Release, supra note 1, at 72275 at n. 246; CAT NMS Plan Approval
Order, supra note 393, at 84758.
    \665\ CAT NMS Plan, secs. 6.12 and app. D. secs. 4.1 to 4.1.5.
The Plan Processor is subject to certain industry standards with
respect to its information security program, including, among
others, NIST-800-23 (Guidelines to Federal Organizations on Security
Assurance and Acquisition/Use of Test/Evaluated Products), NIST 800-
53 (Security and Privacy Controls for Federal Information Systems
and Organizations), and NIST 800-115 (Technical Guide to Information
Security Testing and Assessment). CAT NMS Plan, app D sec 4.2.
---------------------------------------------------------------------------

    First, the Plan Processor must develop and maintain a comprehensive
information security program, to be approved and reviewed at least
annually by an operating committee, which contains certain specific
requirements for the Company related to data security.\666\ As part of
this requirement, the Plan Processor is required to create and enforce
policies, procedures, and control structures to monitor and address CAT
data security, including reviews of industry standards and periodic
penetration testing.\667\ Second, both the Participants and the Plan
Processor must implement user security and access policies and
procedures that include safeguards to secure access and use of the
CAT.\668\ The Plan Processor must also review Participant information
security policies and procedures related to the Company to ensure that
such policies and procedures are comparable to those of the CAT
system.\669\ Finally, the Plan Processor must develop a cyber-incident
response plan and document all information relevant to breaches.\670\
In addition to these policies and procedures requirements, the CAT NMS
Plan requires several forms of periodic review of CAT, including an
annual written assessment,\671\ regular reports,\672\ and an annual
audit.\673\ The Commission has proposed amendments to the CAT NMS Plan
that are designed to enhance the security of the CAT through increased
security requirements as well as limiting the scope of sensitive
information required to be collected by the CAT.\674\
---------------------------------------------------------------------------

    \666\ CAT NMS Plan, app. D sec. 4.1.
    \667\ Id. sec. 6.2(b)(v) and app. D secs. 4.1 to 4.2.
    \668\ Specifically, these safeguards must include: (1)
restrictions on the acceptable uses of CAT Data; (2) role-based
access controls; (3) authentication of individual users; (4)
multifactor authentication and password controls; (5) implementation
of information barriers to prevent unauthorized staff from accessing
CAT Data; (6) separate storage of sensitive personal information and
controls on transmission of data; (7) security-driven monitoring and
logging; (8) escalation of non-compliance or security events; and
(9) remote access controls. Id. at secs. 6.2(b)(v), 6.5(c)(i),
6.5(c)(iii) and (iv) and app. D secs. 4.1 to 4.1.4, 4.1.6, 8.1,
8.1.1, 8.1.3, 8.2, 8.2.2.
    \669\ Id. sec. 6.2(b)(vii).
    \670\ Id. app. D sec. 4.1.5.
    \671\ The Participants are required to provide the Commission
with an annual written assessment of the Plan Processor's
performance, which must include, among other things, an evaluation
of potential technology upgrades and an evaluation of the CAT
information security program. Id. secs. 6.2(a)(v)(G), 6.6(b).
    \672\ The Plan Processor is required to provide the operating
committee with regular reports on various topics, including data
security issues and the Plan Processor. Id. secs. 6.1(o),
6.2(b)(vi), 6.2(a)(v)(E), 6.2(b)(vi).
    \673\ The Plan Processor is required to create and implement an
annual audit plan that includes a review of all Plan Processor
policies, procedures, control structures, and tools that monitor and
address data security. Id. secs. 6.2(a)(v)(B) and (C), app. D secs.
4.1.3, 5.3.
    \674\ Proposed Amendments to the National Market System Plan
Governing the Consolidated Audit Trail to Enhance Data Security,
Release No. 89632 (Aug. 21, 2020), 85 FR 65990 (Oct. 16, 2020).
---------------------------------------------------------------------------

3. Current Market Practice
    This section describes current and new SCI entities' market
practices, as relevant to certain of the proposed and existing
provisions. These market practices include entities' compliance efforts
that exceed current regulatory baseline requirements, entities'
adherence to voluntary standards and best practices, and business
practices not directly related to compliance with a regulatory
obligation that nevertheless overlap with the substantive or procedural
requirements of the proposed rule. To the extent the entities' existing
practices already comply with the requirements or proposed requirements
of Regulation SCI, or to the extent those practices might facilitate
such compliance, the benefits and costs of the proposal could be
mitigated. The Commission requests comment on how the new and existing
SCI entities' current market practices affect the baseline against
which the economic effects are measured.
a. Systems Classification and Lifecycle Management
    Based on the experience of Commission most current SCI entities
undertake some form of lifecycle management program that includes
acquisition, integration, support, refresh and disposal of covered
systems, as applicable, and the sanitization of end-of-life systems.
b. Third-Party Vendor Management and Oversight
    Globally the end-user spending on public cloud services is
estimated to grow 20.4% in 2022 to a total of $494.7 billion, up from
$410.9 billion in 2021.\675\ In terms of market concentration, as of Q1
2022, the three largest CSPs collectively have the market share of 65
percent global spending on cloud computing \676\ and the eight largest
CSPs have roughly 80 percent of the market.\677\ SCI entities employ
cloud service providers. Some of the largest cloud service providers
appear to be familiar with the Regulation SCI requirements with which
SCI entities are obliged to comply.\678\
---------------------------------------------------------------------------

    \675\ See Press Release, Gartner.com (Apr. 19, 2020), available
at https://www.gartner.com/en/newsroom/press-releases/2022-04-19-gartner-forecasts-worldwide-public-cloud-end-user-spending-to-reach-nearly-500-billion-in-2022.
    \676\ See Synergy Research Group, Huge Cloud Market Still
Growing at 34% Per Year; Amazon, Microsoft & Google Now Account for
65% of the Total, PR Newswire (Apr. 28, 2022), available at https://
www.prnewswire.com/news-releases/huge-cloud-market-still-growing-at-
34-per-year-amazon-microsoft_google-now-account-for-65-of-the-
total-301535935.html (estimating as of Q1 2022 that the breakdown
is: Amazon Web Services (AWS): 33%; Microsoft Azure: 22%; Google
Cloud: 10%).
    \677\ Id.
    \678\ For example, see Microsoft Azure, Regulation Systems
Compliance and Integrity (SCI) Cloud Implementation Guide (2019),
available at https://azure.microsoft.com/mediahandler/files/resourcefiles/microsoft-azure-regulation-systems-compliance-and-integrity-sci-cloud-implementation-guide/AzureRegSCIGuidance.pdf; or
Google Cloud, U.S. Securities & Exchange Commission Regulation
Systems Compliance & Integrity (Regulation SCI) (Dec. 2021),
available at https://services.google.com/fh/files/misc/sec_regulation_sci_gcp_whitepaper.pdf.

---------------------------------------------------------------------------

    Both new and existing SCI entities may have existing agreements
with third-party providers that govern the obligations and expectations
as between an SCI entity and a third-party provider it utilizes. These
documents may not currently be consistent with the SCI entity's
requirements under the proposed amendments Regulation SCI. Some SCI
entities may currently rely on a third-party provider's standard
contract or SLA, which may not been drafted with Regulation SCI's
requirements in mind. Similarly, some existing agreements between the
SCI entity and a third-party provider may provide the third-party
provider with the contractual right to be able to make decisions that
would negatively impact an SCI entity's obligations in the third-party
provider's ``commercially reasonable discretion.'' Likewise, existing
agreements may include defined terms that differ from those under the
proposed amendments.
    Regardless of their size, SCI entities typically enter into
contracts with third-party providers to perform a specific function for
a given time frame at a set price. At the conclusion of a contract, it
may be renewed if both parties are satisfied. Because prices typically
increase over time, there may be some need to negotiate a new fee for
continued service. Negotiations also occur if additional services are
requested from a given third-party provider. In the instance where
additional services are required mid-contract, for example, due to
increased regulatory requirements, the third-party provider may be able
to separately bill for the extra work that it must incur to provide the
additional service, particularly if that party is in a highly
concentrated market for that service and can wield market power.
Alternatively, the service provider may be forced to absorb the
additional cost until the contract can be renegotiated. This may be the
case because that condition is specified in the contract with the SCI
entity.
Request for Comment
    95. The Commission requests that commenters provide relevant data
on the number of third-party providers available to SCI entities by
their types of services they offer or by the types of systems, such as
critical SCI systems, SCI systems, and indirect SCI systems.
    96. To what extent do third-party providers compete with each other
for SCI entities?
c. SCI Review
    With respect to business continuity and disaster recovery plan
reviews, FINRA Rule 4370 requires a broker-dealer to conduct an annual
review of its business continuity plan. FINRA has observed that some
broker-dealers \679\ engaged in annual testing to evaluate the
effectiveness of their business continuity plans.\680\ With respect to
broker-dealer reporting to their boards regarding cybersecurity
policies and procedures and cybersecurity incidents, the board
reporting frequency ranged from quarterly to ad-hoc among the firms
FINRA reviewed.\681\ Approximately two-thirds of the broker-dealers
(68%) examined in a 2015 survey had an individual explicitly assigned
as the firm's CISO which might suggest extensive executive leadership
engagement.
---------------------------------------------------------------------------

    \679\ FINRA did not disclose the number or identity of the firms
but it is likely that larger firms have more robust systems and
practices given their greater resources.
    \680\ See FINRA, 2019 Report on Examination Findings and
Observations: Business Continuity Plans (BCPs), supra note 600.
    \681\ See Report on Cybersecurity Practices, supra note 621. At
a number of firms, the board received annual cybersecurity-related
reporting while other firms report on a quarterly basis. A number of
firms also provide ad hoc reporting to the board in the event of
major cybersecurity events.
---------------------------------------------------------------------------

d. Current SCI Industry Standards
    As of 2015, the majority of broker-dealers reported utilizing one
or more frameworks with respect to cybersecurity \682\ either mapping
directly to the standard or using it as reference point. Some of the
standards such as COBIT may have broad application to various areas of
IT but it is unclear to what extent broker-dealers utilize such
standards beyond cybersecurity.
---------------------------------------------------------------------------

    \682\ See supra note 622. Among the firms that were part of the
FINRA sweep, nearly 90% used one or more of the NIST, ISO or ISACA
frameworks or standards. More specifically, 65% of the respondents
reported that they use the ISO 27001/27002 standard while 25% use
COBIT. Some firms use combinations of these standards for various
parts of their cybersecurity programs. The COBIT standard, for
example, is focused more on information technology governance than
cybersecurity per se. In addition, several firms underscored the
utility of the PCI Standard as well as the SANS Top 20.
---------------------------------------------------------------------------

    Also, each of the two exempt clearing agencies (Euroclear Bank SA/
NV, and Clearstream Banking, S.A.) publish disclosure framework
reports,\683\ that purport to describe the policies and procedures
relating to the 24 principles and five responsibilities set forth in
the Principles for Financial Market Infrastructures (PFMI) published by
CPSS and IOSCO.\684\ The PFMI establishes new international standards
for financial market infrastructures (FMIs) including payment systems
that are systemically important, central securities depositories,
securities settlement systems, central counterparties and trade
repositories and prescribes the form and content of the disclosures
expected of financial market infrastructures. Most relevant, principle
17 on operational risk offers guidelines on policies and procedures to
identify, monitor, and manage operational risks, vulnerabilities, and
threats; capacity planning; stress testing; systems development and
testing methodology; business continuity and disaster recovery planning
and testing; vendor risk management; and board supervision of risk
management, etc.
---------------------------------------------------------------------------

    \683\ Clearstream, Principles for financial market
infrastructures: Disclosure Framework (Dec. 23, 2020), available at
https://www.clearstream.com/resource/blob/1386778/3458c1c468e5f40ddf5dc970e8da4af2/cpmi-iosco-data.pdf; Euroclear
Bank, Disclosure Framework CPMI IOSCO 2020 (June 2020), available at
https://www.euroclear.com/content/dam/euroclear/About/business/PA005-Euroclear-Bank-Disclosure-Framework-Report.pdf.
    \684\ Bank for International Settlements (BIS), Principles for
Financial Market Infrastructures: Disclosure Framework and
Assessment Methodology (Dec. 2012), available at https://www.bis.org/cpmi/publ/d106.pdf.
---------------------------------------------------------------------------

e. Penetration Testing
    Current SCI entities are required to conduct penetration testing as
part of its SCI review \685\ once every three years.\686\ Among the new
SCI entities, two SBSDRs that are currently registered as SDRs are
subject to CFTC's rules, which require conducting penetration testing
of the systems with the scope of those rules at least once every year.
---------------------------------------------------------------------------

    \685\ Specifically, paragraph (b)(1) of Rule 1003 currently
requires that ``[p]enetration test reviews of the network,
firewalls, and production systems shall be conducted at a frequency
of not less than once every three years. . .''. Rule 1003(b)(1).
    \686\ See SCI Adopting Release, supra note 1, at 72344.
---------------------------------------------------------------------------

4. Other Affected Parties
    In addition to new and existing SCI entities, the proposed
amendments may indirectly affect other parties, namely third-party
service providers to which SCI systems functionality is outsourced. As
discussed in depth above, an SCI entity may decide to outsource certain
functionality to, or utilize the support or services of, a third-party
provider (which would include both affiliated providers as well as
vendors unaffiliated with the SCI entity) for a variety of reasons,
including cost efficiencies,

increased automation, particular expertise, or functionality that the
SCI entity does not have in-house. Based on Commission staff
experience, the Commission believes that these third-party providers,
play a growing role with respect to SCI systems and indirect SCI
systems, and the Commission anticipates that third-party providers will
likely arise to provide other types of functionality, service, or
support to SCI entities that are not contemplated yet today.\687\
---------------------------------------------------------------------------

    \687\ It has long been recognized that the financial services
industry is increasingly relying on service providers through
various forms of outsourcing. See, e.g., Bank for International
Settlements, Outsourcing in Financial Services (Feb. 15, 2005),
available at https://www.bis.org/publ/joint12.htm. Recent estimates
suggest that the aggregate contract value of outsourcing in the
financial services industry is on the order of $10 to $20 billion.
See, e.g., Business Wire, Insights on the Finance and Accounting
Outsourcing Global Market to 2026 (Jan. 14, 2022), available at
https://www.businesswire.com/news/home/20220114005440/en/Insights-
on-the-Finance-and-Accounting-Outsourcing-Global-Market-to-2026_-
Featuring-Accenture-Capgemini-and-Genpact-Among-Others_-
ResearchAndMarkets.com.
---------------------------------------------------------------------------

    Due to data limitations, we are unable to quantify or characterize
in much detail the structure of these various service provider
markets.\688\ The Commission lacks specific information on the exact
extent to which third-party service providers are retained, the
specific services they provide, and the costs for those services beyond
the estimates discussed above for cloud service providers. We also do
not have information about the market for these services, including the
competitiveness of such markets. We request information from commenters
on the services related to SCI systems and indirect systems provided by
third parties to new and existing SCI entities, the costs for those
services, and the nature of the market for these services.
---------------------------------------------------------------------------

    \688\ Although certain regulatory filings may shed a limited
light on the use of third-party service providers, we are unaware of
any data sources that provide detail on the overall picture for each
of the new and existing SCI entities.
---------------------------------------------------------------------------

C. Analysis of Benefits and Costs of Proposed Amendments

    The proposed amendments both expand the scope of Regulation SCI to
reach new entities and also strengthen existing requirements in
Regulation SCI that would apply to both old and new entities. This
section explores the benefits and costs of these changes. First, we
discuss the general benefits and costs of the proposed amendments to
Regulation SCI. Next, we discuss the expansion of Regulation SCI to
certain new SCI entities and the rationale for it. Finally, we analyze
the specific benefits and costs of applying each provision of amended
Regulation SCI to each of the proposed new SCI entities and current SCI
entities.\689\ The Commission encourages commenters to identify,
discuss, analyze, and supply relevant data, information, or statistics
regarding the benefits and costs.
---------------------------------------------------------------------------

    \689\ For purposes of measuring the benefits and costs of the
proposed rule on both existing and new SCI entities, this analysis
assumes that market participants are compliant with existing
applicable Commission, FINRA, CFTC, and other applicable rules,
including those requiring registration and the rules and regulations
applicable to such registered entities. To the extent that some
entities engaged in activities including crypto asset securities are
not, but should be, FINRA or Commission registered entities, they
may incur additional costs to comply with existing registration
obligations that are distinct from the costs associated with the
proposed rule amendments and are not discussed in this analysis.
Similarly, any benefits from coming into compliance with existing
registration obligations are also not discussed in this analysis.
For such entities, we expect the benefits and costs specifically
associated with the proposed rule amendments to be same as those
described below for existing and new SCI entities that are currently
registered.
---------------------------------------------------------------------------

    The Commission is providing both a qualitative assessment and
quantified estimates, including ranges, of the potential economic
effects of the proposal where feasible. The overall magnitude of the
economic effects will depend, in part, on the extent to which the new
and current SCI entities already have in place practices that are
aligned with the requirements of Regulation SCI, including the proposed
amendments. New SCI entities' costs of implementing Regulation SCI
could also differ with the number and size of their systems affected.
    In many cases it is difficult to quantify the economic effects,
particularly those beyond the costs estimated in the Paperwork
Reduction Act analysis. As explained in more detail below, the
Commission in certain cases does not have, and does not believe it can
reasonably obtain, data or information necessary to quantify certain
effects. For instance, the Commission finds it impracticable to
quantify many of the benefits associated with amended Regulation SCI.
Indeed, we lack information that would allow us to predict the
reduction in frequency and severity of SCI events or the specific cost
savings that might arise from avoiding the harm Regulation SCI is
designed to prevent. Further, even in cases where the Commission has
some data, quantification is not practicable due to the number and type
of assumptions necessary to quantify certain economic effects, which
render any such quantification unreliable. The Commission requests that
commenters provide relevant data and information to assist the
Commission in quantifying the economic consequences of proposed
amendments to Regulation SCI.
1. General Benefits and Costs of Proposed Amendments
    Regulation SCI promotes the capacity, integrity, resiliency,
availability, and security of SCI systems, as well as transparency
about systems problems when they do occur, and thereby promote
investors' confidence in market transactions. SCI events can today have
broad impacts because of the growth of electronic trading, which allows
increased volumes of securities transactions in a broader range of
asset classes, at increasing speed, by a variety of trading platforms;
\690\ changes in the way SCI entities employ technology, including the
increasing importance of third-party service providers to ensure
reliable, resilient, and secure systems; \691\ a significant increase
in cybersecurity events across all types of companies, including SCI
entities; \692\ and an evolution of the threat environment.\693\ A
joint report from the World Economic Form and Deloitte states that
``new interconnections and collective dependencies on certain critical
providers significantly contribute to the number of vulnerable nodes
that could threaten and exploit the financial system's essential
functions.'' \694\
---------------------------------------------------------------------------

    \690\ See section I and supra note 3.
    \691\ See sections III.B, III.B.2.a.
    \692\ See section III.B.3.
    \693\ See id.
    \694\ See World Economic Forum, Beneath the Surface: Technology-
Driven Systemic Risks and the Continued Need for Innovation (Oct.
28, 2021) at 14, available at https://www.weforum.org/reports/beneath-the-surface-technology-driven-systemic-risks-and-the-continued-need-for-innovation/; see also Henning Soller, et al.,
Innovative Technologies in Financial Institutions: Risk as a
Strategic Issue, McKinsey Digital (Sep. 25, 2020), available at:
https://www.mckinsey.com/business-functions/mckinsey-digital/our-insights/tech-forward/innovative-technologies-in-financial-institutions-risk-as-a-strategic-issue.
---------------------------------------------------------------------------

    Expanding Regulation SCI to new SCI entities will help to ensure
that the core technology systems of these newly designated SCI entities
are robust, resilient, and secure--especially for those entities that
have not already adopted comparable measures on their own--and would
also help to improve Commission oversight of the core technology of key
entities in the U.S. securities markets.\695\
---------------------------------------------------------------------------

    \695\ For example, some expert views suggest that current SCI
entities' compliance with Regulation SCI likely prepared those
entities to be more resilient and more prepared to face times of
increased volatility--beyond what their prudent business practices
may have allowed. For example, one industry publication notes that
even as financial firms ``updated their [business continuity
planning] after the Sept. 11, 2001, terrorist attacks and superstorm
Hurricane Sandy in 2012, when these events exposed cracks in Wall
Street's contingency plans,'' they were still ``more prepared during
COVID-19 thanks to Regulation SCI for Systems, Compliance and
Integrity.'' See, e.g., Is Remote Trading Leading to a Paradigm
Shift on the Trading Desk?, supra note 2. Similarly, a senior
executive at FINRA stated in an interview that he found most
surprising the resiliency of the market during COVID-19 and said ``a
lot of credit goes to the SEC for [the market's resiliency] with
respect to adopting [Regulation SCI].'' FINRA, Podcast: Market
Structure & COVID-19: Handling Increased Volatility and Volumes, at
24:38-25:08 (Apr. 28, 2020), available at https://www.finra.org/media-center/finra-unscripted/market-structure-covid19-coronavirus
(featuring an interview with FINRA's then-Executive VP of Market
Regulation and Transparency Services, Tom Gira).

---------------------------------------------------------------------------

    The Commission is also proposing amendments to update Regulation
SCI in order to strengthen its requirements. These amendments would
benefit markets and market participants by reducing the likelihood,
severity, and duration of market disruptions arising from systems
issues, among both current and new SCI entities, whether such events
may originate from natural disasters, third-party provider service
outages, cybersecurity events, hardware or software malfunctions, or
any other sources.\696\ Decreasing the number of trading interruptions
can improve price discovery and liquidity because such interruptions
interfere with the process through which relevant information gets
incorporated into security prices and, may thereby, temporarily disrupt
liquidity flows.\697\ Trading interruptions in one security can also
affect securities trading in other markets. For example, an
interruption in the market for index options and other securities that
underlie derivatives securities could harm the price discovery process
for derivatives securities, and liquidity flows between the stock
market and derivatives markets could be restricted. For this reason,
market-based incentives alone are unlikely to result in optimal
provision of SCI-related services. In this context, having plans and
procedures in place to prepare for and respond to system issues is
beneficial,\698\ and the proposed amendments to Regulation SCI would
help ensure that the infrastructure of the U.S. securities markets
remains robust, resilient, and secure. A well-functioning financial
system is a public good.
---------------------------------------------------------------------------

    \696\ For example, the Ponemon Institute's 2016 Cost of Data
Center Outages report estimates the average cost per minute of an
unplanned outage was $8,851 for the average data center the
Institute surveyed in 2016. See Ponemon Institute, 2016 Cost of Data
Center Outages 14 (Jan. 19, 2016) available at https://www.vertiv.com/globalassets/documents/reports/2016-cost-of-data-center-outages-11-11_51190_1.pdf. Also, although it is difficult to
estimate the total cost of a cyberattack at an SCI entity, a
potential effect of a cyberattack involving an SCI entity is a data
breach. According to the IBM's 2022 Cost of a Data Breach report,
the average cost of a data breach in the United States is $9.44
million, and the report added that ``[f]or 83% of companies, it's
not if a data breach will happen, but when. Usually more than
once.'' See IBM, 2022 Cost of a Data Breach, available at https://
www.ibm.com/reports/data-
breach#:~:text=Average%20cost%20of%20a%20data,million%20in%20the%2020
20%20report. Relatedly, another study reports that in 2020 the
average loss in the financial services industry was $18.3 million
per company per incident. The average cost of a financial services
data breach was $5.85 million. See Jennifer Rose Hale, The Soaring
Risks of Financial Services Cybercrime: By the Numbers, Diligent
(Apr. 9, 2021), available at https://www.diligent.com/insights/financial-services/cybersecurity/#.
    \697\ See Osipovich, Alexander, NYSE Glitch Causes Erroneous
Prices in Hundreds of Stocks, Wall St. J. (online edition) (Jan. 24,
2023), available at https://www.wsj.com/articles/dozens-of-nyse-stocks-halted-in-opening-minutes-after-wild-price-swings-11674585962
(retrieved from Factiva database).
    \698\ For example, according to the IBM Report, in the context
of system issues arising from cybersecurity events, having an
incident response plan and ``testing that plan regularly can help
[each firm] proactively identify weaknesses in [its] cybersecurity
and shore up [its] defenses'' and ``save millions in data breach
costs.'' See 2022 Cost of a Data Breach, supra note 696. See also
Alex Asen et al., Are You Spending Enough on Cybersecurity (Feb. 19,
2020), available at https://www.bcg.com/publications/2019/are-you-spending-enough-cybersecurity (noting ``[a]s the world becomes ever
more reliant on technology, and as cybercriminals refine and
intensify their attacks, organizations will need to spend more on
cybersecurity'').
---------------------------------------------------------------------------

    The Commission recognizes that the proposed amendments to
Regulation SCI would impose costs on SCI entities, as well as costs on
certain members, participants, customers (in the case of SCI broker-
dealers), or third-party providers of SCI entities. The majority of
these costs would be direct compliance costs, which are discussed in
detail below for each requirement of proposed Regulation SCI. For
current SCI entities, these costs would relate to the areas of
Regulation SCI that are being amended. For new SCI entities, the costs
would relate to complying with the entirety of Regulation SCI,
including the proposed amendments. For current SCI entities, these
costs may be mitigated to the extent the SCI entity's current business
practices are already consistent with the proposed requirements, and
if, as a result of compliance, the SCI entity avoids the costs
associated with a systems failure or breach. Likewise, for new SCI
entities, these costs may be mitigated to the extent the SCI entity's
current business practices are already consistent with the requirements
of Regulation SCI, including the proposed amendments, and if, as a
result of compliance, the SCI entity avoids the costs associated with a
systems failure or breach.
    Some portion of compliance costs could be economic transfers. This
may be the case if compliance with a particular provision entails
making use of certain third-party providers, and the market for third-
party provider services is not itself competitive.\699\ In such a case,
third-party providers would make economic profits from the services
they offer and the fees they charge, and some of the services fees
charged would be economic transfers from SCI entities to third-party
providers.
---------------------------------------------------------------------------

    \699\ See, e.g., Yoon-Ho Alex Lee, SEC Rules, Stakeholder
Interests, and Cost-Benefit Analysis, 10 Mkts L.J. 311 (2015),
available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2541805 (retrieved from SSRN Elsevier
database; Yoon-Ho Alex Lee, The Efficiency Criterion of Securities
Regulation: Investor Welfare or Total Surplus?, 57 Ariz. L. Rev. 85
(2015), available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2406032 (retrieved from SSRN Elsevier
database.
---------------------------------------------------------------------------

    The proposed amendments could have other potential costs. For
example, entities covered by the proposed rule frequently would need to
make systems changes to comply with new and amended rules and
regulations under Federal securities laws and SRO rules. For entities
that meet the definition of SCI entity, because they would need to
comply with the proposed amendments when they make systems changes, the
proposed amendments could increase the costs and time needed to make
systems changes to comply with new and amended rules and regulations.
The Commission requests comment on the nature of such additional costs
and time.
Request for Comment
    The Commission requests comment on all aspects of the Overall
Benefits and Costs of Proposed Amendments discussion. In addition, the
Commission is requesting comment on the following specific aspects of
the discussion:
    97. For new SCI entities, what activities do you currently perform
(either because you are required to or you have chosen to voluntarily)
that are already consistent with the requirements of Regulation SCI?
    98. For new SCI entities and current SCI entities, can compliance
with Regulation SCI result in the benefits the Commission describes in
the analysis?
    99. Are commenters aware of any data that can be used to quantify
any aspects of benefits?
    100. The Commission seeks commenters' views regarding the
prospective costs, as well as the potential benefits, of applying
Regulation SCI to SBSDRs. Are there characteristics specific to SBSDRS
or the SBS market that would make applying Regulation SCI broadly or
any specific provision or proposed new provision Regulation SCI
challenging for

SBSDRs? How much time would an SBSDR reasonably need to come into
compliance with Regulation as proposed? Commenters should quantify the
costs of applying Regulation SCI to SBSDRs, to the extent possible.
Commenters are urged to address specifically each requirement of
Regulation SCI and note whether it would be reasonable to apply each
such requirement to SBSDRs and what the benefits and costs of such
application would be.
    101. For current SCI entities, what activities do you currently
perform that are already consistent with the proposed amendments that
seek to strengthen the obligations of SCI entities?
    102. Are the Commission's estimates of incremental compliance costs
owing to these proposed reasonable? Please note that the Commission
does not purport to estimate the total costs of all activities SCI
entities will perform in promoting the capacity, integrity, resiliency,
availability, and security of their automated systems. The Commission's
estimates pertain only to the increase in costs that will arise
directly as a result of having to comply with the specific provisions
of the proposed rules to the extent the covered entity has not already
been performing such activities on its own or pursuant to other
relevant rules or regulations.
    103. What activities do you currently perform that go beyond the
proposed amendments to Regulation SCI?
    104. For current SCI entities, will compliance with the proposed
amendments to Regulation SCI result in performing activities that go
significantly above and beyond their current approach to promoting the
capacity, integrity, resiliency, availability, and security of their
automated systems? In other words, will these new rules require a
significant rearranging of their resources beyond what they are already
complying with voluntarily?
    105. What are the costs of Regulation SCI? Are commenters aware of
any data that can be used to quantify any aspects of costs?
2. Expansion to New SCI Entities
    The Commission proposes to expand the definition of SCI entity to
encompass SBSDRs, certain broker-dealers, and additional clearing
agencies exempted from registration. These entities are key market
participants that play a significant role in the U.S. securities
markets and, in the event of a systems issues, they have the potential
to impact investors, the overall market, or the trading of individual
securities. Under the proposed amendments, the new SCI entities would
become subject to all provisions of Regulation SCI, including the
provisions that the Commission proposes to amend for SCI entities, as
discussed in section III.C of this release. We discuss in this section
the entities to which Regulation SCI would be extended, including the
rationale for doing so. The benefits and costs associated with applying
each of the Regulation SCI requirements to these entities are
subsequently discussed in section V.D.3.
    The Commission preliminarily estimates that as a result of the
proposed amendments to the definition of ``SCI entity'' in Rule 1000,
there would be a total of 21 new SCI entities that would become subject
to the requirements of Regulation SCI. These include 2 SBSDRs, 17 SCI
broker-dealers, and 2 exempt clearing agencies.\700\ Generally,
inclusion of these new SCI entities in the amended definition is
expected to help ensure systems resiliency at such entities and reduce
the potential for incidents at these entities to have broad, disruptive
effects across the securities markets and for investors. Furthermore,
applying Regulation SCI to these entities increases market protections
by establishing these obligations under the Exchange Act so that the
Commission may enforce them directly and examine for compliance and
provides a uniform requirement for all SCI entities.
---------------------------------------------------------------------------

    \700\ The Commission is estimating 23 new SCI entities in the
PRA section based on the PRA's forward-looking requirement to
account for persons to whom a collection of information is addressed
by the agency within any 12-month period. But for purposes of the
Economic Analysis, this section analyzes the baseline of existing
entities that will be new SCI entities and then predicts the cost to
those entities if the rule were to be adopted. Accordingly the
Economic Analysis assumes 21, rather than 23, new SCI entities.
---------------------------------------------------------------------------

a. SBSDRs
    Currently, two SBSDRs are registered with the Commission and are
subject to Rule 13n-6. The SBSDRs registered with the Commission are
also registered with the CFTC as swap data repositories (SDRs) and
accordingly, with respect to systems of concern to the CFTC, are
subject to CFTC rules and regulations related to swap data
repositories, including the CFTC's System Safeguards rule.
    Systems failures at SBSDRs can limit access to data, call into
question the integrity of data, and prevent market participants from
being able to report transaction data, and receive transaction data,
and thereby have a large impact on market confidence, risk exposure,
and market efficiency. For example, were an SBSDR to experience a
systems issue, market participants could be prevented from receiving
timely information regarding accurate prices for individual SBSs--such
as aggregate market exposures to referenced entities (instruments),
positions taken by individual entities or groups, and data elements
necessary for a person to determine the market value of the
transaction.\701\ This could contribute to market instability.
---------------------------------------------------------------------------

    \701\ See Access to Data Obtained by Security-Based Swap Data
Repositories, Securities Exchange Act Release No. 78716 (Aug. 29,
2016), 81 FR 60585, 60594, 60605-6 (Sep. 2, 2016). In that release,
the Commission estimates that approximately 300 relevant authorities
may make requests for data from security-based swap data
repositories.
---------------------------------------------------------------------------

    Having SBSDRs comply with Regulation SCI would reduce the risk of
system issues at SBSDRs and allow continued transparency and access to
data. As noted above in the baseline, SBSDRs are currently subject to
Rule 13n-6, which requires an SBSDR to ``establish, maintain, and
enforce written policies and procedures reasonably designed to ensure
that its systems provide adequate levels of capacity, integrity,
resiliency, availability, and security.'' However, as described in
detail below, the requirements of Regulation SCI that go beyond those
required in Rule 13n-6--such as policies and procedures that include
specific elements for infrastructure planning, up-to-date system
development and testing methodology, regular systems reviews and
testing, BC/DR planning, monitoring for SCI events, and standards to
facilitate successful collection, processing, and dissemination of
market data--should deliver benefits beyond those currently achieved
through Rule 13n-6.
    The coverage of SBSDRs under the proposed amendments to Regulation
SCI would augment the current principles-based requirements for
policies and procedures on operational risk with detailed, more
specific requirements to help ensure that SBSDR market systems are
robust, resilient, and secure and that policies and procedures in place
at SBSDRs meet requirements necessary to maintain the robustness of
critical systems.
b. SCI Broker-Dealers
    The Commission proposes to include certain broker-dealers--to be
referred to as ``SCI broker-dealers''--in the definition of SCI entity.
This expansion would be limited to broker-dealers that exceed one or
more size thresholds. The first proposed threshold is a total assets
test. This test scopes within Regulation SCI any broker-dealers with
five percent

(5%) or more of the total assets \702\ of all security brokers and
dealers during at least two of the four preceding calendar quarters
ending March 31, June 30, September 30, and December 31. The second
proposed threshold is a transaction activity test. This test scopes
within Regulation SCI any broker-dealer that transacted ten percent
(10%) or more of the total average daily dollar volume by applicable
reporting entities during at least four of the preceding six calendar
months in any of the following asset classes: NMS stocks, exchange-
listed options contracts, Agency Securities, or U.S. Treasury
Securities.
---------------------------------------------------------------------------

    \702\ See supra note 169.
---------------------------------------------------------------------------

    The Commission proposes to limit the definition of ``SCI systems''
for an SCI broker-dealer that qualifies as an SCI entity that satisfies
only one or more transaction activity thresholds.\703\ Specifically,
only those systems that relate to the asset class for which the trading
activity threshold is met (i.e., NMS stocks, exchange-listed options
contracts, Treasury Securities, or Agency Securities) would be ``SCI
systems'' or ``indirect SCI systems.'' \704\ Broker-dealers may have
multiple business lines and transact in different types of securities,
and the proposal reflects the Commission's preliminary conclusion that
systems related to asset classes that do not meet the rule's
transaction activity threshold are unlikely to pose risk to the
maintenance of fair and orderly markets if the systems with respect to
that type of security were unavailable (assuming the systems for the
distinct asset class are separate) relative to the burden of complying
with the regulation's more stringent requirements.
---------------------------------------------------------------------------

    \703\ See section III.A.2.b(iv).
    \704\ See section III.A.2.b(iv). As explained above in section
III.A.2.b.v, although crypto asset securities are not a separately
enumerated asset class for the volume threshold, the SCI systems and
indirect SCI systems pertaining to crypto asset securities that are
NMS stocks, exchange-listed options, U.S. Treasury Securities, or
Agency securities would be subject to Regulation SCI, including as
it is proposed to be amended, as discussed in section III. C, with
respect to the asset class for which the SCI broker-dealer satisfies
the threshold.
---------------------------------------------------------------------------

    In contrast, no such limitation applies to an SCI broker-dealer
that qualifies as an SCI entity because it satisfies the total assets
threshold. In this case, broker-dealers that qualify as SCI entities
due to the total assets threshold are subject to Regulation SCI
requirements for all of its applicable systems, regardless of the asset
classes such systems relate to.\705\ As discussed in section
III.A.2.b.iii, this approach with respect to the total assets threshold
takes into consideration the multiple roles that the largest broker-
dealers play in the U.S. securities markets. Not only do some of the
largest broker-dealers generate liquidity in multiple types of
securities, but many also operate multiple types of trading platforms.
Entities with assets at this level also take risks that they may seek
to hedge across asset classes, in some cases using ``central risk
books'' for that and other purposes, and engage in routing substantial
order flow to other trading venues. For these reasons, the Commission
believes that systems issues at firms having assets at this level could
have the potential to impact investors, the overall market, and the
trading of individual securities, following a systems failure in any
market in which they operate.
---------------------------------------------------------------------------

    \705\ As explained above, any system of an SCI broker-dealer
meeting the total asset threshold that pertains to any type of
security, including crypto asset securities, that meets the
definition of SCI systems or indirect SCI systems would be covered
by Regulation SCI.
---------------------------------------------------------------------------

    The Commission estimates that there would be 17 SCI broker-dealers,
five of which would satisfy both the total assets threshold and at
least one of the transaction activity thresholds, and twelve others of
which would satisfy at least one of the transaction activity
thresholds.\706\ As discussed in section V.B.1.b.i, figure 6 (Panel A)
shows the distribution of all registered broker-dealer firms between Q4
2021 and Q3 2022 by level of total assets. Figure 6 (Panel B)
represents the distribution of all registered broker-dealer firms by
percentage of aggregate total assets.\707\ It shows that five firms
accounted for roughly half of broker-dealer aggregate total assets and
thus each could pose a substantial risk to the maintenance of fair and
orderly markets in the event of a systems issue. During all four
quarters from Q4 2021 to Q3 2022, all five firms reported to the
Commission, on Form X-17A-5 (Sec.  249.617), total assets in an amount
that equals five percent (5%) or more of the total assets of all
security brokers and dealers.\708\ Figures 7 through 10 represent the
distribution by level of transaction activity as measured by average
daily dollar volume \709\ (Panel A) and the distribution of firms by
percentage of transaction activity \710\ (Panel B) for each of four
asset classes including NMS stocks, exchange-listed options, U.S.
Treasury Securities, and Agency Securities respectively.\711\ These
figures clearly show that a few firms consistently accounted for a
significant percentage of transaction activity over the six month
period and thus each could pose a substantial risk to the maintenance
of fair and orderly markets in the event of a systems issue. During at
least four months of the six month period, six NMS stocks trading
firms, six exchange-listed options contracts trading firms, four U.S.
Treasury Securities trading firms, and six Agency Securities trading
firms transacted average daily dollar volume in an amount that equals
ten percent (10%) or more of the total average daily dollar of the
corresponding markets. Most of these firms transacted more than ten
percent (10%) during all six months.\712\
---------------------------------------------------------------------------

    \706\ See section III.A.2.b(iv).
    \707\ Panel A and Panel B in figure 6 show the same information
as in figure 1 in section V.B.1.b.i., but with 5% threshold lines
added. The threshold line in Panel A shows the average of 5% of
aggregate total assets in each quarter from Q4 2021 to Q3 2022.
    \708\ Each of these firms would satisfy the proposed total
assets thresholds for an ``SCI broker-dealer''. See section
III.A.2.b.iii (discussing proposed thresholds for an ``SCI broker-
dealer'').
    \709\ These measures are described in more detail in section
III.A.2.b.iii.
    \710\ Id.
    \711\ Panel A and Panel B in figures 7 through 10 show the same
information as in figures 2 through 5 in section V.B.1.b.i., but
with 10% threshold lines added. The threshold line in each Panel A
shows the average of 10% of aggregate average daily dollar volume
reported to the plan processors (SIPs) of the CTA/CQ Plans and
Nasdaq UTP Plan, OPRA Plan, or FINRA TRACE in each respective asset
class from Jan. 2022 to June 2022. The threshold line in each Panel
B equals 10%.
    \712\ Each of these firms would satisfy the proposed transaction
activity thresholds for an ``SCI broker-dealer''. See section
III.A.2.b.iii (discussing proposed thresholds for an ``SCI broker-
dealer'').
---------------------------------------------------------------------------

    These large broker-dealers, by virtue of the total assets or
transaction activity each represents over a period of time, play a
significant role in the orderly functioning of U.S. securities markets.
If such a broker-dealer was adversely affected by a system issue, then
the impact could not only affect the broker-dealer's own customers, but
also disrupt the overall market, by compromising or removing
significant liquidity from the market, interrupting the price discovery
process, or indirectly contributing to capacity issues at other broker-
dealers.\713\
---------------------------------------------------------------------------

    \713\ See section III.A.2.b(iv).
---------------------------------------------------------------------------

    Application of Regulation SCI is expected to reduce the likelihood
of system issues at these largest broker-dealers as well as mitigate
the effects of any such event. While it is possible that these broker-
dealers may have systems in place due to market-based incentives, there
are reasons to believe that these incentives may be insufficient.
First, as mentioned in section V.C.1, a well-functioning financial
system is a public good.\714\ Second, investment in SCI

systems takes the form of a hidden-action problem. As such, due to
principal-agent conflict, it may not be possible for customers or
counterparties to observe the degree of investment in SCI systems and
thus to provide market-based discipline from underinvestment. In this
case, a broker-dealer's investment in SCI systems would offer benefits
to customers and counterparties who might incur switching costs to find
a different broker if a substantial systems issue occurred. These
benefits are likely to be especially high for market participants who
rely on a single counterparty (such as is sometimes the case in
Treasury securities and prime brokerage relationships), and for retail
investors who have invested in the relationship with a single retail
broker.
---------------------------------------------------------------------------

    \714\ Since broker-dealers are not compensated for the positive
impact that their systems investments have on other entities, they
lack sufficient incentives to invest on others' behalf. See, for
instance, Mazaher Kianpour et al., Advancing the concept of
cybersecurity as a public good, 116 Simulation Modeling Practice and
Theory 102493 (2022).
---------------------------------------------------------------------------

BILLING CODE 8011-01-P
[GRAPHIC] [TIFF OMITTED] TP14AP23.005

[GRAPHIC] [TIFF OMITTED] TP14AP23.006

[GRAPHIC] [TIFF OMITTED] TP14AP23.007

[GRAPHIC] [TIFF OMITTED] TP14AP23.008

[GRAPHIC] [TIFF OMITTED] TP14AP23.009

BILLING CODE 8011-01-C
c. Additional Exempt Clearing Agencies
    The proposed amendments would expand the scope of exempt clearing
agencies covered by Regulation SCI to include two new exempt clearing
agencies: Euroclear Bank SA/NV and Clearstream Banking, S.A. These
exempt clearing agencies are not currently subject to Regulation SCI
because Regulation SCI was initially limited to those exempt clearing
agencies that were ``subject to ARP'' and these exempt clearing
agencies are not subject to ARP. At the time it adopted Regulation SCI,
the Commission stated it was taking a measured approach in applying
requirements primarily to entities already covered under the ARP
Inspection Program.\715\
---------------------------------------------------------------------------

    \715\ SCI Adopting Release, supra note 1, at 72259.
---------------------------------------------------------------------------

    The exempt clearing agencies not subject to ARP that the Commission
proposes to scope into Regulation SCI provide CSD functions for
transactions in U.S. securities between U.S. and non-U.S. persons using
similar technologies as registered clearing agencies that are subject
to Regulation SCI.\716\ The technology systems that underpin operations
of these exempt clearing agencies are critical systems that centralize
and automate clearance and settlement functions for the global
financial markets.\717\ Such systems concentrate risk in the clearing
agency.\718\ A disruption to a clearing agency's operations, or failure
on the part of a clearing agency to meet its obligations, could
therefore serve as a source of contagion, resulting in significant
costs not only to the clearing agency itself and its participants but
also to other market participants across the U.S. financial
system.\719\ For example, an SCI event could cause a delay or
disruption in the settlement process with respect to certain
securities, leading to a decrease in liquidity. Trading firms could be
unwilling or unable to enter into new positions should prior trades
suffer settlement timing delays requiring posting of additional margin
at clearing agencies and the assumption of additional risk by trading
firms.
---------------------------------------------------------------------------

    \716\ See section III.A.2.c.
    \717\ See section III.A.2.c.
    \718\ See generally Albert J. Menkveld & Guillaume Vuillemey,
The Economics of Central Clearing, 13 Ann. Rev. Fin. Econ. 153
(2021), available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3957021 (retrieved from SSRN Elsevier
database). See also Paolo Saguato, Financial Regulation, Corporate
Governance, and the Hidden Costs of Clearinghouses, 82 Ohio St. L.J.
1071, 1074-75 (2022), available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3269060 (retrieved from SSRN Elsevier
database) (``[T]he decision to centralize risk in clearinghouses
made them critical for the stability of the financial system, to the
point that they are considered not only too-big-to-fail, but also
too-important-to-fail institutions.'').
    \719\ See generally Dietrich Domanski, et al., Central Clearing:
Trends and Current Issues, BIS Q. Rev. (Dec. 2015), available at
https://www.bis.org/publ/qtrpdf/r_qt1512g.pdf (describing links
between CCP financial risk management and systemic risk); Darrell
Duffie, et al., Policy Perspectives on OTC Derivatives Market
Infrastructure, Fed. Res. Bank N.Y. Staff Rep. No. 424, at 9 (Mar.
2010), available at https://ssrn.com/abstract=1534729 (retrieved
from SSRN Elsevier database) (``If a CCP is successful in clearing a
large quantity of derivatives trades, the CCP is itself a
systemically important financial institution. The failure of a CCP
could suddenly expose many major market participants to losses. Any
such failure, moreover, is likely to have been triggered by the
failure of one or more large clearing agency participants, and
therefore to occur during a period of extreme market fragility.'');
Craig Pirrong, The Inefficiency of Clearing Mandates, Policy
Analysis No. 655, at 11-14, 16-17, 24-26 (July 2010), available at
https://www.cato.org/pubs/pas/PA665.pdf (stating, among other
things, that ``CCPs are concentrated points of potential failure
that can create their own systemic risks,'' that ``[a]t most,
creation of CCPs changes the topology of the network of connections
among firms, but it does not eliminate these connections,'' that
clearing may lead speculators and hedgers to take larger positions,
that a CCP's failure to effectively price counterparty risks may
lead to moral hazard and adverse selection problems, that the main
effect of clearing would be to ``redistribute losses consequent to a
bankruptcy or run,'' and that clearing entities have failed or come
under stress in the past, including in connection with the 1987
market break); Glenn Hubbard et al., Report of the Task Force on
Financial Stability 96, Brookings Inst.(June 2021), available at
https://www.brookings.edu/wp-content/uploads/2021/06/financial-stability_report.pdf (``In short, the systemic consequences from a
failure of a major CCP, or worse, multiple CCPs, would be severe.
Pervasive reforms of derivatives markets following 2008 are, in
effect, unfinished business; the systemic risk of CCPs has been
exacerbated and left unaddressed.''); Froukelien Wendt, Central
Counterparties: Addressing their Too Important to Fail Nature (IMF
Working Paper No. 15/21, Jan. 2015), available at https://www.imf.org/external/pubs/ft/wp/2015/wp1521.pdf (assessing the
potential channels for contagion arising from CCP
interconnectedness); Manmohan Singh, Making OTC Derivatives Safe--A
Fresh Look (IMF Working Paper No. 11/66, Mar. 2011), at 5-11,
available at https://www.imf.org/external/pubs/ft/wp/2011/wp1166.pdf
(retrieved from SSRN Elsevier database) (addressing factors that
could lead central counterparties to be ``risk nodes'' that may
threaten systemic disruption).
---------------------------------------------------------------------------

    Notably, Euroclear Bank SA/NV and Clearstream Banking, S.A. are
already subject to Europe's CSDR, which has Operational Risk rules
(Article 45) that includes many requirements that may align with those
in Regulation SCI.\720\ Additionally, the Commission exemptive order
for one of the exempt clearing agencies requires certain provisions
that are consistent with those in Regulation SCI.
---------------------------------------------------------------------------

    \720\ The two exempt clearing agencies may also be subject to
the EU Regulation, the Digital Operational Resilience Act (DORA),
which went into effect in 2015: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52020PC0595.
---------------------------------------------------------------------------

3. Specific Benefits and Costs of Regulation SCI Requirements for All
SCI Entities
a. Rule 1001--Policies and Procedures
    Rule 1001(a) through (c) sets forth requirements relating to the
written policies and procedures that SCI entities are required to
establish, maintain, and enforce. New SCI entities will need to comply
with these requirements for the first time. In addition, the Commission
is proposing to amend portions of Rule 1001(a), which will affect
existing SCI entities as well. We discuss the benefits and costs of
applying existing provisions to new SCI entities, as well as the
benefits and costs of the amendments for both new and existing
entities, below. We also discuss below the economic effects of these
changes specific to the new SCI entities.
i. Benefits
(1) Provisions Applicable Only to New SCI Entities
    Rule 1001 requires certain policies and procedures for SCI
entities. We consider here the provisions under Rule 1001 that we are
not amending and therefore will only have an impact on SCI entities,
relative to the baseline. We separately consider the provisions that we
propose to amend in the following section, for both new and existing
SCI entities.
(i) Capacity, Integrity, Resiliency, Availability, and Security (Rule
1001(a)(1), (a)(2)(i) Through (iv), (vi), and (vii))
    Rule 1001(a)(1) requires that each SCI entity establish, maintain,
and enforce written policies and procedures reasonably designed to
ensure that its SCI systems and, for purposes of security standards,
indirect SCI systems, have levels of capacity, integrity, resiliency,
availability, and security, adequate to maintain the SCI entity's
operational capability and promote the maintenance of fair and orderly
markets. Rule 1001(a)(2)(i) through (iv), (vi), and (vii) prescribe
certain minimum requirements for an SCI entity's policies and
procedures. The Commission is not amending paragraphs (a)(1) and
(a)(2)(i) through (iv), (vi), or (vii), and therefore current SCI
entities will not be affected whereas new SCI entities will become
subject to these provisions for the first time.
    Generally, the requirements to establish policies and procedures in
Rule 1001(a)(1) should help ensure more robust systems that help reduce
the risk and incidence of systems issues affecting the markets by
imposing requirements on new entities that are

not currently subject to Regulation SCI and by covering systems and
events that are not currently within the scope of existing regulations
and current practices.\721\ In addition, the required policies and
procedures may help new SCI entities recover more quickly from SCI
events that do occur.
---------------------------------------------------------------------------

    \721\ The potential adverse effects of systems failures are
described in section V.C.2. for each type of new SCI entity.
Benefits to new SCI entities from a reduction in the risk and
incidents of systems issues would arise from a reduction in these
adverse effects.
---------------------------------------------------------------------------

    Application of Rule 1001(a)(2)(i) through (iv), (vi), and (vii) to
the new SCI entities is expected to benefit securities markets and
market participants by leading to the establishment, maintenance, and
enforcement of policies and procedures for these entities related to
current and future capacity planning; periodic stress testing; systems
development and testing methodology; and reviews and testing to
identify vulnerabilities; standards for market data collection,
processing, and dissemination; and monitoring to identify potential
systems problems. These requirements should reduce the risk and
incidence of systems issues, such as systems disruptions and systems
intrusions. This, in turn, could reduce interruptions in the price
discovery process and liquidity flows. Systems issues that directly
inhibit execution facilities, order matching, and dissemination of
market data could cause slow executions or delayed orders, or cause
inoperability of an SCI entity for a period of time. If executions were
delayed by a systems disruption in an SCI system related to a trading,
order routing, clearance and settlement, or market data system, given
the magnitude of the transaction activity in which SCI entities
consistently engage, the delay could have cascading effects disruptive
to the broader market.\722\
---------------------------------------------------------------------------

    \722\ See supra note 197.
---------------------------------------------------------------------------

    In addition, Rule 1001(a)(2)(vi) provides that an SCI entity's
policies and procedures must include standards that result in systems
being designed, developed, tested, maintained, operated, and surveilled
in a manner that facilitates the successful collection, processing, and
dissemination of market data. Rule 1001(a)(2)(vi) is expected to help
ensure that timely and accurate market data are made available by new
SCI entities. Market participants rely on market data in a variety of
ways, including for making markets, formulating trading algorithms, and
placing orders, among others. Although new SCI entities currently
facilitate the successful collection, processing, and dissemination of
market data, improvements in timeliness and accuracy of the generation
of market data inputs would help further ensure pricing efficiencies
and uninterrupted liquidity flows in markets.
    Similarly, by requiring policies and procedures for monitoring
systems to identify potential SCI events, Rule 1001(a)(2)(vii) may help
ensure that new SCI entities identify potential SCI events, which could
allow them to prevent some SCI events from occurring or to take timely
appropriate corrective action after the occurrence of SCI events. As
discussed above, reducing the frequency and duration of SCI events or
reducing the duration of SCI events that disrupt markets would reduce
pricing inefficiencies and promote price discovery and liquidity.
    In general, setting forth policies and procedures with regard to
capacity planning, stress testing, systems development and testing
methodology, and reviews and testing to identify vulnerabilities could
yield benefits to market participants and new SCI entities, including a
potential reduction in the likelihood, duration, or severity of SCI
events, thus helping to contain losses from these events, as described
above.\723\ Capacity planning and stress testing are necessary to help
an SCI entity determine its systems' ability to process transactions in
an accurate, timely, and efficient manner, and thereby help ensure
market integrity. Development and testing systems are important in
ensuring the reliability and resiliency of SCI systems. The potential
adverse effects of systems failures are described in section V.C.2. for
each type of new SCI entity. More reliable and resilient systems should
help reduce the occurrence of SCI events and improve systems uptime for
the new SCI entities, and thus possibly result in a reduction in losses
due to SCI events and a reduction in these adverse effects.
Furthermore, the use of inadequately tested software in production
could result in substantial losses to market participants if it does
not function as intended. For instance, if software malfunctions, it
might not execute or route orders as intended and also could have
unintended effects on quoted prices and the actual prices at which
orders execute. Additionally, if a system's capacity thresholds are
improperly estimated, it may become congested, resulting in higher
indirect transaction costs due to lower execution quality (e.g.,
decrease in order fill rates).
---------------------------------------------------------------------------

    \723\ See section V.D.1.
---------------------------------------------------------------------------

    The Commission recognizes that the new SCI entities are subject to
existing policies and procedures obligations as discussed in the
baseline. Pursuant to those obligations, the new SCI entities may
already engage in practices that are similar to certain requirements
under Regulation SCI. To the extent that the existing policies and
procedures are similar to those reflected in Regulation SCI, the
magnitude of the costs and benefits discussed above that stem from the
application of those policies and procedures will be correspondingly
reduced. However, costs and benefits that arise from obligations under
Regulation SCI that differ from those existing obligations, such as
reporting to the Commission will be maintained.
    While some of the existing regulations that apply to the proposed
new SCI entities may be consistent with or similar to the policy and
procedure requirements of Regulation SCI discussed in this section, the
Commission believes it is nevertheless appropriate to apply these
policy and procedure requirements to the new SCI entities and doing so
would benefit participants in the securities markets in which these
entities operate. Applying Regulation SCI to these entities increases
market protections by establishing these obligations under the Exchange
Act so that the Commission may enforce them directly and examine for
compliance and provides a uniform mandatory requirement that will
ensure their continued application.
    In addition, some new SCI entities may already be voluntarily
implementing policies and procedures consistent with the requirements
of Regulation SCI. The magnitude of the benefits (and associated costs,
as discussed below) from the policy and procedure requirements in Rule
1001(a)(1) and (a)(2)(i) through (iv), (vi), and (vii) for the new SCI
entities (and the costs, as discussed below), will therefore depend on
the extent to which their current operations already align with the
rule's requirements, given both existing regulation and current
practice. However, the Commission believes the application of
Regulation SCI is still necessary. For example, while SBSDRs that also
function as SDRs in the swap markets, may currently apply the CFTC
rules to their securities-based swap markets as well as their swaps
markets, the CFTC rules only apply to their swap market SDR systems.
Therefore, applying Regulation SCI to SBSDRs would help to ensure that
the systems relevant to the securities markets are subject to a
requirement to have levels of capacity, integrity, resiliency,
availability, and security adequate to maintain their operational
capability and promote the maintenance of fair

and orderly markets and are subject to enhanced Commission oversight.
    Additionally, with respect to SBSDRs, the requirements of
Regulation SCI are more specific and comprehensive than the principles-
based requirements of Rule 13n-6. The requirements of Regulation SCI
would thus exist and operate in conjunction with Rule 13n-6, helping
ensure that SBSDR market systems are robust, resilient, and secure and
enhancing Commission oversight of the these systems.
    Similarly, application of Regulation SCI to broker-dealers would
complement existing requirements and enhance the policies and
procedures already in place for these entities. For example, the Market
Access Rule prescribes specific controls and procedures around a
broker-dealer entering orders on an exchange or ATS, but the policy and
procedure requirements of Regulation SCI are broader in scope and are
designed to ensure that the key technology pervasive and important to
the functioning of the U.S. securities markets is robust, resilient,
and secure. Further, the SCI review requirement obligates an SCI entity
to assess the risks of its systems and effectiveness of its technology
controls at least annually, identify weaknesses, and ensure compliance
with the safeguards of Regulation SCI. In addition, with respect to the
requirements concerning the collection, processing, and dissemination
of market data, Regulation SCI extends beyond existing requirements to
include SCI systems directly supporting proprietary market data, which
will provide additional benefits to market participants. Further while
Rule 17a-3 has a notification requirement when a broker-dealer fails to
make and keep current the records required by that Rule, Regulation SCI
more directly addresses mitigating the impact of technology failures
with respect to SCI systems and indirect SCI systems (which include
systems that are not used to make and keep current the records required
by Rule 17a-3) and requires notifications to the Commission for a
different set of events--systems intrusions, systems compliance issues,
and systems disruptions--than the notification requirements of 17 CFR
240.17a-11 (``Rule 17a-11'').
    Likewise, while FINRA Rule 4370 requires broker-dealers to maintain
business contingency and disaster recovery plans, it does not include
the requirement that the business continuity and disaster recovery
plans be reasonably designed to achieve next business day resumption of
trading and two-hour resumption of critical SCI systems following a
wide-scale disruption, nor does it require the functional and
performance testing and coordination of industry or sector-testing of
such plans, which are instrumental in achieving the goals of Regulation
SCI with respect to SCI entities.
    Finally, with respect to the exempt clearing agencies not subject
to ARP, subjecting these entities to the policy and procedure
requirements of Regulation SCI will ensure that uniform, minimum
requirements regarding capacity, integrity, resiliency, availability,
and security applies to all exempt clearing agencies. Although some of
the conditions underlying the exemptive orders for the two exempt
clearing agencies that would be subject to Regulation SCI under the
proposed amendments may be consistent with Regulation SCI's policy and
procedure requirements, the conditions vary across the agencies and in
their similarity to the Regulation SCI requirements. As these exempt
clearly agencies and other entities that they interact with become more
technologically innovative and interconnected, applying a uniform,
minimum set of requirements will improve the Commission's oversight and
better ensure the resiliency of the markets in which they operate.
    Overall, applying the specific and comprehensive requirements set
forth in Rule (a)(2)(i) through (iv), (vi), and (vii) of Regulation SCI
to the new SCI entities would create a uniform, mandatory framework
under the Commission's oversight thereby furthering the goals of
Regulation SCI to strengthen the technology infrastructure of the U.S.
securities markets and improve its resilience.
(ii) Systems Compliance (Rule 1001(b))
    Rule 1001(b)(1) requires each SCI entity to establish, maintain,
and enforce written policies and procedures reasonably designed to
ensure that its SCI systems operate in a manner that complies with the
Exchange Act and the rules and regulations thereunder, and the entity's
rules and governing documents, as applicable. Rule 1001(b)(2)(i)
through (iv) provides that an SCI entity's policies and procedures
under Rule 1001(b)(1) must include, at a minimum: (i) testing of all
SCI systems and any changes to SCI systems prior to implementation;
(ii) a system of internal controls over changes to SCI systems; (iii) a
plan for assessments of the functionality of SCI systems designed to
detect systems compliance issues, including by responsible SCI
personnel and by personnel familiar with applicable provisions of the
Exchange Act and the rules and regulations thereunder and the SCI
entity's rules and governing documents; and (iv) a plan of coordination
and communication between regulatory and other personnel of the SCI
entity, including by responsible SCI personnel, regarding SCI systems
design, changes, testing, and controls designed to detect and prevent
systems compliance issues.
    These provisions remain unchanged and do not create any new
requirement for current SCI entities. New SCI entities, however, would
become subject to these provisions for the first time. The Commission
recognizes that new SCI entities currently take various measures to
ensure that their systems operate in a manner that complies with
relevant laws and rules. The specific requirements of Rule 1001(b) will
further ensure that new SCI entities operate their SCI systems in
compliance with the Exchange Act and relevant rules. For example, the
tests under Rule 1001(b)(2)(i) should help new SCI entities to identify
potential compliance issues before new systems or systems changes are
implemented; the internal controls under 17 CFR 242.1001(b)(2)(ii)
(``Rule 1001(b)(2)(ii)'') should help to ensure that new SCI entities
remain vigilant against compliance challenges when changing their
systems and resolve potential noncompliance before the changes are
implemented; and the systems assessment plans under 17 CFR
242.1001(b)(2)(iii) (``Rule 1001(b)(2)(iii)'') and the coordination and
communication plans under Rule 1001(b)(2)(iv) should help technology,
regulatory, and other relevant personnel of new SCI entities to work
together to prevent compliance issues, and to promptly identify and
address compliance issues if they occur.\724\ To the extent that new
SCI entities operate market regulation and market surveillance systems,
and to the extent that compliance with Rule 1001(b) reduces the
occurrence of systems compliance issues, Rule 1001(b) should advance
investor protection.\725\
---------------------------------------------------------------------------

    \724\ See SCI Adopting Release, at 72422.
    \725\ See id. at 72410 and 72422; see also section III.A.2.b.ii
(policies and procedures, including those for system compliance, are
expected to strengthen broker-dealers' operational capabilities
independent of any specific SCI event affecting their technology
supporting trading, clearance and settlement, order routing, market
data, market regulation, and market surveillance).
---------------------------------------------------------------------------

(iii) Responsible SCI Personnel (17 CFR 242.1001(c)(1) (``Rule
1001(c)(1)''))
    Rule 1001(c)(1) requires an SCI entity to establish, maintain, and
enforce reasonably designed written policies and procedures that
include the criteria

for identifying responsible SCI personnel, the designation and
documentation of responsible SCI personnel, and escalation procedures
to quickly inform responsible SCI personnel of potential SCI events.
This provision remains unchanged and does not create any new
requirement for current SCI entities. New SCI entities, however, will
become subject to this provision for the first time.
    Requiring policies and procedures to identify and designate
responsible SCI personnel and to establish escalation procedures to
quickly inform such personnel of potential SCI events should help to
effectively determine whether an SCI event occurred and what
appropriate actions should be taken without unnecessary delay. As such,
Rule 1001(c)(1) is expected to reduce the duration of SCI events as new
SCI entities become aware of them and take appropriate corrective
actions more quickly. The reduction in the duration of SCI events would
benefit markets and their participants as it would promote pricing
efficiency and price discovery.
    The Commission recognizes that the new SCI entities currently have
certain regulatory obligations that may align with certain requirements
of Rule 1001(c)(1), as described in the baseline, and in addition the
new SCI entities may already be voluntarily implementing policies and
procedures that may align with certain requirements of Rule 1001(c)(1).
For example, SBSDRs and exempt clearing agencies may have policies and
procedures that identify roles and responsibilities for key personnel
as well as appropriate escalation procedures including designation and
documentation of responsible personnel as noted above.\726\ Likewise,
as discussed above,\727\ broker-dealers may have policies and
procedures for designating employees with specific roles and
responsibilities and escalation procedures documented in their incident
response plans. As discussed above, the extent of these benefits (and
related costs, as discussed below) would depend in part on how closely
the existing policies and procedures of the new SCI entities align with
the specific requirements of Rule 1000(c)(1).
---------------------------------------------------------------------------

    \726\ See sec. V.B.1.a.ii and V.B.1.c.ii.
    \727\ See section V.B.1.b.ii.
---------------------------------------------------------------------------

(iv) Periodic Reviews of Policies and Procedures and Prompt Remedial
Actions (Rule 1001(a)(3), (b)(3), (c)(2))
    Rule 1001(a)(3), (b)(3), and (c)(2) require each SCI entity to
periodically review the effectiveness of the policies and procedures
required under Rule 1001(a) through (c) related to capacity, integrity,
resiliency, availability, and security; systems compliance; and
responsible SCI personnel, respectively, and to take prompt action to
remedy deficiencies in such policies and procedures. These provisions
remain unchanged since the adoption of Regulation SCI in 2014, but new
SCI entities will become subject to them for the first time.
    Requiring periodic review of the policies and procedures and
remedial actions to address any deficiencies in the policies and
procedures would help to ensure that new SCI entities maintain robust
policies and procedures and update them when necessary so that the
benefits of Rule 1001(a) through (c) as discussed in section V.C.1
should continue to be realized. For example, Rule 1001(a)(3), (b)(3),
and (c)(2) should help to decrease the number of trading interruptions
due to system issues in new SCI entities. It should lead to fewer
interruptions in the price discovery process \728\ and liquidity flows,
thus, may result in fewer periods with pricing inefficiencies. Further,
because interruptions in liquidity flows and the price discovery
process in one security can affect securities trading in other markets,
reducing trading interruptions could have broad effects.
---------------------------------------------------------------------------

    \728\ The price discovery process involves trading--buyers and
sellers arriving at a transaction price for a specific asset at a
given time. Thus, generally, any trading interruptions would
interfere with the price discovery process.
---------------------------------------------------------------------------

    As with the other requirements of Regulation SCI previously
discussed, the Commission acknowledges that the new SCI entities are
subject to existing regulations, and the extent of the benefits (and
costs, as discussed below) will depend on how closely their current
policies and procedures align with the requirements for review and
remedial action under Rule 1001(a)(3), (b)(3), and (c)(2). The SBSDRs
registered with the Commission are registered with the CFTC as swap
data repositories (SDRs) and, with respect to systems of concern to the
CFTC, are subject to CFTC's rules that require these entities to
conduct periodic reviews of automated systems and business continuity-
disaster recovery capabilities.\729\ While such entities may apply the
CFTC rules to the entirety of their repositories, the CFTC rules do not
apply to the SBSDR and its security-based swap related systems.
Therefore, applying Rule 1001(a)(3), (b)(3), and (c)(2) to SBSDRs would
ensure periodic reviews of the effectiveness of policies and procedures
specifically related to SCI systems and create a uniform, mandatory
framework under the Commission's oversight.
---------------------------------------------------------------------------

    \729\ See 17 CFR 49.24(j); 17 CFR 49.24(m); 17 CFR 49.24(b)(3).
---------------------------------------------------------------------------

    Similarly, SCI broker-dealers also are required under FINRA Rule
4370 to conduct an annual review of the business continuity and
disaster recovery plans.\730\ Further, as noted above, the two exempt
clearing agencies are required to report at least on an annual basis to
the competent authority regarding their compliance with CSDR, including
on their operational risk management framework and systems and their
information security framework.\731\ The exempt clearing agencies must
also periodically test and review the operational arrangements and
policies and procedures with users. Additionally, the exemptive order
for one of the exempted clearing agencies requires a review of policies
and procedures and reporting on the status of policies and procedures
to the Commission. To the extent that that the broker-dealers and the
exempt clearing agencies increase the scope of the review of their
policies and procedures related to capacity, integrity, resiliency,
availability, and security; systems compliance; and responsible SCI
personnel, and take prompt action to remedy deficiencies, the exempt
clearing agencies, broker-dealers and their customers will benefit from
application of Rule 1001(a)(3), (b)(3), and (c)(2) and create a
uniform, mandatory framework under the Commission's oversight.
---------------------------------------------------------------------------

    \730\ See sec. V.B.1.b.ii.
    \731\ See sec. V.B.1.c.ii.
---------------------------------------------------------------------------

(2) Amended Provisions Applicable to Current and New SCI Entities
    The Commission is proposing to amend Rule 1001(a)(2)(v)--to add to
that provision a requirement that business continuity and disaster
recovery plans be reasonably designed to address the unavailability of
any third-party provider that provides functionality, support, or
service to the SCI entity without which there would be a material
impact on any of its critical SCI systems--and add several new
provisions in Rule 1001(a)(2), including proposed Rule 1001(a)(2)(viii)
(systems classifications and lifecycle management programs); proposed
Rule 1001(a)(2)(ix) (third-party provider management program); proposed
Rule 1001(a)(2)(x) (a program to prevent the unauthorized access to
such systems and information residing therein); and proposed Rule
1001(a)(2)(xi) (identification of the relevant current industry
standard claimed as a safe harbor, if any). In addition, we are

proposing to amend Rule 1001(a)(4) to clarify that policies and
procedures that are consistent with current SCI industry standards
provide a safe harbor with respect to the requirement that such
policies and procedures be reasonably designed. These amendments would
impact both new and existing SCI entities.
(i) Business Continuity and Disaster Recovery Plans (Rule
1001(a)(2)(v))
    Rule 1001(a)(2)(v) currently requires SCI entities' policies and
procedures to set forth business continuity and disaster recovery plans
that include maintaining backup and recovery capabilities sufficiently
resilient and geographically diverse and that are reasonably designed
to achieve next business day resumption of trading and two-hour
resumption of critical SCI systems following a wide-scale disruption.
The Commission is proposing to also require that such plans are
reasonably designed to address the unavailability of any third-party
provider that provides functionality, support, or service to the SCI
entity, without which there would be a material impact on any of its
critical SCI systems.
    With respect to the existing requirements that will remain
unchanged, these would only affect new SCI entities and not create any
new requirement for current SCI entities. Requiring business continuity
and disaster recovery plans increases the likelihood that the markets
in which they participate will continue to function, and SCI systems
can resume operation in a timely manner, even when there are
significant outages to SCI systems. Rule 1001(a)(2)(v), among other
things, is expected to help ensure prompt resumption of all critical
SCI systems, which in turn is expected to help minimize interruptions
in trading and clearance and settlement after a wide-scale disruption.
Notably, in the case of a wide-scale disruption, multiple SCI entities
may be affected by the same incident at the same time. Given that U.S.
securities market infrastructure is concentrated in relatively few
areas, such as New York City, New Jersey, and Chicago, maintaining
backup and recovery capabilities that are geographically diverse could
facilitate resumption in trading and critical SCI systems following
wide-scale market disruptions.\732\ Reducing the frequency and duration
of trading interruptions would promote pricing efficiency, price
discovery, and liquidity flows in markets.
---------------------------------------------------------------------------

    \732\ As discussed in section III.C.2, the geographic diversity
of data center sites is an important consideration even where an SCI
entity uses CSPs as its business continuity and disaster recovery
service providers.
---------------------------------------------------------------------------

    With respect to the new requirement on the unavailability of third-
party providers, both new and current SCI entities will be affected.
Financial institutions, including SCI entities, have become
increasingly dependent on third parties--such as cloud service
providers--to operate their businesses and provide their services.\733\
The proposed requirement for business continuity and disaster recovery
plans to address the unavailability of any third-party provider would
help ensure that SCI entities are appropriately prepared for
contingencies relating to a third-party provider with respect to
critical SCI systems., including the potential for an extended outage,
if, for example the third-party provider goes into bankruptcy or
dissolves, or if it breaches its contract and decides to suddenly,
unilaterally, and/or permanently cease to provide the SCI entity's
critical SCI systems with functionality, support, or service.
---------------------------------------------------------------------------

    \733\ See supra sec. V.B.4. and note 687.
---------------------------------------------------------------------------

    The Commission understands that some new SCI entities are already
subject to similar requirements and may already have policies and
procedures that may align with Rule 1001(a)(2)(v),\734\ while others
may need to make more significant changes to their current policies,
procedures and practices. As discussed above, the extent of the
benefits (and costs, as discussed below) will depend on how closely the
new SCI entities' current policies and procedures align with the
requirements of 1001(a)(2)(v), including the proposed amendment. With
respect to SBSDRs, which are also registered as SDRs with the CFTC, the
CFTC's System Safeguard rule sets forth requirements for swap data
repositories to establish and maintain emergency procedures,
geographically diverse \735\ backup facilities, and a business
continuity-disaster recovery plan that allows for the timely recovery
and resumption of next day operations following the disruption. While
such entities may apply the CFTC rules to the entirety of their
repositories, the CFTC rules do not apply to the SBSDR and its
security-based swap related systems. Therefore, Rule 1001(a)(2)(v)
would help ensure SBSDR's have in place for their SCI systems business
continuity and disaster recovery plans that meet the minimum
requirements set forth in the rule and create a uniform, mandatory
framework under the Commission's oversight. The proposed amendment
would ensure that these plans specifically address the unavailability
of any third-party provider that provides functionality, support, or
service to the SBSDR's SCI systems, without which there would be a
material impact on any of its critical SCI systems.
---------------------------------------------------------------------------

    \734\ See sections III.A.2.a.ii, III.A.2.b.ii, III.A.2.c.i.,
V.B.1.a.ii, V.B.1.b.ii, and V.B.1.c.ii.
    \735\ SDRs deemed critical by the CFTC require geographically
diverse backup facilities and staff.
---------------------------------------------------------------------------

    SCI broker-dealers are likewise required to create and maintain a
written business continuity plan under FINRA Rule 4370.\736\ Currently
required business continuity public disclosure statements \737\
generally indicate that some backup systems are geographically diverse,
but limited information is disclosed with respect to a specific
timeline for resumption of service in the event of a disruption.
Similarly, these required business continuity public disclosure
statements generally do not provide information on specific BC/DR plans
to address the unavailability of any third-party provider, as would be
required under the proposed amendment. Applying the requirements of
Rule 100(a)(2)(v) to broker-dealers may reduce the frequency and
duration of trading interruptions, which would promote pricing
efficiency, price discovery, and liquidity flows in markets. Further,
the proposed amendment to Rule 1001(a)(2)(v) would help ensure broker-
dealers have business continuity and disaster recovery plans in place
to address the unavailability of any third-party provider that provides
functionality, support, or service to the SCI systems.
---------------------------------------------------------------------------

    \736\ See section V.B.1.b.ii.
    \737\ While broker-dealers are required to provide a brief
summary disclosure statement regarding their BCPs to customers, they
do not disclose the actual BCP. Based on a review of 2021 and 2022
BCP disclosure statements, firms often do not provide any detail on
operational capacity to meet demand surges or any specific
timeframes for resumption of service.
---------------------------------------------------------------------------

    Finally, as discussed above, the exempt clearing agencies are
currently required to maintain a business continuity policy and
disaster recovery plan that ensures two hour resumption of critical
operations and geographically diverse backup systems and monitor and
test it at least annually.\738\ The exempt clearing agencies are also
required to address the unavailability of any critical third-party
provider.\739\ Application of Rule 1000(a)(2)(v), including the
proposed amendment, would help ensure exempt clearing agencies have
business continuity and disaster recovery plans in place to address the
unavailability of any third-

party provider that provides functionality, support, or service to the
SCI systems and thus would likely incrementally reduce the frequency
and duration of trading interruptions and promote pricing efficiency,
price discovery, and liquidity flows in markets.
---------------------------------------------------------------------------

    \738\ See sec. V.b.1.e.ii.
    \739\ Id.
---------------------------------------------------------------------------

(ii) Systems Classification and Lifecycle Management (Proposed Rule
1001(a)(2)(viii))
    Proposed Rule 1001(a)(2)(viii) provides that an SCI entity's
policies and procedures must provide for the maintenance of a written
inventory and classification of all SCI systems, critical SCI systems,
and indirect SCI systems as such, and a program with respect to the
lifecycle management of such systems, including the acquisition,
integration, support, refresh, and disposal of such systems, as
applicable. This is a new provision and applies to both current SCI
entities and new SCI entities.
    A foundational and essential step for an SCI entity to be able to
meet its obligations under Regulation SCI is to be able to clearly
identify the different types of its systems that are subject to
differing obligations under Regulation SCI. Reasonably designed systems
classification and lifecycle management policies and procedures, which
include vulnerability and patch management, reduce the risk of SCI
system defects and operational issues. The systems classification
requirement would promote more efficient and timely compliance with the
remaining provisions of Regulation SCI. The lifecycle management
requirement would also ensure that sensitive information (including
software configuration info, middleware, etc.) is not inadvertently
revealed, potentially compromising the security of an SCI entity's data
and network--and would further enhance the systems' integrity,
resiliency, and security. The Commission understands that one of the
first steps many current SCI entities would take to comply with
Regulation SCI is to develop a classification of their systems in
accordance with the definitions of each type of system in SCI, but not
all SCI entities maintain such a list. Accordingly, the extent of the
benefits described above will depend on whether existing entities have
taken such steps and how closely they align with the proposed
requirements.
    With respect to new SCI entities, broker-dealers are required to
maintain policies and procedures per Regulation S-P and S-ID, as
discussed above.\740\ In two Commission exam sweeps, the Commission
staff observed that most broker-dealers already inventory, catalog, and
classify the risks of their systems and had a process in place for
ensuring regular system maintenance, including the installation of
software patches to address security vulnerabilities.\741\ Furthermore,
identification of mission critical systems is required by FINRA rule
4370. Accordingly, there would be an incremental benefit (and cost)
from applying this particular provision of Regulation SCI to the
broker-dealers. Additionally, the practice of inventorying and
classifying systems might also encourage the firm to invest in
supplemental security measures to reduce the number of indirect SCI
systems, which would result in an incremental and upfront or short-term
cost.
---------------------------------------------------------------------------

    \740\ See sec. V.B.1.b.ii.
    \741\ Id.
---------------------------------------------------------------------------

    As discussed in section V.B.1.c.ii, exempt clearing agencies are
required by CSDR to prepare a list with all the processes and
activities that contribute to the delivery of the services they
provide; and identify and create an inventory of all the components of
their IT systems that support the processes and activities. This likely
would represent an incremental benefit (and cost). Additionally, the
practice of inventorying and classifying systems might also encourage
the firm to invest in supplemental security measures to reduce the
number of indirect SCI systems to reduce the long-time compliance
burden which would result in an incremental and upfront or short-term
cost.
(iii) Third-Party Provider Management (Proposed Rule 1001(a)(2)(ix))
    Proposed Rule 1001(a)(2)(ix) concerns policies and procedures for
effective third-party provider management and would newly apply to both
existing and new SCI entities. As discussed above, financial
institutions have been increasingly outsourcing parts of their
services.\742\ When a market participant chooses to outsource a
particular component of its operation to a third-party vendor, the
vendor may offer components of services (of certain quality) at a
cheaper rate than the market participant can supply on its own or where
the market participant may lack the expertise or ability to provide
them. If this is done properly and with full information, it can result
in an efficient outcome without compromising the service quality below
what is required under Regulation SCI.
---------------------------------------------------------------------------

    \742\ See supra sec. V.B.4. and note 687.
---------------------------------------------------------------------------

    But in some cases, if there is information asymmetry--especially
with respect to service quality--market dynamics among SCI entities
result on the provision of sub-optimal services. This may be the case
for a number of reasons, including imperfect communication between the
SCI entity and its third-party provider. First, a third-party provider
providing its service to an SCI entity may lack the knowledge of the
level of resiliency and capacity the SCI entity must maintain. Second,
an SCI entity may lack the knowledge of the robustness of the third-
party provider's operation. Third, the market for these services may
not be competitive, and an SCI entity looking to outsource these
services may not have other comparable choices. Failure to ensure that
policies and procedures are adequate to reduce these risks may result
in unidentified security weaknesses, the inability to analyze potential
security events, and delayed business continuity and disaster recovery.
    Proposed Rule 1001(a)(2)(ix) would require each SCI entity to have
a program to manage and oversee third-party providers that provide
functionality, support or service, directly or indirectly, for its SCI
systems and, for purposes of security standards, its indirect SCI
systems. Each SCI entity would be required to undertake a risk-based
assessment of each third-party provider's criticality to the SCI
entity, including analyses of third-party provider concentration, of
key dependencies if the third-party provider's functionality, support,
or service were to become unavailable or materially impaired, and of
any potential security, including cybersecurity, risks posed. The
Commission believes that specifically requiring each SCI entity to
undertake a risk-based assessment of each of its third-party providers'
criticality to the SCI entity will help it more fully understand the
risks and vulnerabilities of utilizing each third-party provider, and
provide the opportunity for the SCI entity to better prepare in advance
for contingencies should the provider's functionality, support, or
service become unavailable or materially impaired.
    Again, the extent of these benefits may depend on whether an SCI
entities' existing practices, and applicable regulations, are
consistent with the requirements of proposed Rule 1001(a)(2)(ix). As
noted above, SBSDRS that are dually registered as SDRs with the CFTC
are also subject to the CFTC

System Safeguards rule, which requires a SDR to undertake program of
risk analysis and oversight of outsourcing and vendor management
affecting its operations and automated systems.\743\ A dual-registered
entity's outsourced systems for processing SDR data might also be SCI
systems if such systems also process SBSDR data. Accordingly, an SDR's
adherence to the System Safeguard Rule's provision for vendor
management and outsourcing is reasonably likely to reduce the benefit
(and the cost, as discussed below) of complying with proposed Rule
1001(a)(2)(ix).
---------------------------------------------------------------------------

    \743\ 17 CFR 49.24(b)(6).
---------------------------------------------------------------------------

    Similarly, as discussed above, broker-dealers are already subject
to general vendor management obligations in accordance with FINRA Rule
3110 and obligations under Regulation S-P \744\ and thus some of their
current practices may be consistent with some of the requirements of
Rule 1001(a)(ix). However, those rules are different in scope and
purpose than the proposed amendment to Regulation SCI.\745\ For
example, while FINRA rules already require initial and ongoing due
diligence, third-party provider contract review and ongoing third-party
risk assessment, proposed Rule 1001(a)(2)(ix) also requires an
additional risk-based assessment of each third-party provider's
criticality to the SCI entity. Accordingly, proposed Rule
1001(a)(2)(ix) may restrict usage of particular third-party providers,
if and when they are unwilling or unable to comply with Regulation
SCI's third-party provider requirements.
---------------------------------------------------------------------------

    \744\ See supra sec. V.B.1.b.ii.
    \745\ See sec. III.A.2.b.ii. and III.D.
---------------------------------------------------------------------------

    Finally, as discussed in V.B.1.c.ii, the two exempt clearing
agencies are required by CSDR to have arrangements for the selection
and substitution of IT third-party service providers and proper
controls and monitoring tools which seems within the scope of proposed
Rule 1001(a)(2)(ix) initial and ongoing due diligence provisions. The
exempt clearing agencies are also required to identify critical
utilities providers and critical service providers that may pose risks
to tier operations due to dependency on them which seems within the
scope of ongoing third-party risk assessment. In light of the existing
requirements for exempt clearing agencies discussed in the baseline,
any benefits (and associated costs, as discussed below) from the
proposed amendment are likely to be relatively small with respect to
critical service providers. However, the benefit would likely be larger
with respect to non-critical service providers where the requirements
are less specific.
(iv) Security (Proposed Rule 1001(a)(2)(x))
    Since the adoption of Regulation SCI in 2014, the financial system
has become more digitized and consequently cybersecurity has become a
significant concern for financial firms, investors, and regulatory
authorities.\746\ In addition, the COVID-19 pandemic and accelerated
move to working from home increased the demand for digital services and
reliance of SCI entities on third-party providers including CSPs.
Moving the majority of activities to the online or digitized
environment has increased the risk of cybersecurity events.\747\
According to the Bank for International Settlements, the financial
sector had the second-largest share of COVID-19-related cybersecurity
events between March and June 2020.\748\ The Commission is proposing a
new paragraph (a)(2)(x) of Rule 1001 that would require policies and
procedures of SCI entities include a program to prevent the
unauthorized access to SCI systems and, for purposes of security
standards, indirect SCI systems and information residing therein. This
would be a new provision and would apply to both current SCI entities
and new SCI entities.
---------------------------------------------------------------------------

    \746\ See supra sec. III.C.3.
    \747\ I[ntilde]aki Aldasoro et al., COVID-19 and Cyber Risk in
the Financial Sector, BIS Bull. No. 37 (Jan. 14, 2021), available at
https://www.bis.org/publ/bisbull37.pdf.
    \748\ Id. The health sector is ranked first in term of the
cyberattacks.
---------------------------------------------------------------------------

    The Commission anticipates that the primary benefit of the proposed
rule would be to ensure that all SCI entities, including the new SCI
entities, have policies and procedures to enhance their preparedness
against cybersecurity threats. The proposed requirements to develop
policies and procedures that are specifically designed to prevent the
unauthorized access to SCI systems and information residing therein,
would better protect SCI entities against cybersecurity threats. Such
policies and procedures can strengthen the security surrounding their
information systems and the data contained within, aiding in the
prevention of unauthorized access; minimizing the damage from
cybersecurity events; and improving incident recovery time.
    Another significant benefit is that any such unauthorized access
should be reported to the Commission. Thus, this rule, together with
the Commission notification requirement in Rule 1002(b), as amended,
will help the Commission better understand which entities are most
affected by cybersecurity events, what the current trends may be, and
provide the Commission with information that may aid in subsequent
guidance or rulemaking to further strengthen the affected entities from
future cybersecurity events and disruptions to their business
operations. Indeed, as we stated in section B.2.a, it is the
Commission's understanding that current SCI entities have been
reporting de minimis system intrusions on a quarterly basis, rather
than immediately, as permitted under the current requirements of
Regulation SCI. Current SCI entities are not required to report
attempted intrusions.
    The extent of these benefits will depend on how consistent the
existing policies and procedures of both current and new SCI entities
are with the requirements of proposed Rule 1001(a)(2)(x). The
Commission believes that many existing SCI entities already have most
or all of such policies and procedures in place as part of their
security protocols; thus the benefits (and the associated costs) of
applying the proposed Rule 1001(a)(2)(x) may be reduced.
    Among new SCI entities, both registered SBSDRs have stated they
have policies and procedures addressing access management.\749\ To the
extent that SBSDRs already have access management policies and
procedures that are aligned with the requirements of proposed Rule
1001(a)(2)(x), the proposed rule would offer limited benefits. Further,
as discussed in section V.B.1.b.ii, broker-dealers are required to
maintain policies and procedures addressing security issues per
Regulation S-P and S-ID, although those regulations and the required
policies and procedures are different in scope and purpose. The extent
of the benefits of proposed Rule 1001(a)(2)(x) would thus depend on how
consistent the broker-dealer's current policies and procedures are with
the requirements of the proposed Rule.
---------------------------------------------------------------------------

    \749\ 17 CFR 49.24(b)(2). See Security-Based Swap Data
Repositories; ICE Trade Vault, LLC; Notice of Filing of Application
for Registration as a Security-Based Swap Data Repository, available
at https://www.sec.gov/rules/other/2021/34-91331.pdf; Security-Based
Swap Data Repositories; DTCC Data Repository (U.S.), LLC; Notice of
Filing of Application for Registration as a Security-Based Swap Data
Repository, available at https://www.sec.gov/rules/other/2021/34-91071.pdf.
---------------------------------------------------------------------------

    As discussed in section V.B.1.c.ii, the two exempt clearing
agencies are required to maintain information security frameworks
describing mechanisms to detect and prevent cyber-attacks and a plan in
response to cyber-attacks. The information security

framework includes among other requirements access controls to the
system and adequate safeguards against intrusions and data misuse.
Therefore, proposed Rule 1001(a)(2)(x) may offer only limited
incremental benefits.\750\
---------------------------------------------------------------------------

    \750\ See section V.B.1.c.ii.
---------------------------------------------------------------------------

(v) Current SCI Industry Standards (Proposed Rule 1001(a)(2)(xi)) and
Safe Harbor for Policies and Procedures Consistent With SCI Industry
Standards (Rule 1001(a)(4))
    Proposed Rule 1001(a)(2)(xi) would provide that an SCI entity's
policies and procedures must include an identification of the current
SCI industry standard(s) with which each such policy and procedure is
consistent, if any. This requirement would be applicable if the SCI
entity is taking advantage of the safe harbor provision, Rule
1001(a)(4). We are also proposing to amend the text of Rule 1001(a)(4),
which deems an SCI entity's policies and procedures under Rule 1001(a)
to be reasonably designed if they are consistent with current SCI
industry standards, to make clear that its reference to and definition
of ``current SCI industry standards'' provides a safe harbor for SCI
entities with respect to their Rule 1001(a) policies and procedures.
Proposed Rule 1001(a)(2)(xi) and the amendment to Rule 1001(a)(4) would
apply to both current SCI entities and new SCI entities.
    Rule 1001(a)(4) specifically states that compliance with current
SCI industry standards is not the exclusive means to comply with the
requirements of Rule 1001(a). Therefore, Rule 1001(a)(4) provides
flexibility to allow each SCI entity to determine how to best meet the
requirements in Rule 1001(a), taking into account, for example, its
nature, size, technology, business model, and other aspects of its
business. SCI entities can choose the technology standards that best
fit with their business, promoting efficiency. The ability of SCI
entities to rely on widely recognized technology standards, if they
choose to do so, will provide guidance to SCI entities on policies and
procedures that would meet the articulated standard of being
``reasonably designed to ensure that their systems have levels of
capacity, integrity, resiliency, availability, and security, adequate
to maintain their operational capability and promote the maintenance of
fair and orderly markets.''
    In addition, the flexibility of this requirement leaves room for
industry-wide innovation, while encouraging each SCI entity to conform
to an industry standard that is most appropriate for itself given the
entity's scope of operation and particular characteristics. These
standards currently in place may require protocols that go beyond the
level that would have been chosen by an entity that is driven by
profit-maximizing or cost-saving motives. Furthermore, as industry
standards continue to evolve, Regulation SCI helps to ensure that SCI
entities are motivated to adhere to the changing standards that reflect
the changes in market conditions and technology. The Commission
understands that many existing SCI entities rely on industry standards,
typically by adhering to a specific industry standard or combination of
industry standards for a particular technology area or by using
industry standards as guidance in designing policies and procedures.
Thus, overall benefits and costs to existing SCI entities will be
incremental, and the benefits and costs are likely to be greater for
entities that do not already rely on industry standards and lesser for
entities that already adhere closely to industry standards.
    Among new entities, both SBSDR entities are also registered with
the CFTC as SDRs, and as such are subject to the CFTC's System
Safeguard rule in their capacity as SDRs. The System Safeguard rule
requires SDRs to follow generally accepted standards and best practices
with respect to the development, operation, reliability, security, and
capacity of automated systems.\751\ While not required, it is likely
that dual-registered SDRs/SBSDRs are following these requirements for
SBSDRs given the CFTC requirements for SDRs. Therefore, it is likely
that SBSDRs already have policies and procedures consistent with
existing industry standards.
---------------------------------------------------------------------------

    \751\ See 17 CFR 49.24.
---------------------------------------------------------------------------

    As discussed above, broker-dealers are required to have certain
policies and procedures pursuant to Regulation S-P and S-ID.\752\ The
2015 FINRA report on cybersecurity practices observed that broker-
dealers reported relying on industry standards with respect to
cybersecurity requirements, typically by adhering to a specific
industry standard or combination of industry standards or by using
industry standards as a reference point for designing policies and
procedures.\753\ To the extent that any broker-dealers do not rely on
industry standards or only selectively, applying Rule 1001(a)(4) and
proposed Rule 1001(a)(2)(xi) will likely increase broker-dealer
adherence to industry standards and improve overall compliance with
Rule 1001.
---------------------------------------------------------------------------

    \752\ See sec. V.B.1.b.ii.
    \753\ See section V.B.1.b.ii.
---------------------------------------------------------------------------

    As discussed in section V.B.1.c.ii, the two exempt clearing
agencies are required by CSDR to rely on internationally recognized
technical standards and industry best practices with respect to its IT
systems. As such, it is likely that they already have policies and
procedures that are consistent with one or more industry standards. The
proposed amendment may have some incremental benefit and improve
overall compliance with Rule 1001.
ii. Costs
    The policies and procedures requirements of Regulation SCI would
impose certain compliance costs on new SCI entities, which are expected
to change at least some of their current practices to comply. In
addition, the proposed amendments to certain provisions in Rule 1001
would impose additional costs on new and existing SCI entities. We
discuss these costs below.
(1) Compliance Costs for New SCI Entities
    Some of the new SCI entities are already subject to existing
regulatory requirements that are similar to the requirements in Rule
1001, including the proposed amendments. To the extent these entities
already have policies and procedures that are consistent with the Rule
1001 requirements, they could incur lower costs to comply with the
requirements of Rule 1001 than entities without such existing policies
and procedures. Similarly, the compliance costs associated with Rule
1001 may vary across SCI entities depending on the degree to which
their current voluntary practices are already consistent with the
requirements of Rule 1001.The compliance costs of Rule 1001 may further
depend on the complexity of SCI entities' systems (e.g., the compliance
costs will be higher for SCI entities with more complex systems). They
may also depend, to a large extent, on the scale as well as the
relative criticality of a given SCI entity's systems. We discuss below
the costs for new SCI entities to comply with Rule 1001, including the
proposed amendments; this includes PRA costs as well as additional
compliance costs.
    First, with respect to PRA costs, the Commission estimates total
initial costs of approximately $13.4 million and annual costs of
approximately $3.5

million for all new SCI entities.\754\ In addition to the compliance
costs estimated as part of the PRA analysis, the Commission
acknowledges there may, in some cases, be other compliance costs. In
the SCI Adopting Release, the Commission formed estimates of non-PRA
compliance costs for complying with Rule 1001(a) and (b),\755\ which
are instructive for determining such costs now for the new SCI
entities. The Commission believed then, and continues to do so now,
that the costs of complying with Rule 1001(c) are fully captured in the
PRA cost estimates. The Commission's estimates then were based on
extensive discussions with industry participants as well as information
contained in the comment letters submitted during the rulemaking
process. After carefully considering all comments, the Commission
concluded that to comply with all requirements underlying the policies
and procedures required by Rule 1001(a) and (b), other than paperwork
burdens, on average, each SCI entity will incur an initial cost of
between approximately $320,000 and $2.4 million and an ongoing annual
cost of between approximately $213,600 and $1.6 million.\756\ Adjusted
for inflation since 2014, the initial cost would be between
approximately $407,000 and $3.1 million, and the ongoing annual cost
would be between approximately $272,000 and $2.0 million.\757\
---------------------------------------------------------------------------

    \754\ See section IV.D.7. These are the estimated costs to
comply with Rule 1001(a) through (c). For purposes of this Economic
Analysis, there are two fewer entities than under the PRA analysis,
lowering these estimated costs. See supra note 700.
    \755\ According to the 2014 adopting release, these non-PRA
compliance costs include, for example, establishing current and
future capacity planning estimates, capacity stress testing,
reviewing and keeping current systems development and testing
methodology, regular reviews and testing to detect vulnerabilities,
testing of all SCI systems and changes to SCI systems prior to
implementation, implementing a system of internal controls,
implementing a plan for assessments of the functionality of SCI
systems, implementing a plan of coordination and communication
between regulatory and other personnel of the SCI entity, including
by responsible SCI personnel, designed to detect and prevent systems
compliance issues, and hiring additional staff. See SCI Adopting
Release, supra note 1, at 72416 n. 1939.
    \756\ Id.
    \757\ SEC inflation calculations are based on annual GDP price
index data from Table 1.1.4. in the National Income and Product
Accounts from the Bureau of Economic Analysis, and on inflation
projections from The Budget and Economic Outlook: 2023 to 2033,
published by the Congressional Budget Office in February 2023.
---------------------------------------------------------------------------

    In the 2014 adopting release, the Commission acknowledged that its
cost estimates reflect a high degree of uncertainty because the
compliance costs may depend on the complexity of SCI entities' systems
(e.g., the compliance costs will be higher for SCI entities with more
complex systems). The initial compliance costs associated with Rule
1001 could also vary across SCI entities depending on the degree of
that their current practices are already consistent with the
requirements of Rule 1001.\758\ The Commission explained the difficulty
of gauging the degree to which an SCI entity was already taking
measures consistent with Regulation SCI, which would affect the
compliance costs with respect to Rule 1001. These considerations
continue to apply to the Commission's estimate of any non-PRA costs for
new SCI entities, which span multiple markets and vary a great deal in
terms of the services they provide and the operations they perform.
These new SCI entities face different baselines depending on the
applicable regulatory requirements that they are subject to and the
market practices each SCI entity has been following.
---------------------------------------------------------------------------

    \758\ These estimates in the SCI Adopting Release were in turn
based on the preliminary estimates included in the SCI Proposing
Release, supra note 14, at 18171. However, one important assumption
the SCI Proposing Release made was to assume that certain SCI
entities ``already [had or had] begun implementation of business
continuity and disaster recovery plans that include maintaining
backup and recovery capabilities sufficiently resilient and
geographically diverse to ensure next business day resumption of
trading and two-hour resumption of clearance and settlement services
following a wide-scale disruption.'' Id. at note 633. In the SCI
Adopting Release, however, in order to accommodate the cost
considerations of those SCI entities that did not already have
geographically diverse backup facilities, the Commission estimated
the average cost to be approximately $1.5 million annually for such
SCI entities. See SCI Adopting Release, supra note 1, at 72420. In
the section discussing Rule 1001(a)(2)(v) below, the Commission
estimates the comparable estimate to be between $1.5 million and
$1.8 million. This additional estimate range only applies to SCI
entities that do not already have geographically diverse backup
facilities and would be in addition to the non-paperwork burden
estimates discussed in the current section.
---------------------------------------------------------------------------

    Given these considerations, the Commission believes that the
estimates from 2014 are still appropriate estimates for the non-PRA
costs associated with Rule 1001(a) and (b) of Regulation SCI without
the proposed amendments for the new SCI entities. There are reasons to
believe that these ranges should be increased for inflation \759\ and
technological changes since 2014, such as greater interconnectivity,
that have expanded the scope for testing, leading to greater costs.
However, there are also reasons to believe that as of 2023 these ranges
may have come down.
---------------------------------------------------------------------------

    \759\ For example, GDP Price Index data from the Bureau of
Economic Analysis (BEA) and projections from the Congressional
Budget Office show that, economy-wide, prices increased by about 27%
from 2014 to 2023.
---------------------------------------------------------------------------

    First, some components of costs may be lower in 2023 because of
technological improvements since 2014.\760\ Second, the experience of
the current 47 SCI entities complying with Regulation SCI since 2014
has likely generated a useful industry knowledge base for new SCI
entities, including common practices, industry standards, and cost-
saving measures. From this perspective, the cost of learning would be
lower, including the start-up cost. Third, the Commission understands
that many financial institutions that are not subject to Regulation SCI
have voluntarily begun to conform to one or more industry standards and
adopted written policies and procedures related to ensuring capacity,
integrity, resiliency, availability, and security of their systems.
Indeed, the Commission understands--based on the Commission's
discussions with industry participants--that the changes in the
market--including greater automation and interconnectivity and an
overall need to expand the scope of testing--have already incentivized
many SCI entities to improve their internal protocols and to increase
their technology expenditures. For example, the growing risk of
cybersecurity events has already led many corporate executives to
significantly increase their cybersecurity budgets.\761\ From this
perspective, although the overall security and IT spending may have
increased manifold for SCI entities over the years, the Commission
estimates that the magnitude of compliance costs owing to the adoption
of Regulation SCI

for new SCI entities, over and above their current expenses, may not
necessarily have increased significantly as a result since 2014.
---------------------------------------------------------------------------

    \760\ See Matt Rosoff, Why is Tech Getting Cheaper?, weforum.org
(Oct. 16, 2015), available at https://www.weforum.org/agenda/2015/10/why-is-tech-getting-cheaper/. For example, price has been
dropping for cloud computing services over the last years. See Jean