venues. Because trading activity in stocks is now dispersed among a
larger number of trading venues and markets today are so inter-
connected and complex, the Commission believes that the application of
lower volume thresholds would more effectively capture multiple sources
of potential systems issues that could significantly disrupt the market
for a single security or for the market as a whole. Third, with respect
to ATSs that trade NMS stocks, the Commission is adopting the two-fold
dollar volume thresholds in the first prong--a single NMS stock
threshold and an all NMS stocks threshold. The Commission believes that
such thresholds would appropriately account for the significance of an
ATS in both overall trading of NMS stocks and for a single NMS stock.
---------------------------------------------------------------------------

    \1887\ See also supra Section IV.A.1.b.
    \1888\ See text accompanying supra note 161; see also Proposing
Release, supra note 13, at 18094 (stating that the use of dollar
thresholds may better reflect the economic impact of trading
activity).
---------------------------------------------------------------------------

    With regard to commenters that stated no ATSs should be covered
because ATSs are redundant of exchanges and other ATS, the Commission
acknowledges that, to some extent, certain services provided by any
trading venue, including exchanges and ATSs, are redundant in the sense
that these facilities execute and process trades. However, the
Commission notes that each ATS provides different services in terms of,
among other things, order types, matching rules, and the speed of
execution to meet investors' specific needs. If an ATS outage
interferes with the supply of certain services that investors demand,
it would impose costs on investors. For example, market participants
may program their routing algorithms assuming that all market centers
are operational. If one of those venues is not available, rerouting
order flow may increase costs to the market participant seeking
execution as time required for executing orders may increase, order
fill rates may decrease, and slippage \1889\ may also increase, which
would further increase transaction costs.\1890\
---------------------------------------------------------------------------

    \1889\ Slippage refers to the difference between the expected
price of a trade and the actual trade price due to the passage of
time.
    \1890\ See supra Section VI.B.4 for a discussion of why market
incentives do not seem to reduce these costs.
---------------------------------------------------------------------------

    The Commission also received comments regarding the inclusion of
fixed-income ATSs. One commenter suggested the use of par value traded
rather than volume.\1891\ Further, in noting that fixed-income ATSs
should not be subject to Regulation SCI, this commenter noted that
retail fixed-income ATSs operate on a vastly different scale than
institutional equity markets.\1892\ According to this commenter, the
costs of compliance for a retail fixed-income ATS would be several
orders of magnitude higher than for an exchange in the equity market,
and would overwhelm revenues for retail fixed-income ATSs.\1893\
---------------------------------------------------------------------------

    \1891\ See TMC Letter at 1-3.
    \1892\ See id. at 2.
    \1893\ See id.
---------------------------------------------------------------------------

    The Commission, after considering the views of commenters, has
determined to exclude ATSs that trade only municipal securities or
corporate debt securities from the definition of SCI ATS at this
time.\1894\ Accordingly, such fixed-income ATSs will not be subject to
the requirements of Regulation SCI. Rather, fixed-income ATSs will
continue to be subject to the existing requirements in Rule 301(b)(6)
of Regulation ATS regarding systems capacity, integrity and security if
they meet the twenty percent threshold for municipal securities or
corporate debt securities provided by that rule.\1895\ Because no such
ATS is subject to Regulation SCI at this time, it is possible that the
municipal security and corporate debt markets may be affected by SCI
events that otherwise may have been prevented with more robust systems
that would result from Regulation SCI. However, the Commission believes
that this loss in potential benefit relative to the proposed approach
would be minimal as fixed-income securities trading is generally
significantly less automated than trading in equities.\1896\ Further,
as commenters pointed out, the cost of the requirements of Regulation
SCI could be significant for fixed-income ATSs relative to their size,
scope of operations, and more limited potential for systems risk.
Therefore, lowering the current threshold applicable to fixed-income
ATSs in Regulation ATS and subjecting such ATSs to the requirements of
Regulation SCI could have potentially discouraged the growth of
automation that could benefit investors in these markets. However, as
the Commission monitors the evolution of automation in this market, the
Commission may reconsider the benefits and costs of extending the
requirements of Regulation SCI to fixed-income ATSs in the future.
---------------------------------------------------------------------------

    \1894\ See supra Section IV.A.1.b.
    \1895\ See 17 CFR 242.301(b)(6).
    \1896\ The Commission notes that the corporate debt and
municipal securities markets are primarily voice markets with little
automation. See also supra note 185 (discussing the view of
commenters that the inclusion of fixed-income ATSs and/or the
adoption of the proposed thresholds would impose unduly high costs
on these entities given their size, scope of operations, lack of
automation, low speed, and resulting low potential to pose risk to
systems).
---------------------------------------------------------------------------

    The adopted definition of SCI SRO includes all national securities
exchanges regardless of their volume share. The Commission received one
comment letter stating that the rule should also include volume
thresholds for exchanges.\1897\ The Commission is not persuaded that
applying a volume threshold is appropriate for SCI SROs that are
exchanges, but instead believes that Regulation SCI should cover all
exchanges. In particular, the Commission recognizes that all exchanges
play an important role in the securities markets. As discussed above in
Section IV.A.1.a, all stock exchanges are subject to a variety of
specific public obligations under the Exchange Act, including the
requirements of Regulation NMS which, among other things, designates
the best bid or offer of such exchanges to be protected quotations.
Accordingly, every exchange may have a protected quotation that can
obligate market participants to send orders to that exchange if such
exchange is displaying the best bid or offer. Among other reasons,
given that market participants may be required to send orders to any
one of the exchanges at any given time if such exchange is displaying
the best bid or offer, the Commission believes that it is important
that the safeguards of Regulation SCI apply equally to all exchanges
irrespective of trading volume. As

market participants may be required to send orders to the exchange
displaying the best prices, systems issues at such exchange could force
market participants to re-route their orders and, thus, could increase
execution time and slippage, imposing additional transaction costs to
investors.
---------------------------------------------------------------------------

    \1897\ See supra note 81 and accompanying text.
---------------------------------------------------------------------------

    With respect to options exchanges, the Commission additionally
believes that it would be inappropriate to exclude them from the
definition of SCI SRO because technology risks are equally applicable
to such exchanges, as evidenced by recent technology incidents
affecting the options markets.\1898\ While there are many options that
trade on multiple venues, systems issues resulting in trading
disruptions at an options exchange could lower the quality of pricing
efficiency and disrupt the price discovery process for singly-listed
options (e.g., certain index options only trade on one options
exchange). As such, systems issues at options exchanges can pose
significant risks to the markets, and the Commission believes that the
inclusion of options exchanges within the scope of Regulation SCI is
necessary to achieve the goals of Regulation SCI.
---------------------------------------------------------------------------

    \1898\ See supra note 84.
---------------------------------------------------------------------------

    The definition of SCI entity also includes the MSRB. The Commission
believes that the inclusion of the MSRB as an SCI entity will provide
several significant benefits. In particular, the MSRB collects and
consolidates municipal securities data and makes it available to market
participants. The Commission believes that any event that could affect
the market data collected and consolidated by the MSRB could
significantly disrupt the municipal bond market. Also, the municipal
securities data collected by the MSRB is provided to FINRA and made
available to the Commission and the bank regulators, and serves as a
key resource for monitoring the municipal bond market. Therefore, the
inclusion of the MSRB will help ensure the robustness of the MSRB's
systems and reduce the likelihood of systems issues that could harm
investors in the municipal bond market.
    As discussed above in Section IV.A.1, several commenters advocated
the adoption of a ``risk-based'' approach in the definition of SCI
entity based on the criticality of the functions performed.\1899\ In
effect, these commenters suggested that the Commission apply provisions
of Regulation SCI based on the entity's risk to the operations of the
U.S. securities markets based on the entity's functional role in the
market (e.g., a primary listing market, the sole venue of the security,
a monopoly or utility type role with no redundancy). The Commission has
considered these factors in developing the definition of SCI entity and
believes that the adopted definition, in part, captures the intent of
the commenters' suggestions in that it includes entities in the
definition that play a significant role in the securities markets. In
particular, as discussed in Section IV.A.1.a in detail, the Commission
included all exchanges in the definition of SCI SRO because exchanges
play a significant role in the functioning of securities markets. With
respect to the comments that suggested including only those entities
that are essential to continuous market-wide operation, the Commission
believes that the specific criteria suggested by commenters, in effect,
could lead to the exclusion of significant ATSs. As discussed above,
the Commission continues to believe that significant ATSs that trade
NMS and non-NMS stocks should be included in Regulation SCI. ATSs
collectively represent a significant source of liquidity for stocks.
Furthermore, as today's markets are increasingly inter-connected and
complex with heavy reliance on automated systems, the Commission
recognizes that a systems issue at an ATS could result in a market-wide
impact. Consequently, the Commission believes that re-defining SCI
entities according to commenters' ``risk-based'' approach could exclude
certain entities that the Commission believes have the potential to
pose significant risks to the securities markets should an SCI event
occur, and thus limit the potential benefits from Regulation SCI, which
are discussed throughout this economic analysis.
---------------------------------------------------------------------------

    \1899\ See supra notes 53-57 and accompanying text.
---------------------------------------------------------------------------

ii. SCI Systems
    Regulation SCI expands on current practice, and applies to a
broader range of systems than the current ARP Inspection Program. In
particular, the ARP Policy Statements are focused on specific types of
automated systems.\1900\ The ARP Policy Statements and the ARP
Inspection Program address systems that directly support trading,
clearance and settlement, order routing, and market data. The
definition of ``SCI systems'' would include these systems, as well as
those that directly support market regulation and market surveillance,
systems that serve an essential function for investor protection and
market integrity.
---------------------------------------------------------------------------

    \1900\ See supra Section II.A and Proposing Release, supra note
13, at Section I.A (discussing in more detail the ARP Policy
Statements and the ARP Inspection Program). According to the ARP I
Release, the term ``automated systems'' or ``automated trading
systems'' means computer systems for listed and OTC equities, as
well as options, that electronically route orders to applicable
market makers and systems that electronically route and execute
orders, including the data networks that feed the systems. These
terms also encompass systems that disseminate transaction and
quotation information and conduct trade comparisons prior to
settlement, including the associated communication networks. See ARP
I Release, supra note 1, at 48706, n. 21.
---------------------------------------------------------------------------

    The inclusion of market regulation and market surveillance systems
under Regulation SCI could reduce systems compliance issues that result
from disruptions in systems that support market regulation and market
surveillance. The Commission believes that including market regulation
and market surveillance systems under the definition of SCI systems
should help ensure the robustness of the systems used by SCI entities
to monitor compliance with relevant laws, rules, and their own rules,
and detect any violations of such laws or rules by members or
participants. The reduction in market regulation and market
surveillance systems issues could help ensure investor protection and
preserve market integrity.
    The Commission also believes that the inclusion of market data
systems in the definition of SCI systems will benefit the market.
Currently, SIAC, Nasdaq, and the MSRB \1901\ process, collect, and
disseminate market data on equities, options, and municipal securities
to investors. While SIAC and Nasdaq are part of the ARP Inspection
Program, the MSRB is not. The Commission believes that consolidated
market data is an important part of the investing and trading process
as it helps market participants to make well-informed investment and
trading decisions, and also helps investors to monitor the quality of
execution of orders by their brokers. Thus, any SCI events that affect
market data processed, collected, and disseminated by the MSRB could
reduce

pricing efficiency and, consequently, could significantly disrupt the
municipal bond market. Further, with respect to NMS securities, the
Commission understands that many trading algorithms make trading
decisions based primarily on market data and rely on that data being
current and accurate.
---------------------------------------------------------------------------

    \1901\ As discussed above, in 2008, the Commission amended Rule
15c2-12 to designate the MSRB as the single centralized disclosure
repository for continuing municipal securities disclosure. In 2009,
the MSRB established EMMA, which serves as the official repository
of municipal securities disclosure and provides the public with free
access to relevant municipal securities data, and is the central
database for information about municipal securities offerings,
issuers, and obligors. Additionally, the MSRB's RTRS, with limited
exceptions, requires municipal bond dealers to submit transaction
data to the MSRB within 15 minutes of trade execution, and such near
real-time post-trade transaction data can be accessed through the
MSRB's EMMA Web site. See supra note 77. The MSRB is an SCI entity
by virtue of being an SRO, rather than a plan processor.
---------------------------------------------------------------------------

    In addition, as noted in Section IV.A.2.b, market data as used in
the definition of ``SCI systems'' does not refer exclusively to
consolidated market data, but also includes proprietary market data
generated by SCI entities as well. The Commission notes that
proprietary market data is widely used and relied upon by a broad array
of market participants, including institutional investors, to make
trading decisions. Therefore, if a proprietary market data feed became
unavailable or otherwise unreliable, it could interfere with market
participants making trading decisions and impose additional transaction
costs on market participants.
    The Commission has limited information on the extent to which the
ARP Policy Statements guide ARP participants' practices with respect to
their proprietary market data systems because this information is not
reported to the Commission. To the extent that the ARP Policy
Statements guide ARP participants with respect to certain of their
proprietary market data systems, the potential benefits from including
proprietary market data systems in Regulation SCI could be incremental
given current practice. The Commission also notes that entities have
competitive incentives to limit the number of systems issues with their
proprietary market data systems, as those SCI entities with minimum
latency and the most robust proprietary market data systems may attract
more trading volume. While proprietary market data systems have
experienced systems issues, because these issues are not reported to
the Commission, the Commission has limited information on the frequency
and severity of such systems issues and, in addition, does not have
information about how proprietary market data systems issues affect the
demand to subscribe to a particular proprietary market data feed.
Although the Commission is unable to estimate the benefits and costs of
subjecting proprietary market data systems to Regulation SCI, the
Commission believes that if a proprietary market data feed became
unavailable or otherwise unreliable, it could have a significant impact
on the trading of the securities to which it pertains, and could
interfere with the maintenance of fair and orderly markets.\1902\
---------------------------------------------------------------------------

    \1902\ See supra Section IV.A.2.b.
---------------------------------------------------------------------------

    To the extent that proprietary market data systems and consolidated
market data systems share common infrastructure, the compliance costs
associated with proprietary market data systems could be incremental to
those costs associated with consolidated market data systems. In
addition, to the extent the ARP Policy Statements guide ARP
participants with respect to their proprietary market data systems, the
initial compliance costs associated with proprietary market data
systems will be lower for these participants with respect to the
relevant proprietary market data systems.
    As adopted, a subset of SCI systems are defined as critical SCI
systems. Critical SCI systems are defined as SCI systems of, or
operated by or on behalf of, an SCI entity that directly support
functionality relating to clearance and settlement systems of clearing
agencies; openings, reopenings, and closings on the primary listing
exchange; trading halts; initial public offerings; the provision of
consolidated market data; and exclusively listed securities.\1903\ In
addition, critical SCI systems include systems that provide
functionality to the securities markets for which the availability of
alternatives is significantly limited or nonexistent, and without which
there would be a material impact on fair and orderly markets.\1904\
Critical SCI systems include systems that represent potential ``single
points of failure'' in the securities markets--if they were to
experience systems issues, the Commission believes they would be the
most likely to have a widespread and significant impact on the U.S.
securities markets. Critical SCI systems are subject to certain
heightened resilience and information dissemination requirements under
Regulation SCI. In addition, because an SCI entity may tailor its
policies and procedures based on the relative criticality of a given
system to the SCI entity and to the securities markets generally, an
SCI entity may subject its critical SCI systems to higher standards
than other SCI systems.
---------------------------------------------------------------------------

    \1903\ See Rule 1000.
    \1904\ See id.
---------------------------------------------------------------------------

    By adopting a defined term ``critical SCI systems'' (which is not
defined for purposes of the ARP Inspection Program or Regulation ATS),
along with the heightened requirements associated with critical SCI
systems, the Commission expects fewer disruptions in critical SCI
systems, and therefore fewer SCI events involving potential ``single
points of failure'' that could cause wide-scale disruptions across the
securities markets. As explained in Section VI.C.1, this could reduce
the likelihood and duration of systems issues, thereby helping to avoid
pricing inefficiencies and reduce interruptions in liquidity flow,
which may occur during times when systems disruptions can make systems
unavailable or unreliable.
    The Commission also notes that, by distinguishing critical SCI
systems from other SCI systems, and because an SCI entity may tailor
its policies and procedures based on the relative criticality of a
given system to the SCI entity and to the securities markets generally,
an SCI entity may subject its critical SCI systems to higher standards
than other SCI systems. In addition, critical SCI systems are subject
to a goal of two-hour recovery following a wide-scale disruption, and a
requirement for information dissemination to all members or
participants of an SCI entity in the case of an SCI event impacting
critical SCI systems (unless the SCI event qualifies as a de minimis
SCI event). As result, the designation of critical SCI systems may
result in additional costs as compared to the proposal. However, by
distinguishing critical systems, Regulation SCI is consistent with a
risk-based approach that targets areas that would generate the most
benefits.
    Regulation SCI defines ``indirect SCI systems'' \1905\ to mean any
systems of, or operated by or on behalf of, an SCI entity that, if
breached, would be reasonably likely to pose a security threat to SCI
systems.\1906\ As discussed above in Section IV.A.2.d, the adopted
definition excludes systems that are effectively physically or
logically separated from SCI systems because the Commission believes
that the benefit of including systems that can effectively be ``walled
off'' may be limited, as ``walled off'' systems are less likely to
serve as potential vulnerable entry points to SCI systems in the event
of a security

breach.\1907\ Regulation SCI will expressly impose new requirements on
systems that fall within the definition of ``indirect SCI systems''
(which is not defined for purposes of the ARP Inspection Program or
Regulation ATS). These new requirements for indirect SCI systems should
help ensure the robustness and resiliency of SCI systems by reducing
the occurrence of security-related issues at SCI systems. Moreover, the
application of Regulation SCI to indirect SCI systems could encourage
SCI entities to isolate certain non-SCI systems from SCI systems
(thereby removing these non-SCI systems from the scope of indirect SCI
systems), which would decrease the risk that non-SCI systems provide
vulnerable points of entry into SCI systems and cause security-related
issues at SCI systems. The reduction in security-related SCI systems
issues could lead to fewer interruptions in the price discovery process
and liquidity flows and thus result in fewer periods with pricing
inefficiencies as discussed in Section VI.C.1.
---------------------------------------------------------------------------

    \1905\ As discussed in Section IV.A.2.d, ``SCI security
systems'' have been renamed ``indirect SCI systems'' and its
definition has been revised in response to commenters who expressed
concern about the breadth of the proposed definition. Because the
definition of indirect SCI systems has been refined from the
proposal, the compliance costs associated with indirect SCI systems
(discussed below) would be lower relative to the compliance costs
associated with the proposed rules.
    \1906\ As proposed, ``SCI security systems'' means any systems
that share network resources with SCI systems that, if breached,
would be reasonably likely to pose a security threat to SCI systems.
    \1907\ Some SCI entities currently employ a wide variety of
means to separate their systems, including logical and physical
separation.
---------------------------------------------------------------------------

    Regulation SCI specifies the obligations SCI entities would have
with respect to SCI systems and indirect SCI systems. As mentioned
above, the definition of SCI systems includes more systems than the ARP
Inspection Program traditionally covered, and ``indirect SCI systems''
is not defined for purposes of the ARP Inspection Program or Regulation
ATS. Because Regulation SCI applies to SCI systems and indirect SCI
systems, SCI entities will incur compliance costs, discussed in detail
further below in Section VI.C.2, which include, among other things,
costs associated with policies and procedures related to such systems.
Furthermore, as mentioned above, the definition of SCI systems includes
systems that directly support trading, clearance and settlement, order
routing, and market data, which are covered by the ARP Inspection
Program. Accordingly, the Commission believes that initial compliance
costs associated with SCI systems will be higher for SCI entities that
are not currently participating in the ARP Inspection Program (e.g.,
some SCI ATSs) as compared to ARP Inspection Program participants that
have established practices consistent with the ARP Policy Statements.
Although the Commission believes that some SCI ATSs will generally
incur higher initial compliance costs associated with the requirements
of Rule 1001 compared to other SCI entities that are current
participants in the ARP Inspection Program, the difference in initial
compliance costs could be limited because, as currently constituted,
relative to the systems of SCI SROs, the systems of SCI ATSs generally
would not fall within the category of critical SCI systems, and thus
such SCI ATSs would not be subject to the more stringent requirements
that would be applicable to the critical SCI systems of other SCI
entities. Further, as discussed in Section VI.C.1, the Commission
believes that Regulation SCI could have an impact on competition among
SCI entities in part because the initial compliance costs associated
with SCI systems and indirect SCI systems will vary across SCI
entities.
    In the SCI Proposal, the Commission defined SCI systems more
broadly than it has in the adopted rule. Specifically, the proposed
definition of SCI systems would have included all regulation and
surveillance systems, as well as development and testing systems. As
discussed above in Section IV.A.2.b, after considering, among other
things, the views of commenters that the definition of SCI systems was
overbroad and, thus, could cover nearly all systems of an SCI entity,
the Commission refined the definition of SCI systems.\1908\
Specifically, the scope of adopted Regulation SCI does not cover member
regulation or member surveillance systems such as those, for example,
relating to member registration, capital requirements, or dispute
resolution, because issues relating to such systems are unlikely to
have the same level of impact on the maintenance of fair and orderly
markets or an SCI entity's operational capability as those systems
identified in the definition of SCI systems. Consequently, the
Commission does not believe that the exclusion of member regulation and
member surveillance systems will significantly reduce the benefits of
Regulations SCI discussed in Section VI.C.1. Furthermore, the
Commission believes that the exclusion of member regulation and member
surveillance systems from the adopted definition of SCI systems will
substantially reduce the costs of compliance with Regulation SCI
relative to the proposal because it reduces the potential number of SCI
events that would be subject to the Commission notification
requirements compared to the proposal.
---------------------------------------------------------------------------

    \1908\ See supra Section IV.A.2.b (discussing the definition of
SCI systems).
---------------------------------------------------------------------------

    As discussed above in Section IV.A.2.b, many commenters also
opposed the inclusion of development and testing systems in the
definition of SCI system, stating that issues in development and
testing systems would have little or no impact on the operations of SCI
entities.\1909\ The Commission agrees that issues with development and
testing systems generally have less of an impact on the SCI entity's
operations than production systems that directly support trading,
clearance and settlements, order routing, market data, market
regulation, and market surveillance. In response to comment letters,
the adopted definition of SCI systems is limited to systems that
directly support trading, clearance and settlement, order routing,
market data, market regulation, and market surveillance, and does not
include development and testing systems. Consequently, the requirements
of Regulation SCI that are triggered by the definition of SCI systems
do not apply to development and testing systems. However, the
Commission recognizes that there would be benefits from maintaining
robust development and testing systems because these systems are
important in ensuring the reliability and resiliency of systems of SCI
entities. As discussed in Section IV.A.2.b, in order to have policies
and procedures reasonably designed to ensure capacity, integrity,
resiliency, availability, and security for SCI systems (and indirect
SCI systems, as applicable) in accordance with adopted Rule 1001(a), an
SCI entity will be required to have policies and procedures that
include a program to review and keep current systems development and
testing methodology for such systems.\1910\
---------------------------------------------------------------------------

    \1909\ See supra note 234 and accompanying text.
    \1910\ Further, as discussed above, the definition of SCI review
and the corresponding requirement for an annual SCI review require
an assessment of internal control design and effectiveness, which
includes development processes. In addition, if development and
testing systems are not appropriately walled off from production
systems, such systems could be captured under the definition of
indirect SCI systems and be subject to the requirements of
Regulation SCI.
---------------------------------------------------------------------------

    A few commenters advocated that SCI entities should be permitted to
conduct their own risk-based assessment in determining the scope of SCI
systems.\1911\ As discussed in Section IV.A.2.b, rather than limiting
the definition of SCI systems to systems that pose a greater risk to
the markets in the event of a systems issue or that are of paramount
importance to the functioning of the U.S. securities market, the
Commission is subjecting those systems that meet the definition of
``critical SCI systems'' to certain heightened requirements under

Regulation SCI. The Commission continues to believe that any systems
issues involving systems that directly support one of the six functions
(trading, clearance and settlement, order routing, market data, market
regulation, or market surveillance) listed in the definition of SCI
systems could also cause significant market disruptions and, thus,
including such systems and imposing heightened requirements on a subset
of such systems--critical SCI systems--should help realize the benefits
of Regulation SCI discussed in Section VI.C.1.a.
---------------------------------------------------------------------------

    \1911\ See DTCC Letter at 3-5; Omgeo Letter at 5-6; and OCC
Letter at 3-4.
---------------------------------------------------------------------------

    As discussed above in Section IV.A.2.b, the definition of SCI
systems includes any system that is operated by a third-party on behalf
of an SCI entity and directly supports one of the six key functions
(trading, clearance and settlement, order routing, market data, market
regulation, or market surveillance) listed in the definition of SCI
systems. The Commission understands that many SCI entities and many
SROs, in particular, rely heavily on outsourcing to help test, operate,
and run various systems in their daily operations and that they
outsource networks, data center operations, and many of the products
and systems that support their trading and/or clearing systems. The
Commission also notes that its staff already discusses with ARP
entities their use of certain third-party systems as necessary under
the ARP Inspection Program. Because of this reliance on outsourcing to
third party systems, the Commission believes that including any system
that directly supports one of the six functions listed in the
definition of SCI system, regardless of whether it is operated by the
SCI entity directly or by a third party, is important in reducing
systems issues and, thus, promoting pricing efficiency and price
discovery process.
    Several commenters stated that the definition of SCI systems should
not include systems operated on behalf of an SCI entity by a third-
party.\1912\ These commenters expressed concerns about potential
difficulties with meeting the requirements of Regulation SCI with
regard to third-party systems.\1913\ Another commenter questioned
whether the Commission considered the costs and benefits of including
third-party systems within the definition.\1914\ This commenter also
noted that the inclusion of third-party systems may force SCI entities
to insource functions that are more efficiently performed by vendors,
and the cost of insourcing will be passed along to members and market
participants and may degrade competition.\1915\
---------------------------------------------------------------------------

    \1912\ See, e.g., Omgeo Letter at 5-6; and BATS Letter at 4.
    \1913\ See, e.g., Omgeo Letter at 5-6; and BATS Letter at 4.
    \1914\ See BATS Letter at 4-5.
    \1915\ See id. at 5.
---------------------------------------------------------------------------

    As discussed above, the Commission believes that, among other
reasons, allowing systems operated on behalf of an SCI entity by a
third-party to be excluded from the requirements of Regulation SCI
would reduce the effectiveness of the regulation in promoting the
national market system by ensuring the capacity, integrity, resiliency,
availability, and security of those systems important to the
functioning of the U.S. securities markets.\1916\ The Commission
acknowledges that ensuring compliance of systems operated by a third-
party with Regulation SCI may be more costly than ensuring compliance
of internal systems with Regulation SCI because of search costs
associated with employing adequate third-party systems or services and
the additional communication needed with the third-party service
provider. The Commission acknowledges that higher compliance costs
associated with managing third-party systems could be passed on to
market participants.
---------------------------------------------------------------------------

    \1916\ See supra Section IV.A.2.b (discussing the definition of
``SCI systems'').
---------------------------------------------------------------------------

    Moreover, the Commission recognizes that the inclusion of systems
operated by a third-party on behalf of an SCI entity in the scope of
SCI systems may in certain cases make it more difficult for an SCI
entity to utilize third parties because the SCI entity is required to
ensure that SCI systems and indirect SCI systems operated on its behalf
by a third party are operated in compliance with Regulation SCI. In
particular, the SCI entity might not be able to ensure that systems
operated by certain third parties are in compliance with Regulation SCI
and therefore might not be able to utilize such third-party service
providers. Limitations on the choice of third-party systems could lower
the quality of employable third-party systems because the employable
third-party systems may not be best suited for the SCI entity or be the
best available of its type. At this time, however, it is difficult to
estimate the extent to which inclusion of systems operated by third
parties on behalf of an SCI entity in the definition of SCI systems
will alter outsourcing arrangements in a manner that would result in
reducing an SCI entity's ability to maintain its operational capability
and promote the maintenance of fair and orderly markets. While the
Commission understands that SROs outsource some systems, the Commission
lacks sufficient information regarding the specific contractual
relationships between SCI entities and third-party service providers.
    Furthermore, if--due to limited options on employable third-
parties--an SCI entity decides to insource systems that could be more
cost-effectively provided by third parties with relevant expertise, the
quality of such systems may be adversely affected, while the cost to
the SCI entity may be increased. As such, Regulation SCI could impose
higher costs on SCI entities that are currently more dependent on
third-party systems for their operations than SCI entities that
primarily employ their own systems and therefore could potentially have
adverse effects on competition among SCI entities. In addition, the
requirements of Regulation SCI could force some third-party vendors out
of the market for SCI systems or indirect SCI systems. In this respect,
Regulation SCI could negatively impact such vendors and reduce the
ability for some third-party vendors to compete in the market for SCI
systems and indirect SCI systems, with attendant costs to SCI entities.
However, Regulation SCI, over time, could result in quality
improvements for systems or services provided by such third-party
vendors as vendors that primarily provide services to SCI entities may
compete in part on the quality of their systems in light of the
requirements of Regulation SCI.
iii. SCI Events
    Rule 1000 defines SCI events to include systems disruptions,
systems compliance issues, and systems intrusions. Further, for
purposes of the information dissemination requirement under Rule
1002(c), the Commission defines the new term, major SCI event, to mean
an SCI event that has had, or the SCI entity reasonably estimates would
have, any impact on a critical SCI system, or a significant impact on
the SCI entity's operations or on market participants. As discussed
further below, Regulation SCI requires SCI entities to take appropriate
corrective actions in response to SCI events (Rule 1002(a)), notify the
Commission of SCI events (Rule 1002(b)), and disseminate information
regarding certain major SCI events to all members or participants of an
SCI entity and certain other SCI events to affected members or
participants (Rule 1002(c)).
    Prior to the adoption of Regulation SCI, ``systems disruption'' was
not defined by Commission rule. Rather, in the 2001 Staff ARP
Interpretive Letter, Commission staff provided guidance on

examples of significant systems outages that should be reported to
Commission staff.\1917\ The Commission understands that ARP
participants currently exercise a level of discretion in determining
what systems issues constitute significant systems outages.
---------------------------------------------------------------------------

    \1917\ See 2001 Staff ARP Interpretive Letter, supra note 21.
---------------------------------------------------------------------------

    As adopted, ``systems disruption'' is defined to mean an event in
an SCI entity's SCI systems that disrupts, or significantly degrades,
the normal operation of an SCI system. The Commission believes the
revised definition sets forth a standard that SCI entities can apply in
a wide variety of circumstances to determine in their discretion
whether a systems issue should be appropriately categorized as a
systems disruption. The adopted definition of systems disruption
potentially covers types of events that were not articulated as part of
Commission staff guidance regarding significant systems outages, and at
the same time potentially excludes types of systems events that were
articulated as part of such guidance. The Commission, however, believes
that the adopted definition of systems disruptions would more
appropriately capture material or significant systems issues than the
2001 Staff ARP Interpretive Letter. Accordingly, the inclusion of
systems disruptions in the definition of SCI event, along with the
requirements of taking timely corrective actions, Commission
notification, information dissemination, and recordkeeping on these
systems issues, should help effectively reduce the severity and
duration of events that harm pricing efficiency, price discovery, and
liquidity and help Commission oversight of the securities markets. The
Commission also acknowledges that SCI entities will incur some costs to
determine whether a systems disruption has occurred. The Commission
notes that these costs should be lower compared to the proposed
definition, in part, because the adopted definition of systems
disruption sets forth a standard that permits SCI entities to more
effectively identify such systems issues.
    As discussed in Section IV.A.3.a, after considering the views of
commenters that the proposed definition of systems disruption was too
prescriptive, insufficiently flexible, and should be limited to
material systems disruptions, the Commission has taken a different
approach. Instead of the proposed seven-prong prescriptive definition
representing the effects caused by a disruption of an SCI entity's
systems, the adopted definition focuses on whether a system is halted
or degraded in a manner that is outside of its normal operation. The
proposed definition had the potential to incorporate certain types of
minor events that should more appropriately fall outside the purview of
the regulation. Similarly, the prescriptive approach of the proposed
definition also had the potential to exclude certain types of events
that were significant enough to warrant inclusion, but may otherwise
have gone unreported because they were not one of the seven enumerated
types of systems malfunctions.
    Currently, ``systems intrusion'' is not defined by Commission rule
or Commission staff guidance. The Commission believes that regulated
entities exercise a level of discretion in determining what systems
intrusions to report to Commission staff. By adopting a definition of
systems intrusion, the Commission is specifying the criteria for SCI
entities to use to identify systems intrusions that would be subject to
Regulation SCI. The definition of systems intrusion covers successful
unauthorized entry to SCI systems and indirect SCI systems.
Unauthorized access, destruction, and manipulation of SCI systems and
indirect SCI systems could adversely affect the markets and market
participants because intruders could force systems to operate in
unintended ways that could create significant disruptions in securities
markets. Therefore, the inclusion of systems intrusions in the
definition of SCI events can help reduce the risk of such adverse
effects. The Commission believes that the inclusion of systems
intrusion in the definition of SCI event should help ensure consistent
compliance with the requirements of taking timely corrective actions,
Commission notification, information dissemination, and recordkeeping
and, thus, should help realize the benefits of those requirements
discussed in sections below. The Commission also acknowledges that SCI
entities will incur some costs to determine whether a systems intrusion
has occurred.
    Currently, ``systems compliance issue'' is also not defined by
Commission rule or Commission staff guidance and the Commission
believes that regulated entities exercise a level of discretion in
determining what systems compliance-related issues to report to
Commission staff. While the ARP Policy Statements do not address
systems compliance issues, some SCI entities notify the Commission of
certain systems compliance-related issues.\1918\ As noted above,
however, the Commission does not receive comprehensive data regarding
such issues. By adopting a definition of systems compliance issue, the
Commission is specifying the criteria for SCI entities to use to
identify systems compliance issues that would be subject to Regulation
SCI.
---------------------------------------------------------------------------

    \1918\ See supra note 1803 and accompanying text. As part of the
Commission's oversight of SROs, OCIE reviews systems compliance
issues reported to Commission staff.
---------------------------------------------------------------------------

    By defining SCI events to include systems compliance issues, the
Commission believes Regulation SCI should further assist the Commission
in its oversight of SCI entities and in the protection of investors.
Specifically, the Commission believes that inclusion of systems
compliance issues in the definition of SCI event and the resulting
applicability of the Commission reporting, information dissemination,
and recordkeeping requirements are important to help ensure that SCI
systems are operated by SCI entities in compliance with the Exchange
Act, rules thereunder, and their own rules and governing
documents.\1919\ In addition, the Commission believes that, as part of
its oversight of the securities markets, it should learn of a non-de
minimis systems compliance issue immediately upon an SCI entity having
a reasonable basis to conclude that such a systems compliance issue has
occurred so that the Commission may consider whether there has been any
resulting harm to investors or market participants. The Commission also
acknowledges that SCI entities could incur some costs to determine
whether a systems compliance issue has occurred.
---------------------------------------------------------------------------

    \1919\ See supra Section IV.A.3.b.
---------------------------------------------------------------------------

    The Commission notes that it has refined the definition of systems
compliance issue as compared to the proposal by replacing the phrase
``federal securities laws'' with ``the Act.'' \1920\ Accordingly, the
number of systems compliance issues subject to Regulation SCI could be
no greater and possibly lower than if the Commission adopted the
definition of systems compliance issue as proposed and there could be a
corresponding reduction in benefits, compared to the proposal, as a
result of adopting a targeted definition.\1921\
---------------------------------------------------------------------------

    \1920\ See id.
    \1921\ For example, the adopted definition of systems compliance
issue makes explicit that the requirements of Regulation SCI do not
apply to any obligations that an SCI entity has under the Securities
Act of 1933.
---------------------------------------------------------------------------

    Regulation SCI also defines ``major SCI event.'' The addition of
the definition of major SCI event allows the requirement for
dissemination of

information to all members or participants of an SCI entity to be
consistent with a tiered, risk-based approach. As discussed in Section
VI.C.2.b.iv below and in Section VI.C.1 above, dissemination of
information regarding SCI events to all members or participants of an
SCI entity can result in benefits and affect competitive incentives to
prevent systems issues. The Commission acknowledges, however, that the
benefits of information dissemination to all members or participants of
an SCI entity would not be realized if SCI entities were required to
disseminate too many events, creating confusion about which events are
meaningful, or if SCI entities were required to disseminate too few
events. The definition of major SCI events provides a targeted approach
to determining which events are appropriately disseminated to all
members or participants of an SCI entity. The Commission also
acknowledges that, as discussed in Section VI.C.2.b.iv below, SCI
entities would incur compliance costs associated with developing a
process for determining major SCI events and de minimis SCI events.
    SCI entities will incur compliance costs with regard to the
requirements of Regulation SCI. As noted above, the definition of SCI
event includes systems disruptions and systems intrusions, terms that
are not defined under the ARP Inspection Program, but which are
contemplated by the ARP Inspection Program's attention to systems
failures, disruptions, and other systems problems, including systems
vulnerability.\1922\ To this extent, the initial compliance costs
associated with SCI events may be higher for SCI entities that are not
currently participating in the ARP Inspection Program than for those
currently participating in the ARP Inspection Program. Similarly, the
initial compliance costs associated with SCI events will be higher for
SCI entities that do not currently self-report systems compliance-
related issues to the Commission than those that do. As discussed in
Section VI.C.1, the Commission believes that Regulation SCI will have
an impact on competition among SCI entities because the initial
compliance costs stemming from the definition of SCI events will be
different among SCI entities. However, all SCI entities, regardless of
current participation in the ARP Inspection Program or self-reporting
of systems compliance-related issues, could incur costs associated with
the inclusion of major SCI events as a definition.
---------------------------------------------------------------------------

    \1922\ See supra Section II.A (discussing the ARP Inspection
Program).
---------------------------------------------------------------------------

    As an alternative to the adopted definitions of SCI event, several
commenters suggested that the definition of SCI event include a
materiality threshold such that certain Regulation SCI requirements
would apply only to events that exceed the threshold, as determined by
the SCI entity.\1923\ The Commission is not persuaded that
incorporating a materiality threshold into the definition of SCI event
would appropriately capture SCI events. Some systems issues, which may
initially seem insignificant to an SCI entity, may later prove to be
the source of significant systems issues at the SCI entity.
Furthermore, there could be incidences in which systems issues cause
minor disruptions for one particular SCI entity but result in
significant disruptions for another SCI entity or market participant.
Under the use of the suggested materiality threshold, such systems
issues could be overlooked and timely corrective action may not be
taken.
---------------------------------------------------------------------------

    \1923\ See supra note 334 and accompanying text.
---------------------------------------------------------------------------

b. Requirements for SCI Entities--Rules 1001-1004
i. Policies and Procedures--Rules 1001(a), (b), and (c)
    Rules 1001(a), (b), and (c) set forth requirements relating to the
written policies and procedures that SCI entities are required to
establish, maintain, and enforce. Rule 1001(a) requires an SCI entity
to establish, maintain, and enforce written policies and procedures
reasonably designed to ensure that its SCI systems and, for purposes of
security standards, indirect SCI systems, have levels of capacity,
integrity, resiliency, availability, and security, adequate to maintain
the SCI entity's operational capability and promote the maintenance of
fair and orderly markets. Rule 1001(b) requires an SCI entity to
establish, maintain, and enforce written policies and procedures
reasonably designed to ensure that its SCI systems operate in a manner
that complies with the Exchange Act and the rules regulations
thereunder and the entity's rules and governing documents, as
applicable. Rule 1001(c) requires an SCI entity to establish, maintain,
and enforce reasonably designed written policies and procedures that
include the criteria for identifying responsible SCI personnel, the
designation and documentation of responsible SCI personnel, and
escalation procedures to quickly inform responsible SCI personnel of
potential SCI events. This section discusses the economic effects of
requiring these policies and procedures, both individually and as a
whole.
    The Commission believes the policies and procedures requirements as
a whole should reduce the risk and incidences of SCI events because
they are requirements under Commission rules rather than voluntary
guidelines, and require SCI entities to establish, maintain, and
enforce written policies and procedures related to capacity, integrity,
resiliency, availability, security, compliance, responsible SCI
personnel, and escalation. Also, policies and procedures requirements
as a whole should reduce the risk and incidences of SCI events by
imposing requirements on entities that are not currently participating
in the ARP Inspection Program, and by covering areas not currently
within the scope of the ARP Inspection Program, such as policies and
procedures regarding systems compliance.\1924\ The policies and
procedures requirements in Regulation SCI should help ensure faster
recoveries from systems disruptions, systems compliance issues, and
systems intrusions. As discussed in Section VI.C.1, reducing the risk,
incidence, and duration of SCI events could reduce interruptions in the
price discovery process and liquidity flows and thus result in reduced
periods with pricing inefficiencies.
---------------------------------------------------------------------------

    \1924\ With respect to NASD and FINRA rules identified by
commenters, although they have some broad relation to certain
aspects of the policies and procedures provisions under Regulation
SCI, the Commission is not persuaded that these rules, even when
taken together, are an appropriate substitute for the comprehensive
approach in Regulation SCI with respect to technology systems and
system issues. See NASD Rule 3010(b)(1) and FINRA Rule 3130. See
also supra note 115.
---------------------------------------------------------------------------

    The Commission also recognizes that the policies and procedures
requirements of Regulation SCI will impose certain costs. In general,
the Commission believes that some SCI entities that participate in the
ARP Inspection Program already comply with some of the requirements of
Rule 1001 and thus would incur lower initial costs to comply with the
requirements of Rule 1001 than SCI entities that do not participate in
the ARP Inspection Program. Additionally, some SCI entities that
currently participate in the ARP Inspection Program are large and have
complex systems and, therefore, will incur more costs to comply with
Rule 1001 than others. Furthermore, SCI entities that do not currently
participate in the ARP Inspection Program will also face costs to
comply with Rule 1001 if they do not already have policies and
procedures similar to those required by

Rule 1001. These costs are discussed further below.
Quantifiable Costs
    In the SCI Proposal, based on discussion with industry
participants, the Commission estimated that, to comply with all
requirements underlying the policies and procedures required by
proposed Rules 1000(b)(1) and (2) other than paperwork burdens, on
average, each SCI entity would incur an initial cost of between
approximately $400,000 and $3 million.\1925\ Based on this estimated
range in costs, the Commission estimated that in the aggregate SCI
entities would incur a total initial cost of between approximately
$17.6 million \1926\ and $132 million \1927\ to comply with proposed
Rules 1000(b)(1) and (2). In addition, the Commission estimated that,
to comply with the policies and procedures required by proposed Rules
1000(b)(1) and (2), on average, each SCI entity would incur an ongoing
annual cost of between approximately $267,000 \1928\ and $2
million.\1929\ Based on this estimated range, the Commission estimated
that in the aggregate SCI entities would incur a total annual ongoing
cost of between approximately $11.7 million \1930\ and $88
million.\1931\
---------------------------------------------------------------------------

    \1925\ See Proposing Release, supra note 13, at 18171. As
explained in the SCI proposal, the Commission preliminarily
estimated a range of cost for complying with the policies and
procedures required by proposed Rules 1000(b)(1) and (2) because
some SCI entities are already in compliance with some of these
requirements and thus would likely need to incur less costs to
comply with the rules. For example, the Commission believed that
many SCI SROs (e.g., certain national securities exchanges and
registered clearing agencies) already have or have begun
implementation of business continuity and disaster recovery plans
that include maintaining backup and recovery capabilities
sufficiently resilient and geographically diverse to ensure next
business day resumption of trading and two-hour resumption of
clearance and settlement services following a wide-scale disruption.
See id. at 18171, n. 633.
    \1926\ See id. at 18171, n. 634.
    \1927\ See id. at 18171, n. 635.
    \1928\ See id. at 18172, n. 637.
    \1929\ See id. at 18172, n. 638.
    \1930\ See id.
    \1931\ See id. at 18172, n. 640.
---------------------------------------------------------------------------

    One commenter noted that the Commission did not provide sufficient
discussion of the basis for the cost estimates for complying with the
policies and procedures required by proposed Rules 1000(b)(1) and
(2).\1932\ However, this commenter was cautiously confident that its
initial cost for full implementation of proposed Rules 1000(b)(1) and
(2) would not exceed $3 million plus four times the estimated burden
under the Paperwork Reduction Act analysis, although the commenter
believed that such cost would not be less than half of such $3 million
plus at least three times the Paperwork Reduction Act estimate.\1933\
This commenter further noted that the approach taken by the Commission
in the proposal with regard to federal securities law liabilities and
the safe harbors likely will result in increased insurance costs for
SCI entities and higher salaries for employees.\1934\
---------------------------------------------------------------------------

    \1932\ See MSRB Letter at 30.
    \1933\ See id. at 31. According to this commenter, if as a
result of the restrictive listing of industry standards in Table A,
it determines that it should adhere to one of the listed standards
rather than the standards to which it currently adheres, its cost of
compliance with proposed Rule 1000(b)(1) would be considerably
increased and its total cost for compliance with proposed Rules
1000(b)(1) and (2) would likely be at or near $3 million plus four
times the estimated burden under the Paperwork Reduction Act
analysis. See id. As noted above in Section IV.B.1.b.iii, the
Commission believes that staff guidance should be characterized as
listing examples of publications describing processes, guidelines,
frameworks, and/or standards for an SCI entity to consider looking
to in developing reasonable policies and procedures, rather than
strictly as listing examples of ``standards.'' As such, nothing that
the staff may include in its guidance precludes an SCI entity from
adhering to standards such as ISO 27000, COBIT, or others referenced
by commenters to the extent they result in policies and procedures
that comply with the requirements of Rule 1001(a).
    \1934\ See id. The commenter did not provide an estimate of the
anticipated increased insurance costs for SCI entities and higher
salaries for employees. The Commission acknowledges that SCI
entities may incur increased insurance and personnel costs because
of the potential additional liability associated with Regulation
SCI, although the Commission is unable to estimate these costs given
it lacks specific information regarding current personnel and
insurance costs and the amount of any potential increases associated
with changes in liability. The Commission also notes that many
entities that fall within the definition of SCI entity could already
be subject to liability for systems issues and thus may already
largely be incurring these insurance and personnel costs.
---------------------------------------------------------------------------

    Another commenter noted that, without further clarification, the
broad scope of the policies and procedures requirement under Regulation
SCI could be burdensome, in terms of the cost of developing and
implementing new (or enhancing existing) policies and procedures, and
in terms of complying and documenting compliance under such policies
and procedures.\1935\ According to this commenter, these requirements
could significantly increase technology project costs (e.g., for
testing, monitoring, and compliance staff) and would significantly
prolong the systems development lifecycle and time to market.\1936\
With respect to the Commission's cost estimate for proposed Rules
1000(b)(1) and (2), another commenter noted that the Commission's
estimates do not adequately account for the opportunity costs of delays
in systems innovation.\1937\ This commenter stated that the Commission
did not address the significant costs of complying with the
requirements concerning the capacity, integrity, resiliency,
availability, and security of systems.\1938\
---------------------------------------------------------------------------

    \1935\ See FINRA Letter at 32. The estimated burden associated
with the development and maintenance of policies and procedures is
discussed in the Paperwork Reduction Act section above. See supra
Section V.D.1.a.
    \1936\ See FINRA Letter at 32.
    \1937\ See ITG Letter at 7. This commenter also noted that the
estimates do not adequately account for the monitoring and
notification costs that would be engendered by the proposal. See id.
    \1938\ See id.
---------------------------------------------------------------------------

    After considering the views of these commenters and in light of the
changes to the proposed rules, the Commission now estimates that, to
comply with all requirements underlying the policies and procedures
required by Rules 1001(a) and (b),\1939\ other than paperwork burdens,
on average, each SCI entity will incur an initial cost of between
approximately $320,000 and $2.4 million and an ongoing annual cost of
between approximately $213,600 and $1.6 million.\1940\ The Commission
notes that it has reduced the cost for complying with the policies and
procedures required by Rules 1001(a) and (b) in a variety of ways,
including by, for example: Refining the definition of SCI systems; more
explicitly allowing SCI entities to tailor policies and procedures
consistent with a risk-based approach; having separate staff guidance
on current SCI industry standards rather than Commission guidance
through proposed Table A, with staff guidance characterized as listing
examples of publications describing processes, guidelines, frameworks,
and/or standards for an SCI entity to consider looking to in developing
reasonable policies and procedures, rather than strictly as listing
examples of

``standards;'' and focusing compliance on the Exchange Act rather than
federal securities laws generally.
---------------------------------------------------------------------------

    \1939\ These include, for example, establishing current and
future capacity planning estimates, capacity stress testing,
reviewing and keeping current systems development and testing
methodology, regular reviews and testing to detect vulnerabilities,
testing of all SCI systems and changes to SCI systems prior to
implementation, implementing a system of internal controls,
implementing a plan for assessments of the functionality of SCI
systems, implementing a plan of coordination and communication
between regulatory and other personnel of the SCI entity, including
by responsible SCI personnel, designed to detect and prevent systems
compliance issues, and hiring additional staff.
    \1940\ The Commission estimates an average range of cost for
complying with the policies and procedures required by Rules 1001(a)
and (b) because some SCI entities are already in compliance with
some of these requirements. The Commission recognizes that, for SCI
entities that do not currently comply with the policies and
procedures required by Rules 1001(a) and (b), their cost of
compliance may, depending on their nature, size, technology,
business model, and other aspects of their business, be at the upper
end of the estimated average cost range.
---------------------------------------------------------------------------

    At the same time, the Commission acknowledges that other aspects of
the compliance costs could potentially be higher for the adopted rules
than the proposed rules. For example, the requirement for a goal of
two-hour resumption for all critical SCI systems (rather than only
clearance and settlement systems) could increase compliance costs for
SCI entities with critical SCI systems as compared to the proposal.
However, as discussed above, the Commission has specified that the
stated recovery timeframes in Regulation SCI are goals, rather than
inflexible requirements.\1941\ In addition, for some SCI entities that
would have chosen to not use the proposed SCI entity safe harbor, the
Commission's adoption of non-exhaustive, general minimum elements for
systems compliance policies and procedures in Rule 1001(b)(2) could
increase compliance costs as compared to the proposal. Based on the
foregoing, the Commission believes that it is reasonable to revise the
estimate to reflect the more targeted scope and increased flexibility
of the adopted regulation, as compared to the proposal, in combination
with potential increased costs associated with compliance with Rules
1001(a)(2)(v) and 1001(b)(2), and new costs associated with compliance
with Rule 1001(a)(2)(vii).\1942\ Therefore, the Commission believes
that on balance overall, the costs will be reduced, and in its best
judgment, each SCI entity is likely to incur an initial cost of between
approximately $320,000 and $2.4 million and an ongoing annual cost of
between approximately $213,600 and $1.6 million for complying with the
policies and procedures required by Rules 1001(a) and (b). However, the
Commission acknowledges that its cost estimates reflect a high degree
of uncertainty. As noted above, the compliance costs of Rule 1001 may
depend on the complexity of SCI entities' systems (e.g., the compliance
costs will be higher for SCI entities with more complex systems). The
initial compliance costs associated with Rule 1001 may also vary across
SCI entities depending on the degree of current practices' compliance
with the requirements of Rule 1001. Because it is difficult to gauge
the precise degree of current compliance for each SCI entity in
estimating potential costs with respect to Rule 1001 at this time, the
Commission is estimating a range of compliance costs above.
---------------------------------------------------------------------------

    \1941\ See supra note 504 and accompanying text.
    \1942\ Rule 1001s(a)(2)(v), 1001(a)(2)(vii), and 1001(b)(2) are
discussed further below.
---------------------------------------------------------------------------

    The Commission estimates that, in the aggregate, SCI entities will
incur a total initial cost of between approximately $14 million \1943\
and $106 million \1944\ to comply with the policies and procedures
required by Rules 1001(a) and (b). In addition, the Commission
estimates that, in the aggregate, SCI entities will incur total annual
ongoing cost of between approximately $9 million \1945\ and $70
million.\1946\ These cost estimates are intended to cover the cost of
complying with all substantive requirements under Rules 1001(a) and (b)
other than paperwork related burdens.
---------------------------------------------------------------------------

    \1943\ $320,000 x 44 SCI entities = $14.1 million.
    \1944\ $2.4 million x 44 SCI entities = $105.6 million.
    \1945\ $213,600 x 44 SCI entities = $9.4 million.
    \1946\ $1.6 million x 44 SCI entities = $70.4 million.
---------------------------------------------------------------------------

    The Commission acknowledges that, for SCI entities, the
requirements of Rules 1001(a) and (b) could increase technology project
costs, prolong the systems development lifecycle and time to market,
and result in opportunity costs because of potential delays in systems
innovation.\1947\ On the other hand, as discussed throughout this
release, the Commission believes that entities that are important to
the functioning of the U.S. securities markets should be required to
have policies and procedures reasonably designed to ensure systems
capacity, integrity, resiliency, availability, security, and
compliance. Further, as discussed above in Sections IV.B.1 and IV.B.2,
the Commission has focused the scope of Rules 1001(a) and (b) as
compared to the SCI Proposal. Moreover, in tandem with the adoption of
a definition of critical SCI systems, the Commission is making more
clear that Rule 1001(a) permits SCI entities to tailor policies and
procedures consistent with a risk-based approach. With respect to Rule
1001(b), the Commission is adopting non-exhaustive, general minimum
elements that an SCI entity must include in its systems compliance
policies and procedures.\1948\
---------------------------------------------------------------------------

    \1947\ See supra note 1936 and accompanying text (discussing a
commenter's view regarding the potential economic effects of the
policies and procedures requirements).
    \1948\ See supra note 1935 and accompanying text (discussing a
commenter's views that, without clarification, the policies and
procedures requirement under Regulation SCI could be burdensome).
---------------------------------------------------------------------------

Benefits and Qualitative Costs
Capacity, Integrity, Resiliency, Availability, and Security
    Rule 1001(a)(1) requires that each SCI entity establish, maintain,
and enforce written policies and procedures reasonably designed to
ensure that its SCI systems and, for purposes of security standards,
indirect SCI systems, have levels of capacity, integrity, resiliency,
availability, and security, adequate to maintain the SCI entity's
operational capability and promote the maintenance of fair and orderly
markets. Rule 1001(a)(2)(i)-(iv) provides that an SCI entity's policies
and procedures under Rule 1001(a) must include, at a minimum: (i) The
establishment of reasonable current and future technological
infrastructure capacity planning estimates; (ii) periodic capacity
stress tests of systems to determine their ability to process
transactions in an accurate, timely, and efficient manner; (iii) a
program to review and keep current systems development and testing
methodology of such systems; and (iv) regular reviews and testing, as
applicable, of systems, including backup systems, to identify
vulnerabilities pertaining to internal and external threats, physical
hazards, and natural or manmade disasters.\1949\
---------------------------------------------------------------------------

    \1949\ See Rule 1001(a)(2) and supra Section IV.B.1.
---------------------------------------------------------------------------

    Rules 1001(a)(1) and (2)(i)-(iv) codify and expand certain
provisions of the ARP Policy Statements. They also expand on the
requirements under Rule 301(b)(6) of Regulation ATS for ATSs that trade
NMS stocks and non-NMS stocks. In particular, under the ARP Policy
Statements and through the ARP Inspection Program, ARP participants,
among other things, are expected to establish current and future
capacity estimates; conduct capacity stress tests; and conduct annual
reviews that cover significant elements of the operations of the
automation process, including the capacity planning and testing
process, contingency planning, systems development methodology, and
vulnerability assessments. Further, Rule 301(b)(6) requires certain
ATSs, with respect to those systems that support order entry, order
routing, order execution, transaction reporting, and trade comparison,
to establish certain capacity estimates, conduct periodic capacity
stress tests of critical systems, develop and implement reasonable
procedures to review and keep current systems development and testing
methodology, review the vulnerability of their systems and data center
computer operations to specified threats, establish adequate
contingency and disaster recovery plans, conduct an independent review
of their systems controls annually for ensuring that Rule
301(b)(6)(ii)(A)-(E) are met and conduct a review by senior management
of a report of the independent review, and

promptly notify the Commission of certain systems outages and systems
changes.\1950\
---------------------------------------------------------------------------

    \1950\ See 17 CFR 242.301(b)(6)(ii).
---------------------------------------------------------------------------

    As mentioned above, Rules 1001(a)(1) and (2)(i)-(iv) codify certain
aspects of the ARP Policy Statements. For SCI entities that are current
participants in the ARP Inspection Program, codifying these aspects
into requirements to establish policies and procedures should help
ensure more robust systems that help realize the benefits of Regulation
SCI discussed in Section VI.C.1.\1951\
---------------------------------------------------------------------------

    \1951\ Likewise, the relocation and modification of certain
requirements in Rule 301(b)(6) of Regulation ATS applicable to
significant-volume ATSs that trade NMS stocks and non-NMS stocks
will help ensure that SCI ATSs create and maintain policies and
procedures to support robust systems. See supra note 2 and
accompanying text (noting that Regulation SCI, in addition to
codifying the ARP Policy Statements, also supersedes and replaces
aspects of those policy statements codified in Rule 301(b)(6) under
the Exchange Act for significant-volume ATSs that trade NMS stocks
and non-NMS stocks).
---------------------------------------------------------------------------

    In addition to the effects of the codification of aspects of the
ARP Inspection Program, the Commission believes that the rules would
further reduce the risk and incidences of systems issues affecting the
markets by imposing requirements on entities that are not currently
participating in the ARP Inspection Program, and by covering systems
and events not currently within the scope of the ARP Inspection
Program. For example, Rules 1001(a)(2)(i)-(iv) will help maintain
robust systems at SCI entities that currently do not have the policies
and procedures in place required by the rule. In particular, the
Commission believes that, taken together, Rules 1001(a)(2)(i)-(iv) will
benefit the securities markets by leading to the establishment,
maintenance, and enforcement of policies and procedures that will
reduce the risks and incidences of systems disruptions and systems
intrusions. As noted above in Section VI.C.1, a reduction in the risk
and incidences of systems issues could reduce interruptions in the
price discovery process and liquidity flows.
    Because current ARP participants will change their current
practices to comply with Rules 1001(a)(2)(i)-(iv), the Commission
recognizes that these entities will incur compliance costs that are
incremental relative to the current compliance costs of the ARP
Inspection Program.\1952\ Furthermore, SCI entities that are not
currently participating in the ARP Inspection Program may incur higher
initial compliance costs to meet the requirements of Rules
1001(a)(2)(i)-(iv), compared to SCI entities that are current
participants of the ARP Inspection Program. The paperwork burdens are
discussed in Section V, and other costs are included as part of the
quantified costs estimated above related to all requirements associated
with Rules 1001(a) and (b) other than paperwork burdens.\1953\
---------------------------------------------------------------------------

    \1952\ See supra Section VI.B (discussing current practices of
SCI entities).
    \1953\ See supra note 1940 and accompanying text.
---------------------------------------------------------------------------

    A few commenters discussed in detail how setting forth policies and
procedures with regard to systems development could yield benefits,
such as efficient pricing of securities, to markets. One commenter
noted that preventing defects from entering in software construction is
the most cost effective approach to quality assurance.\1954\ This
commenter stated that it is ten times cheaper to find a defect in
development than it is during systems testing, and it is one hundred
times cheaper to fix a defect in development than in production (and
this is not accounting for the impact on business).\1955\ In addition,
this commenter noted that software of higher quality is cheaper to
maintain and easier to enhance, and that testing schedules for low
quality, large software projects are two to three times longer and more
than twice as costly as testing for high quality projects.\1956\
According to information submitted by this commenter of large, mission
critical systems across several industries, improving overall
structural quality by 10 percent reduces ``ticket volume'' by over 30
percent.\1957\ This commenter believed that this would be an
inadvertent benefit of controlling integrity at the structural level
that may even compensate for the cost of other aspects of Regulation
SCI.\1958\ Another commenter noted that the cost of a serious
operational problem can rise to eight digits, and in extreme cases nine
digits.\1959\ This commenter noted that these costs are often shared
with market participants beyond the owners of the disrupted
systems.\1960\ This commenter believed that the proposed Rule
1000(b)(1) requirements are reasonable and their cost can be balanced
against the losses associated with the operational risks they
address.\1961\
---------------------------------------------------------------------------

    \1954\ See CAST Letter at 10.
    \1955\ See id.
    \1956\ See id. (quoting Capers Jones and Olivier Bonsignour, The
Economics of Software Quality (2012)).
    \1957\ See id. at 10-11.
    \1958\ See id. at 11.
    \1959\ See CISQ Letter at 2.
    \1960\ See id. at 2.
    \1961\ See id. at 2. See also CISQ2 Letter at 6 (stating,
``[t]he cost of recent outages in SCI systems easily justifies the
additional effort in quality assurance. However, empirical evidence
from software industry improvement programs demonstrates that the
additional time added into quality assurance is more than
compensated for by a reduction in rework to produce [return on
investments] of 5:1 or greater'').
---------------------------------------------------------------------------

    The Commission generally agrees with commenters that setting forth
policies and procedures with regard to systems development could yield
benefits to market participants and SCI entities, including a potential
reduction in losses due to SCI events. Rule 1001(a)(2)(iii) requires
SCI entities to establish a program to review and keep current systems
development and testing methodology for SCI systems and, for purposes
of security standards, indirect SCI systems. The Commission believes
that development and testing systems are important in ensuring the
reliability and resiliency of SCI systems. More reliable and resilient
systems should help reduce the occurrences of SCI events and improve
systems uptime for SCI entities, and thus possibly result in a
reduction in losses due to SCI events. Furthermore, the Commission
recognizes that the use of inadequately tested software in production
could result in substantial losses to market participants if it does
not function as intended. For instance, if software malfunctions, it
may not route orders as intended and also could result in mispricing of
securities. Additionally, if a system's capacity thresholds are
improperly estimated, it may become congested, resulting in higher
indirect transaction costs due to lower execution quality (e.g.,
decrease in order fill rates). The Commission believes that costs
associated with Rule 1001(a)(2)(iii) are appropriate in light of the
reduction in losses due to SCI events and other benefits discussed
throughout this Economic Analysis.
Business Continuity and Disaster Recovery Plans
    Rule 1001(a)(2)(v) requires SCI entities' policies and procedures
to set forth business continuity and disaster recovery plans that
include maintaining backup and recovery capabilities sufficiently
resilient and geographically diverse and that are reasonably designed
to achieve next business day resumption of trading and two-hour
resumption of critical SCI systems following a wide-scale
disruption.\1962\ Therefore, as

adopted, Rule 1001(a)(2)(v) puts an emphasis on trading and critical
SCI systems with respect to resumption following a wide-scale
disruption. As discussed above, the definition of critical SCI systems
is intended to capture those systems that are critical to the operation
of the securities markets, including systems that are potential single
points of failure in the securities markets. The Commission understands
that some SCI entities already have, to an extent, policies and
procedures that are required by Rule 1001(a)(2)(v), while others would
need to make more significant changes to their current practices.\1963\
---------------------------------------------------------------------------

    \1962\ FINRA Rule 4370 generally requires that a FINRA member
maintain a written continuity plan identifying procedures relating
to an emergency or significant business disruption, which is akin to
adopted Rule 1001(a)(2)(v) requiring policies and procedures for
business continuity and disaster recovery plans. However, the FINRA
rule does not include the requirement that the business continuity
and disaster recovery plans be reasonably designed to achieve next
business day resumption of trading and two-hour resumption of
critical SCI systems following a wide-scale disruption, nor does it
require the functional and performance testing and coordination of
industry or sector-testing of such plans. See supra note 115.
    \1963\ See infra note 1973 and accompanying text (discussing the
estimated range of cost per SCI entity to comply with the policies
and procedures required by Rules 1001(a) and (b)).
---------------------------------------------------------------------------

    Rule 1001(a), among other things, is expected to help ensure prompt
resumption of all critical SCI systems, which in turn is expected to
help minimize interruptions in trading and liquidity after a wide-scale
disruption. In addition, in the case of a wide-scale disruption,
multiple SCI entities may be affected by the same incident at the same
time. Given that U.S. securities market infrastructure is concentrated
in relatively few areas, such as New York City, New Jersey, and
Chicago, maintaining backup and recovery capabilities that are
geographically diverse could facilitate resumption in trading and
critical SCI systems following wide-scale market disruptions. As
discussed in detail in Section VI.C.1, the Commission expects the
reduction in the occurrence of trading interruptions and the duration
of trading interruptions would promote pricing efficiency, price
discovery, and liquidity flows in markets.
    One commenter noted that the Commission's cost-benefit analysis in
the SCI Proposal did not take into consideration the already existing
industry excess capacity as backup.\1964\ With respect to this
commenter, the Commission understands, based on staff expertise, that
systems are sized to adequately handle message traffic with excess
capacity under normal conditions and in those situations that
moderately exceed the norm. The Commission also understands, however,
that exchanges periodically receive escalated levels of message traffic
due to unanticipated events and must make real-time adjustments to
manage the capacity of their systems, such as queuing and/or
throttling. Therefore, the Commission is not persuaded that excess
capacity is a reasonable alternative to backup systems because systems
may reach their capacity periodically. Also, as noted above, in the
case of a wide-scale disruption, multiple SCI entities may be affected
by the same incident at the same time. Given that U.S. securities
market infrastructure is concentrated in relatively few areas,
maintaining backup and recovery capabilities that are geographically
diverse could facilitate resumption in trading and critical SCI systems
following wide-scale market disruptions.
---------------------------------------------------------------------------

    \1964\ See Angel Letter at 14.
---------------------------------------------------------------------------

    The Commission also received comments regarding the costs of
maintaining geographically diverse backup facilities under proposed
Rule 1000(b)(1). One commenter stated that the Commission did not
appropriately consider the costs and benefits of maintaining
geographically diverse data centers to meet the next-day readiness
requirement.\1965\ This commenter believed that the cost of
establishing and maintaining geographically diverse data centers alone
will dwarf the estimated overall compliance cost of $400,000 to $3
million.\1966\ This commenter estimated that the incremental all-in,
five-year cost to it to relocate its backup site would be $17
million.\1967\ This commenter noted that the geographically diverse
backup center requirement could also result in costs on members and
users of the SCI entity.\1968\ Another commenter noted that it
maintains robust redundant and backup systems that exceed regulatory
requirements and provide adequate capacity, security, and resiliency
for its trading operations; however, the manpower and financial capital
required to maintain and staff a geographically diverse backup site
would easily push its annual and recurring compliance cost beyond the
higher estimates provided by the Commission.\1969\
---------------------------------------------------------------------------

    \1965\ See ISE Letter at 12. See also FIF Letter at 3.
    \1966\ See ISE Letter at 12.
    \1967\ See id.
    \1968\ See id. The cost to members or participants of SCI
entities in connection with business continuity and disaster
recovery plan testing is discussed in Section VI.C.2.b.vii below.
    \1969\ See ITG Letter at 7-8.
---------------------------------------------------------------------------

    The Commission notes that the potential cost for maintaining
geographically diverse backup and recovery capabilities is likely less
than those estimated by commenters given the scope of the adopted rule.
Specifically, because Rule 1001(a)(2)(v) does not require an SCI entity
to require its members or participants to use an SCI entity's backup
facility in the same way they use the primary facility (i.e., does not
require members or participants to co-locate their systems at backup
sites to replicate the speed and efficiency of the primary site), the
requirement for geographically diverse backup systems does not mean
that the backup systems are required to be identical (e.g., same speed
and efficiency) to the primary facility. Nevertheless, the Commission
believes it is critical that SCI entities and their designated members
or participants be able to operate with the SCI entities' backup
systems in the event of a wide-scale disruption. In addition, the
Commission notes that Rule 1001(a) does not specify any particular
minimum distance or geographic location that would be necessary to
achieve geographic diversity, although the Commission believes that
backup sites should not rely on the same infrastructure components,
such as for transportation, telecommunications, water supply, and
electric power. Further, Regulation SCI does not require an SCI entity
to have a geographically diverse backup facility so distant from the
primary facility that the SCI entity may not rely primarily on the same
labor pool to staff both facilities if it believed it to be
appropriate.
    With respect to commenters who expressed concern regarding the
potential cost for maintaining geographically diverse backup and
recovery capabilities, the Commission cannot estimate with confidence
the precise costs for the creation of a new, geographically diverse
backup facility, given the wide range of message traffic that various
exchanges, ATSs, and other entities receive and the reasonable
flexibility in the design of the backup facility. Given that Rule
1001(a)(2)(v) does not require an SCI entity to require its members or
participants to use an SCI entity's backup facility in the same way
they use the primary facility, however, the Commission believes that
the upper bound of building a new backup facility is equal to the cost
of building a new primary facility. Given the Commission's response to
commenters' concerns regarding the requirement to maintain
geographically diverse backup and recovery capabilities, and the degree
of flexibility within Regulation SCI to determine the precise nature
and location of its backup site,\1970\ the Commission believes that the
commenter's estimate of $17 million over five years (or $3.4 million
per

year),\1971\ is high. Based on the Commission's best judgment,
including taking into account Commission staff experience with SCI
entities that have invested in geographically diverse backup facilities
in recent years, the Commission believes that the average cost is more
likely to be approximately $1.5 million annually for an SCI entity
(that does not already have geographically diverse backup facilities).
Nevertheless, even were the costs to be at the upper amount suggested
by the commenter, the Commission believes the costs are appropriate
given that individual SCI entity resilience is fundamental to achieving
the goal of improving U.S. securities market infrastructure
resilience.\1972\
---------------------------------------------------------------------------

    \1970\ See supra notes 541-544 and accompanying text.
    \1971\ See supra note 1967 and accompanying text.
    \1972\ See supra notes 499-544 and accompanying text.
---------------------------------------------------------------------------

    The Commission recognizes that SCI entities may encounter
significantly different costs in complying with the geographic
diversity requirement underlying Rule 1001(a)(2)(v). As noted in
Section VI.B.2, nearly all national securities exchanges already have
backup facilities that do not rely on the same infrastructure
components as those used by their primary facility. For those national
securities exchanges that do not have such backup facilities, the cost
to build such backup facilities will result in higher initial
compliance costs than for national securities exchanges that do. For
other SCI entities (e.g., some SCI ATSs), the compliance costs to meet
the geographic diversity requirement would depend on the nature, size,
technology, business model, and other aspects of their business.\1973\
Because SCI entities may encounter significantly different costs in
complying with the geographic diversity requirement, the Commission
believes that the initial compliance costs could have impact on
competition among SCI entities.
---------------------------------------------------------------------------

    \1973\ The Commission notes that its average estimated range of
initial cost of approximately $320,000 to $2.4 million per SCI
entity to comply with Rules 1001(a) and (b), other than paperwork
burdens, includes the cost to build and maintain a geographically
diverse backup facility. The Commission estimates that the costs for
SCI entities that do not currently have a geographically diverse
backup facility would be at the higher end of this range.
---------------------------------------------------------------------------

    The requirement to have policies and procedure to meet a goal of
next day resumption in trading and two-hour resumption in critical SCI
systems will impose compliance costs for SCI entities. The Interagency
White Paper sets forth sound practices for core clearing and settlement
organizations and firms that play significant roles in critical
financial markets,\1974\ and the 2003 BCP Policy Statement discusses
the resumption of certain trading markets following a wide-scale
disruption.\1975\ As noted in Section VI.B.1, the Commission believes
that SCI entities currently use an array of measures to restore systems
when disruptions occur. However, the two-hour resumption goal for all
critical SCI systems differs from the goals set forth in the
Interagency White Paper insofar as the goal for Regulation SCI applies
to critical SCI systems generally.\1976\ To this extent, Rule
1001(a)(2)(v) would impose additional costs for SCI entities that
currently have practices that are consistent with the Interagency White
Paper for clearance and settlement systems but not all critical SCI
systems. The next business day resumption goal for certain trading
markets set forth in the 2003 BCP Policy Statement is consistent with
the resumption goal for trading in Rule 1001(a)(2)(v). For some SCI
entities that do not have policies and procedures with respect to
critical SCI systems consistent with the Interagency White Paper and
the 2003 BCP Policy Statement, the Commission believes that the initial
compliance costs associated with establishing policies and procedures
with respect to next day resumption in trading and two-hour resumption
in all critical SCI systems would be larger than those that do. The
costs associated with designing and modifying policies and procedures
with respect to systems resumption requirements are included in the
costs related to paperwork burdens in Section V. Furthermore, as
discussed in Section VI.C.1, the Commission believes that the systems
resumption requirements of Rule 1001(a)(2)(v) will have an impact on
competition among SCI entities in part because the associated initial
compliance costs will be different among SCI entities.
---------------------------------------------------------------------------

    \1974\ According to the Interagency White Paper, core clearing
and settlement organizations should develop the capacity to recover
and resume clearing and settlement activities within the business
day on which the disruption occurs with the overall goal of
achieving recovery and resumption within two hours after an event.
See Interagency White Paper, supra note 504, at 17812.
    \1975\ The 2003 BCP Policy Statement states that each SRO market
and ECN should have a business continuity plan that anticipates the
resumption of trading, in the securities traded by that market, no
later than the next business day following a wide-scale disruption.
See 2003 BCP Policy Statement, supra note 504, at 56658.
    \1976\ See supra Section IV.A.2.c (discussing the definition of
critical SCI systems) and supra Section IV.B.1 (discussing the
Commission's rationale for applying the two hour recovery goal to
critical SCI systems generally instead of clearance and settlement
services specifically).
---------------------------------------------------------------------------

Market Data
    Rule 1001(a)(2)(vi) provides that an SCI entity's policies and
procedures must include standards that result in systems being
designed, developed, tested, maintained, operated, and surveilled in a
manner that facilitates the successful collection, processing, and
dissemination of market data.\1977\ Unlike the other provisions of Rule
1001(a)(2) discussed above, Rule 1001(a)(2)(vi) is not addressed in
Regulation ATS or the ARP Policy Statements.
---------------------------------------------------------------------------

    \1977\ See Rule 1001(a)(2) and supra Section IV.B.1.
---------------------------------------------------------------------------

    The Commission believes that Rule 1001(a)(2)(vi) should help ensure
that timely and accurate market data is available to all market
participants. Given that market participants rely on consolidated
market data in a variety of ways, including making markets, formulating
trading algorithms, and placing orders, the Commission believes that
this is an important benefit of Regulation SCI, although the Commission
recognizes that SCI entities currently already take measures to
facilitate the successful collection, processing, and dissemination of
market data. As discussed in Section VI.C.1, the Commission believes
that the further improvements in timeliness and accuracy of market data
would help further ensure pricing efficiencies and uninterrupted
liquidity flows in markets. As Rule 1001(a)(2)(vi) will be a new
requirement for SCI entities, it will impose incremental compliance
costs on SCI entities in setting aside additional resources to satisfy
the requirements of the rule. These costs are included as part of the
quantified costs estimated above related to all requirements underlying
Rules 1001(a) and (b) other than paperwork burdens.\1978\
---------------------------------------------------------------------------

    \1978\ See supra note 1940 and accompanying text.
---------------------------------------------------------------------------

Monitoring
    Rule 1001(a)(2)(vii) provides that an SCI entity's policies and
procedures must include monitoring of systems to identify potential SCI
events. Rule 1001(a)(2)(vii) imposes a new requirement that is not
addressed in Regulation ATS or the ARP Policy Statements.
    The Commission believes that SCI entities, particularly those that
participate in the ARP Inspection Program, already monitor their
systems in order to identify potential systems issues. Nevertheless, by
defining ``SCI event'' and requiring policies and procedures for
monitoring systems to identify potential SCI events, the Commission
believes that Rule

1001(a)(2)(vii) should further help ensure that SCI entities identify
potential SCI events, which could allow them to prevent some SCI events
from occurring or to take timely appropriate corrective action after
the occurrence of SCI events. As discussed above, the Commission
believes the reduction in the occurrence of SCI events or the reduction
in the duration of SCI events that disrupt markets would reduce pricing
inefficiencies and promote price discovery and liquidity. Although the
Commission believes that SCI entities already monitor their systems in
order to identify potential systems issues, the Commission believes
that SCI entities will have to allocate additional resources to comply
with the requirements of Rule 1001(a)(2)(vii), including potentially
hiring additional staff, and thus will incur costs. These costs are
included as part of the quantified costs estimated above related to all
requirements underlying Rules 1001(a) and (b) other than paperwork
burdens.
Current SCI Industry Standards
    Rule 1001(a)(4) deems an SCI entity's policies and procedures under
Rule 1001(a) to be reasonably designed if they are consistent with
current SCI industry standards.\1979\ However, Rule 1001(a)(4)
specifically states that compliance with current SCI industry standards
is not the exclusive means to comply with the requirements of Rule
1001(a). Therefore, as adopted, Rule 1001(a)(4) provides flexibility to
allow each SCI entity to determine how to best meet the requirements in
Rule 1001(a), taking into account, for example, its nature, size,
technology, business model, and other aspects of its business. Thus,
Rule 1001(a)(4) allows SCI entities to choose the technology standards
that best fit with their business, promoting efficiency. Furthermore,
as discussed in Section IV.B.1, staff guidance lists examples of
publications describing processes, guidelines, frameworks, or standards
for an SCI entity to consider looking to in developing reasonable
policies and procedures under Rule 1001(a). The reference to the
publications which the staff may include, and which the Commission
believes should be general and flexible enough to be compatible with
many widely-recognized technology standards, will help SCI entities to
implement and comply with Regulation SCI.\1980\
---------------------------------------------------------------------------

    \1979\ Current SCI industry standards are required to be
comprised of information technology practices that are widely
available to information technology professionals in the financial
sector and issued by an authoritative body that is a U.S.
governmental entity or agency, association of U.S. governmental
entities or agencies, or widely recognized organization. See Rule
1001(a)(4).
    \1980\ See supra Section IV.B.1.b (discussing the role of staff
guidance on current SCI industry standards).
---------------------------------------------------------------------------

    Some commenters expressed concern that SCI entities would closely
adhere to the publications listed in Table A rather than take advantage
of the flexibility built into the proposed rule out of concern that, if
they did not, they would expose themselves to potential regulatory
action for failure to comply with Regulation SCI.\1981\ As discussed
above in Section IV.B.1, Rule 1001(a) allows for flexibility in
choosing standards or guidelines when an SCI entity is designing
policies and procedures required by that rule. Moreover, the staff
guidance lists examples of publications describing processes,
guidelines, frameworks, or standards for an SCI entity to consider
looking to in developing reasonable policies and procedures under Rule
1001(a). As noted in Section IV.B.1, the Commission understands that
many SCI entities are already following other technology standards,
such as ISO 27000 and COBIT. The staff guidance would not preclude SCI
entities from adhering to standards such as ISO 27000, COBIT, or
others, to the extent they result in policies and procedures that
comply with the requirements of Rule 1001(a).\1982\ Because there is no
requirement for SCI entities to follow the publications listed as staff
guidance, there is no separate compliance cost associated with the
staff guidance in addition to the cost of complying with Rule 1001(a).
As discussed throughout this section, the Commission recognizes that,
in general, there will be costs associated with designing policies and
procedures required by Rule 1001(a). Such costs to SCI entities that
already set forth their policies and procedures based on industry
standards, or that follow the publications listed in the staff guidance
or comparable publications as a guide, would be minimal. On the other
hand, other SCI entities that decide to modify their policies and
procedures and those that do not have such policies and procedures in
place may incur greater costs in designing policies and procedures
required by Rule 1001(a). The costs associated with modifying and
designing policies and procedures are included in the costs related to
paperwork burdens in Section V.
---------------------------------------------------------------------------

    \1981\ See, e.g., MSRB Letter at 11; Angel Letter at 8; BATS
Letter at 6; and NYSE Letter at 20-21.
    \1982\ Likewise, the staff guidance would not preclude an SCI
entity from adopting a derivative of multiple standards, and/or
customizing one or more standards for the particular system at
issue. In assessing whether an SCI entity's use of such an approach
in designing its policies and policies and procedures would be
``deemed'' to be reasonably designed, the Commission's inquiry would
be into whether its policies and procedures were consistent with
standards meeting the criteria in adopted Rule 1001(a)(4).
---------------------------------------------------------------------------

Systems Compliance
    Rule 1001(b)(1) requires each SCI entity to establish, maintain,
and enforce written policies and procedures reasonably designed to
ensure that its SCI systems operate in a manner that complies with the
Exchange Act and the rules and regulations thereunder, and the entity's
rules and governing documents, as applicable. Rule 1001(b)(2)(i)-(iv)
provides that an SCI entity's policies and procedures under Rule
1001(b)(1) must include, at a minimum: (i) Testing of all SCI systems
and any changes to SCI systems prior to implementation; (ii) a system
of internal controls over changes to SCI systems; (iii) a plan for
assessments of the functionality of SCI systems designed to detect
systems compliance issues, including by responsible SCI personnel and
by personnel familiar with applicable provisions of the Act and the
rules and regulations thereunder and the SCI entity's rules and
governing documents; and (iv) a plan of coordination and communication
between regulatory and other personnel of the SCI entity, including by
responsible SCI personnel, regarding SCI systems design, changes,
testing, and controls designed to detect and prevent systems compliance
issues. The Commission recognizes that SCI entities currently take
varying measures to ensure that their systems operate in a manner that
complies with relevant laws and rules. These practices at SCI entities
may include escalating a compliance issue upon discovery, including
legal and compliance personnel in the review of systems changes, and
periodically reviewing rulebooks.
    The Commission believes that Rule 1001(b) should help to ensure
that SCI entities operate their SCI systems in compliance with the
Exchange Act and relevant rules and should help to reduce the
occurrence of systems compliance issues. For example, the tests under
Rule 1001(b)(2)(i) should help SCI entities to identify potential
compliance issues before new systems or systems changes are
implemented; the internal controls under Rule 1001(b)(2)(ii) should
help to ensure that SCI entities remain vigilant against compliance
issues when changing their systems and resolve potential compliance
issues before the changes are implemented; and the systems assessment
plans under Rule 1001(b)(2)(iii) and the coordination

and communication plans under Rule 1001(b)(2)(iv) should help
technology, regulatory, and other relevant personnel (including
responsible SCI personnel) of SCI entities to work together to prevent
compliance issues, and to promptly identify and address compliance
issues if they occur. To the extent that compliance with Rule 1001(b)
reduces the occurrence of systems compliance issues, Rule 1001(b)
should help ensure investor protection. Because SCI entities will need
to allocate their resources towards establishing, maintaining, and
enforcing policies and procedures with regard to systems compliance,
Rule 1001(b) will impose compliance costs on SCI entities. These costs
are included as part of the quantified costs estimated above related to
all requirements underlying Rules 1001(a) and (b) other than paperwork
burdens.\1983\
---------------------------------------------------------------------------

    \1983\ See supra note 1940 and accompanying text. However, the
costs associated with establishing and maintaining policies and
procedures are included in the costs related to paperwork burdens in
Section V.
---------------------------------------------------------------------------

    One commenter suggested that the Commission follow the Federal
Aviation Administration's and NASA's approach, where, according to this
commenter, individuals are encouraged to report safety issues and
penalties are waived where there is self-reporting.\1984\ As discussed
above in Section IV.B.2.b, the Commission is not persuaded that it
would be appropriate to provide a safe harbor for all problems that are
self-reported by SCI entities and individuals because the Commission is
not persuaded that the suggested self-report safe harbor will
effectively further the intent of Regulation SCI.\1985\ The extent to
which regulators' reporting rules offer safe harbor protection is
determined by particular circumstances and regulatory objectives. For
purposes of Regulation SCI, a blanket safe harbor provision of the type
proposed by the commenter would reduce incentives for SCI entities to
take the proactive actions required to ensure the compliance of their
SCI systems and, thus, could undermine the benefits of Regulation SCI
discussed in Section IV.C.1.
---------------------------------------------------------------------------

    \1984\ See Angel Letter at 3-4. This commenter also stated that,
in the SCI Proposal, the Commission did not analyze how other
government regulatory agencies in the U.S. and elsewhere address
technology risks (e.g., in the aviation, nuclear power, electricity,
telecommunications, medical, and banking sectors). See Angel Letter
at 3 and 15. The Commission notes that, in considering the adoption
of Regulation SCI, it has considered some of the current practices
in other industries, such as those discussed by panelists at the
Technology Roundtable (e.g., aviation, nuclear power). See supra
note 15 and Transcript of the Technology Roundtable, at 42-45.
    \1985\ The Commission notes that, in addition to dealing with a
different problem in different industries, the ``waiving of
penalties'' cited by the commenter has limitations (e.g., the ASRS
system cited by the comment suspends safe harbor protection for
repeat violators and does not offer safe harbor for certain types of
violations). Safe harbor protection for self-reporters may be
appropriate in some circumstances. However, the Commission believes
that in the specific context of Regulation SCI, such safe harbor
protections would not further the intent of the regulation.
---------------------------------------------------------------------------

Responsible SCI Personnel
    Rule 1001(c) requires an SCI entity to establish, maintain, and
enforce reasonably designed written policies and procedures that
include the criteria for identifying responsible SCI personnel, the
designation and documentation of responsible SCI personnel, and
escalation procedures to quickly inform responsible SCI personnel of
potential SCI events. Rule 1001(c) imposes a requirement that is not
addressed in Regulation ATS or the ARP Policy Statements.
    The Commission believes that requiring policies and procedures to
identify and designate responsible SCI personnel and to establish
escalation procedures to quickly inform responsible SCI personnel of
potential SCI events should help to effectively alert responsible SCI
personnel of potential SCI events, in order for such personnel to
determine whether an SCI event has occurred so that any appropriate
actions can be taken in accordance with the requirements of Regulation
SCI without unnecessary delay. As such, Rule 1001(c) should help reduce
the duration of SCI events as SCI entities should become aware of
potential SCI events and take appropriate corrective actions more
quickly. The reduction in the duration of SCI events would benefit
markets as it would promote pricing efficiency and price discovery as
discussed in Section VI.C.1.
    The Commission believes that the costs associated with Rule 1001(c)
are attributed to paperwork burdens, which are discussed in Section
V.D.1.a above.\1986\ The Commission does not believe that Rule 1001(c)
will impose significant other costs on SCI entities because these
entities already identify and designate responsible SCI personnel and
have escalation procedures.\1987\
---------------------------------------------------------------------------

    \1986\ When monetized, the paperwork burden would result in
approximately $1.7 million initially and $611,000 annually for all
SCI entities in the aggregate.
    \1987\ As noted above, several commenters emphasized the
importance of escalation procedures at SCI entities, pursuant to
which technology staff or junior employees could assess a systems
problem and escalate the issue up the chain of command to management
as well as legal and/or compliance personnel. See supra note 740 and
accompanying text.
---------------------------------------------------------------------------

Periodic Review
    Rules 1001(a)(3), (b)(3), and (c)(2) require each SCI entity to
periodically review the effectiveness of the policies and procedures
required under Rules 1001(a), (b), and (c), respectively, and to take
prompt action to remedy deficiencies in such policies and procedures.
Regulation ATS and the ARP Policy Statements do not explicitly address
the periodic review of policies and procedures and remediation of
deficient policies and procedures.
    The Commission believes that requiring periodic review of the
policies and procedures and remedial actions to address any
deficiencies in the policies and procedures will help to ensure that
SCI entities maintain robust policies and procedures and update them
when necessary so that the benefits of Rules 1001(a), (b), and (c)
should continue to be realized. As such, the Commission believes that
Rules 1001(a)(3), (b)(3), and (c)(2) will help realize the benefits of
Regulation SCI, and would facilitate price discovery and liquidity
flow, as discussed in Section VI.C.1. These requirements, however, will
impose costs on SCI entities because they will have to use resources to
review the policies and procedures required by Rules 1001(a), (b), and
(c) beyond the resources currently expended for this purpose or will
have to take more prompt remedial action to remedy any identified
deficiencies. The Commission expects that these costs generally will
arise following an SCI entity's periodic review of the effectiveness of
its policies and procedures and as a result of SCI events. The
Commission believes that the costs associated with the review and
update requirements are attributed to paperwork burdens, which are
discussed in Section V.D.1.a above.\1988\ However, the Commission
recognizes that, if an SCI entity takes prompt or unplanned remedial
action following the discovery of deficiencies in its policies and
procedures, this may result in indirect costs (i.e., opportunity costs)
to SCI entities because they may need to delay or shift their resources
away from profitable projects and reallocate their resources towards
taking prompt or unplanned remedial actions required by the rules.
However, it is difficult to assess such indirect costs imposed on SCI
entities because the Commission lacks information necessary to provide
a reasonable estimate. For example, the Commission does not have

comprehensive and detailed information on the value of the potential
forgone projects of SCI entities.
---------------------------------------------------------------------------

    \1988\ As noted in Section V.D.1.a above, the paperwork burden
related to the review of the policies and procedures is included in
the estimated annual ongoing burden of Rules 1001(a), (b), and (c).
---------------------------------------------------------------------------

ii. Corrective Action--Rule 1002(a)
    Rule 1002(a) requires an SCI entity to begin to take appropriate
corrective action upon any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred. Rule
1002(a) also requires corrective action to include, at a minimum,
mitigating potential harm to investors and market integrity resulting
from the SCI event and devoting adequate resources to remedy the SCI
event as soon as reasonably practicable. Thus, it would not be
appropriate for an SCI entity to unnecessarily delay the start of
corrective action once its responsible SCI personnel have a reasonable
basis to conclude that an SCI event has occurred, and the SCI entity
would be required to focus on mitigating potential harm to investors
and market integrity resulting from the SCI event and devoting adequate
resources to remedy the SCI event as soon as reasonably practicable.
The Commission believes that SCI entities already have a variety of
procedures in place to take corrective actions when system issues
occur. However, Rule 1002(a) will likely require modifications to those
existing practices in part because the rule specifies the timing and
enumerates certain goals for corrective action.\1989\
---------------------------------------------------------------------------

    \1989\ For example, although the Commission believes that market
participants already take corrective actions when system issues
occur, currently, when taking corrective action, market participants
may not always focus on mitigating potential harm to investors and
market integrity or devoting adequate resources to remedy the issues
as soon as reasonably practicable, as SCI entities are required to
do under Rule 1002(a).
---------------------------------------------------------------------------

    The Commission believes that the corrective action requirement will
reduce the length of systems disruptions, systems compliance issues,
and systems intrusions, and thus, as noted in Section VI.C.1, reduce
the negative effects of those interruptions on the SCI entity and
market participants. Additionally, to the extent that corrective action
could involve wide-scale systems upgrades, some SCI entities may
potentially seek to accelerate capital expenditures, for example, by
updating their systems with newer technology earlier than they might
have otherwise to comply with Regulation SCI. As such, Rule 1002(a)
could further help ensure that SCI entities invest sufficient resources
as soon as reasonably practicable to address systems issues.
    The Commission recognizes that Rule 1002(a) may require SCI
entities to undertake corrective action sooner and/or to increase
investments in newer and more updated systems earlier than they might
have otherwise. The Commission thus believes that Rule 1002(a) could
impose modestly higher costs for SCI entities in responding to SCI
events relative to their current practice.\1990\ But, given the wide
variety of current practices, the Commission is unable to estimate the
incremental costs associated with the required changes. Furthermore, if
Regulation SCI reduces the frequency and severity of SCI events in the
future, the cost of corrective action could similarly decline over
time. However, the Commission cannot estimate these costs because the
degree to which Regulation SCI will reduce the frequency and severity
of SCI events is unknown. The Commission also believes that, if an SCI
entity takes corrective action sooner than they might have without the
requirements of Regulation SCI, this may impose indirect costs (i.e.,
opportunity costs) to SCI entities because they may have to delay or
reallocate their resources away from profitable projects and direct
their resources toward taking corrective action required by the rule.
However, the Commission acknowledges that it is difficult to assess
such indirect costs imposed on SCI entities. For instance, the
Commission does not have comprehensive and detailed information on the
value of the potential foregone projects of SCI entities. Consequently,
the Commission is, at this time, unable to estimate the costs of Rule
1002(a) of Regulation SCI because the Commission lacks information
necessary to provide a reasonable cost estimate.
---------------------------------------------------------------------------

    \1990\ See also MSRB Letter at 32 (commenting that under most
circumstances, any increased cost due to proposed Rule 1000(b)(3)
would be modest since corrective action normally would already be
taken).
---------------------------------------------------------------------------

    Several commenters stated that the requirements of proposed Rule
1000(b)(3) put too great an emphasis on immediate corrective action at
the expense of thoroughly analyzing the SCI event and its cause,
considering potential remedies, and/or acting in accordance with
internal policies and procedures before committing to a plan to take
corrective action.\1991\ Partly in response to this concern, the
Commission has modified the rule as adopted from the proposal. The
Commission agrees that an SCI entity should be given appropriate time
to perform an initial analysis and preliminary investigation into a
potential systems issue before the corrective obligations are
triggered. If a corrective action were to be applied without such
analysis or investigation, then the impact of an SCI event could
persist, exacerbating or prolonging its negative effects on markets and
market participants. The Commission notes that Rule 1002(a) does not
use the term ``immediate.'' Rather, Rule 1002(a) requires that
corrective action be taken ``as soon as reasonably practicable'' once
the triggering standard has been met. The Commission believes that,
because the facts and circumstances of each specific SCI event will be
different, this standard would help ensure that an SCI entity takes
necessary corrective action soon after an SCI event, but not without
sufficient time to first consider what is the appropriate action to
remedy the SCI event in a particular situation and how such corrective
action should be implemented.\1992\
---------------------------------------------------------------------------

    \1991\ See SIFMA Letter at 3; OCC Letter at 14; Joint SROs
Letter at 11; LiquidPoint Letter at 4; DTCC Letter at 10; and Direct
Edge Letter at 7.
    \1992\ See also supra Section IV.B.3.a (discussing in more
detail the triggering standard for corrective action, Commission
notification, and information dissemination) and Section IV.B.3.b
(discussing the corrective action requirement).
---------------------------------------------------------------------------

iii. Commission Notification--Rule 1002(b)
    As discussed above in Section IV.B.3.c, Rule 1002(b) requires SCI
entities to provide notifications to the Commission regarding SCI
events. Specifically, upon any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred, an SCI
entity is required to notify the Commission of the SCI event
immediately. Within 24 hours of any responsible SCI personnel having a
reasonable basis to conclude that an SCI event has occurred, an SCI
entity is required to submit a more detailed written notification, on a
good faith, best efforts basis, pertaining to the SCI event. Until such
time as the SCI event is resolved and the SCI entity's investigation of
the SCI event is closed, the SCI entity is required to provide updates
regularly, or at such frequency as requested by a representative of the
Commission. The SCI entity is also required to submit a detailed final
written notification after the SCI event is resolved and the SCI
entity's investigation of the event is closed (and an additional
interim written notification, if the SCI event is not resolved or the
investigation is not closed within a specified period of time).
Finally, SCI entities are required to notify the Commission of
information regarding de minimis systems disruptions and de minimis
systems intrusions on a quarterly basis.
    The Commission believes that most, if not all, major systems
incidents are

reported by ARP entities to the Commission and that many ``de minimis''
systems issues are documented internally by SCI entities as part of
their incident management systems. For those entities that do not
participate in the ARP Inspection Program, the Commission also believes
that some internal documentation of systems incidents exists. In
addition, the Commission notes that some SCI entities currently notify
the Commission of certain systems compliance issues.
    Rule 1002(b) will apply to more entities (e.g., some SCI ATSs),
more systems (e.g., market regulation and market surveillance systems,
additional market data systems), and more types of systems issues
(e.g., systems compliance issues) than the ARP Policy Statements, and
also require more detailed reporting to the Commission.\1993\ The
Commission believes that Rule 1002(b) will enhance the effectiveness of
Commission oversight of the operation of SCI entities. For example, one
commenter suggested that SCI events notification results in greater
transparency for the Commission, with multiple benefits, including
ensuring that the Commission has a view into problems at particular SCI
entities for regulatory purposes as well as perspective on the effect