\436\ See 17 CFR 242.1001(a)(4).
---------------------------------------------------------------------------

    Rule 1001(b) of Regulation SCI requires each SCI entity to
establish, maintain, and enforce written policies and procedures
reasonably designed to ensure that its SCI systems operate in a manner
that complies with the Exchange Act and the rules and regulations
thereunder and the entity's rules and governing documents, as
applicable, and specifies certain minimum requirements for such
policies and procedures.\437\ Rule 1001(c) of Regulation SCI requires
SCI entities to establish, maintain, and enforce reasonably designed
written policies and procedures that include the criteria for
identifying responsible SCI personnel, the designation and
documentation of responsible SCI personnel, and escalation procedures
to quickly inform responsible SCI personnel of potential SCI
events.\438\
---------------------------------------------------------------------------

    \437\ See 17 CFR 242.1001(b).
    \438\ See 17 CFR 242.1001(c).
---------------------------------------------------------------------------

    The Commission is proposing revisions to Rule 1001(a)(2) and (4) of
Regulation SCI to include four additional elements in the policies and
procedures: (1) the maintenance of a written inventory of all SCI
systems, critical SCI systems, and indirect SCI systems, including a
lifecycle management program with respect to such systems; (2) a
program to manage and oversee third-party providers that includes an
initial and periodic review of contracts with third-party providers and
a risk-based assessment of each third-party provider's criticality to
the SCI entity; (3) a program to prevent unauthorized SCI system
access; and (4) identification of the SCI industry standard with which
such policies and procedures are consistent, if any. The Commission
also proposes to amend the existing requirements in Rule 1001(a)(2)(v)
for the BC/DR plan to include the requirement to maintain backup and
recovery capabilities that are reasonably designed to address the
unavailability of any third-party provider without which there would be
a material impact on any of its critical SCI systems.
    The requirement to have a third-party provider management program
would help ensure that any third-party provider an SCI entity selects
is able to support the SCI entity's compliance with Regulation SCI's
requirements.
    Additionally, the proposed revisions would ensure SCI entities are
creating an inventory of their SCI systems, critical SCI systems, and
indirect SCI systems and have a lifecycle management program for such
systems, which would ensure that SCI entities are able to identify when
a system becomes an SCI system or indirect SCI system and when it
ceases to be one. Next, the revisions would require SCI entities to
have in place a program to prevent unauthorized SCI system access. The
existing collections of information, which would be extended to new SCI
entities would advance the goals of promoting the maintenance of fair
an orderly markets and improving Commission review and oversight of
U.S. securities market infrastructure. The proposed additional
collections of information would advance these same goals.
2. Rule 1002 of Regulation SCI
    Under Rule 1002 of Regulation SCI, SCI entities have certain
obligations regarding SCI events. Rule 1002(a) requires an SCI entity
to begin to take appropriate corrective action when any responsible SCI
personnel has a reasonable basis to conclude that an SCI event has
occurred. The corrective action must include, at a minimum, mitigating
potential harm to investors and market integrity resulting from the SCI
event and devoting adequate resources to remedy the SCI event as soon
as reasonably practicable.\439\ Rule 1002(b)(1) requires each SCI
entity to immediately notify the Commission of an SCI event.\440\ Under
17 CFR 242.1002(b)(2) (``Rule 1002(b)(2)''), each SCI entity is
required, within 24 hours of any responsible SCI personnel having a
reasonable basis to conclude that the SCI event has occurred, to submit
a written notification to the Commission pertaining to the SCI event
that includes a description of the SCI event and the system(s)
affected, with other information required to the extent available at
the time.\441\ Under 17 CFR 242.1002(b)(3) (``Rule 1002(b)(3)''), each
SCI entity is required to provide regular updates regarding the SCI
event until the event is resolved.\442\ Under 17 CFR 242.1002(b)(4)(i)
(``Rule 1002(b)(4)(i)''), each SCI entity is required to submit written
interim reports, as necessary, and a written final report regarding an
SCI event to the Commission.\443\ Under 17 CFR 242.1002(b)(4)(ii)
(``Rule 1002(b)(4)(ii)''), the information that is required to be
included in the interim and final written reports is set forth,
including the SCI entity's assessment of the types and number of market
participants affected by the SCI event and the impact of the SCI event
on the market, and a copy of any information disseminated pursuant to
Rule 1002(c) regarding the SCI event to the SCI entity's members or
participants. For any SCI event that ``has had, or the SCI entity
reasonably estimates would have, no or a de minimis impact on the SCI
entity's operations or on market participants,'' Rule 1002(b)(5)
provides an exception to the general Commission notification
requirements under Rule 1002(b) Instead, an SCI entity must make, keep,
and preserve records relating to all such SCI events, and submit a
quarterly report to the Commission regarding any such events that are
systems disruptions or systems intrusions. SCI events that are reported
immediately and later determined to have a de minimis impact may be
reclassified as de minimis.\444\
---------------------------------------------------------------------------

    \439\ See 17 CFR 242.1002(a).
    \440\ See 17 CFR 242.1002(b)(1).
    \441\ See 17 CFR 242.1002(b)(2).
    \442\ See 17 CFR 242.1002(b)(3).
    \443\ See 17 CFR 242.1002(b)(4).
    \444\ See 17 CFR 242.1002(b)(5).
---------------------------------------------------------------------------

    Rule 1002(c) of Regulation SCI requires that SCI entities
disseminate information to their members or participants regarding SCI
events.\445\ Under 17 CFR 242.1002(c)(1)(i) (``Rule 1002(c)(1)(i)''),
each SCI entity is required, promptly after any responsible SCI
personnel has a reasonable basis to conclude that an SCI event (other
than a systems intrusion) has occurred, to disseminate certain
information to its members or participants. Under 17 CFR
242.1002(c)(1)(ii) (``Rule 1002(c)(1)(ii)''), each SCI entity is
required, when

known, to disseminate additional information about an SCI event (other
than a systems intrusion) to its members or participants promptly.
Under 17 CFR 242.1002(c)(1)(iii) (``Rule 1002(c)(1)(iii)''), each SCI
entity is required to provide to its members or participants regular
updates of any information required to be disseminated under Rule
1002(c)(1)(i) and (ii) until the SCI event is resolved. Rule 1002(c)(2)
requires each SCI entity to disseminate certain information regarding a
systems intrusion to its members or participants. For ``major SCI
events,'' these disseminations must be made to all of its members or
participants. For SCI events that are not ``major SCI events,'' SCI
entities must disseminate such information to those SCI entity members
and participants reasonably estimated to have been affected by the
event.\446\ In addition, dissemination of information to members or
participants is permitted to be delayed for systems intrusions if such
dissemination would likely compromise the security of the SCI entity's
systems or an investigation of the intrusion and documents the reasons
for such determination.\447\ Rule 1002(c)(4) of Regulation SCI provides
exceptions to the dissemination requirements under Rule 1002(c) of
Regulation SCI for SCI events to the extent they relate to market
regulation or market surveillance systems and SCI events that have had,
or the SCI entity reasonably estimates would have, no or a de minimis
impact on the SCI entity's operations or on market participants.\448\
Rule 1000 sets out the definition of systems intrusion, which means any
unauthorized entry into the SCI systems or indirect SCI systems of an
SCI entity.
---------------------------------------------------------------------------

    \445\ See 17 CFR 242.1002(c).
    \446\ See 17 CFR 242.1002(c)(3).
    \447\ See 17 CFR 242.1002(c)(2).
    \448\ See 17 CFR 242.1002(c)(4).
---------------------------------------------------------------------------

    The Commission proposes to amend the definition of systems
intrusion in Rule 1000 to include cybersecurity events that disrupt, or
significantly degrade, the normal operation of an SCI system and
significant attempted unauthorized entries into the SCI systems or
indirect SCI systems of an SCI entity, as determined by the SCI entity
pursuant to established reasonable written criteria. SCI entities would
be required to report information concerning these systems intrusions
pursuant to Rule 1002(b). The Commission believes that it is
appropriate to expand the definition of systems intrusion to include
two additional types of cybersecurity events that are currently not
part of the current definition as described above. The additional
notifications that would result from the proposed revised definition of
systems intrusion would provide the Commission and its staff more
complete information to assess the security status of the SCI entity,
and also assess the impact or potential impact that unauthorized
activity could have on the security of the SCI entity's affected
systems as well on other SCI entities and market participants.
    The proposed revisions to Rule 1002(b) would eliminate the de
minimis exception's applicability to systems intrusions, thus requiring
all systems intrusions, whether de minimis or non-de minimis, to be
reported pursuant to Rule 1002(b)(1) through (4). The Commission would
also amend the information required under Rule 1002(b)(4)(ii) to be
included in the interim and final written notifications to include a
copy of any information disseminated pursuant to Rule 1002(c) by an SCI
broker-dealer to its customers. The Commission would use this
information to be aware of potential and actual security threats to SCI
entities, including threats that may extend to other market
participants in the securities markets, including other SCI entities.
    As a result of the amendment to the definition of systems
intrusions, SCI entities would be required to disseminate information
to members and participants pursuant to Rule 1002(c)(2) concerning
cybersecurity events not currently covered by the rule. This would have
the effect of increasing the number of SCI events that would be
required to be disseminated. Further, in connection with expansion of
Regulation SCI to SCI broker-dealers, amended Rule 1002(c)(3) would
require that SCI broker-dealers promptly disseminate information about
major SCI events to all of its customers and, for SCI events that are
not major SCI events, to customers that any responsible SCI personnel
subsequently reasonably estimates may have been affected by the SCI
event. Such information would be used by the SCI entity's members and
participants, and in the case of an SCI broker-dealer, its customers,
to understand better the threats faced by the SCI entity, evaluate the
event's impact on their trading or other business with the SCI entity
and formulate a response, thereby advance the Commission's goal of
promoting fair and orderly markets and investor protection. The
proposed revisions to Rule 1002(c), however, would exclude systems
intrusions that are significant attempted unauthorized entries into the
SCI systems or indirect SCI systems of an SCI entity from the
information dissemination requirements of Rule 1002(c)(1) through
(3).\449\
---------------------------------------------------------------------------

    \449\ See proposed amended Rule 1002(c)(4).
---------------------------------------------------------------------------

3. Rule 1003 of Regulation SCI
    Rule 1003(a) establishes reporting burdens for all SCI entities.
Rule 1003(a)(1) requires each SCI entity to submit to the Commission
quarterly reports describing completed, ongoing, and planned material
changes to its SCI systems and security of indirect SCI systems during
the prior, current, and subsequent calendar quarters, including the
dates or expected dates of commencement and completion.\450\ Under 17
CFR 242.1003(a)(2) (``Rule 1003(a)(2)''), each SCI entity is required
to promptly submit a supplemental report notifying the Commission of a
material error in or material omission from a report previously
submitted under Rule 1003(a)(1).
---------------------------------------------------------------------------

    \450\ See 17 CFR 242.1003(a).
---------------------------------------------------------------------------

    Rule 1003(b) of Regulation SCI also requires that an SCI entity
conduct an ``SCI review'' not less than once each calendar year.\451\
``SCI review'' is defined in Rule 1000 of Regulation SCI to mean a
review, following established procedures and standards, that is
performed by objective personnel having appropriate experience to
conduct reviews of SCI systems and indirect SCI systems, and which
review contains: (1) a risk assessment with respect to such systems of
an SCI entity; and (2) an assessment of internal control design and
effectiveness of its SCI systems and indirect SCI systems to include
logical and physical security controls, development processes, and
information technology governance, consistent with industry standards
Rule 1003(b)(2) requires each SCI entity to submit a report of the SCI
review to senior management no more than 30 calendar days after
completion of the review.\452\ Rule 1003(b) requires that penetration
test reviews of the network, firewalls, and production systems shall be
conducted at a frequency of not less than once every three years and
that assessments of SCI systems directly supporting market regulation
or market surveillance shall be conducted at a frequency based upon the
risk assessment conducted as part of the SCI review, but in no case
less than once every three years.\453\ Rule 1003(b)(2) requires that
the submission of a report of the SCI review to senior management of
the SCI entity for review no more than 30 calendar days after
completion

of such SCI review.\454\ Rule 1003(b)(3) requires each SCI entity to
submit the report of the SCI review to the Commission and to its board
of directors or the equivalent of such board, together with any
response by senior management, within 60 calendar days after its
submission to senior management.\455\
---------------------------------------------------------------------------

    \451\ See 17 CFR 242.1003(b).
    \452\ See 17 CFR 242.1003(b)(2).
    \453\ See 17 CFR 242.1003(b)(1)(i) and (ii).
    \454\ See 17 CFR 242.1003(b)(2).
    \455\ See 17 CFR 242.1003(b)(3).
---------------------------------------------------------------------------

    The Commission is proposing revisions to Rule 1003(b) and the
definition of SCI review. The Commission is proposing to increase the
frequency of penetration testing by SCI entities such that they are
conducted at least annually, rather than once every three years, and
that the penetration tests include any of the vulnerabilities of its
SCI systems and indirect SCI systems identified pursuant to Rule
1001(a)(2)(iv).\456\ The Commission would use this more frequent
information to have more up-to-date information regarding an SCI
entity's systems vulnerabilities and help the Commission with its
oversight of U.S. securities market technology infrastructure.
---------------------------------------------------------------------------

    \456\ See 17 CFR 242.1000.
---------------------------------------------------------------------------

    In addition, the Commission is proposing a number of revisions to
the requirements relating to SCI reviews and for the reports SCI
entities submit (both to their board of directors as well as to the
Commission). The definition of SCI review in Rule 1000 is proposed to
contain the substantive requirements for an SCI review, which would be
required to be ``a review, following established and documented
procedures and standards, that is performed by objective personnel
having appropriate experience to conduct reviews of SCI systems and
indirect SCI systems . . .'' \457\ The Commission proposes to amend the
definition of SCI review in Rule 1000 to require that the SCI review:
(1) use appropriate risk management methodology, (2) include third-
party provider management risks and controls, (3) include the risks
related to the capacity, integrity, resiliency, availability, and
security, and (4) include systems capacity and availability and
information technology service continuity within the review of internal
control design and operating effectiveness.\458\
---------------------------------------------------------------------------

    \457\ See id.
    \458\ See id.
---------------------------------------------------------------------------

    The Commission also proposes to amend Rule 1003(b)(2) to require
that the SCI review be conducted in each calendar year during which the
entity was an SCI entity for any part of that calendar year and that
the SCI entity submit the associated report of the SCI review to the
SCI entity's senior management and board, as well as to the
Commission.\459\ The Commission proposes amend Rule 1003(b)(2) to
specify that certain elements be included in the report of the SCI
review, namely: (1) the dates the SCI review was conducted and the date
of completion; (2) the entity or business unit of the SCI entity
performing the review; (3) a list of the controls reviewed and a
description of each such control; (4) the findings of the SCI review
with respect to each SCI system and indirect SCI system, which shall
include, at a minimum, assessments of: the risks related to the
capacity, integrity, resiliency, availability, and security; internal
control design and operating effectiveness; and an assessment of third-
party provider management risks and controls; (5) a summary, including
the scope of testing and resulting action plan, of each penetration
test review conducted as part of the SCI review; and (6) a description
of each deficiency and weakness identified by the SCI review.\460\ The
Commission also proposes to amend Rule 1003(b)(3) to require a response
to the report of the SCI review from senior management and to require
that the date the report was submitted to senior management be
submitted to the Commission and the board of directors, and that the
response from senior management include a response for each deficiency
and weakness identified by the SCI review, and the associated
mitigation and remediation plan and associated dates for each.\461\
---------------------------------------------------------------------------

    \459\ See 17 CFR 242.1003(b)(2) and (3).
    \460\ See 17 CFR 242.1003(b)(2).
    \461\ See 17 CFR 242.1003(b)(3).
---------------------------------------------------------------------------

    The additional requirements and details are designed to ensure SCI
reviews contain certain baseline information and are based on the
appropriate risk management methodology. The enhanced SCI review and
corresponding report would provide the Commission and its staff greater
insight into the SCI entity's compliance with Regulation SCI and would
more thoroughly assist the staff in determining how to follow up with
the SCI entity in reviewing and addressing any identified weaknesses
and vulnerabilities. The Commission would use this additional reporting
and information to improve the Commission's oversight of the technology
infrastructure of SCI entities further.
4. Rule 1004 of Regulation SCI
    Rule 1004 of Regulation SCI requires SCI entities to, with respect
to an SCI entity's business continuity and disaster recovery plans,
including its backup systems: (a) establish standards for the
designation of those members or participants that the SCI entity
reasonably determines are, taken as a whole, the minimum necessary for
the maintenance of fair and orderly markets in the event of the
activation of such plans; (b) designate members or participants
pursuant to such standards and require participation by such designated
members or participants in scheduled functional and performance testing
of the operation of such plans, in the manner and frequency specified
by the SCI entity, provided that such frequency shall not be less than
once every 12 months; and (c) coordinate the testing of such plans on
an industry- or sector-wide basis with other SCI entities.\462\
---------------------------------------------------------------------------

    \462\ See 17 CFR 242.1003(b)(4).
---------------------------------------------------------------------------

    The Commission is proposing to include certain third-party
providers in the BC/DR testing requirements of Rule 1004. Specifically,
an SCI entity would be required to establish standards for the
designation of third-party providers (in addition to members or
participants) that it determines are, taken as a whole, the minimum
necessary for the maintenance of fair and orderly markets in the event
of the activation of the SCI entity's BC/DR plans. In addition, Rule
1004 would require each SCI entity to designate such third-party
providers (in addition to members or participants) pursuant to such
standards and require their participation in the scheduled functional
and performance testing of the operation of such BC/DR plans.\463\
---------------------------------------------------------------------------

    \463\ See id.
---------------------------------------------------------------------------

    The Commission believes that the requirement that SCI entities
establish standards that require designated third-party providers to
participate in the testing of their business continuity and disaster
recovery plans will help reduce the risks associated with an SCI
entity's decision to activate its BC/DR plans and help to ensure that
such plans operate as intended, if activated. The testing participation
requirement should help an SCI entity to ensure that its efforts to
develop effective BC/DR plans are not undermined by a lack of
participation by third-party providers that the SCI entity believes are
necessary to the successful activation of such plans. This requirement
should also assist the Commission in maintaining fair and orderly
markets in a BC/DR scenario following a wide-scale disruption.

5. Rule 1005 and 1007 of Regulation SCI
    Rule 1005 of Regulation SCI requires SCI entities to make, keep,
and preserve certain records related to their compliance with
Regulation SCI.\464\ Rule 1007 sets forth requirements for a SCI entity
whose Regulation SCI records are prepared or maintained by a service
bureau or other recordkeeping service on behalf of the SCI entity.\465\
---------------------------------------------------------------------------

    \464\ See 17 CFR 242.1005. Rule 1005(a) of Regulation SCI
relates to recordkeeping provisions for SCI SROs, whereas Rule
1005(b) relates to the recordkeeping provision for SCI entities
other than SCI SROs.
    \465\ See 17 CFR 242.1007.
---------------------------------------------------------------------------

    Rule 1005(c) specifies that the requirement that records required
to be made, kept, and preserved by Rule 1005 be accessible to the
Commission and its representatives for the period required by Rule
1005, in cases where an SCI entity ceases to do business or ceases to
be registered under the Exchange Act.\466\ The Commission proposes to
add that this survival provision similarly applies to an SCI entity
that ``otherwise [ceases] to be an SCI entity.'' \467\ This addition
accounts for circumstances not expressly covered; specifically, the
circumstance in which an SCI entity continues to do business or remains
a registered entity, but may cease to qualify as an SCI entity (e.g.,
an SCI ATS that no longer satisfies a volume threshold). Such entities
would not be excepted from complying with the recordkeeping provisions
of Rule 1005.
---------------------------------------------------------------------------

    \466\ See 17 CFR 242.1005(c).
    \467\ See id.
---------------------------------------------------------------------------

    The Commission believes the records of entities that ceased being
SCI entities are important for assisting the Commission and its staff
in understanding whether such an SCI entity met its obligations under
Regulation SCI, assessing whether such an SCI entity had appropriate
policies and procedures with respect to its technology systems, helping
to identify the causes and consequences of an SCI event, and
understanding the types of material systems changes that occurred at
such an SCI entity. The Commission expects this revision to facilitate
the Commission's inspections and examinations of SCI entities that have
ceased to be SCI entities and assist it in evaluating such SCI entity's
previous compliance with Regulation SCI. Furthermore, having an SCI
entity's records available even after it has ceased to be an SCI entity
should provide an additional tool to help the Commission to reconstruct
important market events and better understand the impact of such
events. There are no amendments to Rule 1007, which sets forth
requirements for a SCI entity whose Regulation SCI records are prepared
or maintained by a service bureau or other recordkeeping service on
behalf of the SCI entity.
6. Rule 1006 of Regulation SCI
    Rule 1006 requires each SCI entity, with a few exceptions, to file
any notification, review, description, analysis, or report to the
Commission required under Regulation SCI electronically on Form
SCI.\468\ There are no amendments to this section. The Commission staff
would use the collection of information in its examination and
oversight program in identifying patterns and trends across
registrants.
---------------------------------------------------------------------------

    \468\ See 17 CFR 242.1003(b)(6).
---------------------------------------------------------------------------

C. Respondents

    The collection of information requirements contained in Regulation
SCI apply to SCI entities. As of 2021, there were an estimated 47
Current SCI Entities (i.e., entities that met the definition of SCI
entity) \469\ that were subject to the requirements of Regulation
SCI.\470\ The Commission preliminarily estimates that as a result of
the proposed amendments to Rule 1000, there would be a total of 23 New
SCI Entities (i.e., meet the amended definition of SCI entity) that
would become subject to the requirements of Regulation SCI. Thus, the
Commission preliminarily estimates that a total of 70 entities would be
subject to the requirements of Regulation SCI. The Commission
preliminarily believes that the remaining amendments would not add any
additional respondents but would result in additional reporting
burdens, which are discussed in section IV.D (Total Initial and Annual
Reporting Burdens).
---------------------------------------------------------------------------

    \469\ In 2020, the Commission amended Regulation SCI to add as
SCI entities SCI competing consolidators, defined as competing
consolidators that exceed a five percent consolidated market data
gross revenue threshold over a specified time period. See Market
Data Infrastructure Adopting Release, supra note 24. The Commission
estimated that seven persons would meet the definition of SCI
competing consolidator and be subject to Regulation SCI, two of
which would be Current SCI Entities (as plan processors) and five of
which would be new SCI competing consolidators, if they registered
as competing consolidators and exceeded the threshold. See Extension
Without Change of a Currently Approved Collection: Regulation SCI
and Form SCI; ICR Reference No.<PHONE_NUMBER>-005; OMB Control No.
3235-0703 (Mar. 3, 2022), available at https://www.reginfo.gov/public/do/PRAViewDocument?ref_nbr=202111-3235-005 (``2022 PRA
Supporting Statement''). Currently, no competing consolidators have
registered with the Commission. As a result, no competing
consolidators (in addition to the two current plan processors that
are Current SCI Entities) are included as Current SCI Entities. To
the extent that a competing consolidator registers with the
Commission and qualifies as an SCI competing consolidator it would
be subject to the same additional burdens as Current SCI Entities as
a result of the proposed amendments to Regulation SCI. The
additional burdens for Current SCI Entities are set forth in section
IV.D.
    \470\ Proposed Collection; Comment Request; Extension:
Regulation SCI, Form SCI; SEC File No. 270-653, OMB Control No.
3235-0703, 87 FR 3132.
---------------------------------------------------------------------------

    The following table summarizes the estimated number of Current SCI
Entities and New SCI Entities:

------------------------------------------------------------------------
                   Type of SCI entity                         Number
------------------------------------------------------------------------
Current SCI Entities....................................              47
New SCI Entities:
    SBSDR \1\...........................................               3
    SCI broker-dealers \2\..............................              17
    Exempt Clearing Agencies \3\........................               3
                                                         ---------------
        Total New SCI Entities..........................              23
                                                         ---------------
        Total SCI Entities..............................              70
------------------------------------------------------------------------
\1\ See supra notes 118, 124 and accompanying text. As noted earlier,
  two SBSDRs are currently registered with the Commission. The
  Commission estimates for purposes of the PRA that one additional
  entity may seek to register as an SBSDR in the next three years, and
  so for purposes of this proposal the Commission has assumed three
  SBSDR respondents.
\2\ See supra note 219 and accompanying text.
\3\ See supra notes 240 and accompanying text. As noted earlier, the
  Commission proposes to expand the scope of ``SCI entity'' to cover two
  additional exempt clearing agencies that are not subject to ARP, which
  are Euroclear Bank SA/NV and Clearstream Banking, S.A. The Commission
  estimates for purposes of the PRA that one additional entity may
  receive an exemption from registration as a clearing agency in the
  next three years, and so for purposes of this proposal the Commission
  has assumed three exempt clearing agency respondents.

D. Total Initial and Annual Reporting Burdens

    As stated above, each requirement to disclose information, offer to
provide information, or adopt policies and procedures constitutes a
collection of information requirement under the PRA. We discuss below
the collection of information burdens associated with the proposed
rules and rule amendments.
1. Rule 1001
    The rules under Regulation SCI that would require an SCI entity to
establish policies and procedures are discussed more fully in sections
II.B, and the proposed amendments are discussed more fully in sections
III.A and III.C above.
a. Rule 1001(a)
    Current SCI Entities are already required to establish, maintain,
and enforce policies and procedures pursuant to Rule 1001(a) and
therefore already incur baseline initial \471\ and ongoing burden \472\
for complying with Rule 1001(a), so the amendments should only impose a
burden required to comply with the additional requirements.\473\
Presently, none of the New SCI Entities are required to comply with the
policies and procedures requirement of Rule 1001(a), but the proposed
amendments will newly impose the baseline burden to develop and draft
written policies and procedures and review and update annually such
policies and procedures, as well as the additional burden to include
the proposed requirements in the policies and procedures. The
Commission estimates an initial compliance burden of 386 additional
hours \474\ for Current SCI Entities and 890 hours \475\ for New SCI
Entities. The Commission estimates an annual compliance burden of 58
hours \476\ for Current SCI Entities and 145 hours \477\ for New SCI
Entities.\478\ The table below summarizes the initial and ongoing
annual burden estimates for Current SCI Entities and New SCI Entities:
---------------------------------------------------------------------------

    \471\ The Commission's currently approved baseline for average
compliance burden per SCI entity to develop and draft the policies
and procedures required by Rule 1001(a) (except for 17 CFR
242.1001(a)(2)(vi) (``Rule 1001(a)(2)(vi)'')) is 534 hours. See
Extension Without Change of a Currently Approved Collection:
Regulation SCI and Form SCI; ICR Reference No.<PHONE_NUMBER>-005; OMB
Control No. 3235-0703 (Mar. 3, 2022), available at https://www.reginfo.gov/public/do/PRAViewDocument?ref_nbr=202111-3235-005
(``2022 PRA Supporting Statement''). Rule 1001(a)(2) currently
requires six elements (excluding Rule 1001(a)(2)(vi)) to be included
in the policies and procedures required by Rule 1001(a)(1). The
burden hours for each element would be 89 hours per policy element
(534 hours/6 policy elements).
    \472\ The Commission's currently approved baseline for average
compliance burden per SCI entity to review and update the policies
and procedures required by Rule 1001(a) (except for Rule
1001(a)(2)(vi)) is 87 hours. See 2022 PRA Supporting Statement,
supra note 471. The burden hours for each element would be 14.5
hours per policy element (87 hours/6 policy elements).
    \473\ The Commission estimates that at the additional burden
would be the result of the additions to Rule 1001(a)(2),
specifically the proposed requirement in the BC/DR plan and the four
proposed additional policy elements. The Commission does not
anticipate that Current SCI Entities or New SCI Entities would incur
any additional burden from the amendment to Rule 1001(a)(4) above
and beyond the burden hours estimated for the policies and
procedures in this release.
    \474\ 89 hours x 4 additional policy elements = 356 hours. The
Commission estimates a one-time burden of 30 hours (one-third of 89
hours per policy element) for SCI entities to address the
unavailability of third-party providers in their BC/DR plans. 356
hours + 30 hours = 386 hours. The burden hours include 139
Compliance Manager hours, 139 Attorney hours, 43 Senior System
Analyst hours, 43 Operations Specialist hours, 15 Chief Compliance
Officer hours, and 7 Director of Compliance hours.
    \475\ 534 baseline burden hours + 356 additional burden hours =
890 hours. The burden hours include 320 Compliance Manager hours,
320 Attorney hours, 100 Senior System Analyst hours, 100 Operations
Specialist hours, 33 Chief Compliance Officer hours, and 17 Director
of Compliance hours.
    \476\ 14.5 hours x 4 additional policy elements = 58 hours. The
burden hours include 19 Compliance Manager hours, 19 Attorney hours,
5 Senior System Analyst hours, 5 Operations Specialist hours, 7
Chief Compliance Officer hours, and 3 Director of Compliance hours.
    \477\ 87 baseline burden hours + 58 additional burden hours =
145 hours. The burden hours include 47 Compliance Manager hours, 47
Attorney hours, 13 Senior System Analyst hours, 13 Operations
Specialist hours, 17 Chief Compliance Officer hours, and 8 Director
of Compliance hours.
    \478\ The Commission recognizes that the some of the Regulation
SCI requirements and certain proposed requirements in the Exchange
Act Cybersecurity Proposal rule may appear duplicative. The
Commission believes that although the requirements are related, they
are ultimately separate obligations. Thus, the Commission has not
considered the requirements of the Exchange Act Cybersecurity
Proposal rule in formulating its estimates.

----------------------------------------------------------------------------------------------------------------
                                                                                Estimated burden
                                                                                hours for all
                                                               Estimated     Burden hours   entities  (estimated
          Respondent type                 Burden type         respondents     per entity        respondents x
                                                              (entities)        (hours)       burden hours per
                                                                                entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities...............  Initial..............              47             386                18,142
                                     Annual...............              47              58                 2,726
New SCI Entities...................  Initial..............              23             890                20,470
                                     Annual...............              23             145                 3,335
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the
average internal cost of compliance for Current SCI Entities and New
SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                        Estimated       Average internal         (estimated
        Respondent type             Burden type        respondents     cost of compliance       respondents x
                                                       (entities)          per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities...........  Initial..........                47          \1\ $144,787            $6,804,989
                                 Annual...........                47            \2\ 23,403             1,099,941
New SCI Entities...............  Initial..........                23           \3\ 333,371             7,667,533

                                 Annual...........                23            \4\ 58,315             1,341,245
----------------------------------------------------------------------------------------------------------------
\1\ (139 Compliance Manager hours x $344) + (139 Attorney hours x $462) + (43 Senior Systems Analyst hours x
  $316) + (43 Operations Specialist hours x $152) + (15 Chief Compliance Officer hours x $589) + (7 Director of
  Compliance hours x $542) = $144,787. The Commission derived this estimate based on per hour figures from
  SIFMA's Management & Professional Earnings in the Securities Industry 2013, modified by Commission staff to
  account for an 1,800-hour work-year and inflation, and multiplied by 5.35 to account for bonuses, firm size,
  employee benefits, and overhead.
\2\ (19 Compliance Manager hours x $344) + (19 Attorney hours x $462) + (5 Senior Systems Analyst hours x $316)
  + (5 Operations Specialist hours x $152) + (7 Chief Compliance Officer hours x $589) + (3 Director of
  Compliance hours x $542) = $23,403.
\3\ (320 Compliance Manager hours x $344) + (320 Attorney hours x $462) + (100 Senior Systems Analyst hours x
  $316) + (100 Operations Specialist hours x $152) + (33 Chief Compliance Officer hours x $589) + (17 Director
  of Compliance hours x $542) = $333,371.
\4\ (47 Compliance Manager hours x $344) + (47 Attorney hours x $462) + (13 Senior Systems Analyst hours x $316)
  + (13 Operations Specialist hours x $152) + (17 Chief Compliance Officer hours x $589) + (8 Director of
  Compliance hours x $542) = $58,315.

    The proposed amendments would newly impose a burden on New SCI
Entities to comply with Rule 1001(a)(2)(vi), which requires the
policies and procedures required by Rule 1001(a) to include standards
that result in systems being designed, developed, tested, maintained,
operated, and surveilled in a manner that facilitates the successful
collection, processing, and dissemination of market data.\479\ The
Commission estimates that New SCI Entities would incur an initial
burden of 160 hours and an ongoing burden of 145 hours to annually
review and update the policies and procedures.\480\ The table below
summarizes the initial and ongoing annual burden estimates for New SCI
Entities to comply with Rule 1001(a)(2)(vi):
---------------------------------------------------------------------------

    \479\ Current SCI Entities would incur no additional burden as
they are already required to include the required standards in their
policies and procedures.
    \480\ These estimates are consistent with the Commission-
approved baseline initial and ongoing average compliance burdens per
SCI entity. See 2022 PRA Supporting Statement, supra note 471. The
160 hour initial burden includes 100 Compliance Manager hours, 20
Chief Compliance Officer hours, 10 Director of Compliance hours, and
30 Compliance Attorney hours. The 145 annual burden hours includes
100 Compliance Manager hours, 10 Chief Compliance Officer hours, 5
Director of Compliance hours, and 30 Compliance Attorney hours.

----------------------------------------------------------------------------------------------------------------
                                                                                Estimated burden
                                                                                hours for all
                                                               Estimated     Burden hours    entities (estimated
          Respondent type                 Burden type         respondents     per entity        respondents x
                                                              (entities)                      burden hours  per
                                                                                entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities...................  Initial..............              23             160                 3,680
                                     Annual...............              23             145                 3,335
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the
average internal cost of compliance for New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
         Respondent type              Burden type       respondents    cost of compliance       respondents x
                                                        (entities)         per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities................  Initial...........              23           \1\ $60,980            $1,402,540
                                  Annual............              23            \2\ 52,380             1,204,740
----------------------------------------------------------------------------------------------------------------
\1\ (100 Senior Systems Analyst hours x $316) + (20 Chief Compliance Officer hours x $589) + (10 Director of
  Compliance hours x $542) + (30 Compliance Attorney hours x $406) = $60,980.
\2\ (100 Senior Systems Analyst hours x $316) + (10 Chief Compliance Officer hours x $589) + (5 Director of
  Compliance hours x $542) + (30 Compliance Attorney hours x $406) = $52,380.

    The Commission estimates that on average, Current SCI Entities
would seek outside legal and/or consulting services to initially update
their policies and procedures for the proposed additional requirements
at a cost of $29,050 per SCI entity,\481\ while New SCI Entities would
seek such services in the initial preparation of the policies and
procedures (including the proposed requirements) at a cost of $73,800
per SCI entity.\482\
---------------------------------------------------------------------------

    \481\ The Commission's currently approved baseline for
annualized recordkeeping cost per SCI entity to consult outside
legal and/or consulting services in the initial preparation policies
and procedures required by Rule 1001(a) is $47,000. See 2022 PRA
Supporting Statement, supra note 471. Rule 1001(a)(2) currently
requires seven elements (including Rule 1001(a)(2)(vi)) to be
included in the policies and procedures required by Rule 1001(a)(1).
The cost per element would be approximately $6,700 per policy
element ($47,000 hours/7 policy elements = $6,714). As noted
earlier, the Commission proposes to add four additional elements to
the policies and procedures. $6,700 per policy element x 4
additional policy elements = $26,800. The Commission also estimates
a one-time burden of approximately $2,250 per SCI entity (one-third
of $6,700 per policy element) to address the unavailability of
third-party providers in their BC/DR plans. $26,800 + $2,250 =
$29,050.
    \482\ $47,000 + $26,800 = $73,800.

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal cost
                                                                                of compliance
                                                         Estimated      Average external         (estimated
                   Respondent type                      respondents      cost per entity        respondents x
                                                        (entities)                            average external
                                                                                cost per entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities................................              47               $29,050            $1,365,350
New SCI Entities....................................              23                73,800             1,697,400
----------------------------------------------------------------------------------------------------------------

b. Rule 1001(b)
    New SCI Entities would be required to meet the requirements of Rule
1001(b), which requires each SCI entity to establish, maintain, and
enforce systems compliance policies. The Commission estimates a
compliance burden of 270 hours initially to design the systems
compliance policies and procedures and 95 hours annually to review and
update such policies and procedures.\483\ The table below summarizes
the initial and ongoing annual burden estimates for New SCI Entities to
comply with Rule 1001(b):
---------------------------------------------------------------------------

    \483\ The Commission estimates that the burden for New SCI
Entities is consistent with the Commission's current approved
baselines for the initial and ongoing burdens. For the initial
recordkeeping burden, this baseline is 270 hours (40 Compliance
Attorney hours + 200 Senior System Analyst hours + 20 Chief
Compliance Officer hours + 10 Director of Compliance hours). The
Commission estimated separate baselines for the ongoing
recordkeeping burden for SCI SROs and entities that were not SROs.
Since none of the entities that would potentially be subject to
Regulation SCI as a result of the proposed amendments are SROs, the
Commission is basing its estimates on the baseline for non-SROs. The
Commission's current approved baseline for the ongoing recordkeeping
burden for entities that are not SROs is 95 hours (14 Compliance
Attorney hours + 66 Senior System Analyst hours + 10 Chief
Compliance Officer hours + 5 Director of Compliance hours). See 2022
PRA Supporting Statement, supra note 471.

----------------------------------------------------------------------------------------------------------------
                                                                                Estimated burden
                                                                                hours for all
         Respondent type              Burden type        Estimated      Burden hours per     entities (estimated
                                                        respondents          entity         respondents x burden
                                                                                hours per entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities................  Initial...........              23                   270                 6,210
                                  Annual............              23                    95                 2,185
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the
average internal cost of compliance for New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
         Respondent type              Burden type       respondents    cost of compliance       respondents x
                                                        (entities)         per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities................  Initial...........              23           \1\ $96,640            $2,222,720
                                  Annual............              23            \2\ 35,140               808,220
----------------------------------------------------------------------------------------------------------------
\1\ (200 Senior Systems Analyst hours x $316) + (20 Chief Compliance Officer hours x $589) + (10 Director of
  Compliance hours x $542) + (40 Compliance Attorney hours x $406) = $96,640.
\2\ (66 Senior Systems Analyst hours x $316) + (10 Chief Compliance Officer hours x $589) + (5 Director of
  Compliance hours x $542) + (14 Compliance Attorney hours x $406) = $35,140.

    In establishing, maintaining, and enforcing the policies and
procedures required by Rule 1001(b), the Commission believes that each
new SCI entity will seek outside legal and/or consulting services in
the initial preparation of such policies and procedures. The total
annualized cost of seeking outside legal and/or consulting services
will be $621,000.\484\
---------------------------------------------------------------------------

    \484\ The Commission estimates that the cost for outside legal
and/or consulting services for New SCI Entities is consistent with
the Commission's current approved baselines, which is $27,000 per
new SCI entity. See 2022 PRA Supporting Statement, supra note 471.
$27,000 for the first year x 23 New SCI Entities = 621,000.
---------------------------------------------------------------------------

c. Rule 1001(c)
    The proposed amendments would newly impose a burden on New SCI
Entities to develop and maintain policies with Rule 1001(c), relating
to

the policies for designation of responsible SCI personnel. The
Commission estimates a compliance burden of 114 hours initially to
design the systems compliance policies and procedures and 39 hours
annually to review and update such policies and procedures.\485\ The
table below summarizes the initial and ongoing annual burden estimates
for New SCI Entities to comply with Rule 1001(b):
---------------------------------------------------------------------------

    \485\ The Commission's current approved baseline 114 hours for
the initial burden to establish the criteria for identifying
responsible SCI personnel and the escalation procedures (32
Compliance Manager hours + 32 Attorney hours x $412 + 10 Senior
Systems Analyst hours x $282 + 10 Operations Specialist hours x $135
+ 20 Chief Compliance Officer hours x $526 + 10 Director of
Compliance). The Commission's approved baseline is 39 hours for the
ongoing burden to annually review and update the criteria and the
escalation procedures (9.5 Compliance Manager hours + 9.5 Attorney
hours + 2.5 Senior Systems Analyst hours + 2.5 Operations Specialist
hours + 10 Chief Compliance Officer hours + 5 Director of Compliance
hours). See 2022 PRA Supporting Statement, supra note 471.

----------------------------------------------------------------------------------------------------------------
                                                                                Estimated burden
                                                                                hours for all
          Respondent type                 Burden type          Estimated     Burden hours    entities (estimated
                                                              respondents     per entity    respondents x burden
                                                                                hours per entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities...................  Initial..............              23             114                 2,622
                                     Annual...............              23              39                   897
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the
average internal cost of compliance for New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
         Respondent type              Burden type       respondents    cost of compliance       respondents x
                                                        (entities)         per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities................  Initial...........              23           \1\ $47,672            $1,096,456
                                  Annual............              23            \2\ 17,427               400,821
----------------------------------------------------------------------------------------------------------------
\1\ (32 Compliance Manager hours x 344) + (32 Attorney hours x $462) + (10 Senior Systems Analyst hours x $316)
  + (10 Operations Specialist hours x $152) + (20 Chief Compliance Officer hours x $589) + (10 Director of
  Compliance hours x $542) = $47,672.
\2\ (9.5 Compliance Manager hours x $344) + (9.5 Attorney hours x $462) + (2.5 Senior Systems Analyst hours x
  $316) + (2.5 Operations Specialist hours x $152) + (10 Chief Compliance Officer hours x $589) + (5 Director of
  Compliance hours x $542) = $17,427.

    The Commission does not expect SCI entities to incur any external
PRA costs in connection with the policies and procedures required under
Rule 1001(c).
2. Rule 1002
    The rules under Regulation SCI that would require an SCI entity to
take corrective action, provide certain notifications and reports, and
disseminate certain information regarding SCI events are discussed more
fully in sections II.B, and the proposed amendments are discussed more
fully in sections III.A and III.C above.
a. Rule 1002(a)
    As noted above, Rule 1002(a) requires each SCI entity, upon any
responsible SCI personnel having a reasonable basis to conclude that an
SCI event has occurred, to begin to take appropriate corrective action.
The Commission has previously expressed the view that Rule 1002(a)
would likely result in SCI entities developing and revising their
processes for corrective action.\486\ The Commission believes that the
requirement to take corrective action for these additional systems
intrusions would likely result in SCI entities updating their processes
for corrective action.\487\
---------------------------------------------------------------------------

    \486\ See 2022 PRA Supporting Statement, supra note 471.
    \487\ The Commission's estimate includes the amendments to the
definition of systems intrusions adding (1) cybersecurity events
that disrupt, or significantly degrade, the normal operation of an
SCI system and (2) significant attempted unauthorized entries into
the SCI systems or indirect SCI systems of an SCI entity. It does
not include the systems intrusions that would previously have been
classified as de minimis events because Current SCI Entities are
already required to take corrective action to resolve such SCI
events.
---------------------------------------------------------------------------

    The Commission continues to believe that Rule 1002(a) will likely
result in SCI entities developing and revising their processes for
corrective action as well as review them annually.\488\ Current SCI
Entities are already required to take corrective action pursuant to
Rule 1002(a) and therefore already incur the initial \489\ and ongoing
\490\ baseline burdens for developing and revising their corrective
action process, so the amendments should only impose a one-time burden
required to update the procedures to account for the additional types
of systems intrusions.\491\ The Commission estimates that the one-time
burden for each SCI entity to include in its corrective action process
the proposed systems intrusions would be 20% of the 114 hours baseline

burden.\492\ Presently, the New SCI Entities are not required to comply
with requirement in Rule 1002(a) to take corrective action, but the
proposed amendments will newly impose these burdens, including the
burden for incorporating the additional systems intrusions into the
corrective action process. For Current SCI Entities, the Commission
estimates a one-time compliance burden of 23 hours. For New SCI
Entities, the Commission estimates an initial burden of 137 hours \493\
and an annual compliance burden of 39 hours \494\ for New SCI Entities.
The table below summarizes the initial and ongoing annual burden
estimates for Current SCI Entities and New SCI Entities:
---------------------------------------------------------------------------

    \488\ See 2022 PRA Supporting Statement, supra note 471.
    \489\ The Commission's currently approved baseline for average
compliance burden per respondent to develop a process for corrective
action is 114 hours (32 Compliance Manager hours + 32 Attorney hours
+ 10 Senior Systems Analyst hours + 10 Operations Specialist hours +
20 Chief Compliance Officer hours + 10 Director of Compliance
hours). See 2022 PRA Supporting Statement, supra note 471.
    \490\ The average compliance burden for each SCI entity to
review their process is 39 hours (9 Compliance Manager hours + 9
Attorney hours + 3 Senior Systems Analyst hours + 3 Operations
Specialist hours + 10 Chief Compliance Officer hours + 5 Director of
Compliance hours. See 2022 PRA Supporting Statement, supra note 471.
    \491\ The Commission also proposes to remove the option for SCI
entities to classify systems intrusions as de minimis and
potentially report them pursuant to Rule 1002(b)(5) on the quarterly
SCI reports as de minimis events. SCI entities would instead report
these systems intrusions pursuant to Rule 1002(b)(1) through (4).
The Commission believes that the burden for developing a corrective
action plan for these systems intrusions is already incorporated in
the baseline burden estimates. See supra notes 489-490.
    \492\ 114 hours x 0.20 = 23 hours. The burden hours include 7
Compliance Manager hours, 6 Attorney hours, 2 Senior Systems Analyst
hours, 2 Operations Specialist hours, 4 Chief Compliance Officer
hours, and 2 Director of Compliance hours.
    \493\ 114 baseline burden hours + 23 burden hours for additional
systems intrusions = 137 hours. The burden hours include 39
Compliance Manager hours, 38 Attorney hours, 12 Senior Systems
Analyst hours, 12 Operations Specialist hours, 24 Chief Compliance
Officer hours, and 12 Director of Compliance hours.
    \494\ The Commission estimates that the ongoing recordkeeping
burden for each New SCI Entity to review its corrective action
process would be the same as the baseline ongoing recordkeeping
burden of 39 hours. See supra note 490.

----------------------------------------------------------------------------------------------------------------
                                                                                Burden hours for all
                                                                                respondents
                                                               Estimated     Burden hours        (estimated
          Respondent type                 Burden type         respondents   per SCI entity  respondents x burden
                                                                                hours per SCI
                                                                                entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities...............  One-time Burden......              47              23                 1,081
New SCI Entities...................  Initial..............              23             137                 3,151
                                     Ongoing..............                              39                   897
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the cost
of compliance for Current SCI Entities and New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal cost
                                                                                of compliance
                                                                        Average internal         (estimated
         Respondent type              Burden type        Estimated     cost of compliance       respondents x
                                                        respondents        per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities............  One-time Burden...              47            \1\ $9,556              $449,132
New SCI Entities................  Initial...........              23            \2\ 57,228             1,316,244
                                  Ongoing...........                            \3\ 17,258               396,934
----------------------------------------------------------------------------------------------------------------
\1\ (7 Compliance Manager hours x 344) + (6 Attorney hours x $462) + (2 Senior Systems Analyst hours x $316) +
  (2 Operations Specialist hours x $152) + (4 Chief Compliance Officer hours x $589) + (2 Director of Compliance
  hours x $542) = $9,556.
\2\ (39 Compliance Manager hours x 344) + (38 Attorney hours x $462) + (12 Senior Systems Analyst hours x $316)
  + (12 Operations Specialist hours x $152) + (24 Chief Compliance Officer hours x $589) + (12 Director of
  Compliance hours x $542) = $57,228.
\3\ (9 Compliance Manager hours x 344) + (9 Attorney hours x $462) + (3 Senior Systems Analyst hours x $316) +
  (3 Operations Specialist hours x $152) + (10 Chief Compliance Officer hours x $589) + (5 Director of
  Compliance hours x $542) = $17,258.

    The Commission does not expect SCI entities to incur any external
PRA costs in connection with the requirement to take corrective actions
under Rule 1002(a).
b. Rule 1002(b)(1) Through (4)
    As noted earlier, SCI entities have certain reporting obligations
regarding SCI events. Current SCI Entities are already required to
submit the notifications, updates, and reports required by Rule
1002(b)(1) through (4) and therefore already incur a baseline burden.
As a result of the additional systems intrusions, including the
amendments to the definition of systems intrusions and the exclusion of
systems intrusions from de minimis SCI events required to be reported
to the Commission, Current SCI Entities could potentially incur new
burdens pursuant to Rule 1002(b)(1) through (4) reporting additional
SCI events for which they currently either do not report or which they
currently report quarterly as de minimis. As proposed, New SCI Entities
would for the first time be required to provide the submissions
required by Rule 1002(b)(1) through (4) and would bear the existing
burden for compliance with Rule 1002(b)(1) through (4) and the
additional burden to report the proposed systems intrusions.
    The Commission estimates that on average each Current SCI Entity
will experience an additional three SCI events each year that are not
de minimis SCI events \495\ and New SCI Entities will experience an
average of eight SCI events each year that are not de minimis SCI
events.\496\
---------------------------------------------------------------------------

    \495\ The Commission's currently approved baseline for the
number of SCI events is five events per year that are not de
minimis. See 2022 PRA Supporting Statement, supra note 471. The
Commission estimates that as a result of the additional systems
intrusions that SCI entities would be required to report, the number
of SCI events would increase by three events per year that are not
de minimis.
    \496\ The Commission estimates that each New SCI Entity would
experience the baseline burden of five SCI events and three
additional SCI events, for a total of eight SCI events that are not
de minimis.
---------------------------------------------------------------------------

    As a result, pursuant to Rule 1002(b)(1), which requires immediate
notification of SCI events, the Commission estimates that each Current
SCI Entity will submit, on average, an additional three notifications
per year beyond the current baseline,\497\ and each New SCI Entity will
submit eight

notifications per year.\498\ These notifications can be made orally or
in writing, and the Commission estimates that approximately one-fourth
of these notifications will be submitted in writing (i.e.,
approximately one event per year for each Current SCI Entity and two
events per year for each New SCI Entity \499\), and approximately
three-fourths will be provided orally (i.e., approximately two events
per year for each Current SCI Entity \500\ and six events per year for
each New SCI Entity \501\). The Commission estimates that each written
notification will require two hours and each oral notification will
require 1.5 hours.\502\ The Commission estimates a burden of 5 hours
\503\ for each Current SCI Entities and 13 hours \504\ for New SCI
Entities. The table below summarizes the initial and ongoing annual
burden estimates for Current SCI Entities and New SCI Entities:
---------------------------------------------------------------------------

    \497\ The Commission's currently approved baseline for the
number of notifications submitted by an SCI entity pursuant to Rule
1002(b)(1) is five notifications per year, with one-fourth of the
five notifications submitted in writing (i.e., approximately one
event per year for each SCI entity), and approximately three-fourths
provided orally (i.e., approximately four events per year for each
SCI entity). See 2022 PRA Supporting Statement, supra note 471. The
Commission estimates that the proposed systems intrusions will
result in each SCI entity submitting three additional notifications,
one for each of the three estimated additional SCI events.
    \498\ The Commission estimates that each New SCI Entity will
submit both the current baseline of five notifications and the
additional three notifications, for a total of eight notifications.
See supra note 497 (discussing the 3 additional notifications).
    \499\ 8 SCI events / 4 = 2 SCI events reported in writing. The
Commission estimates that each Current SCI Entities already reports
one SCI event per year in writing. See 2022 PRA Supporting
Statement, supra note 471. The Commission therefore estimates that
they would report one additional SCI event in writing. New SCI
Entities would report two SCI events in writing.
    \500\ 3 SCI events-1 SCI event reported in writing = 2 SCI
events reported orally.
    \501\ 8 SCI events-2 SCI events reported in writing = 6 SCI
events reported orally.
    \502\ The Commission-approved baseline for the burden hours for
each notification are 2 hours for written communications (0.5
Compliance Manager hours + 0.5 Attorney hours + 0.5 Senior Systems
Analyst hours + 0.5 Senior Business Analyst hours) and 1.5 hours for
oral communications (0.25 Compliance Manager hours + 0.25 Attorney
hours + 0.5 Senior Systems Analyst hours + (0.5 Senior Business
Analyst hours). See 2022 PRA Supporting Statement, supra note 471.
The Commission does not believe that reporting the proposed systems
intrusions would change the estimated burden hours.
    \503\ 1 written notification each year * 2 hours per
notification + 2 oral notifications each year * 1.5 hours per
notification = 5 hours.
    \504\ 2 written notification each year * 2 hours per
notification + 6 oral notifications each year * 1.5 hours per
notification = 13 hours.

----------------------------------------------------------------------------------------------------------------
                                                                                Burden hours for
                                                                                all respondents
                                                               Estimated     Burden hours        (estimated
                      Respondent type                         respondents   per SCI entity      respondents x
                                                              (entities)                      burden hours  per
                                                                                SCI entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities......................................              47               5                   235
New SCI Entities..........................................              23              13                   299
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the
average internal cost of compliance associated with the ongoing
reporting burden for Current SCI Entities and New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
                   Respondent type                      respondents    cost of compliance       respondents x
                                                        (entities)       per SCI entity       average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities................................              47         \1\ $1,737.50               $81,663
New SCI Entities....................................              23             \2\ 4,499               103,477
----------------------------------------------------------------------------------------------------------------
\1\ The average internal cost of compliance for each Current SCI entity to submit an additional written
  notification per year is $713.50 (0.5 Compliance Manager hours x $344) + (0.5 Attorney hours x $462) + (0.5
  Senior Systems Analyst hours x $316) + (0.5 Senior Business Analyst hours x $305) = $713.50 per written
  notification. $713.50 x 1 written notification each year = $713.50.
(0.25 Compliance Manager hours x $344) + (0.25 Attorney hours x $462) + (0.5 Senior Systems Analyst hours x
  $316) + (0.5 Senior Business Analyst hours x $305) = $512 per oral notification. $512 x 2 = $1,024.
$713.50 + $1,024 = $1,737.50.
\2\ $713.50 per written notification x 2 written notifications + $512 per written notification x 6 oral
  notifications = $4,499.

    The Commission estimates that each notification submitted pursuant
to Rule 1002(b)(2) will require 24 hours per SCI entity.\505\ The
Commission estimates an average of 72 hours \506\ for each Current SCI
Entity and 192 hours \507\ for each New SCI Entity to submit the 24
hour written notifications required by Rule 1002(b)(2). The table below
summarizes the initial and ongoing annual burden estimates for Current
SCI Entities and New SCI Entities:
---------------------------------------------------------------------------

    \505\ The Commission-approved baseline for the burden hours for
each written notification is 24 hours (5 Compliance Manager hours +
5 Attorney hours + 6 Senior Systems Analyst hours + 1 Assistant
General Counsel hour + 1 Chief Compliance Officer hour + 6 Senior
Business Analyst hours) for each SCI entity. See 2022 PRA Supporting
Statement, supra note 471.
    \506\ 3 additional notifications x 24 hours per notification =
72 hours. See supra note 497 (discussing the three additional
notifications for each Current SCI Entity).
    \507\ 8 notifications x 24 hours per notification = 192 hours.
See supra note 498 (discussing the eight notifications for each New
SCI Entity).

----------------------------------------------------------------------------------------------------------------
                                                                                Burden hours for
                                                                                all respondents
                                                               Estimated     Burden hours        (estimated
                      Respondent type                         respondents   per SCI entity      respondents x
                                                              (entities)                      burden hours  per
                                                                                SCI entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities......................................              47              72                 3,384
New SCI Entities..........................................              23             192                 4,416
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the cost
of compliance associated with the ongoing reporting burden for Current
SCI Entities and New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
                   Respondent type                      respondents    cost of compliance       respondents x
                                                        (entities)       per SCI entity       average internal
                                                                                cost of compliance
                                                                                per entity
----------------------------------------------------------------------------------------------------------------
Current SCI Entities................................              47           \1\ $26,589            $1,249,683
New SCI Entities....................................              23            \2\ 70,904             1,630,792
----------------------------------------------------------------------------------------------------------------
\1\ The average internal cost of compliance for each Current SCI entity to submit an additional written
  notification per year is $8,863 per notification ((5 Compliance Manager hours x $344) + (5 Attorney hours x
  $462) + (6 Senior Systems Analyst hours x $316) + (1 Assistant General Counsel x $518) + (6 Senior Business
  Analyst hours x $305) + (1 Chief Compliance Officer hour x $589)). $8,863 per notification x 3 notifications
  each year = $26,589.
\2\ $8,863 per notification x 8 notifications each year = $70,904.

    As for Rule 1002(b)(3), the Commission estimates that, based on
past experience, each Current SCI entity will submit 1 additional
written update and 1 additional oral update each year and each New SCI
Entity will submit 2 written updates (on Form SCI) and 2 oral
updates.\508\ The Commission estimates that each written update will
require 6 hours and each oral update will require 4.5 hours.\509\ The
Commission estimates a total burden of 10.5 hours \510\ for Current SCI
Entities and 21 hours \511\ for New SCI Entities. The table below
summarizes the initial and ongoing annual burden estimates for Current
SCI Entities and New SCI Entities:
---------------------------------------------------------------------------

    \508\ The Commission's currently approved baseline for the
number of updates submitted by an SCI entity pursuant to Rule
1002(b)(3) is one written update and one oral update each year, for
a total of two updates per a year. See 2022 PRA Supporting
Statement, supra note 471. The Commission estimates that as a result
of the three additional SCI events resulting from the additional
systems intrusions each SCI entity is potentially required to be
report, the total number of updates would increase to two written
updates and two oral updates each year, for a total of four updates
per a year.
    \509\ The Commission-approved baseline for the burden hours for
each update are 6 hours for the written update (1.5 Compliance
Manager hours + 1.5 Attorney hours + 1.5 Senior Systems Analyst
hours + 1.5 Senior Business Analyst hours) and 4.5 hours for the
oral update (0.75 Compliance Manager hours + 0.75 Attorney hours +
1.5 Senior Systems Analyst hours + 1.5 Senior Business Analyst
hours). See 2022 PRA Supporting Statement, supra note 471. The
Commission does not propose to change the estimated burden hours at
this time and notes that the estimated hours for the Senior Systems
Analyst and Senior Business Analyst regarding the oral update
reflect a correction to a typographical error in the 2022 PRA
Supporting Statement.
    \510\ 1 written notification x 6 hours per written notification
+ 1 oral notification x 4.5 hours per oral notification = 10.5
hours.
    \511\ 2 written notifications x 6 hours per written notification
+ 2 oral notifications x 4.5 hours per oral notification = 21 hours.

----------------------------------------------------------------------------------------------------------------
                                                                                Burden hours for
                                                                                all respondents
                                                               Estimated     Burden hours        (estimated
                      Respondent type                         respondents   per SCI entity      respondents x
                                                              (entities)                      burden hours  per
                                                                                SCI entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities......................................              47            10.5                 493.5
New SCI Entities..........................................              23              21                   483
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the cost
of compliance associated with the ongoing reporting burden for Current
SCI Entities and New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
                   Respondent type                      respondents    cost of compliance       respondents x
                                                        (entities)       per SCI entity       average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
Current SCI entities................................              47            \1\ $3,677              $172,819
New SCI Entities....................................              23             \2\ 7,354               169,142
----------------------------------------------------------------------------------------------------------------
\1\ The average internal cost of compliance for each SCI entity to submit an additional written update is $2,141
  per notification ((1.5 Compliance Manager hours x $344) + (1.5 Attorney hours x $462) + (1.5 Senior Systems
  Analyst hours x $316) + (1.5 Senior Business Analyst hours x $305)).
The average internal cost of compliance for each SCI entity to submit an additional oral update is $1,536 ((0.75
  Compliance Manager hours x $344) + (0.75 Attorney hours x $462) + (1.5 Senior Systems Analyst hours x $316) +
  (1.5 Senior Business Analyst hours x $305)).
$2,141 + $1,536 = $3,677 for each Current SCI Entity to submit two additional updates (one written update and
  one oral update).
\2\ $2,141 per written update x 2 written updates per year + $1,536 per oral update x 2 oral updates per year =
  $7,354 for each New SCI Entity to submit updates in compliance with Rule 1002(b)(3).

    As for Rule 1002(b)(4), the Commission estimates that Current SCI
Entities will submit an additional 3 reports per year above and beyond
the current baseline \512\ and New SCI Entities will submit 8 reports
per year.\513\ The Commission estimates that compliance with Rule
1002(b)(4) for a particular SCI event will require 35 hours.\514\ The
Commission estimates that each Current SCI Entity will incur 105 hours
\515\ and each New SCI Entity will incur 280 hours \516\ to meet the
requirements of Rule 1002(b)(4). The table below summarizes the initial
and ongoing annual burden estimates for Current SCI Entities and New
SCI Entities:
---------------------------------------------------------------------------

    \512\ The Commission's currently approved baseline for the
number of reports submitted by an SCI entity pursuant to Rule
1002(b)(4) is five reports per year. See 2022 PRA Supporting
Statement, supra note 471. The Commission estimates that as a result
of the increase in the estimated number of SCI events from five
events to eight events, SCI entities would potentially be required
to submit an additional three reports per year.
    \513\ As noted earlier, the Commission estimates that New SCI
Entities would submit both the baseline estimate of five reports and
the additional three reports, for a total of eight reports.
    \514\ The Commission's currently approved baseline for burden
hours each SCI entity would incur to comply with Rule 1002(b)(4) for
each SCI event would be 35 hours (8 Compliance Manager hours + 8
Attorney hours + 7 Senior Systems Analyst hours + 2 Assistant
General Counsel hours + 1 General Counsel hour + 2 Chief Compliance
Officer hours + 7 Senior Business Analyst hours). See 2022 PRA
Supporting Statement, supra note 471. The Commission does not
propose to change the estimated burden hours at this time.
    \515\ 3 notifications each year x 35 hours per notification =
105 hours.
    \516\ 8 notifications each year x 35 hours per notification =
280 hours.

----------------------------------------------------------------------------------------------------------------
                                                                                Burden hours for
                                                                                all respondents
                                                               Estimated     Burden hours        (estimated
                      Respondent type                         respondents   per SCI entity      respondents x
                                                              (entities)                      burden hours  per
                                                                                SCI entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities......................................              47             105                 4,935
New SCI Entities..........................................              23             280                 6,440
----------------------------------------------------------------------------------------------------------------

    The Commission estimates that the average internal cost of
compliance per notification is $13,672.\517\ The table below summarizes
the Commission's estimates for the cost of compliance associated with
the ongoing reporting burden for Current SCI Entities and New SCI
Entities:
---------------------------------------------------------------------------

    \517\ (8 Compliance Manager hours x $344) + (8 Attorney hours x
$462) + (7 Senior Systems Analyst hours x $316) + (2 Assistant
General Counsel hours x $518) + (1 General Counsel hour x $663) + (2
Chief Compliance Officer hours x $589) + (7 Senior Business Analyst
hours x $305) = $13,672.

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
                   Respondent type                      respondents    cost of compliance       respondents x
                                                        (entities)       per SCI entity       average internal
                                                                                cost of compliance
                                                                                per entity
----------------------------------------------------------------------------------------------------------------
Current SCI Entities................................              47           \1\ $41,016            $1,927,752
New SCI Entities....................................              23           \2\ 109,376             2,515,648
----------------------------------------------------------------------------------------------------------------
\1\ $13,672 per notification x 3 notifications each year = $41,016.
\2\ $13,672 per notification x 8 notifications per year = $109,376 average internal cost of compliance for each
  New SCI Entity.

c. Rule 1002(b)(5)
    The Commission estimates that eliminating systems intrusions from
the SCI events reported as de minimis events \518\ on the quarterly
reports reduces the burden for each SCI entity to submit the quarterly
report by 10% less compared to the current baseline, or 36 hours.\519\
Each Current SCI Entity would experience a decrease in its reporting
burden of 4 hours per quarterly report,\520\ for a total decrease of 16
hours per SCI entity.\521\ As New SCI Entities are not currently
required to meet this burden, they would newly incur a burden of 36
hours per report, for a total burden per SCI entity of 144 hours.\522\
---------------------------------------------------------------------------

    \518\ Systems intrusions, whether de minimis or non-de minimis,
would be reported pursuant to Rules 1002(b)(1) through (4), as
discussed earlier. See section III.C.3. The burdens for reporting
all systems intrusions as non-de minimis events is discussed above.
See supra notes 495-517 and accompanying text.
    \519\ The Commission's currently approved baseline for the
initial and ongoing reporting burden to comply with the quarterly
report requirement is 40 hours. See 2022 PRA Supporting Statement,
supra note 471. 40 hours x 10% = 36 hours. This estimate includes 7
hours for a Compliance Manager, 7 hours for an Attorney, 9 hours for
a Senior Systems Analyst, 1 hours for an Assistant General Counsel,
9 hours for a Senior Business Analyst, 1 hours for a General
Counsel, and 2 hours for a Chief Compliance Officer.
    \520\ 40 hours (baseline estimate)-36 hours (revised estimate) =
4 hours per quarterly report. This estimate includes 0.75 hours for
a Compliance Manager, 0.75 hours for an Attorney, 1 hour for a
Senior Systems Analyst, 0.2 hours for an Assistant General Counsel,
1 hours for a Senior Business Analyst, 0.1 hours for a General
Counsel, and 0.2 hours for a Chief Compliance Officer.
    \521\ 4 quarterly submissions per year x 4 hours per submission
= 16 hours decrease per SCI entity.
    \522\ 4 quarterly submissions per year x 36 hours per submission
= 144 hours per SCI entity.
---------------------------------------------------------------------------

    The table below summarizes the initial and ongoing annual burden
estimates for Current SCI Entities and New SCI Entities:

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Burden hours for all
                                                                                Burden hours per SCI       respondents
                                                                 Estimated       Number of       Hours per      entity (number of        (estimated
                       Respondent type                          respondents       reports         report       reports x hours per      respondents x
                                                                (entities)                                           report)          burden hours  per
                                                                                SCI entity)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Current SCI Entities........................................              47               4             (4)                  (16)                 (752)

New SCI Entities............................................              23               4              36                   144                 3,312
--------------------------------------------------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the
average internal cost of compliance associated with the ongoing
reporting burden for Current SCI Entities and New SCI Entities:

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Average internal    Total internal  cost
                                                                                cost of compliance       of compliance
                                                               Estimated                    Internal cost of     per SCI entity          (estimated
                      Respondent type                         respondents      Number of     compliance per   (number of reports x      respondents x
                                                              (entities)        reports          report         internal cost of      average internal
                                                                                compliance per      cost of compliance
                                                                                report)             per entity
--------------------------------------------------------------------------------------------------------------------------------------------------------
Current SCI entities......................................              47               4      \1\ $(1,513)          \2\ $(6,052)            $(284,444)
New SCI entities..........................................              23               4        \3\ 13,619            \4\ 54,476             1,252,948
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ (0.75 Compliance Manager hours x $344) + (0.75 Attorney hours x $462) + (1 Senior Systems Analyst hours x $316) + (0.2 Assistant General Counsel
  hours x $518) + (0.1 General Counsel hour x $663) + (0.2 Chief Compliance Officer hours x $589) + (1 Senior Business Analyst hours x $305) = $1,513.
\2\ $1,513 per notification x 4 notifications each year = $6,052 per Current SCI Entity.
\3\ (6.75 Compliance Manager hours x $344) + (6.75 Attorney hours x $462) + (9 Senior Systems Analyst hours x $316) + (1.8 Assistant General Counsel
  hours x $518) + (0.9 General Counsel hour x $663) + (1.8 Chief Compliance Officer hours x $589) + (9 Senior Business Analyst hours x $305) = $13,619.
\4\ $13,619 per notification x 4 notifications each year = $54,476 per New SCI Entity.

    The Commission estimates that while SCI entities will handle
internally most of the work associated with Rule 1002(b), SCI entities
will seek outside legal advice in the preparation of certain Commission
notifications. The Commission estimates that the total annual reporting
cost of seeing outside legal advice is $5,800 per SCI entity.\523\
Because Rule 1002(b) will impose approximately 32 reporting
requirements \524\ per SCI entity per year and each required
notification will be require an average of $181.25.\525\ The total
annual reporting costs for Current SCI Entities and New SCI Entities is
summarized below:
---------------------------------------------------------------------------

    \523\ The Commission-approved baseline for the annual reporting
cost of seeking outside legal advice is $5,800 per SCI entity. See
2022 PRA Supporting Statement, supra note 471.
    \524\ The Commission-approved baseline for the number of
reporting requirements required by Rule 1002(b) is 21 requirements
for each SCI entity. See 2022 PRA Supporting Statement, supra note
471. The proposed amendments add an additional 11 reporting
requirements (3 immediate notifications + 3 24-hour notifications +
2 updates pertaining to an SCI event + 3 interim/final
notifications). 21 + 11 = 32 reporting requirements.
    \525\ $5,800 per SCI entity/32 reporting requirements = $181.25
per reporting requirement.

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Cost per  SCI
                                                                                entity        Total cost
                                                                                (number of     burdens (cost
                                                                              Number of      Number of       Cost per        reporting        per SCI
                    Rule                           Type of respondent        respondents     reporting       reporting    requirements x     entity x
                                                                                requirements     requirement      cost per        number of
                                                                                reporting     respondents)
                                                                                requirement)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Rule 1002(b)(1)............................  Current SCI Entities..........           47               3         $181.25            $544         $25,556
                                             New SCI Entities..............           23               8          181.25           1,450          33,350
Rule 1002(b)(2)............................  Current SCI Entities..........           47               3          181.25             544          25,556
                                             New SCI Entities..............           23               8          181.25           1,450          33,350
Rule 1002(b)(3)............................  Current SCI Entities..........           47               2          181.25             363          17,038
                                             New SCI Entities..............           23               4          181.25             725          16,675
Rule 1002(b)(4)............................  Current SCI Entities..........           47               3          181.25             544          25,556
                                             New SCI Entities..............           23               8          181.25           1,450          33,350
Rule 1002(b)(5)............................  Current SCI Entities..........           47               0          181.25               0               0
                                             New SCI Entities..............           23               4          181.25             725          16,675
--------------------------------------------------------------------------------------------------------------------------------------------------------

d. Rule 1002(c)
    The Commission anticipates that the proposed amendment will newly
impose the information dissemination requirements of Rule 1002(c)(1) on
New SCI Entities, and New SCI Entities will incur the same burdens that
Current SCI Entities already incur to comply with these
requirements.\526\ The table below summarizes the burden that would be
newly imposed on New SCI Entities:
---------------------------------------------------------------------------

    \526\ Current SCI Entities are already required to comply with
Rule 1002(c)(1). The burdens for compliance are summarized in the
most recent PRA Supporting Statement. See 2022 PRA Supporting
Statement, supra note 471. The proposed amendments impose no
additional burden related to this section. The Commission does not
anticipate that New SCI Entities would incur burdens beyond what is
estimated in the 2022 PRA Supporting Statement.

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Burden hours for all
                                                                                Burden hours per       respondents
                                                              Estimated          Number of           Hours per       SCI Entity          (estimated
               Rule                    Respondent type       respondents       dissemination       dissemination     (number of         respondents x
                                                                                reports x hours    burden hours  per
                                                                                per report)         SCI entity)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Rule 1002(c)(1)(i)................  New SCI Entities.....              23  3 information                   \2\ 7                21                   483
                                                                            disseminations \1\.
Rule 1002(c)(1)(ii) and (iii).....                                         9 updates \3\........          \4\ 13               117                 2,691
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ The Commission's currently approved baseline for the number of each SCI entity's information disseminations per year under Rule 1002(c)(1)(i) is
  three information disseminations. See 2022 PRA Supporting Statement, supra note 471.
\2\ The Commission's currently approved baseline is that each information dissemination under Rule 1002(c)(1)(i) would require 7 hours. This includes 1
  Compliance Manager hour, 2.67 Attorney hours, 1 Senior System Analyst hour, 0.5 General Counsel hours, 0.5 Director of Compliance hours, 0.5 Chief
  Compliance Officer hours, 0.5 Corporate Communications Manager hours, and 0.33 Webmasters hours. See 2022 PRA Supporting Statement, supra note 471.
\3\ The Commission's currently approved baseline for Rule 1002(c)(1)(ii) and (iii) is that each SCI entity will disseminate three updates for each SCI
  event. 3 updates per SCI Event x 3 SCI events = 9 updates each year.
\4\ The Commission's currently approved baseline is that each information dissemination under Rule 1002(c)(1)(ii) and (iii) would require 13 hours. This
  includes 2 Compliance Manager hours, 4.67 Attorney hours, 2 Senior System Analyst hour, 1 General Counsel hours, 1 Director of Compliance hours, 1
  Chief Compliance Officer hours, 1 Corporate Communications Manager hours, and 0.33 Webmasters hours. See 2022 PRA Supporting Statement, supra note
  471, at 25-26.

    The table below summarizes the Commission's estimates for the
average internal cost of compliance associated with the ongoing
reporting burden for Current SCI Entities and New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
              Rule                  Respondent type     respondents    cost of compliance       respondents x
                                                        (entities)       per SCI entity       average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
Rule 1002(c)(1)(i)..............  New SCI Entities..              23            \1\ $9,212              $211,876
Rule 1002(c)(1)(ii) and (iii)...                                                \2\ 51,666             1,188,318
----------------------------------------------------------------------------------------------------------------
\1\ (1 Compliance Manager hours x $344) + (2.67 Attorney hours x $462) + (1 Senior Systems Analyst hours x $316)
  + (0.5 General Counsel hour x $663) + (0.5 Chief Compliance Officer hours x $589) + (0.5 Director of
  Compliance hours x $542) + (0.5 Corporate Communications Manager hours x $378) + (0.33 Webmaster hours x $276)
  = $3,071. $3,071 per notification x 3 notifications each year = $9,212.
\2\ (2 Compliance Manager hours x $344) + (4.67 Attorney hours x $462) + (2 Senior Systems Analyst hours x $316)
  + (1 General Counsel hour x $663) + (1 Chief Compliance Officer hours x $589) + (1 Director of Compliance
  hours x $542) + (1 Corporate Communications Manager hours x $378) + (0.33 Webmaster hours x $276) = $5,741.
  $5,741 per notification x 9 notifications each year = $51,666.

    With respect to the Rule 1002(c)(2) requirement to disseminate
information regarding systems intrusions, the Commission estimates that
each Current SCI Entity will disseminate information regarding 3
systems intrusions each year and each New SCI Entity will disseminate
information regarding 4 systems intrusions each year.\527\ The
Commission estimates that each dissemination under Rule 1002(c)(2) will
require 10 hours.\528\
---------------------------------------------------------------------------

    \527\ The Commission's currently approved baseline for the
number of each SCI entity's information disseminations per year
under Rule 1002(c)(2) is that each SCI entity will disseminate
information about one systems intrusion each year. See 2022 PRA
Supporting Statement, supra note 471. As discussed above, the
Commission estimates an additional three SCI events (i.e., three
additional systems intrusions) as a result of the additional types
of systems intrusions added to the definition systems intrusions in
Rule 1000 and the elimination of systems intrusions from the de
minimis SCI events reported quarterly in Rule 1002(b)(5). The
Commission estimates that each SCI entity would disseminate
information related to four systems intrusions each year. Each
Current SCI Entity would disseminate information for three systems
intrusions beyond the baseline estimate of one systems intrusion. As
New SCI Entities will newly incur this burden, and as a result will
report four systems intrusions.
    \528\ The Commission's currently approved baseline is that each
dissemination under Rule 1002(c)(2) will require 10 hours. See 2022
PRA Supporting Statement, supra note 471.
---------------------------------------------------------------------------

    The table below summarizes the initial and ongoing annual burden
estimates for Current SCI Entities and New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Burden hours for all
                                                                                respondents
                                                               Estimated     Burden hours        (estimated
                      Respondent type                         respondents   per SCI entity      respondents x
                                                              (entities)                      burden hours  per
                                                                                SCI entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities......................................              47          \1\ 30                 1,410
New SCI Entities..........................................              23          \2\ 40                   920
----------------------------------------------------------------------------------------------------------------
\1\ 3 information disseminations x 10 hours per dissemination = 30 hours.
\2\ 4 information disseminations x 10 hours per dissemination = 40 hours.

    The Commission estimates that the average internal cost of
compliance per notification is $4,406.\529\ The table below summarizes
the Commission's estimates for the cost of compliance associated with
the ongoing reporting burden for Current SCI Entities and New SCI
Entities:
---------------------------------------------------------------------------

    \529\ (1.5 Compliance Manager hours x $344) + (3.67 Attorney
hours x $462) + (1.5 Senior Systems Analyst hours x $316) + (0.75
General Counsel hour x $633) + (0.75 Director of Compliance hours x
$542) + (0.75 Chief Compliance Officer hours x $589) + (0.75
Corporate Communications Manager hours x $378) + (0.33 Webmasters
hours x $276) = $4,406 per notification.

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
                   Respondent type                      respondents    cost of compliance       respondents x
                                                        (entities)       per SCI entity       average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
Current SCI Entities................................              47           \1\ $13,218              $621,246
New SCI Entities....................................              23            \2\ 17,624               405,352
----------------------------------------------------------------------------------------------------------------
\1\ $4,406 per notification x 3 information disseminations each year = $13,218.
\2\ $4,406 per notification x 4 information disseminations per year = $17,624.

    The Commission believes SCI entities will seek outside legal advice
in the preparation of the information dissemination under Rule 1002(c).
The Commission estimates that the total annual reporting cost of seeing
outside legal advice is $3,320 per SCI entity.\530\ Because Rule
1002(c) will impose approximately 16 third-party disclosure
requirements \531\ per SCI entity per year and each required disclosure
will be require an average of $207.50.\532\ The total annual reporting
costs for Current SCI Entities and New SCI Entities are summarized
below:
---------------------------------------------------------------------------

    \530\ The Commission-approved baseline for the annual reporting
cost of seeking outside legal advice is $3,320 per SCI entity. See
2022 PRA Supporting Statement, supra note 471.
    \531\ The Commission-approved baseline for the number of
disclosure requirements required by Rule 1002(c) is 13 requirements
for each SCI entity. See 2022 PRA Supporting Statement, supra note
471. The proposed amendments add an additional 3 reporting
requirements (3 additional information disseminations related to 3
additional systems intrusions). 13 + 3 = 16 disclosure requirements.
    \532\ $3,320 per SCI entity/16 reporting requirements = $207.50
per reporting requirement.

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Cost per SCI     Total cost
                                                                                entity (number   burdens (cost
                     Rule                                Respondent type            Number of    Number of     Cost per   of disclosures  per SCI entity
                                                                                respondents  disclosures   disclosure    x cost per      x number of
                                                                                disclosure)    respondents)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Rule 1002(c)(1)(i)............................  New SCI Entities.................           23            3      $207.50         $622.50      $14,317.50
Rule 1002(c)(1)(ii) and (iii).................  New SCI Entities.................           23            9       207.50        1,867.50       42,952.50
Rule 1002(c)(2)...............................  Current SCI Entities.............           47            3       207.50          622.50       29,257.50
                                                New SCI Entities.................           23            4       207.50             830          19,090
--------------------------------------------------------------------------------------------------------------------------------------------------------

    As noted above, Regulation SCI requires SCI entities to identify
certain types of events and systems. The Commission believes that the
identification of critical SCI systems, major SCI events, and de
minimis SCI events will impose an initial one-time implementation
burden on new SCI entities in developing processes to quickly and
correctly identify the nature of a system or event. The identification
of these systems and events may also impose periodic burdens on SCI
entities in reviewing and updating the processes. The Commission
anticipates that the because the proposed amendment will newly impose
the requirements of Rule 1002(b) on New SCI Entities, New SCI Entities
will incur the burden to develop processes to comply with these
requirements.\533\ The Commission estimates that each New SCI entity
will initially require 198 hours to establish criteria for identifying
material systems changes and 39 hours to annually to review and update
the criteria.\534\ The table below summarizes the burden that would be
newly imposed on New SCI Entities:
---------------------------------------------------------------------------

    \533\ Current SCI Entities are already required to comply with
Rule 1003(a). The burdens for compliance are summarized in the most
recent PRA Supporting Statement. See 2022 PRA Supporting Statement,
supra note 471. The proposed amendments impose no additional burden
related to this section.
    \534\ These estimates reflect the Commission-approved baseline.
See 2022 PRA Supporting Statement, supra note 471. The Commission
does not anticipate that New SCI Entities would incur burdens beyond
what is estimated in the 2022 PRA Supporting Statement.

----------------------------------------------------------------------------------------------------------------
                                                                                Estimated burden
                                                               Estimated                        hours for all
          Respondent type                 Burden type         respondents    Burden hours    entities (estimated
                                                              (entities)      per entity    respondents x burden
                                                                                hours per entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities...................  Initial..............              23             198                 4,554
                                     Annual...............              23              39                   897
----------------------------------------------------------------------------------------------------------------

    The table below summarizes the Commission's estimates for the
average internal cost of compliance for New SCI Entities:

----------------------------------------------------------------------------------------------------------------
                                                                                Total internal  cost
                                                                                of compliance
                                                         Estimated      Average internal         (estimated
         Respondent type              Burden type       respondents    cost of compliance       respondents x
                                                        (entities)         per entity         average internal
                                                                                cost of compliance
                                                                                per entity)
----------------------------------------------------------------------------------------------------------------
New SCI Entities................  Initial...........              23           \1\ $78,144            $1,797,312
                                  Annual............              23            \2\ 17,258               396,934
----------------------------------------------------------------------------------------------------------------
\1\ (64 Compliance Manager hours x $344) + (64 Attorney hours x $462) + (20 Senior Systems Analyst hours x $316)
  + (20 Operations Specialist hours x $152) + (20 Chief Compliance Officer hours x $589) + (10 Director of
  Compliance hours x $542) = $78,144.
\2\ (9 Compliance Manager hours x $344) + (9 Attorney hours x $462) + (3 Senior Systems Analyst hours x $316) +
  (3 Operations Specialist hours x $152) + (10 Chief Compliance Officer hours x $589) + (5 Director of
  Compliance hours x $542) = $17,258.

    As discussed above in section III.C.3.c, the proposed amendments to
the definition of systems intrusion would require SCI entities to
establish reasonable written criteria to identify significant attempted
unauthorized entries into the SCI systems or indirect SCI systems of an
SCI entity. As this is a new burden for both Current SCI Entities and
New SCI Entities, the Commission estimates an average burden across all
SCI entities of 89 hours \535\ initially to establish the criteria for
identifying material systems changes and 14.5 hours \536\ annually to
review and update the criteria.
---------------------------------------------------------------------------

    \535\ This estimate is based on the Commission's burden estimate
for Rule 1001(a), because Rule 1001(a) requires policies and
procedures. See supra notes 474-475 and accompanying text. Rule
1001(a) (excluding Rule 1001(a)(2)(vi)) requires a total of ten
policy elements at a minimum, consisting of six currently required
policy elements and four proposed policy elements. See supra notes
471 and 474. Because the proposed amendment to the definition of
systems intrusion in Rule 1000 requires only one set of written
criteria, the Commission estimates that the initial staff burden to
draft the criteria required to identify significant attempted
unauthorized systems intrusions is one-tenth of the initial staff
burden to draft the policies and procedures required by Rule 1001(a)
(excluding Rule 1001(a)(2)(vi)). 890 hours/10 policy elements = 89
burden hours per policy element. The 89 burden hours includes 25
hours for a Compliance Manager, 25 hours for an Attorney, 8 hours
for a Senior Systems Analyst, and 8 hours for an Operations
Specialist. The Commission also estimates that a Chief Compliance
Officer will spend 15 hours and a Director of Compliance and a
Director of Compliance will spend 8 hours reviewing the policies and
procedures.
    \536\ This estimate is based on the Commission's burden estimate
for Rule 1001(a), because Rule 1001(a) requires policies and
procedures. See supra notes 475-476 and accompanying text. Rule
1001(a) (excluding Rule 1001(a)(2)(vi)) requires a total of ten
policy elements at a minimum, consisting of six currently required
policy elements and four proposed policy elements. See supra notes
472 and 475. Because the proposed amendment to the definition of
systems intrusion in Rule 1000 requires only one set of written
criteria, the Commission estimates that the ongoing staff burden to
review and update the criteria required to identify significant
attempted unauthorized systems intrusions is one-tenth of the
ongoing staff burden to review and update the policies and
procedures required by Rule 1001(a) (excluding Rule 1001(a)(2)(vi)).
145 hours/10 policy elements = 14.5 burden hours per policy element.
The 14.5 burden hours includes 2 hours for a Compliance Manager, 2
hours for an Attorney, 1 hours for a Senior Systems Analyst, and 1
hours for an Operations Specialist. The Commission also estimates
that a Chief Compliance Officer will spend 5.5 hours and a Director