to state that Programmatic CCID Subsystem Access allows Regulatory
Staff to submit multiple ITIN(s)/SSN(s)/EIN(s) \324\ for a Customer(s)
of regulatory interest identified through regulatory efforts outside of
the CAT to obtain Customer-ID(s) in order to query CAT Data regarding
such Customer(s).\325\ The Commission also proposes to amend the CAT
NMS Plan to explicitly state that the Plan Processor must provide
Programmatic CCID Subsystem Access by developing and supporting the
CCID Transformation Logic and an API to facilitate the submission of
Transformed Values to the CCID Subsystem for the generation of
Customer-ID(s).\326\ The proposed amendments would also state that
Performance Requirements for the conversion of ITIN(s)/SSN(s)/EIN(s) to
Customer-ID(s) shall be consistent with the criteria set out in
Appendix D, Functionality of the CAT System, User-Defined Direct Query
Performance Requirements.\327\
---------------------------------------------------------------------------

    \323\ See proposed Section 1.1.
    \324\ The CCID Subsystem will contain the functionality to
facilitate the efficient and accurate conversion of multiple legal
entity's EIN(s) into a Transformed Value(s) and a subsequent
Customer-ID. However, because an EIN(s) will be reported to CAIS as
a Customer Attribute for association with a Customer-ID, the need
for Regulatory Staff to utilize the CCID Subsystem to convert
multiple EIN(s) into a Transformed Value and a subsequent Customer-
ID will be minimized.
    \325\ See proposed Appendix D, Section 4.1.6 (Programmatic CCID
Subsystem Access).
    \326\ See id.
    \327\ See id.
---------------------------------------------------------------------------

    The Commission believes that it is appropriate to provide for
Programmatic CCID Subsystem Access because such access would facilitate
the ability of Regulatory Staff, who may be in possession of the
ITIN(s)/SSN(s)/EIN(s) of multiple Customers as a result of their
regulatory efforts outside of the CAT, to obtain the Customer-IDs of
such Customers and query CAT Data, including Customer and Account
Attributes and CAT transactional data using an application that
accommodates the input of multiple ITIN(s)/SSN(s)/EIN(s). In addition,
as required by Article VI, Section 6.5(g)(i)(I), the policies of the
Participants must be reasonably designed to implement and satisfy the
Customer and Account Attributes data requirements of Section 4.1.6 of
Appendix D such that Participants must be able to demonstrate that a
Participant's ongoing use of Programmatic CAIS and/or CCID Subsystem
access is in accordance with the Customer Identifying Systems Workflow,
which will enable an ongoing analysis of whether Programmatic CCID
Subsystem Access is being used by an approved Participant
appropriately. Finally, the Commission believes that it is appropriate
to amend the CAT NMS Plan to adopt the performance requirements
applicable to User-Defined Direct queries because such queries provide
Regulatory Staff with programmatic interfaces to enable complex queries
in a manner most similar to Programmatic CCID Subsystem Access.
    The Commission requests comment on the proposed amendments to
define and set forth the requirements for Programmatic CCID Subsystem
Access. Specifically, the Commission solicits comment on the following:
    129. The proposed amendments require the Plan Processor to provide
Programmatic CCID Subsystem Access by developing and supporting the
CCID Transformation Logic and an API to facilitate the submission of
Transformed Values to the CCID Subsystem for the generation of
Customer-ID(s). Is there another more appropriate method to facilitate
the development and support for the Programmatic CCID Subsystem Access?
Please be specific in your response.
    130. The proposed amendments require Programmatic CCID Subsystem
access to allow Regulatory Staff to submit multiple ITIN(s)/SSN(s)/
EIN(s) of a Customer(s) of regulatory interest identified through
regulatory efforts outside of CAT to obtain Customer-ID(s) in order to
query CAT Data regarding such Customer(s). Is this an appropriate way
to facilitate Regulatory Staff obtaining Customer-IDs in order to query
CAT Data? If not, is there another more appropriate way to facilitate
obtaining Customer-IDs for Regulatory Staff?
    131. The proposed amendments that require the performance
requirements for Programmatic CCID Subsystem Access be consistent with
the criteria in the User-Defined Direct Query Performance Requirements
set out in Appendix D, Functionality of the CAT System. Is there
another more appropriate performance requirement in the CAT NMS Plan
that should apply to Programmatic CCID Subsystem Access? Why would an
alternative performance requirement more appropriate? Please be
specific in your response.

G. Participants' Data Confidentiality Policies

1. Data Confidentiality Policies
    When adopting Rule 613, the Commission recognized the importance of
maintaining the confidentiality of all CAT Data reported to the Central
Repository.\328\ The Commission noted at the time that the purpose and
efficacy of the CAT would be compromised if the Commission, the SROs,
and their members could not rely on the integrity, confidentiality, and
security of the information stored in the Central Repository, noting
that the Central Repository would contain confidential and commercially
valuable information.\329\ Rule 613 required the CAT NMS Plan to
include policies and procedures that are designed to ensure
implementation of the privacy protections that are necessary to assure
regulators and market participants that the CAT NMS Plan provides for
rigorous protection of confidential information reported to the Central
Repository.\330\ Furthermore, Rule 613 required the Participants and
their employees to agree to not use CAT Data for any purpose other than
surveillance and regulatory purposes, provided that a Participant is
permitted to use the data that it reports to the Central Repository for
regulatory, surveillance, commercial, or other purposes as otherwise
permitted by applicable law, rule or regulation.\331\
---------------------------------------------------------------------------

    \328\ See e.g., Rule 613 Adopting Release, supra note 2, at
45781-83.
    \329\ See id. at 45783.
    \330\ 17 CFR 242.613(e)(4)(i).
    \331\ 17 CFR 242.613(e)(4)(i)(A). In addition, the CAT NMS Plan
specifies that usage of the CAT Data is provided to Participants
solely for the purpose of performing their respective regulatory and
oversight responsibilities pursuant to federal securities laws,
rules and regulations or any contractual obligations. CAT NMS Plan
Section 6.5(g). As noted in the CAT NMS Plan Approval Order,
regulatory purposes include, among other things, analysis and
reconstruction of market events, market analysis and research to
inform policy decisions, market surveillance, examinations,
investigations, and other enforcement functions. See CAT NMS Plan
Approval Order, supra note 3, at 84724 note 586.
---------------------------------------------------------------------------

    The CAT NMS Plan has several provisions designed to protect the
confidentiality of CAT Data. Specifically, Section 6.5(f)(ii) of the
CAT NMS Plan requires Participants to adopt and enforce policies and
procedures that: (1) Implement ``effective information barriers''
between the Participant's regulatory and non-regulatory staff with
regard to access and use of CAT Data stored in the Central Repository;
(2) permit only persons designated by Participants to have access to
the CAT Data stored in the Central Repository; and (3) impose penalties
for staff non-compliance with any of its or the Plan Processor's
policies or procedures with respect to information security. Section
6.5(f)(iii) of the CAT NMS Plan requires each Participant to, as
promptly as reasonably practicable, and in any event

within 24 hours, report to the Chief Compliance Officer, in accordance
with the guidance provided by the Operating Committee, any instance, of
which such Participant becomes aware, of: (1) Noncompliance with the
policies and procedures adopted by such Participant pursuant to Section
6.5(e)(ii); or (2) a breach of the security of the CAT. Section 6.5(g)
requires the Participants to establish, maintain, and enforce written
policies and procedures reasonably designed to: (1) Ensure the
confidentiality of the CAT Data obtained from the Central Repository;
and (2) limit the use of CAT Data obtained from the Central Repository
solely for surveillance and regulatory purposes. The CAT NMS Plan
further requires each Participant to periodically review the
effectiveness of the policies and procedures required by Section
6.5(g), and to take prompt action to remedy deficiencies in such
policies and procedures.\332\
---------------------------------------------------------------------------

    \332\ See CAT NMS Plan, supra note 3, at Section 6.5(g).
---------------------------------------------------------------------------

    The Commission believes that while the existing provisions
discussed above are designed to protect the security and
confidentiality of CAT Data, the CAT NMS Plan should be modified and
supplemented to provide additional specificity concerning data usage
and confidentiality policies and procedures, and to strengthen such
policies and procedures with expanded and new requirements designed to
protect the security and confidentiality of CAT Data.
    First, the Commission proposes to combine the existing CAT NMS Plan
provisions applicable to Participants discussed above, specifically
Sections 6.5(f)(ii), (f)(iii) and (g), into a single section of the CAT
NMS Plan.\333\ The Commission also proposes to modify these provisions
so that they would apply to the Proposed Confidentiality Policies and
procedures and usage restriction controls \334\ in accordance with
these policies, as required by proposed Section 6.5(g)(i).\335\ This
single section, Section 6.5(g)(i), would set forth the provisions that
must be included in each Participant's confidentiality and related
policies (``Proposed Confidentiality Policies''). Provisions that are
applicable to Participants would be contained in one place and
separated from those applicable to the Plan Processor. As proposed,
Section 6.5(f) of the CAT NMS Plan would continue to relate to data
confidentiality and related policies and procedures of the Plan
Processor, while Section 6.5(g) would relate to data confidentiality
and related policies and procedures of the Participants.
---------------------------------------------------------------------------

    \333\ Specifically, the Commission proposes to move Sections
6.5(f)(ii)(A) and (C), to Sections 6.5(g)(i)(D) and (H)
respectively, and Section 6.5(f)(iii) to Section 6.5(g)(iii).
Section 6.5(f)(ii)(B) would be deleted and replaced by a new
provision regarding access to CAT Data in proposed Section
6.5(g)(i)(C), as discussed below. See infra Part II.G.2.a. Due to
the proposed deletions, paragraphs (f)(iv) and (f)(v) in Section 6.5
would be re-designated as (f)(ii) and (f)(iii).
    \334\ See, infra, Part II.G.3.a.
    \335\ Revising these provisions to cover the Proposed
Confidentiality Policies would apply these existing safeguards to
the identical Proposed Confidentiality Policies. For example,
proposed Section 6.5(g)(iii) would be modified to reference the
policies, procedures and usage restriction controls required by
Section 6.5(g)(i) instead of Section 6.5(e)(ii). The Commission
believes the provision is supposed to reference Section 6.5(f)(ii),
because there is no Section 6.5(e)(ii) and because Participant
policies and procedures are addressed in Section 6.5(f)(ii). In
addition, the Commission proposes to revise the language of some of
these provisions for clarity. Proposed Section 6.5(g)(iii) would
thus require Participants to, as promptly as reasonably practicable,
and in any event within 24 hours of becoming aware, report to the
Chief Compliance Officer, in accordance with the guidance provided
by the Operating Committee: (A) Any instance of noncompliance with
the policies, procedures and usage restriction controls adopted by
such Participant pursuant to Section 6.5(g)(i); or (B) a breach of
the security of the CAT.
---------------------------------------------------------------------------

    Second, the Commission proposes to amend the CAT NMS Plan to
require the Proposed Confidentiality Policies to be identical across
Participants, which would result in shared policies that govern the
usage of CAT Data by Participants and apply to all Participants
equally. Currently, the CAT NMS Plan requires each individual
Participant to establish, maintain, and enforce policies and procedures
relating to the usage and confidentiality of CAT Data. The Commission
preliminarily believes that having policies that vary across
Participants could result in the creation of policies that differ
substantively even for the same regulatory role. For example, pursuant
to Section 6.5(f)(ii) of the CAT NMS Plan, a Participant could
establish policies that grant broad access to CAT Data to regulatory
staff that are assigned to a particular regulatory role, even if such
broad access is not necessary for that regulatory role, while another
Participant could more appropriately establish policies limiting access
to CAT Data for the same regulatory role to CAT Data necessary to
perform the role. The Commission preliminarily believes that to the
extent SROs have regulatory staff with roles that serve a consistent
purpose across SROs, that SROs generally should be accessing CAT Data
pursuant to identical policies. The Commission further believes that
requiring one identical set of policies would allow for input and
expertise of all Participants to be used in the development of such
policies, and should reasonably be expected to result in more
comprehensive Proposed Confidentiality Policies that incorporate the
full range of regulatory activities performed by the SROs and are
designed in a manner that is consistent with how SROs operate in
practice.\336\ As proposed, while the Proposed Confidentiality Policies
would be identical across Participants, the policies would incorporate
different regulatory and surveillance roles and goals of the
Participants and would apply to the whole scope of CAT Data usage by
Participants, including use within a SAW, excepted non-SAW environment,
or any other Participant environment.\337\
---------------------------------------------------------------------------

    \336\ The Commission understands that the Participants have
established policies and procedures pursuant to Section 6.5(f)(ii),
and preliminarily believes that Participants can use these existing
policies and procedures in order to help prepare, review, and
approve the policies and procedures required by proposed Section
6.5(g)(i). The Commission also understands Participants have
policies and procedures outside of CAT, such as insider trading
policies and non-public data policies, which could be used to help
develop both the Proposed Confidentiality Policies and the related
procedures.
    \337\ See infra Part II.G.2.
---------------------------------------------------------------------------

    The Commission recognizes, though, that the internal organization
structures, reporting lines, or other operations may differ across the
Participants. Accordingly, the Commission preliminarily believes that
it is appropriate to permit Participants to develop their own
procedures relating to the Proposed Confidentiality Policies. In this
regard, proposed Section 6.5(g)(i) would require each Participant to
establish, maintain, and enforce procedures in accordance with the
policies required by proposed Section 6.5(g)(i). The Commission also
preliminarily believes that it is not necessary to subject such
Participant procedures to the same requirements as those policies that
are discussed below, including the requirements that such procedures
are approved by the CAT Operating Committee and subject to annual
examination and publication, because Participant procedures will differ
based on individual Participants' organizational, technical, and
structural uniqueness.\338\
---------------------------------------------------------------------------

    \338\ See infra Part II.G.4.
---------------------------------------------------------------------------

2. Access to CAT Data and Information Barriers
    As noted above, current Sections 6.5(f)(ii)(A) and (B) of the CAT
NMS Plan require each Participant to adopt and enforce policies and
procedures that implement effective information barriers between such
Participant's

regulatory and non-regulatory staff with regard to access and use of
CAT Data stored in the Central Repository and permit only persons
designated by Participants to have access to CAT Data stored in the
Central Repository.\339\
---------------------------------------------------------------------------

    \339\ See supra Part II.G.1.
---------------------------------------------------------------------------

a. Regulatory Staff and Access to CAT Data
    Current Section 6.5(f)(ii)(A) and (B) do not impose specific
restrictions or requirements for Participants in determining which
staff are considered regulatory staff. The existing provisions also do
not address whether there may be limited instances in which non-
regulatory staff--particularly technical staff--may have legitimate
reasons to access CAT Data for regulatory purposes. The Commission
believes that providing specificity regarding which staff are
considered regulatory staff in the current CAT NMS Plan, and thus may
have access to CAT Data, and specific limitations on access to CAT Data
by both regulatory and non-regulatory staff may help better protect CAT
Data and result in it being accessed and used appropriately.
    To address these issues, the Commission proposes to replace
existing Section 6.5(f)(ii)(B) \340\ with Section 6.5(g)(i)(C) to the
CAT NMS Plan. Section 6.5(g)(i)(C) would limit access to CAT Data to
persons designated by Participants, which persons must be: (1)
Regulatory Staff; or (2) technology and operations staff that require
access solely to facilitate access to and usage of CAT Data stored in
the Central Repository by Regulatory Staff. In contrast to existing
Section 6.5(f)(ii)(B), the proposed requirement in Section 6.5(g)(i)(C)
would apply more broadly to CAT Data, rather than ``CAT Data stored in
the Central Repository,'' and the Commission preliminarily believes
that this expansion is appropriate because access to CAT Data should be
limited to appropriate Participant personnel whether or not the data is
being accessed directly from the Central Repository. The Commission
further believes that deleting Section 6.5(f)(ii)(B) is appropriate
because proposed Section 6.5(g)(i)(C) provides greater clarity and more
specificity on which Participant staff are permitted to access CAT
Data.
---------------------------------------------------------------------------

    \340\ Current Section 6.5(f)(ii)(B) of the CAT NMS Plan states
that each Participant shall adopt and enforce policies and
procedures that: ``Permit only persons designated by Participants to
have access to the CAT Data stored in the Central Repository.'' The
Commission believes that proposed Section 6.5(g)(i)(C) more clearly
defines what Participant staff may have access to CAT Data.
---------------------------------------------------------------------------

    The Commission proposes to define ``Regulatory Staff,'' for the
purposes of the Proposed Confidentiality Policies and the CAT NMS Plan.
Specifically, ``Regulatory Staff'' would be defined in Section 1.1 of
the CAT NMS Plan as the Participant's Chief Regulatory Officer (or
similarly designated head(s) of regulation) and staff within the Chief
Regulatory Officer's (or similarly designated head(s) of regulation's)
reporting line.\341\ In addition, the proposed definition would require
that Regulatory Staff be specifically identified and approved in
writing by the Chief Regulatory Officer (or similarly designated
head(s) of regulation). In addition to creating the definition, the
Commission proposes to amend references throughout the CAT NMS Plan
that refer to ``Participant regulatory staff'' or ``Participants'
regulatory staff'' to ``Participants' Regulatory Staff,'' in Sections
6.5(b)(i) and 6.5(f)(iv)(B) and in Appendix D, Sections 6.1, 6.2, 8.1,
8.2.1, 8.3, 9.1, 10.2 and 10.3 of the CAT NMS Plan.\342\
---------------------------------------------------------------------------

    \341\ See proposed CAT NMS Plan Section 1.1.
    \342\ The term ``regulatory staff'' appears in other existing
provisions of the CAT NMS Plan, and in particular Appendix C, and
the Commission is not proposing to amend these references. The
Commission is not changing references to ``regulatory staff'' which
clearly refer to both Participant and Commission staff, in Section
6.10 of the CAT NMS Plan. In addition, the Commission is not
amending the term in Appendix C because, as discussed in Part II.L
below, Appendix C was not intended to be continually updated once
the CAT NMS Plan was approved.
---------------------------------------------------------------------------

    The Commission preliminarily believes that the proposed definition
of Regulatory Staff is reasonably designed to result in the
identification of those with a legitimate regulatory role and such
staff would be the only Participant staff that are generally provided
access to CAT Data. The Commission preliminary believes considering a
Participant's Chief Regulatory Officer (or similarly designated head(s)
of regulation) as Regulatory Staff is appropriate because generally
that role with a Participant is regulatory in function and reports
directly to a Participant's board of directors and/or a Participant's
Regulatory Oversight Committee.\343\ The Commission is including staff
within the Chief Regulatory Officer's (or similarly designated head(s)
of regulation's) reporting line because the Commission believes that
such Participant staff will have a primarily regulatory function. By
contrast, Participant staff with other reporting lines and who
primarily perform other functions for Participants, such as commercial
or business functions generally should not have access to CAT Data. The
Commission further believes that requiring the Chief Regulatory Officer
(or similarly designated head(s) of regulation) to identify and approve
which personnel are considered Regulatory Staff should help prevent
staff with primarily non-regulatory obligations from being categorized
as Regulatory Staff. A Chief Regulatory Officer (or similarly
designated head(s) of regulation) may determine that some Regulatory
Staff should not have access to CAT Data. The Commission believes that
this proposal would further clarify which Participant staff can access
CAT Data outside of the CAT infrastructure. For example, in addition to
the staff who are directly accessing CAT Data inside the CAT
infrastructure, Participant regulatory staff assisting examination
staff in analyzing data extracted by a Participant for a particular
examination or participating in an enforcement matter would be
accessing CAT Data and thus would need to be identified and approved
for access to CAT Data.
---------------------------------------------------------------------------

    \343\ The Commission is proposing to allow ``similarly
designated head(s) of regulation'' to act as the Chief Regulatory
Officer in the proposed definition because certain Participants do
not have a ``Chief Regulatory Officer.'' With respect to FINRA, the
Commission understands that it does not have a Chief Regulatory
Officer and that it may have multiple Executive Vice Presidents that
fit within for the definition.
---------------------------------------------------------------------------

    Participants may have staff with the technical or operational
expertise necessary to implement systems to access CAT Data within
other departments or that otherwise fall outside of the proposed
definition of Regulatory Staff. Limiting access solely to Regulatory
Staff could make it difficult for Participants to adequately develop,
monitor, test, improve, or fix technical and operational systems
developed or designed to access, review, or analyze CAT Data.
Accordingly, the Commission proposes to require that the Proposed
Confidentiality Policies allow technology and operations staff access
to CAT Data only insofar as it is necessary to facilitate access by
Regulatory Staff. To better protect CAT Data however, the Commission
believes that such staff should not be granted access to CAT Data as a
matter of course, and further believes that such staff should be
subject to affidavit and training requirements and other requirements
applicable to regulatory users of CAT Data.
    The Commission understands that with regard to CAT
responsibilities, certain Participants may choose to enter into
regulatory services agreements (``RSAs'') or allocate regulatory
responsibilities pursuant to Rule 17d-2 (through ``17d-2 agreements'')
to other Participants to operate their surveillance and regulatory
functions, and in

particular cross-market regulation and surveillance.\344\ Under an RSA
an SRO contracts to perform certain regulatory functions on behalf of
another SRO, but the outsourcing SRO maintains ultimate legal
responsibility for the regulation of its members and market. In
contrast, under a Commission approved plan for the allocation of
regulatory responsibilities pursuant to Rule 17d-2, the SRO does not
maintain ultimate legal responsibility.\345\ The amendment would not
prohibit the outsourcing SRO from permitting its Regulatory Staff to
access CAT Data to carry out their regulatory responsibilities. In
addition, the Commission preliminarily believes it would be appropriate
for Regulatory Staff to access CAT Data to oversee and audit the
performance of the SRO under an RSA, since the ultimate regulatory
responsibility remains with the outsourcing SRO.
---------------------------------------------------------------------------

    \344\ See 15 U.S.C. 78q(d)(1) and 17 CFR 240.17d-2.
    \345\ See Section 17(d)(1) of the Act and Rule 17d-2 thereunder,
15 U.S.C. 78q(d)(1) and 17 CFR 240.17d-2. Section 17(d)(1) of the
Act allows the Commission to relieve an SRO of certain
responsibilities with respect to members of the SRO who are also
members of another SRO. Specifically, Section 17(d)(1) allows the
Commission to relieve an SRO of its responsibilities to: (i) Receive
regulatory reports from such members; (ii) examine such members for
compliance with the Act and rules and regulations thereunder, and
the rules of the SRO; or (iii) carry out other specified regulatory
responsibilities with respect to such members.
---------------------------------------------------------------------------

    The Commission further believes that restricting access to CAT Data
as proposed above would not foreclose 17d-2 agreements and RSAs, but
that the Proposed Confidentiality Policies, 17d-2 agreements and RSAs
would address access to CAT Data in light of these agreements. For
example, the Commission preliminarily believes that the role of the
relevant SROs' Chief Regulatory Officers, and designation of employees
who may access CAT Data, may depend on the nature of the arrangement
between the SROs. However, the proposed amendment would not foreclose
SROs from considering both the outsourcing SRO's and the counterparty
SRO's Chief Regulatory Officer (or similarly designated head(s) of
regulation) as a relevant Chief Regulatory Officer (or similarly
designated head(s) of regulation) for purposes of proposed Sections 1.1
and 6.5(g)(i), and thus allowing each Chief Regulatory Officer (or
similarly designated head(s) of regulation) to identify Regulatory
Staff in a manner consistent with the Proposed Confidentiality
Policies.
b. Information Barriers
    Current Section 6.5(f)(ii)(A) of the CAT NMS Plan requires
Participants to adopt and enforce policies and procedures that
implement effective information barriers between such Participant's
regulatory and non-regulatory staff with regard to access and use of
CAT Data stored in the Central Repository. The Commission proposes to
move this requirement to Section 6.5(g)(i)(D), and modify the provision
to replace the references to ``regulatory and non-regulatory staff,''
with the new defined term to state ``Regulatory Staff and non-
Regulatory Staff,'' and correct the grammar of the provision.
    Because the CAT is intended to be a regulatory system, the
Commission continues to believe that requiring effective information
barriers between regulatory and non-regulatory Staff is appropriate.
The Commission believes that proposed Section 6.5(g)(i)(D) improves
upon existing Section 6.5(f)(ii) by requiring such information barriers
to be implemented in the identical set of policies required by Section
6.5(g)(i), and because it more clearly defines between which types of
staff effective information barriers must be established. Regulatory
Staff, depending on their roles and regulatory responsibilities, will
have access to transactional data and/or access to CAIS or CCID
Subsystem data, and there should be effective information barriers that
prevent disclosure of such data to non-Regulatory Staff. Effective
information barriers would help restrict non-Regulatory Staff access to
CAT Data to the limited circumstances in which such staff could access
CAT Data, as described below.
c. Access by Non-Regulatory Staff
    The Commission understands that there might be limited
circumstances in which non-Regulatory Staff access to CAT data may be
appropriate. Accordingly, the Commission proposes new Section
6.5(g)(i)(E), which would require that the Confidentiality Policies
limit non-Regulatory Staff access to CAT Data to limited circumstances
in which there is a specific regulatory need for such access and a
Participant's Chief Regulatory Officer (or similarly designated head(s)
of regulation), or designee, provides written approval for each
instance of access by non-Regulatory Staff.\346\
---------------------------------------------------------------------------

    \346\ The Commission notes that this would not apply to certain
technology and operations staff pursuant to proposed Section
6.5(g)(i)(C) discussed above.
---------------------------------------------------------------------------

    The Commission believes that it is appropriate to provide this
specific exception to allow for access to CAT Data by non-Regulatory
Staff where there is a specific regulatory need. The Commission
preliminarily believes there could be circumstances that justify
allowing non-Regulatory Staff to view limited CAT Data. For example, in
the case of a market ``flash crash,'' Regulatory Staff may need to
brief an exchange's Chief Executive Officer (who may not otherwise be
considered Regulatory Staff) regarding the causes of such an event or
share raw CAT Data about specific orders and trades. Another example in
which non-Regulatory Staff access could be appropriate is if major
market participant misconduct warrants a briefing to a Participant's
board of directors because it presents a risk to the continued
operation of an exchange. The Commission believes requiring approval
and documentation of such approval by the Participant's Chief
Regulatory Officer (or similarly designated head(s) of regulation)
should obligate the Chief Regulatory Officer (or similarly designated
head(s) of regulation) to determine whether a specific regulatory need
exists. As proposed, and described further below, such approval and the
access of CAT Data by non-Regulatory Staff would be subject to an
annual examination.\347\
---------------------------------------------------------------------------

    \347\ See infra Part II.G.4.
---------------------------------------------------------------------------

d. Training and Affidavit Requirements
    The CAT NMS Plan currently has provisions relating to training and
affidavit requirements for individuals who access CAT Data, enforced by
the Plan Processor. Section 6.1(m) of the CAT NMS Plan requires the
Plan Processor to develop and, with the prior approval of the Operating
Committee, implement a training program that addresses the security and
confidentiality of all information accessible from the CAT, as well as
the operational risks associated with accessing the Central Repository.
The training program must be made available to all individuals who have
access to the Central Repository on behalf of the Participants or the
SEC, prior to such individuals being granted access to the Central
Repository. Section 6.5(f)(i)(B) states that the Plan Processor shall
require all individuals who have access to the Central Repository
(including the respective employees and consultants of the Participants
and the Plan Processor, but excluding employees and Commissioners of
the SEC) to execute a personal ``Safeguard of Information Affidavit''
in a form approved by the Operating Committee

providing for personal liability for misuse of data.\348\
---------------------------------------------------------------------------

    \348\ Although Commission personnel would be excluded from
provisions such as Section 6.5(f)(i)(B), the rules and policies
applicable to the Commission and its personnel will be comparable to
those applicable to the Participants and their personnel. See CAT
NMS Plan Approval Order, supra note 3, at 84765.
---------------------------------------------------------------------------

    The Commission proposes in new Section 6.5(g)(i)(F) that the
Proposed Confidentiality Policies require all Participant staff who are
provided access to CAT Data to: (1) Sign a ``Safeguard of Information''
affidavit as approved by the Operating Committee pursuant to Section
6.5(f)(i)(B); and (2) participate in the training program developed by
the Plan Processor that addresses the security and confidentiality of
information accessible in the CAT pursuant to Section 6.1(m), provided
that Participant staff may be provided access to CAT Data prior to
meeting these requirements in exigent circumstances.\349\ This
affidavit and training requirement is already required by the Plan
Processor before individuals can access the Central Repository,
pursuant to Sections 6.1(m) and 6.5(f)(i)(B) of the CAT NMS Plan, but
this proposal would require the Proposed Confidentiality Policies to
access to CAT Data.
---------------------------------------------------------------------------

    \349\ The Commission notes that the Safeguard of Information
affidavit approved by the Operating Committee pursuant to Section
6.5(f)(i)(B) must provide for personal liability for the misuse of
data.
---------------------------------------------------------------------------

    The Commission preliminarily believes it is important that any
Participant staff with access to CAT Data, whether or not that staff
has access to the Central Repository itself, should undergo appropriate
training and sign the Safeguard of Information affidavit.\350\ The
Commission further believes that an exception for exigent circumstances
is appropriate to provide for the rare circumstance where non-
Regulatory Staff, who has not yet completed the training and affidavit
requirements required by Section 6.5(g)(i)(F), must receive access to
limited CAT Data to address an exceptional emergency. Examples might
include the Chief Executive Officer of a securities exchange receiving
a briefing relating to a sudden market-wide emergency or technical or
operations staff being called upon to address an unanticipated threat
to the continued functioning of a Participant's system. Under proposed
Section 6.5(g)(i)(F), any Participant staff who does receive access to
CAT Data prior to satisfying the requirements of proposed Section
6.5(g)(i)(F), due to exigent circumstances, would have to fulfill such
requirements thereafter.
---------------------------------------------------------------------------

    \350\ In the CAT NMS Plan Approval Order, the Commission stated
that it believed existing CAT NMS Plan provisions, including Section
6.1(m), ``indicate that the Plan Processor will require that all
persons that have access to CAT Data will be required to complete
training prior to accessing CAT Data, and expects that only those
persons that have been adequately trained will have access to CAT
Data.'' See CAT NMS Plan Approval Order, supra note 3, at 84755. The
Commission believes that proposed Section 6.5(g)(i)(F) clarifies and
affirms that these expectations regarding training should apply to
all Participant staff with access to CAT Data, regardless of whether
or not directly accessed through the Central Repository.
---------------------------------------------------------------------------

3. Additional Policies Relating to Access and Use of CAT Data and
Customer and Account Attributes
    The Commission also proposes several additional requirements to the
Proposed Confidentiality Policies to expand upon existing provisions as
described below. The Commission preliminarily believes that these
additional requirements, and providing a comprehensive list of
requirements for the Proposed Confidentiality Policies, would help
result in policies that are sufficiently robust to protect CAT Data and
to effectively regulate Participant usage of such data.
a. Limitations on Extraction and Usage of CAT Data
    Rule 613 and the CAT NMS Plan limit the usage of CAT Data solely to
surveillance and regulatory purposes.\351\ In this regard, the CAT NMS
Plan requires Participants to adopt policies and procedures that are
reasonably designed to limit the use of CAT Data obtained from the
Central Repository solely for surveillance and regulatory
purposes.\352\ In order to broaden the scope of such policies, the
Commission proposes to add Sections 6.5(g)(i)(B) to require that the
policies limit the extraction of CAT Data to the minimum amount
necessary to achieve a specific surveillance or regulatory
purpose.\353\ The Commission recognizes the potential security risks
that result from the extraction of CAT Data. At the same time, the
Commission recognizes that there may be legitimate regulatory needs to
extract CAT Data. Accordingly, the Commission believes that it is
important for the CAT NMS Plan and the Participants' policies to
require that only the minimum amount of CAT Data necessary to achieve
surveillance or regulatory purposes shall be downloaded. Such a
requirement would apply to all CAT Data, including transactional data
and Customer and Account Attributes, as well as means of access to CAT
Data, such as the online targeted query tool or Manual and Programmatic
CAIS and/or CCID Subsystem Access. The Commission preliminarily does
not believe that such a requirement would impede Participant ability to
perform surveillance, investigate potential violations, and bring
enforcement cases, because Participant Regulatory Staff can view and
analyze CAT Data without extraction, such as through the proposed SAW
environments or in the online targeted query tool, and to the extent
that any CAT Data must be downloaded this proposed provision would not
limit a Participant's ability to download the minimum amount of CAT
Data necessary to achieve surveillance or regulatory purposes.
---------------------------------------------------------------------------

    \351\ See, e.g., Rule 613(e)(4)(i)(A) and CAT NMS Plan, supra
note 3, at Section 6.5(f)(i)(A), 6.5(g). However, a Participant may
use data that it reports to the Central Repository for regulatory,
surveillance, commercial, or other purposes as otherwise not
prohibited by applicable law, rule or regulation. See CAT NMS Plan,
supra note 3, at 6.5(h).
    \352\ See CAT NMS Plan, supra note 3, at Section 6.5(g). As
proposed, the policies required by the Proposed Confidentiality
Policies would still require this. See proposed Section
6.5(g)(i)(A). The Commission also proposes to modify this provision
to state that the Proposed Confidentiality Policies must ensure the
confidentiality of CAT Data and limit the use of CAT Data to solely
surveillance and regulatory purposes, and not ``CAT Data obtained
from the Central Repository,'' to avoid potential confusion and to
make clear that requirements related to the Proposed Confidentiality
Policies extend to CAT Data outside of the Central Repository.
    \353\ This provision is consistent with proposed Section
6.13(a)(i)(C). See, supra Part II.C.2. This provision of the
Proposed Confidentiality Policies, as well as the others, will be
subject to an annual examination of compliance by an independent
auditor, which should help ensure that the provision is adhered to
by Participants. See, infra Part II.G.4.
---------------------------------------------------------------------------

b. Individual Roles and Usage Restrictions
    The Commission proposes to add Section 6.5(g)(i)(F) to the CAT NMS
Plan to require the Proposed Confidentiality Policies to define the
individual roles and regulatory activities of specific users, including
those users requiring access to Customer and Account Attributes, of the
CAT. This provision would require Participants to define roles and
responsibilities on an individual level. For example, the policies
could provide for a role in which a regulatory analyst accesses CAT
Data to determine whether industry members complied with specific laws
or SRO or Commission rules. The policies would be expected to define
all individual roles and regulatory activities of users that
Participants require to perform their regulatory and surveillance
functions. For example, this would include roles and regulatory
activities related to CAIS and CCID Subsystem access. The Commission
also proposes to require in

Section 6.5(f)(i) of the CAT NMS Plan that each Participant shall
establish, maintain, and enforce usage restriction controls (e.g., data
loss prevention controls within any environment where CAT Data is used)
in accordance with the Proposed Confidentiality Policies.
    The Commission preliminarily believes that requiring the
Participants to define the individual roles and regulatory activities
of specific users, including those requiring access to Customer and
Account Attributes, will encourage the Participants to thoroughly
consider the roles and regulatory activities that individual users at
Participants will be engaged in when using CAT Data and to consider
what roles and regulatory activities require CAT Data to accomplish
Participants' regulatory goals. Clearly defined roles and regulatory
activities for individual users would help Participants better develop
appropriate policies, procedures and controls to appropriately limit
access to CAT Data on an individual level, and in particular, to
establish appropriate Participant-specific procedures and usage
restriction controls as required by proposed Section 6.5(g)(i). Over
time, if Participants develop new roles and regulatory activities, or
modify existing roles and regulatory activities, the Participants would
be required to update the Proposed Data Confidentiality Policies, and
related procedures and usage restriction controls, as appropriate. The
Commission also preliminarily believes that requiring the Participants
to define individual roles and regulatory activities of specific users
should provide clarity and transparency with regard to the use of CAT
Data to achieve specific regulatory and surveillance roles and goals of
the Participants.\354\
---------------------------------------------------------------------------

    \354\ See infra Part II.E.4.
---------------------------------------------------------------------------

    In particular, the Commission preliminarily believes that this
provision would help provide clarity with regard to individual roles in
the context of regulatory coordination. In addition, the provision
would add accountability for Regulatory Staff based on their individual
roles. Some individual roles that are appropriate for some Participants
may not be appropriate for others, because of differences between
markets and the functions of the SROs. For example, FINRA may need to
define individual roles and regulatory responsibilities that would not
be applicable to exchange SROs. Or, an SRO with a trading floor may
have to define individual roles that specifically relate to regulation
and surveillance of trading floor activity. An SRO that has entered
into an RSA with another SRO may need to define an individual role or
roles for Regulatory Staff responsible for overseeing and monitoring
the another SRO's performance under the RSA.
    The Commission believes that requiring the establishment of usage
restriction controls should help achieve the goal that individuals with
access to CAT Data are using only the amount of CAT Data necessary to
accomplish that individual's regulatory function. For example,
Regulatory Staff with a regulatory role that only requires access to
transactional data should not be given manual access to CAIS or CCID
Subsystem. Additionally, limiting the access of an individual to only
the specific data elements required for his or her surveillance or
regulatory function reduces the potential of inappropriate receipt and
misuse of CAT Data. The Commission believes that this requirement also
leverages existing requirements of the CAT NMS Plan.\355\ The
Commission further believes that the CAT NMS Plan's logging
requirements would provide information that would help Participants to
establish and refine usage restriction controls.\356\
---------------------------------------------------------------------------

    \355\ Pursuant to the CAT NMS Plan, the CAT System must support
an arbitrary number of roles with access to different types of CAT
Data, down to the attribute level. See CAT NMS Plan, supra note 3,
at Appendix D, Section 4.14. In addition, the administration and
management of roles must be documented by the Plan Processor. Id. As
noted below, the Commission proposing to amend Appendix D, Section
4.14 to clarify what ``arbitrary number'' means, see, infra, note
380.
    \356\ For example, the CAT NMS Plan requires the online targeted
query tool to log ``submitted queries and parameters used in the
query, the user ID of the submitter, the date and time of the
submission, as well as the delivery of results. The Plan Processor
will use this logged information to provide monthly reports to each
Participant and the SEC of its respective metrics on query
performance and data usage of the online query tool. The Operating
Committee must receive all monthly reports in order to review items,
including user usage and system processing performance.'' See CAT
NMS Plan, supra note 3, at Appendix D, Section 8.1.1.
---------------------------------------------------------------------------

c. Policies Relating to Customer and Account Attributes
    Currently, the policies and procedures required by Section
6.5(f)(ii) of the CAT NMS Plan and (g) do not directly address PII or
Customer and Account Attributes, CAIS or the CCID Subsystem. The
Commission believes that requiring Participants to incorporate policies
relating to the access of Customer and Account Attributes, Programmatic
CAIS Access, and Programmatic CCID Subsystem Access in the Proposed
Confidentiality Policies would help protect the security and
confidentiality of Customer and Account Attributes and CCIDs.
    Specifically, the Commission proposes Section 6.5(g)(i)(I) of the
CAT NMS Plan, which would require that the Proposed Confidentiality
Policies be reasonably designed to implement and satisfy the Customer
and Account Attributes data requirements of proposed Section 4.1.6 of
Appendix D such that Participants must be able to demonstrate that a
Participant's ongoing use of Programmatic CAIS and/or CCID Subsystem
access is in accordance with the Customer Identifying Systems
Workflow.\357\ As discussed above in Part II.F, the Commission is
proposing to amend Section 4.1.6 of Appendix D to more clearly define a
Customer Identifying Systems Workflow, which sets forth explicit
restrictions designed to limit the access and usage of Customer and
Account Attributes only to the extent necessary to accomplish
surveillance and regulatory purposes. The Commission believes that
requiring the Proposed Confidentiality Policies to incorporate and
implement the proposed Customer Identifying Systems Workflow would
result in consistent application of the Customer Identifying Systems
Workflow because all Participants would be subject to the policies
which apply to Customer and Account Data usage both within and outside
of a SAW. Together with Participant-specific procedures and usage
restriction controls, these policies would help protect the security
and confidentiality of Customer and Account Attributes, which would
yield insight into a specific Customer's trading activity if coupled
with transaction data, and would be collected and maintained by the CAT
system.\358\ These policies would also be subject to the approval,
publication, and examination provisions discussed below.
---------------------------------------------------------------------------

    \357\ See supra Part II.E and Part II.F.
    \358\ In addition, the Commission believes that the logging and
reports required by Appendix D, Section 8.1.1 of the CAT NMS Plan
would help Participants review whether the requirements of Section
4.1.6 of Appendix D are being followed. See, supra note 356.
---------------------------------------------------------------------------

    The Commission also believes that it is appropriate to amend the
CAT NMS Plan to highlight that the restrictions to a Participant's
access to Customer and Account Attributes and Customer Identifying
Systems through programmatic access continue to apply even after a
Participant is initially approved for programmatic access. Thus, the
proposed amendments state that the Proposed Confidentiality Policies
must be reasonably designed to implement and satisfy the Customer and

Account Attributes data requirements of Section 4.1.6 of Appendix D
such that Participants must be able to demonstrate that a Participant's
ongoing use of Programmatic CAIS and/or CCID Subsystem access is in
accordance with the Customer Identifying Systems Workflow and the
restrictions noted therein. As a result of these policies, Participants
must be able to demonstrate that their ongoing use of programmatic
access continues to be in compliance with the restrictions to Customer
and Account Attributes. For example, a Participant could document the
changes to the Participant's evolving use of the programmatic access,
noting in particular how the Participant's programmatic access
continues to comply with the restrictions around access to Customer and
Account Attributes since the Commission's initial approval of the
Participant's programmatic access.\359\ In light of this requirement,
each Participant would be in a position to continually assess whether
such ongoing programmatic access adheres to the restrictions of the
Customer Identifying Systems Workflow. For example, if the
functionality of a Participant's programmatic access changed to address
a new regulatory purpose, the Participant must be able to demonstrate
that the changed functionality remains consistent with all of the
restrictions of the Customer Identifying Systems Workflow including (1)
that the ``least privileged'' practice of limiting access to Customer
Identifying Systems has been applied but that programmatic access to
achieve the new regulatory purpose is still required; (2) that
Regulatory Staff accessing Customer and Account Attributes through
programmatic access is limited to only those individuals that maintain
the appropriate regulatory role for such access; (3) that queries
submitted by Regulatory Staff using programmatic access are based on a
``need to know'' data in the Customer Identifying Systems; and (4) that
queries have been designed such that query results contain only the
Customer and Account Attributes that Regulatory Staff reasonably
believes will achieve the regulatory purpose of the inquiry or set of
inquiries. The Commission preliminarily believes that these
requirements, in conjunction with other requirements of the Proposed
Confidentiality Policies discussed above, including monitoring, usage
restriction controls and definitions of individual roles and regulatory
activities of specific users, would help restrict Manual and
Programmatic CAIS and/or CCID Subsystem Access to narrowly tailored
circumstances when initially approved by the Commission and on an
ongoing basis.
---------------------------------------------------------------------------

    \359\ The Commission generally believes that such documentation
should at minimum have the same level of detail as the initial
application material for programmatic access and should highlight
how the Participant's programmatic access has changed over time.
---------------------------------------------------------------------------

4. Approval, Publication, Review and Annual Examinations of Compliance
    Currently, Section 6.5(g) of the CAT NMS Plan requires Participants
to periodically review the effectiveness of the policies and procedures
required by Section 6.5(g), and take prompt action to remedy
deficiencies in such policies and procedures. However, the Commission
believes that the highly sensitive nature of CAT Data and the
importance of confidentiality warrants further oversight of the
Proposed Confidentiality Policies, and in particular, the Commission
believes it is appropriate to require approval of the Proposed
Confidentiality Policies; require publication of these policies;
provide specifics regarding Participant review of policies, procedures,
and usage restriction controls; and require an annual examination of
compliance with the Proposed Confidentiality Policies by independent
accountants.
    First, the Commission proposes to require that both the CISO and
CCO of the Plan Processor be required to review the Proposed
Confidentiality Policies.\360\ In addition, the Commission proposes to
require that the CCO of the Plan Processor obtain assistance and input
from the Compliance Subcommittee,\361\ and require that the policies
required by proposed Section 6.5(g)(i) of the CAT NMS Plan be subject
to review by the Operating Committee, after review by the CISO and
CCO.\362\ Currently, no specific individual is responsible for
reviewing or approving the Participant policies and procedures required
by Section 6.5(f)(ii) or 6.5(g) of the CAT NMS Plan. The Commission
preliminarily believes that these requirements will further help result
in Proposed Confidentiality Policies that are consistent with the
requirements of the CAT NMS Plan and proposed changes herein, while
providing for multiple opportunities for feedback and input while the
Proposed Confidentiality Policies are being developed. It would allow
the Plan Processor to have input in the creation of the Proposed
Confidentiality Policies and would encourage consistency with policies
and procedures created by the Plan Processor itself. The Commission
preliminarily believes that it is appropriate to require the CCO to
receive the assistance of the Compliance Subcommittee for broad input
into the process of developing the Proposed Confidentiality
Policies.\363\ The Commission believes that it is reasonable to require
the Operating Committee to review and approve the Proposed
Confidentiality Policies after review by the CCO and CISO to prevent
such policies from going into effect until these relevant parties have
had the opportunity to review and provide feedback if necessary.
Similarly, it is important for the Operating Committee, CCO and CISO to
review updates to the Proposed Confidentiality Policies, as
Participants make changes over time, because such parties can provide
feedback and identify any inconsistencies with requirements of the CAT
NMS Plan.
---------------------------------------------------------------------------

    \360\ See proposed Sections 6.2(a)(v)(R) and 6.2(b)(viii).
    \361\ See proposed Section 6.2(a)(v)(R). The CAT NMS Plan
requires the Operating Committee to maintain a compliance
Subcommittee (the ``Compliance Subcommittee'') whose purpose shall
be to aid the Chief Compliance Officer as necessary. See CAT NMS
Plan, supra note 3, at Section 4.12(b).
    \362\ See proposed Section 6.5(g)(vi). The Commission
anticipates that the Participants will provide the draft Proposed
Confidentiality Policies to the CISO and CCO sufficiently in advance
of the Operating Committee vote to permit review.
    \363\ Members of the Advisory Committee, composed of members
that are not employed by or affiliated with any Participant or any
of its affiliates or facilities, are currently on the Compliance
Subcommittee. See CAT NMS Plan, supra note 3, at Section 4.13.
---------------------------------------------------------------------------

    Second, the Commission believes that public disclosure of the
Proposed Confidentiality Policies would be beneficial to investors and
the public. Currently, the policies and procedures created by
Participants pursuant to Section 6.5(f)(ii) and (g) are not required to
be publicly disseminated. The Commission believes that public
disclosure could help encourage the Participants to thoroughly consider
the Proposed Confidentiality Policies and encourage the Participants to
create robust Proposed Confidentiality Policies because they will be
subject to public scrutiny. Thus, the Commission proposes new Section
6.5(g)(iv) which would require the Participants to make the Proposed
Confidentiality Policies publicly available on each of the
Participants' websites, or collectively on the CAT NMS Plan website,
redacted of sensitive proprietary information.\364\

The Commission also believes that such a requirement would allow other
Participants, broker-dealers, investors, and the public to better
understand and analyze the Proposed Confidentiality Policies that
govern Participant usage of and the confidentiality of CAT Data, and,
when updated by Participants, any changes to these policies. The
Commission preliminarily believes that broker-dealers and investors
that generate the order and trade activity that is reported to CAT
should be able to access the policies governing usage of CAT Data. In
addition, due to the sensitivity and importance of CAT Data, which may
contain personally identifiable information, trading strategies, and
other valuable or sensitive information, it is important for broker-
dealers, investors and the public to understand how CAT Data will be
used and confidentiality maintained by the Participants, and to know
the policies that Participants are bound to follow to protect the
confidentiality of such data. The Commission believes that this may be
particularly important for policies relating to access to Customer
Account Attributes, as well policies relating to Manual and
Programmatic CAIS and/or CCID Subsystem Access, which will allow
customer attribution of order flow. The Commission is proposing an
exception for sensitive proprietary information in the Proposed
Confidentiality Policies because certain information in the policies
required in the Proposed Confidentiality Policies may jeopardize the
security of CAT Data if publicly disclosed. However, the Commission
preliminarily does not believe that the proposed requirements for the
Proposed Confidentiality Policies would require the disclosure of any
substantial amount of sensitive proprietary information, and expects
that there would be no redactions of information specifically required
in the Proposed Confidentiality Policies, such as the identification of
the individual roles and regulatory activities of specific users. The
Commission believes that Participant-specific procedures and usage
restriction controls, that would not be required to be made public, are
more likely to contain the type of sensitive information that is
inappropriate for public disclosure.
---------------------------------------------------------------------------

    \364\ See supra note 362. As proposed, publication of the
policies could occur on either each of the Participant websites or
on the CAT NMS Plan website. The CAT NMS Plan website was created by
the Participants shortly after the adoption of Rule 613 and has been
used as a means to communicate information to the industry and the
public at large since that time. See CAT NMS Plan, supra note 3, at
Appendix C-109.
---------------------------------------------------------------------------

    Currently, the CAT NMS Plan requires Participants to periodically
review the effectiveness of the policies and procedures required by
Section 6.5(g), maintain such policies and procedures, and take prompt
action to remedy deficiencies in such policies and procedures, without
further specifics regarding how this review is to occur. The Commission
proposes changes to strengthen the review of the Proposed
Confidentiality Policies in proposed Sections 6.5(g)(i)(J), 6.5(g)(ii)
and 6.5(g)(v).
    Proposed Section 6.5(g)(i)(J) would require that the Proposed
Confidentiality Policies document monitoring and testing protocols that
will be used to assess Participant compliance with the policies (e.g.,
protocols monitoring CAT Data movement within any environment where CAT
Data is used and associated testing to determine that such protocols
are effective at identifying data leakage). In conjunction with this
provision, proposed Section 6.5(g)(ii) would require the Participant to
periodically review the effectiveness of the policies, procedures, and
usage restriction controls required by Section 6.5(g)(i), including by
using the monitoring and testing protocols documented within the
policies pursuant to Section 6.5(g)(i)(J), and taking prompt action to
remedy deficiencies in such policies, procedures and usage restriction
controls.\365\
---------------------------------------------------------------------------

    \365\ The Commission would delete existing language in current
Section 6.5(g)(i) that states: ``Each Participant shall periodically
review the effectiveness of the policies and procedures required by
this paragraph, and take prompt action to remedy deficiencies in
such policies and procedures.'' The Commission believes that this
language would be replaced and enhanced in substance by proposed
Section 6.5(g)(i)(J).
---------------------------------------------------------------------------

    The Commission believes that these requirements are appropriate and
should result in Proposed Confidentiality Policies, and Participant-
specific procedures and usage restriction controls developed pursuant
to the Proposed Confidentiality Policies, that are effective and
complied with by each Participant across all environments where CAT
Data is used. The Commission believes that review of implementation is
important since even robust confidentiality policies could be
circumvented or violated due to poor or improper implementation. Such
periodic review will also help assure broker-dealers, investors and the
public that the Participants are complying with the publicly disclosed
Proposed Confidentiality Policies and related procedures and usage
restriction controls. In addition, such review would assist
Participants in meeting their requirement to maintain the Proposed
Confidentiality Policies and related procedures and usage restriction
controls as required by proposed Section 6.5(g)(i), including updating
and revising them as appropriate.
    The Commission also proposes a new Section 6.5(g)(v) which would
require that, on an annual basis, each Participant shall engage an
independent accountant to perform an examination of compliance with the
policies required by Section 6.5(g)(i) in accordance with attestation
standards of the American Institute of Certified Public Accountants
(``AICPA'') (referred to as U.S. Generally Accepted Auditing Standards
or GAAS) or the Public Company Accounting Oversight Board (``PCAOB''),
and with Commission independence standards based on SEC Rule 2-01 of
Regulation S-X.\366\ In addition, the examination results shall be
submitted to the Commission upon completion, in a text-searchable
format (e.g. a text-searchable PDF). The examination report shall be
considered submitted to the Commission when electronically received by
an email address provided by Commission staff. The Commission
preliminarily believes that this additional oversight would help result
in such data being used solely for surveillance and regulatory
purposes.
---------------------------------------------------------------------------

    \366\ See 17 CFR 210.2-01. The Commission stresses that the
proposed change relates only to a required ``examination'' by
independent accountants, and has no relation to ``examinations''
performed by Commission staff.
---------------------------------------------------------------------------

    The Commission preliminarily believes that requiring the annual
examination to be performed by an independent accountant should result
in an examination that is performed by experienced professionals who
are subject to certain professional standards. The Commission believes
that permitting the examination to be in accordance with either the
attestation standards of the AICPA or the PCAOB should give
Participants greater flexibility in choosing an independent accountant.
The Commission preliminarily believes that either standard is
sufficient for the annual examinations to be performed adequately in
these circumstances and both are familiar to the Commission,
Participants and other market participants. The Commission believes
that the independence standard of SEC Rule 2-01 of Regulation S-X would
require Participants to engage an independent accountant that is
independent of the Participant. The Commission understands that under
the proposed requirement, Participants can likely use their existing
auditors to perform this task as long as the existing auditors meet the
independence requirements. The Commission further believes that as
proposed, Participants that are affiliated would be permitted to

use the same auditor for each affiliated entity.
    The Commission believes that it is appropriate to require that the
Participants provide the examination reports to the Commission. The
Commission believes that this will allow the Commission to review the
results of the examination, and to assess whether or not Participants
are adequately complying with the Proposed Confidentiality Policies.
The Commission believes that the examination reports should be
protected from disclosure subject to the provisions of applicable
law.\367\
---------------------------------------------------------------------------

    \367\ See, e.g., 5 U.S.C. 552 et seq.; 15 U.S.C. 78x (governing
the public availability of information obtained by the Commission).
---------------------------------------------------------------------------

    The Commission requests comment on the amendments to consolidate
and enhance Participants' data confidentiality policies and procedures.
Specifically, the Commission solicits comment on the following:
    132. Are current requirements relating to Participant data usage
and confidentiality policies and procedures in Section 6.5(f)(ii),
6.5(f)(iii), and 6.5(g) in the CAT NMS Plan sufficient to protect the
confidentiality and security of CAT Data?
    133. Are the requirements of the Proposed Confidentiality Policies
sufficiently robust to protect the confidentiality and security of CAT
Data? Would additional or fewer requirements for such policies be
beneficial?
    134. Should the Proposed Confidentiality Policies be required to
provide any other limitations on the extraction or usage of CAT Data?
Do the proposed requirements sufficiently address concerns about
policies and procedures related to the extraction and usage of CAT
Data, including Customer and Account Attributes?
    135. Should the Proposed Confidentiality Policies include specific
data security requirements to help protect the confidentiality of CAT
Data (e.g., data loss prevention controls that include data access
controls, data encryption, specific availability restrictions, and
controls on data movement for securing CAT Data within any environment
where CAT Data is used)? Should the Proposed Confidentiality Policies
require Participants to maintain a full technical audit log of all CAT
Data movement within their own environments?
    136. Should the Proposed Confidentiality Policies or the CAT NMS
Plan itself be required to define what ``surveillance and regulatory
purposes'' means?
    137. Should the Participants be required to establish, maintain,
and enforce identical written policies as proposed Section 6.5(g)(i)?
Should Participants be required to create procedures and usage
restriction controls in accordance with the Proposed Confidentiality
Policies?
    138. Should the Proposed Confidentiality Policies limit extraction
of CAT Data to the minimum amount of data necessary to achieve a
specific surveillance or regulatory purpose? Should other policies and/
or procedures regarding the extraction of CAT Data be required?
    139. Should the Proposed Confidentiality Policies do more than
define the individual roles and regulatory activities of specific
users, e.g., require documentation relating to each instance of access
of CAT Data or define both appropriate and inappropriate usages of CAT
Data?
    140. The proposed amendments define Regulatory Staff. Is the
proposed definition of Regulatory Staff appropriate and reasonable? Is
the definition too broad or too narrow? Why or why not? For example,
should the Commission limit the definition of Regulatory Staff to staff
that exclusively report to the Chief Regulatory Officer (or similarly
designated head(s) of regulation) or to persons within the Chief
Regulatory Officer's (or similarly designated head(s) of regulation's)
reporting line?
    141. Is it reasonable and appropriate to require that the Proposed
Confidentiality Policies limit access to CAT Data to Regulatory Staff
and technology and operations staff that require access solely to
facilitate access to and usage of the CAT Data by Regulatory Staff?
Should any other Participant staff be permitted access to CAT Data?
    142. The proposed amendments provide that the Proposed
Confidentiality Policies require, absent exigent circumstances, that
all Participant staff who are provided access to CAT Data must sign a
``Safeguard of Information affidavit'' and participate in the training
program developed by the Plan Processor. Is this requirement
appropriate and reasonable? Should Participants be permitted to allow
access to CAT Data by staff that have not met the affidavit and
training requirements if there are exigent circumstances? If so, how
should exigent circumstances be defined? Who should determine what are
exigent circumstances?
    143. The proposed amendments provide that the Proposed
Confidentiality Policies shall provide for only one limited exception
for access to CAT Data by non-Regulatory Staff (other than technology
and operations staff as provided for in Section 6.5(g)(i)(B)), namely a
``specific regulatory need for access.'' Is this exception clearly
defined and easily understood? Is this exception too broad or too
narrow? Should non-Regulatory Staff be permitted access to CAT Data in
any other circumstance? Should non-Regulatory Staff be required to
obtain written approval from a Participant's CRO for each instance of
access to CAT Data? Should there be other requirements for non-
Regulatory Staff to access CAT Data? Would this proposed requirement
restrict the ability of certain non-Regulatory Staff, such as Chief
Executive Officers, from carrying out their oversight over regulatory
matters?
    144. Is it appropriate and reasonable to require the Chief
Information Security Officer of the Plan Processor, in collaboration
with the Chief Compliance Officer of the Plan Processor, to review the
Proposed Confidentiality Policies? Is it appropriate and reasonable to
require the Operating Committee to approve the Proposed Confidentiality
Policies? Should other individuals, entities, or the Commission be
responsible for reviewing and/or approving these policies and
procedures? Should such review and/or approval be subject to objective
or subjective criteria, or explicit standards? If so, what should those
criteria or standards be?
    145. Are the proposed requirements for policies relating to
Customer and Account Attributes, and CAIS and CCID Subsystem access,
specifically proposed Section 6.5(g)(i)(I), appropriate and reasonable?
Should other requirements relating to access or usage of Customer and
Account Attributes be required? Is it appropriate and reasonable to
have policy provisions that apply only to Customer and Account
Attributes data instead of CAT Data more broadly?
    146. Is it appropriate and reasonable to require that the
Participants engage an independent accountant to examine on an annual
basis each Participant's compliance with the policies required by
proposed Section 6.5(g)(i)? Are the proposed attestation and
independence standards appropriate?
    147. Is it appropriate and reasonable to require that the Proposed
Confidentiality Policies document monitoring and testing protocols that
will be used to assess Participant compliance with the policies? Should
additional specificity be added regarding the monitoring and testing
requirements, such as requiring that these requirements include
specific data loss prevention controls? Is it

appropriate and reasonable to require that Participants periodically
review the effectiveness of the policies and procedures and usage
restriction controls required by Section 6.5(g)(i)? Should more or
fewer requirements regarding review of Participant compliance with the
Proposed Confidentiality Policies or related procedures and/or usage
restrictions be implemented?
    148. Is it appropriate and reasonable to require that the Proposed
Confidentiality Policies be made public? Is it appropriate and
reasonable to provide that Participants have no obligation to disclose
sensitive information? Should Participants be permitted to withhold any
other type of information? Should the policies be published or made
public in a form different than publication on the CAT NMS Plan
website?

H. Regulator & Plan Processor Access

1. Regulatory Use of CAT Data
    As noted earlier, Rule 613 and the CAT NMS Plan already limits the
use of CAT Data to solely surveillance and regulatory purposes.\368\
The CAT NMS Plan also provides that the Plan Processor must provide
Participants' regulatory staff and the Commission with access to CAT
Data for regulatory purposes only.\369\ Examples of functions for which
Participants' regulatory staff and the SEC could use CAT Data include
economic analysis, market structure analyses, market surveillance,
investigations, and examinations.\370\ The Commission has received
letters stating that ``surveillance and regulatory purposes'' is too
broad and vague a limit on the use of CAT Data and should be clarified
to prohibit SROs from using CAT Data for any commercial purpose.\371\
The Commission believes that it is important that CAT Data be used only
for surveillance and regulatory purposes. The Commission also believes
it is important to prohibit Participants from using CAT Data in
situations where use of CAT Data may serve both a surveillance or
regulatory purpose, and commercial purpose, and, more specifically
prohibit use of CAT Data for economic analyses or market structure
analyses in support of rule filings submitted to the Commission
pursuant to Section 19(b) of the Exchange Act (``SRO rule filings'') in
these instances.
---------------------------------------------------------------------------

    \368\ See, e.g., Rule 613(e)(4)(i)(A) and CAT NMS Plan, supra
note 3, at Section 6.5(f)(i)(A), 6.5(g). However, a Participant may
use data that it reports to the Central Repository for regulatory,
surveillance, commercial, or other purposes as otherwise not
prohibited by applicable law, rule or regulation. See CAT NMS Plan,
supra note 3, at Section 6.5(h).
    \369\ See CAT NMS Plan, supra note 3, at Appendix D, Section
8.1. Because this section currently only refers to ``regulatory
purposes,'' the Commission proposes to amend this section to clarify
that such access is for surveillance and regulatory purposes only,
to be consistent with Rule 613 and other sections of the CAT NMS
Plan. See, supra note 368. This change would also be consistent with
proposed changes discussed below, that would clarify the requirement
that CAT Data should be used only for surveillance and regulatory
purposes.
    \370\ Id.
    \371\ See letter dated November 11, 2019 from Kenneth E.
Bentsen, Jr., President and CEO, Securities Industry and Financial
Markets Association (``SIFMA''), to the Honorable Jay Clayton,
Chairman, Commission (``[t]he Commission should clarify the meaning
of the term `surveillance and regulatory purposes' . . . . In doing
so, the Commission should ensure that the SROs will be clearly
prohibited from using CAT Data for any commercial purpose''); letter
dated December 16, 2019 from Ronald Newman, National Political
Director, and Kate Ruane, Senior Legislative Counsel, American Civil
Liberties Union, to the Honorable Jay Clayton, Chairman, Commission
(``[t]his standard is far too broad and vague to assure that the
data will only be acquired and used for specific and legitimate
enforcement purposes. The SEC should provide a clearly defined
standard that must be met in order to access and use information in
the CAT and should specifically prohibit those with access from
using the information for any commercial purpose'').
---------------------------------------------------------------------------

    The Commission proposes to amend Section 8.1 of Appendix D to add
to the requirement that access to CAT Data would be only for
surveillance and regulatory purposes that the access should be
consistent with Proposed Confidentiality Policies as set forth in
Section 6.5(g) of the CAT NMS Plan. The Commission also proposes to
amend Section 8.1 of Appendix D to specify that Regulatory Staff and
the SEC must be performing regulatory functions when using CAT Data,
including for economic analyses, market structure analyses, market
surveillance, investigations, and examinations, and may not use CAT
Data in such cases where use of CAT Data may serve both a surveillance
or regulatory purpose, and a commercial purpose. The Commission further
proposes that in any case where the use of CAT Data may serve both a
surveillance or regulatory purpose and a commercial purpose, such as
economic analyses or market structure analyses in support of SRO rule
filings with both a regulatory and commercial purpose, use of CAT Data
is not permitted. This would be consistent with the existing
requirement in Rule 613 the CAT NMS Plan that CAT Data must be used for
solely regulatory and surveillance purposes.\372\
---------------------------------------------------------------------------

    \372\ See 17 CFR 242.613(e)(4)(i)(A); CAT NMS Plan, supra note
3, Sections 6.5(c) and 6.5(g). Because the CAT NMS Plan requires CAT
Data to be used for solely regulatory or surveillance purposes,
Participants may not use CAT Data for any economic analyses or
market structure analyses that do not have a solely regulatory or
surveillance purpose.
---------------------------------------------------------------------------

    The Commission preliminarily believes that the proposed amendments
to Section 8.1 of Appendix D are appropriate because adding the
requirement that surveillance and regulatory purposes be consistent
with the Proposed Confidentiality Policies would establish a minimum
standard for what constitutes regulatory use of CAT Data that is
identical across the Participants. It would additionally help protect
the security of CAT Data by limiting the extraction of CAT Data to, as
proposed, the minimum amount of data necessary to achieve a specific
surveillance or regulatory purpose. The Commission's proposed
amendments concerning the functions for which CAT Data can be used
reiterate that the CAT Data may only be used for solely surveillance
and regulatory purposes.
    The Commission believes that prohibiting the use of CAT Data for
SRO rule filings with a regulatory and commercial purpose is important
because exchange groups are no longer structured as mutual
organizations that are owned, for the most part, by SRO members. Today,
nearly all exchange SROs are part of publicly-traded exchange groups
that are not owned by the SRO members, and, among other things, compete
with broker-dealers and each other for market share and order
flow.\373\ CAT Data includes data submitted by the SROs and broker-
dealers.\374\ The Commission believes that SROs may want to use CAT
Data for legitimate surveillance and regulatory purposes in conjunction
with an SRO rule filing, but many exchange SRO rule filings have at
least some commercial component. For example, CAT Data could be used to
determine whether or not a particular order type is working as intended
or if changes would be beneficial to market participants--however,
exchange SROs compete for order flow by offering different types and
variations of order types, therefore potential SRO rule filings in this
context would not be solely related to surveillance or regulation.
Prohibiting the use of CAT Data for such a rule change is consistent
with the existing

requirement that CAT Data must be used for solely regulatory and
surveillance purposes,\375\ and the proposed amendments make clear that
this restriction on the usage of CAT Data applies to SRO rule filings
that do not have solely regulatory or surveillance purposes.\376\
However, this prohibition would not restrict an SRO's ability to use
CAT Data for SRO rule filings with a solely surveillance or regulatory
purpose, such as monitoring for market manipulation or compliance with
sales practice rules.\377\
---------------------------------------------------------------------------

    \373\ See Securities Exchange Act Release No. 50699 (Nov. 18,
2004), 69 FR 71125, 71132 (Dec. 8, 2004) (noting that SROs had been
challenged by the trend to demutualize and that the ``impact of
demutualization is the creation of another SRO constituency--a
dispersed group of public shareholders--with a natural tendency to
promote business interests'').
    \374\ SROs compete for order flow with off exchange venues,
including alternative trading systems (which also match buyers and
sellers but are subject to a different regulatory framework and in
many cases do not display pricing information to the general public)
and other liquidity providers (e.g., broker-dealer internalizers).
    \375\ See supra note 368.
    \376\ The Commission preliminarily believes that this is
consistent with the Participants' understanding of the CAT NMS Plan,
and notes that the current CAT Reporter Agreement, which is between
the Plan Processor and CAT Reporters, states that the signing
parties acknowledge that the Consolidated Audit Trail, LLC, the
Participants, and the Plan Processor ``are not authorized by the CAT
NMS Plan to use the submitted CAT Data for commercial purposes[.]''
See ``Consolidated Audit Trail Reporter Agreement,'' available at:
https://www.catnmsplan.com/sites/default/files/2020-05/Consolidated-Audit-Trail-Reporter-Agreement-amended_0.pdf.
    \377\ Although the Participants would be permitted to use CAT
Data to support a rule filing with a solely surveillance or
regulatory purpose, proposed Section 6.13(a)(i)(C) would permit only
the extraction of the minimum amount of CAT Data necessary to
achieve that specific regulatory purpose. However, the proposed
amendment would not prevent a Participant from using the data that
it reports to the Central Repository for regulatory, surveillance,
commercial, or other purposes as otherwise not prohibited by
applicable law, rule or regulation. See CAT NMS Plan, supra note 3,
at 6.5(h).
---------------------------------------------------------------------------

2. Access to CAT Data
    As described above, the Commission proposes to amend Appendix D,
Section 8.1 of the CAT NMS Plan to add that access to CAT Data must be
consistent with the Participants' Confidentiality Policies and
Procedures as set forth in proposed Section 6.5(g). The Commission also
continues to believe that access of Participants' Regulatory Staff and
the Commission to CAT Data must be based on an RBAC model. RBAC is a
mechanism for authentication in which users are assigned to one or many
roles, and each role is assigned a defined set of permissions.\378\ An
RBAC model specifically assigns the access and privileges of individual
CAT users based on the individual's job responsibilities and need for
access. Users would not be directly assigned specific access and
privileges but would instead receive access and privileges based on
their assigned role in the system.
---------------------------------------------------------------------------

    \378\ See CAT NMS Plan, supra note 3, at Appendix C, note 250.
---------------------------------------------------------------------------

    The CAT NMS Plan currently provides that an RBAC model ``must be
used to permission user[s] with access to different areas of the CAT
System.'' \379\ The CAT NMS Plan further requires the CAT System to
support an arbitrary number of roles with access to different types of
CAT Data, down to the attribute level.\380\ The administration and
management of roles must be documented, and Participants, the SEC, and
the Operating Committee must be provided with periodic reports
detailing the current list of authorized users and the date of their
most recent access.\381\ The Plan Processor is required to log every
instance of access to Central Repository data by users.\382\ The CAT
NMS Plan, as part of its data requirements surrounding Customer and
Account Attributes,\383\ further requires that using the RBAC model,
access to Customer and Account Attributes shall be configured at the
Customer and Account Attribute level, following the ``least
privileged'' practice of limiting access to the greatest extent
possible.
---------------------------------------------------------------------------

    \379\ See CAT NMS Plan, supra note 3, at Appendix D, Section
4.1.4. The Commission also proposed to correct certain grammatical
errors. See Appendix D, Sections 4.1.4, 8.2.2.
    \380\ The Commission proposes to amend Appendix D, Section 4.1.4
to state that the CAT System must support as many roles as required
by Participants and the Commission to permit access to different
types of CAT Data, down to the attribute level. The Commission
believes that this change clarifies what ``arbitrary number of
roles'' means in the context of the RBAC model required by the CAT
NMS Plan and should result in the implementation of an RBAC model
that will support the number of roles required by Participants and
the Commission.
    \381\ The CAT NMS Plan provides that the reports of the
Participants and the SEC will include only their respective list of
users and that the Participants must provide a response to the
report confirming that the list of users is accurate. The required
frequency of this report would be defined by the Operating
Committee. See CAT NMS Plan, supra note 3, at Appendix D, Section
4.1.4. The Commission proposes to amend the language in Appendix D,
Section 4.1.4 to make clear that the reports provided to the
Participants and the SEC will include only their respective list of
users and that the CAT NMS Plan obligates the Participants to
provide a response to the report confirming that the list of users
is accurate. The Commission believes that these changes are
consistent with existing expectations and could help avoid potential
confusion regarding obligations relating to these reports.
    \382\ Id.
    \383\ See CAT NMS Plan, supra note 3, at Appendix D, Section
4.1.6.
---------------------------------------------------------------------------

    The Commission now believes that it is important to require that
access of Participants' Regulatory Staff \384\ to all CAT Data must be
through the RBAC model, and extend the practice of requiring ``least
privileged'' access to all CAT Data, and not just to Customer and
Account Attributes. Specifically, the Commission proposes to amend
Appendix D, Section 8.1 of the CAT NMS Plan by adding that the Plan
Processor must provide Participants' Regulatory Staff and the SEC with
access to all CAT Data based on an RBAC model that follows ``least
privileged'' practices.
---------------------------------------------------------------------------

    \384\ As noted earlier, the Commission proposes to amend
Appendix D, Section 8.1 to remove references to ``regulatory staff''
and replace them with the defined term ``Regulatory Staff.'' See
supra note 342.
---------------------------------------------------------------------------

    The Commission preliminarily believes that this proposed amendment
would strengthen the requirement that, in addition to requiring a
regulatory purpose, access to CAT Data is also restricted by an RBAC
model that follows ``least privileged'' practices. The Commission
preliminarily believes that this proposed amendment would provide
consistency across the CAT NMS Plan by requiring that the RBAC and
``least privileged'' practices requirement that applies to the CAT
System and the Customer and Account Attributes also applies to
accessing CAT Data. An RBAC model and ``least privileged'' practices
requirement would provide access only to those who have a legitimate
purpose in accessing CAT Data, and limit the privileges of those users
to the minimum necessary to perform their regulatory roles and
functions.
    The Commission also proposes amendments to Appendix D, Section
4.1.4 to address the general requirements relating to access to
Customer Identifying Systems and transactional CAT Data by Plan
Processor employees and contractors. Specifically, the Commission
proposes amendments to Appendix D, Section 4.1.4 to require that
``[f]ollowing `least privileged' practices, separation of duties, and
the RBAC model for permissioning users with access to the CAT System,
all Plan Processor employees and contractors that develop and test
Customer Identifying Systems shall only develop and test with non-
production data and shall not be entitled to access production data
(i.e., Industry Member Data, Participant Data, and CAT Data) in CAIS or
the CCID Subsystem. All Plan Processor employees and contractors that
develop and test CAT Systems containing transactional CAT Data shall
use non-production data for development and testing purposes; if it is
not possible to use non-production data, such Plan Processor employees
and contractors shall use the oldest available production data that
will support the desired development and testing, subject to the
approval of the Chief Information Security Officer.'' \385\
---------------------------------------------------------------------------

    \385\ See proposed Appendix D, Section 4.1.4 (Data Access).
---------------------------------------------------------------------------

    The Commission believes that imposing the limitations on which Plan

Processor employees and contractors can access Customer Identifying
Systems is appropriate as the possibility of misuse of CAT Data exists
with those individuals as with any Regulatory Staff. Therefore it is
also appropriate to require that Plan Processor employees and
contractors accessing Customer Identifying Systems must follow ``least
privileged'' practices, separation of duties, and the RBAC model for
permissioning users with access to the CAT System. The Commission also
believes it is appropriate to limit the actual testing and development
of Customer Identifying Systems to non-production data because such
non-production data will not contain Customer and Account Attributes
and other data that could be used to identify Customers and other
market participants. With respect to transactional CAT Data, the
Commission believes that is reasonable to require that Plan Processor
employees and contractors use non-production data if possible; however,
the Commission recognizes that for practical purposes, it may be
difficult or impossible to generate non-production transactional CAT
Data sufficient for desired development and testing. As a result, Plan
Processor employees and contractors may use production data in the
testing and development of CAT Systems that contains transactional CAT
Data, but they must use the oldest available production data that will
support the desired development and testing. Given that production data
will be accessed in this specific circumstance, the Commission believes
that the Chief Information Security Officer should approve such access.
    The Commission requests comment on the proposed amendments
concerning the access of regulators and the Plan Processor to CAT Data.
Specifically, the Commission solicits comment on the following:
    149. There is existing CAT NMS Plan language stating that CAT Data
may be used solely for surveillance and regulatory purposes.\386\ Is it
necessary to further provide that the use of CAT Data is prohibited in
cases where it would serve both a regulatory or surveillance purpose,
and a commercial purpose?
---------------------------------------------------------------------------

    \386\ See supra note 368.
---------------------------------------------------------------------------

    150. The Commission proposes to prohibit the use of CAT Data in SRO
rule filings that have both a regulatory and commercial purpose. Are
there instances where it is necessary to use CAT Data in an SRO rule
filing that may have a commercial impact but is essential for
regulatory purposes? Please provide examples. If so, what should be the
conditions or process by which SROs would be permitted to use CAT Data
for SRO rule filings?
    151. Does requiring that access to CAT Data be restricted by an
RBAC model that follows ``least privileged'' practices, and adding the
requirement that access must be consistent with the Proposed
Confidentiality Policies enhance the security of CAT Data? Is adding
the requirement that access to CAT Data must be consistent with the
Proposed Confidentiality Policies necessary and appropriate? Should the
proposed amendments be more prescriptive and define potential roles
generally or specifically that would be used in an RBAC model or least
privileged access model?
    152. The proposed amendments require the Plan Processor employees
and contractors that test and develop Customer Identifying Systems to
follow ``least privileged'' practices, separation of duties, and the
RBAC model for permissioning users with access to the CAT System. Do
commenters agree that such employees and contractors should follow
these principles and practices in order to access Customer Identifying
Systems?
    153. Should Plan Processor contractors supporting the development
or operation of the CAT System be subject to certain additional access
restrictions? For example, should Plan Processor contractors be
required to access CAT system components through dedicated systems?
Should Plan Processor contractors be subject to heightened personnel
security requirements before being granted access to Customer
Identifying Systems or any component of the CAT System?
    154. The proposed amendment requires that all Plan Processor
employees and contractors that develop and test Customer Identifying
Systems shall only develop and test with non-production data and shall
not be entitled to access production data (i.e., Industry Member Data,
Participant Data, and CAT Data) in CAIS or the CCID Subsystem. Do
commenters agree that is appropriate? If data other than non-production
data should be permitted to be used, what type of data should be used
by Plan Processor employees and contractors to test and develop
Customer Identifying Systems? Please be specific in your response.
    155. The proposed amendments require that if non-production data is
not available for Plan Processor employees and contractors to develop
and test CAT Systems containing transactional CAT Data, then such
employees and contractors shall use the oldest available production
data that will support the desired development and testing. Do
commenters agree that Plan Processor employees and contractors should
be permitted to use the oldest available production data that will
support the desired development and testing?
    156. The proposed amendments require that the Chief Information
Security Officer approve access to the oldest available production data
that will support the desired development and testing for Plan
Processor employees and contractors that are testing and developing
systems that contain transactional CAT Data. Do commenters agree that
the Chief Information Security Officer should approve such access?
    157. Should additional restrictions be required to enhance
security, such as imposing U.S. citizenship requirements on all
administrators or other staff with access to the CAT System and/or the
Central Repository? Please explain the impact on the implementation and
security of the CAT including costs and benefits. Should the Commission
only apply these additional access restrictions to access the Customer
Identifying Systems and associated data?

I. Secure Connectivity & Data Storage

    The Commission proposes to amend the CAT NMS Plan to enhance the
security of connectivity to the CAT infrastructure. Currently under the
CAT NMS Plan, Appendix D, Section 4.1.1, the CAT System ``must have
encrypted internet connectivity'' and CAT Reporters must connect to the
CAT infrastructure, ``using secure methods such as private lines or
(for smaller broker-dealers) Virtual Private Network connections over
public lines.'' The Participants have stated that the CAT NMS Plan does
not require CAT Reporters to use private lines to connect to the CAT
due to cost concerns, particularly for small broker dealers.\387\
Because the CAT NMS Plan does not explicitly require private lines for
any CAT Reporters and does not differentiate between Participants and
Industry Members, the Commission now proposes to amend Section 4.1.1 of
Appendix D to codify and enhance existing secure connectivity
practices, and to differentiate between connectivity requirements for
Participants and Industry Members.
---------------------------------------------------------------------------

    \387\ See CAT NMS Plan Approval Order, supra note 3, at 84760.
---------------------------------------------------------------------------

    First, the Commission proposes to amend Section 4.1.1 of Appendix D
to require Participants to connect to CAT infrastructure using private
lines. Since

the Commission approved the CAT NMS Plan and the Participants began
implementing the CAT, the Participants have determined that they would
connect to the CAT infrastructure using private lines only. The
Commission preliminarily believes that it is appropriate for the CAT
NMS Plan to reflect a current practice which provides additional
security benefits over allowing Participants to connect to CAT
infrastructure through public lines, even if through encrypted internet
connectivity. The Commission preliminarily believes that this practice
is warranted because public lines are shared with other users,
including non-Participants, and usage of public lines could result in
increased cybersecurity risks because traffic could be intercepted or
monitored by other users. Private lines, managed by Participants
themselves, could provide more robust and reliable connectivity to CAT
infrastructure because such lines would not be shared with other users
and could be tailored to bandwidth and stability requirements
appropriate for connecting to CAT infrastructure.
    Next, the Commission proposes to amend Appendix D, Section 4.1.1 to
clarify the methods that CAT Reporters may use to connect to the CAT
infrastructure and to make the provision consistent with existing
practice. The Commission proposes to state that Industry Members must
connect to the CAT infrastructure using secure methods such as private
lines for machine-to-machine interfaces or encrypted Virtual Private
Network connections over public lines for manual web-based submissions.
``Machine-to-machine'' interfaces mean direct communications between
devices or machines, with no human interface or interaction, and in the
CAT context would generally be automated processes that can be used to
transmit large amounts of data. In contrast, manual web-based
submissions would require human interaction and input. These proposed
amendments would be consistent with existing requirements imposed by
FINRA CAT, LLC (``FINRA CAT'') regarding connectivity, which has
required that all machine-to-machine interfaces utilize private lines
and only permits the use of public lines by establishing an
authenticated, encrypted connection through the CAT Secure Reporting
Gateway.\388\
---------------------------------------------------------------------------

    \388\ See FINRA CAT Connectivity Supplement for Industry
Members, Version 1.5 (dated February 27, 2020), available at:
https://www.catnmsplan.com/sites/default/files/2020-03/FINRA_CAT_Connectivity_Supplement_for_Industry_Members_1.5.pdf. The
FINRA CAT Connectivity Supplement for Industry Members describes the
methods available for Industry Members and CAT Reporting Agents to
connect to the CAT system. The CAT Secure Reporting Gateway enables
end users with secure access to the CAT Reporter Portal via a web
browser. FINRA CAT is the Plan Processor.
---------------------------------------------------------------------------

    The Commission preliminarily believes that codifying these existing
FINRA CAT secure connectivity requirements for Industry Members is
appropriate. The Commission preliminarily believes that all machine-to-
machine interfaces, which facilitate the automated transfer of
potentially large amounts of data, should only occur on private lines
instead of public lines, and that it is only appropriate for public
lines to be used for manual web-based submissions on an encrypted
Virtual Private Network. The Commission preliminarily believes that
private lines would be more robust and capable of handling the
automated transfer of potentially large amounts of data, in comparison
to public lines, because the private lines would not be shared with
public users and the private lines could be designed to meet the
bandwidth and stability requirements necessary for CAT reporting. In
addition, as noted above, the Commission preliminarily believes that
private lines are more secure than public lines, which may be shared
with other users. However, the Commission believes that for manual web-
based submissions, it is appropriate to codify FINRA CAT's existing
secure connectivity framework, which allows broker-dealers that do not
need or use machine-to-machine connectivity to submit data to CAT using
the CAT Secure Reporting Gateway.\389\ The Commission preliminarily
believes that such an allowance is appropriate for Industry Members
that can meet their reporting obligations through manual web-based
submissions that do not contain an amount of data that justifies the
expense and effort required to install and maintain private lines.
Requiring manual web-based submissions to be submitted in an encrypted
Virtual Private Network should result in submissions that remain
secure, even if transmitted over public lines.
---------------------------------------------------------------------------

    \389\ See id.
---------------------------------------------------------------------------

    The Commission is also proposing to add specific requirements
relating to connections to CAT infrastructure, specifically, to amend
Appendix D, Section 4.1.1 to require ``allow listing.'' Specifically,
the Commission proposes to require that for all connections to CAT
infrastructure, the Plan Processor must implement capabilities to allow
access (i.e., ``allow list'') only to those countries where CAT
reporting or regulatory use is both necessary and expected. In
addition, proposed Appendix D, Section 4.1.1 would require, where
possible, more granular ``allow listing'' to be implemented (e.g., by
IP address). Lastly, the Plan Processor would be required to establish
policies and procedures to allow access if the source location for a
particular instance of access cannot be determined technologically.
    The Commission preliminarily believes that while this control will
not eliminate threats pertaining to potential unauthorized access to
the CAT system, this proposed requirement would enhance the security of
CAT infrastructure and connections to the CAT infrastructure. While the
CAT NMS Plan currently specifies certain connectivity requirements, it
does not require the Plan Processor to limit access to the CAT
infrastructure based on an authorized end user's location. The
Commission preliminarily believes that it is not generally appropriate
for CAT Reporters or Participants to access the CAT System in countries
where regulatory use is not both necessary and expected. As proposed,
CAT Reporters or Participants would need to justify to the Participants
and the Plan Processor the addition of a new country to the ``allow
list.'' The Commission further believes that the Plan Processor has a
detailed understanding of both authorized users and their
organization's IP address information and has the ability to restrict
access accordingly. The Commission also preliminarily believes that the
burden of maintaining an allowed list may be minimized by using the
same set of allowed countries for both CAT Reporters and regulatory
user access.
    In cases where it is not possible to use multi-factor
authentication technology to determine the location of a CAT Reporter
or a regulatory user, the Commission preliminarily believes that a
policies and procedures approach to compliance is appropriate. The
proposed amendments would allow the Plan Processor to allow access in
such circumstances under established policies and procedures that would
improve the security of the CAT System. Similarly, when using bypass
codes, the policies and procedures could mandate that Help Desk staff
facilitating such access ask relevant questions on the location of the
CAT Reporter or Regulatory Staff and remind them of CAT access geo-
restrictions. Based on its experience during the implementation of CAT,
the Commission believes that it is likely that the usage of bypass
codes will be minimal compared to standard multi-factor authentication
push technology or other technologies that allow for geo-

restrictions, and preliminarily believes that policies and procedures
applicable to such circumstances would help protect the security of CAT
Data.
    The Commission recognizes that it may not always be possible to
accurately detect the location of a CAT Reporter or Regulatory Staff
given distributed networking, and that there is a potential for
malicious spoofing of location or IP addresses. As discussed above, in
situations where a CAT Reporter or Regulatory Staff is unable to be
located, the proposed policies and procedures could address whether or
not connectivity is possible and address how such connectivity is
granted. With regard to malicious spoofing by third parties, the
Commission preliminarily believes that existing protections, such as
the private line connectivity described above, should help result in a
framework where only authorized CAT Reporters or Regulatory Staff are
able to connect to CAT infrastructure. In addition, in spite of these
potential issues, the Commission believes that in comparison to
existing requirements, the benefits of ``allow listing,'' and in
particular identifying specific known access points such as specific
countries and IP addresses, would enhance the security of connectivity
to the CAT while not being substantially difficult to implement in
available technologies.
    Currently, the CAT NMS Plan imposes requirements on data centers
housing CAT Systems (whether public or private), but does not impose
any geographical restrictions or guidelines.\390\ The Commission now
believes it is appropriate the enhance requirements applicable to data
centers housing CAT Systems by imposing geographic restrictions.
Specifically, the Commission proposes to amend Appendix D, Section
4.1.3 to require that data centers housing CAT Systems (whether public
or private) must be physically located in the United States.
---------------------------------------------------------------------------

    \390\ See CAT NMS Plan, supra note 3, Appendix D, Section 4.1.3.
While the CAT NMS Plan does not impose geographical restrictions on
CAT Systems, Regulation SCI, which applies to the Central
Repository, see supra note 54, requires SCI entities to establish,
maintain, and enforce written policies and procedures that, among
other things, shall include business continuity and disaster
recovery plans that include maintaining backup and recovery
capabilities sufficiently resilient and geographically diverse and
that are reasonably designed to achieve two-hour resumption of
critical SCI systems following a wide-scale disruption. See 17 CFR
242.1001(a)(2)(v).
---------------------------------------------------------------------------

    The Commission preliminarily believes that requiring CAT data
centers to be physically located in the United States will help
strengthen the security of CAT Data by ensuring that no data center
housing CAT Systems with CAT Data is located outside of the United
States. Locating data centers housing the CAT System outside of the
United States could subject such data centers, and the CAT System and
CAT Data within, to security risks that may arise only because of their
location. The Commission also preliminarily believes that requiring CAT
data centers to be physically located in the United States would result
in CAT data centers that are within the jurisdiction of both the
Commission and the United States legal system. The Commission also
preliminarily believes that any benefit, such as any cost advantages,
of locating data centers housing the CAT System outside of the United
States would not justify the increased risks associated with locating
the data centers outside of the United States.
    158. Should the current secure connectivity practices in place for
the Participants to connect to the CAT infrastructure using only
private lines be codified in the CAT NMS Plan?
    159. Is it appropriate to clarify when private line and Virtual
Private Network connections should be used?
    160. Should the CAT NMS Plan be amended to require the Plan
Processor to allow access based on countries and where possible, based
on IP addresses? Is it too restrictive or should the restriction be
more granular? Should the CAT NMS Plan specify which countries are or
are not acceptable to be allowed access or provide specific guidance or
standards on how the Plan Participant can select countries to be
allowed access? Do CAT Reporters have business or regulatory staff or
operations in countries outside of the United States? Should
Participant access be restricted to specific countries, e.g., the
United States, Five Eyes? If so, which countries and why? Should Plan
Processor access be restricted to specific countries, e.g., the United
States, Five Eyes? If so, which countries and why?
    161. Is it appropriate to require the Plan Processor to establish
policies and procedures governing access when the location of a CAT
Reporter or Regulatory Staff cannot be determined technologically? Do
commenters believe that such a provision is necessary, or would it be
more appropriate for the CAT NMS Plan to prohibit access if the
location of a CAT Reporter or Regulatory Staff cannot be determined
technologically?
    162. Should the CAT NMS Plan specifically prescribe what types of
multi-factor authentication are permissible? Should the CAT NMS Plan
prohibit the usage of certain methods of multi-factor authentication,
such as usage of one-time passcodes?
    163. Should the CAT NMS Plan require data centers housing CAT
Systems (whether public or private) to be physically located within the
United States? Would it be appropriate to locate data centers housing
CAT Systems in any foreign countries?
    164. Currently, the CAT NMS Plan states that the CAT databases must
be deployed within the network infrastructure so that they are not
directly accessible from external end-user networks. If public cloud
infrastructures are used, virtual private networking and firewalls/
access control lists or equivalent controls such as private network
segments or private tenant segmentation must be used to isolate CAT
Data from unauthenticated public access. Should additional isolation
requirements be added to the CAT NMS Plan to increase system
protection? For example, should the Commission require that the CAT
System use dedicated cloud hosts that are physically isolated from a
hardware perspective? Please explain the impact on the implementation
of the CAT including costs and benefits.
    165. Should the use of multiple dedicated hosts be required so that
development is physically isolated from production? Should all
development and production be done on a separate dedicated host or
should only Customer Identifying Systems development and/or production
be done on its own dedicated cloud host? Please explain the impact on
the implementation and security of the CAT including costs and
benefits.

J. Breach Management Policies and Procedures

    Appendix D, Section 4.1.5 of the CAT NMS Plan requires the Plan
Processor to develop policies and procedures governing its responses to
systems or data breaches, including a formal cyber incident response
plan and documentation of all information relevant to breaches.\391\
The CAT NMS Plan further specifies that the cyber incident response
plan will provide guidance and direction during security incidents, but
otherwise states that the cyber incident response plan may include
several items.\392\ The Commission believes that due to the importance
of the security of CAT Data and the CAT System, and the potential

for serious harm should a system or data breach (e.g., any unauthorized
entry into the CAT System or indirect SCI systems) \393\ occur, that
more specific requirements for the formal cyber incident response plan
required by Appendix D, Section 4.1.5 of the CAT NMS Plan would be
beneficial.\394\ Specifically, as discussed below, the Commission
believes that requiring the formal cyber incident response plan to
incorporate corrective actions and breach notifications, modeled after
similar provisions in Regulation SCI, is appropriate.
---------------------------------------------------------------------------

    \391\ See CAT NMS Plan, supra note 3, at Appendix D, Section
4.1.5. The cyber incident response plan is subject to review by the
Operating Committee. See id.
    \392\ See CAT NMS Plan, supra note 3, at Appendix D, Section
4.1.5. The CAT NMS Plan also lists a series of items that
documentation of information relevant to breaches should include.
Id.
    \393\ ``Indirect SCI systems'' are defined as ``any systems of,
or operated by or on behalf of, an SCI entity that, if breached,
would be reasonably likely to pose a security threat to SCI
systems.'' 17 CFR 242.1000.
    \394\ The Commission adopted Regulation SCI in November 2014 to
strengthen the technology infrastructure of the U.S. securities
markets. See Securities Exchange Act Release No. 73639 (November 19,
2014), 79 FR 72251 (December 5, 2014). Regulation SCI is designed to
reduce the occurrence of systems issues in the U.S. securities
markets, improve resiliency when systems problems occur, and enhance
the Commission's oversight of securities market technology
infrastructure. Regulation SCI applies to certain core technology
systems (``SCI systems'') of key market participants called ``SCI
entities'' which include, among others, the Participants. The CAT
System is an SCI system of the Participants. Regulation SCI imposes
corrective action and breach management obligations on SCI entities,
but also includes requirements for SCI entities to, among other
things: Establish, maintain, and enforce written policies and
procedures reasonably designed to ensure that their key automated
systems have levels of capacity, integrity, resiliency,
availability, and security adequate to maintain their operational
capability and promote the maintenance of fair and orderly markets;
operate such systems in accordance with the Exchange Act and the
rules and regulations thereunder and the entities' rules and
governing documents, as applicable; provide certain notifications
and reports to the Commission regarding systems problems and systems
changes; inform members and participants about systems issues;
conduct business continuity and disaster recovery testing and
penetration testing; conduct annual reviews of their automated
systems; and make and keep certain books and records.
    The Commission notes that the proposed changes to Appendix D,
Section 4.1.5, would apply separately and independently to the
Participants, but would not in any way increase, reduce or otherwise
change the Plan Processor and Participants' responsibilities
applicable under Regulation SCI.
---------------------------------------------------------------------------

    The Commission believes that the cyber incident response plan
should require the Plan Processor to take appropriate corrective action
in response to any data security or breach (e.g., any unauthorized
entry into the CAT System or indirect SCI systems). Specifically, the
Commission proposes to modify Appendix D, Section 4.1.5 of the CAT NMS
Plan to require that the formal cyber incident response plan must
include ``taking appropriate corrective action that includes, at a
minimum, mitigating potential harm to investors and market integrity,
and devoting adequate resources to remedy the systems or data breach as
soon as reasonably practicable.'' This language relating to taking
corrective action and devoting adequate resources mirrors the similar
requirement applicable to SCI entities for SCI events \395\ in Rule
1002(a) of Regulation SCI.\396\ This requirement would obligate the
Plan Processor to respond to systems or data breaches with appropriate
steps necessary to remedy each systems or data breach and mitigate the
negative effects of the breach, if any, on market participants and the
securities markets more broadly.\397\ The specific steps that the Plan
Processor would need to take to mitigate the harm will be dependent on
the particular systems or data breach, its causes, and the estimated
impact of the breach, among other factors. To the extent that a systems
or data breach affects not only just the users of the CAT System, but
the market as a whole, the Plan Processor would need to consider how it
might mitigate any potential harm to the overall market to help protect
market integrity. In requiring ``appropriate'' corrective action, this
provision would not prescribe with specificity the types of corrective
action that must be taken, but instead would afford flexibility to the
Plan Processor in determining how to best respond to a particular
systems or data breach in order to remedy the issue and mitigate the
resulting harm after the issue has already occurred.\398\ In addition,
as with Rule 1002(a) of Regulation SCI, the proposed provision does not
require ``immediate'' corrective action, but instead would require that
corrective action be taken ``as soon as reasonably practicable,'' which
would allow for appropriate time for the Plan Processor to perform an
initial analysis and preliminary investigation into a potential systems
or data breach before beginning to take corrective action.
---------------------------------------------------------------------------

    \395\ An ``SCI event'' is an event at an SCI entity that
constitutes a system disruption, a systems compliance issue, or a
systems intrusion. A ``systems disruption'' means an event in an SCI
entity's SCI systems that disrupts, or significantly degrades, the
normal operation of an SCI system. A ``systems compliance issue''
means ``an event at an SCI entity that has caused any SCI system of
such entity to operate in a manner that does not comply with the Act
and the rules and regulations thereunder or the entity's rules or
governing documents, as applicable.'' A ``systems intrusion'' means
any unauthorized entry into the SCI systems or indirect SCI systems
of an SCI entity.'' See Rule 1000 of Regulation SCI, 17 CFR
242.1000.
    \396\ See Rule 1002(a) of Regulation SCI, 17 CFR 242.1002(a).
    \397\ The CAT NMS Plan already requires the Plan Processor to
develop policies and procedures that include ``documentation of all
information relevant to breaches,'' which ``should include,'' among
other things, a chronological timeline of events, relevant
information related to the breach, response efforts and the impact
of the breach. See CAT NMS Plan, supra note 3, at Appendix D,
Section 4.1.5. In addition, to the extent that a systems or data
breach meets the definition of an SCI Event, see supra note 395,
Regulation SCI would require written notification to the Commission
that includes, among other things: (i) The SCI entity's assessment
of the impact of the SCI event on the market; (ii) the steps the SCI
entity has taken, is taking, or plans to take with respect to the
SCI event; (iii) the time the SCI event was resolved; (iv) the SCI
entity's rule(s) and or governing document(s), as applicable, that
relate to the SCI event; and (v) any other pertinent information
known by the SCI entity about the SCI event. See
242.1002(b)(4)(ii)(A).
    \398\ For example, appropriate corrective action to a CAT Data
breach could include the rotation of CCIDs, to limit the potential
harm of inadvertent disclosure of CCIDs. See also Regulation SCI
Adopting Release, supra note 54, at 72307-08.
---------------------------------------------------------------------------

    In addition, the Commission believes that the Plan Processor should
be required to provide breach notifications of systems or data
breaches, and that such notifications should be incorporated into the
formal cyber incident response plan. Specifically, the Commission
proposes to modify Appendix D, Section 4.1.5 of the CAT NMS Plan to
require the Plan Processor to provide breach notifications of systems
or data breaches to CAT Reporters that it reasonably estimates may have
been affected, as well as to the Participants and the Commission,
promptly after any responsible Plan Processor personnel have a
reasonable basis to conclude that a systems or data breach has
occurred.\399\ The Commission also proposes to require that the cyber
incident response plan provide for breach notifications. As proposed,
such breach notifications could be delayed, as described in greater
detail below, if the Plan Processor determines that dissemination of
such information would likely compromise the security of the CAT System
or an investigation of the systems or data breach, and would not be
required if the Plan Processor reasonably estimates the systems or data
breach would have no or a de minimis impact on the Plan Processor's
operations or on market participants.
---------------------------------------------------------------------------

    \399\ CAT Reporter means each national securities exchange,
national securities association, and Industry Member that is
required to record and report information to the Central Repository
pursuant to SEC Rule 613(c). See CAT NMS Plan supra note 3, Section
1.1.
---------------------------------------------------------------------------

    The Commission believes that in the case of systems or data
breaches, impacted parties should receive notifications, including CAT
Reporters affected by the systems or data breaches, such as the SROs or
Industry Members, as well as the Participants and Commission, which use
the CAT System for regulatory and surveillance purposes. The Commission
notes that these breach notifications could

potentially allow affected CAT Reporters, the Participants, and the
Commission to proactively respond to the information in a way to
mitigate any potential harm to themselves, customers, investors, and
the public. The Commission preliminarily believes that requiring breach
notifications promptly after any responsible Plan Processor personnel
have a reasonable basis to conclude that a systems or data breach has
occurred should result in breach notifications that are not delayed for
inappropriate reasons once the conclusion that a systems or data breach
has occurred is made, but the proposed requirement would not require
breach notifications to be prematurely released before Plan Processor
personnel have adequate time to investigate potential systems or data
breaches and consider whether or not such dissemination would likely
compromise the security of the CAT System or an investigation of the
systems or data breach.
    Pursuant to proposed Appendix D, Section 4.1.5 of the CAT NMS Plan,