17 CFR Part 239

    Reporting and recordkeeping requirements, Securities.

17 CFR Parts 270 and 274

    Investment companies, Reporting and recordkeeping requirements,
Securities.

17 CFR Parts 275 and 279

    Reporting and recordkeeping requirements, Securities.

Text of Proposed Rules and Rule and Form Amendments

    For the reasons set forth in the preamble, the Commission is
proposing to amend title 17, chapter II of the Code of Federal
Regulations as follows:

PART 230--GENERAL RULES AND REGULATIONS, SECURITIES ACT OF 1933

0
1. The authority citation for part 230 continues to read, in part, as
follows:

    Authority:  15 U.S.C. 77b, 77b note, 77c, 77d, 77f, 77g, 77h,
77j, 77r, 77s, 77z-3, 77sss, 78c, 78d, 78j, 78l, 78m, 78n, 78o, 78o-
7 note, 78t, 78w, 78ll(d), 78mm, 80a-8, 80a-24, 80a-28, 80a-29, 80a-
30, and 80a-37, and Pub. L. 112-106, sec. 201(a), sec. 401, 126
Stat. 313 (2012), unless otherwise noted.
* * * * *
    Sections 230.400 to 230.499 issued under secs. 6, 8, 10, 19, 48
Stat. 78, 79, 81, and 85, as amended (15 U.S.C. 77f, 77h, 77j, 77s).
* * * * *
0
2. Amend Sec.  230.485 by revising paragraph (c)(3) to read as follows:

Sec.  230.485   Effective date of post-effective amendments filed by
certain registered investment companies.

* * * * *
    (c) * * *
    (3) A registrant's ability to file a post-effective amendment,
other than an amendment filed solely for purposes of submitting an
Interactive Data File, under paragraph (b) of this section is
automatically suspended if a registrant fails to submit any Interactive
Data File (as defined in Sec.  232.11 of this chapter) required by the
Form on which the registrant is filing the post-effective amendment. A
suspension under this paragraph (c)(3) shall become effective at such
time as the registrant fails to submit an Interactive Data File as
required by the relevant Form. Any such suspension, so long as it is in
effect, shall apply to any post-effective amendment that is filed after
the suspension becomes effective, but shall not apply to any post-
effective amendment that was filed before the suspension became
effective. Any suspension shall apply only to the ability to file a
post-effective amendment pursuant to paragraph (b) of this section and
shall not otherwise affect any post-effective amendment. Any suspension
under this paragraph (c)(3) shall terminate as soon as a registrant has
submitted the Interactive Data File required by the relevant Form.
* * * * *
0
3. Amend Sec.  230.497 by revising paragraphs (c) and (e) to read as
follows:

Sec.  230.497   Filing of investment company prospectuses--number of
copies.

* * * * *
    (c) For investment companies filing on Sec. Sec.  239.15A and
274.11A of this chapter (Form N-1A), Sec. Sec.  239.17a and 274.11b of
this chapter (Form N-3), Sec. Sec.  239.17b and 274.11c of this chapter
(Form N-4), or Sec. Sec.  239.17c and 274.11d of this chapter (Form N-
6), within five days after the effective date of a registration
statement or the commencement of a public offering after the effective
date of a registration statement, whichever occurs later, 10 copies of
each form of prospectus and form of Statement of Additional Information
used after the effective date in connection with such offering shall be
filed with the Commission in the exact form in which it was used.
Investment companies filing on Forms N-1A, N-3, N-4, or N-6 must submit
an Interactive Data File (as defined in Sec.  232.11 of this chapter)
if required by the Form on which the registrant files its registration
statement.
* * * * *
    (e) For investment companies filing on Sec. Sec.  239.15A and
274.11A of this chapter (Form N-1A), Sec. Sec.  239.17a and 274.11b of
this chapter (Form N-3), Sec. Sec.  239.17b and 274.11c of this chapter
(Form N-4), or Sec. Sec.  239.17c and 274.11d of this chapter (Form N-
6), after the effective date of a registration statement, no prospectus
that purports to comply with Section 10 of the Act (15 U.S.C. 77j) or
Statement of Additional Information that varies from any form of
prospectus or form of Statement of Additional Information filed
pursuant to paragraph (c) of this section shall be used until five
copies thereof have been filed with, or mailed for filing to the
Commission. Investment companies filing on Forms N-1A, N-3, N-4, or N-6
must submit an Interactive Data File (as defined in Sec.  232.11 of
this chapter) if required by the Form on which the registrant files its
registration statement.
* * * * *

PART 232--REGULATION S-T--GENERAL RULES AND REGULATIONS FOR
ELECTRONIC FILINGS

0
4. The authority citation for part 232 continues to read, in part, as
follows:

    Authority:  15 U.S.C. 77c, 77f, 77g, 77h, 77j, 77s(a), 77z-3,
77sss(a), 78c(b), 78l, 78m, 78n, 78o(d), 78w(a), 78ll, 80a-6(c),
80a-8, 80a-29, 80a-30, 80a-37, 7201 et seq.; and 18 U.S.C. 1350,
unless otherwise noted.
* * * * *
0
5. Amend Sec.  232.11 by revising the definition of ``Related Official
Filing'' to read as follows:

Sec.  232.11  Definition of terms used in this part.

* * * * *
    Related Official Filing. The term Related Official Filing means the
ASCII or HTML format part of the official filing with which all or part
of an Interactive Data File appears as an exhibit or, in the case of a
filing on Form N-1A (Sec. Sec.  239.15A and 274.11A of this chapter),
Form N-2 (Sec. Sec.  239.14 and 274.11a-1 of this chapter), Form N-3
(Sec. Sec.  239.17a and 274.11b of this chapter), Form N-4 (Sec. Sec.
239.17b and 274.11c of this chapter), Form N-6 (Sec. Sec.  239.17c and

274.11d of this chapter), Form N-8B-2 (Sec.  274.12 of this chapter),
Form S-6 (Sec.  239.16 of this chapter), and Form N-CSR (Sec. Sec.
249.331 and 274.128 of this chapter), and, to the extent required by
Sec.  232.405 [Rule 405 of Regulation S-T] for a business development
company as defined in Sec.  2(a)(48) of the Investment Company Act of
1940 (15 U.S.C. 80a-2(a)(48)), Form 10-K (Sec.  249.310 of this
chapter), Form 10-Q (Sec.  249.308a of this chapter), and Form 8-K
(Sec.  249.308 of this chapter), the ASCII or HTML format part of an
official filing that contains the information to which an Interactive
Data File corresponds.
* * * * *
0
6. Amend Sec.  232.405 by revising the introductory text, paragraphs
(a)(2), (a)(3) introductory text, (a)(3)(i) introductory text, and
(3)(ii), (a)(4), (b)(1) introductory text, (b)(2), (b)(3)(iii), Note 1
to Sec.  232.405(b)(1), and Note 2 to Sec.  232.405 to read as follows:

Sec.  232.405  Interactive Data File submissions.

    This section applies to electronic filers that submit Interactive
Data Files. Section 229.601(b)(101) of this chapter (Item 601(b)(101)
of Regulation S-K), paragraph (101) of Part II--Information Not
Required to be Delivered to Offerees or Purchasers of Form F-10 (Sec.
239.40 of this chapter), paragraph 101 of the Instructions as to
Exhibits of Form 20-F (Sec.  249.220f of this chapter), paragraph
B.(15) of the General Instructions to Form 40-F (Sec.  249.240f of this
chapter), paragraph C.(6) of the General Instructions to Form 6-K
(Sec.  249.306 of this chapter), General Instruction C.3.(g) of Form N-
1A (Sec. Sec.  239.15A and 274.11A of this chapter), General
Instruction I of Form N-2 (Sec. Sec.  239.14 and 274.11a-1 of this
chapter), General Instruction C.3.(h) of Form N-3 (Sec. Sec.  239.17a
and 274.11b of this chapter), General Instruction C.3.(h) of Form N-4
(Sec. Sec.  239.17b and 274.11c of this chapter), General Instruction
C.3.(h) of Form N-6 (Sec. Sec.  239.17c and 274.11d of this chapter),
General Instruction 2.(l) of Form N-8B-2 (Sec.  274.12 of this
chapter), General Instruction 5 of Form S-6 (Sec.  239.16 of this
chapter), and General Instruction C.4 of Form N-CSR (Sec. Sec.  249.331
and 274.128 of this chapter) specify when electronic filers are
required or permitted to submit an Interactive Data File (Sec.
232.11), as further described in note 1 to this section. This section
imposes content, format, and submission requirements for an Interactive
Data File, but does not change the substantive content requirements for
the financial and other disclosures in the Related Official Filing
(Sec.  232.11).
    (a) * * *
    (2) Be submitted only by an electronic filer either required or
permitted to submit an Interactive Data File as specified by Sec.
229.601(b)(101) of this chapter (Item 601(b)(101) of Regulation S-K),
paragraph (101) of Part II--Information Not Required to be Delivered to
Offerees or Purchasers of Form F-10 (Sec.  239.40 of this chapter),
paragraph 101 of the Instructions as to Exhibits of Form 20-F (Sec.
249.220f of this chapter), paragraph B.(15) of the General Instructions
to Form 40-F (Sec.  249.240f of this chapter), paragraph C.(6) of the
General Instructions to Form 6-K (Sec.  249.306 of this chapter),
General Instruction C.3.(g) of Form N-1A (Sec. Sec.  239.15A and
274.11A of this chapter), General Instruction I of Form N-2 (Sec. Sec.
239.14 and 274.11a-1 of this chapter), General Instruction C.3.(h) of
Form N-3 (Sec. Sec.  239.17a and 274.11b of this chapter), General
Instruction C.3.(h) of Form N-4 (Sec. Sec.  239.17b and 274.11c of this
chapter), General Instruction C.3.(h) of Form N-6 (Sec. Sec.  239.17c
and 274.11d of this chapter), General Instruction 2.(l) of Form N-8B-2
(Sec.  274.12 of this chapter), General Instruction 5 of Form S-6
(Sec.  239.16 of this chapter), or General Instruction C.4 of Form N-
CSR (Sec. Sec.  249.331 and 274.128 of this chapter), as applicable;
    (3) Be submitted using Inline XBRL:
    (i) If the electronic filer is not a management investment company
registered under the Investment Company Act of 1940 (15 U.S.C. 80a et
seq.), a separate account as defined in Section 2(a)(14) of the
Securities Act (15 U.S.C. 77b(a)(14)) registered under the Investment
Company Act of 1940, a business development company as defined in
Section 2(a)(48) of the Investment Company Act of 1940 (15 U.S.C. 80a-
2(a)(48)), or a unit investment trust as defined in Section 4(2) of the
Investment Company Act of 1940 (15 U.S.C. 80a-4), and is not within one
of the categories specified in paragraph (f)(1)(i) of this section, as
partly embedded into a filing with the remainder simultaneously
submitted as an exhibit to:
* * * * *
    (ii) If the electronic filer is a management investment company
registered under the Investment Company Act of 1940 (15 U.S.C. 80a et
seq.), or a separate account (as defined in Section 2(a)(14) of the
Securities Act (15 U.S.C. 77b(a)(14)) registered under the Investment
Company Act of 1940, a business development company as defined in
Section 2(a)(48) of the Investment Company Act of 1940 (15 U.S.C. 80a-
2(a)(48)), or a unit investment trust as defined in Section 4(2) of the
Investment Company Act of 1940 (15 U.S.C. 80a-4) and is not within one
of the categories specified in paragraph (f)(1)(ii) of this section, as
partly embedded into a filing with the remainder simultaneously
submitted as an exhibit to a filing that contains the disclosure this
section requires to be tagged; and
    (4) Be submitted in accordance with the EDGAR Filer Manual and, as
applicable, either Item 601(b)(101) of Regulation S-K (Sec.
229.601(b)(101) of this chapter), paragraph (101) of Part II--
Information Not Required to be Delivered to Offerees or Purchasers of
Form F-10 (Sec.  239.40 of this chapter), paragraph 101 of the
Instructions as to Exhibits of Form 20-F (Sec.  249.220f of this
chapter), paragraph B.(15) of the General Instructions to Form 40-F
(Sec.  249.240f of this chapter), paragraph C.(6) of the General
Instructions to Form 6-K (Sec.  249.306 of this chapter), General
Instruction C.3.(g) of Form N-1A (Sec. Sec.  239.15A and 274.11A of
this chapter), General Instruction I of Form N-2 (Sec. Sec.  239.14 and
274.11a-1 of this chapter), General Instruction C.3.(h) of Form N-3
(Sec. Sec.  239.17a and 274.11b of this chapter), General Instruction
C.3.(h) of Form N-4 (Sec. Sec.  239.17b and 274.11c of this chapter),
General Instruction C.3.(h) of Form N-6 (Sec. Sec.  239.17c and 274.11d
of this chapter); General Instruction 2.(l) of Form N-8B-2 (Sec.
274.12 of this chapter); General Instruction 5 of Form S-6 (Sec.
239.16 of this chapter); or General Instruction C.4 of Form N-CSR
(Sec. Sec.  249.331 and 274.128 of this chapter).
    (b) * * *
    (1) If the electronic filer is not a management investment company
registered under the Investment Company Act of 1940 (15 U.S.C. 80a et
seq.), a separate account (as defined in Section 2(a)(14) of the
Securities Act (15 U.S.C. 77b(a)(14)) registered under the Investment
Company Act of 1940, a business development company as defined in
Section 2(a)(48) of the Investment Company Act of 1940 (15 U.S.C. 80a-
2(a)(48)), or a unit investment trust as defined in Section 4(2) of the
Investment Company Act of 1940 (15 U.S.C. 80a-4), an Interactive Data
File must consist of only a complete set of information for all periods
required to be presented in the corresponding data in the Related
Official Filing, no more and no less, from all of the following
categories:
* * * * *
    Note 1 to Sec.  232.405(b)(1): It is not permissible for the
Interactive Data File to present only partial face financial
statements, such as by excluding

comparative financial information for prior periods.
    (2) If the electronic filer is an open-end management investment
company registered under the Investment Company Act of 1940, a separate
account (as defined in section 2(a)(14) of the Securities Act)
registered under the Investment Company Act of 1940 (15 U.S.C. 80a et
seq.), or a unit investment trust as defined in Section 4(2) of the
Investment Company Act of 1940 (15 U.S.C. 80a-4), an Interactive Data
File must consist of only a complete set of information for all periods
required to be presented in the corresponding data in the Related
Official Filing, no more and no less, from the information set forth
in:
(i) Items 2, 3, 4, and 10(a)(4) of Sec. Sec.  239.15A and 274.11A of
this chapter (Form N-1A);
    (ii) Items 2, 4, 5, 11, 16A, 18 and 19 of Sec. Sec.  239.17a and
274.11b of this chapter (Form N-3);
    (iii) Items 2, 4, 5, 10, 16A, and 17 of Sec. Sec.  239.17b and
274.11c of this chapter (Form N-4);
    (iv) Items 2, 4, 5, 10, 11, 16A and 18 of Sec. Sec.  239.17c and
274.11d of this chapter (Form N-6); or
    (v) Item 9A of Sec.  274.12 of this chapter (Form N-8B-2),
including to the extent required by Sec.  239.16 of this chapter (Form
S-6); as applicable.
    (3) * * *
    (iii) As applicable, all of the information provided in response to
Items 3.1, 4.3, 8.2.b, 8.2.d, 8.3.a, 8.3.b, 8.5.b, 8.5.c, 8.5.e,
10.1.a-d, 10.2.a-c, 10.2.e, 10.3, 10.5, and 13 of Form N-2 in any
registration statement or post-effective amendment thereto filed on
Form N-2; or any form of prospectus filed pursuant to Sec.  230.424 of
this chapter (Rule 424 under the Securities Act); or, if a Registrant
is filing a registration statement pursuant to General Instruction A.2
of Form N-2, any filing on Form N-CSR, Form 10-K, Form 10-Q, or Form 8-
K to the extent such information appears therein.
* * * * *
    Note 2 to Sec.  232.405: Section 229.601(b)(101) of this chapter
(Item 601(b)(101) of Regulation S-K) specifies the circumstances under
which an Interactive Data File must be submitted and the circumstances
under which it is permitted to be submitted, with respect to Sec.
239.11 of this chapter (Form S-1), Sec.  239.13 of this chapter (Form
S-3), Sec.  239.25 of this chapter (Form S-4), Sec.  239.18 of this
chapter (Form S-11), Sec.  239.31 of this chapter (Form F-1), Sec.
239.33 of this chapter (Form F-3), Sec.  239.34 of this chapter (Form
F-4), Sec.  249.310 of this chapter (Form 10-K), Sec.  249.308a of this
chapter (Form 10-Q), and Sec.  249.308 of this chapter (Form 8-K).
Paragraph (101) of Part II--Information not Required to be Delivered to
Offerees or Purchasers of Sec.  239.40 of this chapter (Form F-10)
specifies the circumstances under which an Interactive Data File must
be submitted and the circumstances under which it is permitted to be
submitted, with respect to Form F-10. Paragraph 101 of the Instructions
as to Exhibits of Sec.  249.220f of this chapter (Form 20-F) specifies
the circumstances under which an Interactive Data File must be
submitted and the circumstances under which it is permitted to be
submitted, with respect to Form 20-F. Paragraph B.(15) of the General
Instructions to Sec.  249.240f of this chapter (Form 40-F) and
Paragraph C.(6) of the General Instructions to Sec.  249.306 of this
chapter (Form 6-K) specify the circumstances under which an Interactive
Data File must be submitted and the circumstances under which it is
permitted to be submitted, with respect to Sec.  249.240f of this
chapter (Form 40-F) and Sec.  249.306 of this chapter (Form 6-K).
Section 229.601(b)(101) (Item 601(b)(101) of Regulation S-K), paragraph
(101) of Part II--Information not Required to be Delivered to Offerees
or Purchasers of Form F-10, paragraph 101 of the Instructions as to
Exhibits of Form 20-F, paragraph B.(15) of the General Instructions to
Form 40-F, and paragraph C.(6) of the General Instructions to Form 6-K
all prohibit submission of an Interactive Data File by an issuer that
prepares its financial statements in accordance with 17 CFR 210.6-01
through 210.6-10 (Article 6 of Regulation S-X). For an issuer that is a
management investment company or separate account registered under the
Investment Company Act of 1940 (15 U.S.C. 80a et seq.), a business
development company as defined in Section 2(a)(48) of the Investment
Company Act of 1940 (15 U.S.C. 80a-2(a)(48)), or a unit investment
trust as defined in Section 4(2) of the Investment Company Act of 1940
(15 U.S.C. 80a-4), General Instruction C.3.(g) of Form N-1A (Sec. Sec.
239.15A and 274.11A of this chapter), General Instruction I of Form N-2
(Sec. Sec.  239.14 and 274.11a-1 of this chapter), General Instruction
C.3.(h) of Form N-3 (Sec. Sec.  239.17a and 274.11b of this chapter),
General Instruction C.3.(h) of Form N-4 (Sec. Sec.  239.17b and 274.11c
of this chapter), General Instruction C.3.(h) of Form N-6 (Sec. Sec.
239.17c and 274.11d of this chapter), General Instruction 2.(l) of Form
N-8B-2 (Sec.  274.12 of this chapter), General Instruction 5 of Form S-
6 (Sec.  239.16 of this chapter), and General Instruction C.4 of Form
N-CSR (Sec. Sec.  249.331 and 274.128 of this chapter), as applicable,
specifies the circumstances under which an Interactive Data File must
be submitted.

PART 239--FORMS PRESCRIBED UNDER THE SECURITIES ACT OF 1933

0
7. The authority citation for part 239 continues to read, in part, as
follows:

    Authority: 15 U.S.C. 77c, 77f, 77g, 77h, 77j, 77s, 77z-2, 77z-3,
77sss, 78c, 78l, 78m, 78n, 78o(d), 78o-7 note, 78u-5, 78w(a), 78ll,
78mm, 80a-2(a), 80a-3, 80a-8, 80a-9, 80a-10, 80a-13, 80a-24, 80a-26,
80a-29, 80a-30, and 80a-37; and sec. 107, Pub. L. 112-106, 126 Stat.
312, unless otherwise noted.
* * * * *
0
8. Amend Form S-6 (referenced in Sec. Sec.  239.16) by adding General
Instruction 5 as follows:

    Note:  The text of Form S-6 does not, and these amendments will
not, appear in the Code of Federal Regulations.

Form S-6

* * * * *

General Instructions

* * * * *

Instruction 5. Interactive Data

    (a) An Interactive Data File as defined in rule 11 of Regulation S-
T [17 CFR 232.11] is required to be submitted to the Commission in the
manner provided by rule 405 of Regulation S-T [17 CFR 232.405] for any
registration statement or post-effective amendment thereto on Form S-6
that includes or amends information provided in response to item 9A of
Form N-8B-2 (as provided pursuant to Instruction 1.(a) of the
Instructions as to the Prospectus of this Form).
    (1) Except as required by paragraph (a)(2), the Interactive Data
File must be submitted as an amendment to the registration statement to
which the Interactive Data File relates. The amendment must be
submitted on or before the date the registration statement or post-
effective amendment that contains the related information becomes
effective.
    (2) In the case of a post-effective amendment to a registration
statement filed pursuant to paragraphs (b)(1)(i), (ii), (v), or (vii)
of rule 485 under the Securities Act [17 CFR 230.485(b)], the
Interactive Data File must be submitted either with the filing, or as
an amendment to the registration statement to which the Interactive
Data Filing relates that is submitted on or before the date the post-
effective amendment that

contains the related information becomes effective.
    (b) All interactive data must be submitted in accordance with the
specifications in the EDGAR Filer Manual.
* * * * *

PART 270--RULES AND REGULATIONS, INVESTMENT COMPANY ACT OF 1940

0
9. The authority citation for part 270 continues to read, in part, as
follows:

    Authority: 15 U.S.C. 80a-1 et seq., 80a-34(d), 80a-37, 80a-39,
and Pub. L. 111-203, sec. 939A, 124 Stat. 1376 (2010), unless
otherwise noted.
* * * * *
0
10. Section 270.38a-2 is added to read as follows:

Sec.  270.38a-2  Cybersecurity policies and procedures of certain
investment companies.

    (a) Cybersecurity policies and procedures. Each fund must adopt and
implement written policies and procedures that are reasonably designed
to address cybersecurity risks, including policies and procedures that:
    (1) Risk assessment. (i) Require periodic assessments of
cybersecurity risks associated with fund information systems and fund
information residing therein including requiring the fund to:
    (A) Categorize and prioritize cybersecurity risks based on an
inventory of the components of the fund information systems and fund
information residing therein and the potential effect of a
cybersecurity incident on the fund; and
    (B) Identify the fund's service providers that receive, maintain,
or process fund information, or are otherwise permitted to access fund
information systems and any fund information residing therein, and
assess the cybersecurity risks associated with the fund's use of these
service providers.
    (ii) Require written documentation of any risk assessments.
    (2) User security and access. Require controls designed to minimize
user-related risks and prevent the unauthorized access to fund
information systems and fund information residing therein including:
    (i) Requiring standards of behavior for individuals authorized to
access fund information systems and any fund information residing
therein, such as an acceptable use policy;
    (ii) Identifying and authenticating individual users, including
implementing authentication measures that require users to present a
combination of two or more credentials for access verification;
    (iii) Establishing procedures for the timely distribution,
replacement, and revocation of passwords or methods of authentication;
    (iv) Restricting access to specific fund information systems or
components thereof and fund information residing therein solely to
individuals requiring access to such systems and information as is
necessary for them to perform their responsibilities and functions on
behalf of the fund; and
    (v) Securing remote access technologies.
    (3) Information protection.
    (i) Require measures designed to monitor fund information systems
and protect fund information from unauthorized access or use, based on
a periodic assessment of the fund information systems and fund
information that resides on the systems that takes into account:
    (A) The sensitivity level and importance of fund information to its
business operations;
    (B) Whether any fund information is personal information;
    (C) Where and how fund information is accessed, stored and
transmitted, including the monitoring of fund information in
transmission;
    (D) Fund information systems access controls and malware
protection; and
    (E) The potential effect a cybersecurity incident involving fund
information could have on the fund and its shareholders, including the
ability for the fund to continue to provide services.
    (ii) Require oversight of service providers that receive, maintain,
or process fund information, or are otherwise permitted to access fund
information systems and any fund information residing therein and
through that oversight document that such service providers, pursuant
to a written contract between the fund and any such service provider,
are required to implement and maintain appropriate measures, including
the practices described in paragraphs (a)(1), (2), (3)(i), (4), and (5)
of this section, that are designed to protect fund information and fund
information systems.
    (4) Cybersecurity threat and vulnerability management. Require
measures to detect, mitigate, and remediate any cybersecurity threats
and vulnerabilities with respect to fund information systems and the
fund information residing therein.
    (5) Cybersecurity incident response and recovery. (i) Require
measures to detect, respond to, and recover from a cybersecurity
incident, including policies and procedures that are reasonably
designed to ensure:
    (A) Continued operations of the fund;
    (B) The protection of fund information systems and fund information
residing therein;
    (C) External and internal cybersecurity incident information
sharing and communications; and
    (D) Reporting of a significant fund cybersecurity incident by the
fund's adviser under Sec.  275.204-6 (Rule 204-6 under the Investment
Advisers Act of 1940).
    (ii) Require written documentation of any cybersecurity incident,
including the fund's response to and recovery from such an incident.
    (b) Annual review. A fund must, at least annually, review and
assess the design and effectiveness of the cybersecurity policies and
procedures required by paragraph (a) of this section, including whether
they reflect changes in cybersecurity risk over the time period covered
by the review.
    (c) Board oversight. A fund must:
    (1) Obtain the initial approval of the fund's board of directors,
including a majority of the directors who are not interested persons of
the fund, of the fund's policies and procedures; and
    (2) Provide, for review by the fund's board of directors, a written
report prepared no less frequently than annually by the fund that, at a
minimum, describes the review, the assessment, and any control tests
performed, explains their results, documents any cybersecurity incident
that occurred since the date of the last report, and discusses any
material changes to the policies and procedures since the date of the
last report.
    (d) Unit investment trusts. If the fund is a unit investment trust,
the fund's principal underwriter or depositor must:
    (i) Approve the fund's policies and procedures; and
    (ii) Receive all written reports required by paragraph (c) of this
section.
    (e) Recordkeeping. The fund must maintain:
    (1) A copy of the policies and procedures that are in effect, or at
any time within the past five years were in effect, in an easily
accessible place;
    (2) Copies of written reports provided to the board of directors
pursuant to paragraph (c)(2) of this section (or, if the fund is a unit
investment trust, to the fund's principal underwriter or depositor,
pursuant to paragraph (d) of this section) for at least five years
after the end of the fiscal year in which the documents were provided,
the first two years in an easily accessible place;
    (3) Any records documenting the review pursuant to paragraph (c)(2)
of

this section for at least five years after the end of the fiscal year
in which the annual review was conducted, the first two years in an
easily accessible place;
    (4) Any report provided to the Commission pursuant to paragraph
(a)(5) of this section for at least five years after the provision of
the report, the first two years in an easily accessible place;
    (5) Records documenting the occurrence of any cybersecurity
incident, including records related to any response and recovery from
such incident pursuant to paragraph (a)(5) of this section, for at
least five years after the date of the incident, the first two years in
an easily accessible place; and
    (6) Records documenting the risk assessment pursuant to paragraph
(a)(1) of this section for at least five years after the date of the
assessment, the first two years in an easily accessible place.
    (f) Definitions. For purposes of this section:
    Cybersecurity incident means an unauthorized occurrence on or
conducted through a fund's information systems that jeopardizes the
confidentiality, integrity, or availability of a fund's information
systems or any fund information residing therein.
    Cybersecurity risk means financial, operational, legal,
reputational, and other adverse consequences that could result from
cybersecurity incidents, threats, and vulnerabilities.
    Cybersecurity threat means any potential occurrence that may result
in an unauthorized effort to adversely affect the confidentiality,
integrity or availability of a fund's information systems or any fund
information residing therein.
    Cybersecurity vulnerability means a vulnerability in a fund's
information systems, information system security procedures, or
internal controls, including vulnerabilities in their design,
configuration, maintenance, or implementation that, if exploited, could
result in a cybersecurity incident.
    Fund means a registered investment company or a business
development company.
    Fund information means any electronic information related to the
fund's business, including personal information, received, maintained,
created, or processed by the fund.
    Fund information systems means the information resources owned or
used by the fund, including physical or virtual infrastructure
controlled by such information resources, or components thereof,
organized for the collection, processing, maintenance, use, sharing,
dissemination, or disposition of fund information to maintain or
support the fund's operations.
    Personal information means any information that can be used, alone
or in conjunction with any other information, to identify an
individual, such as name, date of birth, place of birth, telephone
number, street address, mother's maiden name, Social Security number,
driver's license number, electronic mail address, account number,
account password, biometric records or other nonpublic authentication
information.
    Significant fund cybersecurity incident means a cybersecurity
incident, or a group of related cybersecurity incidents, that
significantly disrupts or degrades the fund's ability to maintain
critical operations, or leads to the unauthorized access or use of fund
information, where the unauthorized access or use of such information
results in substantial harm to the fund or to an investor whose
information was accessed.

PART 274--FORMS PRESCRIBED UNDER THE INVESTMENT COMPANY ACT OF 1940

0
11. The authority citation for part 274 is revised to read as follows:

    Authority: 15 U.S.C. 77f, 77g, 77h, 77j, 77s, 78c(b), 78l, 78m,
78n, 78o(d), 80a-8, 80a-24, 80a-26, 80a-29, 80a-37, otherwise noted.

0
12. Amend Form N-1A (referenced in Sec. Sec.  239.15A and 274.11A) by
revising General Instruction C.3.(g)(i) and (ii), and adding Item
10(a)(4). The revisions read as follows:

    Note:  The text of Form N-1A does not, and these amendments will
not, appear in the Code of Federal Regulations.

Form N-1A

* * * * *

General Instructions

* * * * *

C. Preparation of the Registration Statement

* * * * *
    3. * * *
* * * * *
(g) Interactive Data File
    (i) An Interactive Data File (rule 232.11 of Regulation S-T [17 CFR
232.11]) is required to be submitted to the Commission in the manner
provided by rule 405 of Regulation S-T [17 CFR 232.405] for any
registration statement or post-effective amendment thereto on Form N-1A
that includes or amends information provided in response to Items 2, 3,
4, or 10(a)(4).
* * * * *
    (ii) An Interactive Data File is required to be submitted to the
Commission in the manner provided by rule 405 of Regulation S-T for any
form of prospectus filed pursuant to paragraphs (c) or (e) of rule 497
under the Securities Act [17 CFR 230.497(c) or (e)] that includes
information provided in response to Items 2, 3, 4, or 10(a)(4) that
varies from the registration statement. All interactive data must be
submitted with the filing made pursuant to rule 497.
* * * * *

Part A--INFORMATION REQUIRED IN A PROSPECTUS

* * * * *

Item 10. Management, Organization, and Capital Structure

* * * * *
    (4) Significant Fund Cybersecurity Incidents. Provide a description
of any significant fund cybersecurity incident as defined by rule 38a-2
of the Investment Company Act (17 CFR 270.38a-2) that has or is
currently affecting the Fund or its service providers.

Instructions

    1. The disclosure must include all significant fund cybersecurity
incidents that have occurred within the last 2 fiscal years, as well as
any currently ongoing.
    2. The description of each incident must include the following
information to the extent known: The entity or entities affected; when
the incident was discovered and whether it is ongoing; whether any data
was stolen, altered, or accessed or used for any other unauthorized
purpose; the effect of the incident on the Fund's operations; and
whether the Fund or service provider has remediated or is currently
remediating the incident.
* * * * *
0
13. Amend Form N-2 (referenced in Sec. Sec.  239.14 and 274.11a-1) by
revising General Instruction I.2 and 3, Item 13 is to read as follows:

    Note:  The text of Form N-2 does not, and these amendments will
not, appear in the Code of Federal Regulations.

Form N-2

* * * * *

General Instructions

* * * * *

I. Interactive Data

* * * * *
    2. An Interactive Data File is required to be submitted to the
Commission in

the manner provided by Rule 405 of Regulation S-T for any registration
statement or post-effective amendment thereto filed on Form N-2 or for
any form of prospectus filed pursuant to Rule 424 under the Securities
Act [17 CFR 230.424] that includes or amends information provided in
response to Items 3.1, 4.3, 8.2.b, 8.2.d, 8.3.a, 8.3.b, 8.5.b, 8.5.c,
8.5.e, 10.1.a-d, 10.2.a-c, 10.2.e, 10.3, 10.5, or 13. The Interactive
Data File must be submitted either with the filing, or as an amendment
to the registration statement to which it relates, on or before the
date the registration statement or post-effective amendment that
contains the related information becomes effective. Interactive Data
Files must be submitted with the filing made pursuant to Rule 424.
    3. If a Registrant is filing a registration statement pursuant to
General Instruction A.2, an Interactive Data File is required to be
submitted to the Commission in the manner provided by Rule 405 of
Regulation S-T for any of the documents listed in General Instruction
F.3.(a) or General Instruction F.3.(b) that include or amend
information provided in response to Items 3.1, 4.3, 8.2.b, 8.2.d,
8.3.a, 8.3.b, 8.5.b, 8.5.c, 8.5.e, 10.1.a-d, 10.2.a-c, 10.2.e, 10.3,
10.5, or 13. All interactive data must be submitted with the filing of
the document(s) listed in General Instruction F.3.(a) or General
Instruction F.3.(b).
* * * * *

Part A--INFORMATION REQUIRED IN A PROSPECTUS

* * * * *

Item 13. Significant Fund Cybersecurity Incidents

    Provide a description of any significant fund cybersecurity
incident as defined by rule 38a-2 of the Investment Company Act (17 CFR
270.38a-2) that has or is currently affecting the Registrant, any
subsidiary of the Registrant, or the Registrant's service providers.

Instructions.

    1. The disclosure must include all significant fund cybersecurity
incidents that have occurred within the last 2 fiscal years, as well as
any currently ongoing.
    2. The description of each incident must include the following
information to the extent known: The entity or entities affected; when
the incident was discovered and whether it is ongoing; whether any data
was stolen, altered, or accessed or used for any other unauthorized
purpose; the effect of the incident on the Registrant's operations; and
whether the Registrant, any subsidiary of the Registrant, or any
service provider of the Registrant has remediated or is currently
remediating the incident.
0
14. Amend Form N-3 (referenced in Sec. Sec.  239.17a and 274.11b) by
revising General Instruction C.3(h)(i) and (ii) and adding new Item 16A
to reads as follows:

    Note:  The text of Form N-3 does not, and these amendments will
not, appear in the Code of Federal Regulations.

Form N-3

* * * * *

GENERAL INSTRUCTIONS

* * * * *

C. Preparation of the Registration Statement

* * * * *
3. Additional Matters
* * * * *
    (h) Interactive Data
    (i) An Interactive Data File (see rule 232.11 of Regulation S-T [17
CFR 232.11]) is required to be submitted to the Commission in the
manner provided by rule 405 of Regulation S-T [17 CFR 232.405] for any
registration statement or post-effective amendment thereto on Form N-3
that includes or amends information provided in response to Items 2, 4,
5, 11, 16A, 18, or 19 with regards to Contracts that are being sold to
new investors.
* * * * *
    (ii) An Interactive Data File is required to be submitted to the
Commission in the manner provided by rule 405 of Regulation S-T for any
form of prospectus filed pursuant to paragraphs (c) or (e) of rule 497
under the Securities Act [17 CFR 230.497(c) or (e)] that includes
information provided in response to Items 2, 4, 5, 11, 16A, 18 or 19
that varies from the registration statement with regards to Contracts
that are being sold to new investors. All interactive data must be
submitted with the filing made pursuant to rule 497.
* * * * *

PART A--INFORMATION REQUIRED IN A PROSPECTUS

* * * * *

Item 16A. Significant Fund Cybersecurity Incidents

    Provide a description of any significant fund cybersecurity
incident as defined by rule 38a-2 of the Investment Company Act (17 CFR
270.38a-2) that has or is currently affecting the Registrant, Insurance
Company or the Registrant's service providers.

Instructions.

    1. The disclosure must include all significant fund cybersecurity
incidents that have occurred within the last 2 fiscal years, as well as
any currently ongoing.
    2. The description of each incident must include the following
information to the extent known: The entity or entities affected; when
the incident was discovered and whether it is ongoing; whether any data
was stolen, altered, or accessed or used for any other unauthorized
purpose; the effect of the incident on the Registrant's operations; and
whether the Registrant, Insurance Company, or any service provider of
the Registrant has remediated or is currently remediating the incident.
* * * * *
0
15. Amend Form N-4 (referenced in Sec. Sec.  239.17b and 274.11c) by
revising General Instruction C.3(h)(i) and (ii) and adding new Item 16A
to read as follows:

    Note: The text of Form N-4 does not, and these amendments will
not, appear in the Code of Federal Regulations.

Form N-4

* * * * *

GENERAL INSTRUCTIONS

* * * * *

C. Preparation of the Registration Statement

* * * * *
3. Additional Matters
* * * * *
    (h) Interactive Data
    (i) An Interactive Data File (see rule 232.11 of Regulation S-T [17
CFR 232.11]) is required to be submitted to the Commission in the
manner provided by rule 405 of Regulation S-T [17 CFR 232.405] for any
registration statement or post-effective amendment thereto on Form N-4
that includes or amends information provided in response to Items 2, 4,
5, 10, 16A, or 17 with regards to Contracts that are being sold to new
investors.
* * * * *
    (ii) An Interactive Data File is required to be submitted to the
Commission in the manner provided by rule 405 of Regulation S-T for any
form of prospectus filed pursuant to paragraphs (c) or (e) of rule 497
under the Securities Act [17 CFR 230.497(c) or (e)] that includes
information provided in response to Items 2, 4, 5, 10, 16A, or 17 that
varies from the registration

statement with regards to Contracts that are being sold to new
investors. All interactive data must be submitted with the filing made
pursuant to rule 497.
* * * * *

PART A--INFORMATION REQUIRED IN A PROSPECTUS

* * * * *

Item 16A. Significant Fund Cybersecurity Incidents

    Provide a description of any significant fund cybersecurity
incident as defined by rule 38a-2 of the Investment Company Act (17 CFR
270.38a-2) that has or is currently affecting the Registrant,
Depositor, or the Registrant's service providers.

Instructions.

    1. The disclosure must include all significant fund cybersecurity
incidents that have occurred within the last 2 fiscal years, as well as
any currently ongoing.
    2. The description of each incident must include the following
information to the extent known: The entity or entities affected; when
the incident was discovered and whether it is ongoing; whether any data
was stolen, altered, or accessed or used for any other unauthorized
purpose; the effect of the incident on the Registrant's operations; and
whether the Registrant, Depositor, or any service provider of the
Registrant has remediated or is currently remediating the incident.
* * * * *
0
16. Amend Form N-6 (referenced in Sec. Sec.  239.17c and 274.11d) by
revising General Instruction C.3(h)(i) and (ii) and adding new Item 16A
to read as follows:

    Note:  The text of Form N-6 does not, and these amendments will
not, appear in the Code of Federal Regulations.

Form N-6

* * * * *

GENERAL INSTRUCTIONS

* * * * *

C. Preparation of the Registration Statement

* * * * *
3. Additional Matters
* * * * *
    (h) Interactive Data
    (i) An Interactive Data File (see rule 232.11 of Regulation S-T [17
CFR 232.11]) is required to be submitted to the Commission in the
manner provided by rule 405 of Regulation S-T [17 CFR 232.405] for any
registration statement or post-effective amendment thereto on Form N-6
that includes or amends information provided in response to Items 2, 4,
5, 10, 11, 16A, or 18 with regards to Contracts that are being sold to
new investors.
* * * * *
    (ii) An Interactive Data File is required to be submitted to the
Commission in the manner provided by rule 405 of Regulation S-T for any
form of prospectus filed pursuant to paragraphs (c) or (e) of rule 497
under the Securities Act [17 CFR 230.497(c) or (e)] that includes
information provided in response to Items 2, 4, 5, 10, 11, 16A, or 18
that varies from the registration statement with regards to Contracts
that are being sold to new investors. All interactive data must be
submitted with the filing made pursuant to rule 497.
* * * * *

PART A--INFORMATION REQUIRED IN A PROSPECTUS

* * * * *

Item 16A. Significant Fund Cybersecurity Incidents

    Provide a description of any significant fund cybersecurity
incident as defined by rule 38a-2 of the Investment Company Act (17 CFR
270.38a-2) that has or is currently affecting the Registrant, the
Depositor or the Registrant's service providers.

Instructions.

    1. The disclosure must include all significant fund cybersecurity
incidents that have occurred within the last 2 fiscal years, as well as
any currently ongoing.
    2. The description of each incident must include the following
information to the extent known: The entity or entities affected; when
the incident was discovered and whether it is ongoing; whether any data
was stolen, altered, or accessed or used for any other unauthorized
purpose; the effect of the incident on the Registrant's operations; and
whether the Registrant, Depositor, or any service provider of the
Registrant has remediated or is currently remediating the incident.
0
17. Amend Form N-8B-2 (referenced in Sec.  274.12) by adding new
General Instruction 2.(l) and new Item 9A to read as follows:
    Note: The text of Form N-8B-2 does not, and these amendments will
not, appear in the Code of Federal Regulations.

FORM N-8B-2

* * * * *

GENERAL INSTRUCTIONS FOR FORM N-8B-2

* * * * *

2. Preparation and Filing of Registration Statement

* * * * *

(l) Interactive Data

    (1) An Interactive Data File as defined in rule 11 of Regulation S-
T [17 CFR 232.11] is required to be submitted to the Commission in the
manner provided by rule 405 of Regulation S-T [17 CFR 232.405] for any
registration statement on Form N-8B-2 that includes information
provided in response to Item 9A pursuant to Instruction 2. The
Interactive Data File must be submitted with the filing to which it
relates on the date such filing becomes effective.
    (2) All interactive data must be submitted in accordance with the
specifications in the EDGAR Filer Manual.
* * * * *

I. ORGANIZATION AND GENERAL INFORMATION

* * * * *
    9A. Provide a description of any significant fund cybersecurity
incident as defined by rule 38a-2 of the Investment Company Act of 1940
(17 CFR 270.38a-2) that has or is currently affecting the trust, the
depositor, or the trust's service providers.
    Instructions:
    (a) The disclosure must include all significant fund cybersecurity
incidents that have occurred within the last 2 fiscal years, as well as
any currently ongoing.
    (b) The description of each incident must include the following
information to the extent known: the entity or entities affected; when
the incident was discovered and whether it is ongoing; whether any data
was stolen, altered, or accessed or used for any other unauthorized
purpose; the effect of the incident on the trust's operations; and
whether the trust, the depositor, or any service provider of the trust
has remediated or is currently remediating the incident.
* * * * *

PART 275--RULES AND REGULATIONS, INVESTMENT ADVISERS ACT OF 1940

0
18. The authority citation for part 275 continues to read, in part, as
follows:

    Authority: 15 U.S.C. 80b-2(a)(11)(G), 80b-2(a)(11)(H), 80b-
2(a)(17), 80b-3, 80b-4, 80b-4a, 80b-6(4), 80b-6a, and 80b-11, unless
otherwise noted.
* * * * *

    Section 275.204-2 is also issued under 15 U.S.C. 80b-6.
* * * * *
0
19. Amend Sec.  275.204-2 by:
0
a. Revising paragraph (a)(17)(i);
0
b. Removing the period at the end of paragraph (a)(17)(iii) and adding
a semicolon in its place; and
0
c. Adding paragraphs (a)(17)(iv) through (vii).
    The additions read as follows:

Sec.  275.204-2  Books and records to be maintained by investment
advisers.

    (a) * * *
    (17) * * *
    (i) A copy of the investment adviser's policies and procedures
formulated pursuant to Sec. Sec.  275.206(4)-7(a) and 275.206(4)-9 that
are in effect, or at any time within the past five years were in
effect;
* * * * *
    (iv) A copy of the investment adviser's written report documenting
the investment adviser's annual review of the cybersecurity policies
and procedures conducted pursuant to Sec.  275.206(4)-9(b) in the last
five years;
    (v) A copy of any Form ADV-C, and amendments filed by the adviser
under Sec.  275.204-6 in the last five years;
    (vi) Records documenting the occurrence of any cybersecurity
incident, as defined in Sec.  275.206(4)-9(c), occurring in the last
five years, including records related to any response and recovery from
such an incident; and
    (vii) Records documenting any risk assessment conducted pursuant to
the cybersecurity policies and procedures required by Sec.  275.206(4)-
9(a)(1) in the last five years.
* * * * *
0
20. Amend Sec.  275.204-3 by revising paragraph (b)(4) to read as
follows:

Sec.  275.204-3  Delivery of brochures and brochure supplements.

* * * * *
    (b) * * *
    (4) Deliver the following to each client promptly after you create
an amended brochure or brochure supplement, as applicable, if the
amendment adds disclosure of an event or incident, or materially
revises information already disclosed about an event or incident: in
response to Item 9 of Part 2A of Form ADV or Item 3 of Part 2B of Form
ADV (Disciplinary Information), or Item 20.B of Part 2A of Form ADV
(Cybersecurity Risks and Incidents);
    (i) The amended brochure or brochure supplement, as applicable,
along with a statement describing the material facts relating to the
change in disciplinary information or information about a significant
cybersecurity incident; or
    (ii) A statement describing the material facts relating to the
change in disciplinary information or information about a significant
cybersecurity incident.
* * * * *
0
21. Section 275.204-6 is added to read as follows:

Sec.  275.204-6   Cybersecurity incident reporting.

    (a) Every investment adviser registered or required to be
registered under section 203 of the Act (15 U.S.C. 80b-3) shall:
    (1) Report to the Commission any significant adviser cybersecurity
incident or significant fund cybersecurity incident, promptly, but in
no event more than 48 hours, after having a reasonable basis to
conclude that any such incident has occurred or is occurring by filing
Form ADV-C electronically on the Investment Adviser Registration
Depository (IARD).
    (2) Amend any previously filed Form ADV-C promptly, but in no event
more than 48 hours after:
    (i) Any information previously reported to the Commission on Form
ADV-C pertaining to a significant adviser cybersecurity incident or a
significant fund cybersecurity becoming materially inaccurate;
    (ii) Any new material information pertaining to a significant
adviser cybersecurity incident or a significant fund cybersecurity
incident previously reported to the Commission on Form ADV-C being
discovered; or
    (iii) Any significant adviser cybersecurity incident or significant
fund cybersecurity incident being resolved or any internal
investigation pertaining to such an incident being closed.
    (b) For the purposes of this section:
    Adviser information and cybersecurity incident have the same
meanings as in Sec.  275.206(4)-9 (Rule 206(4)-9 under the Investment
Advisers Act of 1940).
    Significant adviser cybersecurity incident means a cybersecurity
incident, or a group of related cybersecurity incidents, that
significantly disrupts or degrades the adviser's ability, or the
ability of a private fund client of the adviser, to maintain critical
operations, or leads to the unauthorized access or use of adviser
information, where the unauthorized access or use of such information
results in:
    (i) Substantial harm to the adviser; or
    (ii) Substantial harm to a client, or an investor in a private
fund, whose information was accessed.
    Significant fund cybersecurity incident has the same meaning as in
Sec.  270.38a-2 of this chapter (Rule 38a-2 under the Investment
Company Act of 1940).
0
22. Section 275.206(4)-9 is added to read as follows:

Sec.  275.206(4)-9  Cybersecurity policies and procedures of investment
advisers.

    (a) Cybersecurity policies and procedures. As a means reasonably
designed to prevent fraudulent, deceptive, or manipulative acts,
practices, or courses of business within the meaning of section 206(4)
of the Act (15 U.S.C. 80b6(4)), it is unlawful for any investment
adviser registered or required to be registered under section 203 of
the Investment Advisers Act of 1940 (15 U.S.C. 80b-3) to provide
investment advice to clients unless the adviser adopts and implements
written policies and procedures that are reasonably designed to address
the adviser's cybersecurity risks, including policies and procedures
that:
    (1) Risk assessment.
    (i) Require periodic assessments of cybersecurity risks associated
with adviser information systems and adviser information residing
therein, including requiring the adviser to:
    (A) Categorize and prioritize cybersecurity risks based on an
inventory of the components of the adviser information systems and
adviser information residing therein and the potential effect of a
cybersecurity incident on the adviser; and
    (B) Identify the adviser's service providers that receive,
maintain, or process adviser information, or are otherwise permitted to
access adviser information systems and any adviser information residing
therein, and assess the cybersecurity risks associated with the
adviser's use of these service providers.
    (ii) Require written documentation of any risk assessments.
    (2) User security and access. Require controls designed to minimize
user-related risks and prevent unauthorized access to adviser
information systems and adviser information residing therein,
including:
    (i) Requiring standards of behavior for individuals authorized to
access adviser information systems and any adviser information residing
therein, such as an acceptable use policy;
    (ii) Identifying and authenticating individual users, including
implementing authentication measures that require users to present a
combination of two or more credentials for access verification;
    (iii) Establishing procedures for the timely distribution,
replacement, and revocation of passwords or methods of authentication;

    (iv) Restricting access to specific adviser information systems or
components thereof and adviser information residing therein solely to
individuals requiring access to such systems and information as is
necessary for them to perform their responsibilities and functions on
behalf of the adviser; and
    (v) Securing remote access technologies.
    (3) Information protection.
    (i) Require measures designed to monitor adviser information
systems and protect adviser information from unauthorized access or
use, based on a periodic assessment of the adviser information systems
and adviser information that resides on the systems that takes into
account:
    (A) The sensitivity level and importance of adviser information to
its business operations;
    (B) Whether any adviser information is personal information;
    (C) Where and how adviser information is accessed, stored and
transmitted, including the monitoring of adviser information in
transmission;
    (D) Adviser information systems access controls and malware
protection; and
    (E) The potential effect a cybersecurity incident involving adviser
information could have on the adviser and its clients, including the
ability for the adviser to continue to provide investment advice.
    (ii) Require oversight of service providers that receive, maintain,
or process adviser information, or are otherwise permitted to access
adviser information systems and any adviser information residing
therein and through that oversight document that such service
providers, pursuant to a written contract between the adviser and any
such service provider, are required to implement and maintain
appropriate measures, including the practices described in paragraphs
(a)(1), (2), (3)(i), (4), and (5) of this section, that are designed to
protect adviser information and adviser information systems.
    (4) Cybersecurity threat and vulnerability management. Require
measures to detect, mitigate, and remediate any cybersecurity threats
and vulnerabilities with respect to adviser information systems and the
adviser information residing therein;
    (5) Cybersecurity incident response and recovery.
    (i) Require measures to detect, respond to, and recover from a
cybersecurity incident, including policies and procedures that are
reasonably designed to ensure:
    (A) Continued operations of the adviser;
    (B) The protection of adviser information systems and the adviser
information residing therein;
    (C) External and internal cybersecurity incident information
sharing and communications; and
    (D) Reporting of significant cybersecurity incidents under Sec.
275.204-6 (Rule 204-6).
    (ii) Require written documentation of any cybersecurity incident,
including the adviser's response to and recovery from such an incident.
    (b) Annual review. An adviser must, at least annually:
    (1) Review and assess the design and effectiveness of the
cybersecurity policies and procedures required by paragraph (a) of this
section, including whether they reflect changes in cybersecurity risk
over the time period covered by the review; and
    (2) Prepare a written report that, at a minimum, describes the
review, the assessment, and any control tests performed, explains their
results, documents any cybersecurity incident that occurred since the
date of the last report, and discusses any material changes to the
policies and procedures since the date of the last report.
    (c) Definitions. For purposes of this section:
    Adviser information means any electronic information related to the
adviser's business, including personal information, received,
maintained, created, or processed by the adviser.
    Adviser information systems means the information resources owned
or used by the adviser, including physical or virtual infrastructure
controlled by such information resources, or components thereof,
organized for the collection, processing, maintenance, use, sharing,
dissemination, or disposition of adviser information to maintain or
support the adviser's operations.
    Cybersecurity incident means an unauthorized occurrence on or
conducted through an adviser's information systems that jeopardizes the
confidentiality, integrity, or availability of an adviser's information
systems or any adviser information residing therein.
    Cybersecurity risk means financial, operational, legal,
reputational, and other consequences that could result from
cybersecurity incidents, threats, and vulnerabilities.
    Cybersecurity threat means any potential occurrence that may result
in an unauthorized effort to adversely affect the confidentiality,
integrity, or availability of an adviser's information systems or any
adviser information residing therein.
    Cybersecurity vulnerability means a vulnerability in an adviser's
information systems, information system security procedures, or
internal controls, including vulnerabilities in their design,
configuration, maintenance, or implementation that, if exploited, could
result in a cybersecurity incident.
    Personal information means:
    (i) Any information that can be used, alone or in conjunction with
any other information, to identify an individual, such as name, date of
birth, place of birth, telephone number, street address, mother's
maiden name, Social Security number, driver's license number,
electronic mail address, account number, account password, biometric
records or other nonpublic authentication information; or
    (ii) Any other non-public information regarding a client's account.

PART 279--FORMS PRESCRIBED UNDER THE INVESTMENT ADVISERS ACT OF
1940

0
23. The authority citation for part 279 continues to read as follows:

    Authority:  The Investment Advisers Act of 1940, 15 U.S.C. 80b-1
et seq., Pub. L. 111203, 124 Stat. 1376.

0
24. Amend Form ADV (referenced in Sec.  279.1) by:
0
a. Adding Item 20 to Part 2A; and
0
b. Revising the instructions to the form, in the section entitled
``Form ADV: Glossary of Terms.''
    The addition and revision read as follows:

    Note:  The text of Form ADV does not, and this amendment will
not, appear in the Code of Federal Regulations.

FORM ADV (Paper Version)

UNIFORM APPLICATION FOR INVESTMENT ADVISER REGISTRATION

PART 2: Uniform Requirements for the Investment Adviser Brochure and
Brochure Supplements

* * * * *

Item 20. Cybersecurity Risks and Incidents

    A. Risks. Describe the cybersecurity risks that could materially
affect the advisory services you offer. Describe how you assess,
prioritize, and address cybersecurity risks created by the nature and
scope of your business.
    B. Incidents. Provide a description of any cybersecurity incident
that that has occurred within the last two fiscal years that has
significantly disrupted or degraded your ability to maintain

critical operations, or has led to the unauthorized access or use of
adviser information, resulting in substantial harm to you or your
clients. The description of each incident must include the following
information to the extent known: The entity or entities affected; when
the incident was discovered and whether it is ongoing; whether any data
was stolen, altered or accessed or used for any other unauthorized
purpose; the effect of the incident on the adviser's operations; and
whether the adviser, or service provider, has remediated or is
currently remediating the incident.
* * * * *

APPENDIX B: FORM ADV GLOSSARY OF TERMS

    Adviser information means any electronic information related to the
adviser's business, including personal information, received,
maintained, created, or processed by the adviser.
    Adviser information systems means the adviser information resources
owned or used by the adviser, including physical or virtual
infrastructure controlled by such information resources, or components
thereof, organized for the collection, processing, maintenance, use,
sharing, dissemination, or disposition of adviser information to
maintain or support the adviser's operations.
    Cybersecurity incident means an unauthorized occurrence on or
conducted through an adviser's information systems that jeopardizes the
confidentiality, integrity, or availability of an adviser's information
systems or any adviser information residing therein.
    Cybersecurity risk means financial, operational, legal,
reputational, and other consequences that could result from
cybersecurity incidents, threats, and vulnerabilities.
    Cybersecurity threat means any potential occurrence that may result
in an unauthorized effort to adversely affect the confidentiality,
integrity, or availability of an adviser's information systems or any
adviser information residing therein.
    Cybersecurity vulnerability means a vulnerability in an adviser's
information systems, information system security procedures, or
internal controls, including vulnerabilities in their design,
configuration, maintenance, or implementation that, if exploited, could
result in a cybersecurity incident.
    Personal information means:
    (1) Any information that can be used, alone or in conjunction with
any other information, to identify an individual, such as name, date of
birth, place of birth, telephone number, street address, mother's
maiden name, Social Security number, driver's license number,
electronic mail address, account number, account password, biometric
records or other nonpublic authentication information; or
    (2) Any other non-public information regarding a client's account.
* * * * *
0
25. Section 279.10 is added to read as follows:

Sec.  279.10  Form ADV-C, investment adviser cybersecurity incident
reporting.

    This form shall be filed pursuant to Sec.  275.204-6 of this
chapter (Rule 204-6) by investment advisers registered or required to
register under section 203 of the Act (15 U.S.C. 80b-3).

    By the Commission.

    Dated: February 9, 2022.
Vanessa A. Countryman,
Secretary.
    Note: The following appendix will not, appear in the Code of
Federal Regulations.

FORM ADV-C

INVESTMENT ADVISER CYBERSECURITY INCIDENT REPORT PURSUANT TO RULE 204-6
[17 CFR 275.206(4)-6]

    You must submit this Form ADV-C if you are registered with the
Commission as an investment adviser within 48 hours after having a
reasonable basis to conclude that a significant adviser cybersecurity
incident or a significant fund cybersecurity incident (collectively,
``significant cybersecurity incident'') has occurred or is occurring in
accordance with rule 204-6 under the Investment Advisers Act of 1940.

    Check the box that indicates what you would like to do (check all
that apply):
    [cir] Submit an initial report for a significant cybersecurity
incident.
    [cir] Submit an amended report for a significant cybersecurity
incident.
    [cir] Submit a final amended report for a significant cybersecurity
incident.

(1) Investment Advisers Act SEC File Number: 801-
(2) Your full legal name of investment adviser (if you are a sole
proprietor, state last, first, middle name):
(3) Name under which your primarily conduct your advisory business, if
different from above:
(4) Address of principal place of business (number, street, city,
state, zip code):
(5) Contact information for an individual with respect to the
significant cybersecurity incident being reported: (Name, title,
address if different from above, phone, email address)
(6) Adviser reporting a:
    [ballot] Significant adviser cybersecurity incident
(a) If so, does the significant adviser cybersecurity incident involve
any private funds?
    [ballot] Yes
    [ballot] No
    (1) If yes, list the private fund ID number(s)
    [ballot] Significant fund cybersecurity incident
    (b) If so, list each investment company registered under the
Investment Company Act of 1940 or company that has elected to be a
business development company pursuant to section 54 of that Act
involved and their SEC file number(s) (811 or 814 number) and the
series ID number of the specific fund if more than one series under the
SEC file number.
(7) Approximate date(s) the significant cybersecurity incident
occurred, if known:
(8) Approximate date the significant cybersecurity incident was
discovered:
(9) Is the significant cybersecurity incident ongoing?
    [ballot] Yes
    [ballot] No
    (a) If not, approximate date the significant cybersecurity incident
was resolved or any internal investigation pertaining to such incident
was closed.
(10) Has law enforcement or a government agency (other than the
Commission) been notified about the significant cybersecurity incident?
    [ballot] Yes
    [ballot] No
    (a) If yes, which law enforcement or government agencies have been
notified?
(11) Describe the nature and scope of the significant cybersecurity
incident, including any effect on the relevant entity's critical
operations:
(12) Describe the actions taken or planned to respond to and recover
from the significant cybersecurity incident:
(13) Was any data was stolen, altered, or accessed or used for any
other unauthorized purpose?
    [ballot] Yes
    [ballot] No
    [ballot] Unknown
    (a) If yes, describe the nature and scope of such information,
including whether it was adviser information or fund information.
(14) Was any personal information lost, stolen, modified, deleted,

destroyed, or accessed without authorization as a result of the
significant cybersecurity incident?
    [ballot] Yes
    [ballot] No
    [ballot] Unknown
    (a) If yes, describe the nature and scope of such information.
    (b) If yes, has notification been provided to persons whose
personal information was lost, stolen, damaged, or accessed without
authorization?
    [ballot] Yes
    [ballot] No
    (i) If not, are such notifications planned?
    [ballot] Yes
    [ballot] No
    (15) Has disclosure about the significant cybersecurity incident
been made to the adviser's clients and/or to investors in any
investment company registered under the Investment Company Act of 1940
or company that has elected to be a business development company
pursuant to section 54 of that Act, or private funds advised by the
adviser involved?
    [ballot] Yes
    [ballot] No
    (a) If yes, when was such disclosure made?
    (b) If not, explain why such disclosure has not be made?
(16) Is the significant cybersecurity incident covered under a
cybersecurity insurance policy maintained by you or any investment
company registered under the Investment Company Act of 1940 or company
that has elected to be a business development company pursuant to
section 54 of that Act, or any private fund?
    [ballot] Yes
    [ballot] No
    [ballot] Unknown
    (a) If yes, has the insurance company issuing the cybersecurity
insurance policy been contacted about the significant cybersecurity
incident?
    [ballot] Yes
    [ballot] No

Definitions

    For the purposes of this Form:
    Adviser information and adviser information systems have the same
meanings as in rule 206(4)-9 under the Investment Advisers Act of 1940.
    Fund information, fund information systems, and significant fund
cybersecurity incident have the same meaning as in rule 38a-2 under the
Investment Company Act of 1940.
    Private fund has the same meaning as in section 202(a)(29) of the
Investment Advisers Act of 1940.
    Personal information has the same meaning in rule 206(4)-9 under
the Advisers Act of 1940 or rule 38a-2 under the Investment Company Act
of 1940, as applicable.
    Significant adviser cybersecurity incident has the meaning as in
rule 204-6 under the Advisers Act of 1940.

[FR Doc. 2022-03145 Filed 3-8-22; 8:45 am]
BILLING CODE 8011-01-P


EPA response to FHWA comments

2007 NAAQS for Ozone RIA

1.  Chapter 2, page 1, second paragraph under “2.1 Ozone Chemistry,”
next to last sentence.  “In urban areas with a high population
concentration, ozone is often VOC-limited due to the high density of
traffic with NOx emissions.”  What is the basis for this statement?
Many inventories also show a high percentage of NOx emissions from other
sources such as off-road engines and power plants, especially in the
future.   “due to the high density of traffic with NOx emissions”
should be deleted.

This is cited directly from Staff Paper, and referenced by a footnote.
We have added additional text in 2.3.1 explaining that we will be using
an updated emissions inventory for the Final RIA:

	The 2020 inventory from the Final PM NAAQS emissions platform was used
as 		the starting point for the baseline and all subsequent analyses.
This included 	emissions from Canada as of 2000, and Mexico as of 1999.
An updated 2020 	inventory based on the EPA's 2002 modeling platform is
currently being 	developed and will be used for the final ozone NAAQS
RIA   In addition, all 	national and local controls used in the
illustrative control scenario for the revised 	PM NAAQS RIA were
included in this 2020 baseline. These controls were 	included to prevent
double counting of costs and benefits, especially in the case of 	NOx
controls which are precursors to both PM2.5 and ozone.

2.  Chapter 2, page 2, first paragraph.  “and at X latitude.”  What
does “X” stand for?  How does this relate to the previous sentence
that states that the effect of latitude is strongest in the winter?

This sentence has been deleted.

3.  Chapter 2, page 3, first paragraph.  “Solvent use and highway
vehicles are the two main sources of VOCs, with roughly equal
contributions to total emissions.   Emissions of VOCs from highway
vechicles account for roughly two-thirds of the transportation-related
emissions.”  Why is this placing such a strong emphasis on highway
vehicles, which were only 27% of emissions in 2002.  Industrial
processes were greater at 46%[EPA note:  do not understand the source of
the 46% number.  The Staff Paper table of VOC sources, page 2-6, has no
such number, and even if a number of industrial sources are added
together, the total is still less than half of the total for highway
vehicles].  The list of sources of VOC emissions should be complete and
subjective terms should not be used, and the year of data should be
cited.  Instead a data driven description should be given such as “in
2002, solvents were XX% of VOC emissions, on-road vehicles were XX%,
nonroad vehicles were XX%.”

This text was taken directly from the Staff Paper, and is cited as such.
 We have now added additional text from the Staff Paper to include the
sentence which includes the 27% figure (for 2004, not 2002)..  We have
also added data on projected emissions changes predicted to occur by
2020.

4.  Chapter 2, page 3, second paragraph.  “The two largest sources of
NOx are electric power generation plants and motor vehicles.  Emissions
of NOx therefore are highest in areas having a high density of power
plants and in urban regions having high traffic density.  Once again,
why is this placing such a strong emphasis on highway vehicles?  What is
the basis for this statement?  In 2002, nonroad vehicles were 20% of
emissions.   The list of sources of NOx emissions should be complete and
subjective terms should not be used, and the year of data should be
cited.  Instead a data driven description should be given such as “in
2002, solvents were XX% of VOC emissions, on-road vehicles were XX%,
nonroad vehicles were XX%.”

This is cited directly from Staff Paper, and referenced by a footnote.
We have added the 2002 data for nonroad emissions, and have also
included data on projected emissions in 2020.   As described in #1, an
updated emissions inventory will be used for the Final RIA.

5.  Chapter 3, page 2, first paragraph under “3.1 Establishing the
Baseline.”  “However, in developing the baseline it was important to
recognize that there are several areas that are not required to meet the
current standard by 2020.”  This is not correct.  Currently, only the
South Coast area in California has a maximum attainment date past 2020.
If this is the only area, then terms such as “several” and
“some” should not be used in this section.  If this section is
anticipating that areas will be bumped-up to higher classifications,
then this should be discussed, or the discussion in Chapter 4, pages 8-9
for the two California areas referenced.  However, this should also be
consistent with Chapter 4, page 8, second paragraph which states “The
analysis assumes that all but one California area will meet the current
standard (effectively 0.084 ppm) by 2020.”

Two areas of Southern California made recent requests to extend their
attainment deadlines.  One was San Joaquin, which was required to attain
by 2013.  We are recognizing these recent changes in our text.  The
entire RIA has being edited to include consistent language recognizing
the changes to planned attainment dates for San Joaquin and South Coast
(Los Angeles)..

6.  Chapter 3, page 3, table 3.1.  It is recommended that this table be
divided to differentiate between national rules and the less certain
strategies presented in the PM NAAQS RIA.  We have expressed several
concerns regarding the strategies in the PM RIA, and those strategies
should be clearly separated from national rules both in the title of the
table(s) and in the body.

As this is only an illustrative analysis, available known potential
controls were applied to achieve the greatest emissions reductions.
Application of controls included in national rules and individual
controls are described following the baseline and the control strategy
description.

7.  Chapter 3, page 7, first paragraph.  This paragraph details that
on-road controls are assumed to be applied statewide for several states.
 Is this reasonable to assume?  In addition, it assumes a 75%
penetration for diesel retrofits and idling elimination in California,
and a 25% penetration elsewhere.  What is the basis for this assumption?
 How is this reasonable, especially in California?

EPA felt that a 25% penetration rate was adequate for contributing to
the reduction strategy for areas projected to exceed the current
standard of 0.08 in 2020.  However, we determined that a more aggressive
level of control (i.e., 75% penetration rate) was appropriate for
illustrating attainment of the 0.07 alternative standard.  The exception
to this is California, in which we applied diesel retrofit control
measures at a 75% penetration rate for both the current and alternative
standards.

8.  Chapter 3, page 11, first paragraph.  “The baseline predicted that
10 counties would not meet the current ozone standard in 2020, even
after inclusion of all known controls.”  As currently designated and
classified, all counties except for the 4 in the South Coast are
supposed to demonstrate attainment by at the latest 2013.  How do these
counties relate to current classifications and SIPs for the current
standard that are due by June 15, 2007?  Are any of these 10 counties in
areas with submitted SIPs that show attainment prior to 2020?

The information on those and other counties, their attainment status,
and subpart 2 classifications is published in the Federal Register under
40 CFR Part 81 and is alsoposted at
http://www.epa.gov/air/oaqps/greenbk/gnc.html.   The EPA Greenbook site
is  periodically updated. For example, a check of the site on July 5,
2007 revealed that the information presented there was as of June 20,
2007.   The Federal Register information is more current.   A check
there revealed that no additional bump up request and approvals as of
July 8, 2007.

The SIP submission and review by EPA is something that is currently in
process.  As part of this activity, some states may asked for
reclassifications.   When the submissions asking for reclassification
have been reviewed and approved, the resulting classification will be
reflected published in the Federal Register under 40 CFR part 81 and
subsequently posted atthe EPA Greenbook site.   The SIP submittal
process is moving more slowly than anticipated.  However, it is our
understanding that there may be additional requests for bump ups with
resulting attainment dates beyond 2020

9.  Chapter 3, page13, Table 3.4.  This table details increased
penetration of on-road SCR and DPF from 25% to 75%, and continuous
Inspection and Maintenance (OBD).  What is the basis for these
assumptions?  How are they reasonable?

	Further mobile controls were needed in the development of the control
strategy.  	As described in #7 above, these decisions were made using
EPA’s best 	judgment.

10.  Chapter 3, pages 21-23.  What are the time frames (years) of these
reductions?

EPA is assuming that these emissions reductions will occur over any time
period prior to 2020.  We do not made a differentiation between
reductions that occur over short versus long timelines.

11. Chapter 4, page 9, first paragraph, incomplete.  Blank spaces need
to be filled for the amount of tons to be achieved by the on-road and
nonroad rules, and the residual tons.

These blanks have been filled in.

12.  Chapter 5, page 4, section <IP_ADDRESS>.  “Cost information for mobile
source controls was taken from studies conducted by EPA…”  These
studies should be specifically referenced and cited.  Also, it appears
that “Appendix 6?” should be “Appendix 5.”

	Appendices now labeled correctly, and the studies are now cited in
Appendix 5.

13.  Chapter 6, incomplete.  This Chapter, “Incremental Benefits of
Attaining Alternative Ozone Standards Relative to the Current 8-hour
Standard,” is missing.

This chapter is included in current drafts.

14.  Chapter 8, incomplete.  “This chapter will explain the results
and the limitations of the analysis.”  However, only four tables and
no text are included.

This was a placeholder (at the time).  Chapter 8 is now complete.

15.  Chapter 9.  This file is titled Chapter 9, but the text is titled
and numbered as Chapter 8.  The outline for the RIA shows that the
“Statutory and Executive Order Impact Analyses” are Chapter 9.

All numbering is now fixed.

16.  Appendix 3, page 11, section 3.2.1, second paragraph.  States,
“We looked at options of applying this measure to 50% and 100% of the
fleet…”  However, this does not seem to be consistent with Chapter
3, which discusses 25% and 75% market penetration.

Initial investigation of this approach used 50% and 100%.

17.  Appendix 3, page 12, last paragraph.  Where are the “interviews
with component manufacturers” documented?  There should be a specific
reference to which manufacturers were interviewed, when, and the topic
of discussion.

We are not citing the specific manufacturers that were interviewed, but
more information on the expected emissions reductions is available at:
HYPERLINK "https://www.epa.gov/otaq/retrofit/retropotentialtech.htm"
https://www.epa.gov/otaq/retrofit/retropotentialtech.htm .

18.   Appendix 5, pages 4-5.  There seems to be a fault in the logic
applied in the development of continuous I/M costs.  The cost comparison
seems to compare the same fleet of vehicles, i.e., it assumes that the
same number of vehicle will be subject to continuous I/M that are
subject to remote I/M.  However, this logic appears flawed in that the
RIA seems to apply continuous I/M over entire States.  This application
is much wider than current I/M programs.  To have a fair discussion of
costs, the RIA needs to include an analysis of the number of vehicle
that would be subject to the continuous I/M, compared to the remote I/M.

	The continuous I/M program is applied to the same fleet of vehicles as
the current 	periodic I/M programs.  The text has been updated to make
this clearer.

19. Appendix 5, page 5-6.  As we commented on the PM NAAQS RIA, this RIA
also identifies anti-idling measures as a "no cost" strategy.  This
seems overly simplistic.  Although fuel savings could offset capital
costs, it does not reflect how control measures could be adopted to
actually achieve these reductions.  This may be more true for MIRTs, but
what reasonable control measures could force the installation of MIRTs?
Capital costs, especially in the case of TSEs, would most likely be
placed upon public entities that would not recoup the fuel savings.

Per the PM RIA, OMB has indicated that this is not an issue to consider.

20. Appendix 5, page 7.  “Reduce Gasoline RVP from 7.8 to 7.0 in
Remaining Nonattainment Areas.  Cost-Effectiveness of Measure:  Cost per
ton will be $5,700 to $36,000/ton VOC.”  What is the basis of this
estimate?  What is the source of the data?  This needs to be discussed
and referenced.

Two references were inadvertently omitted in the RIA:

	Michigan Department of Environmental Quality and Southeast Michigan
Council 	of Governments. Proposed Revision to State of Michigan State
Implementation 	Plan for 7.0 Low Vapor Pressure Gasoline Vapor Request
for Southeast 	Michigan.  May 24, 2006.

	U.S. EPA. Guide on Federal and State Summer RVP Standards for
Conventional 	Gasoline Only. EPA420-B-05-012. November 2005


[Federal Register: October 18, 2007 (Volume 72, Number 201)]
[Proposed Rules]
[Page 59067-59068]
[DOCID:fr18oc07-25]

-----------------------------------------------------------------------

ENVIRONMENTAL PROTECTION AGENCY

40 CFR Part 63

[EPA-HQ-OAR-2004-0022; FRL-8483-8]
RIN 2050-AG29

NESHAP: National Emission Standards for Hazardous Air Pollutants:
Standards for Hazardous Waste Combustors; Extension of Comment Period

AGENCY: Environmental Protection Agency (EPA).

ACTION: Solicitation of comment on legal analysis; extension of comment
period.

-----------------------------------------------------------------------

SUMMARY: EPA is announcing that the comment period to the notice
entitled ``NESHAP: National Emission Standards for Hazardous Air
Pollutants: Standards for Hazardous Waste Combustors; Solicitation of
Comment on Legal Analysis,'' published on September 27, 2007 (72 FR
54875), is being extended until November 27, 2007. In that notice, EPA
discusses the standards for hazardous waste combustors that were
promulgated on October 12, 2005 (70 FR 59402), and specifically
identifies which standards EPA believes are consistent with the Clean
Air Act and case law, and which standards are not and need to be
reexamined through a subsequent rulemaking. This analysis of the
standards is being done in response to several opinions issued by the
United States Court of Appeals for the District of Columbia Circuit
that call into question the legality of some of the standards for
hazardous waste combustors.

DATES: The comment period for this notice is extended from the original
closing date of October 18, 2007 to November 27, 2007.

ADDRESSES: Submit your comments, identified by Docket ID No. EPA-HQ-
OAR-2004-0022, by one of the following methods:
     http://www.regulations.gov: Follow the on-line instructions for

submitting comments.
     E-mail<EMAIL_ADDRESS>     Fax:<PHONE_NUMBER>.
     Mail: U.S. Postal Service, send comments to: Air and
Radiation Docket (2822T), Docket ID No. EPA-HQ-OAR-2004-0022, U.S.
Environmental Protection Agency, 1200 Pennsylvania Avenue, NW.,
Washington, DC 20460. Please include a total of two copies.
     Hand Delivery: In person or by courier, deliver comments
to: HQ EPA Docket Center, Public Reading Room, EPA West, Room 3334,
1301 Constitution Avenue, NW., Washington, DC 20004. Such deliveries
are only accepted during the Docket's normal hours of operation, and
special arrangements should be made for deliveries of boxed
information. Please include a total of two copies.
    Instructions: Direct your comments to Docket ID No. EPA-HQ-OAR-
2004-0022. The EPA's policy is that all comments received will be
included in the public docket without change and may be made available
online at http://www.regulations.gov, including any personal information

provided, unless the comment includes information claimed to be
Confidential Business Information (CBI) or other information the
disclosure of which is restricted by statute. Do not submit information
that you consider to be CBI or otherwise protected through
http://www.regulations.gov or e-mail (see instructions below on procedures to

submit CBI information). The http://www.regulations.gov Web site is an

``anonymous access'' system, which means EPA will not know your
identity or contact information unless you provide it in the body of
your comment. If you send an e-mail comment directly to EPA without
going through http://www.regulations.gov, your e-mail address will be

automatically captured and included as part of the comment that is
placed in the public docket and made available on the Internet. If you
submit an electronic comment, EPA recommends that you include your name
and other contact information in the body of your comment and with any
disk or CD-ROM you submit. If EPA cannot read your comment due to
technical difficulties and cannot contact you for clarification, EPA
may not be able to consider your comment. Electronic files should avoid
the use of special characters, any form of encryption, and be free of
any defects or viruses. For additional information about EPA's public
docket visit the EPA Docket Center homepage at http://www.epa.gov/epahome/dockets.htm
.

    Docket: All documents in the docket are listed in the
http://www.regulations.gov index. Although listed in the index, some

information is not publicly available, e.g., CBI or other information
the disclosure of which is restricted by statute. Certain other
material, such as copyrighted material, will be publicly available only
in hard copy. Publicly available docket materials are available either
electronically in http://www.regulations.gov or in hard copy at the HQ EPA

Docket Center, Public Reading Room, EPA West, Room 3334, 1301
Constitution Avenue, NW., Washington, DC 20004. The Public Reading Room
is open from 8:30 a.m. to 4:30 p.m., Monday through Friday, excluding
legal holidays. The telephone number for the Public Reading Room is
(202) 566-1744, and the telephone number for the HQ EPA Docket Center
is<PHONE_NUMBER>. A reasonable fee may be charged for copying docket
materials.

FOR FURTHER INFORMATION CONTACT: For more information on this notice,
contact Frank Behan at<PHONE_NUMBER>, or<EMAIL_ADDRESS>Office
of Solid Waste (5302P), U.S. Environmental Protection Agency, 1200
Pennsylvania Ave., NW., Washington, DC 20460.

SUPPLEMENTARY INFORMATION:
    Comment Period. We are extending the comment period by
approximately five weeks in response to several

entities' requests for more time to respond to the notice that was
published on September 27, 2007 (72 FR at 54875). As a result, the
public comment period will be extended to 60 days and will now end on
November 27, 2007.
    Entities Potentially Affected by this Action. Categories and
entities potentially affected by this action include:

------------------------------------------------------------------------
                                                   Potentially affected
            Category             NAICS code \a\          entities
------------------------------------------------------------------------
Petroleum and coal products                 324  Any entity that
 manufacturing.                                   combusts hazardous
                                                  waste as defined in
                                                  the final rule.
Chemical manufacturing.........             325
Cement and concrete product                3273
 manufacturing.
Other nonmetallic mineral                  3279
 product manufacturing.
Waste treatment and disposal...            5622
Remediation and other waste               5629
 management services.
------------------------------------------------------------------------
\a\ North American Industry Classification System.

    This table is not intended to be exhaustive, but rather provides a
guide for readers regarding entities likely to be impacted by this
action. This table lists examples of the types of entities EPA is now
aware could potentially be regulated by this action. Other types of
entities not listed could also be affected. To determine whether your
facility, company, business, organization, etc., is affected by this
action, you should examine the applicability criteria in 40 CFR
63.1200. If you have any questions regarding the applicability of this
action to a particular entity, consult the person listed in the
preceding FOR FURTHER INFORMATION CONTACT section.
    How Do I Obtain a Copy of this Document and Other Related
Information? In addition to being available in the docket, an
electronic copy of today's notice will also be available on the World
Wide Web (WWW). Following the Administrator's signature, a copy of this
document may be posted on the WWW at http://www.epa.gov/hwcmact. This

Web site also provides other information related to the NESHAP for
hazardous waste combustors including the final rule issued on October
12, 2005 (70 FR 59402) and the notice published on September 27, 2007
(72 FR 54875).
    How Do I Submit Comments That Include Confidential Business
Information (CBI)? Do not submit CBI information to EPA through
http://www.regulations.gov or e-mail. Clearly mark the part or all of the

information that you claim to be CBI. For CBI information in a disk or
CD-ROM that you mail to EPA, mark the outside of the disk or CD-ROM as
CBI and then identify electronically within the disk or CD-ROM the
specific information that is claimed as CBI. In addition to one
complete version of the comment that includes information claimed as
CBI, a copy of the comment that does not contain the information
claimed as CBI must be submitted for inclusion in the public docket.
Information so marked will not be disclosed except in accordance with
procedures set forth in 40 CFR part 2. Send or deliver information
identified as CBI to only the following address: Ms. LaShan Haynes,
RCRA Document Control Officer, EPA (Mail Code 5305P), Attention Docket
ID No. EPA-HQ-OAR-2004-0022, 1200 Pennsylvania Avenue, Washington DC
20460.

List of Subjects in 40 CFR Part 63

    Environmental protection, Air pollution control, Hazardous
substances, Reporting and recordkeeping requirements.

    Dated: October 9, 2007.
Matt Hale,
Director, Office of Solid Waste.
[FR Doc. E7-20596 Filed 10-17-07; 8:45 am]

BILLING CODE 6560-50-P


[Federal Register Volume 87, Number 167 (Tuesday, August 30, 2022)]
[Notices]
[Pages 52951-52952]
[FR Doc No: 2022-18652]

-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

[Docket No. IC22-33-000]

Commission Information Collection Activities (FERC-547); Comment
Request; Extension

AGENCY: Federal Energy Regulatory Commission, Department of Energy.

ACTION: Notice of information collection and request for comments.

-----------------------------------------------------------------------

SUMMARY: In compliance with the requirements of the Paperwork Reduction
Act of 1995, the Federal Energy Regulatory Commission (Commission or
FERC) is soliciting public comment on the currently approved
information collection, FERC-547 (Gas Pipeline Rates: Refund Report
Requirements).

DATES: Comments on the collection of information are due October 31,
2022.

ADDRESSES: Send written comments on FERC-547 (IC22-33-000) to the
Commission. You may submit copies of your comments by one of the
following methods:
    Electronic filing through https://www.ferc.gov, is preferred.
     Electronic Filing: Documents must be filed in acceptable
native applications and print-to-PDF, but not in scanned or picture
format.
     For those unable to file electronically, comments may be
filed by USPS mail or by hand (including courier) delivery.
    [cir] Mail via U.S. Postal Service Only Addressed to: Federal
Energy Regulatory Commission, Secretary of the Commission, 888 First
Street NE, Washington, DC 20426.
    [cir] Hand (including courier) Delivery to: Federal Energy
Regulatory Commission, 12225 Wilkins Avenue, Rockville, MD 20852.
    Instructions: FERC submissions must be formatted and filed in
accordance with submission guidelines at: https://www.ferc.gov. For
user assistance, contact FERC Online Support by email at
[email protected], or by phone at:<PHONE_NUMBER> (toll-free).
    Docket: Users interested in receiving automatic notification of
activity in this docket or in viewing/downloading comments and
issuances in this docket may do so at https://www.ferc.gov/ferc-online/overview.

FOR FURTHER INFORMATION CONTACT: Ellen Brown may be reached by email at
[email protected], telephone at<PHONE_NUMBER>.

SUPPLEMENTARY INFORMATION:
    Title: Gas Pipeline Rates: Refund Report Requirements.
    OMB Control No.: 1902-0084.
    Type of Request: Three-year extension of the FERC-547 information
collection requirements with no changes to the current reporting
requirements.
    Abstract: The Commission uses FERC-547 (Gas Pipeline Rates: Refund
Report Requirements) to implement the statutory refund provisions
governed by Sections 4, and 16 of the Natural Gas Act (NGA).\1\ Section
4 authorizes the Commission to order a refund (with interest) for any
portion of a natural gas company's increased rate or charge found to be
unjust or unreasonable. Refunds may also be instituted by a natural gas
company as a stipulation to a Commission-approved settlement agreement
or a provision under the company's tariff. Section 16 of the NGA
authorizes the Commission to prescribe rules and regulations necessary
to administer its refund mandates. The Commission's refund reporting
requirements are located in 18 CFR 154.501 (Refund Obligations) and
154.502 (Reports).
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 717-717w.
---------------------------------------------------------------------------

    The Commission uses the data collected in FERC-547 to monitor
refunds owed by natural gas companies to ensure that the flow-through
of refunds owed by these companies are made as expeditiously as
possible and to assure that refunds are made in compliance with the
Commission's regulations.
    Type of Respondents: Natural gas companies.
    Estimate of Annual Burden: \2\ Refund obligations occur following a
Commission determination of unjust or unreasonable rates. Due to the
nature of determinations on an ad hoc basis, the Commission estimate is
based on the average number of refund obligations. The Commission
estimates the annual public reporting burden for the information
collection as:
---------------------------------------------------------------------------

    \2\ Burden is defined as the total time, effort, or financial
resources expended by persons to generate, maintain, retain, or
disclose or provide information to or for a Federal agency. For
further explanation of what is included in the information
collection burden, reference 5 CFR 1320.3.

                                                FERC-547: Gas Pipeline Rates: Refund Report Requirements
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                Average burden      Total annual
                                                                    Number of     Total number of   hours & average     burden hours &       Cost per
                     Number of respondents                        responses per      responses        cost \3\ per    total annual cost  respondent  ($)
                                                                    respondent                       response  ($)            ($)
(1)                                                                         (2)   (1) x (2) = (3)               (4)    (3) x (4) = (5)   (5) / (1) = (6)
--------------------------------------------------------------------------------------------------------------------------------------------------------
22.............................................................               2               44       2 hrs.; $182    88 hrs.; $8,008             $364
--------------------------------------------------------------------------------------------------------------------------------------------------------

    Comments: Comments are invited on: (1) whether the collection of
information is necessary for the proper performance of the functions of
the Commission, including whether the information will have practical
utility; (2) the accuracy of the agency's estimate of the burden and
cost of the collection of information, including the validity of the
methodology and assumptions used; (3) ways to enhance the quality,
utility and clarity of the information collection; and (4) ways to
minimize the burden of the collection of information on those who are
to respond, including the use of automated collection techniques or
other forms of information technology.
---------------------------------------------------------------------------

    \3\ FERC staff estimates that industry costs for salary plus
benefits are similar to Commission costs. The cost figure is the
FY2022 FERC average annual salary plus benefits ($188,992/year or
$91/hour).

    Dated: August 24, 2022.
Kimberly D. Bose,
Secretary.
[FR Doc. 2022-18652 Filed 8-29-22; 8:45 am]
BILLING CODE 6717-01-P