whether it made the required disclosure of Part II of proposed Form
SCIR to its customers.\334\ The Covered Entity would not need to
indicate a date for the customer disclosure because it could be made in
a number of ways (e.g., by email or mail) and that process could span a
number of days. If the Covered Entity has not disclosed the significant
cybersecurity incident as required by proposed Rule 10, it would need
to explain why. The requirement to report this information is designed
to promote compliance with the disclosure requirements of proposed Rule
10.
---------------------------------------------------------------------------

    \332\ See Line Items 13.A. through C. of proposed Form SCIR.
    \333\ See Line Items 13.A. through B. of proposed Part I of Form
SCIR.
    \334\ See Line Item 13.C. of Part I of proposed Form SCIR.
---------------------------------------------------------------------------

    Line Item 14 of Part I of proposed Form SCIR would elicit
information about any insurance coverage the Covered Entity may have
with respect to the significant cybersecurity incident.\335\ First, the
Covered Entity would need to indicate whether the significant
cybersecurity incident is covered by an insurance policy of the Covered
Entity.\336\ The Covered Entity would have the option of checking yes,
no, or unknown. If yes, the Covered Entity would need to indicate
whether the insurance company has been contacted. The existence of
insurance coverage to cover losses could be relevant to Commission
staff in assessing the potential magnitude of harm to the Covered
Entity's customers, counterparties, members, registrants, or users and
to the Covered Entity's financial condition. For example, the existence
of insurance coverage, to the extent the significant cybersecurity
incident is covered by the policy, could indicate a greater possibility
that the Covered Entity and/or any of its customers, counterparties,
members, registrants, or users affected by the incident are made whole.
---------------------------------------------------------------------------

    \335\ See Line Items 14.A. and B. of Part I of proposed Form
SCIR.
    \336\ See Line Item 14.A. of Part I of proposed Form SCIR.
---------------------------------------------------------------------------

    Finally, Line Item 15 of Part I of proposed Form SCIR would permit
the Covered Entity to include in the form any additional information
the entity would want the Commission and Commission staff to know as
well as provide any comments about the information included in the
report.\337\
---------------------------------------------------------------------------

    \337\ See Line Item 15 of proposed Part I of Form SCIR.
---------------------------------------------------------------------------

c. Request for Comment
    The Commission requests comment on all aspects of the proposed
requirements to report significant cybersecurity incidents on Part I of
proposed Form SCIR. In addition, the Commission is requesting comment
on the following specific aspects of the proposals:
    41. Should paragraph (c)(1) of proposed Rule 10 be modified to
revise the immediate notification requirement? For example, should the
requirement permit the notice to be made by telephone or email? If so,
explain why. If not, explain why not. If telephone or email notice is
permitted, should the rule specify the Commission staff, Division, or
Office to phone or email?
    42. Should paragraph (c)(1) of proposed Rule 10 be modified to
revise the requirement to provide immediate written electronic notice
to specify how the notice must be transmitted to the Commission? For
example, should the rule specify an email address or other type of
electronic portal to be used to transmit the notice? If so, explain
why. If not, explain why not. Should the rule be modified to require
that the notice be transmitted to the Commission through the EDGAR
system? If so, explain why. If not, explain why not. Should the rule be
modified to require that the notice be transmitted to the Commission
through the EDGAR system using a structured data language other than
custom XML format?
    43. Should paragraph (c)(1) of proposed Rule 10 be modified to
revise the requirement to provide immediate written electronic notice
to require the notice to be provided within a specific timeframe such
as on the same day the requirement was triggered or within 24 hours? If
so, explain why. If not, explain why not.
    44. Should paragraph (c)(1) of proposed Rule 10 be modified to
revise the trigger for the immediate notification and reporting
requirements? If so, explain why. If not, explain why not. For example,
should the trigger be when the Covered Entity ``detects'' a significant
cybersecurity incident (rather than when it has a reasonable basis to
conclude that the significant cybersecurity incident has occurred or is
occurring)? If so, explain why. If not, explain why not. For example,
would a detection standard be a less subjective standard? If so,
explain why. If not, explain why not. Is there another trigger standard
that would be more appropriate? If so, identify it and explain why it
would be more appropriate.
    45. If the immediate notification requirement of paragraph (c)(1)
is adopted as proposed, it is anticipated that a dedicated email
address would be established to receive these notices. Are there other
methods the Commission should use for receiving these notices? If so,
identity them and explain why they would be more appropriate than
email. For example, should the notices be received through the EDGAR
system? If so, explain why. If not, explain why not.
    46. Should paragraph (c)(2) of proposed Rule 10 be modified to
revise the reporting requirements to incorporate the cybersecurity
reporting program that CISA will implement under recently adopted
legislation (``CISA Reporting Program'') to the extent it will be
applicable to Covered Entities? \338\ If so, explain why and suggest
modifications to the proposed reporting requirements for Covered
Entities to incorporate the CISA Reporting Program. For example, if a
Covered Entity would be required to file a report under the CISA
Reporting Program, should that report satisfy the obligations to report
to the Commission a significant cybersecurity incident under paragraph
(c) of proposed Rule 10? If so, explain why. If not, explain why not.
---------------------------------------------------------------------------

    \338\ See CIRCIA.
---------------------------------------------------------------------------

    47. Should paragraph (c)(2) of proposed Rule 10 be modified to
revise the timeframe for filing an initial Part I of proposed Form
SCIR? If so, explain why. If not, explain why not. For example, should
the reporting requirements be revised to permit Covered Entities more
than 48 hours to file an initial Part I of proposed Form SCIR with the
Commission? If yes, explain how long they should have to file the
initial Part I of proposed Form SCIR and why that timeframe would be
appropriate. For example, should Covered Entities have 72 or 96 hours
to file the initial Part I of proposed Form SCIR? If so, explain why.
If not, explain why not. Would providing more time to file the initial
Part I of proposed Form SCIR make the filing more useful insomuch as
the Covered Entity would have more time to investigate the significant
cybersecurity incident? If so, explain why and how to balance that
benefit against the delay in providing this information to the
Commission within 48 hours. Would the immediate notification
requirement of paragraph (c) of proposed Rule 10 make it appropriate to
lengthen the timeframe for when the Covered Entity would need to file
the initial Part I of proposed Form SCIR? If so, explain why. If not,
explain why not. For example, could the immediate notification
requirement and the ability of the Commission staff to follow-up with
the contact person identified on the notification serve as an
appropriate alternative to receiving the initial Part I of proposed
Form SCIR within 48 hours. If so, explain why. If not, explain why not.
Conversely,

should the timeframe for filing an initial Part I of proposed Form SCIR
be shortened to 24 hours or some other period of time that is less than
48 hours? If so, explain why. If not, explain why not.
    48. Should paragraph (c)(2) of proposed Rule 10 be modified to
revise the timeframe for filing an initial or amended Part I of
proposed Form SCIR so the timeframes are expressed in business days or
calendar days instead of hours? If so, explain why. If not, explain why
not. For example, should Covered Entities have two, five, or some other
number business or calendar days to file an initial or amended Part I
of proposed Form SCIR? Would business or calendar days be more
appropriate given that Part I of proposed Form SCIR would be filed
through the EDGAR system? \339\ If so, explain why. If not, explain why
not.
---------------------------------------------------------------------------

    \339\ The Commission accepts electronic submissions through the
EDGAR system Monday through Friday, except federal holidays, from
6:00 a.m. to 10:00 p.m. Eastern Time. See Chapter 2 of the EDGAR
Filer Manual (Volume I), version 41 (Dec. 2022). Further, filings
submitted by direct transmission commencing on or before 5:30 p.m.
Eastern Standard Time or Eastern Daylight Saving Time, whichever is
currently in effect, shall be deemed filed on the same business day,
and all filings submitted by direct transmission commencing after
5:30 p.m. Eastern Standard Time or Eastern Daylight Saving Time,
whichever is currently in effect, shall be deemed filed as of the
next business day. 17 CFR 232.13.
---------------------------------------------------------------------------

    49. Should paragraph (c)(2) of proposed Rule 10 be modified to
revise the timeframe for filing an initial or amended Part I of
proposed Form SCIR so that it must be filed promptly after the filing
requirement is triggered without specifying the 48 hour limit? If so,
explain why and describe how ``promptly'' should be interpreted for
purposes of the reporting requirements of paragraph (c) of proposed
Rule 10. If not, explain why not.
    50. Should paragraph (c)(2) of proposed Rule 10 be modified to
revise the reporting requirements to include the filing of an initial
Part I of proposed Form SCIR and a final Part I of proposed Form SCIR
but not require the filing of interim amended forms? If so, explain
why. If not, explain why not. For example, could informal
communications between the Commission staff and the Covered Entity
facilitated by the contact employee identified in the immediate notice
that would be required under paragraph (c)(1) of proposed Rule 10 be an
appropriate alternative to requiring the filing of interim amended
forms? If so, explain why. If not, explain why not.
    51. Should paragraph (c)(2) of proposed Rule 10 be modified to
revise the reporting requirements to include the filing of interim
amended forms on a pre-set schedule? If so, explain why. If not,
explain why not. For example, should Covered Entities be required to
file an initial Part I of proposed Form SCIR and a final Part I of
proposed Form SCIR pursuant to the requirements of paragraph (c) of
proposed Rule 10 but file interim amended forms on a pre-set schedule?
If so, explain why this would be appropriate, including why a pre-set
reporting requirement would not undermine the objectives of the
proposed reporting requirements, and how often the interim reporting
should be required (e.g., weekly, bi-weekly, monthly, quarterly). Would
a pre-set reporting cadence (e.g., weekly, bi-weekly, monthly,
quarterly) undermine the objectives of the proposed reporting
requirements by inappropriately delaying the Commission's receipt of
important information about a significant cybersecurity incident? If
so, explain why. If not, explain why not. Would the immediate
notification requirement and the ability of the Commission staff to
follow-up with the contact person identified on the notification
mitigate this potential consequence? If so, explain why. If not,
explain why not.
    52. Should paragraph (c)(2)(ii)(D) of proposed Rule 10 and Part I
of proposed Form SCIR be modified to revise the reporting requirements
relating to internal investigations? If so, explain why. If not,
explain why not. For example, would these reporting requirements create
a disincentive for Covered Entities to perform internal investigations
in response to significant cybersecurity incidents? If so, explain why.
If not, explain why not.
    53. Should Part I of proposed Form SCIR be modified? If so, explain
why. If not, explain why not. For example, does the form strike an
appropriate balance of providing enough detail to the Commission to be
helpful while also not being unduly burdensome to Covered Entities? If
so, explain why. If not, explain why not. Is certain information that
would be elicited in Part I of Form SCIR unnecessary? If so, identify
the information and explain why it would be unnecessary. Is there
additional information that should be required to be included in Part I
of proposed Form SCIR? If so, identify the information and explain why
it would be appropriate to require a Covered Entity to report it in the
form.
    54. Should Part I of proposed Form SCIR be modified to require that
Covered Entities provide a UIC--such as an LEI \340\ (which would
require each Covered Entity without a UIC (such as an LEI) to obtain
one to comply with the rule)? If so, explain why. If not, explain why
not. For example, would a requirement to provide a UIC allow the
Commission staff to better evaluate cyber-threats to Covered Entities?
If so, explain why. If not, explain why not. Should the form be
modified to require Covered Entities to provide another type of
standard identifier other than a CIK number and UIC (if they have a
UIC)? If so, explain why. If not, explain why not.
---------------------------------------------------------------------------

    \340\ The Commission approved a UIC (namely, the LEI) in a
previous rulemaking. See section II.B.2.b. of this release; see also
Regulation SBSR Release, 80 FR at 14632. The Commission is aware
that additional identifiers could be recognized as UICs in the
future, but for the purposes of this release, the Commission is
equating the UIC with the LEI.
---------------------------------------------------------------------------

3. Disclosure of Cybersecurity Risks and Incidents
a. Cybersecurity Risks and Incidents Disclosure
    Proposed Rule 10 would require a Covered Entity to make two types
of public disclosures relating to cybersecurity on Part II of proposed
Form SCIR.\341\ First, the Covered Entity would need to, in plain
English, provide a summary description of the cybersecurity risks that
could materially affect its business and operations and how the Covered
Entity assesses, prioritizes, and addresses those cybersecurity
risks.\342\ A cybersecurity risk would be material to a Covered Entity
if there is a substantial likelihood that a reasonable person would
consider the information important based on the total mix of facts and
information.\343\ The facts and circumstances relevant to determining
materiality in this context may include, among other things, the
likelihood and extent to which the cybersecurity risk or resulting
incident: (1) could disrupt or degrade the Covered Entity's ability to
maintain critical operations; (2) could adversely affect the
confidentiality, integrity, or availability of information residing on
the Covered Entity's information systems, including whether the
information is personal, confidential, or proprietary information; and/
or (3) could harm the Covered Entity or its customers, counterparties,
members, registrants, users, or other persons.
---------------------------------------------------------------------------

    \341\ See paragraph (d)(1) of proposed Rule 10.
    \342\ See paragraph (d)(1)(i) of proposed Rule 10; Line Item 2
of Part II proposed of Form SCIR.
    \343\ See, e.g., SEC. v. Steadman, 967 F.2d 636, 643 (D.C. Cir.
1992); cf. Basic Inc. v. Levinson, 485 U.S. 224, 231-232 (1988); TSC
Industries v. Northway, Inc., 426 U.S. 438, 445, 449 (1976).
---------------------------------------------------------------------------

    The second element of the disclosure would be a summary description
of each

significant cybersecurity incident that occurred during the current or
previous calendar year, if applicable.\344\ The look-back period of the
current and previous calendar years is designed to make the disclosure
period consistent across all Covered Entities. The look-back period
also is designed to provide a short history of significant
cybersecurity incidents affecting the Covered Entity while not
overburdening the firm with a longer disclosure period. The summary
description of each significant cybersecurity incident would need to
include: (1) the person or persons affected; \345\ (2) the date the
incident was discovered and whether it is ongoing; (3) whether any data
was stolen, altered, or accessed or used for any other unauthorized
purpose; (4) the effect of the incident on the Covered Entity's
operations; and (5) whether the Covered Entity, or service provider,
has remediated or is currently remediating the incident.\346\ This
disclosure--because it addresses actual significant cybersecurity
incidents--would serve as another way for market participants to
evaluate the Covered Entity's cybersecurity risks and vulnerabilities
apart from the general disclosure of its cybersecurity risk. For
example, a Covered Entity's disclosure of multiple significant
cybersecurity incidents during the current or previous calendar year
(particularly, if they did not impact other Covered Entities) would be
useful in assessing whether the Covered Entity is adequately addressing
cybersecurity risk or is more vulnerable to that risk as compared with
other Covered Entities.
---------------------------------------------------------------------------

    \344\ See paragraph (d)(1)(ii) of proposed Rule 10; Line Item 3
of Part II proposed of Form SCIR. See also paragraph (a)(10) of
proposed Rule 10 (defining the term ``significant cybersecurity
incident'').
    \345\ This element of the disclosure would not need to include
the identities of the persons affected or personal information about
those persons. Instead, the disclosure could use generic terms to
identify the person or persons affected. For example, the disclosure
could state that ``customers of the broker-dealer,''
``counterparties of the SBSD,'' or ``members of the SRO'' are
affected (as applicable).
    \346\ See paragraphs (d)(1)(ii)(A) through (E) of proposed Rule
10; Line Item 3 of Part II proposed of Form SCIR.
---------------------------------------------------------------------------

    The objective of these disclosures is to provide greater
transparency to customers, counterparties, registrants, or members of
the Covered Entity, or to users of its services, about the Covered
Entity's exposure to material harm as a result of a cybersecurity
incident, which, in turn, could cause harm to customers,
counterparties, members, registrants, or users. This information could
be used by these persons to manage their own cybersecurity risk and, to
the extent they have choice, select a Covered Entity with which to
transact or otherwise conduct business. Information about prior attacks
and their degree of success is immensely valuable in mounting effective
countermeasures.\347\
---------------------------------------------------------------------------

    \347\ See Peter W. Singer and Allan Friedman. Cybersecurity and
Cyberwar: What Everyone Needs to Know. Oxford University Press 222
(2014).
---------------------------------------------------------------------------

    However, the intent of the disclosure on Part II of proposed Form
SCIR is to avoid overly detailed disclosures that could increase
cybersecurity risk for the Covered Entity and other persons. Revealing
too much information could assist future attackers as well as lead to
loss of customers, reputational harm, litigation, or regulatory
scrutiny, which would be a cost associated with public disclosure.\348\
Therefore, under proposed Rule 10, the Covered Entity would be required
to provide only a summary description of its cybersecurity risk and
significant cybersecurity incidents.\349\ The requirement that the
disclosures contain summary descriptions only is designed to produce
meaningful disclosures but not disclosures that would reveal
information (e.g., proprietary or confidential methods of addressing
cybersecurity risk or known cybersecurity vulnerabilities) that could
be used by threat actors to cause harm to the Covered Entity or its
customers, counterparties, members, users, or other persons. This
requirement is also designed to produce high-level disclosures about
the Covered Entity's cybersecurity risks and significant cybersecurity
incidents that can be easily reviewed by interested parties in order to
give them a general understanding of the Covered Entity's risk profile.
---------------------------------------------------------------------------

    \348\ See, e.g., Federal Trade Commission v. Equifax, Inc., FTC
Matter/File Number: 172 3203, Civil Action Number: 1:19-cv-03297-TWT
(2019), available at https://www.ftc.gov/enforcement/cases-proceedings/172-3203/equifax-inc (``FTC Equifax Civil Action'').
    \349\ See paragraphs (d)(1)(i) and (ii) of proposed Rule 10.
---------------------------------------------------------------------------

b. Disclosure Methods and Updates
    Proposed Rule 10 would require a Covered Entity to make the public
disclosures discussed above (i.e., the information about cybersecurity
risks and significant cybersecurity incidents) on Part II of proposed
Form SCIR.\350\ Part II of proposed Form SCIR would elicit information
about the Covered Entity that would be used to identify the filer.\351\
In particular, the Covered Entity would need to provide its full legal
name and business name (if different from its legal name), UIC (if the
filer has a UIC),\352\ CIK number, and main address.\353\ The Covered
Entity also would need to indicate the type of Market Entity it is by
checking the appropriate box or boxes.\354\ For example, if the Covered
Entity is dually registered as a broker-dealer and SBSD, it would need
to check the box for each of those entity types.
---------------------------------------------------------------------------

    \350\ See paragraph (d) of proposed Rule 10.
    \351\ See Line Items 1.A. through 1.D. of Part II of proposed
Form SCIR.
    \352\ As mentioned previously, the Commission approved a UIC--
namely, the LEI--in a prior rulemaking. See section II.B.2.b. of
this release. Therefore, for the purposes of this release, the
Commission is proposing to require those Covered Entities that
already have LEIs to identify themselves with LEIs on Part II of
Form SCIR.
    \353\ See Line Items 1.A. through 1.C. of Part I of proposed
Form SCIR. See also section II.B.2.b. of this release (discussing
UIC and CIK numbers in more detail with respect to Part I of
proposed Form SCIR).
    \354\ See Line Item 1.D. of Part II of proposed Form SCIR
(setting forth check boxes to indicate whether the Covered Entity is
a broker-dealer, clearing agency, MSBSP, the MRSB, a national
securities association, a national securities exchange, SBSD, SBSDR,
or transfer agent).
---------------------------------------------------------------------------

    Page 1 of Part II of proposed Form SCIR also would contain fields
for the individual executing the form to sign and date the form. By
signing the form, the individual would: (1) certify that the form was
executed on behalf of, and with the authority of, the Covered Entity;
and (2) represent individually, and on behalf of the Covered Entity,
that the information and statements contained in the form are current,
true and complete. The form of the certification is designed to ensure
that the Covered Entity, through the individual executing the form,
discloses information that can be used by the Covered Entity's
customers, counterparties, members, registrants, or users, or by other
interested persons to assess the Covered Entity's cybersecurity risk
profile and compare it with the risk profiles of other Covered
Entities.
    As discussed above, proposed Rule 10 would require the Covered
Entity to publicly disclose a summary description of the cybersecurity
risks that could materially affect the Covered Entity's business and
operations and how the Covered Entity assesses, prioritizes, and
addresses those cybersecurity risks.\355\ Line Item 2 of Part II of
proposed Form SCIR would contain a narrative field in which the Covered
Entity would provide this summary description.\356\ In order to provide
context to the meaning of the disclosure, the beginning of Line Item 2
would set forth the definition of ``cybersecurity risk'' in proposed
Rule 10 as well as the definitions of ``cybersecurity incident,''
``cybersecurity

threat,'' and ``cybersecurity vulnerability'' because these three terms
are used in the definition of ``cybersecurity risk.'' \357\
---------------------------------------------------------------------------

    \355\ See paragraph (d)(1)(i) of proposed Rule 10.
    \356\ See Line Item 2 of Part II of proposed Form SCIR.
    \357\ Id. See also paragraphs (a)(2) through (5) of proposed
Rule 10 (defining, respectively, ``cybersecurity incident,''
``cybersecurity risk,'' ``cybersecurity threat,'' and
``cybersecurity vulnerability'').
---------------------------------------------------------------------------

    Line Item 3 of Part II of proposed Form SCIR would be used to make
the disclosure about each significant cybersecurity incident that
occurred during the current and previous calendar year.\358\ The
definition of ``significant cybersecurity incident'' would be set forth
at beginning of Line Item 3 in order to provide context to the meaning
of the disclosure. To complete the line item, the Covered Entity first
would need to indicate by checking ``yes'' or ``no'' whether it had
experienced one or more significant cybersecurity incidents during the
current or previous calendar year. If the answer is yes, the Covered
Entity would need to provide in a narrative field on Line Item 3 the
summary description of each significant cybersecurity incident.\359\
---------------------------------------------------------------------------

    \358\ See Line Item 3 of Part II of proposed Form SCIR.
    \359\ See paragraph (d)(1)(ii) of proposed Rule 10.
---------------------------------------------------------------------------

    As discussed next, there would be two methods of making the
disclosure, which would be required of all Covered Entities under
proposed Rule 10, and an additional third method that would be required
of Covered Entities that are carrying or introducing broker-dealers.
First, Covered Entities would be required to file Part II of Form SCIR
with the Commission electronically through the EDGAR system in
accordance with the EDGAR Filer Manual, as defined in Rule 11 of
Regulation S-T,\360\ and in accordance with the requirements of
Regulation S-T.\361\ The Commission would make these filings available
to the public. The objective of requiring centralized EDGAR-filing of
Part II of proposed Form SCIR is to facilitate the ability to compare
disclosures across different Covered Entities or categories of Covered
Entities in the same manner that EDGAR filing facilitates comparison of
financial statements, annual reports, and other disclosures across
Commission registrants. By creating a single location for all of the
disclosures, Commission staff, investors, market participants, and
analysts as well as Covered Entities' customers, counterparties,
members, registrants, or users would be able to run search queries to
compare the disclosures of multiple Covered Entities. Centralized EDGAR
filing could make it easier for Commission staff and others to assess
the cybersecurity risk profiles of different types of Covered Entities
and could facilitate trend analysis of significant cybersecurity
incidents. Thus, by providing a central location for the cybersecurity
disclosures, filing Part II of proposed Form SCIR through EDGAR could
lead to greater transparency of the cybersecurity risks in the U.S.
securities markets.
---------------------------------------------------------------------------

    \360\ See 17 CFR 232.11.
    \361\ See paragraph (d)(2)(i) of proposed Rule 10.
---------------------------------------------------------------------------

    Second, proposed Rule 10 would require the Covered Entity to post a
copy of the Part II of proposed Form SCIR most recently filed on EDGAR
on an easily accessible portion of its business internet website that
can be viewed by the public without the need of entering a password or
making any type of payment or providing any other consideration.\362\
Consequently, the disclosures could not be located behind a ``paywall''
or otherwise require a person to pay a registration fee or provide any
other consideration to access them. The purpose of requiring the form
to be posted on the Covered Entity's business internet website is that
individuals naturally may visit a company's business internet website
when seeking timely and updated information about the company,
particularly if the company is experiencing an incident that disrupts
or degrades the services it provides. Therefore, requiring the form to
be posted on the website is designed to make it available through this
commonly used method of obtaining information. Additionally,
individuals may naturally visit a company's business internet website
as part of their due diligence process in determining whether to use
its services. Therefore, posting the form on the Covered Entity's
business internet website could provide individuals with information
about the Covered Entity's cybersecurity risks before they elect to
enter into an arrangement with the firm. It could serve a similar
purpose for individuals considering whether to maintain an ongoing
business relationship with the Covered Entity.
---------------------------------------------------------------------------

    \362\ See paragraph (d)(2)(ii) of proposed Rule 10. In addition
to the disclosure to be made available to security-based swap
counterparties as required by paragraph (d)(2)(ii) of proposed Rule
10, current Commission rules require that SBS Entities' trading
relationship documentation between certain counterparties address
cybersecurity. Specifically, an SBS Entity's trading relationship
documentation must include valuation methodologies for purposes of
complying with specified risk management requirements, which would
include the risk management requirements of proposed Rule 10 (if it
is adopted). See 17 CFR 250.15Fi-5(b)(4). This documentation would
include a dispute resolution process or alternative methods for
determining value in the event of a relevant cybersecurity incident.
See also section IV.C.1.b.iii. of this release (discussing
disclosure requirements of Rule 15Fh-3(b)).
---------------------------------------------------------------------------

    In addition to those two disclosure methods, a Covered Entity that
is either a carrying or introducing broker-dealer would be required to
provide a copy of the Part II of proposed Form SCIR most recently filed
on EDGAR to a customer as part of the account opening process.\363\
Thereafter, the Covered Entity would need to provide the customer with
the most recently posted form annually and when it is updated. The
broker-dealer would need to deliver the form using the same means that
the customer elects to receive account statements (e.g., by email or
through the postal service).\364\ This additional method of disclosure
is designed to make the information readily available to the broker-
dealer's customers (many of whom may be retail investors) through the
same processes that other important information (i.e., information
about their securities accounts) is communicated to them. Requiring a
broker-dealer to deliver copies of the form is designed to enhance
investor protection by enabling customers to take protective or
remedial measures to the extent appropriate. It would also assist
customers in determining whether their engagement of that particular
broker-dealer remains appropriate and consistent with their investment
objectives.
---------------------------------------------------------------------------

    \363\ See paragraph (d)(3) of proposed Rule 10.
    \364\ If the disclosure requirements of proposed Rule 10 are
adopted, the Commission would establish a compliance date by which a
Covered Entity would need to make its first public disclosure on
Part II of proposed Form SCIR. At a minimum, the initial disclosure
would need to include a summary description of the cybersecurity
risks that could materially affect the Covered Entity's business and
operations and how the Covered Entity assesses, prioritizes, and
addresses those cybersecurity risks. In setting an initial
compliance date, the Commission could take a bifurcated approach in
which each method of disclosure has a different compliance date. For
example, the compliance date for making the website disclosure could
come before the compliance date for making the EDGAR disclosure and
the additional disclosure required of carrying and introducing
broker-dealers. The Commission seeks comment below on a potential
compliance date or compliance dates for the disclosure requirements.
---------------------------------------------------------------------------

    Finally, a Covered Entity would be required to file on EDGAR an
updated Part II of proposed Form SCIR promptly if the information
required to be disclosed about cybersecurity risks or significant
cybersecurity incidents materially changes, including, in the case of
the disclosure about significant cybersecurity incidents, after the
occurrence of a new significant cybersecurity incident or when

information about a previously disclosed significant cybersecurity
incident materially changes.\365\ The Covered Entity also would need to
post a copy of the updated Part II of proposed Form SCIR promptly on
its business internet website and, if it is a carrying broker-dealer or
introducing broker-dealer, deliver copies of the form to its customers.
Given the potential effect that significant cybersecurity incidents
could have on a Covered Entity's customers, counterparties, members,
registrants, or users--such as exposing their personal or other
confidential information or resulting in a loss of cash or securities
from their accounts--time is of the essence, and requiring a Covered
Entity to update the disclosures promptly would enhance investor
protection by enabling customers, counterparties, members, registrants,
or users to take proactive or remedial measures to the extent
appropriate. Accordingly, the timing of the filing of an updated
disclosure should take into account the exigent nature of significant
cybersecurity incidents which would generally militate toward swiftly
filing the update. Furthermore, requiring Covered Entities to update
their disclosures following the occurrence of a new significant
cybersecurity incident would assist market participants in determining
whether their business relationship with that particular Covered Entity
remains appropriate and consistent with their goals.
---------------------------------------------------------------------------

    \365\ See paragraph (d)(4) of proposed Rule 10. See also
Instruction C.2. of proposed Form SCIR. As discussed earlier, a
Covered Entity would be required to file Part I of proposed Form
SCIR with the Commission promptly, but no later than 48 hours, upon
having a reasonable basis to conclude that a significant
cybersecurity incident has occurred or is occurring. See paragraph
(c)(2)(i) of proposed Rule 10; see also section II.B.2.a. of this
release (discussing this requirement in more detail). Therefore, the
Covered Entity would need to file a Part I and an updated Part II of
proposed Form SCIR with the Commission relatively contemporaneously.
Depending on the facts and circumstances, the Part I and updated
Part II could be filed at the same time or one could proceed the
other if the Covered Entity, for example, has the information to
complete Part II first but needs more time to gather the information
to complete Part I (which elicits substantially more information
than Part II). However, as discussed above, Part I must be filed no
later than 48 hours after the Covered Entity has a reasonable basis
to conclude that a significant cybersecurity incident has occurred
or is occurring and the Covered Entity must include in the initial
filing the information that is known at that time and file an
updated Part I as more information becomes known to the Covered
Entity.
---------------------------------------------------------------------------

    A Covered Entity also would need to file an updated Part II of
proposed Form SCIR if the information in the summary description of a
significant cybersecurity incident included on the form is no longer
within the look-back period (i.e., the current or previous calendar
year). For example, the information that would need to be included in
the summary description includes whether the significant cybersecurity
incident is ongoing and whether the Covered Entity had remediated it.
The Covered Entity would need to file an updated Part II of proposed
Form SCIR if the significant cybersecurity incident was remediated and
ended on a date that was beyond the look-back period. The updated Part
II of proposed Form SCIR would no longer include a summary description
of that specific significant cybersecurity incident. The objective is
to focus the most recently filed disclosure on events within the
relative near term. The history of the Covered Entity's significant
cybersecurity incidents would be available in previous filings.
c. Request for Comment
    The Commission requests comment on all aspects of the proposed
disclosure requirements. In addition, the Commission is requesting
comment on the following specific aspects of the proposals:
    55. Should paragraph (d)(1)(i) of proposed Rule 10 be modified to
revise the requirements that Covered Entities publicly disclose the
cybersecurity risks that could materially affect their business and
operations and to publicly disclose a description of how the Covered
Entity assesses, prioritizes, and addresses those cybersecurity risks?
If so, explain why. If not, explain why not. For example, would the
public disclosures required by paragraph (d)(1)(i) of proposed Rule 10
be useful or provide meaningful information to a Covered Entity's
customers, counterparties, members, registrants, or users? If so,
explain why. If not, explain why not. Could the proposed disclosure
requirement be modified to make it more useful? If so, explain how.
Could the public disclosures required by paragraph (d)(1)(i) of
proposed Rule 10 assist threat actors in engaging in cyber crime? If
so, explain why. If not, explain why not. Could the proposed disclosure
requirements be modified to eliminate this risk without negatively
impacting the usefulness of the disclosures? If so, explain how.
    56. Should paragraph (d)(1)(ii) of proposed Rule 10 be modified to
revise the requirements that Covered Entities publicly disclose
information about each significant cybersecurity incident that has
occurred during the current or previous calendar year? If so, explain
why. If not, explain why not. For example, would the public disclosures
required by paragraph (d)(1)(ii) of proposed Rule 10 be useful or
provide meaningful information to a Covered Entity's customers,
counterparties, members, registrants, or users? If so, explain why. If
not, explain why not. Could the proposed disclosure requirement be
modified to make it more useful? If so, explain how. Could the public
disclosures required by paragraph (d)(1)(ii) of proposed Rule 10 assist
threat actors in engaging in cyber crime? If so, explain why. If not,
explain why not. Could the proposed disclosure requirements be modified
to eliminate this risk without negatively impacting the usefulness of
the disclosures? If so, explain how.
    57. Should paragraph (d)(1)(ii) of proposed Rule 10 be modified to
revise the required current and previous year look-back period for the
disclosure of significant cybersecurity incidents? If so, explain why.
If not, explain why not. For example, should the look-back period be a
shorter period of time (e.g., only the current calendar year)? If so,
explain why. If not, explain why not. Alternatively, should the look-
back period be longer (e.g., the current calendar year and previous two
calendar years)? If so, explain why. If not, explain why not. Should
the look-back period be expressed in months rather than calendar years?
For example, should the look-back period be 12, 18, 24, 30, or 36
months? If so, explain why. If not, explain why not.
    58. Should paragraph (d)(1)(ii) of proposed Rule 10 be modified to
provide that the requirement to include a summary description of each
significant cybersecurity incident that occurred during the current or
previous calendar year in Part II of proposed Form SCIR be prospective
and, therefore, limited to significant cybersecurity incidents that
occur on or after the compliance date of the disclosure requirement? If
so, explain why. If not, explain why not.
    59. Should the public disclosure requirements of paragraphs
(d)(1)(i) and (ii) of proposed Rule 10 be modified to require the
disclosure of additional or different information? If so, identify the
additional or different information and explain why it would be
appropriate to require its public disclosure by Covered Entities.
    60. Should 17 CFR 240.15Fh-3(b) be amended to specify that required
counterparty disclosure includes the information that would be required
by paragraph (d)(1) of proposed Rule 10 and publicly disclosed on Part
II of proposed Form SCIR? If so, explain why. If not explain why not.
    61. Should paragraph (d)(2) of proposed Rule 10 be modified to
revise

the methods of making the public disclosures? If so, explain why. If
not, explain why not. For example, should Covered Entities be required
to file Part II of proposed Form SCIR on EDGAR but not be required to
post a copy of the form on their business internet websites? If so,
explain why. If not, explain why not. Would requiring the public
cybersecurity disclosures to be filed in a centralized electronic
system, such as EDGAR, make it easier for investors, analysts, and
others to access and gather information from the cybersecurity
disclosures than if those disclosures were only posted on Covered
Entity websites? Alternatively, should Covered Entities be required to
post an executed copy of Part II of proposed Form SCIR on their
business internet websites but not be required to file the form on
EDGAR? If so, explain why. If not, explain why not. Why or why not?
    62. Should paragraph (d)(2) of proposed Rule 10 be modified to
revise the requirement to post a copy of Part II of proposed Form SCIR
on business internet website of the Covered Entity to permit the
Covered Entity to post a link to the EDGAR filing? If so, explain why.
If not, explain why not.
    63. Should paragraph (d)(3) of proposed Rule 10 be modified to
revise the additional methods of making the public disclosures required
of carrying and introducing broker-dealers? If so, explain why. If not,
explain why not. For example, would filing Part II of proposed Form
SCIR on EDGAR and posting a copy of the form on the Covered Entity's
business internet website be sufficient to meet the objectives of the
disclosure requirements discussed above and, therefore, obviate the
need for a carrying broker-dealer or introducing broker-dealer to
additionally send copies of the form to customers? If so, explain why.
If not, explain why not. Rather than requiring the broker-dealer or
introducing broker-dealer to send a copy of the Part II of proposed
Form SCIR most recently filed on EDGAR to each customer, would it be
sufficient that the most recently filed form as of the end of each
quarter or the calendar year be sent to the customers? If so, explain
why. If not, explain why not.
    64. Should paragraph (d)(3) of proposed Rule 10 be modified to
permit the Covered Entity to send a website link to the EDGAR filing to
customers instead of a copy of the EDGAR filing? If so, explain why. If
not, explain why not.
    65. Should paragraph (d)(3) of proposed Rule 10 be modified to
require other types of Covered Entities to send a copy of the most
recently filed Part II of proposed Form SCIR to their customers,
counterparties, members, registrants, or users? If so, explain why. If
not, explain why not. For example, should transfer agents be required
to send the most recently filed Part II of proposed Form SCIR to their
securityholders? If so, explain why. If not, explain why not.
    66. Should paragraph (d)(4) of proposed Rule 10 be modified to
revise the requirement that a Covered Entity must ``promptly'' provide
an updated disclosure on Part II of proposed Form SCIR if the
information on the previous disclosure materially changes to provide
that the Commission shall allow registrants to delay publicly
disclosing a significant cybersecurity incident where the Attorney
General requests such a delay from the Commission based on the Attorney
General's written determination that the delay is in the interest of
national security?
    67. Should paragraph (d)(4) of proposed Rule 10 be modified to
revise the requirement that a Covered Entity must ``promptly'' provide
an updated disclosure on Part II of proposed Form SCIR if the
information on the previous disclosure materially changes to specify a
timeframe within which the updated filing must be promptly made? If so,
explain why. If not, explain why not. For example, should the rule be
modified to require that the updated disclosure must be made within 24,
36, 48, or 60 hours of the information on the previous disclosure
materially changing? If so, explain why. If not, explain why not.
Should the timeframe for making the updated disclosure be expressed in
business days? If so, explain why. If not, explain why not. For
example, should the updated disclosure be required to be made within
two, three, four, or five business days (or some other number of days)
of the information on the previous disclosure materially changing? If
so, explain why. If not, explain why not.
    68. Should paragraph (d)(4) of proposed Rule 10 be modified to
revise the requirement that a Covered Entity must ``promptly'' provide
an updated disclosure on Part II of proposed Form SCIR if the
information on the previous disclosure materially changes to require
the update to be made within 30 days (similar to the requirement for
updating Form CRS)? \366\ If so, explain why. If not, explain why not.
For example, would this approach appropriately balance the objective of
requiring timely disclosure with the objective of providing accurate
and complete disclosure? If so, explain why. If not, explain why not.
---------------------------------------------------------------------------

    \366\ See Form CRS Instructions, available at https://www.sec.gov/files/formcrs.pdf.
---------------------------------------------------------------------------

    69. Should paragraph (d)(4) of proposed Rule 10 be modified to
revise the requirements that trigger when an updated Part II of
proposed Form SCIR must be filed on EDGAR, posted on the Covered
Entity's business internet website, and, if applicable, sent to
customers? If so, explain why. If not, explain why not. For example,
should the rule require that an updated form must be publically
disclosed through these methods on a quarterly, semi-annual, or annual
basis if the information on the previously filed form has materially
changed? If so, explain why. If not, explain why not.
    70. Should Part II of proposed Form SCIR be modified to require
that Covered Entities provide a UIC--such as an LEI (which would
require Covered Entities without a UIC (such as an LEI) to obtain one
to comply with the rule)? \367\ If so, explain why. If not, explain why
not. For example, would requiring Covered Entities to provide a UIC
better allow investors, analysts, and third-party data aggregators to
evaluate the cyber security risk profiles of Covered Entities? If so,
explain why. If not, explain why not. Should the form be modified to
require Covered Entities to provide another type of standard identifier
other than a CIK number and UIC (if they have a UIC)? If so, explain
why. If not, explain why not.
---------------------------------------------------------------------------

    \367\ As mentioned previously in section II.B.2.b. of this
release, the Commission approved a UIC (namely, the LEI) in a
previous rulemaking. The Commission is aware that additional
identifiers could be recognized as UICs in the future, but for the
purposes of this release, the Commission is equating the UIC with
the LEI.
---------------------------------------------------------------------------

    71. If the disclosure requirements of proposed Rule 10 are adopted,
what would be an appropriate compliance date for the disclosure
requirements? For example, should the compliance date be three, six,
nine, or twelve months after the effective date of the rule (or some
other period of months)? Please suggest a compliance period and explain
why it would be appropriate. Should the compliance date for the website
disclosure be sooner than the compliance date for the EDGAR disclosure
or vice versa? If so, explain why. If not, explain why not. Should the
compliance date for the additional disclosure methods that would be
required of carrying and introducing broker-dealers be different than
the compliance dates for the website disclosure and the EDGAR
disclosure? If so, explain why. If not, explain why not. If the
requirement to provide a summary description of each significant
cybersecurity incident that occurred

during the current and previous calendar year is prospective (i.e.,
does not apply to incidents that occurred before the compliance date),
should the compliance period be shorter than if the requirement was
retrospective, given that the initial disclosure, in most cases, would
limited to a summary description of the cybersecurity risks that could
materially affect the Covered Entity's business and operations and how
the Covered Entity assesses, prioritizes, and addresses those
cybersecurity risks? If so, explain why. If not, explain why not.
4. Filing Parts I and II of Proposed Form SCIR in EDGAR Using a
Structured Data Language
a. Discussion
    Proposed Rule 10 would require Covered Entities would file Parts I
and II of proposed Form SCIR electronically with the Commission using
the EDGAR system in accordance with the EDGAR Filer Manual, as defined
in Rule 11 of Regulation S-T,\368\ and in accordance with the
requirements of Regulation S-T.\369\ In addition, under the proposed
requirements, Covered Entities would file Parts I and II of Form SCIR
in a structured (i.e., machine-readable) data language.\370\
Specifically, Covered Entities would file Parts I and II of proposed
Form SCIR in an eXtensible Markup Language (``XML'')-based data
language specific to the form (``custom XML,'' and in this release
``SCIR-specific XML''). While the majority of filings through the EDGAR
system are submitted in unstructured HTML or ASCII formats, certain
EDGAR-system filings are submitted using custom XML languages that are
each specific to the particular form being submitted.\371\ For such
filings, filers are typically provided the option to either submit the
filing directly to the EDGAR system in the relevant custom XML data
language, or to manually input the information into a fillable web-
based form developed by the Commission that converts the completed form
into a custom XML document.\372\
---------------------------------------------------------------------------

    \368\ See 17 CFR 232.11.
    \369\ See paragraphs (c) and (d) of proposed Rule 10.
    \370\ Requirements related to custom-XML filings are generally
covered in the EDGAR Filer Manual, which is incorporated in
Commission regulations by reference via Regulation S-T. See 17 CFR
232.11; 17 CFR 232.101.
    \371\ See Commission, Current EDGAR Technical Specifications
(Dec. 5, 2022), available at https://www.sec.gov/edgar/filer-information/current-edgar-technical-specifications.
    \372\ See Chapters 8 and 9 of the EDGAR Filer Manual (Volume
II), version 64 (Dec. 2022).
---------------------------------------------------------------------------

    Requiring Covered Entities to file Parts I and II of proposed Form
SCIR through the EDGAR system would allow the Commission to download
Form SCIR information directly from a central location, thus
facilitating efficient access, organization, and evaluation of the
information contained in the forms. Use of the EDGAR system also would
enable technical validation of the information reported on Form SCIR,
which could potentially reduce the incidence of non-discretionary
errors (e.g., leaving required fields blank). Thus, the proposed
requirement to file Parts I and II of proposed Form SCIR through the
EDGAR system would allow the Commission and, in the case of Part II,
the public to more effectively examine and analyze the reported
information. In this regard, the proposed requirement to file Parts I
and II of proposed Form SCIR through the EDGAR system using SCIR-
specific XML, a machine-readable data language, is designed to
facilitate more thorough review and analysis of the reported
information.
b. Request for Comment
    The Commission requests comment on all aspects of the proposed
requirements to file Parts I and II of Form SCIR in EDGAR using a
structured data language. In addition, the Commission is requesting
comment on the following specific aspects of the proposals:
    72. Should the Commission modify the structured data language
requirement for both Parts I and II of Form SCIR in accordance with the
alternatives discussed in Section IV.F. below? \373\ Should Covered
Entities be required to file the cybersecurity risk and incident
disclosures on Part II of Form SCIR in the EDGAR system in a structured
data language? Why or why not? Would custom XML or Inline eXtensible
Business Reporting Language (``iXBRL'') be the most suitable data
language for this information? Or would another data language be more
appropriate?
---------------------------------------------------------------------------

    \373\ See section IV.F. of this release.
---------------------------------------------------------------------------

5. Recordkeeping
a. Amendments to Covered Entity Recordkeeping Rules
    As discussed above, proposed Rule 10 would require a Covered Entity
to: (1) establish, maintain, and enforce reasonably designed policies
and procedures to address cybersecurity risks; \374\ (2) create written
documentation of risk assessments; \375\ (3) create written
documentation of any cybersecurity incident, including its response to
and recovery from the incident; \376\ (4) prepare a written report each
year describing its annual review of its policies and procedures to
address cybersecurity risks; \377\ (5) provide immediate electronic
written notice to the Commission of a significant cybersecurity
incident upon having a reasonable basis to conclude that the
significant cybersecurity incident has occurred or is occurring; \378\
(6) report, not later than 48 hours, upon having a reasonable basis to
conclude that a significant cybersecurity incident has occurred or is
occurring on Part I of proposed Form SCIR; \379\ and (7) provide a
written summary disclosure about its cybersecurity risks that could
materially affect its business and operations, and how the Covered
Entity assesses, prioritizes, and addresses those risks, and
significant cybersecurity incidents that occurred during the current or
previous calendar year on Part II of proposed Form SCIR.\380\
Consequently, proposed Rule 10 would require a Covered Entity to make
several different types of records (collectively, the ``Rule 10
Records''). The proposed cybersecurity rule would not include
requirements specifying how long these records would need to be
preserved and the manner in which they would need to be maintained.
Instead, as discussed below, preservation and maintenance requirements
applicable to Rule 10 Records would be imposed through amendments, as
necessary, to the existing record preservation and maintenance rules
applicable to the Covered Entities.
---------------------------------------------------------------------------

    \374\ See paragraph (b)(1) of proposed Rule 10. See also
sections II.B.1.a. through II.B.1.e. of this release (discussing
this proposed requirement in more detail).
    \375\ See paragraph (b)(1)(i)(B) of proposed Rule 10. See also
section II.B.1.a. of this release (discussing this proposed
requirement in more detail).
    \376\ See paragraph (b)(1)(v)(B) of proposed Rule 10. See also
section II.B.1.e. of this release (discussing this proposed
requirement in more detail).
    \377\ See paragraph (b)(2)(ii) of proposed Rule 10. See also
section II.B.1.f. of this release (discussing this proposed
requirement in more detail).
    \378\ See paragraph (c)(1) of proposed Rule 10. See also section
II.B.2.a. of this release (discussing this proposed requirement in
more detail).
    \379\ See paragraph (c)(2) of proposed Rule 10. See also Section
II.B.2.b. of this release (discussing this proposed requirement in
more detail).
    \380\ See paragraph (d) of proposed Rule 10. See also Section
II.B.3. of this release (discussing this proposed requirement in
more detail).
---------------------------------------------------------------------------

    In particular, broker-dealers, transfer agents, and SBS Entities
are subject to existing requirements that specify how long the records
they are required to make must be preserved (e.g., three or six years)
and how the records must be maintained (e.g., maintenance

requirements for electronic records).\381\ The Commission is proposing
to amend these record preservation and maintenance requirements to
identify Rule 10 Records specifically as records that would need to be
preserved and maintained pursuant to these existing requirements. In
particular, the Commission is proposing to amend the record
preservation and maintenance rules for: (1) broker-dealers; \382\ (2)
transfer agents; \383\ and (3) SBS entities.\384\ The proposed
amendments would specify that the Rule 10 Records must be retained for
three years. In the case of the written policies and procedures to
address cybersecurity risks, the record would need to be maintained
until three years after the termination of the use of the policies and
procedures. These amendments would subject the Rule 10 Records to the
record maintenance requirements of Rules 17a-4, 17ad-7, and 18a-6,
including the requirements governing electronic records.\385\
---------------------------------------------------------------------------

    \381\ See 17 CFR 240.17a-4 (``Rule 17a-4'') (setting forth
record preservation and maintenance requirements for broker-
dealers); 17 CFR 240.17Ad-7 (``Rule 17ad-7'') (setting forth record
preservation and maintenance requirements for transfer agents); 17
CFR 240.18a-6 (``Rule 18a-6'') (setting forth record preservation
and maintenance requirements for SBS Entities). The Commission's
proposal includes an amendment to a CFR designation in order to
ensure regulatory text conforms more consistently with section 2.13
of the Document Drafting Handbook. See Office of the Federal
Register, Document Drafting Handbook (Aug. 2018 Edition, Revision
1.4, dated January 7, 2022), available at https://www.archives.gov/files/federal-register/write/handbook/ddh.pdf. In particular, the
proposal is to amend the CFR section designation for Rule 17Ad-7 (17
CFR 240.17Ad-7) to replace the uppercase letter with the
corresponding lowercase letter, such that the rule would be
redesignated as Rule 17ad-7 (17 CFR 240.17ad-7).
    \382\ This amendment would add a new paragraph (e)(13) to Rule
17a-4.
    \383\ This amendment would add a new paragraph (j) to Rule 17ad-
7.
    \384\ This amendment would add a new paragraph (d)(6) to Rule
18a-6 .
    \385\ See paragraphs (f) of Rule 17a-4, (f) of Rule 17ad-7, and
(e) of Rule 18a-6 (setting forth requirements for electronic records
applicable to broker-dealers, transfer agents, and SBS Entities,
respectively).
---------------------------------------------------------------------------

    Exchange Act Rule 17a-1 (``Rule 17a-1'')--the record maintenance
and preservation rule applicable to registered clearing agencies, the
MSRB, national securities associations, and national securities
exchanges--as it exists today would require the preservation of the
Rule 10 Records.\386\ In particular, Rule 17a-1 requires these types of
Covered Entities to keep and preserve at least one copy of all
documents, including all correspondence, memoranda, papers, books,
notices, accounts, and other such records as shall be made or received
by the Covered Entity in the course of its business as such and in the
conduct of its self-regulatory activity.\387\ Furthermore, Rule 17a-1
provides that the Covered Entity must keep the documents for a period
of not less than five years, the first two years in an easily
accessible place, subject to the destruction and disposition provisions
of Exchange Act Rule 17a-6.\388\ Consequently, under the existing
provisions of Rule 17a-1, registered clearing agencies, the MSRB,
national securities associations, and national securities exchanges
would be required to preserve at least one copy of the Rule 10 Records
for at least five years, the first two years in an easily accessible
place. In the case of the written policies and procedures to address
cybersecurity risks, pursuant to Rule 17a-1 the record would need to be
maintained until five years after the termination of the use of the
policies and procedures.\389\
---------------------------------------------------------------------------

    \386\ See 17 CFR 240.17a-1.
    \387\ See paragraph (a) of Rule 17a-1.
    \388\ See paragraph (b) of Rule 17a-1; 17 CFR 240.17a-6 (``Rule
17a-6''). Rule 17a-6 of the Exchange Act provides that an SRO may
destroy such records at the end of the five year period or at an
earlier date as is specified in a plan for the destruction or
disposition of any such documents if such plan has been filed with
the Commission by SRO and has been declared effective by the
Commission.
    \389\ See, e.g., Nationally Recognized Statistical Rating
Organizations, Exchange Act Release No. 72936 (Aug. 27, 2014) [79 FR
55078, 55099-100 (Sept. 15, 2014)] (explaining why preservation
periods for written policies and procedures are based on when a
version of the policies and procedures is updated or replaced).
---------------------------------------------------------------------------

    Similarly, Exchange Act Rule 13n-7 (``Rule 13n-7'')--the record
maintenance and preservation rule applicable to SBSDRs--as it exists
today would require the preservation of the Rule 10 Records.\390\ In
particular, Rule 13n-7 requires SBSDRs to, among other things, keep and
preserve at least one copy of all documents, including all documents
and policies and procedures required by the Exchange Act and the rules
and regulations thereunder, correspondence, memoranda, papers, books,
notices, accounts, and other such records as shall be made or received
by it in the course of its business as such.\391\ Furthermore, Rule
13n-7 provides that the SBSDR must keep the documents for a period of
not less than five years, the first two years in a place that is
immediately available to representatives of the Commission for
inspection and examination.\392\ Consequently, under the existing
provisions of Rule 13n-7, SBSDRs would be required to preserve at least
one copy of the Rule 10 Records for at least five years, the first two
years in a place that is immediately available to representatives of
the Commission for inspection and examination. In the case of the
written policies and procedures to address cybersecurity risks, the
Commission interprets this provision of Rule 13n-7 to require that the
record would need to be maintained until five years after the
termination of the use of the policies and procedures.
---------------------------------------------------------------------------

    \390\ See 17 CFR 240.13n-7.
    \391\ See paragraph (b)(1) of Rule 13n-7.
    \392\ See paragraph (b)(2) of Rule 13n-7.
---------------------------------------------------------------------------

    Clearing agencies that are exempt from registration would be
Covered Entities under proposed Rule 10.\393\ Exempt clearing agencies
are not subject to Rule 17a-1. However, while exempt clearing
agencies--as entities that have limited their clearing agency
functions--might not be subject to the full range of clearing agency
regulation, the Commission has stated that, for example, an entity
seeking an exemption from clearing agency registration for matching
services would be required to, among other things, allow the Commission
to inspect its facilities and records.\394\ In this regard, exempt
clearing agencies are subject to conditions that mirror certain of the
recordkeeping requirements in Rule 17a-1,\395\ as set forth in the
respective Commission orders exempting each exempt clearing agency from
the requirement to register as a clearing agency (the ``clearing agency
exemption orders'').\396\ Pursuant to the terms and conditions of the
clearing agency exemption orders, the Commission may modify by order
the terms, scope, or conditions if the Commission determines that such
modification is necessary or appropriate in the public interest, for
the protection of investors, or otherwise in furtherance of the

purposes of the Exchange Act.\397\ In support of the public interest
and the protection of investors, the Commission is proposing to amend
the clearing agency exemption orders to add a condition that each
exempt clearing agency must retain the Rule 10 Records for a period of
at least five years after the record is made or, in the case of the
written policies and procedures to address cybersecurity risks, for at
least five years after the termination of the use of the policies and
procedures.
---------------------------------------------------------------------------

    \393\ See paragraph (a)(1)(ii) of proposed Rule 10 (defining as
a ``covered entity'' a clearing agency (registered or exempt) under
section 3(a)(23)(A) of the Exchange Act). See also section I.A.2.c.
of this release (discussing the clearing agency exemptions provided
by the Commission).
    \394\ See Confirmation and Affirmation of Securities Trades;
Matching, Exchange Act Release No. 39829 (Apr. 6, 1998) [63 FR 17943
(Apr. 13, 1998)] (providing interpretive guidance and requesting
comment on the confirmation and affirmation of securities trades and
matching).
    \395\ See, e.g., BSTP SS&C Order, 80 FR at 75411 (conditioning
BSTP's exemption by requiring BSTP to, among other things, preserve
a copy or record of all trade details, allocation instructions,
central trade matching results, reports and notices sent to
customers, service agreements, reports regarding affirmation rates
that are sent to the Commission or its designee, and any complaint
received from a customer, all of which pertain to the operation of
its matching service and ETC service. BSTP shall retain these
records for a period of not less than five years, the first two
years in an easily accessible place.).
    \396\ See DTCC ITP Matching Order, 66 FR 20494; BSTP SS&C Order,
80 FR 75388; Euroclear Bank Order, 81 FR 93994.
    \397\ See Clearstream Banking Order, 62 FR 9225.
---------------------------------------------------------------------------

b. Request for Comment
    The Commission requests comment on all aspects of the proposed
recordkeeping requirements. In addition, the Commission is requesting
comment on the following specific aspects of the proposals:
    73. Should the proposed amendments to Rules 17a-4, 18a-6, and/or
17ad-7 be modified? If so, describe how they should be modified and
explain why the modification would be appropriate. For example, should
the retention periods for the records be five years (consistent with
Rule 17a-1) or some other period of years as opposed to three years? If
so, explain why. If not, explain why not.
    74. As discussed above, the Commission is proposing to amend the
clearing agency exemption orders to specifically require the exempt
clearing agencies to retain the Rule 10 Records. Should the ordering
language be consistent with the proposed amendments to Rules 17a-4,
17ad-7, and18a-6? For example, should the ordering language provide
that the exempt clearing agency must maintain and preserve: (1) the
written policies and procedures required to be adopted and implemented
pursuant to paragraph (b)(1) of proposed Rule 10 until five years after
the termination of the use of the policies and procedures; (2) the
written documentation of any risk assessment pursuant to paragraph
(b)(1)(i)(B) of proposed Rule 10 for five years; (3) the written
documentation of the occurrence of a cybersecurity incident pursuant to
paragraph (b)(1)(v)(B) of proposed Rule 10, including any documentation
related to any response and recovery from such an incident, for five
years; (4) the written report of the annual review required to be
prepared pursuant to paragraph (b)(2)(ii) of proposed Rule 10 for five
years; (5) a copy of any notice transmitted to the Commission pursuant
to paragraph (c)(1) of proposed Rule 10 or any Part I of proposed Form
SCIR filed with the Commission pursuant to paragraph (c)(2) of proposed
Rule 10 for five years; and (6) a copy of any Part II of proposed Form
SCIR filed with the Commission pursuant to paragraph (d) of proposed
Rule 10 for five years? Additionally, should the ordering language
provide that the exempt clearing agency must allow the Commission to
inspect its facilities and records? If so, explain why. If not, explain
why not.

C. Proposed Requirements for Non-Covered Broker-Dealers

1. Cybersecurity Policies and Procedures, Annual Review, Notification,
and Recordkeeping
    As discussed earlier, not all broker-dealers would be Covered
Entities under proposed Rule 10.\398\ Consequently, these Non-Covered
Broker-Dealers would not be subject to the requirements of proposed
Rule 10 to: (1) include certain elements in their cybersecurity risk
management policies and procedures; \399\ (2) file confidential reports
that provide information about the significant cybersecurity incident
with the Commission and, for some Covered Entities, other regulators;
\400\ and (3) make public disclosures about their cybersecurity risks
and the significant cybersecurity incidents they experienced during the
current or previous calendar year.\401\
---------------------------------------------------------------------------

    \398\ See section II.A.1. of this release (discussing the
definition of ``covered entity'' and why certain broker-dealers
would not be included within the definition).
    \399\ See paragraphs (b)(1)(i) through (v) of proposed Rule 10.
    \400\ See paragraph (c)(2) of proposed Rule 10. See also
paragraph (a)(10) of proposed Rule 10 (defining the term
``significant cybersecurity risk'').
    \401\ See paragraph (d) of proposed Rule 10.
---------------------------------------------------------------------------

    In light of their limited business activities, Non-Covered Broker-
Dealers would not be subject to the same requirements as would Covered
Entities. Instead, Non-Covered Broker-Dealers would be required to
establish, maintain, and enforce written policies and procedures that
are reasonably designed to address their cybersecurity risks taking
into account the size, business, and operations of the firm.\402\ They
also would be required to review and assess the design and
effectiveness of their cybersecurity policies and procedures, including
whether the policies and procedures reflect changes in cybersecurity
risk over the time period covered by the review. They also would be
required to make a record with respect to the annual review. In
addition, they would be required to provide the Commission and their
examining authority with immediate written electronic notice of a
significant cybersecurity incident affecting them.\403\ Finally, they
would be required to maintain and preserve versions of their policies
and procedures and the record of the annual review.
---------------------------------------------------------------------------

    \402\ See paragraph (e)(1) of proposed Rule 10.
    \403\ See paragraph (e)(2) of proposed Rule 10.
---------------------------------------------------------------------------

    A Non-Covered Broker-Dealer could be a firm that limits its
business to selling mutual funds on a subscription-way basis or a
broker-dealer that limits its business to engaging in private
placements for clients. Alternatively, it could be a broker-dealer that
limits its business to effecting securities transactions in order to
facilitate mergers, acquisitions, business sales, and business
combinations or a broker-dealer that limits its business to engaging in
underwritings for issuers. Moreover, a Non-Covered Broker-Dealer--
because it does not meet the definition of ``covered entity''--would
not a be a broker-dealer that: maintains custody of customer securities
and cash; \404\ connects to a broker-dealer that maintains custody of
customer securities through an introducing relationship; \405\ is a
large proprietary trading firm; \406\ operates as a market maker; \407\
or operates an ATS.\408\
---------------------------------------------------------------------------

    \404\ See paragraph (a)(1)(i)(A) of proposed Rule 10 (defining
``covered entity'' to include a broker-dealer that maintains custody
of cash and securities for customers or other broker-dealers and is
not exempt from the requirements of Rule 15c3-3).
    \405\ See paragraph (a)(1)(i)(B) of proposed Rule 10 (defining
``covered entity'' to include a broker-dealer that introduces
customer accounts on a fully disclosed basis to another broker-
dealer that maintains custody of cash and securities for customers
or other broker-dealers and is not exempt from the requirements of
Rule 15c3-3).
    \406\ See paragraphs (a)(1)(i)(C) and (D) of proposed Rule 10
(defining ``covered entity'' to include a broker-dealer with
regulatory capital equal to or exceeding $50 million or total assets
equal to or exceeding $1 billion).
    \407\ See paragraph (a)(1)(i)(E) of proposed Rule 10 (defining
``covered entity'' to include a broker-dealer that is a market maker
under the Exchange Act or the rules thereunder (which includes a
broker-dealer that operates pursuant to Rule 15c3-1(a)(6)) or is a
market maker under the rules of an SRO of which the broker-dealer is
a member).
    \408\ See paragraph (a)(1)(i)(F) of proposed Rule 10 (defining
``covered entity'' to include a broker-dealer that is an ATS).
---------------------------------------------------------------------------

    A broker-dealer that limits its business to one of the activities
described above and that does not engage in functions that would make
it a Covered Entity under proposed Rule 10 generally does not use
information systems to carry out its operations to the same degree as a
broker-dealer that is a Covered Entity. For example, the information
systems used by a Non-Covered Broker-Dealer could be limited to smart
phones and personal computers with internet and email access. Moreover,
this type of firm may have a small staff of employees using these
information systems. Therefore, the

overall footprint of the information systems used by a Non-Covered
Broker-Dealer may be materially smaller in scale and complexity than
the footprint of the information systems used by a broker-dealer that
is a Covered Entity. In addition, the amount of data stored on these
information systems relating to the Non-Covered Broker-Dealer's
business may be substantially less than the amount of data stored on a
Covered Entity's information systems. This means the information system
perimeter of these firms that needs to be protected from cybersecurity
threats and vulnerabilities is significantly smaller than that of a
Covered Broker-Dealer. For these reasons, proposed Rule 10 would
provide that the written policies and procedures required of a Non-
Covered Broker-Dealer must be reasonably designed to address the
cybersecurity risks of the firm taking into account the size, business,
and operations of the firm.
    Therefore, unlike the requirements for a Covered Entity, proposed
Rule 10 does not specify minimum elements that would need to be
included in a Non-Covered Broker-Dealer's policies and procedures.\409\
Nonetheless, a Non-Covered Broker-Dealer may want to consider whether
any of those required elements would be appropriate components of it
policies and procedures for addressing cybersecurity risk.\410\
---------------------------------------------------------------------------

    \409\ See paragraph (b)(1) of proposed Rule 10 (setting forth
the elements that would need to be included in a Covered Entity's
policies and procedures).
    \410\ As discussed earlier, the elements are consistent with
industry standards for addressing cybersecurity risk. See section
II.B.1. of this release (discussing the policies and procedures
requirements for Covered Entities).
---------------------------------------------------------------------------

    Proposed Rule 10 also would require that the Non-Covered Broker-
Dealer annually review and assess the design and effectiveness of its
cybersecurity policies and procedures, including whether the policies
and procedures reflect changes in cybersecurity risk over the time
period covered by the review.\411\ The annual review and assessment
requirement is designed to require Non-Covered Broker-Dealers to
evaluate whether their cybersecurity policies and procedures continue
to work as designed. Non-Covered Broker-Dealers could consider using
this information to determine whether changes are needed to assure
their continued effectiveness (i.e., to make sure their policies and
procedures continue to be reasonably designed to address their
cybersecurity risks as required by the rule).
---------------------------------------------------------------------------

    \411\ See paragraph (e)(1) of proposed Rule 10.
---------------------------------------------------------------------------

    The rule also would require the Non-Covered Broker-Dealer to make a
written record that documents the steps taken in performing the annual
review and the conclusions of the annual review. Therefore, Non-Covered
Broker-Dealers would need to make a record of the review rather than
documenting the review in a written report, as would be required of
Covered Entities.\412\ A report is a means to communicate information
within an organization. The personnel that prepare the report for the
Covered Entity would be able to use it to communicate their assessment
of the firm's policies and procedures to others within the organization
such as senior managers. For purposes of proposed Rule 10, a record,
among other things, is a means to document that an activity took place,
for example, to demonstrate compliance with a requirement. As discussed
above, Non-Covered Broker-Dealers generally would be smaller and less
complex organizations than Covered Entities. A record of the annual
review could be used by Commission examination staff to review the Non-
Covered Broker-Dealer's compliance with the annual review requirement
without imposing the additional process involved in creating an
internal report.
---------------------------------------------------------------------------

    \412\ See section II.B.1.f. of this release (discussing in more
detail the annual report that would be required of Covered
Entities).
---------------------------------------------------------------------------

    As discussed earlier, Covered Entities would be subject to a
requirement to give the Commission immediate written electronic notice
of a significant cybersecurity incident upon having a reasonable basis
to conclude that the significant cybersecurity incident has occurred or
is occurring.\413\ Non-Covered Broker-Dealers would be subject to the
same immediate written electronic notice requirement. In particular,
they would be required to give immediate written electronic notice to
the Commission of a significant cybersecurity incident upon having a
reasonable basis to conclude that the incident has occurred or is
occurring.\414\ The Commission would keep the notices nonpublic to the
extent permitted by law. The notice would need to identify the Non-
Covered Broker-Dealer, state that the notice is being given to alert
the Commission of a significant cybersecurity incident impacting the
Non-Covered Broker-Dealer, and provide the name and contact information
of an employee of the Non-Covered Broker-Dealer who can provide further
details about the nature and scope of the significant cybersecurity
incident. In addition, Non-Covered Broker-Dealers--like Covered Broker-
Dealers--would need to give the notice to their examining
authority.\415\ The immediate written electronic notice is designed to
alert the Commission on a confidential basis to the existence of a
significant cybersecurity incident impacting a Non-Covered Broker-
Dealer so the Commission staff can quickly begin to assess the event.
---------------------------------------------------------------------------

    \413\ See paragraph (c)(1) of proposed Rule 10. See also section
II.B.2.a. of this release (discussing the immediate notification
requirement for Covered Entities in more detail).
    \414\ See paragraph (e)(2) of proposed Rule 10. See also
paragraph (a)(10) of proposed Rule 10 (defining the term
``significant cybersecurity incident'').
    \415\ See paragraph (e)(2) of proposed Rule 10. See also
paragraph (c)(1)(i) of proposed Rule 10 (requiring Covered Broker-
Dealers to provide the notice to their examining authority).
---------------------------------------------------------------------------

    Finally, as discussed above, proposed Rule 10 would require the
Non-Covered Broker-Dealer to: (1) establish, maintain, and enforce
written policies and procedures that are reasonably designed to address
the cybersecurity risks of the firm; (2) make a written record that
documents its annual review; and (3) provide immediate electronic
written notice to the Commission of a significant cybersecurity
incident upon having a reasonable basis to conclude that the
significant cybersecurity incident has occurred or is occurring.\416\
The Commission is proposing to amend the broker-dealer record
preservation and maintenance rule to identify these records
specifically as being subject to the rule's requirements.\417\ Under
the amendments, the written policies and procedures would need to be
maintained until three years after the termination of the use of the
policies and procedures and all other records would need to be
maintained for three years.
---------------------------------------------------------------------------

    \416\ See paragraph (e) of proposed Rule 10.
    \417\ This amendment would add a new paragraph (e)(13) to Rule
17a-4.
---------------------------------------------------------------------------

2. Request for Comment
    The Commission requests comment on all aspects of the proposed
requirements for non-covered broker-dealers. In addition, the
Commission is requesting comment on the following specific aspects of
the proposals:
    75. Should paragraph (e)(1) of proposed Rule 10 be modified to
specify certain minimum elements that would need to be included in the
policies and procedures of Non-Covered Broker-Dealers? If so, identify
the elements and explain why they should be included. For example,
should paragraph (e) of proposed Rule 10 specify that the policies and
procedures must include policies and procedures to address any

or all of the following: (1) risk assessment; (2) user security and
access; (3) information protection; (4) cybersecurity threat and
vulnerability management; and (5) cybersecurity incident response and
recovery? If so, explain why. If not, explain why not.
    76. Should paragraph (e)(2) of proposed Rule 10 be modified to
require the notice to be given within a specific timeframe such as on
the same day the requirement was triggered or within 24 hours? If so,
explain why. If not, explain why not.
    77. Should paragraph (e)(2) of proposed Rule 10 be modified to
revise the trigger for the immediate notification requirement? If so,
explain why. If not, explain why not. For example, should the trigger
be when the Non-Covered Broker-Dealer ``detects'' a significant
cybersecurity incident (rather than when it has a reasonable basis to
conclude that the significant cybersecurity incident has occurred or is
occurring)? If so, explain why. If not, explain why not. For example,
would a detection standard be a less subjective standard? If so,
explain why. If not, explain why not. Is there another trigger standard
that would be more appropriate? If so, identify it and explain why it
would be more appropriate.
    78. Should paragraph (e)(2) of proposed Rule 10 be modified to
eliminate the requirement that a Non-Covered Broker-Dealer give the
Commission immediate written electronic notice of a significant
cybersecurity incident upon having a reasonable basis to conclude that
the significant cybersecurity incident has occurred or is occurring? If
so, explain why. If not, explain why not. For example, would this
requirement be unduly burdensome on Non-Covered Broker-Dealers? Please
explain.
    79. If the immediate notification requirement of paragraph (e)(2)
is adopted as proposed, it is anticipated that a dedicated email
address would be established to receive these notices. Are there other
methods the Commission should use for receiving these notices? If so,
identity them and explain why they would be more appropriate than
email. For example, should the notices be received through the EDGAR
system? If so, explain why. If not, explain why not.
    80. Should paragraph (e) of proposed Rule 10 be modified to include
any other requirements that would be applicable to Covered Entities
under proposed Rule 10 that also should be required of Non-Covered
Broker-Dealers? If so, identify them and explain why they should apply
to Non-Covered Broker-Dealers. For example, should the paragraph be
modified to require Non-Covered Broker-Dealers to report information
about a significant cybersecurity incident confidentially on Part I of
proposed Form SCIR? If so, explain why. If not, explain why not. Should
the timeframe for filing Part I of Proposed Form SCIR be longer for
Non-Covered Broker-Dealers? For example, should the reporting timeframe
be within 72 or 96 hours instead of 48 hours? Please explain. If Non-
Covered Broker-Dealers were required to file Part I of Form SCIR,
should they be permitted to provide more limited information about the
significant cybersecurity incident than Covered Entities? If so,
identify the more limited set of information and explain why it would
be appropriate to permit Non-Covered Broker-Dealers omit the additional
information that Covered Entities would need to report.
    81. Should Non-Covered Broker-Dealers be required to make and
preserve for three years in accordance with Rule 17a-4 a record of any
significant cybersecurity incident that impacts them containing some or
all of the information that would be reported by Covered Entities on
Part I of proposed Form SCIR? If so, explain why. If not, explain why
not.
    82. Should paragraph (e) of proposed Rule 10 be modified to require
a Non-Covered Broker-Dealer to prepare a written report of the annual
review (rather than a record, as proposed)? If so, explain why. If not,
explain why not.

D. Cross-Border Application of the Proposed Cybersecurity Requirements
to SBS Entities

1. Background on the Cross-Border Application of Title VII Requirements
    Security-based swap transactions take place across national
borders, with agreements negotiated and executed between counterparties
in different jurisdictions (which might then be booked and risk-managed
in still other jurisdictions).\418\ Mindful that this global market
developed prior to the enactment of the Dodd-Frank Act and the fact
that the application of Title VII \419\ to cross-border activities
raises issues of potential conflict or overlap with foreign regulatory
regimes,\420\ the Commission has adopted a taxonomy to classify
requirements under section 15F of the Exchange Act as applying at
either the transaction-level or at the entity-level.\421\ Transaction-
level requirements under section 15F of the Exchange Act are those that
primarily focus on protecting counterparties to security-based swap
transactions by requiring SBSDs to, among other things, provide certain
disclosures to counterparties, adhere to certain standards of business
conduct, and segregate customer funds, securities, and other
assets.\422\ In contrast to transaction-level requirements, entity-
level requirements under section 15F of the Exchange Act are those that
are expected to play a role in ensuring the safety and soundness of the
SBS Entity and thus relate to the entity as a whole.\423\ Entity-level
requirements include capital and margin requirements, as well as other
requirements relating to a firm's identification and management of its
risk exposure, including the risk management procedures required under
section 15F(j) of the Exchange Act, a statutory basis for rules
applicable to SBS Entities that the Commission is proposing in this
release.\424\ Because these requirements relate to the entire entity,
they apply to SBS Entities on a firm-wide basis, without
exception.\425\
---------------------------------------------------------------------------

    \418\ See Cross-Border Proposing Release, 78 FR at 30976, n. 48.
    \419\ Unless otherwise indicated, references to ``Title VII'' in
this section of this release are to Subtitle B of Title VII of the
Dodd-Frank Act.
    \420\ See Cross-Border Proposing Release, 78 FR at 30975.
    \421\ See id. at 31008-25. See also Business Conduct Standards
for Security-Based Swap Dealers and Major Security-Based Swap
Participants, Exchange Act Release No. 77617 (Apr. 14, 2016) [81 FR
29959, 30061-69 (May 13, 2016)] (``Business Conduct Standards
Adopting Release'').
    \422\ Cross-Border Proposing Release, 78 FR at 31010.
    \423\ See id. at 31011, 31035.
    \424\ See id. at 31011-16 (addressing the classification of
capital and margin requirements, as well as of the risk management
requirements of section 15F(j) of the Exchange Act and other entity-
level requirements applicable to SBSDs).
    \425\ See id. at 31011, 31024-25. See also id. at 31035
(applying the analysis to MSBSPs). In reaching this conclusion, the
Commission explained that it ``preliminarily believes that entity-
level requirements are core requirements of the Commission's
responsibility to ensure the safety and soundness of registered
security based swap dealers,'' and that ``it would not be consistent
with this mandate to provide a blanket exclusion to foreign
security-based swap dealers from entity-level requirements
applicable to such entities.'' Id. at 31024 (footnotes omitted). The
Commission further expressed the preliminary view that concerns
regarding the application of entity-level requirements to foreign
SBSDs would largely be addressed through the proposed approach to
substituted compliance. See id.
---------------------------------------------------------------------------

    The Commission applied this taxonomy in 2016 when it adopted rules
to implement business conduct standards for SBS Entities. At that time,
the Commission also stated that the rules and regulations prescribed
under section 15F(j) should be treated as entity-level
requirements.\426\ The

Commission has not, however, expressly addressed the entity-level
treatment of the cybersecurity requirements under proposed Rule 10,
except with regard to recordkeeping and reporting.\427\
---------------------------------------------------------------------------

    \426\ See Business Conduct Standards Adopting Release, 81 FR at
30064-65.
    \427\ The Commission has previously stated that recordkeeping
and reporting requirements are entity-level requirements. See
Recordkeeping and Reporting Requirements for Security-Based Swap
Dealers, Major Security-Based Swap Participants, and Broker-Dealers,
Exchange Act Release No. 87005 (Sept. 19, 2019), 84 FR 68550, 68596-
97 (Dec. 16, 2019) (``SBS Entity Recordkeeping and Reporting
Adopting Release'').
---------------------------------------------------------------------------

2. Proposed Entity-Level Treatment
a. Proposal
    Consistent with its approach to the obligations described in
Section 15F(j) and to capital,\428\ margin,\429\ risk mitigation,\430\
and recordkeeping,\431\ the Commission is proposing to apply the
requirements of proposed Rule 10 to an SBS Entity's entire security-
based swap business without exception, including in connection with any
security-based swap business it conducts with foreign
counterparties.\432\
---------------------------------------------------------------------------

    \428\ See Capital, Margin, and Segregation Requirements for
Security-Based Swap Dealers and Major Security-Based Swap
Participants and Capital and Segregation Requirements for Broker-
Dealers. Exchange Act Release No. 86175 (Jun. 21, 2019), 84 FR
43872, 43879 (Aug, 22, 2019) (``Capital, Margin, and Segregation
Requirements Adopting Release'').
    \429\ Id.
    \430\ See Risk Mitigation Techniques for Uncleared Security-
Based Swaps, Exchange Act Release No. 87782 (Dec. 18, 2019) [85 FR
6359, 6378 (Feb. 4, 2020)] (``SBS Entity Risk Mitigation Adopting
Release'').
    \431\ See SBS Entity Recordkeeping and Reporting Adopting
Release, 84 FR at 68596-97.
    \432\ As entity-level requirements, transaction-level exceptions
such as in 17 CFR 3a71-3(c) and 17 CFR 3a67-10(d), would not be
available for the proposed cybersecurity requirements.
---------------------------------------------------------------------------

    Cybersecurity policies and procedures and the related requirements
of proposed Rule 10 serve as an important mechanism for allowing SBS
Entities and their counterparties to manage risks associated with their
operations, including risks related to the entity's safety and
soundness.\433\ An alternative approach that does not require an SBS
Entity to take steps to manage cybersecurity risk throughout the firm's
entire business could contribute to operational risk affecting the
entity's security-based swap business as a whole, and not merely
specific security-based swap transactions. Moreover, to the extent that
these risks affect the safety and soundness of the SBS Entity, they
also may affect the firm's counterparties and the functioning of the
broader security-based swap market. Accordingly, the Commission
proposes to apply the requirements to the entirety of an SBS Entity's
business.\434\ However, as described below, the Commission is proposing
that foreign SBS Entities have the potential to avail themselves of
substituted compliance to satisfy the cybersecurity requirements under
proposed Rule 10.
---------------------------------------------------------------------------

    \433\ See sections I.A. and II.B.1. of this release (discussing,
respectively, cybersecurity risks and how those risks can be managed
by certain policies, procedures, and controls). See also sections
II.B.2-5 of this release.
    \434\ The Commission has expressed the view that an entity that
has registered with the Commission subjects itself to the entire
regulatory system governing such registered entities. Cross-Border
Proposing Release, 78 FR at 30986. See also Business Conduct
Standards Adopting Release, 81 FR at n.1306 (determining that the
requirements described in section 15F(j) of the Exchange Act should
be treated as entity-level requirements, and stating that such
treatment would not be tantamount to applying Title VII to persons
that are ``transact[ing] a business in security-based swaps without
the jurisdiction of the United States,'' within the meaning of
section 30(c) of the Exchange Act). That treatment of section 15F(j)
of the Exchange Act was also deemed necessary or appropriate as a
prophylactic measure to help prevent the evasion of the provisions
of the Exchange Act that were added by the Dodd-Frank Act, and thus
help prevent the relevant purposes of the Dodd-Frank Act from being
undermined. Id. (citing Application of ``Security-Based Swap
Dealer'' and ``Major Security-Based Swap Participant'' Definitions
to Cross-Border Security-Based Swap Activities; Republication,
Exchange Act Release No. 72472 (June 25, 2014) [79 FR 47277, 47291-
92 (Aug. 12, 2014)] (``SBS Entity Definitions Adopting Release'')
(interpreting anti-evasion provisions of the Exchange Act, section
30(c)). A different approach in connection with proposed Rule 10
would not be consistent with the purposes of Title VII of the Dodd-
Frank Act and could allow SBS Entities to avoid compliance with
these proposed rules for portions of their business in a manner that
could increase the risk to the registered entity.
---------------------------------------------------------------------------

b. Request for Comment
    The Commission generally requests comments on the proposed entity-
level application of proposed Rule 10. In addition, the Commission
requests comments on the following specific issues:
    83. Does the proposed approach appropriately treat the proposed
requirements as entity-level requirements applicable to the entire
business conducted by foreign SBS Entities? If not, please identify any
particular aspects of proposed Rule 10 that should not be applied to a
foreign SBS Entity, or applied only to specific transactions, and
explain how such an approach would be consistent with the goals of
Title VII of the Dodd-Frank Act.
    84. Should the Commission apply the same cross-border approach to
the application of proposed Rule 10 for both SBSDs and MSBSPs? If not,
please describe how the cross-border approach for SBSDs should differ
from the cross-border approach for MSBSPs, and explain the reason(s)
for any potential differences in approach.
    85. What types of conflicts might a foreign SBS Entity face if it
had to comply with proposed Rule 10 in more than one jurisdiction? In
what situations would compliance with more than one of these
requirements be difficult or impossible? For Market Entities that are
U.S. persons, could compliance with the proposed rules create
compliance challenges with requirements in a foreign jurisdiction?
    86. As an alternative to treating the proposed requirements as
entity-level requirements, should the Commission instead treat the
proposed requirements as transaction-level requirements? If so, to
which cross-border security-based swap transactions should these
requirements apply and why? Please describe how these requirements
would apply differently if classified as transaction-level requirements
instead of as entity-level requirements.
3. Availability of Substituted Compliance
a. Existing Substituted Compliance Rule
    In 2016,\435\ the Commission adopted Exchange Act Rule 3a71-6
(``Rule 3a71-6'') \436\ to provide that the Commission may, by order,
make a determination that compliance with specified requirements under
a foreign financial regulatory system by non-U.S. SBS Entities \437\
may satisfy certain business conduct requirements under Exchange Act
section 15F, subject to certain conditions. The rule in part provides
that the Commission shall not make a determination providing for
substituted compliance unless the Commission determines, among other
things, that the foreign regulatory requirements are

comparable to otherwise applicable requirements.\438\
---------------------------------------------------------------------------

    \435\ See Business Conduct Standards Adopting Release, 81 FR at
30070-81. Separately, in 2015, the Commission adopted a rule making
substituted compliance potentially available in connection with
certain regulatory reporting and public dissemination requirements
related to security-based swaps. See Regulation SBSR-Reporting and
Dissemination of Security-Based Swap Information, Exchange Act
Release No. 74244 (Feb. 11, 2015) [80 FR 14563 (Mar. 19, 2015)]
(adopting 17 CFR 242.908 (``Rule 908'')). Paragraph (c) of Rule 908
does not contemplate substituted compliance for the rules being
proposing today.
    \436\ See 17 CFR 240.3a71-6.
    \437\ If the Commission makes a substituted compliance
determination under paragraph (a)(1) of Rule 3a71-6, SBS Entities
that are not U.S. persons (as defined in 17 CFR 240.3a71-3(a)(4)
(``Rule 3a71-3(a)(4)'')), but not SBS Entities that are U.S.
persons, may satisfy specified requirements by complying with
comparable foreign requirements and any conditions set forth in the
substituted compliance determination made by the Commission. See
paragraphs (b) and (d) of Rule 3a71-6.
    \438\ See paragraph (a)(2) of 3a71-6. See also Business Conduct
Standards Adopting Release, 81 FR at 30074.
---------------------------------------------------------------------------

    When the Commission adopted this substituted compliance rule that
addressed the specified business conduct requirements, the Commission
also noted that Exchange Act section 15F(j)(7) authorizes the
Commission to prescribe rules governing the duties of SBS
Entities.\439\ The Commission stated that it was not excluding that
provision from the potential availability of substituted compliance,
and that it expected to separately consider whether substituted
compliance may be available in connection with any future rules
promulgated pursuant to that provision.\440\ Further, the Commission
stated that it expected to assess the potential availability of
substituted compliance in connection with other requirements when the
Commission considers final rules to implement those requirements.\441\
Consistent with these statements, the Commission subsequently amended
Rule 3a71-6 to provide SBS Entities that are non U.S. persons with the
potential to avail themselves of substituted compliance with respect to
the following Title VII requirements: (1) trade acknowledgment and
verification,\442\ (2) capital and margin requirements,\443\ (3)
recordkeeping and reporting,\444\ and (4) portfolio reconciliation,
portfolio compression, and trading relationship documentation.\445\
---------------------------------------------------------------------------

    \439\ Business Conduct Standards Adopting Release, 81 FR at n.
1438.
    \440\ Id.
    \441\ See Business Conduct Standards Adopting Release, 81 FR at
30074.
    \442\ See Trade Acknowledgment and Verification of Security-
Based Swap Transactions, Exchange Act Release No. 78011 (Jun. 8,
2016) [81 FR 39807, 39827-28 (Jun. 17, 2016)] (``SBS Entity Trade
Acknowledgment and Verification Adopting Release'').
    \443\ See Capital, Margin, and Segregation Requirements Adopting
Release, 84 FR at 43948-50.
    \444\ See SBS Entity Recordkeeping and Reporting Adopting
Release, 84 FR at 68597-99.
    \445\ See SBS Entity Risk Mitigation Adopting Release, 85 FR at
6379-80.
---------------------------------------------------------------------------

b. Proposed Amendment to Rule 3a71-6
    The Commission is proposing to further amend Rule 3a71-6 to provide
SBS Entities that are not U.S. persons (as defined in Rule 3a71-3(a)(4)
of the Exchange Act) with the potential to avail themselves of
substituted compliance to satisfy the cybersecurity requirements of
proposed Rule 10 and Form SCIR as applicable to SBS Entities.\446\ In
proposing to amend the rule, the Commission preliminarily believes that
the principles associated with substituted compliance, as previously
adopted in connection with both the business conduct requirements and
the recordkeeping and reporting requirements, in large part should
similarly apply to the cyber security risk management requirements
being proposing today. The discussions in the Business Conduct
Standards Adopting Release, including for example those regarding
consideration of supervisory and enforcement practices,\447\ certain
multi-jurisdictional issues,\448\ and application procedures \449\ are
applicable to the proposed cybersecurity requirements. Accordingly, the
proposed substituted compliance rule would apply to the cybersecurity
risk management requirements in the same manner as it already applies
to existing business conduct requirements and the recordkeeping and
reporting requirements.
---------------------------------------------------------------------------

    \446\ Substituted compliance would only be available to eligible
SBS Entities. For example, substituted compliance would not be
available to a Market Entity registered as both an SBS Entity and a
broker-dealer with respect to the broker-dealer's obligations under
the proposed rules.
    \447\ Business Conduct Standards Adopting Release, 81 FR at
30079.
    \448\ Business Conduct Standards Adopting Release, 81 FR at
30079-80.
    \449\ Business Conduct Standards Adopting Release, 81 FR at
30080-81.
---------------------------------------------------------------------------

    Making substituted compliance available for the cybersecurity risk
management requirements would be consistent with the approach the
Commission has taken with other rules applicable to SBS Entities. This
approach takes into consideration the global nature of the security-
based swap market and the prevalence of cross-border transactions
within that market.\450\ The application of the cybersecurity risk
management requirements may lead to requirements that are duplicative
of, or in conflict with, applicable foreign requirements, even when the
two sets of requirements implement similar goals and lead to similar
results. Those results have the potential to disrupt existing business
relationships and, more generally, to reduce competition and market
efficiency. To address those effects, under certain circumstances it
may be appropriate to allow the possibility of substituted compliance,
whereby non-U.S. market participants may satisfy the cybersecurity risk
management requirements by complying with comparable foreign
requirements. Allowing for the possibility of substituted compliance in
this manner would help achieve the benefits of those particular
requirements in a way that helps avoid regulatory conflict and
minimizes duplication, thereby promoting market efficiency, enhancing
competition, and contributing to the overall functioning of the global
security-based swap market.
---------------------------------------------------------------------------

    \450\ See generally Business Conduct Standards Adopting Release,
81 FR at 30073-74 (addressing the basis for making substituted
compliance available in the context of the business conduct
requirements).
---------------------------------------------------------------------------

    Accordingly, the Commission is proposing to amend paragraph (d)(1)
of Rule 3a71-6 to make substituted compliance available for proposed
Rule 10 and Form SCIR if the Commission determines with respect to a
foreign financial regulatory system that compliance with specified
requirements under such foreign financial regulatory system by a
registered SBS Entity, or class thereof, satisfies the corresponding
requirements of proposed Rule 10 and Form SCIR.\451\ However, the
proposal would not amend Rule 3a71-6 in connection with the proposed
amendments to Rule 18a-6 regarding records to be preserved by certain
SBS Entities. Rule 3a71-6 currently permits eligible applicants to seek
a substituted compliance determination from the Commission with regard
to the requirements of Rule 18a-6.\452\
---------------------------------------------------------------------------

    \451\ Paragraph (a)(1) of Rule 3a71-6 provides that the
Commission may, conditionally or unconditionally, by order, make a
determination with respect to a foreign financial regulatory system
that compliance with specified requirements under the foreign
financial system by an SBS Entity, or class thereof, may satisfy the
corresponding requirements identified in paragraph (d) of the rule
that would otherwise apply. See section II.D.3.c. of this release.
    \452\ See paragraph (d)(6) of Rule 3a71-6.
---------------------------------------------------------------------------

c. Comparability Criteria, and Consideration of Related Requirements
    If adopted, the proposed amendment to paragraph (d)(1) of Rule
3a71-6 would provide that eligible applicants may request that the
Commission make a substituted compliance determination with respect to
one or more of the requirements Rule 10 and Form SCIR.\453\ Further,
existing paragraph (d)(6) of Rule 3a71-6 would permit eligible
applicants to request that the Commission make a substituted compliance
determination with respect to one or more of the requirements of the
proposed amendments to Rule 18a-6, if adopted. A positive substituted
compliance determination with respect to requirements existing before
adoption of the proposed Rule 10, Form SCIR, and the related record
preservation requirements would not automatically result in a positive
substituted compliance determination with respect

to proposed Rule 10, Form SCIR or the proposed amendments to Rule 18a-
6. Before making a substituted compliance determination, the substance
of each foreign regulatory system to which substituted compliance would
apply should be evaluated for comparability to such newly adopted
requirements. As such, if the Commission adopts the proposed amendment
to Rule 3a71-6, eligible applicants \454\ seeking a Commission
determination permitting SBS Entities that are not U.S. persons to
satisfy the requirements of proposed Rule 10, Form SCIR, or the
proposed amendments to Rule 18a-6 by complying with comparable foreign
requirements would be required to file an application, pursuant to the
procedures set forth in 17 CFR 240.0-13, requesting that the Commission
make a such a determination pursuant to 17 CFR 3a71-6(a)(1).\455\
---------------------------------------------------------------------------

    \453\ See paragraph (c) of Rule 3a71-6.
    \454\ See 17 CFR 3a71-6(c).
    \455\ Existing Commission substituted compliance determinations
do not address the requirements of the proposed new rules or the
proposed amendments. If the Commission adopts the requirements in
the proposed new or amended rules, SBS Entities (or the relevant
foreign financial regulatory authority or authorities) seeking a
substituted compliance determination with respect to those
requirements would be required to file an application requesting
that the Commission make the determination. Applicants may not
request that the Commission make a substituted compliance
determination related to the new requirements by amending a
previously filed application that requested a substituted compliance
determination related to other Commission requirements. However, new
applications may incorporate relevant information from the
applicant's previously filed requests for substituted compliance
determinations if the information remains accurate.
---------------------------------------------------------------------------

    The Commission has taken a holistic approach in determining the
comparability of foreign requirements for substituted compliance
purposes, focusing on regulatory outcomes as a whole, rather than on a
requirement-by-requirement comparison.\456\ The Commission
preliminarily believes that such a holistic approach would be
appropriate for determining comparability for substituted compliance
purposes in connection with the requirements of proposed Rule 10, Form
SCIR, and the proposed amendments to Rule 18a-6. Under the proposed
amendment to Rule 3a71-6, the Commission's comparability assessments
associated with the proposed cybersecurity risk management requirements
accordingly would consider whether, in the Commission's view, the
foreign regulatory system achieves regulatory outcomes that are
comparable to the regulatory outcomes associated with those
requirements. Rule 3a71-6 provides that the Commission's substituted
compliance determination will take into account factors that the
Commission determines appropriate, such as, for example, the scope and
objectives of the relevant foreign regulatory requirements (taking into
account the applicable criteria set forth in paragraph (d) of the
rule), as well as the effectiveness of the supervisory compliance
program administered, and the enforcement authority exercised, by a
foreign financial regulatory authority or authorities in such foreign
financial regulatory system to support its oversight of the SBS Entity
(or class thereof) or of the activities of such SBS Entity (or class
thereof).\457\
---------------------------------------------------------------------------

    \456\ See Business Conduct Standards Adopting Release, 81 FR at
30078-79. See also SBS Entity Trade Acknowledgment and Verification
Adopting Release, 81 FR at 39828; SBS Entity Recordkeeping and
Reporting Adopting Release, 84 FR at 68598-99.
    \457\ See 17 CFR 240.3a71-6(a)(2)(i).
---------------------------------------------------------------------------

    The Commission may determine to conduct its comparability analyses
regarding Rule 10, Form SCIR, and the related record preservation
requirements in conjunction with comparability analyses regarding other
Exchange Act requirements that, like the requirements being proposed
today, relate to risk management, recordkeeping, reporting, and
notification requirements of SBS Entities. If the Commission adopts the
proposed amendment to Rule 3a71-6, substituted compliance requests
related to Rule 10, Form SCIR, and the related record preservation
requirements may be filed by (i) applicants filing a request for a
substituted compliance determination solely in connection with Rule 10,
Form SCIR, and the related record preservation requirements,\458\ and
(ii) applicants filing a request for a substituted compliance
determination in connection with Rule 10, Form SCIR, and the related
record preservation requirements combined with a request for a
substituted compliance determination related to other eligible
requirements. In either event, depending on the applicable facts and
circumstances, the Commission's comparability assessment associated
with the Rule 10, Form SCIR, or the related record preservation
requirements may constitute part of a broader assessment of Exchange
Act risk management, recordkeeping, reporting, and notification
requirements for SBS Entities, and the applicable comparability
decisions may be made at the level of those risk management,
recordkeeping, reporting, and notification requirements for SBS
Entities as a whole.
---------------------------------------------------------------------------

    \458\ This category of applicants would include those who
previously filed requests for the Commission to make substituted
compliance determinations related to other requirements eligible for
substituted compliance determinations under Rule 3a71-6.
---------------------------------------------------------------------------

d. Request for Comment
    The Commission generally requests comments on all aspects of the
proposed amendment to Rule 3a71-6 and proposed availability of
substituted compliance. In addition, the Commission requests comments
on the following specific issues:
    87. Should the Commission make substituted compliance available
with respect to proposed Rule 10, Form SCIR, and the related record
preservation requirements? Why or why not? If you believe that
substituted compliance should not be available with respect to these
requirements, how would you distinguish this policy decision from the
Commission's previous determination to make substituted compliance
potentially available with respect to other Title VII requirements
(i.e., the business conduct, trade acknowledgment and verification,
capital and margin, recordkeeping and reporting, and portfolio
reconciliation, portfolio compression, and trading relationship
documentation rules)?
    88. Are there other aspects of the scope of the substituted
compliance rule for which the Commission should amend or provide
additional guidance in light of proposed Rule 10, Form SCIR, and the
proposed amendment to Rule 18a-6? If so, what other amendments or
additional guidance would be appropriate and why?
    89. Are the items identified in Rule 3a71-6 as factors the
Commission will consider prior to making a substituted compliance
determination in connection with proposed Rule 10, Form SCIR, and the
related record preservation requirements appropriate? If so, explain
why. If not, explain why not. Should any of those items be modified or
deleted? Should additional considerations be added? If so, please
explain.

E. Amendments to Rule 18a-10

1. Proposal
    Exchange Act Rule 18a-10 (``Rule 18a-10'') permits an SBSD that is
registered as a swap dealer and predominantly engages in a swaps
business to elect to comply with the capital, margin, segregation,
recordkeeping, and reporting requirements of the Commodity Exchange Act
and the CFTC's rules in lieu of complying with the capital, margin,
segregation, recordkeeping, and reporting requirements of Exchange Act
Rules 18a-1, 18a-3, 18a-4, 18a-5, 18a-

6, 18a-7, 18a-8, and 18a-9.\459\ An SBSD may elect to operate pursuant
to Rule 18a-10 if it meets certain conditions.\460\ First, the firm
must be registered with the Commission as a stand-alone SBSD (i.e., not
also registered as a broker-dealer or an OTC derivatives dealer) and
registered with the CFTC as a swap dealer. Second, the firm must be
exempt from the segregation requirements of Rule 18a-4. Third, the
aggregate gross notional amount of the firm's outstanding security-
based swap positions must not exceed the lesser of two thresholds as of
the most recently ended quarter of the firm's fiscal year.\461\ The
thresholds are: (1) a maximum fixed-dollar gross notional amount of
open security-based swaps of $250 billion; \462\ and (2) 10% of the
combined aggregate gross notional amount of the firm's open security-
based swap and swap positions.
---------------------------------------------------------------------------

    \459\ See 17 CFR 240.18a-10.
    \460\ See Capital, Margin, and Segregation Requirements Adopting
Release, 84 at 43944-46 (discussing the conditions and the reasons
for them). See also SBS Entity Recordkeeping and Reporting Adopting
Release, 84 FR at 68549.
    \461\ The gross notional amount is based on the notional amounts
of the firm's security-based swaps and swaps that are outstanding as
of the quarter end. It is not based on transaction volume during the
quarter.
    \462\ The maximum fixed-dollar threshold of $250 billion is set
for a transition period of 3 years from the compliance date of the
rule. Three years after that date it will drop to $50 billion
(unless the Commission issues an order retaining the $250 billion
threshold or lesser amount that is greater than $50 billion).
---------------------------------------------------------------------------

    As discussed above, Rule 18a-6 is proposed to be amended to require
SBSDs to maintain and preserve the records required to be made pursuant
to proposed Rule 10.\463\ However, because Rule 18a-6 is within the
scope of Rule 18a-10, an SBSD operating pursuant to Rule 18a-10 would
not be subject to the maintenance and preservation requirements of Rule
18a-6 with respect to the records required to be made pursuant to
proposed Rule 10. Therefore, while an SBSD would be subject to proposed
Rule 10 and need to make these records, the firm would not need to
maintain or preserve them in accordance with Rule 18a-6. For these
reasons, the Commission is proposing to amend Rule 18a-10 to exclude
from its scope the record maintenance and preservation requirements of
Rule 18a-6 as they pertain to the records required to be made pursuant
to proposed Rule 10.\464\ Therefore, the records required to be made
pursuant to proposed Rule 10 would need to be preserved and maintained
in accordance with Rule 18a-6, as it is proposed to be amended.
---------------------------------------------------------------------------

    \463\ See section II.B.5. of this release (discussing these
proposals in more detail).
    \464\ See proposed paragraph (g) of Rule 18a-10.
---------------------------------------------------------------------------

2. Request for Comment
    The Commission requests comment on all aspects of the proposed
amendments relating to Rule 18a-10. In addition, the Commission is
requesting comment on the following specific aspects of the proposals:
    90. Should the proposed amendments to Rule 18a-10 be modified? If
so, describe how and explain why the modification would be appropriate.
For example, would the records required to be made pursuant to proposed
Rule 10 be subject to CFTC record preservation and maintenance rules?
If so, identify the rules and explain the preservation and maintenance
requirements they would impose on the records required to be made
pursuant to proposed Rule 10. In addition, explain whether it would be
appropriate to permit an SBSD operating pursuant to Rule 18a-10 to
comply with these CFTC rules in terms of preserving and maintaining the
records required to be made pursuant to proposed Rule 10 in lieu of the
complying with the preservation and maintenance requirements that would
apply to the records under the proposed amendments to Rule 18a-6.

F. Market Entities Subject to Regulation SCI, Regulation S-P,
Regulation ATS, and Regulation S-ID

1. Discussion
a. Introduction
    As discussed in more detail below, certain types of Market Entities
are subject to Regulation SCI and Regulation S-P.\465\ The Commission
separately is proposing to amend Regulation SCI and Regulation S-
P.\466\ Regulation SCI and Regulation S-P (currently and as they would
be amended) have or would have provisions requiring policies and
procedures that address certain types of cybersecurity risks.\467\
Regulation SCI (currently and as it would be amended) also requires
immediate written or telephonic notice and subsequent reporting to the
Commission on Form SCI of certain types of incidents.\468\ These
notification and subsequent reporting requirements of Regulation SCI
could be triggered by a ``significant cybersecurity incident'' as that
term would be defined in proposed Rule 10.\469\ Finally, Regulation SCI
and Regulation S-P (currently and as they would be amended) have or
would have provisions requiring disclosures to persons affected by
certain incidents.\470\ These current or proposed disclosure
requirements of Regulation SCI and Regulation S-P could be triggered by
a cybersecurity-related event that also would be a ``significant
cybersecurity incident'' as that term would be defined in proposed Rule
10.\471\ Consequently, if proposed Rule 10 is adopted (as proposed),
Market Entities could be subject to requirements in that rule and in
Regulation SCI and Regulation S-P that pertain to cybersecurity. While
the Commission preliminarily believes that these requirements are
nonetheless appropriate, it is seeking comment on the proposed
amendments, given the following: (1) each proposal has a different
scope and purpose; (2) the policies and procedures related to
cybersecurity that would be required under each of the proposed rules
would be consistent; (3) the public disclosures or notifications
required by the proposed rules would require different types of
information to be disclosed, largely to different audiences at
different times; and (4) it should be appropriate for entities to
comply with the proposed requirements.
---------------------------------------------------------------------------

    \465\ See 17 CFR 242.1000 through 1007 (Regulation SCI); 17 CFR
248.1 through 248.30 (Regulation S-P). See also section II.F.1.b. of
this release (discussing the types of Market Entities that are or
would be subject to Regulation SCI and/or Regulation S-P).
    \466\ See Regulation SCI 2023 Proposing Release; Regulation S-P
2023 Proposing Release.
    \467\ See section II.F.1.c. of this release (discussing the
existing and proposed requirements of Regulation SCI and Regulation
S-P to have policies and procedures that address certain
cybersecurity risks).
    \468\ See section II.F.1.d. of this release (discussing the
existing and proposed immediate notification and subsequent
reporting requirements of Regulation SCI).
    \469\ See paragraph (a)(10) of proposed Rule 10 (defining the
term ``significant cybersecurity incident'').
    \470\ See section II.F.1.e. of this release (discussing the