these breach notifications would be required to include a summary
description of the systems or data breach, including a description of
the corrective action taken and when the systems or data breach was or
is expected to be resolved. This requirement mirrors the information
dissemination requirement in Rule 1002(c)(2) of Regulation SCI for
systems intrusions. Notably, in contrast to other types of ``SCI
events'' for which more detailed information is required to be
disseminated, only summary descriptions are required for systems
intrusions under Regulation SCI. The Commission recognizes that
information relating to systems or data breaches in many cases may be
sensitive and could raise security concerns, and thus preliminarily
believes that it is appropriate that the required breach notifications
be provided in a summary form. Even so, the proposal would still
require a summary description of the systems or data breach, which
would be required to describe the impacted data, and which must also
include a description of the corrective action taken and when the
systems or data breach has been or is expected to be resolved.
    In addition, as proposed, the Plan Processor would be allowed to
delay breach notifications ``if the Plan Processor determines that
dissemination of such information would likely compromise the security
of the CAT System or an investigation of the systems or data breach,
and documents the reasons for such determination,'' which mirrors the
similar provision in Rule 1002(c)(2) of Regulation SCI. The Commission
preliminarily believes this proposed provision is appropriate so that
breach notifications do not expose the CAT System to greater security
risks or compromise an investigation into the breach. The proposal
would require the affirmative documentation of the reasons for the Plan
Processor's determination to delay a breach notification, which would
help prevent the Plan Processor from improperly invoking this
exception. In addition, the breach notification may only be
temporarily, rather than indefinitely, delayed; once the reasons for
the delay no longer apply, the Plan Processor must provide the
appropriate breach notification to affected CAT Reporters, the
Participants, and the Commission.
    Finally, proposed Appendix D, Section 4.1.5 of the CAT NMS Plan
would provide an exception to the requirement for breach notifications
for systems or data breaches ``that the Plan Processor reasonably
estimates would have no or a de minimis impact on the Plan Processor's
operations or on market participants'' (``de minimis breach''), which
also mirrors the Commission's approach relating to information
dissemination for de minimis SCI events under Rule 1002(c) of
Regulation SCI. Importantly, the Plan Processor would be required to
document all information relevant to a breach the Plan Processor
believes to be de minimis. The Plan Processor should have all the
information necessary should its initial determination that a breach is
de minimis prove to be incorrect, so that it could promptly provide
breach notifications as required. In addition, maintaining
documentation for all breaches, including de minimis breaches, would be
helpful in identifying patterns among systems or data breaches.\400\
---------------------------------------------------------------------------

    \400\ Importantly, the proposed exception to breach
notifications for de minimis breaches would apply specifically to
the proposed breach notification requirement under the CAT NMS Plan.
It would not apply to any obligations of the Plan Processor with
respect to Regulation SCI, and thus, for example, would not obviate
the need for the Plan Processor to immediately share information for
all SCI events, including systems or data breaches that are systems
intrusions, with those SCI SROs for which the CAT System is an SCI
system and which themselves are independently subject to Regulation
SCI.
---------------------------------------------------------------------------

    The Commission requests comment on the proposed amendments to the
breach management policies and procedures. Specifically, the Commission
solicits comment on the following:
    166. Are the proposed modifications to the breach notification
provision of the CAT NMS Plan necessary and appropriate? Should
specific methods of notifying affected CAT Reporters, the Participants,
and the Commission be required? Should specific corrective action
measures be required, such as the provision of credit monitoring
services to impacted parties or rotation of CCIDs in the event of a
breach of CAT Data? If so, under what circumstances should such
corrective actions be required?
    167. Should the Plan Processor be required to provide breach
notifications of systems or data breaches to CAT Reporters that it
reasonably estimates may have been affected, as well as to the
Participants and the Commission? Is it necessary and appropriate to
require such breach notifications promptly after any responsible Plan
Processor personnel have a reasonable basis to conclude that a systems
or data breach has occurred? Should any disclosure to the public be
required? For example, should breach notifications of systems or data
breaches be reported by the Plan Processor on a publicly accessible
website (such as the CAT NMS Plan website)? Should other requirements
or direction regarding the breach notifications be adopted? Should
there be an exception for de minimis breaches?
    168. Is it reasonable to require that breach notifications be part
of the formal cyber incident response plan? Should any currently
optional items of the cyber incident response plan be required to be in
the cyber incident response plan?
    169. The proposed modifications to the breach notification
provision of the CAT NMS Plan are modeled, in part, after Regulation
SCI. Should other industry standards or objective criteria (e.g., NIST)
be used to determine when and how breach notifications will be
required?

K. Firm Designated ID and Allocation Reports

    Prior to approval of the CAT NMS Plan, the Commission granted
exemptive relief to the SROs, for, among other things, relief related
to allocations of orders.\401\ Specifically, the Commission, pursuant
to Section 36(a)(1) of the Act,\402\ exempted the SROs from Rule
613(c)(7)(vi)(A),\403\ which requires the Participants to require each
CAT Reporter to record and report the account number for any
subaccounts to which an execution is allocated. As a condition to this
exemption, the SROs must require that

(i) CAT Reporters submit an ``Allocation Report'' to the Central
Repository, which would at minimum contain several elements, including
the unique firm-designated identifier assigned by the broker-dealer of
the relevant subaccount (i.e., the Firm Designated ID), and (ii) the
Central Repository be able to link the subaccount holder to those with
authority to trade on behalf of the account.\404\ This approach was
incorporated in the CAT NMS Plan that was approved by the
Commission.\405\
---------------------------------------------------------------------------

    \401\ See Securities and Exchange Act Release No. 77265 (March
1, 2016), 81 FR 11856 (March 7, 2016) (``2016 Exemptive Order'').
    \402\ 15 U.S.C. 78mm(A)(1).
    \403\ 17 CFR 242.613(c)(7)(vi)(A).
    \404\ See 2016 Exemptive Order, supra note 401, at 11868.
    \405\ See, e.g., CAT NMS Plan, supra note 3, at Section 1.1
(defining ``Allocation Report'') and Section 6.4(d)(ii)(A)(i)
(requiring an Allocation Report if an order is executed in whole in
or in part).
---------------------------------------------------------------------------

    Under the Allocation Report approach there is no direct link in the
Central Repository between the subaccounts to which an execution is
allocated and the execution itself. Instead, CAT Reporters are required
to report the Firm Designated ID of the relevant subaccount on an
Allocation Report, which could be used by the Central Repository to
link the subaccount holder to those with authority to trade on behalf
of the account. However, the Commission believes that because the CAT
NMS Plan does not currently explicitly require Customer and Account
Attributes be reported for Firm Designated IDs that are submitted in
Allocation Reports, as it does for Firm Designated IDs associated with
the original receipt or origination of an order, there is a potential
for confusion with regard to reporting requirements for Firm Designated
IDs.
    The Commission proposes to amend Section 6.4(d)(ii)(C) of the CAT
NMS Plan to require that Customer and Account Attributes be reported
for Firm Designated IDs submitted in connection with Allocation
Reports, and not just for Firm Designated IDs submitted in connection
with the original receipt or origination of an order. Specifically, the
Commission proposes to amend Section 6.4(d)(ii)(C) of the CAT NMS Plan
to state that each Participant shall, through its Compliance Rule,
require its Industry Members to record and report, for original receipt
or origination of an order and Allocation Reports, the Firm Designated
ID for the relevant Customer, and in accordance with Section
6.4(d)(iv), Customer and Account Attributes for the relevant Customer.
    The Commission believes that if Industry Members do not provide
Customer and Account Attributes for the relevant Firm Designated ID
submitted in an Allocation Report, then there would be no ability for
the Central Repository to link the subaccount holder to those with
authority to trade on behalf of the account. The Commission
preliminarily believes that amending the language in Section
6.4(d)(ii)(C) to implement the previously approved exemptive relief is
appropriate.
    In addition, the Commission believes that these proposed amendments
do not substantively change the obligations of Industry Members, who,
through Participant Compliance Rules, are already required to submit
customer information for all Active Accounts pursuant to the CAT NMS
Plan.\406\ Specifically, Section 6.5(d)(iv) states that Participant
Compliance Rules must require Industry Members to, among other things,
submit an initial set of Customer information required in Section
6.4(d)(ii)(C) for Active Accounts to the Central Repository upon the
Industry Member's commencement of reporting, and submit updates,
additions or other changes on a daily basis for all Active Accounts.
Active Accounts are defined as ``an account that has activity in
Eligible Securities within the last six months,'' and the Commission
believes that ``activity'' would include the allocation of shares to an
account, reflected in Allocation Reports.\407\ Thus, Section 6.5(d)(iv)
already requires the information required by proposed Section
6.4(d)(ii)(C), but the Commission preliminarily believes that amending
the language in Section 6.4(d)(ii)(C) would help avoid confusion
regarding when Customer and Account Attributes are required to be
submitted for Firm Designated IDs.
---------------------------------------------------------------------------

    \406\ See CAT NMS Plan, supra note 3, at Section 6.4(d)(ii)(C).
    \407\ Section 6.5(d)(iv) of the CAT NMS Plan was amended in the
CAT NMS Plan Approval Order ``to clarify that each Industry Member
must submit an initial set of customer information for Active
Accounts at the commencement of reporting to the Central Repository,
as well as any updates, additions, or other changes in customer
information, including any such customer information for any new
Active Accounts.'' See CAT NMS Plan Approval Order, supra note 3, at
84868-69.
---------------------------------------------------------------------------

    170. Is it reasonable and appropriate to clarify that Industry
Members, for Allocation Reports, are required to report the Firm
Designated ID for the relevant Customer, and in accordance with Section
6.4(d)(iv) of the CAT NMS Plan, Customer Account Information and
Customer Identifying Information for the relevant Customer?

L. Appendix C of the CAT NMS Plan

    Rule 613(a) \408\ required the Participants to discuss various
considerations related to how the Participants propose to implement the
requirements of the CAT NMS Plan, cost estimates for the proposed
solution, and the costs and benefits of alternate solutions considered
but not proposed.\409\ Appendix C of the CAT NMS Plan generally
contains a discussion of the considerations enumerated in Rule
613,\410\ which were required to be addressed when the CAT NMS Plan was
filed with the Commission, prior to becoming effective.\411\ The Rule
613 Adopting Release stated that the additional information and
analysis generated by discussing these considerations was intended to
ensure that the Commission and the Participants had sufficiently
detailed information to carefully consider all aspects of the NMS plan
that would ultimately be submitted by the Participants.\412\ Therefore
the Commission believes that the discussion of these considerations was
not intended to be continually updated once the CAT NMS Plan was
approved.\413\ However, in addition to the discussion of
considerations, Appendix C of the CAT NMS Plan also contains provisions
such as those that set forth objective milestones with required
completion dates to assess the Participants' progress toward the
implementation of the CAT.\414\ Therefore, the Commission proposes to
amend Appendix C of the CAT NMS Plan to insert introductory language to
clarify that Appendix C has not been updated to reflect subsequent
amendments to the CAT NMS Plan and Appendix D.\415\
---------------------------------------------------------------------------

    \408\ 17 CFR 242.613(a).
    \409\ See Rule 613 Adopting Release, supra note 2, at 45789.
    \410\ 17 CFR 242.613(a)(1).
    \411\ See Rule 613 Adopting Release, supra note 2, at 45789-90.
    \412\ See id.
    \413\ See id. The CAT NMS Plan was approved on November 15,
2016. See supra note 3.
    \414\ See Appendix C of the CAT NMS Plan, at Section C.10.
    \415\ See proposed Appendix C.
---------------------------------------------------------------------------

M. Proposed Implementation

    As discussed below, the Commission proposes to allow additional
time beyond the effective date for the Participants to comply with
certain requirements in the proposed amendments.
1. Proposed 90-Day Implementation Period
    The Commission proposes that requirements related to developing and
implementing certain policies and procedures, design specifications,
and changes to logging in the proposed amendments must be met no later
than

90 days from the effective date of the amendment. Specifically, the
Commission believes that this timeframe would provide sufficient time
for the Participants to collectively develop and approve the Proposed
Confidentiality Policies \416\ pursuant to proposed Section 6.5(g)(i),
as well as to develop and establish their own procedures and usage
restrictions related to these policies. The Commission also believes
that a 90-day timeframe would provide sufficient time for the Plan
Processor to implement SAW-specific policies and procedures for the
CISP \417\ pursuant to proposed Sections 6.12 and 6.13(a), and to
develop detailed design specifications for the SAWs \418\ pursuant to
proposed Section 6.13(b), because the Plan Processor is already
familiar with the security requirements necessary to protect CAT Data
and would merely be extending these requirements to the SAWs for the
purposes of implementation and creating a roadmap for Participants to
follow via the design specifications. In addition, the Commission
believes that the 90-day timeframe would provide sufficient time for
the Plan Processor to make necessary programming changes to implement
the new logging requirements contained in proposed Appendix D, Section
8.1.1.
---------------------------------------------------------------------------

    \416\ See Part II.G.1-2 supra.
    \417\ See Part II.C.2-3 supra.
    \418\ See Part II.C.4 supra.
---------------------------------------------------------------------------

2. Proposed 120-Day Implementation Period
    The Commission proposes that requirements related to the Plan
Processor providing the SAWs to Participants \419\ contained in
proposed Section 6.1(d)(v) must be met no later than 120 days from the
effective date of the amendment. The Commission believes that this
timeframe would provide sufficient time for the Plan Processor to
establish the Participants' SAWs because the Plan Processor has already
been authorized to build similar environments for some of the
Participants since November 2019.\420\ In addition, to the extent that
the Plan Processor has already developed design specifications and
implemented the policies and procedures for the SAWs within the 90-day
timeframe following the effective date of the amendment, the Plan
Processor will already have achieved interim elements of SAW
implementation.
---------------------------------------------------------------------------

    \419\ See Part II.C.2 supra.
    \420\ See supra note 52 and accompanying text.
---------------------------------------------------------------------------

3. Proposed 180-Day Implementation Period
    The Commission proposes that requirements related to the
Participants complying with SAW access and usage \421\ pursuant to
proposed Section 6.13(a), or having received an exception,\422\
pursuant to proposed Section 6.13(d), must be met no later than 180
days from the effective date of the amendment. The Commission believes
that this timeframe would provide sufficient time for the Participants
to (1) build internal architecture for their SAWs and customize their
SAWs with the desired analytical tools, (2) import external data into
their SAWs as needed, and (3) demonstrate their compliance with the SAW
design specifications. The Commission also believes that this timeframe
would provide sufficient time for Participants seeking an exception
from the requirement to use the SAW to access CAT Data through the
user-defined direct query and bulk extract tools to go through the
required process. Specifically, these Participants would have 30 days
after the SAW design specifications have been provided to prepare their
application materials for submission to the Plan Processor's CISO, CCO,
and the Security Working Group. Then, the CISO and CCO would be
required to issue a determination to the requesting Participant within
60 days of receiving the application materials, with the result that
the requesting Participant should have a response by the compliance
date 180 days from the effective date of the amendment.
---------------------------------------------------------------------------

    \421\ See Parts II.C.2 and II.C.4 supra.
    \422\ See Part II.C.5 supra.
---------------------------------------------------------------------------

    The Commission requests comment on the proposed implementation
timeframes. Specifically, the Commission solicits comment on the
following:
    171. Does the proposed 90-day implementation period with respect to
the requirement for the Participants to develop and approve the
Proposed Confidentiality Policies strike an appropriate balance between
timely implementation and the time needed for the Participants to
develop these policies and related procedures?
    172. Does the proposed 90-day implementation period with respect to
the requirement for the Plan Processor to implement SAW-specific
policies and procedures for the CISP and to develop detailed design
specifications for the SAWs strike an appropriate balance between
timely implementation and the time needed for the Plan Processor to
complete these tasks? Does the proposed 90-day implementation period
with respect to the requirement for the Plan Processor to make
programming changes to implement the new logging requirements strike an
appropriate balance between timely implementation and the time needed
for the Plan Processor to complete the necessary coding to its systems?
    173. Does the proposed 120-day implementation period with respect
to the requirement for the Plan Processor to provide the SAWs to
Participants strike an appropriate balance between timely
implementation and the time needed for the Plan Processor to achieve
implementation of the SAWs?
    174. Does the proposed 180-day implementation period with respect
to the requirements for the Participants to either comply with SAW
access and usage, or receive an exception, strike an appropriate
balance between timely implementation and the time needed for the
Participants to either complete their components of the SAW, or seek
and receive an exception from the CISO and CCO?

N. Application of the Proposed Amendments to Commission Staff

    The Commission takes very seriously concerns about maintaining the
security and confidentiality of CAT Data and believes that it is
imperative that all CAT users, including the Commission, implement and
maintain a robust security framework with appropriate safeguards to
ensure that CAT Data is kept confidential and used only for
surveillance and regulatory purposes. However, the Commission is not a
party to the CAT NMS Plan.\423\ By statute, the Commission is the
regulator of the Participants, and the Commission oversees and enforces
their compliance with the CAT NMS Plan.\424\ To impose obligations on
the Commission under the CAT NMS Plan would invert this structure,
raising questions about the Participants monitoring their own
regulator's compliance with the CAT NMS Plan.\425\ Accordingly, the
Commission does not believe that it is appropriate for its security and
confidentiality obligations, or those of its personnel, to be reflected
through CAT NMS Plan provisions. Accordingly, the Commission is not
including its staff within the definition of Regulatory Staff in the
proposed amendments. Rather, the obligations of the Commission and

its personnel with respect to the security and confidentiality of CAT
Data should be reflected through different mechanisms from those of the
Participants. The Commission reiterates that in each instance the
purpose of excluding Commission personnel from these provisions is not
to subject the Commission or its personnel to more lenient data
security or confidentiality standards. Despite these differences in the
origins of their respective obligations, the rules and policies
applicable to the Commission and its personnel will be comparable to
those applicable to the Participants and their personnel.\426\
---------------------------------------------------------------------------

    \423\ See 17 CFR 242.608(a)(1) (stating that NMS plans are filed
by two or more SROs).
    \424\ See 17 CFR 242.608(b)(2), (c), (d); 17 CFR 242.613(b).
    \425\ See CAT NMS Plan Approval Order, supra note 3, at 84764-
65.
    \426\ See id. at 84765. In addition, Commission and SEC staff
are subject to federal and Commission rules and policies that
address security and confidentiality obligations. For example,
disclosure or misuse of CAT Data would potentially subject
Commission personnel to criminal penalties (including fines and
imprisonment), disciplinary action (including termination of
employment), civil injunction, and censure by professional
associations for attorneys and accountants. Id.
---------------------------------------------------------------------------

    Consistent with the CAT Approval Order,\427\ a cross-divisional
steering committee of senior Commission Staff was formed that has
designed and continue to maintain comparable policies and procedures
regarding Commission and Commission Staff access to, use of, and
protection of CAT Data. These policies and procedures also must comply
with the Federal Information Security Modernization Act of 2014 and the
NIST standards required thereunder,\428\ and are subject to audits by
the SEC Office of Inspector General and the Government Accountability
Office. The Commission will review and update, as necessary, its
existing confidentiality and data use policies and procedures to
account for access to the CAT, and, like the Participants, will
periodically review the effectiveness of these policies and procedures
and take prompt action to remedy deficiencies in such policies and
procedures.
---------------------------------------------------------------------------

    \427\ See id. at 84765.
    \428\ See id. See also Public Law 113-283 (Dec. 18, 2014); NIST,
Security and Privacy Controls for Federal Information Systems and
Organizations, Special Publication 800-53, revision 4 (Gaithersburg,
Md.: April 2013); NIST, Contingency Planning Guide for Federal
Information Systems, Special Publication 800-34, revision 1
(Gaithersburg, Md.: May 2010).
---------------------------------------------------------------------------

    For example, with respect to restrictions on the use of Manual and
Programmatic CCID Subsystem and CAIS Access, the Commission intends to
have comparable policies and restrictions as the Participants but as
adopted and enforced by the Commission. In addition, under the
restrictions set forth in the proposed amendments, Commission personnel
would also be permitted to extract only the minimum amount of CAT Data
necessary to achieve a specific surveillance or regulatory purpose--
which could include supporting discussions with a regulated entity
regarding activity that raises concerns, filing a complaint against a
regulated entity, or supporting an investigation or examination of a
regulated entity. Consistent with what the Commission stated when the
CAT NMS Plan was approved, the Commission will ensure that its policies
and procedures impose protections upon itself and its personnel that
are comparable to those required under the proposed provisions in the
CAT NMS Plan from which the Commission and its personnel are excluded,
which includes reviewing and updating, as necessary, existing
confidentiality and data use policies and procedures.\429\
---------------------------------------------------------------------------

    \429\ See id. at 84765-66.
---------------------------------------------------------------------------

III. Paperwork Reduction Act

    As discussed above, the Commission is proposing to make various
changes to the CAT NMS Plan, and certain provisions of the proposed
amendment contain ``collection of information requirements'' within the
meaning of the Paperwork Reduction Act of 1995 (``PRA'').\430\ The
Commission is requesting public comment on the new collection of
information requirements in this proposed amendment to the CAT NMS
Plan. The Commission is submitting these collections of information to
the Office of Management and Budget (``OMB'') for review in accordance
with 44 U.S.C. 3507(d) and 5 CFR 1320.11.\431\ An agency may not
conduct or sponsor, and a person is not required to respond to, a
collection of information unless the agency displays a currently valid
control number.\432\ The title of the new collection of information is
``CAT NMS Plan Data Security Amendments.''
---------------------------------------------------------------------------

    \430\ 44 U.S.C. 3501 et seq.
    \431\ 44 U.S.C. 3507; 5 CFR 1320.11.
    \432\ 5 CFR 1320.11(l).
---------------------------------------------------------------------------

A. Summary of Collections of Information

    The proposed amendments to the CAT NMS Plan include several
obligations that would require a collection of information within the
meaning of the PRA.
1. Evaluation of the CISP
    The CAT NMS Plan currently requires the CCO to oversee the regular
written assessment of the Plan Processor's performance, which must be
provided to the Commission at least annually and which must include an
evaluation of the existing information security program ``to ensure
that the program is consistent with the highest industry standards for
the protection of data.'' \433\ The proposed amendments would require
the CCO to evaluate the newly-defined CISP. This change would newly
require the CCO to evaluate elements of the CISP that relate to the
SAWs provided by the Plan Processor.\434\ The proposed amendments would
also require the CCO, in collaboration with the CISO, to include in
this evaluation a review of the quantity and type of CAT Data extracted
from the CAT System to assess the security risk of permitting such CAT
Data to be extracted and to identify any appropriate corrective
measures.\435\ The Participants, under the existing provisions of the
CAT NMS Plan, would be entitled to review and comment on these new
elements of the written assessment of the Plan Processor's
performance.\436\
---------------------------------------------------------------------------

    \433\ See Section 6.6(b)(i)(A)-(B); Section 6.6(b)(ii)(B)(3).
    \434\ See id.; see also proposed Section 1.1, definition of
``Comprehensive Information Security Program'' and ``Secure
Analytical Workspace.'' The Commission preliminarily believes that
all other elements of the CISP are currently required by the CAT NMS
Plan.
    \435\ See proposed Section 6.6(b)(ii)(B)(3). These requirements
are also enshrined in proposed Section 6.2. See also proposed
Section 6.2(a)(v)(T) (requiring the CCO to determine, pursuant to
Section 6.6(b)(ii)(B)(3), to review CAT Data that has been extracted
from the CAT System to assess the security risk of allowing such CAT
Data to be extracted); proposed Section 6.2(b)(x) (requiring the
CISO to determine, pursuant to Section 6.6(b)(ii)(B)(3), to review
CAT Data that has been extracted from the CAT System to assess the
security risk of allowing such CAT Data to be extracted).
    \436\ See CAT NMS Plan, supra note 3, at Section 6.6(b)(i)(B).
---------------------------------------------------------------------------

2. Security Working Group
    The proposed amendments would require the Security Working Group to
advise the CISO and the Operating Committee, including with respect to
issues involving: (1) Information technology matters that pertain to
the development of the CAT System; (2) the development, maintenance,
and application of the CISP; (3) the review and application of the
confidentiality policies required by proposed Section 6.5(g); (4) the
review and analysis of third-party risk security assessments conducted
pursuant to Section 5.3 of Appendix D, including the review and
analysis of results and corrective actions arising from such
assessments; and (5) emerging cybersecurity topics.\437\ The proposed
amendments would also require the CISO to apprise the Security Working
Group of relevant developments and to provide it with all

information and materials necessary to fulfill its purpose.\438\
---------------------------------------------------------------------------

    \437\ See proposed Section 4.12(c).
    \438\ See id.
---------------------------------------------------------------------------

3. SAWs
    There are a number of information collections related to the
proposed SAW requirements, including collections related to the
following categories: (a) Policies, Procedures, and Detailed Design
Specifications; (b) Implementation and Operation Requirements; and (c)
Non-SAW Environment Requirements. These collections are explained in
more detail below.
a. Policies, Procedures, and Detailed Design Specifications
    The proposed definition for the CISP would define the scope of the
existing information security program. However, the proposed amendments
would add one new element to this information security program or
CISP--the SAWs provided by the Plan Processor.\439\ The proposed
amendments would therefore require the Plan Processor to develop and
maintain a CISP that would include SAWs \440\ and, more specifically,
that would include data access and extraction policies and procedures
and security controls, policies, and procedures for SAWs.\441\
---------------------------------------------------------------------------

    \439\ See proposed Section 1.1, definition of ``Comprehensive
Information Security Program'' and ``Secure Analytical Workspace.''
    \440\ See proposed Section 6.12. The Commission preliminarily
believes that all other elements of the CISP are currently required
by the CAT NMS Plan.
    \441\ See proposed Section 6.13(a).
---------------------------------------------------------------------------

    In addition, the proposed amendments would require the Plan
Processor to develop, maintain, and make available to the Participants
detailed design specifications for the technical implementation of the
access, monitoring, and other controls required for SAWs by the CISP.
b. Implementation and Operation Requirements
    The proposed amendments would require the Plan Processor to notify
the Operating Committee that each Participant's SAW has achieved
compliance with the detailed design specifications required by proposed
Section 6.13(b)(i) before that SAW may connect to the Central
Repository.\442\
---------------------------------------------------------------------------

    \442\ See proposed Section 6.13(b)(ii).
---------------------------------------------------------------------------

    The proposed amendments would also require the Plan Processor to
monitor each Participant's SAW in accordance with the detailed design
specifications developed pursuant to proposed Section 6.13(b)(i), for
compliance with the CISP and the detailed design specifications only,
and to notify the Participant of any identified non-compliance with the
CISP or the detailed design specifications.\443\
---------------------------------------------------------------------------

    \443\ See proposed Section 6.13(c)(i).
---------------------------------------------------------------------------

c. Non-SAW Environments
    There are a number of information collections related to the
proposed requirements for non-SAW environments, including collections
related to the following categories: (i) Application Materials; (ii)
Exception Determinations; and (iii) Non-SAW Implementation and
Operation Requirements. These collections are explained in more detail
below.
i. Application Materials
    The proposed amendments would require the Participant requesting an
exception from the proposed SAW usage requirements to provide the CISO,
the CCO, the members of the Security Working Group (and their
designees), and Commission observers of the Security Working Group with
various application materials. First, the Participant would be required
to provide a security assessment of the non-SAW environment, conducted
within the prior twelve months by a named, independent third party
security assessor, that (a) demonstrates the extent to which the non-
SAW environment complies with the NIST SP 800-53 security controls and
associated policies and procedures required by the CISP pursuant to
Section 6.13(a)(ii), (b) explains whether and how the Participant's
security and privacy controls mitigate the risks associated with
extracting CAT Data to the non-SAW environment through the user-defined
direct query or bulk extract tools described in Section 6.10(c)(i)(B)
and Appendix D, Section 8.2 of the CAT NMS Plan, and (c) includes a
Plan of Action and Milestones document detailing the status and
schedule of any corrective actions recommended by the assessment.\444\
Second, the Participant would be required to provide detailed design
specifications for the non-SAW environment demonstrating: (a) The
extent to which the non-SAW environment's design specifications adhere
to the design specifications developed by the Plan Processor for SAWs
pursuant to proposed Section 6.13(b)(i), and (b) that the design
specifications will enable the operational requirements set forth for
non-SAW environments in proposed Section 6.13(d)(iii), which include,
among other things, Plan Processor monitoring.\445\
---------------------------------------------------------------------------

    \444\ See proposed Section 6.13(d)(i)(A)(1).
    \445\ See proposed Section 6.13(d)(i)(A)(2).
---------------------------------------------------------------------------

    Under the proposed amendments, Participants who are denied an
exception or who want to apply for a continuance must submit a new
security assessment that complies with the requirements of proposed
Section 6.13(d)(i)(A)(1) and up-to-date versions of the materials
required by proposed Section 6.13(d)(i)(A)(2).\446\
---------------------------------------------------------------------------

    \446\ See proposed Section 6.13(d)(i)(C), (d)(ii)(C).
---------------------------------------------------------------------------

ii. Exception and Revocation Determinations
    The proposed amendments would require the CISO and the CCO to
review initial application materials submitted by requesting
Participants, in accordance with policies and procedures developed by
the Plan Processor, and to simultaneously notify the Operating
Committee and the requesting Participant of their determination.\447\
If the exception is granted, the proposed amendments would require the
CISO and the CCO to provide the requesting Participant with a detailed
written explanation setting forth the reasons for that
determination.\448\ For applications that are denied, the proposed
amendments would require the CISO and the CCO to specifically identify
the deficiencies that must be remedied before an exception could be
granted.\449\ The proposed amendments would also require the CISO and
the CCO to follow the same procedures when reviewing applications for a
continued exception and issuing determinations regarding those
applications.\450\
---------------------------------------------------------------------------

    \447\ See proposed Section 6.13(d)(i)(B).
    \448\ See proposed Section 6.13(d)(i)(B)(1).
    \449\ See proposed Section 6.13(d)(i)(B)(2).
    \450\ See proposed Section 6.13(d)(ii)(B).
---------------------------------------------------------------------------

    For Participants that are denied a continuance, or for Participants
that fail to submit the proper application materials, the CISO and the
CCO would also be required to revoke the exception and require such
Participants to cease using their non-SAW environments to access CAT
Data through the user-defined direct query and bulk extract tools
described in Section 6.10(c)(i)(B) and Appendix D, Section 8.2 of the
CAT NMS Plan, in accordance with the remediation timeframes developed
by the Plan Processor.\451\
---------------------------------------------------------------------------

    \451\ See proposed Section 6.13(d)(ii)(A), (C).
---------------------------------------------------------------------------

iii. Non-SAW Implementation and Operation Requirements
    The proposed amendments would prevent an approved Participant from
employing a non-SAW environment to access CAT Data through the user-

defined direct query or bulk extract tools described in Section
6.10(c)(i)(B) and Appendix D, Section 8.2 until the Plan Processor
notifies the Operating Committee that the non-SAW environment has
achieved compliance with the detailed design specifications submitted
by that Participant as part of its application for an exception (or
continuance).\452\
---------------------------------------------------------------------------

    \452\ See proposed Section 6.13(d)(iii)(A).
---------------------------------------------------------------------------

    The proposed amendments would also require the Plan Processor to
monitor the non-SAW environment in accordance with the detailed design
specifications submitted with the exception (or continuance)
application, for compliance with those detailed design specifications
only, and to notify the Participant of any identified non-compliance
with such detailed design specifications.\453\ Furthermore, the
proposed amendments would require the Participant to simultaneously
notify the Plan Processor, the members of the Security Working Group
(and their designees), and Commission observers of the Security Working
Group of any material changes to its security controls for the non-SAW
environment.\454\
---------------------------------------------------------------------------

    \453\ See proposed Section 6.13(d)(iii)(B).
    \454\ See proposed Section 6.13(d)(iii)(C).
---------------------------------------------------------------------------

4. Online Targeted Query Tool and Logging of Access and Extraction
    The CAT NMS Plan currently requires the targeted online query tool
to log submitted queries, query parameters, the user ID of the
submitter, the date and time of the submission, and the delivery of
results.\455\ The CAT NMS Plan further requires that the Plan Processor
provides monthly reports based on this information to each Participant
and the SEC of its respective metrics on query performance and data
usage, and that the Operating Committee receive the monthly reports to
review items, including user usage and system processing performance.
The Commission proposes to modify these requirements by defining the
term ``delivery of results'' as ``the number of records in the
result(s) and the time it took for the query to be performed'' and
requiring that access and extraction of CAT Data be logged.\456\ This
change would also require the same logging of access and extraction of
CAT Data from the user-defined direct queries and bulk extraction
tools.
---------------------------------------------------------------------------

    \455\ See CAT NMS Plan, supra note 3, at Appendix D, Section
8.1.1.
    \456\ See proposed Appendix D, Section 8.1.1.
---------------------------------------------------------------------------

5. CAT Customer and Account Attributes
    The CAT NMS Plan currently requires that Industry Members report a
Customer's SSN or ITIN as part of the information necessary for the
Plan Processor to create a Customer-ID.\457\ The Commission is
proposing to amend the Plan to modify the information that Industry
Members must report to CAT to be consistent with the CCID Alternative
for creating Customer-IDs outlined in the PII Exemption Request and the
PII Exemption Order. First, in lieu of reporting a Customer's SSN or
ITIN to CAT, the Commission is proposing that Industry Members would
use the CCID Transformation Logic \458\ in conjunction with an API
provided by the Plan Processor to transform their Customer's SSN/ITIN
using the CCID Transformation Logic to create a Transformed Value and
then report that Transformed Value to the CCID Subsystem.\459\ Once the
Transformed Value is reported to the CCID Subsystem, the CCID Subsystem
would perform another transformation of the Transformed Value to create
a globally unique Customer-ID for each Customer.
---------------------------------------------------------------------------

    \457\ See CAT NMS Plan, supra note 3, at Appendix D, Section 9.1
    \458\ The Commission is proposing that the CCID Transformation
Logic will be embedded in the CAT Reporter Portal or used by the
Industry Member in machine-to machine-processing. See proposed
Appendix D, Section 9.1.
    \459\ See proposed Section 6.4(D)(ii)(d), Appendix D, Section
9.1 and 9.2. See also notes 168-173, supra and accompanying text.
---------------------------------------------------------------------------

    The CAT NMS Plan currently requires the CCO to oversee the Regular
Written Assessment of the Plan Processor's performance, which must be
provided to the Commission at least annually and which must include an
evaluation of the performance of the CAT.\460\ As proposed, the overall
performance and design of the CCID Subsystem and the process for
creating Customer-ID(s) must be included in the annual Regular Written
Assessment of the Plan Processor, as required by Article VI, Section
6.6(b)(ii)(A).
---------------------------------------------------------------------------

    \460\ See CAT NMS Plan, supra note 3, Section 6.6(b)(ii)(A).
---------------------------------------------------------------------------

6. Customer Identifying Systems Workflow
    The CAT NMS Plan currently requires Industry Members to report PII
\461\ to the CAT, and states that such ``PII can be gathered using the
`PII workflow' described in Appendix D, Data Security, PII Data
Requirements.'' \462\ However, the ``PII workflow'' was neither defined
nor established in the CAT NMS Plan.\463\ The Commission is therefore
proposing to amend the CAT NMS Plan to define the PII workflow for
accessing Customer and Account Attributes, and to apply the existing
provisions of the CAT NMS Plan to Customer and Account Attributes going
forward.\464\
---------------------------------------------------------------------------

    \461\ See supra note 10.
    \462\ See CAT NMS Plan, supra note 3, at Appendix D, Section
4.1.6.
    \463\ Id.
    \464\ See Part II.F., supra and accompanying text for a complete
description of the Customer Identifying Systems Workflow.
---------------------------------------------------------------------------

    The current CAT NMS Plan requires that a full audit trail of PII
access (who accessed what data, and when) be maintained, and that the
CCO and the CISO have access to daily PII reports that list all users
who are entitled to PII access, as well as the audit trail of all PII
access that has occurred for the day.\465\ The Commission is proposing
to amend the Plan to require that the Plan Processor maintain a full
audit trail of access to Customer Identifying Systems by each
Participant and the Commission (who accessed what data within each
Participant, and when), and to require that the Plan Processor provide
to each Participant and the Commission the audit trail for their
respective users on a monthly basis. The CCO and the CISO will continue
to have access to daily reports that list all users who are entitled to
Customer Identifying Systems access, as is the case today; however, the
Commission is proposing that such reports also be provided to the
Operating Committee on a monthly basis.\466\
---------------------------------------------------------------------------

    \465\ See CAT NMS Plan, supra note 3, Appendix D, Section 4.1.6
(PII Data Requirements).
    \466\ See proposed Appendix D, Section 4.1.6.
---------------------------------------------------------------------------

    The proposed Customer Identifying Systems Workflow would permit
regulators to use Programmatic CAIS Access or Programmatic CCID
Subsystem Access to query those databases. The Commission is proposing
to require that each Participant submit an application that has been
approved by the Participant's Chief Regulatory Officer (or similarly
designated head(s) of regulation) to the Commission for authorization
to use Programmatic CAIS Access or Programmatic CCID Subsystem Access
if a Participant requires programmatic access. The application must
explain:
     Which programmatic access is being requested: Programmatic
CAIS Access and/or Programmatic CCID Subsystem Access;
     Why Programmatic CAIS Access or Programmatic CCID
Subsystem is required, and why Manual CAIS Access or Manual CCID
Subsystem Access cannot achieve the regulatory purpose of an inquiry or
set of inquiries;
     The Participant's rules that require Programmatic Access
for surveillance and regulatory purposes;
     The regulatory purpose of the inquiry or set of inquires
requiring programmatic access;

     A detailed description of the functionality of the
Participant's SAW system(s) that will use data from CAIS or the CCID
Subsystem;
     A system diagram and description indicating architecture
and access controls to the Participant's SAW system(s) that will use
data from CAIS or the CCID Subsystem; and
     The expected number of users of the Participant's
system(s) that will use data from CAIS or the CCID Subsystem.
7. Proposed Confidentiality Policies, Procedures and Usage Restrictions
    The Commission is proposing to amend Section 6.5(g)(i) of the CAT
NMS Plan to require the Participants to create and maintain identical
confidentiality and related policies (``Proposed Confidentiality
Policies''). Proposed Section 6.5(g)(i) would require each Participant
to establish, maintain and enforce procedures and usage restriction
controls in accordance with the Proposed Confidentiality Policies. As
proposed, the Proposed Confidentiality Policies must: (i) Be reasonably
designed to (1) ensure the confidentiality of the CAT Data; and (2)
limit the use of CAT Data to solely surveillance and regulatory
purposes; (ii) limit extraction of CAT Data to the minimum amount of
data necessary to achieve a specific surveillance or regulatory
purpose; (iii) limit access to CAT Data to persons designated by
Participants, who must be (1) Regulatory Staff or (2) technology and
operations staff that require access solely to facilitate access to and
usage of the CAT Data by Regulatory Staff; \467\ (iv) implement
effective information barriers between such Participants' Regulatory
Staff and non-Regulatory Staff with regard to access and use of CAT
Data; (v) limit access to CAT Data by non-Regulatory Staff, by allowing
such access only where there is a specific regulatory need for such
access and requiring that a Participant's Chief Regulatory Officer (or
similarly designated head(s) of regulation), or his or her designee,
document his or her written approval of each instance of access by non-
Regulatory Staff; (vi) require that, in the absence of exigent
circumstances, all Participant staff who are provided access to CAT
Data, or have been provided access to CAT Data, must (1) sign a
``Safeguard of Information'' affidavit as approved by the Operating
Committee pursuant to Section 6.5(f)(i)(B); and (2) participate in the
training program developed by the Plan Processor that addresses the
security and confidentiality of information accessible in the CAT
pursuant to Section 6.1(m); (vii) define the individual roles and
regulatory activities of specific users; (viii) impose penalties for
staff non-compliance with Participants' or the Plan Processor's
policies or procedures with respect to information security, including,
the policies required by Section 6.5(g)(i); (ix) be reasonably designed
to implement and satisfy the Customer and Account Attributes data
requirements of Section 4.1.6 of Appendix D such that Participants must
be able to demonstrate that a Participant's ongoing use of Programmatic
CAIS and/or CCID Subsystem access is in accordance with the Customer
Identifying Systems Workflow; and (x) document monitoring and testing
protocols that will be used to assess Participant compliance with the
policies.
---------------------------------------------------------------------------

    \467\ The Commission proposes to define Regulatory Staff as the
Participant's Chief Regulatory Officer (or similarly designated
head(s) of regulation) and staff within the Chief Regulatory
Officer's (or similarly designated head(s) of regulation's)
reporting line. See proposed Section 1.1.
---------------------------------------------------------------------------

    Proposed Section 6.5(g)(ii) would require the Participant to
periodically review the effectiveness of the policies and procedures
and usage restriction controls required by Section 6.5(g)(i), including
by using the monitoring and testing protocols documented within the
policies pursuant to Section 6.5(g)(i)(J), and take prompt action to
remedy deficiencies in such policies, procedures and usage restriction
controls. In addition, proposed Section 6.5(g)(iii) would require that
each Participant, as reasonably practicable, and in any event within 24
hours of becoming aware, report to the Chief Compliance Officer, in
accordance with the guidance provided by the Operating Committee: (A)
any instance of noncompliance with the policies, procedures, and usage
restriction controls adopted by such Participant pursuant to Section
6.5(g)(i); or (B) a breach of the security of the CAT.
    Proposed Section 6.5(g)(iv) would require that that the Proposed
Confidentiality Policies be made publicly available on each of the
Participants' websites, or collectively on the CAT NMS Plan website,
redacted of sensitive proprietary information.\468\
---------------------------------------------------------------------------

    \468\ See proposed Section 6.5(g)(iv).
---------------------------------------------------------------------------

    Proposed Section 6.5(g)(v) would require that, on an annual basis,
each Participant engage an independent accountant to perform an
examination of compliance with the policies required by Section
6.5(g)(i) in accordance with attestation standards of the American
Institute of Certified Public Accountants (``AICPA'') (referred to as
U.S. Generally Accepted Auditing Standards or GAAS) or the Public
Company Accounting Oversight Board (``PCAOB''), and with Commission
independence standards based on SEC Rule 2-01 of Regulation S-X.\469\
In addition, the examination results shall be submitted to the
Commission upon completion, in a text-searchable format (e.g. a text-
searchable PDF). The examination report shall be considered submitted
to the Commission when electronically received by Commission staff at
the Commission's principal office in Washington DC.\470\
---------------------------------------------------------------------------

    \469\ See 17 CFR 210.2-01.
    \470\ See proposed Section 6.5(g)(v).
---------------------------------------------------------------------------

    The Commission proposes Sections 6.2(a)(v)(R) and 6.2(b)(viii) in
the CAT NMS Plan to require that both the CISO and CCO of the Plan
Processor be required to review the Proposed Confidentiality Policies.
In addition, the Commission proposes to require that the CCO of the
Plan obtain assistance and input from the Compliance Subcommittee,\471\
and require that the policies required by proposed Section 6.5(g)(i) of
the CAT NMS Plan be subject to review and approval by the Operating
Committee, after review by the CISO and CCO.\472\
---------------------------------------------------------------------------

    \471\ See proposed Section 6.2(a)(v)(R). The CAT NMS Plan
requires the Operating Committee to maintain a compliance
Subcommittee (the ``Compliance Subcommittee'') whose purpose shall
be to aid the Chief Compliance Officer as necessary. See CAT NMS
Plan, supra note 3, at Section 4.12(b).
    \472\ See proposed Section 6.5(g)(vi).
---------------------------------------------------------------------------

8. Secure Connectivity--``Allow Listing''
    The Commission is proposing to amend Appendix D, Section 4.1.1 of
the CAT NMS Plan to require ``allow listing.'' Specifically, the
Commission proposes to require that for all connections to CAT
infrastructure, the Plan Processor must implement capabilities to allow
access (i.e., ``allow list'') only to those countries where CAT
reporting or regulatory use is both necessary and expected. In
addition, proposed Appendix D, Section 4.1.1 would require, where
possible, more granular ``allow listing'' to be implemented (e.g., by
IP address). Lastly, the Plan Processor would be required to establish
policies and procedures to allow access if the source location for a
particular instance of access cannot be determined technologically.
9. Breach Management Policies and Procedures
    Appendix D, Section 4.1.5 of the CAT NMS Plan requires the Plan
Processor to

develop policies and procedures governing its responses to systems or
data breaches, including a formal cyber incident response plan, and
documentation of all information relevant to breaches.\473\ The CAT NMS
Plan further specifies that the cyber incident response plan will
provide guidance and direction during security incidents, but otherwise
states that the cyber incident response plan may include several
items.\474\ The Commission proposes to require that the formal cyber
incident response plan incorporate corrective actions and breach
notifications.\475\
---------------------------------------------------------------------------

    \473\ See CAT NMS Plan, supra note 3, at Appendix D, Section
4.1.5. The cyber incident response plan is subject to review by the
Operating Committee. See id.
    \474\ See CAT NMS Plan, supra note 3, at Appendix D, Section
4.1.5. The CAT NMS Plan also lists a series of items that
documentation of information relevant to breaches should include.
Id.
    \475\ See supra Part II.J.
---------------------------------------------------------------------------

    Specifically, the Commission is proposing to modify Appendix D,
Section 4.1.5 of the CAT NMS Plan to require that the formal cyber
incident response plan must include ``taking appropriate corrective
action that includes, at a minimum, mitigating potential harm to
investors and market integrity, and devoting adequate resources to
remedy the systems or data breach as soon as reasonably practicable.''
In addition, the Commission is proposing to modify Appendix D, Section
4.1.5 of the CAT NMS Plan to require the Plan Processor to provide
breach notifications of systems or data breaches to CAT Reporters that
it reasonably estimates may have been affected, as well as to the
Participants and the Commission, promptly after any responsible Plan
Processor personnel have a reasonable basis to conclude that a systems
or data breach has occurred. The Commission also proposes to state that
the cyber incident response plan must provide for breach notifications.
As proposed, these breach notifications would be required to include a
summary description of the systems or data breach, including a
description of the corrective action taken and when the systems or data
breach has been or is expected to be resolved.
    As proposed, the Plan Processor would be allowed to delay breach
notifications ``if the Plan Processor determines that dissemination of
such information would likely compromise the security of the CAT System
or an investigation of the systems or data breach, and documents the
reasons for such determination.'' The proposal would further require
affirmative documentation of the reasons for the Plan Processor's
determination to delay a breach notification. In addition, breach
notifications would not be required for systems or data breaches ``that
the Plan Processor reasonably estimates would have no or a de minimis
impact on the Plan Processor's operations or on market participants.''
\476\ For a breach that the Plan Processor believes to be a de minimis
breach, the Plan Processor would be required to document all
information relevant to such breach.
---------------------------------------------------------------------------

    \476\ See proposed Appendix D, Section 4.1.5.
---------------------------------------------------------------------------

10. Customer Information for Allocation Report Firm Designated IDs
    Proposed Section 6.4(d)(ii)(C) would explicitly require that
Customer and Account Attributes be reported for Firm Designated IDs
submitted in connection with Allocation Reports, and not just for Firm
Designated IDs submitted in connection with the original receipt or
origination of an order. Specifically, proposed Section 6.4(d)(ii)(C),
as amended, of the CAT NMS Plan would state that each Participant
shall, through its Compliance Rule, require its Industry Members to
record and report, for original receipt or origination of an order and
Allocation Reports, the Firm Designated ID for the relevant Customer,
and in accordance with Section 6.4(d)(iv), Customer and Account
Attributes for the relevant Customer.

B. Proposed Use of Information

1. Evaluation of the CISP
    The Commission preliminarily believes that the proposed review of
CAT Data extracted from the CAT System will facilitate Commission
oversight of the security risks posed by the extraction of CAT Data.
The proposed review would be part of the evaluation of the CISP
attached by the Participants to the written assessment of the Plan
Processor's performance and provided to the Commission at least
annually.\477\ The Commission preliminarily believes the proposed
review should enable the Commission to better assess whether the
current security measures should be enhanced or lightened and whether
any planned corrective measures are appropriate. The proposed
amendments require the CCO to evaluate the CISP, which includes SAWs,
and the evaluation would be included in the regular written assessment.
---------------------------------------------------------------------------

    \477\ See Section 6.6(b)(ii)(B)(3).
---------------------------------------------------------------------------

2. Security Working Group
    The proposed amendments require the CISO to keep the Security
Working Group apprised of relevant developments, and to provide it with
all information and materials necessary to fulfill its purpose, which
will help to keep the Security Working Group adequately informed about
issues that fall within its purview. The Commission further
preliminarily believes that the Security Working Group will be able to
provide the CISO and the Operating Committee with valuable feedback
regarding the security of the CAT.
3. SAWs
a. Policies, Procedures, and Detailed Design Specifications
    By requiring the Plan Processor to develop and maintain a CISP that
would include SAWs and, more specifically, that will include specified
data access and extraction policies and procedures and security
controls, policies, and procedures for SAWs, the Commission
preliminarily believes that the proposed amendments would better
protect CAT Data by keeping it within the CAT System and therefore
subject to the security controls, policies, and procedures of the CISP
when accessed and analyzed by the Participants. In addition, the
Commission preliminarily believes that requiring the Plan Processor to
develop, maintain, and make available to the Participants detailed
design specifications for the technical implementation of the access,
monitoring, and other controls required for SAWs may increase the
likelihood that the CISP is implemented consistently across the SAWs
and at a high standard.
b. Implementation and Operation Requirements
    Requiring the Plan Processor to notify the Operating Committee that
each Participant's SAW has achieved compliance with the detailed design
specifications developed pursuant to proposed Section 6.13(b)(i) before
that SAW may connect to the Central Repository will protect the CAT,
because this process will confirm that the CISP has been implemented
properly before any Participant is permitted to use its SAW to access
CAT Data.
    Requiring the Plan Processor to monitor each Participant's SAW in
accordance with the detailed design specifications developed pursuant
to proposed Section 6.13(b)(i) should enable the Plan Processor to
conduct such monitoring, including automated monitoring, consistently
and efficiently across SAWs. It should also help the Plan Processor to
identify and to escalate any non-compliance events,

threats, and/or vulnerabilities as soon as possible, thus reducing the
potentially harmful effects of these matters. Likewise, requiring the
Plan Processor to notify the Participant of any identified non-
compliance will likely speed remediation of such non-compliance by the
Participant.
c. Non-SAW Environments
i. Application Materials
    The Commission preliminarily believes that requiring the
Participants to submit new and/or up-to-date versions of the specified
application materials in connection with an initial application, a re-
application, or a continuance will help the CISO and the CCO to
determine whether it is appropriate to grant an exception (or
continuance) to the proposed SAW usage requirements. For example, the
proposed requirement that the Participant produce a security assessment
conducted within the last twelve months by an independent and named
third party security assessor should give these decision-makers access
to up-to-date, accurate, and unbiased information about the security
and privacy controls put in place for the relevant non-SAW environment,
including reliable information about risk mitigation measures and
recommended corrective actions.\478\ The Commission preliminarily
believes that this information will help the CISO and the CCO to
determine whether the non-SAW environment is sufficiently secure to be
granted an exception (or continuance) from the SAW usage requirements
set forth in proposed Section 6.13(a)(i)(B). Similarly, the Commission
preliminarily believes that requiring the requesting Participant to
provide detailed design specifications for its non-SAW environment that
demonstrate the extent of adherence to the SAW design specifications
developed by the Plan Processor pursuant to Section 6.13(b)(i) and that
the detailed design specifications will support required non-SAW
environment operations will help the CISO and the CCO to assess the
security-related infrastructure of the non-SAW environment and to
determine whether the non-SAW environment will support the required
functionality.
---------------------------------------------------------------------------

    \478\ See proposed Section 6.13(d)(i)(A)(1).
---------------------------------------------------------------------------

ii. Exception and Revocation Determinations
    For both initial applications and applications for a continued
exception, the proposed amendments would require the CISO and the CCO
to notify the Operating Committee and the requesting Participant and to
provide the Participant with a detailed written explanation setting
forth the reasons for their determination and, for denied Participants,
specifically identifying the deficiencies that must be remedied before
an exception could be granted. The Commission preliminarily believes
that this kind of feedback could be quite valuable--not only because it
should prevent the CISO and the CCO from denying applications without
basis, but also because it should provide denied Participants with the
information needed to effectively bring their non-SAW environments into
compliance with the proposed standards. The Commission also
preliminarily believes it is valuable to require that the Operating
Committee be notified of determinations related to non-SAW
environments, because this should enhance the ability of the Operating
Committee to oversee the security of CAT Data.
iii. Non-SAW Implementation and Operation Requirements
    By requiring the Plan Processor to notify the Operating Committee
that a non-SAW environment has achieved compliance with the detailed
design specifications submitted by a Participant in connection with its
application for an exception (or continuance), the Commission
preliminarily believes that the proposed amendments will protect the
security of the CAT.\479\ The Commission preliminarily believes that it
is important for approved Participants to adhere to and implement the
detailed design specifications that formed a part of their application
packages, because such detailed design specifications will have been
reviewed and vetted by the CISO, the CCO, the members of the Security
Working Group (and their designees), and Commission observers of the
Security Working Group.\480\ Therefore, the Commission preliminarily
believes that non-SAW environments that implement their submitted
design specifications should be sufficiently secure, and, for an
additional layer of protection and oversight, the proposed amendments
require the Plan Processor to determine and notify the Operating
Committee that the non-SAW environment has achieved compliance with
such detailed design specifications before CAT Data can be accessed via
the user-defined direct query or bulk extraction tools.
---------------------------------------------------------------------------

    \479\ The proposed amendments do not specify a particular format
for this notification; the Commission preliminarily believes that
such notification could be made with a phone call or through email.
    \480\ See proposed Section 6.13(d)(i)(A), (d)(ii)(A).
---------------------------------------------------------------------------

    Similarly, the Commission preliminarily believes that the proposed
monitoring and notification requirements will improve the security of
the non-SAW environments that are granted an exception by the CISO and
the CCO and, therefore, the overall security of the CAT. Requiring the
Plan Processor to monitor each non-SAW environment that has been
granted an exception will help the Plan Processor to identify any non-
compliance events, threats, and/or vulnerabilities, thus reducing the
potentially harmful effects these matters could have if left unchecked
and uncorrected. The Commission also preliminarily believes that it is
appropriate to require approved Participants to simultaneously notify
the Plan Processor, the members of the Security Working Group (and
their designees), and Commission observers of the Security Working
Group of any material changes to the security controls for the non-SAW
environment. If the security controls reviewed and vetted by the CISO,
the CCO, the members of the Security Working Group (and their
designees), and Commission observers of the Security Working Group
change in any material way, the Commission preliminarily believes it is
appropriate to require the simultaneous escalation of this information
to the Plan Processor, the members of the Security Working Group (and
their designees), and Commission observers of the Security Working
Group.
4. Online Targeted Query Tool and Logging of Access and Extraction
    The Commission preliminarily believes the proposed definition of
``delivery of results'' would result in logs that provide more useful
information to the Plan Processor and Participants and will assist in
the identification of potential issues relating to the security or
access to CAT Data. The Commission also preliminarily believes that the
requirement to log access and extraction of CAT Data is appropriate
because the monthly reports of information relating to the query tools
will permit the Operating Committee and Participants to review
information concerning access and extraction of CAT Data regularly and
to identify issues related to the security of CAT Data.
5. CAT Customer and Account Attributes
    The Commission preliminarily believes that it is appropriate to
amend the CAT NMS Plan to eliminate the

requirement that Industry Members report SSNs/ITINs and instead require
that they report a Transformed Value. As proposed, the Transformed
Value will be reported to the CCID Subsystem, which will perform
another transformation to create the Customer-ID.\481\ The Plan
Processor will then link the Customer-ID to the Customer and Account
Attributes for use by Regulatory Staff for regulatory and surveillance
purposes. Replacing the reporting of ITIN(s)/SSN(s) of a natural person
Customer with the reporting of Transformed Values obviates the need for
the CAT to collect certain sensitive pieces of identifying information
associated with a natural person Customer.\482\
---------------------------------------------------------------------------

    \481\ See proposed Section 6.1(v) and proposed Appendix D,
Section 9.1 of the CAT NMS Plan.
    \482\ See PII Exemption Order, supra note 5, at 16156.
---------------------------------------------------------------------------

    The Commission preliminarily believes that the proposed language in
Appendix D, Section 9.1 requires that the Participants must assess the
overall performance and design of the CCID Subsystem and the process
for creating Customer-ID(s) as part of each annual Regular Written
Assessment of the Plan Processor, as required by Article VI, Section
6.6(b)(ii)(A). The Commission preliminarily believes the assessment
should enable the Commission to better assess the overall performance
and design of the CCID Subsystem, including the ingestion of the
Transformed Value and the subsequent creation of an accurate Customer-
ID, to confirm the CCID Subsystem is operating as intended, or whether
any additional measures should be taken to address the creation and
protection of Customer-IDs.
6. Customer Identifying Systems Workflow
    The Commission preliminarily believes it is appropriate to require
the Plan Processor to maintain a full audit trail of access to Customer
Identifying Systems by each Participant and the Commission (who
accessed what data and when), and to require the Plan Processor to
provide to each Participant and the Commission the audit trail for
their respective users on a monthly basis. The information contained in
the audit trail and the reports could help the Participants, the
Commission, and the Operating Committee develop and implement internal
policies, procedures and control systems that allow only Regulatory
Staff who are entitled to access to Customer Identifying Systems to
have such access.
    The Commission preliminarily believes that requiring each
Participant to submit an application that has been approved by the
Participant's Chief Regulatory Officer (or similarly designated head(s)
of regulation) to use Programmatic CAIS Access or Programmatic CCID
Subsystem Access will help the Commission to determine whether it is
appropriate for a particular Participant to have authorization to use
programmatic access. The Commission preliminarily believes that some
Participants may not require programmatic access to either CAIS or the
CCID Subsystem in order to carry out their regulatory and oversight
responsibilities. However, the Commission recognizes that in some
circumstances, e.g., determining the scope and nature of hacking and
associated trading misconduct may require programmatic access. The
specific information required in the application will assist the
Commission in evaluating on a case-by-case basis whether programmatic
access is needed for a Participant.
7. Proposed Confidentiality Policies, Procedures and Usage Restrictions
    The Commission believes that the proposed amendments to Section
6.5(g)(i), which would require the Participants to create and maintain
identical confidentiality and related policies, and individualized
procedures and usage restrictions, would help protect the security and
confidentiality of CAT Data and help ensure that CAT Data is used only
for appropriate regulatory and surveillance purposes.
    The Commission preliminarily believes that requiring the
Participants to periodically review the effectiveness of the policies
and procedures and usage restriction controls required by Section
6.5(g)(i), including by using the monitoring and testing protocols
documented within the policies pursuant to Section 6.5(g)(i)(J), and
take prompt action to remedy deficiencies in such policies, procedures
and usage restriction controls, should help ensure that the Proposed
Confidentiality Policies, as well as the Participant-specific
procedures and usage restriction controls developed pursuant to the
Proposed Confidentiality Policies, are effective and being complied
with by each Participant.
    The Commission preliminarily believes that requiring each
Participant, as reasonably practicable, and in any event within 24
hours of becoming aware, report to the Chief Compliance Officer, in
accordance with the guidance provided by the Operating Committee: (A)
Any instance of noncompliance with the policies, procedures, and usage
restriction controls adopted by such Participant pursuant to Section
6.5(g)(i); or (B) a breach of the security of the CAT should help
ensure that Participants comply with the Proposed Confidentiality
Policies and related procedures, and help ensure the security of CAT
Data.
    The Commission preliminarily believes that requiring that the
Proposed Confidentiality Policies be made publicly available on each of
the Participants' websites, or collectively on the CAT NMS Plan
website, redacted of sensitive proprietary information, could help
ensure that the Proposed Confidentiality Policies are robust and
thoroughly considered by Participants. The Commission also believes
that such a requirement will allow other Participants, broker-dealers,
investors and the public to better understand and analyze the Proposed
Confidentiality Policies that govern Participant usage of and the
confidentiality of CAT Data. The Commission preliminarily believes that
broker-dealers and investors that generates the order and trade
activity that is reported to CAT should have some insight on the
policies governing usage of CAT Data, particularly due to the
sensitivity and importance of CAT Data, which may contain personally
identifiable information, trading strategies and other valuable or
sensitive information.
    The Commission preliminarily believes that requiring each
Participant to engage an independent accountant to perform an
examination of compliance with the policies required by Section
6.5(g)(i) would provide additional oversight which should enhance
confidence that Participants are complying with policies designed to
ensure the confidentiality of CAT Data and would help ensure that such
data is used solely for surveillance and regulatory purposes. The
Commission preliminarily believes that requiring the Participants to
submit the examination reports to the Commission would allow the
Commission to review the results of the examination that was performed,
and to assess whether or not Participants are adequately complying with
the Proposed Confidentiality Policies.
    The Commission preliminarily believes that requiring the policies
required by proposed Section 6.5(g)(i) be subject to review and
approval by the Operating Committee, after review by the CISO and CCO,
will further help ensure that the Proposed Confidentiality Policies are
consistent with the requirements of the CAT NMS Plan and proposed
changes herein, while

providing for multiple opportunities for feedback and input while the
Proposed Confidentiality Policies are being developed. It would allow
the Plan Processor to have input in the creation of the Proposed
Confidentiality Policies and help ensure consistency with policies and
procedures created by the Plan Processor itself. The Commission
preliminarily believes that it is appropriate to require the CCO to
receive the assistance of the Compliance Subcommittee because the
Compliance Subcommittee's purpose is to aid the CCO and because it
would further allow for more input into the process of developing the
Proposed Confidentiality Policies.\483\
---------------------------------------------------------------------------

    \483\ Members of the Advisory Committee, composed of members
that are not employed by or affiliated with any Participant or any
of its affiliates or facilities, are currently on the Compliance
Subcommittee. See CAT NMS Plan, supra note 3, at Section 4.13.
---------------------------------------------------------------------------

8. Secure Connectivity--``Allow Listing''
    The Commission preliminarily believes that requiring ``allow
listing,'' which would require the Plan Processor to allow access only
to those countries or more granular access points where CAT reporting
or regulatory use is both necessary and expected would enhance the
security of CAT infrastructure and connections to the CAT
infrastructure by requiring the Plan Processor to limit access to the
CAT infrastructure based on an authorized end user's geolocation of the
IP addresses of CAT Reporters. Similarly, the Commission preliminarily
believes that requiring the Plan Processor to establish policies and
procedures to allow access if the source location for a particular
instance of access cannot be determined technologically would improve
the security of the CAT System, by addressing whether or not
connectivity is possible and how such connectivity could be granted.
9. Breach Management Policies and Procedures
    The Commission preliminarily believes that requiring the Plan
Processor's cyber incident response plan to include ``taking
appropriate corrective action that includes, at a minimum, mitigating
potential harm to investors and market integrity, and devoting adequate
resources to remedy the systems or data breach as soon as reasonably
practicable,'' would obligate the Plan Processor to respond to systems
or data breaches with appropriate steps necessary to remedy each
systems or data breach and mitigate the negative effects of the breach,
if any, on market participants and the securities markets more broadly.
    The Commission preliminarily believes that requiring the Plan
Processor's cyber incident response plan to incorporate breach
notifications, and requiring the Plan Processor to provide breach
notifications, would inform affected CAT Reporters, and the
Participants and the Commission, in the case of systems or data
breaches. The Commission preliminarily believes that it is appropriate
for these breach notifications to include a summary description of the
systems or data breach, including a description of the corrective
action taken and when the systems or data breach has been or is
expected to be resolved. These breach notifications could potentially
allow affected CAT Reporters, Participants and/or the Commission to
proactively respond to the information in a way to mitigate any
potential harm to themselves, customers, investors and the public.
Furthermore, requiring the Plan Processor to document all information
relevant to de minimis breaches should ensure that the Plan Processor
has all the information necessary should its initial determination that
a breach is de minimis prove to be incorrect, so that it could promptly
provide breach notifications as required, and would be helpful in
identifying patterns among systems or data breaches.
10. Customer Information for Allocation Report Firm Designated IDs
    The Commission preliminarily believes proposed Section
6.4(d)(ii)(c) would explicitly require that Customer and Account
Attributes be reported for Firm Designated IDs submitted in connection
with Allocation Reports, and will require Industry Members to report
such information. The Commission preliminarily believes that this
proposed amendment is consistent with previously granted exemptive
relief, which requires the Central Repository to have the ability to
use elements of Allocation Reports to link the subaccount holder to
those with authority to trade on behalf of the account.\484\ The
Commission preliminarily believes that if Industry Members do not
provide Customer and Account Attributes for the relevant Firm
Designated ID submitted in an Allocation Report, then there would be no
ability for the Central Repository to link the subaccount holder to
those with authority to trade on behalf of the account. The Commission
preliminarily believes that amending the language in Section
6.4(d)(ii)(C) to implement the previously approved exemptive relief is
appropriate. However, the Commission does not believe that the proposed
amendment substantively changes the obligations of Industry Members,
who, through Participant Compliance Rules, are already required to
submit customer information for all Active Accounts pursuant to the CAT
NMS Plan.\485\
---------------------------------------------------------------------------

    \484\ See Securities and Exchange Act Release No. 77265 (March
1, 2016), 81 FR 11856, 11868 (March 7, 2016); see also CAT NMS Plan,
supra note 3, at Section 1.1 (defining ``Allocation Report'') and
Section 6.4(d)(ii)(A)(i) (requiring an Allocation Report if an order
is executed in whole in or in part).
    \485\ See supra, note 407.
---------------------------------------------------------------------------

C. Respondents

1. National Securities Exchanges and National Securities Associations
    The respondents to certain proposed collections of information
would be the 25 Participants (the 24 national securities exchanges and
one national securities association (FINRA)) currently registered with
the Commission.\486\
---------------------------------------------------------------------------

    \486\ The Participants are: BOX Options Exchange LLC, Cboe BZX
Exchange, Inc., Cboe BYX Exchange, Inc., Cboe C2 Exchange, Inc.,
Cboe EDGA Exchange, Inc., Cboe EDGX, Inc., Cboe Exchange, Inc.,
Financial Industry Regulatory Authority, Inc., Investors Exchange
Inc., Long-Term Stock Exchange, Inc., MEMX, LLC, Miami International
Securities Exchange LLC, MIAX PEARL, LLC, MIAX Emerald, LLC, NASDAQ
BX, Inc., NASDAQ GEMX, LLC, NASDAQ ISE, LLC, NASDAQ MRX, LLC, NASDAQ
PHLX LLC, The NASDAQ Stock Market LLC, New York Stock Exchange LLC,
NYSE MKT LLC, and NYSE Arca, Inc., NYSE Chicago Stock Exchange,
Inc., NYSE National, Inc.
---------------------------------------------------------------------------

2. Members of National Securities Exchanges and National Securities
Association
    The respondents for certain information collection are the
Participants' broker-dealer members, that is, Industry Members. The
Commission understands that there are currently 3,734 broker-dealers;
however, not all broker-dealers are expected to have CAT reporting
obligations. The Commission estimates that approximately 1,500 broker-
dealers currently quote or execute transactions in NMS Securities,
Listed Options or OTC Equity Securities and would likely have CAT
reporting obligations.\487\
---------------------------------------------------------------------------

    \487\ The Commission understands that the remaining 2,234
registered broker-dealers either trade in asset classes not
currently included in the definition of Eligible Security or do not
trade at all (e.g., broker-dealers for the purposes of underwriting,
advising, private placements).
---------------------------------------------------------------------------

D. Total Initial and Annual Reporting and Recordkeeping Burdens

    The Commission's total burden estimates in this Paperwork Reduction
Act section reflect the total burden on

all Participants and Industry Members. The burden estimates per
Participant or Industry Member are intended to reflect the average
paperwork burden for each Participant or Industry Member, but some
Participants or Industry Members may experience more burden than the
Commission's estimates, while others may experience less. The burden
figures set forth in this section are the based on a variety of
sources, including Commission staff's experience with the development
of the CAT and estimated burdens for other rulemakings.
    Many aspects of the proposed amendment to the CAT NMS Plan would
require the Plan Processor to do certain activities. However, because
the CAT NMS Plan applies to and obligates the Participants and not the
Plan Processor, the Commission preliminarily believes it is appropriate
to estimate the Participants' external cost burden based on the
estimated Plan Processor staff hours required to comply with the
proposed obligations. The Commission derives these estimated costs
associated with Plan Processor staff time based on per hour figures
from SIFMA's Management & Professional Earnings in the Securities
Industry 2013, modified by Commission staff to account for an 1800-hour
work-year, and multiplied by 5.35 to account for bonuses, firm size,
employee benefits and overhead, and adjusted for inflation based on
Bureau of Labor Statistics data on CPI-U between January 2013 and
January 2020 (a factor of 1.12).\488\
---------------------------------------------------------------------------

    \488\ For example, the 2020 inflation-adjusted effective hourly
wage rate for attorneys is estimated at $426 ($380 x 1.12). For
purposes of this Paperwork Reduction Act analysis, the Commission
has preliminarily estimated the per hour cost of a Chief Information
Security Officer to be identical to the per hour cost of a Chief
Compliance Officer ($543 per hour).
---------------------------------------------------------------------------

1. Evaluation of the CISP
    The CAT NMS Plan already requires the Participants to submit to the
Commission, at least annually, a written assessment of the Plan
Processor's performance that is prepared by the CCO. As part of this
assessment, the Participants are required to include an evaluation of
the information security program ``to ensure that the program is
consistent with the highest industry standards for the protection of
data,'' which the Participants may review and comment on before
providing the assessment to the Commission.
    The proposed amendments would newly require the CCO to evaluate
elements of the CISP that relate to SAWs and, in collaboration with the
CISO, to include a review of CAT Data extracted from the CAT System to
assess the security risk of permitting such CAT Data to be extracted.
In connection with these new requirements, the Commission preliminarily
estimates that the Participants would incur an ongoing aggregate
expense of $129,900 per year, or that each Participant would incur an
annual expense of $5,196, in connection with these proposed amendments,
based on a preliminary estimate that Plan Processor staff would need
approximately 250 hours per year to comply with these new
requirements.\489\
---------------------------------------------------------------------------

    \489\ The estimated 250 hours of Plan Processor staff time
include 100 hours by the CCO, 100 hours by the CISO, and 50 hours
for an attorney. Accordingly, the Commission preliminarily estimates
that the Participants would together incur an ongoing annual expense
of $129,900. (100 hours for CCO = $54,300) + (100 hours for CISO =
$54,300) + (50 hours for Attorney = $21,300). Each Participant would
therefore incur an ongoing annual expense of $5,196. $129,900/25
Participants = $5,196 per Participant.
---------------------------------------------------------------------------

    Under the CAT NMS Plan, the Participants would also have the right
to review and comment on these new elements of the written assessment.
The Commission preliminarily estimates that each Participant would
spend approximately 25 hours reviewing and commenting on these new
elements \490\ and that all Participants would incur an aggregate
burden of approximately 625 hours.\491\ In addition, the Commission
preliminarily estimates that each Participant would spend approximately
$1,000 on external legal consulting costs \492\ or that all
Participants would spend approximately $25,000 on external legal
consulting costs.\493\
---------------------------------------------------------------------------

    \490\ The Commission is basing these estimates on the CAT NMS
Plan Approval Order, which estimated that each Participant would
incur a burden of 171.43 hours to review and comment on the entire
written assessment required by Section 6.6(b)(ii). See CAT NMS Plan
Approval Order, supra note 3, at 84925 note 3409. The written
assessment is made up of many components, and the Commission
preliminarily believes the proposed amendments would only require a
portion of the time that was originally estimated for the entire
assessment. The Commission therefore preliminarily believes that
each Participant would incur a burden of 25 hours to review and
comment on the new elements of the written assessment. 15 hours for
attorney + 10 hours for chief compliance officer = 25 hours.
    \491\ 25 hours per Participant * 25 Participants = 625 hours.
    \492\ The Commission is basing these estimates on the CAT NMS
Plan Approval Order, which estimated that each Participant would
spend $1,000 on external legal consulting costs in order to review
and comment on the entire written assessment required by Section
6.6(b)(ii). See CAT NMS Plan Approval Order, supra note 3, at 84925-
26. The Commission preliminarily believes this is an appropriate
estimate for the amount the Participants might spend on the proposed
elements of the written assessment.
    \493\ $1,000 per Participant * 25 Participants = $25,000.
---------------------------------------------------------------------------

2. Security Working Group
    The Commission preliminarily believes that each Participant would
incur an ongoing annual burden of 364 hours to comply with the proposed
requirement that the Security Working Group aid the CISO and the
Operating Committee or that the Participants will incur an aggregated
annual burden of 9,100 hours.\494\
---------------------------------------------------------------------------

    \494\ The Commission preliminarily believes, based on the
activity of the current group established by the Operating Committee
to discuss the security of the CAT, that the Security Working Group
will meet weekly. The Commission preliminarily estimates that the
chief or deputy chief information security officer of each
Participant will likely spend approximately 5 hours per week, on
average, to prepare for this meeting and 2 hours to attend this
meeting. 7 hours * 52 weeks = 364 hours per Participant. 364 hours
per Participant * 25 Participants = 9,100 hours.
---------------------------------------------------------------------------

    The Commission preliminarily believes that requiring the CISO to
keep the Security Working Group apprised of relevant developments, to
provide it with all information and materials necessary to fulfill its
purpose, and to prepare for and attend meetings of the Security Working
Group will take the CISO approximately 570 hours per year. Accordingly,
the Commission preliminarily estimates that the Participants would
incur an ongoing aggregate expense of approximately $309,510 per year,
or that each Participant would incur an ongoing annual expense of
$12,380, in connection with these proposed amendments.\495\
---------------------------------------------------------------------------

    \495\ The Commission preliminarily estimates that the Security
Working Group will meet weekly and that the CISO will spend 8 hours
preparing for each meeting of the Security Working Group and 2 hours
to attend each meeting. 10 hours * 52 weeks = 520 hours. In
addition, the Commission preliminarily estimates that the CISO will
spend approximately 50 hours per year to keep the Security Working
Group apprised of relevant developments and to provide it with all
information and materials necessary to fulfill its purpose. 520
hours + 50 hours = 570 hours for CISO. 570 hours for CISO =
$309,510. $309,510/25 Participants = $12,380.40 per Participant. The
Commission does not believe that any initial or one-time burdens
would be incurred in association with these proposed amendments.
---------------------------------------------------------------------------

3. SAWs
a. Policies, Procedures, and Detailed Design Specifications
    The burdens associated with the development and maintenance of the
CISP are already largely accounted for in the CAT NMS Plan Approval
Order.\496\ For the Plan Processor to develop a CISP that incorporates
the SAW-specific additions that would be

required under the proposed amendments,\497\ the Commission
preliminarily estimates that the Participants would incur an initial,
one-time expense of approximately $89,020, or that each Participant
would incur an initial, one-time annual expense of approximately
$3,561, based on a preliminary estimate that Plan Processor staff would
need approximately 270 hours to comply with these new
requirements.\498\ The Commission also preliminarily estimates that the
Participants would incur an initial, one-time burden of approximately
$27,000 in external legal and consulting costs \499\ or that each
Participant would incur an initial, one-time burden of $1,080.\500\
Furthermore, to maintain a CISP that incorporated the SAW-specific
additions that would be required under the proposed amendments, the
Commission preliminarily estimates that the Participants would incur an
ongoing expense of approximately $56,648 per year, or that each
Participant would incur an ongoing, annual expense of approximately
$2,266, based on a preliminary estimate that Plan Processor staff would
need approximately 175 hours per year to maintain those elements of the
CISP that relate to SAWs.\501\
---------------------------------------------------------------------------

    \496\ See CAT NMS Plan Approval Order, supra note 3, at 84219-
20. In addition, to the extent that the CISO consults with the
Security Working Group regarding the development and maintenance of
the CISP, those costs have already been detailed elsewhere. See Part
III.D.2. supra.
    \497\ See proposed Section 1.1, ``Comprehensive Information
Security Program'' and ``Secure Analytical Workspace.'' See also
proposed Section 6.12; proposed Section 6.13(a).
    \498\ The estimated 270 hours of Plan Processor staff time
include 200 hours by a senior systems analyst, 40 hours by a
compliance attorney, 20 hours by the chief compliance officer, and
10 hours by a director of compliance. Accordingly, the Commission
preliminarily estimates that the Participants would together incur
an ongoing annual expense of $89,020. (200 hours for senior systems
analyst = $58,200) + (40 hours for compliance attorney = $14,960) +
(20 hours for chief compliance officer = $10,860) + (10 hours for
director of compliance = $5,000) = $89,020. Each Participant would
therefore incur an ongoing annual expense of $3,560.80. $89,020/25
Participants = $3,560.80 per Participant. This estimate is based on
burdens estimated in the adopting release for Regulation SCI for the
development of systems compliance policies and procedures. See
Securities Exchange Act Release No. (November 19, 2014), 79 FR
72252, at 72378 (December 5, 2014) (``Regulation SCI Adopting
Release'').
    \499\ This estimate is based on burdens estimated in the
adopting release for Regulation SCI for the development of systems
compliance policies and procedures. See Regulation SCI Adopting
Release, supra note 498, at 72378.
    \500\ $27,000/25 Participants = $1,080 per Participant.
    \501\ The estimated 175 hours of Plan Processor staff time
include 134 hours by a senior systems analyst, 26 hours by a
compliance attorney, 10 hours by the chief compliance officer, and 5
hours by a director of compliance. Accordingly, the Commission
preliminarily estimates that the Participants would together incur
an ongoing annual expense of $56,648. (134 hours for senior systems
analyst = $38,994) + (26 hours for compliance attorney = $9,724) +
(10 hours for chief compliance officer = $5,430) + (5 hours for
director of compliance = $2,500) = $56,648. Each Participant would
therefore incur an ongoing annual expense of $2,265.92. $56,648/25
Participants = $2,265.92 per Participant. This estimate is based on
burdens estimated in the adopting release for Regulation SCI for the
development of systems compliance policies and procedures. See
Regulation SCI Adopting Release, supra note 498, at 72378.
---------------------------------------------------------------------------

    For the Plan Processor to develop detailed design specifications
for the technical implementation of the access, monitoring, and other
controls required for SAWs,\502\ the Commission preliminarily estimates
that the Participants would incur an initial, one-time expense of
approximately $56,180, or that each Participant would incur an initial,
one-time annual expense of approximately $2,247, based on a preliminary
estimate that Plan Processor staff would need approximately 160 hours
to comply with these new requirements.\503\ The Commission also
preliminarily estimates that the Participants would incur an initial,
one-time burden of approximately $47,000 in external legal and
consulting costs \504\ or that each Participant would incur an initial,
one-time burden of $1,880.\505\ In addition, the Commission believes
that the Participants would incur an initial, one-time expense of
approximately $2,965 to make the required detailed design
specifications available to the Participants \506\ or that each
Participant would incur an initial, one-time expense of approximately
$119.\507\ Furthermore, to maintain the required detailed design
specifications, the Commission preliminarily estimates that the
Participants would incur an ongoing expense of approximately $48,250
per year, or that each Participant would incur an ongoing, annual
expense of approximately $1,930, based on a preliminary estimate that
Plan Processor staff would need approximately 145 hours per year to
maintain the required detailed design specifications.\508\
---------------------------------------------------------------------------

    \502\ See proposed Section 6.13(b)(i).
    \503\ The estimated 160 hours of Plan Processor staff time
include 100 hours by a senior systems analyst, 30 hours by a
compliance attorney, 20 hours by the chief compliance officer, and
10 hours by a director of compliance. Accordingly, the Commission
preliminarily estimates that the Participants would together incur
an ongoing annual expense of $56,180. (100 hours for senior systems
analyst = $29,100) + (30 hours for compliance attorney = $11,220) +
(20 hours for chief compliance officer = $10,860) + (10 hours for
director of compliance = $5,000) = $56,180. Each Participant would
therefore incur an ongoing annual expense of $2,247.20. $56,180/25
Participants = $2,247.20 per Participant. This estimate is based on
burdens estimated in the adopting release for Regulation SCI for the
development of policies and procedures related to the design,
development, testing, maintenance, operation, and surveillance of
systems. See Regulation SCI Adopting Release, supra note 498, at
72377. To the extent that the CISO consults with the Security
Working Group regarding the development and maintenance of the
required detailed design specifications, those costs have already
been accounted elsewhere. See Part III.D.2. supra.
    \504\ This estimate is based on burdens estimated in the
adopting release for Regulation SCI for the development of policies
and procedures related to the design, development, testing,
maintenance, operation, and surveillance of systems. See Regulation
SCI Adopting Release, supra note 498, at 72377.
    \505\ $47,000/25 Participants = $1,880 per Participant.
    \506\ The Commission's estimate includes 5 hours by a senior
systems analyst, 2 hours by a compliance attorney, and 3 hours by a
webmaster. (5 hours for senior systems analyst = $1,455) + (2 hours
for compliance attorney = $748) + (3 hours for webmaster = $762) =
$2,965.
    \507\ $2,965/25 Participants = $118.60 per Participant.
    \508\ The estimated 145 hours of Plan Processor staff time
include 100 hours by a senior systems analyst, 30 hours by a
compliance attorney, 10 hours by the chief compliance officer, and 5
hours by a director of compliance. Accordingly, the Commission
preliminarily estimates that the Participants would together incur
an ongoing annual expense of $48,250. (100 hours for senior systems
analyst = $29,100) + (30 hours for compliance attorney = $11,220) +
(10 hours for chief compliance officer = $5,430) + (5 hours for
director of compliance = $2,500) = $48,250. Each Participant would
therefore incur an ongoing annual expense of $1,930. $48,250/25
Participants = $1,930 per Participant. This estimate is based on
burdens estimated in the adopting release for Regulation SCI for the
development of policies and procedures related to the design,
development, testing, maintenance, operation, and surveillance of
systems. See Regulation SCI Adopting Release, supra note 498, at
72377. To the extent that the CISO consults with the Security
Working Group regarding the development and maintenance of the
required detailed design specifications, those costs have already
been accounted for elsewhere. See Part III.D.2. supra.
---------------------------------------------------------------------------

b. Implementation and Operation Requirements
    For the Plan Processor to evaluate each Participant's SAW to
confirm that the SAW has achieved compliance with the detailed design
specifications required by proposed Section 6.13(b)(i), the Commission
preliminarily estimates that the Participants would incur an initial,
one-time expense of approximately $463,750, or that each Participant
would incur an initial, one-time expense of $18,550, based on a
preliminary estimate that Plan Processor staff would need approximately
45 hours per SAW to perform the required evaluation and notification of
the Operating Committee.\509\
---------------------------------------------------------------------------

    \509\ The estimated 45 hours of Plan Processor staff time
include 20 hours by a senior systems analyst, 20 hours by the chief
information security officer, and 5 hours by a compliance attorney.
Assuming each Participant will only have one SAW, the Commission
therefore preliminarily estimates that the Participants would
together incur an initial, one-time expense of $18,550 per SAW, or
an initial, one-time expense of $463,750. (20 hours for senior
systems analyst = $5,820) + (20 hours for chief information security
officer = $10,860) + (5 hours for compliance attorney = $1,870) =
$18,550 per SAW. $18,550 * 25 Participants = $463,750. Each
Participant would therefore incur an initial, one-time expense of
$18,550. $463,750/25 Participants = $18,550 per Participant. To the
extent that the CISO consults with the Security Working Group
regarding the evaluation or validation of the SAWs, those costs have
already been accounted for elsewhere. See Part III.D.2. supra.

---------------------------------------------------------------------------

    For the Plan Processor to build automated systems that will enable
monitoring of the SAWs, the Commission preliminarily estimates that the
Participants would incur an initial, one-time expense of $52,350, or
that each Participant would incur an initial, one-time expense of
$2,094, based on a preliminary estimate that Plan Processor staff would
need approximately 170 hours to build the required systems.\510\ For
the Plan Processor to maintain such systems and to monitor each
Participant's SAW in accordance with the detailed design specifications
developed pursuant to proposed Section 6.13(b)(i), the Commission
preliminarily estimates that the Participants would incur an ongoing
annual expense of approximately $629,220, or that each Participant
would incur an ongoing annual expense of approximately $25,169, based
on a preliminary estimate that Plan Processor staff would need
approximately 2,150 hours to maintain the required systems and to
conduct such monitoring.\511\ For the Plan Processor to simultaneously
notify the Participant of any identified non-compliance with the CISP
or the detailed design specifications, the Commission preliminarily
estimates that the Participants would incur an ongoing annual expense
of approximately $58,969, or that each Participant would incur an
ongoing annual expense of approximately $2,359, based on a preliminary
estimate that Plan Processor staff would need approximately 1.5 hours
for each notification of non-compliance.\512\
---------------------------------------------------------------------------

    \510\ Because the SAWs should all be implementing the CISP
according to the detailed design specifications developed by the
Plan Processor, the Commission preliminarily believes that much of
the monitoring required by the proposed amendments could be
automated. To build a system that would enable such monitoring, the
Commission preliminarily believes that Plan Processor would require
170 hours, including 40 hours by a senior programmer, 40 hours by 3
programmers, and 10 hours by the CISO. Accordingly, the Commission
preliminarily estimates that the Participants would together incur
an initial, one-time expense of $52,350. (40 hours for senior
programmer = $13,560) + (40 hours for programmer = $11,120) + (40
hours for programmer = $11,120) + (40 hours for programmer =
$11,120) + (10 hours for CISO = $5,430) = $52,350. Each Participant
would therefore incur an initial, one-time expense of $2,094.
$52,350/25 Participants = $2,094. To the extent that the CISO
consults with the Security Working Group regarding the build of such
monitoring systems, those costs have already been accounted for
elsewhere. See Part III.D.2. supra.
    \511\ The Commission preliminarily believes that one senior
systems analyst working 40 hours per week could conduct the required
monitoring for all SAWs. Accordingly, the Commission preliminarily
estimates that the Participants would together incur an ongoing
annual expense of $605,280. 40 hours * 52 weeks = 2,080 hours. 2,080
hours for senior systems analyst = $605,280. Each Participant would
therefore incur an ongoing annual expense of $24,211.20. $605,280/25
Participants = $24,211.20. In addition, to maintain the automated
monitoring systems, the Commission preliminarily estimates that Plan
Processor staff would need 70 hours, including 30 hours for a senior
programmer, 30 hours for a programmer, and 10 hours for the CISO.
Accordingly, the Commission preliminarily estimates that the
Participants would together incur an ongoing annual expense of
$23,940. (30 hours for senior programmer = $10,170) + (30 hours for
programmer = $8,340) + (10 hours for CISO = $5,430) = $23,940. Each
Participant would therefore incur an ongoing annual expense of
$957.60. $23,940/25 Participants = $957.60 per Participant.
Altogether, the ongoing annual expenses to the Participants as a
whole would be $629,220, or $25,168.80 for each individual
Participant. $605,280 + $23,940 = $629,220. $629,220/25 Participants
= $25,168.80 per Participant. To the extent that the CISO consults
with the Security Working Group regarding SAW monitoring or the
results of such monitoring, those costs have already been accounted
for elsewhere. See Part III.D.2. supra.
    \512\ The Commission preliminarily estimates that the Plan
Processor would identify 5 non-compliance events per year for each
SAW or, assuming that each Participant only has one SAW, 125 non-
compliance events across all SAWs. 5 events per SAW * 25 SAWs = 125
events. For each non-compliance event, the Commission preliminarily
estimates that the Plan Processor will spend 1.5 hours notifying the
Participant of the identified non-compliance, including 0.5 hours by
a senior systems analyst, 0.25 hours by a compliance manager, 0.25
hours by an attorney, and 0.5 hours by a senior business analyst.
(0.5 hours for senior systems analyst = $145.50) + (0.25 for
compliance manager = $79.25) + (0.25 for attorney = $106.50) + (0.5
hours for senior business analyst = $140.50) = $471.75 per event.
This estimate is based on estimates set forth in the Regulation SCI
Adopting Release for oral notifications of SCI events, as the
Commission preliminarily expects that such notifications would
typically be provided orally on a phone call or in a short email.
See Regulation SCI Adopting Release, supra note 498, at 72384.
Accordingly, the Commission preliminarily estimates that the
Participants would together incur an ongoing annual expense of
$58,968.75. 125 events * $471.75 = $58,968.75. Each Participant
would therefore incur an ongoing annual expense of $2,358.75.
$58,968.75/25 Participants = $2,358.75. To the extent that the CISO
consults with the Security Working Group regarding any non-
compliance events, those costs have already been accounted for
elsewhere. See Part III.D.2. supra.
---------------------------------------------------------------------------

c. Non-SAW Environments
i. Application Materials
    The Commission preliminarily estimates that 6 Participants will
apply for an exception to the SAW usage requirements, based on the
assumption that one exchange family will seek an exception.\513\ In
connection with the initial application for an exception, the
Commission further estimates that each of these Participants would
spend an initial, one-time amount of approximately $250,000 on external
consulting costs to obtain the required security assessment from a
named and independent third party security assessor and approximately
270 hours to provide the required detailed design specifications.\514\
The Commission further estimates that the each Participant would spend
5 hours submitting these materials to the CCO, the CISO, the members of
the Security Working Group (and their designees), and Commission
observers of the Security Working Group.\515\ Accordingly, with respect
to initial application materials, the Commission preliminarily
estimates that the Participants would incur an initial, one-time
expense of approximately $1,500,000 \516\ and an initial, one-time
burden of approximately 1,650 hours.\517\
---------------------------------------------------------------------------

    \513\ For example, there are six Participants in the Cboe Global
Markets, Inc. exchange group, six Participants in the Nasdaq, Inc.
exchange group, and five Participants in the Intercontinental
Exchange, Inc. exchange group. All estimates in this section
represent an average; the Commission believes that some Participants
may incur greater costs and some lesser costs due to variances in
economies of scale for Participants who share a common corporate
parent.
    \514\ The estimated 270 hours include 200 hours by a senior
systems analyst, 40 hours by a compliance attorney, 20 hours by the
chief compliance officer, and 10 hours by a director of compliance.
These estimates mirror the estimated hours for the Plan Processor to
perform the similar task of developing the detailed design
specifications for the SAWs.
    \515\ The estimated 5 hours include 5 hours by a compliance
attorney.
    \516\ $250,000 per non-SAW environment * 6 non-SAW environments
= $1,500,000.
    \517\ 270 hours + 5 hours = 275 hours per non-SAW environment.
275 hours per non-SAW environment * 6 non-SAW environments = 1,650
hours.
---------------------------------------------------------------------------

    Under the proposed amendments, Participants that are denied an
exception or that want to apply for a continuance must submit a new
security assessment that complies with the requirement of proposed
Section 6.13(d)(i)(A)(1) and up-to-date versions of the design
specifications required by proposed Section 6.13(d)(i)(A)(2). The
Commission preliminarily believes that the cost to obtain a new
security assessment would still be $250,000 in these scenarios, because
the Participants would have to obtain the security assessment from a
named and independent third party security assessor that might not be
able to leverage previous work. However, the Commission preliminarily
believes that each Participant would only incur about half of the
hourly burdens associated with preparation of initial application
materials to prepare the updated detailed design specifications needed
to support a re-application or an application for a continuance,
because

the Commission believes that each Participant would be able to
significantly leverage its previous work. Accordingly, the Commission
preliminarily estimates that each of these Participants would spend an
ongoing annual \518\ amount of approximately $250,000 on external
consulting costs to obtain the required security assessment from a
named and independent third party and approximately 135 hours to
provide the required detailed design specifications.\519\ The
Commission further estimates that each Participant would spend 5 hours
submitting these materials to the CCO, the CISO, the members of the
Security Working Group (and their designees), and Commission observers
of the Security Working Group.\520\ Accordingly, with respect to
updated application materials submitted in connection with a re-
application or an application for a continuance, the Commission
preliminarily estimates that the Participants would incur an ongoing
annual expense of approximately $1,500,000 \521\ and an ongoing annual
burden of approximately 840 hours.\522\
---------------------------------------------------------------------------

    \518\ Participants that are denied an exception and re-apply may
incur these ongoing costs more quickly than Participants that are
initially granted an exception and subsequently seek a continuance.
For example, a denied Participant might incur these ongoing costs
approximately 90 days after submitting its initial application
materials, whereas a Participant that is initially granted an
exception may not incur these costs for 11 months. Nevertheless, the
Commission preliminarily believes these costs and burdens will most
likely be incurred annually in both scenarios, in part because
Participants that re-apply are unlikely to be denied an exception
twice. The proposed amendments require the CISO and the CCO to
detail the deficiencies in a denied Participant's application, thus
making it easier for the Participant to correct such deficiencies.
See proposed Section 6.13(d)(i)(B)(2); proposed Section
6.13(d)(ii)(B)(2).
    \519\ The estimated 135 hours include 100 hours by a senior
systems analyst, 20 hours by a compliance attorney, 10 hours by the
chief compliance officer, and 5 hours by a director of compliance.
    \520\ The estimated 5 hours include 5 hours by a compliance
attorney.
    \521\ $250,000 per non-SAW environment * 6 non-SAW environments
= $1,500,000.
    \522\ 135 hours + 5 hours = 140 hours per non-SAW environment.
140 hours per non-SAW environment * 6 non-SAW environments = 840
hours.
---------------------------------------------------------------------------

ii. Exception and Revocation Determinations
    In connection with the requirement that the Plan Processor develop
policies and procedures governing the review of applications for
exceptions to the proposed SAW usage requirements, the Commission
preliminarily estimates that the Participants would incur an initial,
one-time expense of $63,400, or that each Participant would incur an
initial, one-time expense of $2,536, based on a preliminary estimate
that Plan Processor staff would need approximately 130 hours to develop
such policies and procedures.\523\ The Commission also preliminarily
estimates that the Participants would incur an ongoing annual expense
of $31,700, or that each Participant would incur an ongoing annual
expense of approximately $1,268, based on a preliminary estimate that
Plan Processor staff would need approximately 65 hours to maintain and
update such policies and procedures as needed.\524\
---------------------------------------------------------------------------

    \523\ The estimated 130 hours of Plan Processor staff time
include 40 hours by the CISO, 40 hours by the CCO, 40 hours by a
compliance attorney, and 10 hours by a director of compliance.
Accordingly, the Commission preliminarily estimates that the
Participants would together incur an ongoing annual expense of
$63,400. (40 hours for CISO = $21,720) + (40 hours for CCO =
$21,720) + (40 hours for compliance attorney = $14,960) + (10 hours
for director of compliance = $5,000) = $63,400. Each Participant
would therefore incur an ongoing annual expense of $2,536. $63,400/
25 Participants = $2,536 per Participant.
    \524\ The estimated 65 hours of Plan Processor staff time
include 20 hours by the CISO, 20 hours by the CCO, 20 hours by a
compliance attorney, and 5 hours by a director of compliance.
Accordingly, the Commission preliminarily estimates that the
Participants would together incur an ongoing annual expense of
$31,700. (20 hours by the CISO = $10,860) + (20 hours by the CCO =
$10,860) + (20 hours for compliance attorney = $7,480) + (5 hours
for director of compliance = $2,500) = $31,700. Each Participant
would therefor incur an ongoing annual expense of $1,268. $31,700/25
Participants = $1,268 per Participant.
---------------------------------------------------------------------------

    As noted above, the Commission preliminarily estimates that 6
Participants will apply for an exception to the SAW usage requirements.
In connection with initial applications for an exception, the
Commission also preliminarily estimates that the Participants would
incur an initial, one-time expense of approximately $550,560, or that
each Participant would incur an initial, one-time expense of $22,022,
based on a preliminary estimate that Plan Processor staff would need
approximately 200 hours per initial application to review the
application and issue the required determination and supporting written
statement.\525\ The Commission preliminarily believes that the ongoing
annual expenses associated with each application for a continued
exception would be the same, as the process for continued exceptions is
the same as the process for initial applications. Therefore, in
connection with applications for a continued exception, the Commission
preliminarily estimates that the Participants would incur an ongoing
annual expense of approximately $550,560, or that each Participant
would incur an ongoing annual expense of $22,022, based on a
preliminary estimate that Plan Processor staff would need approximately
200 hours per application to review the application and issue the
required determination and supporting written statement.\526\
---------------------------------------------------------------------------

    \525\ The estimated 200 hours of Plan Processor staff time
include 60 hours by the CCO, 60 hours by the CISO, 40 hours by a
senior systems analyst, and 40 hours by a compliance attorney.
Assuming only 6 Participants will apply for an exception to use a
non-SAW environment, the Commission preliminarily estimates that the
Participants would together incur an initial, one-time expense of
$550,560. (60 hours by the CCO = $32,580) + (60 hours by the CISO =
$32,580) + (40 hours for senior systems analyst = $11,640) + (40
hours for compliance attorney = $14,960) = $91,760 per initial
application. $91,760 * 6 Participants = $550,560. Each Participant
would therefore incur an initial, one-time expense of $22,022.40.
$550,560/25 Participants = $22,022.40 per Participant. To the extent
that the CISO consults with the Security Working Group regarding
these applications, those costs have already been accounted for
elsewhere. See Part III.D.2. supra.
    \526\ The estimated 200 hours of Plan Processor staff time
include 60 hours by the CCO, 60 hours by the CISO, 40 hours by a
senior systems analyst, and 40 hours by a compliance attorney.
Assuming that 6 Participants will apply for a continued exception to
use a non-SAW environment, and that 6 Participants will submit their
application materials on time, the Commission preliminarily
estimates that the Participants would together incur an ongoing
annual expense of $550,560. (60 hours by the CCO = $32,580) + (60
hours by the CISO = $32,580) + (40 hours for senior systems analyst
= $11,640) + (40 hours for compliance attorney = $14,960) = $91,760
per application. $91,760 * 6 Participants = $550,560. Each
Participant would therefore incur an ongoing annual expense of
$22,022.40. $550,560/25 Participants = $22,022.40 per Participant.
To the extent that the CISO consults with the Security Working Group
regarding these applications, those costs have already been
accounted for elsewhere. See Part III.D.2. supra. To the extent that
Participants fail to submit their continuance application materials
on time, the costs associated with continuance determinations would
be lower.
---------------------------------------------------------------------------

    The Commission is unable to estimate in advance whether
Participants would submit their application materials for a continued
exception on time or whether Participants would be denied a continued
exception by the CISO and the CCO. For each such instance, however, the
Commission preliminarily believes that the Participants would incur an
ongoing annual expense of approximately $17,510, or that each
Participant would incur an ongoing annual expense of approximately
$700, based on a preliminary estimate that Plan Processor staff would
need approximately 40 hours to revoke an exception and to determine on
which remediation timeframe the Participant should be required to cease
using its non-SAW environment to access CAT Data through the user-
defined direct query and bulk extract tools described in Section
6.10(c)(i)(B) and Appendix D, Section 8.2 of the CAT NMS Plan.\527\
---------------------------------------------------------------------------

    \527\ The estimated 40 hours of Plan Processor staff time
include 10 hours by the CCO, 10 hours by the CISO, 10 hours by a
senior systems analyst, and 10 hours by a compliance attorney. The
Commission preliminarily estimates that the Participants would
together incur an ongoing annual expense of $17,510. (10 hours by
the CCO = $5,430) + (10 hours by the CISO = $5,430) + (10 hours for
senior systems analyst = $2,910) + (10 hours for compliance attorney
= $3,740) = $17,510 per application. Each Participant would
therefore incur an ongoing annual expense of $700.40. $17,510/25
Participants = $700.40 per Participant. To the extent that the CISO
consults with the Security Working Group regarding such a decision,
those costs have already been accounted for elsewhere. See Part
III.D.2. supra. To the extent that Participants that are denied a
continuance, or that fail to submit their continuance application
materials on time, do not re-apply for an exception, the ongoing
annual costs detailed above for preparation of application materials
and for exception determinations would be lower.

---------------------------------------------------------------------------

iii. Non-SAW Environment Implementation and Operation Requirements
    The requirement that the Plan Processor notify the Operating
Committee that a non-SAW environment has achieved compliance with the
detailed design specifications submitted by a Participant as part of
its application for an exception (or continuance) largely mirrors the