The Commission requests comment on all aspects of the foregoing
analysis of the benefits and costs of the requirements to provide
immediate notification and subsequent reporting of significant
cybersecurity incidents. Commenters are requested to provide empirical
data in support of any arguments or analyses. In addition, the
Commission is requesting comment on the following matters:
    16. Please provide views on the benefits and costs associated with
posting the public disclosures on Covered Entities' websites and
submitting them to the Commission through EDGAR. Will the general
nature of the public disclosure be useful to Market Entities as well as
customers, counterparties, members, participants, and users? Should the
Commission require Covered Entities to both post cybersecurity risk and
incident histories on Covered Entity websites and file that information
on Part II of proposed Form SCIR in EDGAR? Should the Commission exempt
some subset(s) of Covered Entities from the requirement to file Part II
of proposed Form SCIR in EDGAR? If so, please explain. Should the
Commission exempt some subset(s) of Covered Entities from the
requirement to post cybersecurity risk and incident history information
on their websites? Explain.
    17. Are the cost estimates associated with posting the public
disclosure on the Covered Entities' websites, submitting Part II of
proposed Form SCIR to the Commission through EDGAR, and providing
disclosures to new and existing customers reasonable? If not, explain
why? Are there any other benefits and costs of these proposed
requirements? If so, please describe them.
    18. Are there any other costs and benefits associated with
requiring Covered Entities to file Part II of proposed Form SCIR using
a structured data language? If so, please describe them. Should the
Commission require Covered Entities to file Part II of proposed Form
SCIR using a structured data language, such as a custom XML? Should the
Commission require Covered Entities to file Part II of proposed Form
SCIR using a different structured data language than a custom XML, such
as Inline XBRL? Why or why not?
    19. Are there any Covered Entities for whom the proposed structured
data requirements of Part II of proposed Form SCIR should be exempted?
If so, what particular exemption threshold or thresholds should the
Commission use for the structured data requirements under the proposed
rule amendments, and why?
    20. Please provide views on the benefits and costs associated with
requiring Covered Entities to identify themselves on Part II of
proposed Form SCIR with both a CIK number and a UIC (such as an LEI)?
What would be the benefits and costs of requiring Covered Entities
without a UIC to obtain one in order to file Part II of proposed Form
SCIR? What, if any, standard identifiers should the Commission require
Covered Entities to use to identify themselves on Part II of proposed
Form SCIR?
    21. What would be the benefits and costs of requiring Covered
Entities to place the required cybersecurity risk and incident history
disclosures on individual Covered Entity websites and in EDGAR with
Part II of proposed Form SCIR relative to the alternatives discussed
below in section IV.F. of this release? Should the Commission instead
adopt one of the alternatives for the requirements around where Covered
Entities must place the public cybersecurity disclosures? Specifically,
the Commission is proposing to require Covered Entities to publish the
disclosures on their individual firm websites and to file the
information in EDGAR using Part II of proposed Form SCIR. Should the
Commission eliminate one, or both, of those requirements?
    22. Are there any Covered Entities for whom the proposed structured
data requirements for Part II of proposed Form SCIR should be exempted?
If so, what particular exemption threshold or thresholds should the
Commission use for the structured data requirements under the proposed
rule amendments, and why?
5. Record Preservation and Maintenance by Covered Entities
    As discussed above, proposed Rule 10 would require a Covered Entity
to: (1) establish, maintain, and enforce written policies and
procedures that are reasonably designed to address cybersecurity risks;
(2) create written documentation of risk assessments; (3) create
written documentation of any cybersecurity incident, including its
response to and recovery from the incident; (4) prepare a written
report each year describing its annual review of its policies and
procedures to address cybersecurity risks; (5) provide immediate
written notice of a significant cybersecurity incident; (6) report a
significant cybersecurity incident on Part I of proposed Form SCIR; and
(7) provide a written disclosure containing a summary description of
its cybersecurity risk and significant cybersecurity incidents on Part
II of proposed Form SCIR. Consequently, proposed Rule 10 would require
a Covered Entity to create several different types of records, but it
would not include its own record preservation and maintenance
provisions. Instead, these requirements would be imposed through
amendments, as necessary, to the existing record preservation and
maintenance rules applicable to the Covered Entities. In particular,
the Commission is proposing to amend the record preservation and
maintenance rules for: (1) broker-dealers (i.e., Rule 17a-4); (2) SBS
Entities (i.e., Rule 18a-6); and (3) transfer agents (i.e., Rule 17ad-
7). The proposed amendments would specify that the Rule 10 Records must
be retained for three years. In the case of the written policies and
procedures to address cybersecurity risks, the record would need to be
maintained until three years after the termination of the use of the
policies and procedures.
    The existing record maintenance and preservation rule applicable to
registered clearing agencies, the MSRB, national securities
associations, and

national securities exchanges (i.e., Rule 17a-1) requires these
categories of Covered Entities keep and preserve at least one copy of
all documents, including all correspondence, memoranda, papers, books,
notices, accounts, and other such records as shall be made or received
by the Covered Entity in the course of its business as such and in the
conduct of its self-regulatory activity. Under the existing provisions
of Rule 17a-1, registered clearing agencies, the MSRB, national
securities associations, and national securities exchanges would be
required to preserve at least one copy of the Rule 10 Records for at
least five years, with the first two years in an easily accessible
place. Similarly, the existing record maintenance and preservation rule
applicable to SBSDRs (i.e., Rule 13n-7) requires these Market Entities
to preserve records. And with respect to exempt clearing agencies, the
Commission is proposing to amend the clearing agency exemption orders
to add a condition that each exempt clearing agency must retain the
Rule 10 Records for a period of at least five years after the record is
made or, in the case of the written policies and procedures to address
cybersecurity risks, for at least five years after the termination of
the use of the policies and procedures.
a. Benefits
    There would be a number of benefits for Covered Entities to
preserving and maintaining the Rule 10 records. With respect to
cybersecurity policies and procedures and the written documentation
concerning risk assessments and any cybersecurity incidents, the
Covered Entity's records could be reviewed for compliance purposes as
well as a reference in future self-conducted audits of the Covered
Entity's cybersecurity system. In addition, the written report each
year describing the Covered Entity's annual review of its policies and
procedures could be used to determine if the Covered Entity's
cybersecurity risk management program is working as expected and to see
if any changes should be made. Lastly, maintaining records of
compliance would assist the Commission in its oversight role,
particularly when conducting examinations of Covered Entities. With
respect to the immediate written notice of a significant cybersecurity
incident, as well as any submitted Part I of proposed Form SCIR, the
records would facilitate examination of Covered Entities for compliance
with proposed Rule 10.
    Finally, with respect to the public disclosures that Covered
Entities would make on Part II of proposed Form SCIR, keeping records
of these forms and submissions would be beneficial to Covered Entities
for compliance purposes as well as use as a reference when updating the
public disclosure. For example, a Covered Entity would need to file an
updated Part II of proposed Form SCIR if the information in the summary
description of a significant cybersecurity incident included on the
form is no longer within the look-back period (i.e., the current or
previous calendar year). However, the retention period for the records
(e.g., three years in the case of broker-dealers, SBS Entities, and
transfer agents, or five years in the case of registered clearing
agencies, the MSRB, national securities associations, national
securities exchanges, SBSDRs, and certain exempt clearing agencies)
would require the Covered Entity to maintain a record of that
particular public disclosure for a longer period of time.
    Benefits also arise due to the Commission's regulation and
oversight of Covered Entities with respect to their books and
records.\862\
---------------------------------------------------------------------------

    \862\ The Commission also would retain copies of Parts I and II
of proposed Form SCIR filed through EDGAR.
---------------------------------------------------------------------------

b. Costs
    The costs associated with preserving the Covered Entity's
cybersecurity policies and procedures and annual review are likely to
be small. The cost would result from the requirement to preserve the
Rule 10 Records for either three or five years. Given that the
incremental volume of records that each Covered Entity would be
required to retain would be relatively small, the costs should be
minimal. Moreover, Covered Entities subject to other record retention
requirements likely already have a system in place to maintain those
records. Therefore, adding the records associated with proposed Rule 10
likely would be a small burden.
    To estimate the costs associated for a Covered Entity to comply
with its recordkeeping maintenance and preservation requirement, the
Commission considered the initial and ongoing compliance costs.\863\
The internal annual cost for this requirement is estimated to be $441
per Covered Entity, and $877,149 in total. These costs include a
blended rate of $73.50 for a general clerk and compliance clerk for a
total of 6 hours. It is estimated that there will be $0 annual external
cost for the recordkeeping maintenance and preservation requirement.
---------------------------------------------------------------------------

    \863\ See section V of this release (discussing these costs in
more detail).
---------------------------------------------------------------------------

c. Request for Comment
    The Commission requests comment on all aspects of the foregoing
analysis of the benefits and costs of the proposed record preservation
and maintenance requirements. Commenters are requested to provide
empirical data in support of any arguments or analyses. In addition,
the Commission is requesting comment on the following matter:
    23. Are there any other benefits and cost associated with the
requirements to preserve the Rule 10 Records? If so, please describe
them.
6. Policies and Procedures, Annual Review, Immediate Notification of
Significant Cybersecurity Incidents, and Record Preservation
Requirements for Non-Covered Broker-Dealers
    As discussed earlier, proposed Rule 10 would require Non-Covered
Broker-Dealers to establish, maintain, and enforce written policies and
procedures that are reasonably designed to address their cybersecurity
risks taking into account the size, business, and operations of the
firm.\864\ The proposed rule also would require Non-Covered Broker-
Dealers to review the design and effectiveness of their cybersecurity
policies and procedures annually, including whether the policies and
procedures reflect changes in cybersecurity risk over the time period
covered by the review. Furthermore, Non-Covered Broker-Dealers would be
required to provide the Commission and their examining authority with
immediate written electronic notice of the occurrence of a significant
cybersecurity incident.\865\ The Commission also is proposing to amend
the record preservation and maintenance rule for broker-dealers (Rule
17a-4) to specifically require Non-Covered Broker-Dealers to preserve
certain records in connection with Rule 10.
---------------------------------------------------------------------------

    \864\ See section II.C.1. of this release (discussing in more
detail the proposed policies and procedures, annual review, and
record preservation requirements for Non-Covered Broker-Dealers).
    \865\ The Commission is not proposing that Non-Covered Broker
Dealers be subject to the requirements to file Parts I and II of
proposed Form SCIR and post copies of the most recently filed Part
II of proposed Form SCIR on their websites and provide copies of
that filing to their customers.
---------------------------------------------------------------------------

a. Benefits
    The requirement under proposed Rule 10 for Non-Covered Broker-
Dealers to establish, maintain, and enforce written policies and
procedures that are reasonably designed to address their cybersecurity
risks would generally

improve cybersecurity preparedness of Non-Covered Broker-Dealers--and
hence reduce their clients' exposure to cybersecurity incidents. This
is because, in establishing and maintaining a set of cybersecurity
policies and procedures in a written format, a Non-Covered Broker-
Dealer can evaluate whether its cybersecurity policies and procedures
continue to work as designed and whether changes are needed to assure
their continued effectiveness. In addition, by permitting Non-Covered
Broker-Dealers to take into account their size, business, and
operations of the firm when designing their written policies and
procedures, Non-Covered Broker-Dealers can more efficiently utilize
their resources. Moreover, by requiring Non-Covered Broker-Dealers to
establish reasonably designed cybersecurity policies and procedures,
the Commission would be better able to understand the protections that
these broker-dealers put in place to address cybersecurity risk. During
an examination, the Commission can assess the adequacy and completeness
of a Non-Covered Broker-Dealers cybersecurity policies and procedures.
Documenting a Non-Covered Broker-Dealer's cybersecurity policies and
procedures in a written format also would aid the Commission in its
review and oversight.
    Due to the varying sizes and operations of Non-Covered Broker-
Dealers, the benefits that accrue from the cybersecurity policies and
procedures requirement likely differ across entities. Because Non-
Covered Broker-Dealers are generally smaller and have fewer assets and
interconnections with other Market Entities than Covered Broker-
Dealers, there is less of a risk that a significant cybersecurity
incident at a Non-Covered Broker-Dealer could provide the threat actor
with access to other Market Entities. However, even though a Non-
Covered Broker-Dealer may not pose a significant overall risk to the
U.S. securities markets, a significant cybersecurity event at a Non-
Covered Broker-Dealer could have profound negative effects if a threat
actor is able to misappropriate customers' confidential financial
information. Consequently, greater cybersecurity investment by a Non-
Covered Broker-Dealer likely would lead to significant benefits for
itself and its customers.
    Non-Covered Broker-Dealers may already have implemented
cybersecurity policies and procedures. The marginal benefits of the
proposed rule would be mitigated to the extent that these existing
policies and procedures are consistent with the proposed rule's
requirements. However, existing policies and procedures that are
already consistent with the proposed rule would facilitate Non-Covered
Broker-Dealers in conducting annual reviews, assessing the design and
effectiveness of their cybersecurity policies and procedures, and
making necessary adjustments.
    The primary benefit of reviewing a Non-Covered Broker-Dealer's
cybersecurity policies and procedures on an annual basis would help to
ensure that they are working as designed, that they accurately reflect
the firm's cybersecurity practices, and that they reflect changes and
developments in the firm's cybersecurity risk over the time period
covered by the review. The documented policies and procedures would
serve as a benchmark when conducting the annual review. The Non-Covered
Broker-Dealer would be required, for compliance purposes and future
reference, to make a written record that documents the steps taken in
performing the annual review and the conclusions of the annual review.
    Cybersecurity threats constantly evolve, and threat actors
consistently identify new ways to infiltrate information systems. An
annual review requirement would ensure that Non-Covered Broker-Dealers
conduct a regular assessment and undertake updates to prevent policies
and procedures from becoming stale or ineffective, in light of the
dynamism of cybersecurity threats.
    The primary benefit of requiring Non-Covered Broker-Dealers to
retain their written cybersecurity policies and procedures as well as a
record of the annual reviews, is to assist the Commission in its
oversight function. In reviewing their records, Non-Covered Broker-
Dealers may see trends in their own cybersecurity risks, which may
serve as an impetus to make adjustments to their cybersecurity policies
and procedures. Furthermore, Proposed Rule 10 would expand beyond
current Commission regulations Non-Covered Broker-Dealers'
cybersecurity policies and procedures that address all cybersecurity
risks that may affect their information systems and the funds and
securities as well as personal, confidential, and proprietary
information that may be stored on those systems.
    As noted above, Non-Covered Broker-Dealers would be required to
give the Commission immediate written electronic notice of a
significant cybersecurity incident upon having a reasonable basis to
conclude that the significant cybersecurity incident has occurred or is
occurring. Compared to the suite of proposed requirements for Covered
Entities, including filing Parts I and II of proposed Form SCIR and
publicly disclosing Part II (which would contain summary descriptions
of the Covered Entity's cybersecurity risks and significant
cybersecurity incidents that occurred in current and previous calendar
years), the proposed requirement to provide immediate written
electronic notice of significant cybersecurity incidents is relatively
small but can yield significant benefits. Most notably, such immediate
notifications would make Commission staff aware of significant
cybersecurity incidents across all broker-dealers and not just at
Covered Broker-Dealers, thus significantly increasing its oversight
powers in the broker-dealer space with respect to cybersecurity
incidents. Trends that impact Non-Covered Broker-Dealers, such as
through malware or a particular type of software, may be detected by
staff, which can then inform other Market Entities of emerging risks.
This is particularly important due to the interconnected nature of the
U.S. securities industry. Breaches that occur at Non-Covered Broker-
Dealers may spread to larger firms, such as Covered Entities, that
could cause more widespread financial disruptions. Furthermore, we
anticipate that the burden on Non-Covered broker dealers of furnishing
immediate written notification of a significant cybersecurity incident
will be minimal.\866\
---------------------------------------------------------------------------

    \866\ See section IV.D.6.b. of this release.
---------------------------------------------------------------------------

b. Costs
    The costs associated with proposed Rule 10 for Non-Covered Broker-
Dealers with respect to the written cybersecurity policies and
procedures requirements would primarily result from establishing
written cybersecurity policies and procedures that are reasonably
designed. Such costs may be passed on to the Non-Covered Broker-
Dealers' customers, either in part or in full.
    Many Non-Covered Broker-Dealers currently have cybersecurity
policies and procedures in place; to the extent a Non-Covered Broker-
Dealer's existing policies and procedures are consistent with the
requirements of the proposed rule, those Non-Covered Broker-Dealers
would have limited need to update those policies and procedures, thus
mitigating the costs of the proposal. Non-Covered Broker-Dealers may be
subject to Regulation S-P, Regulation S-ID, and state regulations. In
those particular instances, they may have already implemented policies
and procedures that are consistent with the requirements of the
proposed Rule 10,

which would mitigate some of the compliance costs associated with the
proposed policies and procedures requirements.
    The cost of complying with the proposed annual review requirement
along with the accompanying written review and conclusion would depend
on the size, business, and operations of the Non-Covered Broker-Dealer.
A Non-Covered Broker-Dealer with simpler operations likely would incur
lower annual review and modification costs than firms with larger
operations. Furthermore, a Non-Covered Broker-Dealer may choose to hire
a third-party for assistance or consultation regarding the completion
of a written annual review and conclusion. This cost, in those
situations, would depend on the services requested and the fees that
are charged by the third-parties and consultants. Such costs could be
passed along to the Non-Covered Broker-Dealer's customers depending on
the competitive nature of the Non-Covered Broker-Dealer's market and
its business model.
    In either case, Non-Covered Broker-Dealers could tailor the
policies and procedures to its cybersecurity risks taking into account
its size, business, and operations. This offers Non-Covered Broker-
Dealers the flexibility to implement cybersecurity policies and
procedures based on the sophistication and complexity of their
information systems. Of course, the cost of cybersecurity systems and
modifications to cybersecurity policies and procedures may be higher as
the size, business, and operation of a Non-Covered Broker-Dealer
increases and becomes more complex.
    The costs associated with giving the Commission immediate written
electronic notice of a significant cybersecurity incident are likely to
be relatively similar to, or possibly somewhat larger, than those
incurred by Covered Broker-Dealers. As noted previously, the cost of
immediate notification consists of notifying the Commission of a
significant cybersecurity incident upon having a reasonable basis to
conclude it has occurred or is occurring as well as researching the
detailing of the incident in question. Non-Covered Broker-Dealers may
be able to make the same determination and notify the Commission in the
same amount of time as their Covered Broker-Dealer counterparts.
However, smaller broker-dealers may not have the staffing or
information technology expertise to make a reasonable decision about a
suspected significant cybersecurity event as quickly as a Covered
Broker-Dealer that may have in-house staff dedicated to this function,
thus increasing the overall immediate notification cost. On the other
hand, smaller broker-dealers could instead contract with third parties
for cybersecurity functions that could identify plausible significant
cybersecurity attacks in the same amount of time as Covered Broker-
Dealers. Unlike Covered Broker-Dealers, Non-Covered Broker-Dealers do
not have to provide more detail beyond the immediate written
notification requirement. Additional information regarding significant
cybersecurity incidents do not have to be provided to the Commission on
a confidential basis through the filing of Part I of proposed Form
SCIR. Moreover, a summary of past incidents do not have to be publicly
disclosed on their websites and with the Commission.
    To estimate the costs associated with the proposed policies and
procedures requirements and annual review requirements, the Commission
considered the initial and ongoing compliance costs.\867\ The internal
annual costs for these requirements (which include an initial burden
estimate annualized over a three year period) are estimated to be
$9,702 per Non-Covered Broker-Dealer, and $19,103,238 in total. These
costs include a blended rate of $462 for a compliance attorney and
assistant general counsel for a total of 21 hours. The annual external
costs for adopting and implementing the policies and procedures, as
well as the annual review of the policies and procedures are estimated
to be $2,480 per Non-Covered Broker-Dealer, and $4,883,120 in total.
This includes the cost of using outside legal counsel at a rate of $496
per hour for a total of five hours.
---------------------------------------------------------------------------

    \867\ See section V of this release (discussing these costs in
more detail).
---------------------------------------------------------------------------

    The cost associated Non-Covered Broker Dealer to research a
suspected cybersecurity incident and provide immediate written
notification to the Commission were combined earlier with those costs
for Covered Entities.\868\ Broken out solely for Non-Covered Broker-
Dealers, the Commission considered the initial and ongoing compliance
costs. The internal annual costs for these requirements (which include
an initial burden estimate annualized over a three year period) are
estimated to be $1,648.51 per Non-Covered Broker-Dealer, and $3,245,916
in total. These costs include a blended rate of $353 for an assistant
general counsel, compliance manager, and systems analyst for a total of
4.67 hours. The annual external costs for these requirements are
estimated to be $1,488 per Non-Covered Broker-Dealer, and $2,959,872 in
total. This includes the cost of using outside legal counsel at a rate
of $496 per hour for a total of three hours.
---------------------------------------------------------------------------

    \868\ See section IV.D.3.b. of this release (discussing the cost
of immediate notification).
---------------------------------------------------------------------------

    Pursuant to proposed Rule 10, a Non-Covered Broker-Dealer would be
required to: (1) establish, maintain, and enforce written policies and
procedures that are reasonably designed to address the cybersecurity
risks of the firm; (2) make a written record that documents its annual
review; and (3) provide immediate electronic written notice to the
Commission of a significant cybersecurity incident upon having a
reasonable basis to conclude that the significant cybersecurity
incident has occurred or is occurring. The additional cost of the
proposed amendments to Rule 17a-4 of preserving and maintaining these
documents for three years, whether in paper or digital form, is likely
minimal.
    To estimate the costs associated for a Non-Covered Broker-Dealer to
comply with its recordkeeping maintenance and preservation requirement,
the Commission considered the initial and ongoing compliance
costs.\869\ The internal annual cost for this requirement is estimated
to be $220.50 per Non-Covered Broker-Dealer, and $434,164.50 in total.
These costs include a blended rate of $73.50 for a general clerk and
compliance clerk for a total of 2 hours. It is estimated that there
will be $0 annual external cost for the recordkeeping maintenance and
preservation requirement.
---------------------------------------------------------------------------

    \869\ See section V of this release (discussing these costs in
more detail).
---------------------------------------------------------------------------

c. Request for Comment
    The Commission requests comment on all aspects of the foregoing
analysis of the benefits and costs of the proposed requirements for
Non-Covered Broker-Dealers. Commenters are requested to provide
empirical data in support of any arguments or analyses. In addition,
the Commission is requesting comment on the following matters:
    24. What level of cybersecurity policies and procedures have Non-
Covered Broker-Dealers implemented? For example, would they meet the
cybersecurity policies and procedures requirements of the proposed
rule, thus making the compliance cost relatively low? Are those
policies and procedures documented?
    25. Are there any other benefits and costs for a Non-Covered
Broker-Dealer

in establishing, maintaining, and enforcing written policies and
procedures under proposed Rule 10? If so, please describe them.
    26. Are the estimated costs of compliance for Non-Covered Broker-
Dealers to establish, maintain, and enforce written policies and
procedures cybersecurity policies and procedures that comply with the
proposed rule reasonable? If not, why not?
    27. Would Non-Covered Broker-Dealers consult with a third party or
hire a consultant with cybersecurity expertise in order to establish
the cybersecurity policies and procedures under proposed Rule 10?
    28. Are there quantifiable benefits to complying with the
cybersecurity policies and procedures requirements of the proposed
rule? If so, please describe them. Are there quantifiable costs for
Non-Covered Broker-Dealers to review their cybersecurity policies
annually that are different than those discussed above? If so, describe
them.
    29. Are there any other benefits in reviewing and updating Non-
Covered Broker-Dealers' cybersecurity policies and procedures on an
annual basis? If so, please describe them.
    30. Is the estimated cost to review Non-Covered Broker-Dealers
cybersecurity policies and procedures reasonable? If not, explain why?
    31. Would it be more or less costly to outsource the responsibility
of an annual review of cybersecurity policies and procedures to a third
party?
7. Substituted Compliance for Non-U.S. SBS Entities
    Commission Rule 3a71-6 states that the Commission may,
conditionally or unconditionally, by order, make a determination with
respect to a foreign financial regulatory system that compliance with
specified requirements under such foreign financial regulatory system
by a registered SBS Entity or class thereof, may satisfy the certain
requirements that would otherwise apply to such an SBS Entity (or class
thereof). The Commission may make such substituted compliance
determinations to permit SBS Entities that are not U.S. persons (as
defined in 17 CFR 240.3a71-3(a)(4)), but not SBS Entities that are U.S.
persons, to satisfy the eligible requirements by complying with
comparable foreign requirements.\870\ The Commission is proposing to
amend Rule 3a71-6 to permit eligible applicants \871\ to seek a
Commission determination with respect to the cybersecurity requirements
of proposed Rule 10 and Form SCIR as applicable to SBS Entities that
are not U.S. persons.\872\ Additionally, Rule 3a71-6 currently permits
eligible applicants to seek a substituted compliance determination from
the Commission with regard to the requirements of Rule 18a-6, including
the proposed amendments to Rule 18a-6 if adopted.\873\
---------------------------------------------------------------------------

    \870\ See 17 CFR 240.3a71-6(d).
    \871\ See 17 CFR 240.3a71-6(c).
    \872\ See section II.D.3.
    \873\ See paragraph (d)(6) of Rule 3a71-6.
---------------------------------------------------------------------------

a. Benefits
    The Commission is proposing amendments to Rule 3a71-6 to make
substituted compliance available to eligible SBS Entities that are not
U.S. persons, if the Commission determines that compliance with
specified requirements under a foreign financial regulatory system by a
registered SBS Entity, or class thereof, satisfies the corresponding
requirements of proposed Rule 10 and Form SCIR. Other regulatory
regimes may achieve regulatory outcomes that are comparable to the
Commission's proposed cybersecurity risk management requirements.
Allowing for the possibility of substituted compliance may avoid
regulatory duplication and conflict that may increase entities'
compliance burdens without an analogous increase in benefits. The
availability of substituted compliance could decrease the compliance
burden for non-U.S. SBS Entities, in particular as it pertains to the
establishment, maintenance, and enforcement of cybersecurity policies
and procedures, notification and reporting to regulators, disclosure of
cybersecurity risks and incidents, and record preservation. Allowing
for the possibility of substituted compliance may help achieve the
benefits of proposed Rule 10, Form SCIR, and the proposed amendments to
Rule 18a-6 in a manner that avoids the costs that SBS Entities that are
not U.S. persons would have to bear due to regulatory duplication or
conflict.
    Further, substituted compliance may have broader market
implications, namely greater foreign SBSDs' activity in the U.S.
market, expanded access by both U.S. and foreign SBS Entities to global
liquidity, and reduced possibility of liquidity fragmentation along
jurisdictional lines. The availability of substituted compliance for
non-U.S. SBS Entities also could promote market efficiency, while
enhancing competition in U.S. markets. Greater participation and access
to liquidity is likely to improve efficiencies related to hedging and
risk sharing while simultaneously increasing competition between
domestic and foreign SBS Entities.
b. Costs
    The Commission believes that the availability of substituted
compliance for proposed Rule 10, Form SCIR, and the proposed amendments
to Rule 18a-6 will not substantially alter the benefits intended by
those requirements. In particular, it is expected that the availability
of substituted compliance will not detract from the risk management
benefits that stem from implementing proposed Rule 10, Form SCIR, and
the proposed amendments to Rule 18a-6.
    To the extent that substituted compliance reduces duplicative
compliance costs, non-U.S. SBS Entities may incur lower overall costs
associated with cybersecurity preparedness than they would otherwise
incur without the option of substituted compliance availability, either
because a non-U.S. SBS Entity may have already implemented foreign
regulatory requirements which have been deemed comparable by the
Commission, or because security-based swap counterparties eligible for
substituted compliance do not need to duplicate compliance with two
sets of comparable requirements.
    A substituted compliance request can be made either by a foreign
regulatory jurisdiction on behalf of its market participants, or by the
registered market participant itself.\874\ The decision to request
substituted compliance is voluntary, and therefore, to the extent that
requests are made by individual market participants, such participants
would request substituted compliance only if compliance with foreign
regulatory requirements was less costly, in their own assessment, than
compliance with both the foreign regulatory regime and the relevant
Title VII requirements, including the requirements of proposed Rule 10,
Form SCIR, and the proposed amendments to Rule 18a-6. Even after a
substituted compliance determination is made, market participants would
only choose substituted compliance if the benefits that they expect to
receive exceed the costs that they expect to bear for doing so.
---------------------------------------------------------------------------

    \874\ See 17 CFR 240.3a71-6(c).
---------------------------------------------------------------------------

E. Effects on Efficiency, Competition, and Capital Formation

    As discussed in the foregoing sections, market imperfections could
lead to underinvestment in cybersecurity by Market Entities, and
information asymmetry could contribute

to a market-wide inefficient provision of cybersecurity defenses. The
proposed rule aims to mitigate the inefficiencies resulting from these
imperfections by: (1) imposing mandates for cybersecurity policies and
procedures that could reduce cybersecurity underinvestment; (2)
creating a reporting framework that could improve information sharing
and improved cybersecurity defense investment and protection; and (3)
providing public disclosure to inform Covered Entities' customers,
counterparties, members, registrants, or users about the Covered
Entities' cybersecurity efforts and experiences, thus potentially
reducing information asymmetry.\875\ While the proposed rule has the
potential to mitigate inefficiencies resulting from market
imperfections, the scale of the overall effect would depend on numerous
factors, including the state of existing of cybersecurity
preparations,\876\ the degree to which the proposed provisions induce
increases to these preparations, the effectiveness of additional
preparations at reducing cybersecurity risks,\877\ the degree to which
customers, counterparties, members, registrants, and users value
additional cybersecurity preparations,\878\ the degree of information
asymmetry and bargaining power between customers, counterparties,
members, registrants, and users vis-[agrave]-vis Market Entities,\879\
the bargaining power of Market Entities vis-[agrave]-vis service
providers,\880\ service providers' willingness to provide bespoke
contractual provisions to affected Market Entities,\881\ the
informational utility of the proposed disclosures, the scale of the
negative externalities on the broader financial system,\882\ the
effectiveness of existing information sharing arrangements, and the
informational utility of the required regulatory reports (as well as
the Commission's ability to make use of them).\883\
---------------------------------------------------------------------------

    \875\ See sections IV.B. and IV.D. of this release (discussing
the broad economic considerations and benefits and costs of the
proposals, respectively.
    \876\ See section IV.C.1. of this release. Here, the Commission
is concerned about the degree to which Market Entities' state of
cybersecurity preparations diverge from socially optimal levels.
    \877\ Formally, the marginal product of the proposed policies
and procedures in the production of cybersecurity defenses.
    \878\ Formally, customers', counterparties', members',
registrants', and users' utility functions--specifically the
marginal utilities of Covered Entities' and Non-Covered Broker-
Dealers' cybersecurity policies and procedures.
    \879\ In other words, the degree to which customers,
counterparties, members, registrants, or users can affect the
policies of Market Entities. Generally, the Commission expects that
customers, counterparties, members, registrants, or users may be
smaller than the affected Market Entity with which they conduct
business and thus be subject to asymmetry and have limited ability
to affect the policies of the Market Entity. However, that may not
always be the case. For example, for customers of broker-dealers,
the situation is likely to involve more heterogeneity, with some
parties (e.g., small retail clients) wielding very little power over
the broker-dealer's policies while others (e.g., large institutional
investors) wielding considerable power.
    \880\ In certain cases, a Covered Entity may determine that a
competing service provider can be used as a bargaining chip in the
renegotiation of existing service agreements, potentially imposing
substantial contracting costs on the parties, which would eventually
be passed on to the Covered Entities' customers, counterparties,
members, participants, or users.
    \881\ Id.
    \882\ See sections IV.D.2.a. and IV.D.2.b. of this release.
    \883\ See section IV.D.3. of this release.
---------------------------------------------------------------------------

    However, since the proposed cybersecurity policies and procedures
and related annual assessment are intended to prevent cybersecurity
incidents at Market Entities that would otherwise cause financial loss
and operational failure, compliance with the proposed rule likely would
result in a safer environment to engage in securities transactions that
protects the efficiency with which markets operate. Specifically, the
proposed requirements are intended to protect the efficiency of
securities market through the prevention of cybersecurity incidents
that can adversely impact Market Entities and that, in turn, can
interrupt the normal operations of U.S. securities markets and disrupt
the efficient flow of information and capital.
    The additional requirements applicable to Covered Entities (namely,
the specific elements of the cybersecurity policies and procedures, the
reporting to the Commission of any significant cybersecurity incident
through Part I of proposed Form SCIR, and the disclosure of
cybersecurity risks and significant cybersecurity incidents) would also
allow for greater information sharing and would reduce the risk of
underinvestment in cybersecurity across the securities industry. For
example, confidential reporting to the Commission through Part I of
proposed Form SCIR would provide regulators with the opportunity to
promptly begin to assess the situation when a Covered Entity is
experiencing a significant cybersecurity incident and begin to evaluate
potential impacts on the market. In addition, public disclosures by
Covered Entities through Part II of proposed Form SCIR and website
postings would allow their customers, counterparties, members,
registrants, and users to manage risk and choose with whom to do
business, potentially allocating their resources to Covered Entities
with greater cybersecurity preparedness. In addition, the sharing of
information through public disclosures could assist in the development
and implementation of cybersecurity policies and procedures,
particularly by smaller and less sophisticated Market Entities which
likely have fewer resources to develop robust cybersecurity protocols.
Such information may be useful to them in in choosing one option over
another, potentially allowing those smaller and less sophisticated
Market Entities to develop their cybersecurity protection in the most
cost-effective way possible.
    Because the proposed rule would likely have differential effects on
Market Entities along a number of dimensions, its overall effect on
competition among Market Entities may be difficult to predict in
certain instances. For example, smaller Market Entities, such as Non-
Covered Broker-Dealers and certain transfer agents are likely to face
disproportionately higher costs relative to revenues resulting from the
proposed rule.\884\ With respect to broker-dealers, the Commission has
endeavored to provide Non-Covered Broker-Dealers with a more limited
and flexible set of requirements that better suits their business
models and would therefore be less onerous. Still, a number of small
broker-dealers would be subject to the proposed rule as Covered
Entities, which could tilt the competitive playing field in favor of
their larger Covered Broker-Dealer counterparts.\885\ In addition, all
transfer agents would be Covered Entities under the proposed rule,
regardless of their size, so the same concern is present.
---------------------------------------------------------------------------

    \884\ See section IV.B. of this release.
    \885\ See section VI.C. of this release (noting that certain
small broker-dealers would meet the definition of ``covered entity''
for purposes of the proposed rule).
---------------------------------------------------------------------------

    On the other hand, if customers, counterparties, members,
registrants, or users believe that the proposed rule effectively
induces the appropriate level of cybersecurity effort among Market
Entities, smaller Market Entities would likely benefit the most from
these improved perceptions, as they would be thought to have sufficient
cybersecurity policies and procedures in place compared to not having
enough cybersecurity protections. Similar differential effects can
occur within a particular group of Market Entities and service
providers that are more (or less) focused on their cybersecurity.
    With respect to competition among Covered Entities' service
providers, the overall effect of the proposed rule and amendments is
similarly ambiguous. It is likely that requiring affected Covered

Entities to request oversight of service providers' cybersecurity
practices pursuant to a written contract would lead some service
providers to cease offering services to affected Covered Entities.\886\
The additional regulation could serve as a barrier to entry to new
service providers and could disproportionally affect would-be Market
Entities.
---------------------------------------------------------------------------

    \886\ See section I.A.1. of this release.
---------------------------------------------------------------------------

    In terms of capital formation, the proposed rule would have second-
order effects, namely through a safer financial marketplace. As noted
above, FSOC states that a destabilizing cybersecurity incident could
potentially threaten the stability of the U.S. financial system by
causing, among other things, a loss of confidence among a broad set of
market participants, which could cause participants to question the
safety or liquidity of their assets or transactions, and lead to
significant withdrawal of assets or activity.\887\ The Market Entities
covered by this rule play important roles in capital formation through
the various services they provide.\888\ Due to their interconnected
systems, a significant cybersecurity incident affecting Market Entities
could have a cascading effect across the U.S. financial system with a
significant impact on investor confidence, resulting in withdrawal of
assets and impairment of capital formation.
---------------------------------------------------------------------------

    \887\ See FSOC 2021 Annual Report.
    \888\ See sections I.A.1. and II.A.1. of this release.
---------------------------------------------------------------------------

    The proposed rule provides the backbone for having sufficient
cybersecurity measures in place to protect customer information, funds,
and securities. Moreover, proposed provisions likely would lead to
increased efficiency in the market, thus resulting in improved capital
formation.\889\ With a more predictable investment environment due to
improved cybersecurity implementation by Market Entities and service
providers, capital formation through the demand for securities
offerings will be less prone to interruptions.
---------------------------------------------------------------------------

    \889\ The proposed provisions do not implicate channels
typically associated with capital formation (e.g., taxation policy,
financial innovation, capital controls, intellectual property, rule-
of-law, and diversification). Thus, the proposed rule are likely to
have only indirect, second order effects on capital formation
arising from any improvements to economic efficiency. Qualitatively,
these effects are expected to be small.
---------------------------------------------------------------------------

    As part of the analysis on competition, efficiency, and capital
formation, the Commission requests comment from all parties,
particularly the Market Entities that are affected by these proposed
rule:
    a. Do firms within the Covered Entity and Non-Covered Broker-Dealer
groups compare their cybersecurity safety measures among themselves or
among firms of a particular type within a group (e.g., national
securities exchanges only or transfer agents only)? Does one entity's
level of cybersecurity protection incentivize competing entities to
improve their cybersecurity policies and procedures? Is it possible
that an entity with subpar cybersecurity protocols may be forced to
exit the market, either because of business migrating to its
competitors or because of the sheer number of cybersecurity incidents
at that entity?
    b. Would better cybersecurity policies and procedures, especially
those that are reviewed and updated, provide more stability in the
securities markets that encourages additional investment?
    c. Would public disclosures of cybersecurity risks and significant
cybersecurity incidents during the current or previous calendar year
encourage investment in cybersecurity protections that later provide
more stability in the market, thus encouraging capital formation?
    d. Does the Commission's knowledge of cybersecurity incidents as
well as of the policy and procedures at Market Entities lead to a
calming effect on the market though oversight and compliance with the
proposed rule, which would then foster greater capital formation?

F. Reasonable Alternatives

1. Alternatives to the Policies and Procedures Requirements of Proposed
Rule 10
a. Require Only Disclosure of Cybersecurity Policies and Procedures
Without Prescribing Specific Elements
    Rather than requiring Covered Entities to adopt cybersecurity
policies and procedures with specific enumerated elements, the
Commission considered requiring Covered Entities to only provide
explanations or summaries of their cybersecurity practices to their
customers, counterparties, members, registrants, or users. In this
alternative scenario, each Covered Entity would provide a disclosure
containing a general overview of its existing cybersecurity policies
and procedures, rather than be required to establish cybersecurity
policies and procedures pursuant to the requirements of paragraph (b)
of proposed Rule 10. Under this alternative, the general disclosure
about the Covered Entity's cybersecurity policies and procedures would
be publicly available to its customers, counterparties, members,
registrants, and users, but it would not reveal specific details of the
Covered Entity's policies and procedures. Further, under this
alternative, detailed and comprehensive information about the Covered
Entity's cybersecurity risks and protocols--including the policies and
procedures themselves--would remain internal to the Covered Entity. The
only other organizations that would be able to review or examine this
more detailed information would be the Commission, FINRA, the MSRB (to
the extent applicable), and other regulators with authority to examine
this information in the course of their oversight activities.
    This alternative approach would create weaker incentives for
Covered Entities to address potential underspending on cybersecurity
measures, as it would rely, in part, on customers', counterparties',
members', registrants', or users' (or third parties' providing analyses
to those customers, counterparties, members, registrants, or users)
\890\ ability to assess the effectiveness of Covered Entities'
cybersecurity practices from the Covered Entities' public disclosures.
Further, any benefits to be gained by requiring public disclosure of a
Covered Entity's cybersecurity policies and procedures can also be
realized through the proposed rule's public disclosure requirement. In
particular, proposed Rule 10 would require each Covered Entity to
provide a summary description of the cybersecurity risks that could
materially affect its business and operations and how the Covered
Entity assesses, prioritizes, and addresses those cybersecurity risks.
In addition, each Covered Entity would need to disclose a summary
description of each significant cybersecurity incident that occurred
during the current or previous calendar year, if applicable. This
disclosure would serve as another way for market participants to
evaluate the Covered Entity's cybersecurity risks and vulnerabilities
apart from the general disclosure of its cybersecurity risks. As
mentioned above, this information could be useful to the Covered
Entity's customers, counterparties, members, registrants, or users to
manage their own cybersecurity risks and, to the extent they have
choice, select a Covered Entity with whom to transact or otherwise
conduct business.\891\
---------------------------------------------------------------------------

    \890\ See section IV.D.1.a. of this release.
    \891\ Furthermore, third-party financial service firms could
conduct studies on cybersecurity preparedness at Market Entities,
such as certain entities not being in line with industry practices
or standards, which also could inform the choices of customers,
counterparties, members, registrants, or users.
---------------------------------------------------------------------------

    Given the cybersecurity risks of disclosing detailed explanations
of

cybersecurity practices (which would necessarily be disclosed if the
Covered Entity would be required to disclose its existing cybersecurity
policies and procedures),\892\ it is likely that requiring such
disclosure would result in the Covered Entity including only general
language in its disclosure and providing few, if any, specific details
that could be used by threat actors to take advantage of weak links in
a Covered Entity's cybersecurity preparedness. Consequently, this
alternative ``disclosure-only'' regime for cybersecurity policies and
procedures would be unlikely to provide enough information and detail
to differentiate between one Covered Entity's cybersecurity policies
and procedures from another's policies and procedures, thus maintaining
information asymmetry between the Covered Entity and other market
participants. If information asymmetry was maintained, it is unlikely
that meaningful change could be effected in the Covered Entities'
cybersecurity practices through market pressure or Commission oversight
over the Covered Entity's policies and procedures.\893\ Furthermore,
not requiring specific enumerated elements in cybersecurity policies
and procedures would likely result in less uniform cybersecurity
preparedness across Covered Entities, leaving market participants with
inconsistent information about the robustness of Covered Entities'
cybersecurity practices. However, if Market Entities believed that
providing more detailed information would give them a competitive
advantage, they would do so.
---------------------------------------------------------------------------

    \892\ See section IV.D.2.b. of this release (discussing
tradeoffs of cybersecurity disclosure).
    \893\ Here, changes in cybersecurity practices would depend
entirely on market discipline exerted by relatively uninformed
market participants.
---------------------------------------------------------------------------

    On the other hand, the costs associated with this alternative
likely would be minimal relative to those associated with the proposed
requirements regarding written policies and procedures, as Covered
Entities would be unlikely to face pressure to adjust their existing
cybersecurity policies and procedures as long as they do not experience
any significant cybersecurity incidents. However, if a Covered Entity
does experience a significant cybersecurity incident, it may force the
Covered Entity to revise its existing cybersecurity policies and
procedures and consequently revise its disclosures to other market
participants concerning its cybersecurity policies and procedures. It
is also conceivable that being required to make public disclosures
regarding its cybersecurity policies and procedures or undergoing
third-party market analyses that aggregate these types of disclosures
(and may focus on, for example, the Covered Entity's lack of conformity
with industry practices and standards) may provide the impetus for a
Covered Entity to make its cybersecurity policies and procedures more
robust.
b. Limiting the Scope of the Proposed Cybersecurity Policies and
Procedures With Respect to Third-Party Service Providers
    The Commission also considered limiting the scope of the proposed
requirement that the Covered Entity's policies and procedures require
oversight of service providers that receive, maintain, or process the
Covered Entity's information, or are otherwise permitted to access the
Covered Entity's information systems and the information residing on
those systems, pursuant to a written contract between the Covered
Entity and the service provider.\894\ Specifically, the Commission
considered narrowing the scope of service providers in the enumerated
categories discussed above \895\ and requiring a periodic review and
assessment of the pared-down list of service providers' cybersecurity
policies and procedures rather than apply the Service Provider
Oversight requirement to each service prover that receives, maintains,
or processes the Covered Entity's information, or is otherwise
permitted to access the Covered Entity's information systems and the
information residing on those systems. The types of service providers
that would still be covered by the written contract requirement would
be those that provide cybersecurity related-services as well as
business-critical services that are necessary for a Covered Entity to
operate its core functions. The Commission further considered requiring
service providers that receive, maintain, or process the Covered
Entity's information, or are otherwise permitted to access the Covered
Entity's information systems and the information residing on those
systems to provide security certifications in lieu of the written
contract requirement.
---------------------------------------------------------------------------

    \894\ See paragraph (b)(1)(iii)(B) of proposed Rule 10 (setting
forth the Service Provider Oversight Requirement).
    \895\ See section IV.C.2.h. of this release.
---------------------------------------------------------------------------

    Narrowing the scope of the types of service providers affected by
the proposal could lower costs for Covered Entities, especially smaller
Covered Entities that rely on generic contracts with service providers
(because they have less negotiating power with their service providers)
and would have difficulty effecting changes in contractual terms with
such service providers.\896\ However, in the current technological
context in which businesses increasingly rely on third-party ``cloud
services'' that effectively place business data out of the business'
immediate control, the cybersecurity risk exposure of Covered Entities
is unlikely to be limited to (or even concentrated in) certain named
service providers. Narrowing the scope of service providers likely
would lead to lower costs only insofar as it reduces effectiveness of
the regulation. A related basis to reject this alternative is the
signaling effect that it sends to threat actors. By excluding certain
categories of service providers, the Commission could be providing
information to threat actors about which service providers would be
easiest to attack, as that universe of excluded vendors may have
relatively inferior policies and procedures than vendors that are
covered by the proposed rule.
---------------------------------------------------------------------------

    \896\ See section IV.D.1.b. of this release (discussing service
providers).
---------------------------------------------------------------------------

    Alternatively, maintaining the proposed scope but only requiring a
standard, recognized, certification in lieu of a written contract could
also lead to cost savings for Covered Entities, particularly if the
certification is completed in-house or if a particular entity has many
service contracts with different third parties that specify they are in
compliance with the certification.\897\ However, the Commission
preliminary believes that it would be difficult to prescribe a set of
characteristics for such a ``standard'' certification that would
sufficiently address the varied types of Covered Entities and their
respective service providers.\898\ Another difficulty may be that if a
single third-party entity is used for the certification, that entity
would have to be well-versed in all contracted services in order to
accurately assess them for compliance. In contrast, individualized
contracts with each

service provider likely would ensure better compliance with the intent
of the proposed rule as those third-party providers specialize in the
services that they offer.
---------------------------------------------------------------------------

    \897\ Service providers may currently be providing
certifications as part of a registrant's policies and procedures.
See also section II.B.1.g. of this release (seeking comment on
alternative approaches to the Service Provider Oversight
Requirement, including whether this cybersecurity risk could be
addressed through policies and procedures to obtain written
assurances or certifications from service providers that the service
provider manages cybersecurity risk in a manner that would be
consistent with how the Covered Entity would need to manage this
risk under paragraph (b) of proposed Rule 10).
    \898\ See section IV.C.3. of this release(discussing the variety
of affected registrants); see also section IV.F.1. of this release
(discussing the limitations of uniform prescriptive requirements).
---------------------------------------------------------------------------

c. Require Specific Standardized Elements for Addressing Cybersecurity
Risks of Covered Entities
    The Commission considered including more standardized elements in
that would need to be included in a Covered Entity's cybersecurity
policies and procedures. For example, Covered Entities could be
required to implement particular controls (e.g., specific encryption
protocols, network architecture, or authentication procedures) that are
designed to address each general element of the required cybersecurity
policies and procedures. Given the considerable diversity in the size,
focus, and technical sophistication of affected Covered Entities,\899\
any specific requirements likely would result in some Covered Entities
needing to substantially alter their cybersecurity policies and
procedures.
---------------------------------------------------------------------------

    \899\ See section IV.C.3. of this release.
---------------------------------------------------------------------------

    The potential benefit of such an approach would be to provide
assurance that Covered Entities have implemented certain specific
cybersecurity practices. But this approach would also entail
considerably higher costs, as many Covered Entities would need to
adjust their existing practices to something else that is more costly
than potential alternatives that could provide the same outcome level
of protection. In addition, considering the variety of Covered Entities
registered with the Commission, it would be exceedingly difficult for
the Commission to devise specific requirements that are appropriately
suited for all Covered Entities: a uniform set of requirements would
certainly be both over- and under-inclusive, while providing varied
requirements based on the circumstances of each Covered Entity would be
complex and impractical. For example, standardized requirements that
ensure reasonably designed cybersecurity policies and procedures for
the largest, most sophisticated and active Covered Entities would
likely be overly burdensome for smaller and less sophisticated Covered
Entities with more limited cybersecurity risk exposures. Conversely, if
these standardized requirements were tailored to smaller Covered
Entities with more limited operations or cybersecurity risks, such
requirements likely would be inadequate in addressing larger Covered
Entities' cybersecurity risks. As a result, instituting blanket
requirements likely would not provide the most efficient and cost-
effective way of instituting appropriate cybersecurity policies and
procedures.
    An important cost associated with this approach is the burden and
complexity of prescribing detailed technical requirements tailored to
the broad variety of Covered Entities that would be subject to proposed
Rule 10. More broadly, imposing standardized requirements would
effectively place the Commission in the role of dictating details
related to the information technology practices of Covered Entities
without the benefit of the Covered Entities' knowledge of their own
particular circumstances. Moreover, given the complex and constantly
evolving cybersecurity landscape, detailed regulatory requirements for
cybersecurity practices would likely limit Covered Entities' ability to
adapt quickly to changes in the cybersecurity landscape.\900\
---------------------------------------------------------------------------

    \900\ If as in the previous example, the Commission were to
require Covered Entities to adopt a specific encryption algorithm,
future discovery of vulnerabilities in that algorithm would prevent
registrants from fully mitigating the vulnerability (i.e., switching
to improved algorithms) in the absence of Commission action.
---------------------------------------------------------------------------

d. Require Audits of Internal Controls Regarding Cybersecurity
    Instead of requiring all Market Entities to establish, maintain,
and enforce cybersecurity policies and procedures, the Commission
considered requiring these entities to obtain audits of the
effectiveness of their existing cybersecurity controls--for example,
obtaining third-party audits with respect to their cybersecurity
practices. This approach would not require Market Entities to
establish, maintain, and enforce written policies and procedures that
are reasonably designed to address their cybersecurity risks as
proposed, but instead would require Market Entities to engage an
independent, qualified third party to assess their cybersecurity
controls and prepare a report describing its assessment and any
potential deficiencies.
    Under this alternative, an independent third party (e.g., an
auditing firm) would certify to the effectiveness of the Market
Entities' cybersecurity practices. If the firms providing such
certifications have sufficient reputational motives to issue credible
assessment,\901\ and if the scope of such certifications is not overly
circumscribed,\902\ it is likely that Market Entities' cybersecurity
practices would end up being more robust under this alternative than
under the current proposal. By providing certification of a Market
Entities' cybersecurity practices, a firm would--in effect--be lending
its reputation to the Market Entity. Because ``lenders'' are naturally
most sensitive to downside risks (here, loss of reputation, lawsuits,
damages, and regulatory enforcement actions), one would expect them to
avoid ``lending'' to Market Entities with cybersecurity practices whose
effectiveness is questionable.\903\
---------------------------------------------------------------------------

    \901\ This would be the case if there was sufficient market
pressure or regulatory requirements to obtain certification from
``reputable'' third-parties with business models premised on
operating as a going-concern and maintaining a reputation for
honesty.
    \902\ In this alternative, it is assumed that certification
would not be limited to only evaluating whether a Market Entity's
stated policies and procedures are reasonably designed, but rather
also would include an assessment of whether the policies and
procedures are actually implemented in an effective manner.
    \903\ Under the proposal it is the Market Entity itself that
effectively ``certifies'' its own cybersecurity policies and
procedures. Like the third-party auditor, the Market Entity faces
down-side risks from ``certifying'' inadequate cybersecurity
practices (i.e., Commission enforcement actions). However, unlike
the auditor, the Market Entity also realizes the potential up-side:
cost savings through reduced cybersecurity expenditures.
---------------------------------------------------------------------------

    While certification by industry-approved third parties could lead
to more robust cybersecurity practices, the costs of such an approach
would likely be considerably higher. Because of the aforementioned
sensitivity to downside risk, firms would likely be hesitant to provide
cybersecurity certifications without a thorough understanding of a
Market Entity's systems and practices. In many cases, developing such
an understanding would involve considerable effort particularly for
certain larger and more sophisticated Covered Entities.\904\ In
addition, there may be a need for a consensus as to what protocols
constitute industry standards in which certifying third parties would
need to stay proficient. Finally, while such a scenario is somewhat
similar to the Service Provider Oversight Requirement, this alternative
does not allow for immediate repercussions or remediation if the third-
party finds deficiencies in the Covered Entity's cybersecurity policies
and procedures. The Commission would need to have a copy of the report
and audit the Market Entity to ensure that Market Entity subsequently
resolved the problem(s). This leads to an inefficient method of
implementing reasonably

designed cybersecurity policies and procedures.
---------------------------------------------------------------------------

    \904\ It would be difficult for an auditor to provide a credible
assessment of the effectiveness of the Market Entity's cybersecurity
practices without first understanding the myriad of systems involved
and how those practices are implemented. Presumably, a Market Entity
would not bear these costs as it is likely to possess such an
understanding.
---------------------------------------------------------------------------

e. Bifurcate Non-Broker-Dealer Market Entities Into Covered Entities
and Non-Covered Entities
    The Commission considered bifurcating other categories of Market
Entities into Covered Entities and Non-Covered Entities (in addition to
broker-dealers) based on certain characteristics of the firm such that
the Non-Covered Entities would not be required to include certain
elements in their cybersecurity risk management policies and
procedures. For example, the Commission considered defining as Non-
Covered Entities Market Entities with assets below a certain threshold
or with only a limited number of customers, counterparties, members,
registrants, or users. This approach also could be scaled based on a
Covered Entity's size, business, or another criterion, similar to the
proposed distinction between Covered Broker-Dealers and Non-Covered
Broker-Dealers. However, as discussed above, cybersecurity risks are
likely to be unique to each Covered Entity primarily because Covered
Entities vary drastically based on their size, business, and the
services they provide. It would be difficult come up with one
characteristic that is common to all Covered Entities such that each of
them can be both broken out into separate groups. For example, it would
be difficult to differentiate between transfer agents the same way one
could distinguish between large and small clearing agencies or even
harder, national securities associations. The only effective way to
differentiate firms with a given Covered Entity category is to choose a
characteristic that is sensible for the type of Covered Entity.\905\
---------------------------------------------------------------------------

    \905\ For additional detail on the importance of each of the
proposed Covered Entity's role in the U.S. securities markets, see
section I.A.2. of this release (discussing critical operations of
each Market Entity). See also section II.A.1. of this release
(discussing why it would not be appropriate to exclude small
transfer agents and certain small broker-dealers from the definition
of Covered Entity).
---------------------------------------------------------------------------

    Finally, as discussed earlier, in determining which Market Entities
should be Covered Entities and which should be Non-Covered Entities,
the Commission considered: (1) how the category of Market Entity
supports the fair, orderly, and efficient operation of the U.S.
securities markets and the consequences if that type of Market Entity's
critical functions were disrupted or degraded by a significant
cybersecurity incident; (2) the harm that could befall investors,
including retail investors, if that category of Market Entity's
functions were disrupted or degraded by a significant cybersecurity
incident; (3) the extent to which the category of Market Entity poses
cybersecurity risk to other Market Entities though information system
connections, including the number of connections; (4) the extent to
which the category of Market Entity would be an attractive target for
threat actors; and (5) the personal, confidential, and proprietary
business information about the category of Market Entity and other
persons (e.g., investors) stored on the Market Entity's information
systems and the harm that could be caused if that information were
accessed or used by threat actors through a cybersecurity breach.\906\
However, the Commission seeks comment on this topic, particularly if
certain proposed Covered Entities should be Non-Covered Entities with
attendant reduced requirements.\907\
---------------------------------------------------------------------------

    \906\ See section II.A.1. of this release.
    \907\ See section II.A.10. of this release.
---------------------------------------------------------------------------

f. Administration and Oversight of Cybersecurity Policies and
Procedures of Covered Entities
    The Commission considered various alternative requirements with
respect to administration and oversight of Covered Entities'
cybersecurity policies and procedures, such as requiring them to
designate a CISO (or another individual that serves in a similar
capacity) or requiring the boards of directors (to the extent
applicable), to oversee directly a Covered Entity's cybersecurity
policies and procedures. There is a broad spectrum of potential
approaches to this alternative, ranging from the largely nominal (e.g.,
requiring Covered Entities simply to designate someone to be a CISO) to
the stringent (e.g., requiring a highly-qualified CISO to attest to the
effectiveness of the Covered Entities' policies).
    Stringent requirements, such as requiring an attestation from a
highly qualified CISO as to the effectiveness of a Covered Entity's
cybersecurity practices in specific enumerated areas, could be quite
effective. Expert practitioners in cybersecurity are in high demand and
command high salaries.\908\ Thus, such an approach would impose
substantial ongoing costs on Covered Entities who do not already have
appropriately qualified individuals on staff. This burden would be
disproportionately borne by smaller Covered Entities, such as small
Covered Broker-Dealers or small transfer agents, for whom keeping a
dedicated CISO on staff would be cost prohibitive. Allowing Covered
Entities to employ part-time CISOs would mitigate this cost burden, but
such requirements would likely create a de facto audit regime. Such an
audit regime would certainly be more effective if explicitly designed
to function as such.\909\
---------------------------------------------------------------------------

    \908\ A recent survey reports CISO median total compensation of
$668,903 for CISOs at companies with revenues of $5 billion or less.
See Matt Aiello and Scott Thompson, 2020 North American Chief
Information Security Officer (CISO) Compensation Survey (2020),
available at https://www.heidrick.com/-/media/heidrickcom/publications-and-reports/2020-north-american-chief-information-security-officer-ciso-compensation-survey.pdf.
    \909\ In designing an effective audit regime, aligning
incentives of auditors to provide credible assessments is a central
concern. In the context of audit regimes, barriers to entry and the
reputation motives of auditing firms helps align incentives. It
would be considerably more difficult to obtain similar incentive
alignment with itinerant part-time CISOs. See section IV.F.1.e. of
this release (describing the audit regime alternative).
---------------------------------------------------------------------------

2. Alternatives to the Requirements of Proposed Form SCIR and Related
Notification and Disclosure Requirements of Proposed Rule 10
a. Public Disclosure of Part I of Proposed Form SCIR
    The Commission considered requiring the public disclosure of Part I
of proposed Form SCIR. Making Part I of proposed Form SCIR filings
public would increase the knowledge of a Covered Entity's customer,
counterparties, members, registrants, or users about significant
cybersecurity incidents impacting the Covered Entity and thus improve
their ability to draw inferences about a Covered Entity's level of
cybersecurity preparations. At the same time, doing so could assist
would-be threat actors, who may gain additional insight into the
vulnerabilities of a Covered Entity's system. As discussed above,
releasing too much detail about a significant cybersecurity incident
could further compromise cybersecurity of the victim, especially in the
short term.\910\ Given these risks, requiring public disclosure of Part
I of proposed Form SCIR filings would likely have the effect of
incentivizing Covered Entities to significantly reduce the detail
provided in these filings. As a result, the information set of
customers, counterparties, members, registrants, users, and would-be
attackers would remain largely unchanged (vis-[agrave]-vis the
proposal), while the ability of the Commission to facilitate
information sharing and to coordinate responses aimed at reducing
overall risks to the financial system would be diminished.
---------------------------------------------------------------------------

    \910\ See section IV.B. of this release.

---------------------------------------------------------------------------

b. Modify the Standard Identifier Requirements for Proposed Form SCIR
    In addition to proposing to require Covered Entities to identify
themselves on Parts I and II of proposed Form SCIR with CIK numbers,
the proposed rule requests that Covered Entities with a UIC--such as an
LEI--include that identifier, if available, on both parts of proposed
Form SCIR. Those Covered Entities that do not have a UIC may file
either part of proposed Form SCIR without a UIC; they are not required
to obtain a UIC prior to filing proposed Form SCIR.
    The Commission considered modifying the requirement that Covered
Entities identify themselves on proposed Form SCIR with CIK numbers and
UICs (if they have UICs). For example, the Commission could eliminate
the requirement that Covered Entities identify themselves on the forms
with a standard identifier, or the Commission could allow Covered
Entities to select a different standard identifier (or identifiers)
other than CIK numbers or UICs (if available). Alternatively, the
Commission could require the use of only one proposed standard
identifier--either CIK numbers, UICs (which would require Covered
Entities to obtain a UIC--such as an LEI--if they do not have
one),\911\ or some other standard identifier. While CIK numbers are
necessary to file in EDGAR and, as discussed earlier, the Commission
anticipates that significant benefits would flow from requiring Parts I
and II of proposed Form SCIR to be filed centrally in EDGAR using a
structured data language. Accordingly, the Commission's proposal would
require Covered Entities to identify themselves on the forms with CIK
numbers. One limitation of CIK numbers, however, is that they are a
Commission-specific identifier, which limits their utility for
aggregating, analyzing, and comparing financial market data involving
market participants that are not Commission registrants and EDGAR
filers.
---------------------------------------------------------------------------

    \911\ Further, the Commission recognizes that some Covered
Entities may not have LEIs, which means that those Covered Entities
would have to register with a Local Operating Unit (``LOU'') of the
Global LEI System and pay fees initially and annually to obtain and
renew the LEI. See LEIROC, How To Obtain an LEI, available at
https://www.leiroc.org/lei/how.htm. A list of LOUs accredited by
GLEIF can be found at https://www.gleif.org/en/about-lei/get-an-lei-find-lei-issuing-organizations. Currently, U.S. entities may obtain
an LEI for a one-time fee of $65 and an annual renewal fee of $50.
See Bloomberg Finance L.P., Fees, Payments & Taxes (2022), available
at https://lei.bloomberg.com/docs/faq#what-fees-are-involved.
---------------------------------------------------------------------------

    While the proposed rule does not require the inclusion of UICs on
proposed Form SCIR for those Covered Entities that do not have a UIC,
the Commission notes that the use of UICs would be beneficial because
the LEI, as a Commission-approved UIC, is a low-cost, globally-utilized
financial institution identifier that is available even to firms that
are not EDGAR filers or Commission registrants. For that reason, the
Commission considered proposing to require that every Covered Entity
that would need to file Part I or II of proposed Form SCIR to identify
themselves with a UIC. There is benefit to including a UIC identifier
on proposed Form SCIR. Among the alternative entity identifier policy
choices considered, requiring Covered Entities to identify themselves
on Parts I and II of proposed Form SCIR with a UIC is superior to other
alternatives, such as not requiring an entity identifier on proposed
Form SCIR or requiring only CIK numbers. Specifically, the mandatory
inclusion of a UIC on (Parts I and II of) proposed Form SCIR could
allow for greater inter-governmental and international coordination of
responses to cybersecurity incidents affecting financial institutions
globally because the LEI is a globally-utilized digital identifier that
is not specific to the Commission. Other regulatory entities and
bodies, including the CFTC, Alberta Securities Commission (Canada),
European Markets and Securities Authority, and Monetary Authority of
Singapore, require the use of an LEI.\912\ Another benefit of the LEI
is that the legal entity's identity is verified by a third party upon
issuance of the LEI and upon annual renewal of the LEI. Additionally,
LEIs contain ``Level 2'' information about the linkages between the
entities being identified and their various parents and subsidiaries,
which is particularly beneficial considering that some financial firms
and Commission registrants have complex, interlocking relationships
with affiliates and subsidiaries that can be different types of
Commission-regulated firms.
---------------------------------------------------------------------------

    \912\ In addition, the FSB has stated that ``[t]he use of the
LEI in regulatory reporting can significantly improve the ability of
the public sector to understand and identify the build-up of risk
across multiple jurisdictions and across complex global financial
processes.'' FSB Peer Review Report.
---------------------------------------------------------------------------

    A UIC requirement for Parts I and II of proposed Form SCIR would
not impose additional costs on those Covered Entities that already have
an LEI. For those Covered Entities that do not have an LEI, they would
need to obtain one before filing either part of proposed Form SCIR. An
LEI can be obtained for a $65 initial cost and a $50 per year renewal
cost.\913\ There also are administrative costs associated with filling
out the paperwork to obtain the LEI as well as to process payments for
the initial issuance of an LEI and its maintenance. The Commission
expects that this cost would be small relative to the benefit that
could be reaped if a significant cybersecurity incident were to occur
that impacted financial institutions across multiple domestic and
international jurisdictions.
    After considering the benefits and costs of requiring the LEI as an
identifier for all Covered Entities via a UIC requirement, the
Commission is proposing to require Covered Entities to identify
themselves with a UIC on proposed Form SCIR only if they already have a
UIC so as to minimize the burden on Covered Entities and because
multiple other Commission disclosure forms also only require
registrants to identify themselves with UICs if they already have
UICs.\914\ In conclusion, requiring Covered Entities to identify
themselves on both parts of proposed Form SCIR with a CIK and with a
UIC (i.e., the LEI) if they already have a UIC is consistent with the
existing regulatory framework.
---------------------------------------------------------------------------

    \914\ Covered Entities that do not have an LEI may obtain one if
they so choose.
---------------------------------------------------------------------------

    Although CIK numbers and UICs (such as in the form of LEIs) are the
primary two entity standard identifiers used in Commission regulations,
the Commission could instead propose to require Covered Entities to
identify themselves with an alternative entity identifier other than
CIK numbers and UICs for the proposed rule. For the reasons stated
above, there are benefits from the use of CIK numbers (i.e., CIK
numbers enable EDGAR filing, which facilitates aggregation and analysis
of the information) and LEIs (i.e., the LEI is an affordable,
international standard identifier that facilitates information
sharing). Accordingly, the Commission decided against proposing to
require the use of another standard entity identifier for the purposes
of this proposal.
c. Require Only One Location for the Public Disclosures
    Rather than requiring Covered Entities to publicly disclose their
cybersecurity risks and significant cybersecurity incidents during the
current or previous calendar year both on their websites and also file
that information centrally on Part II of proposed Form SCIR in EDGAR,
the Commission considered requiring that Covered Entities provide the
public disclosures on their websites only.
    Requiring Covered Entities to place the cybersecurity disclosures
only on their websites could provide modest,

incremental reductions in the burdens associated with providing those
disclosures both on Covered Entity websites and through filing Part II
of proposed Form SCIR with the Commission. Additionally, the websites
of Covered Entities might be the natural place for their customers,
counterparties, members, registrants, or users to look for information
about the Covered Entity. Alternatively, requiring Covered Entities to
place their cybersecurity disclosures (Part II of Form SCIR) only in
EDGAR in a structured data language also could provide modest,
incremental reductions in the burdens associated with placing those
disclosures on their websites.
    Accordingly, the Commission is proposing to require Covered
Entities to provide the information both on their websites and in EDGAR
on Part II of proposed Form SCIR.\915\ Publication on Covered Entity
websites is advantageous because that is where many Covered Entities'
customers, counterparties, members, registrants, or users will look for
information about their financial intermediaries. Centralized filing of
structured public disclosures of cybersecurity risks and significant
cybersecurity incidents during the current or previous calendar year in
EDGAR by Covered Entities would enable customers, counterparties,
members, registrants, and users, as well as financial analysts--and
even the Covered Entities themselves--to more efficiently discern broad
trends in cybersecurity risks and incidents, which would enable Covered
Entities and other market participants to more efficiently determine if
they need to modify, change, or upgrade their cybersecurity defense
measures in light of those trends. Accordingly, the Commission is
proposing to require Covered Entities to publish the required
cybersecurity disclosures on their websites and provide the information
in Part II of proposed Form SCIR, which would be filed in EDGAR using a
custom XML.
---------------------------------------------------------------------------

    \915\ The Commission is seeking comment on this topic. See
section II.B.3.c. of this release.
---------------------------------------------------------------------------

d. Modify the Location of the EDGAR-Filed Public Cybersecurity
Disclosures for Some Covered Entities
    Rather than requiring Covered Entities to provide the public
cybersecurity disclosures in EDGAR using Part II of proposed Form SCIR,
the Commission considered requiring Covered Entities that currently are
required to file forms in EDGAR to provide the disclosures in
structured attachments to existing EDGAR-filed forms. Currently, only
SBS Entities and transfer agents are required to file EDGAR forms.
SBSDs and MSBSPs must file in EDGAR registration applications on Form
SBSE, SBSE-A, or SBSE-BD, amendments to those Forms if the information
in them is or has become inaccurate, and certifications on Form SBSE-
C.\916\ As discussed above, Commission regulations require SBSDRs to
file Form SDR in EDGAR but the Commission temporarily relieved SBSDRs
of the EDGAR-filing requirement. Transfer agents file Forms TA-1, TA-2,
and TA-W in EDGAR in a custom XML.\917\ The Commission considered
permitting those types of Covered Entities that are not currently
subject to an EDGAR-filing requirement to file the cybersecurity
disclosures only on their individual firm websites (without needing to
also file the disclosures in EDGAR). Therefore, rather than requiring
all Covered Entities to file the cybersecurity disclosures using Part
II of proposed Form SCIR, the Commission could require Covered Entities
that are SBS Entities or transfer agents to provide the same
information as structured attachments to Form SBSE (for SBS Entities)
and Form TA-1 (for transfer agents). Likewise, the Commission could
require SBSDRs to file the cybersecurity disclosures as attachments to
Form SDR once the Commission temporary relief from the EDGAR-filing
requirement expires.
---------------------------------------------------------------------------

    \916\ See Instruction A.2 to Form SBSE, Instruction A.2 to Form
SBSE-A, Instruction A.3 to Form SBSE-BD, and Instruction A.2 to Form
SBSE-C.
    \917\ See Commission, Electronic Filing of Transfer Agent Forms
(Nov. 14, 2007), available at https://www.sec.gov/info/edgar/ednews/ta-filing.htm.
---------------------------------------------------------------------------

    Requiring all Covered Entities to provide the disclosures on a
single, uniform form would likely be simpler (because the information
would be in one location)--and thereby more efficient--for the
Commission, Covered Entities, and others who might seek the information
in the cybersecurity disclosures (including Covered Entities' users,
members, customers, or counterparties) than putting the cybersecurity
disclosures in attachments on disparate forms and (for those firms not
subject to EDGAR-filing requirements) on individual Covered Entity
websites.
e. Modify the Structured Data Requirement for the Public Cybersecurity
Disclosures
    Rather than requiring Covered Entities to file Part II of proposed
Form SCIR in EDGAR using a custom XML, the Commission could either
eliminate the structured data language requirement for some or all
Covered Entities or require the use of a different structured data
language, such as Inline XBRL.\918\ For example, the Commission could
eliminate the requirement that Covered Entities file Part II of
proposed Form SCIR in a custom XML or in any structured data language.
By eliminating the structured data requirement, the Commission would
allow Covered Entities to submit the new cybersecurity disclosures in
unstructured HTML or ASCII, thereby avoiding the need to put the
information for Part II of proposed Form SCIR into a fillable web form
that EDGAR would use to generate the custom XML filing, or instead file
Part II of proposed Form SCIR directly in custom XML using the XML
schema for proposed Form SCIR, as published on the Commission's
website.
---------------------------------------------------------------------------

    \918\ XBRL is a structured data language that is specifically
designed to handle business-related information, including financial
information, entity descriptions, corporate actions, ledgers and
sub-ledgers, and other summary and ledger-level information. By
comparison, Inline XBRL is a structured data language that embeds
XBRL data directly into an HTML document, enabling a single document
to provide both human-readable and structured machine-readable data.
---------------------------------------------------------------------------

    Another option is that the Commission could remove the structured
data filing requirement for some subset of Covered Entities. For
example, the Commission could instead require only certain types of
Covered Entities, such as national securities exchanges or SBS
Entities, to file Part II of proposed Form SCIR in a custom XML.
Alternatively, the Commission could require the use of a structured
data language only for those Covered Entities that exceeded some
threshold, be it assets or trading volumes, depending on the type of
Covered Entity in question. Eliminating the requirement that Part II of
proposed Form SCIR be filed in a structured data language, however,
would reduce the benefits of the proposed rule because the use of a
structured data language would make the information contained in Part
II of proposed Form SCIR easier and more efficient for Commission
staff--as well as the Covered Entity's customers, counterparties,
members, registrants, or users--to assemble, review, and analyze.
Financial analysts at third-party information providers also could use
the public disclosures to produce analyses and reports that market
participants may find useful.
    The Commission could require Covered Entities to file Part II of
proposed Form SCIR in Inline XBRL rather than in custom XML on the
grounds that Inline XBRL is an internationally-recognized freely
available industry standard for reporting business-related information
and a data

language that allows EDGAR filers to prepare single documents that are
both human-readable and machine-readable, particularly in connection
with forms containing publicly-available registrant financial
statements. The Commission believes that the use of a form-specific XML
would be appropriate here given the relative simplicity of Part II of
proposed Form SCIR disclosures and the ability for EDGAR to provide
fillable web forms for entities to comply with their custom XML
requirements, leading to a lower burden of compliance for Covered
Entities without Inline XBRL experience.
3. General Request for Comment
    The Commission requests comment on the benefits and costs
associated the alternatives outlined above.

V. Paperwork Reduction Act Analysis

    Certain provisions of the proposed rule, form, and rule amendments
in this release would contain a new ``collection of information''
within the meaning of the Paperwork Reduction Act of 1995
(``PRA'').\919\ The Commission is submitting the proposed rule
amendments and proposed new rules to the Office of Management and
Budget (``OMB'') for review and approval in accordance with the PRA and
its implementing regulations.\920\ An agency may not conduct or
sponsor, and a person is not required to respond to a collection of
information unless it displays a currently valid OMB control
number.\921\ The titles for the collections of information are:
---------------------------------------------------------------------------

    \919\ See 44 U.S.C. 3501 et seq.
    \920\ See 44 U.S.C. 3507; 5 CFR 1320.11.
    \921\ See 5 CFR 1320.11(l).
---------------------------------------------------------------------------

    (1) Rule 10;
    (2) Form SCIR;
    (3) Rule 17a-4--Records to be preserved by certain exchange
members, brokers and dealers (OMB control number 3235-0279);
    (4) Rule 17ad-7--Record retention (OMB control number 3235-0291);
    (5) Rule 18a-6--Records to be preserved by certain security-based
swap dealers and major security-based swap participants (OMB control
number 3235-0751); and
    (6) Rule 3a71-6--Substituted Compliance for Foreign Security-Based
Swap Entities (OMB control number 3235-0715).
    The burden estimates contained in this section do not include any
other possible costs or economic effects beyond the burdens required to
be calculated for PRA purposes.

A. Summary of Collections of Information

1. Proposed Rule 10
    Proposed Rule 10 would require all Market Entities (Covered
Entities and non-Covered Entities) to establish, maintain, and enforce
written policies and procedures that are reasonably designed to address
their cybersecurity risks.\922\ All Market Entities also, at least
annually, would be required to review and assess the design and
effectiveness of their cybersecurity policies and procedures, including
whether the policies and procedures reflect changes in cybersecurity
risk over the time period covered by the review.\923\ They also would
be required to prepare a report (in the case of Covered Entities) and a
record (in the case of non-Covered Entities) with respect to the annual
review.\924\ Finally, all Market Entities would need to give the
Commission immediate written electronic notice of a significant
cybersecurity incident upon having a reasonable basis to conclude that
the significant cybersecurity incident has occurred or is
occurring.\925\
---------------------------------------------------------------------------

    \922\ See paragraphs (b) through (d) of proposed Rule 10
(setting forth the requirements for Market Entities that meet the
definition of ``covered entity''); paragraph (e)(1) of proposed Rule
10. See also Sections II.B.1 and II.C. of this release (discussing
these proposed requirements in more detail).
    \923\ See paragraph (b)(2) of proposed Rule 10; paragraph (e)(1)
of proposed Rule 10. See also Sections II.B.1.f. and II.C. of this
release (discussing these proposed requirements in more detail).
    \924\ See paragraph (b)(2) of proposed Rule 10; paragraph (e)(1)
of proposed Rule 10. See also Sections II.B.1.f. and II.C. of this
release (discussing these proposed requirements in more detail).
    \925\ See paragraph (c)(1) of proposed Rule 10; paragraph (e)(2)
of proposed Rule 10. See also sections II.B.2.a. and II.C. of this
release (discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

    Market Entities that meet the definition of ``covered entity''
would be subject to certain additional requirements under proposed Rule
10.\926\ First, their cybersecurity risk management policies and
procedures would need to include the following elements:
---------------------------------------------------------------------------

    \926\ See paragraph (b) through (d) of proposed Rule 10 (setting
forth the requirements for Market Entities that meet the definition
of ``covered entity''); paragraph (e) of proposed Rule 10 (setting
forth the requirements for Market Entities that do not meet the
definition of ``covered entity'').
---------------------------------------------------------------------------

     Periodic assessments of cybersecurity risks associated
with the Covered Entity's information systems and written documentation
of the risk assessments;
     Controls designed to minimize user-related risks and
prevent unauthorized access to the Covered Entity's information
systems;
     Measures designed to monitor the Covered Entity's
information systems and protect the Covered Entity's information from
unauthorized access or use, and oversight of service providers that
receive, maintain, or process information, or are otherwise permitted
to access the Covered Entity's information systems;
     Measures to detect, mitigate, and remediate any
cybersecurity threats and vulnerabilities with respect to the Covered
Entity's information systems; and
     Measures to detect, respond to, and recover from a
cybersecurity incident and written documentation of any cybersecurity
incident and the response to and recovery from the incident.\927\
---------------------------------------------------------------------------

    \927\ See sections II.B.1.a. through II.B.1.e. of this release
(discussing these proposed requirements in more detail). In the case
of non-Covered Entities, as discussed in more detail below in
Section II.C. of this release, the design of the cybersecurity risk
management policies and procedures would need to take into account
the size, business, and operations of the broker-dealer. See
paragraph (e) of proposed Rule 10.
---------------------------------------------------------------------------

    Second, Covered Entities--in addition to providing the Commission
with immediate written electronic notice of a significant cybersecurity
incident--would need to report and update information about the
significant cybersecurity incident by filing Part I of proposed Form
SCIR with the Commission through the EDGAR system.\928\ The form would
elicit information about the significant cybersecurity incident and the
Covered Entity's efforts to respond to, and recover from, the incident.
---------------------------------------------------------------------------

    \928\ See sections II.B.2. and II.B.4. of this release
(discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

    Third, Covered Entities would need to publicly disclose summary
descriptions of their cybersecurity risks and the significant
cybersecurity incidents they experienced during the current or previous
calendar year on Part II of proposed Form SCIR.\929\ The form would
need to be filed with the Commission through the EDGAR system and
posted on the Covered Entity's business internet website and, in the
case of Covered Entities that are carrying or introducing broker-
dealers, provided to customers at account opening and annually
thereafter.
---------------------------------------------------------------------------

    \929\ See sections II.B.3. and II.B.4.of this release
(discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

    Covered Entities and Non-Covered Entities would need to preserve
certain records relating to the requirements of proposed Rule 10 in
accordance with amended or existing recordkeeping requirements
applicable to them or, in the case of exempt clearing agencies,

pursuant to conditions in relevant exemption orders.\930\
---------------------------------------------------------------------------

    \930\ See sections II.B.5. and II.C. of this release (discussing
these proposed requirements in more detail).
---------------------------------------------------------------------------

2. Form SCIR
    Proposed Rule 10 would require Covered Entities to: (1) report and
update information about a significant cybersecurity incident; \931\
and (2) publicly disclose summary descriptions of their cybersecurity
risks and the significant cybersecurity incidents they experienced
during the current or previous calendar year.\932\ Parts I and II of
proposed Form SCIR would be used by Covered Entities, respectively, to
report and update information about a significant cybersecurity
incident and publicly disclose summary descriptions of their
cybersecurity risks and the significant cybersecurity incidents they
experienced during the current or previous calendar year.
---------------------------------------------------------------------------

    \931\ See sections II.B.2. and II.B.4. of this release
(discussing these proposed requirements in more detail).
    \932\ See sections II.B.3. and II.B.4.of this release
(discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

3. Rules 17a-4, 17ad-7, 18a-6 and Clearing Agency Exemption Orders
    Rules 17a-4, 17ad-7, and 18a-6--which apply to broker-dealers,
transfer agents, and SBS Entities, respectively--would be amended to
establish preservation and maintenance requirements for the written
policies and procedures, annual reports, Parts I and II of proposed
Form SCIR, and records required to be made pursuant to proposed Rule 10
(i.e., the Rule 10 Records).\933\ The proposed amendments would specify
that the Rule 10 Records must be retained for three years. In the case
of the written policies and procedures to address cybersecurity risks,
the record would need to be maintained until three years after the
termination of the use of the policies and procedures. In addition,
orders exempting certain clearing agencies from registering with the
Commission would be amended to establish preservation and maintenance
requirements for the Rule 10 Records that would apply to the exempt
clearing agencies subject to those orders.\934\ The amendments to the
orders would provide that the records need to be retained for five
years (consistent with Rules 13n-7 and 17a-1).\935\ In the case of the
written policies and procedures to address cybersecurity risks, the
record would need to be maintained until five years after the
termination of the use of the policies and procedures.
---------------------------------------------------------------------------

    \933\ See sections II.B.5. and II.C. of this release (discussing
these proposed amendments in more detail). Rule 17a-4 sets forth
record preservation and maintenance requirements for broker-dealers,
Rule 17ad-7 sets forth record preservation and maintenance
requirements for transfer agents, and Rule 18a-6 sets forth record
preservation and maintenance requirements for SBS Entities.
    \934\ See section II.B.5. of this release (discussing these
proposed amendments in more detail).
    \935\ For the reasons discussed in section II.B.5.a. of this
release, the proposal would not amend Rules 13n-7 or 17a-1. As
explained in that section of the release, the existing requirements
of Rule 13n-7 (which applies to SBSDRs) and Rule 17a-1 (which
applies to registered clearing agencies, the MSRB, national
securities associations, and national securities exchanges) will
require these Market Entities to retain the Rule 10 Records for five
years and, in the case of the written policies and procedures, for
five years after the termination of the use of the policies and
procedures.
---------------------------------------------------------------------------

4. Substituted Compliance (Rule 3a71-6)
    Paragraph (d)(1) of Rule 3a71-6 would be amended to add proposed
Rule 10 and Form SCIR to the list of Commission requirements eligible
for a substituted compliance determination.\936\ If adopted, this
amendment together with existing paragraph (d)(6) of Rule 3a71-6 would
permit eligible SBS Entities to file an application requesting that the
Commission make a determination that compliance with specified
requirements under a foreign regulatory system may satisfy the
requirements of proposed Rule 10, Form SCIR, and the related record
preservation requirements. As provided by Exchange Act Rule 0-13,\937\
which the Commission adopted in 2014,\938\ applications for substituted
compliance determinations must be accompanied by supporting
documentation necessary for the Commission to make the determination,
including information regarding applicable requirements established by
the foreign financial regulatory authority or authorities, as well as
the methods used by the foreign financial regulatory authority or
authorities to monitor and enforce compliance; applications should cite
to and discuss applicable precedent.\939\
---------------------------------------------------------------------------

    \936\ See section II.D. of this release (discussing these
proposed amendments in more detail).
    \937\ 17 CFR 240.0-13.
    \938\ See SBS Entity Definitions Adopting Release, 79 FR at
47357-59.
    \939\ See 17 CFR 240.0-13(e). In adopting Rule 0-13, the
Commission noted that because Rule 0-13 was a procedural rule that
did not provide any substituted compliance rights, ``collections of
information arising from substituted compliance requests, including
associated control numbers, [would] be addressed in connection with
any applicable substantive rulemakings that provide for substituted
compliance.'' See SBS Entity Definitions Adopting Release, 79 FR at
47366 n.778.
---------------------------------------------------------------------------

B. Proposed Use of Information

    The proposed requirements to have written policies and procedures
to address cybersecurity risks, to document risk assessments and
significant cybersecurity incidents, to create a report or record of
the annual review of the policies and procedures, to provide immediate
notification and subsequent reporting of significant cybersecurity
incidents, to publicly disclose summary descriptions of cybersecurity
risks and significant cybersecurity incidents, and to preserve the
written policies and procedures, reports, and records would constitute
collection of information requirements under the PRA. Collectively,
these collections of information are designed to address cybersecurity
risk and the threat it poses to Market Entities and the U.S. securities
markets.
    Market Entities would use the written policies and procedures, the
records required to be made pursuant to those policies and procedures,
and the report or record of the annual review of the policies and
procedures to address the specific cybersecurity risks to which they
are exposed. The Commission could use the written policies and
procedures, reports, and records to review Market Entities' compliance
with proposed Rule 10.
    Market Entities would use the immediate written electronic
notifications to notify the Commission (and, in some cases, other
regulators) about significant cybersecurity incidents they experience
pursuant to proposed Rule 10. The Commission could use the immediate
written electronic notification to promptly begin to assess the
situation by, for example, when warranted, assessing the Market
Entity's operating status and engaging in discussions with the Market
Entity to understand better what steps it is taking to protect its
customers, counterparties, members, registrants, or users.
    Covered Entities would use Part I of proposed Form SCIR to report
to the Commission (and, in some cases, other regulators) significant
cybersecurity incidents they experienced pursuant to proposed Rule 10.
The Commission could use the reports of significant cybersecurity
incidents filed using Part I of proposed Form SCIR to understand better
the nature and extent of a particular significant cybersecurity
incident and the efficacy of the Covered Entity's response to mitigate
the disruption and harm caused by the incident. The Commission staff
could use the reports to focus on the Covered Entity's operating status
and to facilitate their outreach to, and discussions with,

personnel at the Covered Entity who are addressing the significant
cybersecurity incident. In addition, the reporting would provide the
staff with a view into the Covered Entity's understanding of the scope
and impact of the significant cybersecurity incident. All of this
information would be used by the Commission and its staff in assessing
the significant cybersecurity incident impacting the Covered Entity.
Further, the Commission would be use the database of reports to assess
the potential cybersecurity risks affecting U.S. securities markets
more broadly. This information could be used to address future
significant cybersecurity incidents. For example, these reports could
assist the Commission in identifying patterns and trends across Covered
Entities, including widespread cybersecurity incidents affecting
multiple Covered Entities at the same time. Further, the reports could
be used to evaluate the effectiveness of various approaches to respond
to and recover from a significant cybersecurity incident.
    Covered Entities would use Part II of proposed Form SCIR to
publicly disclose summary descriptions of their cybersecurity risks and
the significant cybersecurity incidents they experienced during the
current or previous calendar year pursuant to proposed Rule 10. These
disclosures would be used to provide greater transparency to customers,
counterparties, registrants, or members of the Covered Entity, or to
users of its services, about the Covered Entity's cybersecurity risk
profile. This information could be used by these persons to manage
their own cybersecurity risk and, to the extent they have choice,
select a Covered Entity with whom to transact or otherwise conduct
business. In addition, because the reports would be filed through
EDGAR, Covered Entities' customers, counterparties, members,
registrants, or users would be able to run search queries to compare
the disclosures of multiple Covered Entities. This would make it easier
for Commission staff and others to assess the cybersecurity risk
profiles of different types of Covered Entities and could facilitate
trend analysis by members of the public of significant cybersecurity
incidents.
    Under the proposed amendment to Rule 3a71-6, the Commission would
use the information collected to evaluate requests for substituted
compliance with respect to proposed Rule 10, Form SCIR, and the related
record preservation requirements applicable to SBS Entities. Consistent
with Exchange Act Rule 0-13(h),\940\ the Commission would publish in
the Federal Register a notice that a complete application had been
submitted, and provide the public the opportunity to submit to the
Commission any information that relates to the Commission action
requested in the application, subject to appropriate requests for
confidential treatment being submitted pursuant to any applicable
provisions governing confidentiality under the Exchange Act.\941\
---------------------------------------------------------------------------

    \940\ 17 CFR 240.0-13(h).
    \941\ See section V.F of this release.
---------------------------------------------------------------------------

C. Respondents

    The following table summarizes the estimated number of respondents
that would be subject to the proposed Rule 10, Form SCIR, and
recordkeeping burdens.

------------------------------------------------------------------------
                   Type of registrant                         Number
------------------------------------------------------------------------
Covered Broker-Dealers..................................           1,541
Non-Covered Broker-Dealers..............................           1,969
Clearing agencies and exempt clearing agencies..........              16
MSRB....................................................               1
National securities exchanges...........................              24
National securities associations........................               1
SBS Entities............................................              50
SBSDRs..................................................               3
Transfer agents.........................................             353
                                                         ---------------
    Total Covered Entities..............................           1,989
    Total Non-Covered Broker-Dealers....................           1,969
    Total Respondents...................................           3,958
------------------------------------------------------------------------

    The respondents subject to these collection of information
requirements include the following:
1. Broker-Dealers
    Each broker-dealer registered with the Commission would be subject
to proposed Rule 10 as either a Covered Entity or a Non-Covered Broker-
Dealer. As of September 30, 2022, there were 3,510 broker-dealers
registered with the Commission.\942\ The Commission estimates that
1,541 of these broker-dealers would be Covered Entities under the
proposed rule because they fit within one or more of the following
categories: carrying broker-dealer; broker-dealer that introduces
customer accounts to a carrying broker-dealer on a fully disclosed
basis; broker-dealer with regulatory capital equal to or exceeding $50
million; broker-dealer with total assets equal to or exceeding $1
billion; broker-dealer that operates as a market maker under the
securities laws; or a broker-dealer that operates as an ATS.\943\ The
Commission estimates that 1,969 broker-dealers (i.e., the remaining
broker-dealers registered with/the Commission) would be Non-Covered
Broker-Dealers for purposes of the rules.
---------------------------------------------------------------------------

    \942\ This estimate is derived from broker-dealer FOCUS filings
and ATS Form ATS-R quarterly reports as of September 30, 2022.
    \943\ Id.
---------------------------------------------------------------------------

2. Clearing Agencies
    With regard to clearing agencies, respondents under these rules
are: (1) nine registered clearing agencies; \944\ and (2) five exempt
clearing agencies.\945\ The Commission estimates for purposes of the
PRA that two additional entities may seek to register as a clearing
agency in the next three years, and so for purposes of this proposal
the Commission has assumed sixteen total

clearing agency and exempt clearing agency respondents.
---------------------------------------------------------------------------

    \944\ The registered and active clearing agencies are: (1) DTC;
(2) FICC; (3) NSCC; (4) ICC; (5) ICEEU; (6) the Options Clearing
Corp.; and (7) LCH SA. The clearing agencies that are registered
with the Commission but conduct no clearance or settlement
operations are: (1) BSECC; and (2) SCCP.
    \945\ The exempt clearing agencies that provide matching
services are: (1) DTCC ITP Matching U.S. LLC; (2) Bloomberg STP LLC;
(3) SS&C Technologies, Inc.; (4) Euroclear Bank SA/NV; and (5)
Clearstream Banking, S.A.
---------------------------------------------------------------------------

3. The MSRB
    The sole respondent to the proposed collection of information for
the MSRB is the MSRB itself.
4. National Securities Exchanges and National Securities Associations
    The respondents to the proposed collections of information for
national securities exchanges and national securities associations
would be the 24 national securities exchanges currently registered with
the Commission under section 6 of the Exchange Act,\946\ and the one
national securities association currently registered with the
Commission under section 15A of the Exchange Act.\947\
---------------------------------------------------------------------------

    \946\ See 15 U.S.C. 78f. The national securities exchanges
registered with the Commission are: (1) BOX Options Exchange LLC;
(2) Cboe BZX Exchange, Inc.; (3) Cboe BYX Exchange, Inc.; (4) Cboe
C2 Exchange, Inc.; (5) Cboe EDGA Exchange, Inc.; (6) Cboe EDGX,
Inc.; (7) Cboe Exchange, Inc.; (8) Investors Exchange Inc.; (9)
Long-Term Stock Exchange, Inc.; (10) MEMX, LLC; (11) Miami
International Securities Exchange LLC; (12) MIAX PEARL, LLC; (13)
MIAX Emerald, LLC; (14) NASDAQ BX, Inc.; (15) NASDAQ GEMX, LLC; (16)
NASDAQ ISE, LLC; (17) NASDAQ MRX, LLC; (18) NASDAQ PHLX LLC; (19)
The NASDAQ Stock Market LLC; (20) New York Stock Exchange LLC; (21)
NYSE MKT LLC; (22) NYSE Arca, Inc.; (23) NYSE Chicago Stock
Exchange, Inc.; and (24) NYSE National, Inc.
    \947\ See 15 U.S.C. 78o-3. The one national securities
association registered with the Commission is FINRA.
---------------------------------------------------------------------------

5. SBS Entities
    As of January 4, 2023, 50 SBSDs have registered with the
Commission, while no MSBSPs have registered with the Commission.\948\
Of the 50 SBSDs that have registered with the Commission, 7 entities
are also broker-dealers.\949\
---------------------------------------------------------------------------

    \948\ See List of Registered Security-Based Swap Dealers and
Major Security-Based Swap Participants, available at: https://www.sec.gov/tm/List-of-SBS-Dealers-and-Major-SBS-Participants.
    \949\ A Covered Entity that is both a broker-dealer and an SBS
Entity (which includes all seven of these broker-dealers) will have
burdens with respect to the proposed rule, Form SCIR, and
recordkeeping amendments as they apply to both its broker-dealer
business and its security-based swap business. Therefore, such
``dual-hatted'' entities will be counted as both Covered Entities
that are broker-dealers and as SBS Entities for purposes of the PRA.
---------------------------------------------------------------------------

    Requests for a substituted compliance determination under Rule
3a71-6 with respect to the proposed Rule 10, Form SCIR, and the related
record preservation requirements may be filed by foreign financial
authorities, or by non-U.S. SBSDs or MSBSPs. The Commission had
previously estimated that there may be approximately 22 non-U.S.
entities that may potentially register as SBSDs, out of approximately
50 total entities that may register as SBSDs.\950\ Potentially all non-
U.S. SBSDs, or some subset thereof, may seek to rely on a substituted
compliance determination in connection with the proposed cybersecurity
risk management requirements.\951\ However, the Commission had expected
that the great majority of substituted compliance applications would be
submitted by foreign authorities \952\ given their expertise in
connection with the relevant substantive requirements, and in
connection with their supervisory and enforcement oversight with regard
to SBSDs and their activities.\953\ The Commission expected that very
few substituted compliance requests would come from SBS Entities.\954\
For purposes of PRA assessments, the Commission estimated that three
SBS Entities would submit such applications.\955\ Although, as of
January 4, 2023, 30 entities had identified themselves as a nonresident
SBSD in their application for registration with the Commission,\956\
the Commission has issued only one order in response to a request for
substituted compliance from potential registrants.\957\ The Commission
continues to believe that its estimate that three such entities will
submit applications remains appropriate for purposes of this PRA
assessment because applicants may file additional requests.
---------------------------------------------------------------------------

    \950\ See Proposed Rule Amendments and Guidance Addressing
Cross-Border Application of Certain Security-Based Swap
Requirements, Exchange Act Release No. 85823 (May 10, 2019), 84 FR
24206, 24253 (May 24, 2019). See also Security-Based Swap
Transactions Connected With a Non-U.S. Person's Dealing Activity
That Are Arranged, Negotiated, or Executed by Personnel Located in a
U.S. Branch or Office or in a U.S. Branch or Office of an Agent;
Security-Based Swap Dealer De Minimis Exception, Exchange Act
Release No. 77104 (Feb. 10, 2016), 81 FR 8597, 8605 (Feb. 19, 2016)
(``SBS Entity U.S. Activity Adopting Release''); Business Conduct
Standards Adopting Release, 81 FR at 30090, 30105; SBS Entity
Recordkeeping and Reporting Release, 84 FR at 68607-09; and Capital,
Margin, and Segregation Requirements Adopting Release, 84 FR at
43960-61.
    \951\ Consistent with prior estimates, the Commission further
believes that there may up to five MSBSPs. See Registration Process
for Security-Based Swap Dealers and Major Security-Based Swap
Participants, Exchange Act Release No. 75611 (Aug. 5, 2015), 80 FR
48963, 48990 (Aug. 14, 2015) (``SBS Entity Registration Adopting
Release''); see also SBS Entity Business Conduct Standards Adopting
Release, 81 FR at 30089, 30099. It is possible that some subset of
those entities will be non-U.S. MSBSPs that will seek to rely on
substituted compliance in connection with proposed Rule 10, Form
SCIR, and the related record preservation requirements.
    \952\ See SBS Entity Risk Mitigation Adopting Release, 85 FR at
6389. See also SBS Entity Business Conduct Standards Adopting
Release, 81 FR at 30097; SBS Entity Trade Acknowledgement and
Verification Adopting Release, 81 FR at 39832.
    \953\ See SBS Entity Risk Mitigation Adopting Release, 85 FR at
6384. See also SBS Entity Business Conduct Standards Adopting
Release, 81 FR at 30090; SBS Entity Trade Acknowledgement and
Verification Adopting Release, 81 FR at 39832.
    \954\ See SBS Entity Risk Mitigation Adopting Release, 85 FR at
6389. See also SBS Entity Business Conduct Standards Adopting
Release, 81 FR at 30097, n.1582 and accompanying text; SBS Entity
Trade Acknowledgement and Verification Adopting Release, 81 FR at
39832.
    \955\ Id. See also SBS Entity Recordkeeping and Reporting
Adopting Release, 84 FR at 68609; Capital, Margin, and Segregation
Requirements Adopting Release, 84 FR at 43967.
    \956\ No entity has registered as an MSBSP. See List of
Registered Security-Based Swap Dealers and Major Security-Based Swap