supra footnotes 118-123 and accompanying text; section
III.D.3.
    \240\ See supra section III.C.1. Here, we are concerned about
the degree to which registrants' state of cybersecurity preparations
diverge from socially optimal levels.
    \241\ See supra footnote 175 and accompanying text.
    \242\ Formally, the marginal product of the proposed policies
and procedures in the production of cybersecurity defenses.
    \243\ Formally, clients' and investors' utility functions--
specifically the marginal utilities of advisers' and funds'
cybersecurity hygiene.
    \244\ In other words, the degree to which clients and investors
can affect the policies of advisers and funds. Generally, we expect
that fund investors will typically be small and dispersed and thus
be subject to large information asymmetry and have limited ability
to affect the policies of funds. For clients of advisers the
situation is likely to involve more heterogeneity, with some clients
wielding very little power over adviser policies (e.g., small retail
clients) while others wield considerable power (e.g., large pension
funds).
    \245\ See supra footnotes 184-192 and accompanying text.
    \246\ Id.
    \247\ See supra section III.B.
    \248\ See supra section III.D.3.a.
    \249\ The proposed provisions do not implicate channels
typically associated with capital formation (e.g., taxation policy,
financial innovation, capital controls, investor disclosure,
intellectual property, rule-of-law, and diversification). Thus, the
proposed rule amendments are likely to have only indirect, second
order effects on capital formation arising from any improvements to
economic efficiency.
    \250\ Id. Qualitatively, these effects are expected to be small.
---------------------------------------------------------------------------

    Because the proposed rules and amendments are likely to have
differential effects on registrants along a number of dimensions, their
overall effect on competition among registrants is difficult to
predict. For example, smaller registrants--who we believe are less
likely to have extensive cybersecurity measures already in place--are
likely to face disproportionately higher costs resulting from the
proposed rules and amendments.\251\ Thus, the proposed rules and
amendments could tilt the competitive playing field in favor of larger
registrants. On the other hand, if clients and investors believe that
the proposed rules and amendments effectively induce the appropriate
level of cybersecurity effort among registrants, smaller registrants
would likely benefit most from these improved perceptions. Similar
differential effects could apply to registrants and service providers
that are more (or less) focused on their digital business.
---------------------------------------------------------------------------

    \251\ See supra footnote 97 and accompanying text.
---------------------------------------------------------------------------

    With respect to competition among registrants' service providers,
the overall effect of the proposed rules and amendments is similarly
ambiguous. It is likely that requiring affected registrants to provide
oversight of service providers' cybersecurity practices pursuant to a
written contract would lead some service providers to cease offering
services to affected registrants.\252\ This would almost certainly
``reduce'' competition in a crude sense: The number of potential
service providers available to registrants would likely be diminished.
However, this may ``improve'' competition in another sense: Service
providers with ``inadequate'' cybersecurity practices (i.e., those
unwilling to commit contractually to implementing cybersecurity
practices deemed ``reasonably designed'' by the registrant) would be
unable to undercut service providers with ``adequate'' cybersecurity
practices.
---------------------------------------------------------------------------

    \252\ See supra footnotes 184-192 and accompanying text.
---------------------------------------------------------------------------

F. Alternatives Considered

    In formulating our proposal, we have considered various
alternatives. Those alternatives are discussed below and we have also
requested comments on certain of these alternatives.
1. Alternatives to the Proposed Policies and Procedures Requirement
a. Require Only Disclosure of Cybersecurity Policies and Procedures
Without Prescribing Elements
    Rather than requiring registrants to adopt cybersecurity policies
and procedures with specific enumerated elements, the Commission
considered requiring advisers and funds to only provide explanations or
summaries of their cybersecurity practices to their clients or
investors.
    We believe that such an approach would create weaker incentives to
address potential underspending in cybersecurity measures as it would
rely entirely on clients' and investors' (or third parties' providing
analysis to clients and investors) \253\ ability to assess the
effectiveness of registrants' cybersecurity practices from registrants'
explanations. Given the cybersecurity risks of disclosing detailed
explanations of cybersecurity practices,\254\ it is likely that such
explanations would include only vague boilerplate language and provide
little information that could be used by observers to infer the degree
of cybersecurity preparedness. Such a ``disclosure-only'' regime is
unlikely to be effective at resolving the underlying information
asymmetry and would therefore be unlikely to affect meaningful change
in registrants' cybersecurity practices.\255\ Moreover, not requiring
specific enumerated elements in cybersecurity policies and procedures
would likely result in less uniform cybersecurity preparedness across
registrants, undermining clients'

and investors' broader confidence in the fund and adviser industries.
At the same time, the costs associated with this alternative would
likely be minimal, as registrants would be unlikely to face pressure to
adjust practices as a result of such disclosures.
---------------------------------------------------------------------------

    \253\ See supra footnote 208 and accompanying text.
    \254\ See supra section III.D.2.B (discussing tradeoffs of
cybersecurity disclosure).
    \255\ Here changes in cybersecurity practices would depend
entirely on market discipline exerted by relatively uninformed
market participants.
---------------------------------------------------------------------------

b. Require Cybersecurity Policies and Procedures With More Limited
Prescribed Elements
    We also considered paring down some enumerated elements from the
proposed cybersecurity policies and procedures requirement, more
specifically the oversight of service providers component of the
information protection element. In this regard, we considered narrowing
the scope of the types of service providers to named service providers
discussed further above and requiring a periodic review and assessment
of a named service provider's cybersecurity policies and procedures in
lieu of a written contract. We further considered requiring service
providers that receive, maintain, or process adviser or fund
information to provide security certifications in lieu of the written
contract requirement.
    Narrowing the scope of the types of service providers affected by
the proposal could lower costs for registrants, especially smaller
registrants who rely on generic service providers and would have
difficulty effecting changes in contractual terms with such service
providers.\256\ However, given that in the current technological
context \257\ cybersecurity risk exposure of registrants is unlikely to
be limited to (or even concentrated in) certain named service
providers, narrowing the scope of service providers would likely lead
to lower costs only insofar as it reduces effectiveness of the
regulation. In other words, absent a written contractual arrangement
with a service provider relating to the provider's cybersecurity
practices, it is unlikely that registrants could satisfy their
overarching obligations under the proposed rules.
---------------------------------------------------------------------------

    \256\ See supra section III.D.1.b (discussing service
providers).
    \257\ Specifically, a context where businesses increasingly rely
on third-party ``cloud services'' that effectively place business
data out of the business' immediate control.
---------------------------------------------------------------------------

    Alternatively, maintaining the proposed scope but only requiring a
standard, recognized, certification in lieu of a written contract could
also lead to cost savings for registrants.\258\ However, we
preliminarily believe that it would be difficult to prescribe a set of
characteristics for such a ``standard'' certification that would
sufficiently address the varied types of advisers and funds and their
respective service providers.\259\
---------------------------------------------------------------------------

    \258\ Service providers may currently be providing
certifications as part of an adviser's or fund's policies and
procedures.
    \259\ See supra section III.C.3 (discussing the variety of
affected registrants); see also infra section III.F.1.c (discussing
limitation of uniform prescriptive requirements).
---------------------------------------------------------------------------

c. Require Specific Prescriptive Requirements for Addressing
Cybersecurity Risks
    The Commission considered including more prescriptive elements in
the cybersecurity policies and procedures requirement of the current
proposal. For example, advisers and funds could have been required to
implement particular controls (e.g., specific encryption protocols,
network architecture, or authentication procedures) designed to address
each general element of the required cybersecurity policies and
procedures. Given the considerable diversity in the size, focus, and
technical sophistication of affected registrants,\260\ any specific
requirements would result in some registrants needing to substantially
alter their cybersecurity policies and procedures.
---------------------------------------------------------------------------

    \260\ See supra section III.C.3.
---------------------------------------------------------------------------

    The potential benefit of such an approach would be to provide
assurance that advisers and funds have implemented certain specific
cybersecurity hygiene practices. But this approach would also entail
considerably higher costs as many registrants would need to adjust
their existing practices. Considering the variety of advisers and funds
registered with the Commission, it would be exceedingly difficult for
the Commission to devise specific requirements that are appropriately
suited for all registrants: A uniform set of requirements would
certainly be both over- and under-inclusive, while providing varied
requirements based on the circumstances of the registrant would be
complex and impractical. For example, uniform prescriptive requirements
that ensure reasonably designed cybersecurity policies and procedures
for the largest, most sophisticated advisers and funds would likely be
overly burdensome for smaller, less sophisticated advisers with more
limited cybersecurity exposures. Conversely, if these uniform
prescriptive requirements were tailored to advisers and funds with more
limited operations or cybersecurity risk, such requirements likely
would be inadequate to address larger registrants' cybersecurity risks
appropriately. Alternatively, providing different requirements for
different categories of registrants would involve considerable
regulatory complexity in delineating the classes of advisers and
defining the appropriate requirements for each class. More broadly,
imposing detailed prescriptive requirements would effectively place the
Commission in the role of dictating details of the IT practices of
registrants without the benefit of the registrants' knowledge of their
own particular circumstances. Moreover, given the complex and
constantly evolving cybersecurity landscape, detailed regulatory
requirements for cybersecurity practices would likely limit
registrants' ability to adapt quickly to changes in the cybersecurity
landscape.\261\
---------------------------------------------------------------------------

    \261\ If as in the previous example, the Commission were to
require registrants to adopt a specific encryption algorithm, future
discovery of vulnerabilities in that algorithm would prevent
registrants from fully mitigating the vulnerability (i.e., switching
to improved algorithms) in the absence of Commission action.
---------------------------------------------------------------------------

d. Require Audits of Internal Controls Regarding Cybersecurity
    Instead of requiring advisers and funds to adopt and implement
cybersecurity policies and procedures, the Commission considered
requiring advisers and funds to obtain audits of the effectiveness of
their existing cybersecurity controls--for example, by obtaining
service organization control audits with respect to their cybersecurity
practices. This approach would not have required advisers and funds to
adopt and implement cybersecurity policies and procedures as proposed,
but instead would have required advisers and funds to engage an
independent qualified third party to assess their cybersecurity
controls and prepare a report describing its assessment and any
potential deficiencies.
    Under this alternative, an independent third party (e.g., an
auditing firm) would certify to the effectiveness of the adviser's or
fund's cybersecurity practices. If the firms providing such
certifications have sufficient reputational motives to issue credible
assessment,\262\ and if the scope of such certifications is not overly
circumscribed,\263\ it is likely that registrants' cybersecurity
practices

would end up being more robust under this alternative than under the
current proposal. By providing certification of a registrant's
cybersecurity practices, a firm would--in effect--be ``lending'' its
reputation to the registrant. Because ``lenders'' are naturally most
sensitive to down-side risks (here, loss of reputation, lawsuits,
damages, regulatory enforcement actions), one would expect them to
avoid ``lending'' to registrants with cybersecurity practices whose
effectiveness is questionable.\264\
---------------------------------------------------------------------------

    \262\ This would be the case if there was sufficient market
pressure or regulatory requirements to obtain certification from
``reputable'' third-parties with business models premised on
operating as a going-concern and maintaining a reputation for
honesty.
    \263\ We are assuming that in this alternative, certification
would not be limited to only evaluating whether a registrant's
stated policies and procedures are reasonably designed, but rather
also would include an assessment of whether the policies and
procedures are actually implemented in an effective manner.
    \264\ Under the proposal it is the registrant itself that
effectively ``certifies'' its own cybersecurity policies and
procedures. Like the third-party auditor, the registrant faces down-
side risks from ``certifying'' inadequate cybersecurity practices
(i.e., Commission enforcement actions). However, unlike the auditor,
the registrant also realizes the potential up-side: Cost savings
through reduced cybersecurity expenditures.
---------------------------------------------------------------------------

    While certification by credible third parties could lead to more
robust cybersecurity practices, the costs of such an approach would
likely be considerably higher. Because of the aforementioned
sensitivity to down-side risk, firms would likely be hesitant to
provide cybersecurity certifications without a thorough understanding
of a registrant's systems and practices; in many cases, developing such
an understanding would involve considerable effort.\265\ In addition,
it is possible that the inherent ambiguity of what represents
``effective'' practices in an evolving context like cybersecurity would
lead to a reluctance among third parties to provide the necessary
certification services.\266\
---------------------------------------------------------------------------

    \265\ It would be difficult for an auditor to provide a credible
assessment of the effectiveness of the registrant's cybersecurity
practices without first understanding the myriad of systems involved
and how those practices are implemented. Presumably, a registrant
would not bear these costs as it is likely to possess such an
understanding.
    \266\ What constitutes ``effective'' practices with respect to
cybersecurity is likely not as universally accepted as what
constitutes ``adequate'' internal controls with respect to
accounting or financial disclosure. Thus certifying a firm's
cybersecurity practices would likely involve more litigation risk
and uncertainty than traditional financial auditing.
---------------------------------------------------------------------------

e. Vary Requirements of the Proposed Rules on Cybersecurity and
Procedures for Different Subsets of Advisers and Funds
    The Commission considered requiring different elements in an
adviser's or fund's cybersecurity policies and procedures based on
characteristics of the adviser or fund. For example, advisers or funds
with assets under management below a certain threshold or with only a
limited number of clients or investors could have been required to
implement more limited cybersecurity policies and procedures.
    This approach could have scaled based on adviser or fund size,
business or other criteria, with larger firms, for example, being
required to address more elements in their cybersecurity policies and
procedures or being required to implement more prescriptive
cybersecurity measures. However, as discussed above, cybersecurity
risks and vulnerabilities are likely to be unique to each adviser and
fund depending on its particular operations, which could make it
difficult to use any specific characteristics such as firm size, for
example, as an effective proxy to determine the scope of their
cybersecurity policies and procedures.
f. Administration and Oversight of Cybersecurity Policies and
Procedures
    The Commission considered various alternative requirements with
respect to administration and oversight of an adviser's or fund's
cybersecurity policies and procedures such as requiring advisers and
funds to designate a CISO or requiring funds' boards to oversee
directly a fund's cybersecurity policies and procedures. There is a
broad spectrum of potential approaches to this alternative, ranging
from the largely nominal (e.g., requiring registrants to designate
someone to be a CISO) to the stringent (e.g., requiring a highly
qualified CISO to attest to the effectiveness of the registrant's
policies).
    While employee designations and similar nominal requirements may
improve accountability and enhance compliance in certain contexts, they
are unlikely to lead to material improvements in highly technical
aspects of business operations. Given the technical complexity of
cybersecurity issues, imposing such nominal requirements is unlikely to
do much to further the policy objectives or provide substantial
economic benefit. At the same time, while such an approach would
increase regulatory complexity, it would likely entail minimal costs
for registrants.
    On the other hand, stringent requirements such as requiring an
attestation from a highly qualified CISO as to the effectiveness of a
registrant's cybersecurity practices in specific enumerated areas could
be quite effective. Expert practitioners in cybersecurity are in high
demand and command high salaries.\267\ Thus, such an approach would
impose substantial ongoing costs on registrants who do not already have
appropriately qualified individuals on staff. This burden would be
disproportionately borne by smaller registrants, for whom keeping a
dedicated CISO on staff would be cost prohibitive. Allowing registrants
to employ part-time CISOs would mitigate this cost burden, but such
requirements would likely create a de facto ``audit'' regime. Such an
audit regime would certainly be more effective if explicitly designed
to function as such.\268\
---------------------------------------------------------------------------

    \267\ A recent survey reports CISO median total compensation of
$668,903 for CISOs at companies with revenues of $5 billion or less.
See Matt Aiello and Scott Thompson, 2020 North American Chief
Information Security Officer (CISO) Compensation Survey, Heidrick &
Struggles (2020), available at https://www.heidrick.com/-/media/heidrickcom/publications-and-reports/2020-north-american-chief-information-security-officer-ciso-compensation-survey.pdf.
    \268\ In designing an effective audit regime, aligning
incentives of auditors to provide credible assessments is a central
concern. In the context of audit regimes, barriers to entry and the
reputation motives of auditing firms helps align incentives. It
would be considerably more difficult to obtain similar incentive
alignment with itinerant part-time CISOs. See supra section
III.F.1.d (describing the audit regime alternative).
---------------------------------------------------------------------------

2. Modify Requirements for Structuring Disclosure of Cybersecurity
Risks and Incidents
    The Commission considered changing the scope of the tagging
requirements for the proposed fund cybersecurity incident disclosures,
such as by removing the requirements for all or a subset of funds. For
example, the tagging requirements could have excluded unit investment
trusts, which are not currently required to tag any filings in Inline
XBRL.\269\ Under such an alternative, unit investment trusts would
submit their cybersecurity disclosures in unstructured HTML or ASCII,
and forego the initial Inline XBRL implementation costs (such as the
cost of training in-house staff to prepare filings in Inline XBRL, and
the cost to license Inline XBRL filing preparation software from
vendors) and ongoing Inline XBRL compliance burdens that would result
from the proposed tagging requirement.\270\ However, narrowing the
scope of tagging requirements, whether based on fund structure, fund
size, or other criteria, would diminish the

extent of any informational benefits that would accrue as a result of
the proposed disclosure requirements by making the excluded funds'
cybersecurity incident disclosures comparatively costlier to process
and analyze.
---------------------------------------------------------------------------

    \269\ By contrast, funds that file Forms N-1A, N-2, N-3, N-4,
and N-6 are currently subject to Inline XBRL tagging requirements
for portions of those filings. See supra footnote 85.
    \270\ See infra section III.D.3.b. Funds file registration
statements and amendments using the Commission's EDGAR electronic
filing system, which generally requires filers to use ASCII or HTML
for their document submissions, subject to certain exceptions. See
Regulation S-T, 17 CFR 232.101(a)(1)(iv); 17 CFR 232.301; EDGAR
Filer Manual (Volume II) version 60 (Dec. 2021), at 5-1. To the
extent unit investment trusts are part of the same fund family as
other types of funds that are subject to Inline XBRL requirements,
they may be able to leverage those other funds' existing Inline XBRL
tagging experience and software, which would mitigate the initial
Inline XBRL implementation costs that unit investment trusts would
incur under the proposal.
---------------------------------------------------------------------------

    The scope of structuring requirements for the proposed disclosures
could also have been expanded to cover advisers in addition to funds.
Under the proposal, advisers would provide the required cybersecurity
disclosures as part of their narrative brochures, which advisers must
file electronically with the Commission as a text-searchable PDF file
using the FINRA-administered IARD system.\271\ Alternatively, the
Commission could require advisers to structure the cybersecurity
disclosures in IARD-specific XML. Such a requirement would not impose
additional incremental compliance costs on advisers, who would use an
online form provided by the IARD system to submit their disclosures and
would not be required to develop technical expertise to comply with the
structuring requirement.\272\ However, such an alternative would result
in investors receiving most of the narrative brochure disclosures in
PDF format and the remaining cybersecurity disclosures--outside the PDF
brochure--in IARD-specific XML, which could lead to investor confusion
about the location of the disclosures.
---------------------------------------------------------------------------

    \271\ See 17 CFR 275.203(a)(1); General Instruction 5 of Form
ADV Part 2. The proposed requirement is also more technically
feasible than an Inline XBRL requirement for the advisers'
disclosures, because the IARD system does not currently accommodate
Inline XBRL filings.
    \272\ See FINRA Form ADV Guide, available at https://www.iard.com/sites/iard/files/formADV_guide.pdf.
---------------------------------------------------------------------------

3. Public Disclosure of Form ADV-C
    The Commission considered requiring the public disclosure of Form
ADV-C in the proposal. Assuming that the information submitted by
registrants through Form ADV-C filings does not change, making Form
ADV-C filings public would increase clients' and investors' information
about cybersecurity incidents and thus improve their ability to draw
inferences about an adviser's or fund's level of cybersecurity
preparations. At the same time, doing so would also assist would-be
attackers, who would gain additional insight into the vulnerabilities
of a victim's systems. As discussed in section III.D.2.b, release of
too much detail about a cybersecurity incident could further compromise
cybersecurity of the victim, especially in the short term. Given these
risks, requiring public disclosure of Form ADV-C filings would likely
have the effect of significantly reducing the detail provided by
registrants in these filings. As a result, the information set of
clients, investors, and would-be attackers would remain largely
unchanged (vis-[agrave]-vis the proposal), while the ability of the
Commission to facilitate information sharing and to coordinate
responses aimed at reducing systemic risks to the financial system
would be diminished.

IV. Paperwork Reduction Act Analysis

A. Introduction

    Certain provisions of the proposed amendments contain ``collection
of information'' requirements within the meaning of the Paperwork
Reduction Act of 1995 (``PRA'').\273\ We are submitting the proposed
collections of information to the Office of Management and Budget
(``OMB'') for review in accordance with the PRA.\274\ The proposed
rules 206(4)-9, 38a-2, 204-6, and proposed new Form ADV-C would include
new information collection burdens, and the proposed amendments would
have an effect on the current collection of information burdens of rule
204-2 and rule 204-3 under the Investment Advisers Act and Form ADV, as
well as Form N-1A and other registration forms with respect to the
Investment Company Act.
---------------------------------------------------------------------------

    \273\ 44 U.S.C. 3501 through 3521.
    \274\ 44 U.S.C. 3507(d); 5 CFR 1320.11.
---------------------------------------------------------------------------

    Certain funds have current requirements to submit to the Commission
information included in their registration statements, or information
included in or amended by any post-effective amendments to such
registration statements, in response to certain form items in
structured data language (``Investment Company Interactive
Data'').\275\ This also includes the requirement for funds to submit
interactive data to the Commission for any form of prospectus filed
pursuant to 17 CFR 230.497(c) or 17 CFR 230.497(e) under the Securities
Act that includes information in response to certain form items. The
proposed amendments to fund registration forms include new structured
data requirements to tag information about significant fund
cybersecurity incidents using Inline XBRL. Although the interactive
data filing requirements are included in the instructions to each form,
we are separately reflecting the hour and cost burdens for these
requirements in the burden estimate for Investment Company Interactive
Data and not in the estimate for each registration statement form.
---------------------------------------------------------------------------

    \275\ The paperwork burdens for the rules under section 8(b) of
the Investment Company Act are imposed through the forms and reports
that are subject to the requirements in these rules and are
reflected in the PRA burdens of those documents.
---------------------------------------------------------------------------

    The titles of new collections of information we are proposing are
``Rule 206(4)-9 under the Investment Advisers Act,'' ``Rule 38a-2 under
the Investment Company Act,'' ``Rule 204-6 under the Investment
Advisers Act,'' and ``Form ADV-C.'' OMB has not yet assigned control
numbers for these titles. The titles for the existing collections of
information are: (1) ``Rule 204-2 under the Investment Advisers Act of
1940'' (OMB control number 3235-0278); (2) Rule 204-3 under the
Investment Advisers Act of 1940'' (OMB control number 3235-0047); (3)
``Form ADV'' (OMB control number 3235-0049); (4) ``Form N-1A,
Registration Statement under the Securities Act and under the
Investment Company Act for Open-End Management Investment Companies''
(OMB control number 3235-0307); (5) ``Form N-2, Registration Statement
of Closed-End Management Investment Companies'' (OMB control number
3235-0026); (6) ``Form N-3, Registration of Separate Accounts Organized
as Management Investment Companies'' (OMB control number 3235-0316);
(7) ``Form N-4, Registration Statement of Separate Accounts Organized
as Unit Investment Trust'' (OMB control number 3235-0318); (8) ``Form
N-6, Registration Statement of Separate Accounts Organized as Unit
Investment Trust'' (OMB control number 3235-0503); (9) ``Form N-8B-2,
Registration Statement of Unit Investment Trusts Which Are Currently
Issuing Securities'' (OMB control number 3235-0186); (10) ``Form S-6,
for Registration under the Securities Act of Unit Investment Trusts
registered on Form N-8B-2'' (OMB control number 3235-0184); and (11)
``Investment Company Interactive Data'' (OMB control number 3235-0642).
    An agency may not conduct or sponsor, and a person is not required
to respond to, a collection of information unless it displays a
currently valid OMB control number.
    Each requirement to disclose information, offer to provide
information, or adopt policies and procedures constitutes a collection
of information requirement under the PRA. These collections of
information would help increase the likelihood that advisers and funds
are prepared to respond to a cybersecurity incident, and collectively
would serve the Commission's interest in protecting investors by
reducing the risk that a cybersecurity incident could significantly
affect a firm's operations and lead to significant harm to clients

and investors. The Commission staff would also use the collection of
information in its examination and oversight program in identifying
patterns and trends across registrants. We discuss below the collection
of information burdens associated with the proposed rules and rule
amendments.

B. Rule 206(4)-9

    Proposed rule 206(4)-9 would require an adviser to adopt and
implement written policies and procedures that are reasonably designed
to address cybersecurity risks.\276\ These cybersecurity policies and
procedures would need to be tailored based on the complexity of the
adviser's business operations and attendant cybersecurity risks. The
proposed rule would require policies and procedures that address: (1)
Risk assessment, (2) user security and access, (3) information
protection, (4) cybersecurity threat and vulnerability management, and
(5) cybersecurity incident response and recovery. The proposed rule
includes certain minimum activities associated with each of these
elements, including requirements for an adviser to identify and oversee
any service providers that receive, maintain, or process adviser
information, or are otherwise permitted to access its information
systems and any information residing therein.
---------------------------------------------------------------------------

    \276\ See proposed rule 206(4)-9; supra section II.A (discussing
the cybersecurity policies and procedures requirements).
---------------------------------------------------------------------------

    In addition to adopting and implementing such policies and
procedures, the proposed rule would require advisers to review and
assess, at least annually, the design and effectiveness of their
cybersecurity policies and procedures. More specifically, proposed rule
206(4)-9 would require that an adviser at least annually: (1) Review
and assess the design and effectiveness of the cybersecurity policies
and procedures; and (2) prepare a written report that, at a minimum,
describes the review, assessment, and any control tests performed,
explains their results, documents any cybersecurity incident that
occurred since the date of the last report, and discusses any material
changes to the policies and procedures since the date of the last
report.\277\
---------------------------------------------------------------------------

    \277\ See proposed rule 206(4)-9(b).
---------------------------------------------------------------------------

    The respondents to these collection of information requirements
would be investment advisers that are registered or required to be
registered with the Commission. As of October 31, 2021, there were
14,774 investment advisers registered with the Commission. As noted
above, these requirements are mandatory, and all registered investment
advisers would be subject to the requirements of the proposed rule.
Responses provided to the Commission in the context of its examination
and oversight program concerning proposed rule 206(4)-9 would be kept
confidential subject to the provisions of applicable law. These
collections of information would help increase the likelihood that
advisers and funds are prepared to respond to a cybersecurity incident,
and help protect investors from being significantly harmed by a
cybersecurity incident. These collections would also help facilitate
the Commission's inspection and enforcement capabilities. We have made
certain estimates of the burdens associated with the proposed rule
solely for the purpose of this PRA analysis. The table below summarizes
the initial and ongoing annual burden and cost estimates associated
with the proposed rule's policies and procedures and review and report
requirements.

                                                          Table 1--Rule 206(4)-9 PRA Estimates
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                             Internal                                                                                Annual
                                              initial      Internal annual burden hours \1\          Wage rate \2\         Internal time   external cost
                                           burden hours                                                                        costs          burden
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                            PROPOSED RULE 206(4)-9 ESTIMATES
--------------------------------------------------------------------------------------------------------------------------------------------------------
Adopting and implementing policies and                50  21.67 hours \4\...................  $396 (blended rate for           $8,581.32      \5\ $1,488
 procedures \3\.                                                                               compliance attorney and
                                                                                assistant general
                                                                                counsel).
Annual review of policies and procedures               0  10 hours \6\......................  $396 (blended rate for              $3,960      \7\ $1,984
 and report of review.                                                                         compliance attorney and
                                                                                assistant general
                                                                                counsel).
Total new annual burden per adviser.....  ..............  31.67 hours.......................  ..........................      $12,541.32          $3,472
Number of advisers......................  ..............  x 14,774..........................  ..........................        x 14,774        x 14,774
                                                         -----------------------------------------------------------------------------------------------
    Total new annual aggregate burden...  ..............  320,152.58 hours..................  ..........................    $185,285,462     $51,295,328
--------------------------------------------------------------------------------------------------------------------------------------------------------
Notes:
\1\ Includes initial burden estimates annualized over a 3-year period.
\2\ The Commission's estimates of the relevant wage rates are based on salary information for the securities industry compiled by Securities Industry
  and Financial Markets Association's Office Salaries in the Securities Industry 2013, as modified by Commission staff for 2020 (``SIFMA Wage Report'').
  The estimated figures are modified by firm size, employee benefits, overhead, and adjusted to account for the effects of inflation.
\3\ These estimates are based on an average. Some firms may have a lower burden in the case they will be evaluating exiting policies and procedures with
  respect to any cybersecurity risks and/or incidents, while other firms may be creating new cybersecurity policies and procedures altogether.
\4\ Includes initial burden estimates annualized over a three-year period, plus 5 ongoing annual burden hours. The estimate of 25 hours is based on the
  following calculation: ((50 initial hours/3) + 5 additional ongoing burden hours) = 21.67 hours.
\5\ This estimated burden is based on the estimated wage rate of $496/hour, for 3 hours, for outside legal services.
The Commission's estimates of the relevant wage rates for external time costs, such as outside legal services, take into account staff experience, a
  variety of sources including general information websites, and adjustments for inflation.
\6\ We estimate 10 additional ongoing burden hours.
\7\ This estimated burden is based on the estimated wage rate of $496/hour, for 2 hours, for outside legal services. See supra note 5 (regarding wage
  rates with respect to external cost estimates).

C. Rule 38a-2

    Proposed rule 38a-2 would require a fund to adopt and implement
written policies and procedures reasonably designed to address
cybersecurity risks.\278\ These cybersecurity policies and procedures
would address: Risk assessment, user security and access, information
protection, threat and vulnerability management, and incident response
and recovery. The proposed rule includes certain minimum activities
associated with each of these elements, including requirements for the
fund to identify and oversee any service providers that receive,
maintain, or process fund information, or are otherwise permitted to
access its information systems and any information residing therein.
---------------------------------------------------------------------------

    \278\ See proposed rule 38a-2; supra section II.A (discussing
the cybersecurity policies and procedures requirements).
---------------------------------------------------------------------------

    Under the rule, a fund would also, at least annually: (1) Review
and assess the design and effectiveness of those policies and
procedures; and (2) prepare and provide to the fund's board a written
report.\279\ The written report would also include an explanation of
any control tests performed, any cybersecurity incident that occurred
since the date of the last report, and any material changes to the
policies and procedures since the date of the last report.
---------------------------------------------------------------------------

    \279\ For unit investment trusts, the written report would be
provided to the principal underwriter or depositor.
---------------------------------------------------------------------------

    Finally, a fund would need to keep records related to the policies
and procedures, written reports, annual review, and any reports
provided to the Commission. Specifically, the fund would have to
maintain copies for at least five years, the first two years in an
easily accessible place, of: (1) Its cybersecurity policies and
procedures; (2) copies of written reports provided to its board; (3)
records documenting the fund's cybersecurity annual review; (4) any
report of a significant fund cybersecurity incident provided to the
Commission by its adviser that the proposed rule would require; (5)
records documenting the occurrence of a cybersecurity incident,
including records related to any response and recovery from such an
incident; and (6) and records documenting a fund's cybersecurity risk
assessments.\280\
---------------------------------------------------------------------------

    \280\ For unit investment trusts, copies of materials provided
the principal underwriter or depositor similarly would be required
to be maintained for at least five years after the end of the fiscal
year in which the documents were provided.
---------------------------------------------------------------------------

    Each requirement to disclose information, offer to provide
information, or to adopt policies and procedures constitutes a
collection of information requirement under the PRA. The respondents to
proposed rule 38a-2 would be registered investment companies and
BDCs.\281\ We estimate that 14,749 funds would be subject to these
proposed rule requirements.\282\ The collections of information
associated with these requirements would be mandatory, and responses
provided to the Commission in the context of its examination and
oversight program concerning proposed rule 38a-2 would be kept
confidential subject to the provisions of applicable law. These
collections of information would help increase the likelihood that
funds are prepared to respond to a cybersecurity incident, and help
protect investors from being significantly harmed by a cybersecurity
incident. These collections would also help facilitate the Commission's
inspection and enforcement capabilities. We have made certain estimates
of the burdens associated with the proposed rule, as discussed below,
solely for the purpose of this PRA analysis. The table below summarizes
the initial and ongoing annual burden and cost estimates associated
with the proposed rule.
---------------------------------------------------------------------------

    \281\ See proposed rule 38a-2(f) (defining ``fund'').
    \282\ As of December 2020, we estimate 14,654 registered
investment companies and 95 BDCs.

                                                           Table 2--Rule 38a-2: PRA Estimates
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                             Internal                                                                                Annual
                                              initial      Internal annual burden hours \1\          Wage rate \2\         Internal time   external cost
                                           burden hours                                                                        costs          burden
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                              PROPOSED RULE 38A-2 ESTIMATES
--------------------------------------------------------------------------------------------------------------------------------------------------------
Adopting and implementing policies and                60  25 hours \3\......................  $425 (blended rate for             $10,625      \4\ $5,952
 procedures.                                                                                compliance attorney and
                                                                                assistant general
                                                                                counsel).
Annual review of policies and procedures               9  6 hours \5\.......................  $425 (blended rate for              $2,550        \6\ $992
 and report.                                                                                compliance attorney and
                                                                                assistant general
                                                                                counsel).
Recordkeeping...........................               1  1 hour............................  $356 (blended rate for                $356              $0
                                                                                compliance attorney and
                                                                                senior programmer).
Total new annual burden per fund........  ..............  32 hours..........................  ..........................         $13,531          $6,944
Number of funds.........................  ..............  x 14,749 funds \7\................  ..........................  x 14,749 funds       \8\ 7,375
                                                         -----------------------------------------------------------------------------------------------
    Total new annual aggregate burden...  ..............  471,968 hours.....................  ..........................    $199,568,719     $51,212,000
--------------------------------------------------------------------------------------------------------------------------------------------------------
Notes:
\1\ Includes initial burden estimates annualized over a 3-year period.
\2\ The Commission's estimates of the relevant wage rates are based on the SIFMA Wage Report. The estimated figures are modified by firm size, employee
  benefits, overhead, and adjusted to account for the effects of inflation.
\3\ Includes initial burden estimates annualized over a three-year period, plus 5 ongoing annual burden hours. The estimate of 25 hours is based on the
  following calculation: ((60 initial hours/3) + 5 additional ongoing burden hours) = 25 hours.
\4\ This estimated burden is based on the estimated wage rate of $496/hour, for 12 hours, for outside legal services.
The Commission's estimates of the relevant wage rates for external time costs, such as outside legal services, take into account staff experience, a
  variety of sources including general information websites, and adjustments for inflation.
\5\ Includes initial burden estimates annualized over a three-year period, plus 8 ongoing annual burden hours. The estimate of 6 hours is based on the
  following calculation: ((9 initial hours/3) + 3 additional ongoing burden hours) = 6 hours.
\6\ This estimated burden is based on the estimated wage rate of $496/hour, for 2 hours, for outside legal services. See supra footnote 4 (regarding
  wage rates with respect to external cost estimates).
\7\ Includes all registered investment companies, plus BDCs.

\8\ We estimate that 50% of funds will use outside legal services for these collections of information. This estimate takes into account that funds may
  elect to use outside legal services (along with in-house counsel), based on factors such as fund budget and the fund's standard practices for using
  outside legal services, as well as personnel availability and expertise.

D. Rule 204-2

    Under section 204 of the Advisers Act, investment advisers
registered or required to register with the Commission under section
203 of the Advisers Act must make and keep for prescribed periods such
records (as defined in section 3(a)(37) of the Exchange Act), furnish
copies thereof, and make and disseminate such reports as the
Commission, by rule, may prescribe as necessary or appropriate in the
public interest or for the protection of investors. Rule 204-2 sets
forth the requirements for maintaining and preserving specified books
and records. This collection of information is found at 17 CFR 275.204-
2 and is mandatory. The Commission staff uses the collection of
information in its examination and oversight program. As noted above,
responses provided to the Commission in the context of its examination
and oversight program concerning the proposed amendments to rule 204-2
would be kept confidential subject to the provisions of applicable law.
    As part of the proposed cybersecurity risk management rules, we are
proposing corresponding amendments to rule 204-2, the books and records
rule. The proposed amendments would require advisers to retain: (1) A
copy of their cybersecurity policies and procedures formulated pursuant
to proposed rule 206(4)-9 that is in effect, or at any time within the
past five years was in effect; (2) a copy of the adviser's written
report documenting the annual review of its cybersecurity policies and
procedures pursuant to proposed rule 206(4)-9 in the last five years;
(3) a copy of any Form ADV-C filed by the adviser under rule 204-6 in
the last 5 years; (4) records documenting the occurrence of any
cybersecurity incident, as defined in rule 206(4)-9(c), occurring in
the last five years, including records related to any response and
recovery from such an incident; and (5) records documenting any risk
assessment conducted pursuant to the cybersecurity policies and
procedures required by rule 206(4)-9(a)(1) in the last five years.\283\
These proposed amendments would help facilitate the Commission's
inspection and enforcement capabilities.
---------------------------------------------------------------------------

    \283\ See proposed rule 204-2(a)(17)(i) through (vii).
---------------------------------------------------------------------------

    The respondents to this collection of information are investment
advisers registered or required to be registered with the Commission.
All such advisers will be subject to the proposed amendments to rule
204-2. As of October 31, 2021, there were 14,774 advisers that would be
subject to these policies and procedures requirement. In our most
recent Paperwork Reduction Act submission for rule 204-2, we estimated
for rule 204-2 a total annual aggregate hour burden of 2,764,563 hours,
and the total annual aggregate external cost burden is
$175,980,426.\284\ The table below summarizes the initial and ongoing
annual burden estimates associated with the proposed amendments to rule
204-2.\285\
---------------------------------------------------------------------------

    \284\ Supporting Statement for the Paperwork Reduction Act
Information Collection Submission for Revisions to Rule 204-2, OMB
Report, OMB 3235-0278 (Aug. 2021).
    \285\ We estimate the hourly wage rate for compliance clerk is
$70 and a general clerk is $62. The hourly wages used are from the
SIFMA Wage Report.

                                        Table 3--Rule 204-2 PRA Estimates
----------------------------------------------------------------------------------------------------------------
                                                                                Annual
                                  Internal hour burden             Wage rate       Internal time   external cost
                                                                                costs          burden
----------------------------------------------------------------------------------------------------------------
                                  PROPOSED ESTIMATES FOR RULE 204-2 AMENDMENTS
----------------------------------------------------------------------------------------------------------------
Retention of cybersecurity      1.......................   x   $68 (blended rate             $68              $0
 policies and procedures.                                       for general
                                                                clerk and
                                                                compliance
                                                                clerk).
Total burden per adviser......  ........................  ...  .................             $68               0
Total number of affected        x 14,774................  ...  .................        x 14,774               0
 advisers.
                               ---------------------------------------------------------------------------------
    Sub-total burden..........  14,774 hours............  ...  .................      $1,004,632               0
----------------------------------------------------------------------------------------------------------------
Retention of written report     1.......................   x   $68 (blended rate             $68               0
 documenting annual review.                                     for general
                                                                clerk and
                                                                compliance
                                                                clerk).
Total annual burden per         1.......................  ...  .................             $68               0
 adviser.
Total number of affected        x 14,774................  ...  .................        x 14,774               0
 advisers.
                               ---------------------------------------------------------------------------------
    Sub-total burden..........  14,774 hours............  ...  .................      $1,004,632               0
----------------------------------------------------------------------------------------------------------------
Retention of copy of any Form   1.......................   x   $68 (blended rate             $68               0
 ADV-C filed in last 5 years.                                   for general
                                                                clerk and
                                                                compliance
                                                                clerk).
Total annual burden per         1.......................  ...  .................             $68               0
 adviser.
Total number of affected        x 14,774................  ...  .................        x 14,774               0
 advisers.
                               ---------------------------------------------------------------------------------
    Sub-total burden..........  14,774 hours............  ...  .................      $1,004,632               0
----------------------------------------------------------------------------------------------------------------
Retention of records            1.......................   x   $68 (blended rate             $68               0
 documenting a cybersecurity                                    for general
 incident.                                                      clerk and
                                                                compliance
                                                                clerk).
Total annual burden per         1.......................  ...  .................             $68               0
 adviser.
Total number of affected        x 14,774................  ...  .................        x 14,774               0
 advisers.
                               ---------------------------------------------------------------------------------
    Sub-total burden..........  14,774 hours............  ...  .................      $1,004,632               0
----------------------------------------------------------------------------------------------------------------

Retention of records            1.......................   x   $68 (blended rate             $68               0
 documenting an adviser's                                       for general
 cybersecurity risk assessment.                                 clerk and
                                                                compliance
                                                                clerk).
Total annual burden per         1.......................  ...  .................             $68               0
 adviser.
Total number of affected        x 14,774................  ...  .................        x 14,774               0
 advisers.
                               ---------------------------------------------------------------------------------
    Sub-total burden..........  14,774 hours............  ...  .................      $1,004,632               0
----------------------------------------------------------------------------------------------------------------
Total annual aggregate burden   73,870 hours............  ...  .................      $5,023,160               0
 of rule 204-2 amendments.
Current annual estimated        2,764,563 hours.........  ...  .................    $175,980,426               0
 aggregate burden of rule 204-
 2.
Total annual aggregate burden   2,838,433 hours.........  ...  .................    $181,003,586               0
 of rule 204-2.
----------------------------------------------------------------------------------------------------------------

E. Rule 204-6

    Proposed rule 204-6 would require investment advisers to report on
new Form ADV-C a significant adviser cybersecurity incident or a
significant fund cybersecurity incident. The rule would define a
significant adviser cybersecurity incident as a cybersecurity incident,
or a group of related incidents, that significantly disrupts or
degrades the adviser's ability, or the ability of a private fund client
of the adviser, to maintain critical operations, or leads to the
unauthorized access or use of adviser information, where the
unauthorized access or use of such information results in: (1)
Substantial harm to the adviser, or (2) substantial harm to a client,
or an investor in a private fund, whose information was accessed.\286\
Proposed rule 204-6 would also require advisers to amend promptly any
previously filed Form ADV-C in the event information reported on the
form becomes materially inaccurate; if new material information about a
previously reported incident is discovered; and after resolving a
previously reported incident or closing an internal investigation
pertaining to pertaining to a previously disclosed incident.
---------------------------------------------------------------------------

    \286\ See proposed rule 204-6(b).
---------------------------------------------------------------------------

    The respondents to this collection of information are investment
advisers registered or required to be registered with the Commission.
As noted above, this requirement is mandatory, and all registered
investment advisers will be subject to the requirements of the proposed
rule. Responses provided to the Commission would be kept confidential
subject to the provisions of applicable law. This collection of
information would help the Commission's examination and oversight
program efforts in identifying patterns and trends across registrants
regarding such incidents. As of October 31, 2021, there were 14,774
registered advisers that would be subject to this reporting
requirement. The table below summarizes the initial and ongoing annual
burden and cost estimates associated with the proposed rule's reporting
requirement.

                                                            Table 4--Rule 204-6 PRA Estimates
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                           Internal                                                                                Annual
                                        initial burden    Internal annual burden hours                 Wage rate           Internal time   external cost
                                             hours                                                                             costs          burden
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                           PROPOSED ESTIMATES
--------------------------------------------------------------------------------------------------------------------------------------------------------
Making a determination of significant                3  3 hours \1\.....................   x   $353 (blended rate for             $1,059      \2\ $1,488
 cybersecurity incident.                                                                        assistant general
                                                                                counsel, compliance
                                                                                manager and systems
                                                                                analyst).
Amending Form ADV-C as required (e.g.,               1  1 hour..........................   x   $396 (blended rate for               $396        \3\ $496
 if any of the information previously                                                           assistant general
 filed on Form ADV-C becomes                                                                    counsel and compliance
 materially inaccurate).                                                                        manager).
Total new annual burden per adviser...  ..............  4 hours.........................  ...  .........................          $1,455          $1,984
Number of advisers....................  ..............  x 14,774........................  ...  .........................        x 14,774        x 14,774
                                       -----------------------------------------------------------------------------------------------------------------
    Total new aggregate annual burden.  ..............  59,096 hours....................  ...  .........................     $21,496,170     $29,311,616
--------------------------------------------------------------------------------------------------------------------------------------------------------
Notes:
\1\ Includes initial burden estimates annualized over a three-year period, plus 2 ongoing annual burden hours. The estimate of 6 hours is based on the
  following calculation: ((3 initial hours/3) + 2 additional ongoing burden hours) = 3 hours.
\2\ This estimated burden is based on the estimated wage rate of $496/hour, for 3 hours, for outside legal services.
The Commission's estimates of the relevant wage rates for external time costs, such as outside legal services, take into account staff experience, a
  variety of sources including general information websites, and adjustments for inflation.
\3\ This estimated burden is based on the estimated wage rate of $496/hour, for 1 hour, for outside legal services.

F. Form ADV-C

    The Commission is proposing a new Form ADV-C to require an adviser
to provide information regarding a significant cybersecurity incident
in a structured format through a series of check-the-box and fill-in-
the-blank questions. Proposed Form ADV-C would require advisers to
report certain information regarding a significant cybersecurity
incident in order to allow the Commission and its staff to understand
the nature and extent of the cybersecurity incident and the adviser's
response to the incident. We believe that collecting information in a
structured format would enhance the Commission's and its staff's
ability to effectively carry out the risk-based examination program and
other risk assessment and monitoring activities. The structured format
would also assist the Commission and its staff in assessing trends in
cybersecurity incidents across the industry.
    The respondents to this collection of information are investment
advisers registered or required to be registered with the Commission.
As noted above, the collection of this information is mandatory for all
registered advisers. Information filed on Form ADV-C would be kept
confidential subject to the provisions of applicable law. As of October
31, 2021, there were 14,774 registered advisers that would be subject
to this reporting requirement. The table below summarizes the initial
and ongoing annual burden and cost estimates associated with filing
proposed Form ADV-C.

                                                            Table 5--Form ADV-C PRA Estimates
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                           Internal                                                                                Annual
                                        initial burden    Internal annual burden hours                 Wage rate           Internal time   external cost
                                             hours                                                                             costs          burden
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                              PROPOSED FORM ADV-C ESTIMATES
--------------------------------------------------------------------------------------------------------------------------------------------------------
Form ADV-C............................               3  1.5 hours \1\...................   x   $396 (blended rate for               $594        \2\ $496
                                                                                assistant general
                                                                                counsel and compliance
                                                                                manager).
Total new annual burden per adviser...  ..............  1.5 hours.......................  ...  .........................  ..............            $496
Number of advisers....................  ..............  x 14,774........................  ...  .........................        x 14,774        x 14,774
                                                       -------------------------------------------------------------------------------------------------
    Total new aggregate annual burden.  ..............  22,161 hours....................  ...  .........................      $8,775,756      $7,327,904
--------------------------------------------------------------------------------------------------------------------------------------------------------
Notes:
\1\ Includes initial burden estimates annualized over a three-year period, plus 0.5 ongoing annual burden hours. The estimate of 1.5 hours is based on
  the following calculation: ((3 initial hours/3) + 0.5 additional ongoing burden hours) = 1.5 hours.
\2\ This estimated burden is based on the estimated wage rate of $496/hour, for 1 hour, for outside legal services.
The Commission's estimates of the relevant wage rates for external time costs, such as outside legal services, takes into account staff experience, a
  variety of sources including general information websites, and adjustments for inflation.

G. Form ADV

    Form ADV is the investment adviser registration form under the
Advisers Act. Part 1 of Form ADV contains information used primarily by
Commission staff, and Part 2A is the client brochure. Part 2B requires
advisers to create brochure supplements containing information about
certain supervised persons. Part 3: Form CRS (relationship summary)
requires certain registered investment advisers to prepare and file a
relationship summary for retail investors. We use the information on
Form ADV to determine eligibility for registration with us and to
manage our regulatory and examination programs. Clients and investors
use certain of the information to determine whether to hire or retain
an investment adviser, as well as what types of accounts and services
are appropriate for their needs. The collection of information is
necessary to provide advisory clients, prospective clients, other
market participants and the Commission with information about the
investment adviser and its business, conflicts of interest and
personnel. Rule 203-1 under the Advisers Act requires every person
applying for investment adviser registration with the Commission to
file Form ADV. Rule 204-4 under the Advisers Act requires certain
investment advisers exempt from registration with the Commission
(``exempt reporting advisers'' or ``ERAs'') to file reports with the
Commission by completing a limited number of items on Form ADV. Rule
204-1 under the Advisers Act requires each registered and exempt
reporting adviser to file amendments to Form ADV at least annually, and
requires advisers to submit electronic filings through IARD. The
paperwork burdens associated with rules 203-1, 204-1, and 204-4 are
included in the approved annual burden associated with Form ADV and
thus do not entail separate collections of information. These
collections of information are found at 17 CFR 275.203-1, 275.204-1,
275.204-4 and 279.1 (Form ADV itself) and are mandatory. Responses are
not kept confidential.
    We are proposing amendments to Form ADV to provide clients and
prospective clients with information regarding an adviser's
cybersecurity risks and significant cybersecurity incidents that have
occurred in the past two years. Specifically, the proposed amendments
would add a new Item 20 entitled ``Cybersecurity Risks and Incidents''
to Form ADV's narrative brochure, or Part 2A. The brochure, which is
publicly available and the primary client-facing disclosure document,
contains information about the investment adviser's business practices,
fees, risks, conflicts of interest, and disciplinary events. We believe
the narrative format of the brochure would allow advisers to present
clear and meaningful cybersecurity disclosure to their clients and
prospective clients. Advisers would be required to, in plain English,
describe cybersecurity risks that could materially affect the advisory
services they offer and describe how they assess, prioritize, and
address cybersecurity risks created by the nature and scope of their
business. The proposed amendments would also require advisers to
describe any significant adviser cybersecurity incidents that have
occurred within the last two years.
    The collection of information is necessary to improve information
available to us and to the general public about advisers' cybersecurity
risks and

incidents. Our staff would use this information to help prepare for
examinations of investment advisers. This information would be
particularly useful for staff in reviewing an adviser's compliance with
the proposed rulemakings and rule amendments. We are not proposing
amendments to Parts 1 or 3 of Form ADV.
    The respondents to current Form ADV are investment advisers
registered with the Commission or applying for registration with the
Commission and exempt reporting advisers.\287\ Based on the IARD system
data as of October 31, 2021, approximately 14,774 investment advisers
were registered with the Commission, and 4,985 exempt reporting
advisers file reports with the Commission. The amendments we are
proposing would increase the information requested in Part 2A of Form
ADV for registered investment advisers. Because exempt reporting
advisers are not required to complete Form ADV Part 2A, they would not
be subject to the proposed amendments to Form ADV Part 2A and would
therefore not be subject to this collection of information.\288\
However, these exempt reporting advisers are included in the PRA for
purposes of updating the overall Form ADV information collection. In
addition, the burdens associated with completing Part 3 are included in
the PRA for purposes of updating the overall Form ADV information
collection.\289\ Based on the prior revision of Form ADV, we estimated
the annual compliance burden to comply with the collection of
information requirement of Form ADV is 433,004 burden hours and an
external cost burden estimate of $14,125,083.\290\ We propose the
following changes to our PRA methodology for Form ADV:
---------------------------------------------------------------------------

    \287\ An exempt reporting adviser is an investment adviser that
relies on the exemption from investment adviser registration
provided in either section 203(l) of the Advisers Act because it is
an adviser solely to one or more venture capital funds or section
203(m) of the Advisers Act because it is an adviser solely to
private funds and has assets under management in the United States
of less than $150 million.
    \288\ An exempt reporting adviser is not a registered investment
adviser and therefore would not be subject to the proposed
amendments to Item 5 of Form ADV Part 1A. Exempt reporting advisers
are required to complete a limited number of items in Part 1A of
Form ADV (consisting of Items 1, 2.B., 3, 6, 7, 10, 11, and
corresponding schedules), and are not required to complete Part 2.
    \289\ See Updated Supporting Statement for PRA Submission for
Amendments to Form ADV under the Investment Advisers Act of 1940
(``Approved Form ADV PRA'').
    \290\ See Investment Adviser Marketing, Final Rule, Investment
Advisers Act Release No. 5653 (Dec. 22, 2020) [81 FR 60418 (Mar. 5,
2021)] and corresponding submission to the Office of Information and
Regulatory Affairs at reginfo.gov (``2021 Form ADV PRA'').
---------------------------------------------------------------------------

     Form ADV Parts 1 and 2. Form ADV PRA has historically
calculated a per adviser per year hourly burden for Form ADV Parts 1
and 2 for each of (1) the initial burden and (2) the ongoing burden,
which reflects advisers' filings of annual and other-than-annual
updating amendments. We noted in previous PRA amendments that most of
the paperwork burden for Form ADV Parts 1 and 2 would be incurred in
the initial submissions of Form ADV. However, recent PRA amendments
have continued to apply the total initial hourly burden for Parts 1 and
2 to all currently registered or reporting RIAs and ERAs, respectively,
in addition to the estimated number of new advisers expected to be
registering or reporting with the Commission annually. We believe that
the total initial hourly burden for Form ADV Parts 1 and 2 going
forward should be applied only to the estimated number of expected new
advisers annually. This is because currently registered or reporting
advisers have generally already incurred the total initial burden for
filing Form ADV for the first time. On the other hand, the estimated
expected new advisers will incur the full total burden of initial
filing of Form ADV, and we believe it is appropriate to apply this
total initial burden to these advisers. We propose to continue to apply
any new initial burdens resulting from proposed amendments to Form ADV
Part 2, as applicable, to all currently registered or reporting
investment advisers plus all estimated expected new RIAs and ERAs
annually.
    Table 6 below summarizes the burden estimates associated with the
proposed amendments to Form ADV Part 2A. The proposed new burdens take
into account changes in the numbers of advisers since the last approved
PRA for Form ADV, and the increased wage rates due to inflation.

                                                             Table 6--Form ADV PRA Estimates
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                 Internal annual
                                        Internal initial     amendment burden hours      Wage rate \2\       Internal time costs    Annual external cost
                                          burden hours                 \1\                                                               burden \3\
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                             PROPOSED AMENDMENTS TO FORM ADV
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                        RIAs (burden for Parts 1 and 2, not including private fund reporting) \4\
--------------------------------------------------------------------------------------------------------------------------------------------------------
Proposed addition (per adviser) to   3 hours...............  0.2 hours.............  $279.50 per hour       3.2 hours x $279.50 =  1 hour of external
 Part 2A (Item 20).                                                                   (blended rate for      $894.4.                legal services
                                                                                senior compliance                             ($496) for \1/4\ of
                                                                                examiner and                                  advisers that
                                                                                compliance manager)                           prepare Part 2; 1
                                                                                \5\.                                          hour of external
                                                                                compliance
                                                                                consulting services
                                                                                ($739) for \1/2\ of
                                                                                advisers that
                                                                                prepare Part 2.\6\
--------------------------------------------------------------------------------------------------------------------------------------------------------
Current burden per adviser \7\.....  29.72 hours \8\.......  11.8 hours \9\........  $273 per hour          (29.72 + 11.8) x $273  $2,069,250 aggregated
                                                                                (blended rate for      = $11,334.96.          (previously
                                                                                senior compliance                             presented only in
                                                                                examiner and                                  the aggregate) \10\
                                                                                compliance manager).
--------------------------------------------------------------------------------------------------------------------------------------------------------
Revised burden per adviser.........  29.72 hours + 3 hours   0.2 hours + 11.8 hours  $279.50 (blended rate  (32.72 + 12) x $279.5  $4,689.50.\11\
                                      = 32.72 hours.          = 12 hours.             for senior             = $12,499.24.
                                                                                compliance examiner
                                                                                and compliance
                                                                                manager).
--------------------------------------------------------------------------------------------------------------------------------------------------------
Total revised aggregate burden       61,140.08 \12\........  183,456 hours \13\....  Same as above........  (61,140.08 + 183,456)  $9,701,372.\14\
 estimate.                                                                                x $279.5 =
                                                                                $68,364,604.40.
--------------------------------------------------------------------------------------------------------------------------------------------------------

                                                              RIAs (burden for Part 3) \15\
--------------------------------------------------------------------------------------------------------------------------------------------------------
No proposed changes................  ......................  ......................  .....................  .....................  .....................
--------------------------------------------------------------------------------------------------------------------------------------------------------
Current burden per RIA.............  20 hours, amortized     1.58 hours \17\.......  $273 (blended rate     $273 x (6.67 + 1.71)   $2,433.74 per
                                      over three years =                              for senior             = $2,287.74.           adviser.\18\
                                      6.67 hours \16\.                                compliance examiner
                                                                                and compliance
                                                                                manager).
--------------------------------------------------------------------------------------------------------------------------------------------------------
Total updated aggregate burden       66,149.59 hours \19\..  14,573.92 hours \20\..  Same as above........  $22,562,221 (($279.50  $8,157,555.\21\
 estimate.                                                                                x (66,149.59 hours +
                                                                                14,573.92 hours)).
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                          ERAs (burden for Part 1A, not including private fund reporting) \22\
--------------------------------------------------------------------------------------------------------------------------------------------------------
No proposed changes
Current burden per ERA.............  3.60 hours \23\.......  1.5 hours + final       $273 (blended rate     Wage rate x total      $0
                                                              filings \24\.           for senior             hours (see below).
                                                                                compliance examiner
                                                                                and compliance
                                                                                manager).
Total updated aggregate burden       1,245.6 \25\..........  8,033.6 hours \26\....  Same as above........  $2,593,536.40 ($279.5  $0.
 estimate.                                                                                x (1,245.6 + 8,033.6
                                                                                hours)).
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                               Private Fund Reporting \27\
--------------------------------------------------------------------------------------------------------------------------------------------------------
No proposed changes................  ......................  ......................  .....................  .....................  .....................
--------------------------------------------------------------------------------------------------------------------------------------------------------
Current burden per adviser to        1 hour per private      N/A-included in the     $273 (blended rate     .....................  Cost of $46,865.74
 private fund.                        fund \28\.              existing annual         for senior                                    per fund, applied to
                                                              amendment reporting     compliance examiner                           6% of RIAs that
                                                              burden for ERAs.        and compliance                                report private
                                                                                manager).                                     funds.\29\
--------------------------------------------------------------------------------------------------------------------------------------------------------
Total updated aggregate burden       1,150 hours \30\......  N/A...................  Same as above........  $3,978,123.5 ($279.5   $15,090,768.30.\31\
 estimate.                                                                                x 14,233 hours)).
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                      TOTAL ESTIMATED BURDENS, INCLUDING AMENDMENTS
--------------------------------------------------------------------------------------------------------------------------------------------------------
Current per adviser burden/external  23.82 hours \32\......  ......................  .....................  23.82 hours x $273 =   $777.\33\
 cost per adviser.                                                                                $6,502.86 per
                                                                                adviser cost of the
                                                                                burden hour.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Revised per adviser burden/external  16.28 hours \34\......  ......................  .....................  16.28 hours x $279.5   $1,598.03.\35\
 cost per adviser.                                                                                = $4,550.26 per
                                                                                adviser cost of the
                                                                                burden hour.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Current aggregate burden estimates.  433,004 initial and amendment hours annually \36\                      433,004 x $273 =       $14,125,083.\37\
                                                                                $118,210,092
                                                                                aggregate cost of
                                                                                the burden hour.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Revised aggregate burden estimates.  335,748.793 \38\ Initial and amendment hours annually                  290,831.73 x $279.5 =  $32,949,695.30.\39\
                                                                                $81,287,468.54
                                                                                aggregate cost of
                                                                                the burden hour.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Notes:
\1\ This column estimates the hourly burden attributable to annual and other-than-annual updating amendments to Form ADV, plus RIAs' ongoing obligations
  to deliver codes of ethics to clients.
\2\ As with Form ADV generally, and pursuant to the currently approved PRA (see 2021 Form ADV PRA), we expect that for most RIAs and ERAs, the
  performance of these functions will most likely be equally allocated between a senior compliance examiner and a compliance manager, or persons
  performing similar functions. The Commission's estimates of the relevant wage rates are based on salary information for the securities industry
  compiled by the SIFMA Wage Report. The estimated figures are modified by firm size, employee benefits, overhead, and adjusted to account for the
  effects of inflation. For RIAs and ERAs that do not already have a senior compliance or a compliance manager, we expect that a person performing a
  similar function would have similar hourly costs. The estimated wage rates in connection with the proposed PRA estimates are adjusted for inflation
  from the wage rates used in the currently approved PRA analysis.
\3\ External fees are in addition to the projected hour per adviser burden. Form ADV has a one-time initial cost for outside legal and compliance
  consulting fees in connection with the initial preparation of Parts 2 and 3 of the form. In addition to the estimated legal and compliance consulting
  fees, investment advisers of private funds incur one-time costs with respect to the requirement for investment advisers to report the fair value of
  private fund assets.
\4\ Based on Form ADV data as of October 31, 2021, we estimate that there are 14,774 RIAs (``current RIAs'') and 514 advisers that are expected to
  become RIAs annually (``newly expected RIAs'').
\5\ The $279.50 wage rate reflects current estimates from the SIFMA Wage Report of the blended hourly rate for a senior compliance examiner ($243) and a
  compliance manager ($316). ($243 + $316) /2 = $279.5.
\6\ We estimate that a quarter of RIAs would seek the help of outside legal services and half would seek the help of compliance consulting services in
  connection with the proposed amendments to Form ADV Part 2. This is based on previous estimates and ratios we have used for advisers we expect to use
  external services for initially preparing various parts of Form ADV. See 2020 Form ADV PRA Renewal (the subsequent amendment to Form ADV described in
  the 2021 Form ADV PRA did not change that estimate). Because the SIFMA Wage Report does not include a specific rate for outside compliance consultant,
  we are proposing to use the rates in the SIFMA Wage Report for outside management consultant, as we have done in the past when estimating the rate of
  outside compliance counsel. We are adjusting these external costs for inflation, using the currently estimated costs for outside legal counsel and
  outside management consultants in the SIFMA Wage Report: $495 per hour for outside counsel, and $739 per hour for outside management consultant
  (compliance consultants).
\7\ Per above, we are proposing to revise the PRA calculation methodology to apply the full initial burden only to expected RIAs, as we believe that
  current RIAs have generally already incurred the burden of initially preparing Form ADV.
\8\ See 2020 Form ADV PRA Renewal (stating that the estimate average collection of information burden per adviser for Parts 1 and 2 is 29.22 hours,
  prior to the most recent amendment to Form ADV). See also 2021 Form ADV PRA (adding 0.5 hours to the estimated initial burden for Part 1A in
  connection with the most recent amendment to Form ADV). Therefore, the current estimated average initial collection of information hourly burden per
  adviser for Parts 1 and 2 is 29.72 hours (29.22 + 0.5 = 29.72).

\9\ The currently approved average total annual burden for RIAs attributable to annual and other-than-annual updating amendments to Form ADV Parts 1 and
  2 is 10.5 hours per RIA, plus 1.3 hours per year for each RIA to meet its obligation to deliver codes of ethics to clients (10.5 + 1.3 = 11.8 hours
  per adviser). See 2020 Form ADV PRA Renewal (these 2020 hourly estimates were not affected by the 2021 amendments to Form ADV). As we explained in
  previous PRAs, we estimate that each RIA filing Form ADV Part 1 will amend its form 2 times per year, which consists of one interim updating amendment
  (at an estimated 0.5 hours per amendment), and one annual updating amendment (at an estimated 8 hours per amendment), each year. We also explained
  that we estimate that each RIA will, on average, spend 1 hour per year making interim amendments to brochure supplements, and an additional 1 hour per
  year to prepare brochure supplements as required by Form ADV Part 2. See id.
\10\ See 2020 Form ADV PRA Renewal (the subsequent amendment to Form ADV described in the 2021 Form ADV PRA did not affect that estimate).
\11\ External cost per RIA includes the external cost for initially preparing Part 2, which we have previously estimated to be approximately 10 hours of
  outside legal counsel for a quarter of RIAs, and 8 hours of outside management consulting services for half of RIAs. See 2020 Form ADV Renewal (these
  estimates were not affected by subsequent amendments to Form ADV). We add to this burden the estimated external cost associated with the proposed
  amendment (an additional hour of each, bringing the total to 11 hours and 9 hours, respectively, for \1/4\ and \1/2\ of RIAs, respectively). (((.25 x
  14,774 RIAs) x ($496 x 11 hours)) + ((0.50 x 14,774 RIAs) x ($739 x 9 hours))) /14,774 RIAs = $4,689.50 per adviser.
\12\ Per above, we are proposing to revise the PRA calculation methodology for current RIAs to not apply the full initial burden to current RIAs, as we
  believe that current RIAs have generally already incurred the initial burden of preparing Form ADV. Therefore, we calculate the initial burden
  associated with complying with the proposed amendment of 3 initial hours x 14,774 current RIAs = 44,322 initial hours in the first year aggregated for
  current RIAs. We are not amortizing this burden because we believe current advisers will incur it in the first year. For expected RIAs, we estimate
  that they will incur the full revised initial burden, which is 32.72 hours per RIA. Therefore, 32.72 hours x 514 expected RIAs = 16,818.08 aggregate
  hours for expected RIAs. We do not amortize this burden for expected new RIAs because we expect a similar number of new RIAs to incur this initial
  burden each year. Therefore, the total revised aggregate initial burden for current and expected RIAs is 44,322 hours + 16,818.08 hours = 61,140.08
  aggregate initial hours.
\13\ 12 amendment hours x (14,774 current RIAs + 514 expected new RIAs) = 183,456 aggregate amendment hours.
\14\ Per above, for current RIAs, we are proposing to not apply the currently approved external cost for initially preparing Part 2, because we believe
  that current RIAs have already incurred that initial external cost. For current RIAs, therefore, we are applying only the external cost we estimate
  they will incur in complying with the proposed amendment. Therefore, the revised total burden for current RIAs is (((.25 x 14,774 RIAs) x ($496 x 1
  hour)) + ((0.50 x 14,774 RIAs) x ($739 x 1 hour))) /14,774 RIAs = $7,290,969 aggregated for current RIAs, We do not amortize this cost for current
  RIAs because we expect current RIAs will incur this initial cost in the first year. For expected RIAs, we apply the currently approved external cost
  for initially preparing Part 2 plus the estimated external cost for complying with the proposed amendment. Therefore, $4,689.50 per expected RIA x 514
  = $2,410,403 aggregated for expected RIAs. We do not amortize this cost for expected new RIAs because we expect a similar number of new RIAs to incur
  this external cost each year. $7,290,969 aggregated for current RIAs + $2,410,403 aggregated for expected RIAs = $9,701,372 aggregated external cost
  for RIAs.
\15\ Even though we are not proposing amendments to Form ADV Part 3 (``Form CRS''), the burdens associated with completing Part 3 are included in the
  PRA for purposes of updating the overall Form ADV information collection. Based on Form ADV data as of October 31, 2021, we estimate that 8,877
  current RIAs provide advice to retail investors and are therefore required to complete Form CRS, and we estimate an average of 347 expected new RIAs
  to be advising retail advisers and completing Form CRS for the first time annually.
\16\ See Form CRS Relationship Summary; Amendments to Form ADV, Investment Advisers Act Release No. 5247 (Jun. 5, 2019) [84 FR 33492 (Sep. 10, 2019)]
  (``2019 Form ADV PRA''). Subsequent PRA amendments for Form ADV have not adjusted the burdens or costs associated with Form CRS. Because Form CRS is
  still a new requirement for all applicable RIAs, we have, and are continuing to, apply the total initial amendment burden to all current and expected
  new RIAs that are required to file Form CRS, and amortize that initial burden over three years for current RIAs.
\17\ As reflected in the currently approved PRA burden estimate, we stated that we expect advisers required to prepare and file the relationship summary
  on Form ADV Part 3 will spend an average 1 hour per year making amendments to those relationship summaries and will likely amend the disclosure an
  average of 1.71 times per year, for approximately 1.58 hours per adviser. See 2019 Form ADV PRA (these estimates were not amended by the 2021
  amendments to Form ADV).
\18\ See 2020 Form ADV PRA Amendment (this cost was not affected by the subsequent amendment to Form ADV and was not updated in connection with that
  amendment; while this amendment did not break out a per adviser cost, we calculated this cost from the aggregate total and the number of advisers we
  estimated prepared Form CRS). Note, however, that in our 2020 Form ADV PRA Renewal, we applied the external cost only to expected new retail RIAs,
  whereas we had previously applied the external cost to current and expected retail RIAs. We believe that since Form CRS is still a newly adopted
  requirement, we should continue to apply the cost to both current and expected new retail RIAs. See 2019 Form ADV PRA.
\19\ 8,877 current RIAs x 6.67 hours each for initially preparing Form CRS = 59,209.59 aggregate hours for current RIAs initially filing Form CRS. For
  expected new RIAs initially filing Form CRS each year, we are not proposing to use the amortized initial burden estimate, because we expect a similar
  number of new RIAs to incur the burden of initially preparing Form CRS each year. Therefore, 347 expected new RIAs x 20 initial hours for preparing
  Form CRS = 6,940 aggregate initial hours for expected RIAs. 59,209.59 hours + 6,940 hours = 66,149.59 aggregate hours for current and expected RIAs to
  initially prepare Form CRS.
\20\ 1.58 hours x (8,877 current RIAs updating Form CRS + 347 expected new RIAs updating Form CRS) = 14,573.92 aggregate amendment hours per year for
  RIAs updating Form CRS.
\21\ We have previously estimated the initial preparation of Form CRS would require 5 hours of external legal services for an estimated quarter of
  advisers that prepare Part 3, and; 5 hours of external compliance consulting services for an estimated half of advisers that prepare Part 3. See 2020
  PRA Renewal (these estimates were not amended by the most recent amendment to Form ADV). The hourly cost estimate of $496 and $739 for outside legal
  services and management consulting services, respectively, are based on an inflation-adjusted figure in the SIFMA Wage Report. Therefore, (((.25 x
  8,877 current RIAs preparing Form CRS) x ($496 x 5 hours)) + ((0.50 x 8,877 current RIAs preparing Form CRS) x ($739 x 5 hours))) = $21,903,997.50.
  For current RIAs, since this is still a new requirement, we amortize this cost over three years for a per year initial external aggregated cost of
  $7,301,332.50. For expected RIAs that we expect would prepare Form CRS each year, we use the following formula: (((.25 x 347 expected RIAs preparing
  Form CRS) x ($496 x 5 hours)) + ((0.50 x 347 expected RIAs preparing Form CRS) x ($739 x 5 hours))) = $856,222.50 aggregated cost for expected RIAs.
  We are not amortizing this initial cost because we estimate a similar number of new RIAs would incur this initial cost in preparing Form CRS each
  year, $7,301,332.50 + $856,222.50 = $8,157,555 aggregate external cost for current and expected RIAs to initially prepare Form CRS.
\22\ Based on Form ADV data as of October 31, 2021, we estimate that there are 4,985 currently reporting ERAs (``current ERAs''), and an average of 346
  expected new ERAs annually (``expected ERAs'').
\23\ See 2021 Form ADV PRA.
\24\ The previously approved average per adviser annual burden for ERAs attributable to annual and updating amendments to Form ADV is 1.5 hours. See
  2021 Form ADV PRA. As we have done in the past, we add to this burden the burden for ERAs making final filings, which we have previously estimated to
  be 0.1 hour per applicable adviser, and we estimate that an expected 371 current ERAs will prepare final filings annually, based on Form ADV data as
  of December 2020.
\25\ For current ERAs, we are proposing to not apply the currently approved burden for initially preparing Form ADV, because we believe that current
  ERAs have already incurred this burden. For expected ERAs, we are applying the initial burden of preparing Form ADV of 3.6 hours. Therefore, 3.6 hours
  x 346 expected new ERAs per year = 1,245.6 aggregate initial hours for expected ERAs. For these expected ERAs, we are not proposing to amortize this
  burden, because we expect a similar number of new ERAs to incur this burden each year. Therefore, we estimate 1,245.6 aggregate initial annual hours
  for expected ERAs.
\26\ The previously approved average total annual burden of ERAs attributable to annual and updating amendments to Form ADV is 1.5 hours. See 2020 Form
  ADV Renewal (this estimate was not affected by the subsequent amendment to Form ADV). As we have done in the past, we added to this burden the
  currently approved burden for ERAs making final filings of 0.1 hour, and multiplied that by the number of final filings we are estimating ERAs would
  file per year (371 final filings based on Form ADV data as of December 2020). (1.5 hours x 4,985 currently reporting ERAs) + (0.1 hour x 371 final
  filings) = 7,514.6 updated aggregated hours for currently reporting ERAs. For expected ERAs, the aggregate burden is 1.5 hours for each ERA
  attributable to annual and other-than-annual updating amendments to Form ADV x 346 expected new ERAs = 519 annual aggregated hours for expected new
  ERAs updating Form ADV (other than for private fund reporting). The total aggregate amendment burden for ERAs (other than for private fund reporting)
  is 7,514.6 + 519 = 8,033.6 hours.
\27\ Based on Form ADV data as of October 31, 2021, we estimate that 5,232 current RIAs advise 43,501 private funds, and expect an estimated 136 new
  RIAs will advise 407 reported private funds per year. We estimate that 4,959 current ERAs advise 23,476 private funds, and estimate an expected 372
  new ERAs will advise 743 reported private funds per year. Therefore, we estimate that there are 66,977 currently reported private funds reported by
  current private fund advisers (43,501 + 23,476), and there will be annually 1,150 new private funds reported by expected private fund advisers (407 +
  743). The total number of current and expected new RIAs that report or are expected to report private funds is 5,368 (5,232 current RIAs that report
  private funds + 136 expected RIAs that would report private funds).
\28\ See 2020 Form ADV PRA Renewal (this per adviser burden was not affected by subsequent amendments to Form ADV).
\29\ We previously estimated that an adviser without the internal capacity to value specific illiquid assets would obtain pricing or valuation services
  at an estimated cost of $37,625 each on an annual basis. See Rules Implementing Amendments to the Investment Advisers Act of 1940, Investment Advisers
  Act Release No. IA-3221 (Jun. 22, 2011) [76 FR 42950 (Jul. 19, 2011)]. However, because we estimated that external cost in 2011, we are proposing to
  use an inflation-adjusted cost of $46,865.74, based on the CPI calculator published by the Bureau of Labor Statistics at https://www.bls.gov/data/inflation_calculator.htm. As with previously approved PRA methodologies, we continue to estimate that 6% of RIAs have at least one private fund client
  that may not be audited. See 2020 Form ADV PRA Renewal.
\30\ Per above, for currently reported private funds, we are proposing to not apply the currently approved burden for initially reporting private funds
  on Form ADV, because we believe that current private fund advisers have already incurred this burden. For the estimated 1,150 new private funds
  annually of expected private fund advisers, we calculate the initial burden of 1 hour per private fund. 1 hour per expected new private fund x 1,150
  expected new private funds = 1,150 aggregate hours for expected new private funds. For these expected new private funds, we are not proposing to
  amortize this burden, because we expect new private fund advisers to incur this burden with respect to new private funds each year. Therefore, we
  estimate 1,150 aggregate initial hours for expected private fund advisers.

\31\ As with previously approved PRA methodologies, we continue to estimate that 6% of registered advisers have at least one private fund client that
  may not be audited, therefore we estimate that the total number of audits for current and expected RIAs is 6% x 5,368 current and expected RIAs
  reporting private funds or expected to report private funds = 322.08 audits. We therefore estimate that approximately 322 registered advisers incur
  costs of $46,865.74 each on an annual basis (see note 29 describing the cost per audit), for an aggregate annual total cost of $15,090,768.30.
\32\ 433,004 currently approved burden hours /18,179 advisers (current and expected annually) = 23.82 hours per adviser. See 2021 Form ADV PRA.
\33\ $14,125,083 currently approved aggregate external cost /18,179 advisers (current and expected annually) = $777 blended average external cost per
  adviser.
\34\ 335,748.79 aggregate annual hours for current and expected new advisers (see infra note [38]) /(14,774 current RIAs + 514 expected RIAs + 4,985
  current ERAs + 346 expected ERAs) = 16.28 blended average hours per adviser.
\35\ $32,949,695.30 aggregate external cost for current and expected new advisers (see infra note [39]) /(20,619 advisers current and expected annually)
  = $1,598.03 blended average hours per adviser.
\36\ See 2021 Form ADV PRA.
\37\ See 2021 Form ADV PRA.
\38\ 61,140.08 hours + 183,456 hours + 66,149.59 hours + 14,573.92 hours + 1,245.6 + 8,033.6 hours + 1,150 hours = 335,748.79 aggregate annual hours for
  current and expected new advisers.
\39\ $9,701,372 + $8,157,555 + $15,090,768.30 = $32,949,695.30.

H. Rule 204-3

    Rule 204-3, the ``brochure rule,'' requires an investment adviser
to deliver its brochure and brochure supplements to its new clients or
prospective clients before or at the start of the advisory relationship
and to deliver annually thereafter the full updated brochure or a
summary of material changes to its brochure. The rule also requires
that advisers deliver an amended brochure or brochure supplement (or
just a statement describing the amendment) to clients only when
disciplinary information in the brochure or supplement becomes
materially inaccurate. The brochure assists the client in determining
whether to retain, or continue employing, the adviser. Advisers
registered with the Commission are required to prepare and
electronically file firm brochures through the IARD.
    Our proposed amendments to rule 204-3 would require an adviser to
deliver interim brochure amendments promptly to existing clients if the
adviser adds disclosure of a cybersecurity incident to its brochure or
materially revises information already disclosed in its brochure about
such an incident. We believe that requiring an adviser to deliver the
brochure amendment promptly would enhance investor protection by
enabling clients to take protective or remedial measures to the extent
appropriate. It would also assist investors in determining whether
their engagement of that particular adviser remains appropriate and
consistent with their investment objectives.
    The collection of information the brochure rule requires is
necessary for several reasons. For example, it enables the client or
prospective client to evaluate the adviser's background and
qualifications, and to determine whether the adviser's services and
practices are appropriate for that client. It also informs the client
of the nature of the adviser's business, which may inform or limit the
client's rights under the advisory contract. The information that rule
204-3 requires to be contained in the brochure is used by the
Commission and staff in its enforcement, regulatory, and examination
programs.
    The respondents to this collection of information are investment
advisers registered or required to be registered with the Commission.
As noted above, the collection of this information is mandatory for all
registered advisers. Responses are not kept confidential. As of October
31, 2021, there were 14,774 registered advisers that would be subject
to this brochure requirement. The table below summarizes the initial
and ongoing annual burden and cost estimates associated with the
proposed rule's reporting requirement.
    Table 7 below summarizes the initial and ongoing annual burden
estimates associated with the proposed amendments to rule 204-3.

                                                            Table 7--Rule 204-3 PRA Estimates
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Annual
                                      Internal initial   Internal annual burden hours                 Wage rate            Internal time  external  cost
                                        burden hours                                                                           costs          burden
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                   PROPOSED ESTIMATES
--------------------------------------------------------------------------------------------------------------------------------------------------------
Annual delivery of brochure........            \1\ 1.66  1.66 hours..................   x   $64 (general clerk).........         $106.24              $0
Interim delivery of updates to                  \3\ 0.1  0.1 hour....................   x   $64 (general clerk).........           $6.40               0
 disciplinary action \2\.
Interim delivery of updates to                  \4\ 0.1  0.1 hour....................   x   $64 (general clerk).........           $6.40               0
 cybersecurity incidents.
Supplement tracking systems \5\....             \6\ 200  200 hours...................   x   $64 (general clerk).........         $12,800               0
Total new annual burden per adviser  ..................  201.86 hours................  ...  ............................      $12,919.04  ..............
Number of advisers.................  ..................  x14,774.....................  ...  ............................         x14,774  ..............
                                                        ------------------------------------------------------------------------------------------------
    Total new aggregate annual       ..................  2,982,279.64 hours..........  ...  ............................    $190,865,897  ..............
     burden.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Notes:
\1\ We continue to estimate that, with a bulk mailing, an adviser will require no more than 0.02 hours to send the adviser's brochure or summary of
  material changes to each client, or an annual burden of 1.66 hours per adviser. (0.02 hours per client x 83 clients per adviser based on IARD data as
  of October 31, 2021) = approximately 1.66 hours per adviser. We note that the burden for preparing brochures is already incorporated into a separate
  burden estimate for Form ADV. We expect that most advisers will make their annual delivery as part of a mailing of an account statement or other
  periodic report they already make to clients; therefore, we estimate that the additional burden will be adding a few pages to the mailing.
\2\ See approved rule 204-3 PRA.