existing and proposed disclosure requirements of Regulation SCI and
Regulation S-P).
    \471\ See paragraph (a)(10) of proposed Rule 10 (defining the
term ``significant cybersecurity incident'').
---------------------------------------------------------------------------

    The Commission encourages interested persons to provide comments on
the discussion below, as well as on the potential related application
of proposed Rule 10, Regulation SCI, and Regulation S-P. More
specifically, the Commission encourages commenters: (1) to identify any
areas where they believe the requirements of proposed Rule 10 and the
existing or proposed requirements of Regulation SCI and Regulation S-P
would be particularly costly or create practical implementation
difficulties; (2) to provide details on what in particular about
implementation would be difficult; and (3) to make

recommendations on how to minimize these potential impacts. To assist
this effort, the Commission is seeking specific comment below on these
topics.\472\
---------------------------------------------------------------------------

    \472\ See section II.F.2. of this release.
---------------------------------------------------------------------------

b. Market Entities That Are or Would Be Subject to Regulation SCI and
Regulation S-P
    Certain Market Entities that would be subject to the requirements
of proposed Rule 10 applicable to Covered Entities are subject to the
existing requirements of Regulation SCI. In particular, SCI entities
include the following Covered Entities that also would be subject to
the requirements of proposed Rule 10: (1) ATSs that trade certain
stocks exceeding specific volume thresholds; (2) registered clearing
agencies; (3) certain exempt clearing agencies; (4) the MSRB; (5)
FINRA; and (6) national securities exchanges.\473\ Therefore, if
proposed Rule 10 is adopted (as proposed), these Covered Entities would
be subject to its requirements and the requirements of Regulation SCI
(currently and as it would be amended). The Commission is separately
proposing to revise Regulation SCI to expand the definition of ``SCI
entity'' to include the following Covered Entities that also would be
subject to the requirements of proposed Rule 10: (1) broker-dealers
that exceed an asset-based size threshold or a volume-based trading
threshold in NMS stocks, exchange-listed options, agency securities, or
U.S. treasury securities; (2) all exempt clearing agencies; and (3)
SBSDRs.\474\ Therefore, if these amendments to Regulation SCI are
adopted and proposed Rule 10 is adopted (as proposed), these additional
Covered Entities would be subject to the requirements of proposed Rule
10 and also to the requirements of Regulation SCI. Additionally,
broker-dealers and transfer agents that would be subject to proposed
Rule 10 also would be subject to some or all of the existing or
proposed requirements of Regulation S-P.\475\
---------------------------------------------------------------------------

    \473\ See 17 CFR 242.1000 (defining the terms ``SCI alternative
trading system,'' ``SCI self-regulatory system,'' and ``Exempt
clearing agency subject to ARP,'' and including all of those defined
terms in the definition of ``SCI Entity''). The definition of ``SCI
entities'' includes additional Commission registrants that would not
be subject to the requirements of proposed Rule 10: plan processors
and SCI competing consolidators. However, the Commission is seeking
comment on whether these registrants should be subject to the
requirements of proposed Rule 10.
    \474\ All exempt clearing agencies and SBSDRs would be subject
to the requirements of proposed Rule 10 applicable to Covered
Entities. See paragraphs (a)(1)(ii) and (vii) of proposed Rule 10
(defining these registrants as ``covered entities''). Broker-dealers
that exceed the asset-based size threshold under the proposed
amendments to Regulation SCI (which would be several hundred billion
dollars) also would be subject to the requirements of proposed Rule
10 applicable to Covered Entities, as they would exceed the $1
billion total assets threshold in the broker-dealer definition of
``covered entity.'' See paragraph (a)(1)(i)(D) of proposed Rule 10.
A broker-dealer that exceeds one or more of the volume-based trading
thresholds under the proposed amendments to Regulation SCI likely
would meet one of the broker-dealer definitions of ``covered
entity'' in proposed Rule 10 given their size and activities. For
example, it would either be a carrying broker-dealer, have
regulatory capital equal to or exceeding $50 million, have total
assets equal to or exceeding $1 billion, or operate as a market
maker. See paragraphs (a)(1)(i)(A), (C), (D), and (E) of proposed
Rule 10. The Commission is seeking comment above on whether a
broker-dealer that is an SCI entity should be defined specifically
as a ``covered entity'' under proposed Rule 10.
    \475\ Broadly, Regulation S-P's requirements apply to all
broker-dealers, except for ``notice-registered broker-dealers'' (as
defined in 17 CFR 248.30), who in most cases will be deemed to be in
compliance with Regulation S-P if they instead comply with the
financial privacy rules of the CFTC, and are otherwise explicitly
excluded from certain of Regulation S-P's obligations. See 17 CFR
248.2(c). For the purposes of this section II.F. of this release,
the term ``broker-dealer'' when used to refer to broker-dealers that
are subject to Regulation S-P (currently and as it would be amended)
excludes notice-registered broker-dealers. Currently, transfer
agents registered with the Commission (``SEC-registered transfer
agents'') (but not transfer agents registered with another
appropriate regulatory agency) are subject to Regulation S-P's
``disposal rule'' (``Regulation S-P Disposal Rule''). See 17 CFR
248.30(b). However, no transfer agent is currently subject to any
other portion of Regulation S-P, including the ``safeguards rule''
under Regulation S-P (``Regulation S-P Safeguards Rule''). See 17
CFR 248.30(a). Under the proposed amendments to Regulation S-P, SEC-
registered transfer agents and transfer agents registered with
another appropriate regulatory agency (as defined in 15 U.S.C.
78c(34)(B)) would be subject to the Regulation S-P Safeguards Rule
and the Regulation S-P Disposal Rule. Regulation S-P also applies to
additional financial institutions that would not be subject to
proposed Rule 10. See 17 CFR 248.3.
---------------------------------------------------------------------------

c. Policies and Procedures to Address Cybersecurity Risks
i. Different Scope and Purpose of the Policies and Procedures
Requirements
    Each of the policies and procedures requirements has a different
scope and purpose. Regulation SCI (currently and as it would be
amended) limits the scope of its requirements to certain systems of the
SCI Entity that support securities market related functions.
Specifically, it does and would require an SCI Entity to have
reasonably designed policies and procedures applicable to its SCI
systems and, for purposes of security standards, its indirect SCI
systems.\476\ While certain aspects of the policies and procedures
required by Regulation SCI (as it exists today and as proposed to be
amended) are designed to address certain cybersecurity risks (among
other things),\477\ the policies and procedures required by Regulation
SCI focus on the SCI entities' operational capability and the
maintenance of fair and orderly markets.
---------------------------------------------------------------------------

    \476\ See 17 CFR 242.1001(a)(1). ``SCI systems'' are defined as
electronic or similar systems of, or operated by or on behalf of, an
SCI entity that directly support at least one of six market
functions: (1) trading; (2) clearance and settlement; (3) order
routing; (4) market data; (5) market regulation; or (6) market
surveillance. 17 CFR 242.1000. ``Indirect SCI systems'' are defined
as those of, or operated by or on behalf of, an SCI entity that, if
breached, would be reasonably likely to pose a security threat to
SCI systems. 17 CFR 242.1000. The distinction between SCI systems
and indirect SCI systems seeks to encourage SCI Entities that their
SCI systems, which are core market-facing systems, should be
physically or logically separated from systems that perform other
functions (e.g., corporate email and general office systems for
member regulation and recordkeeping). See Regulation Systems
Compliance and Integrity, Release No. 34-73639 79 FR 72251 (Dec. 5,
2014), at 79 FR at 72279-81 (``Regulation SCI 2014 Adopting
Release''). Indirect SCI systems are subject to Regulation SCI's
requirements with respect to security standards. Further, ``critical
SCI systems'' (a subset of SCI systems) are defined as those that
directly support functionality relating to: (1) clearance and
settlement systems of clearing agencies; (2) openings, reopenings,
and closings on the primary listing market; (3) trading halts; (4)
initial public offerings; (5) the provision of market data by a plan
processor; or (6) exclusively-listed securities; and as a catchall,
systems that provide functionality to the securities markets for
which the availability of alternatives is significantly limited or
nonexistent and without which there would be a material impact on
fair and orderly markets. 17 CFR 242.1000.
    \477\ See 17 CFR 242.1000 (defining ``indirect SCI systems'').
The distinction between SCI systems and indirect SCI systems seeks
to encourage SCI Entities that their SCI systems, which are core
market-facing systems, should be physically or logically separated
from systems that perform other functions (e.g., corporate email and
general office systems for member regulation and recordkeeping). See
Regulation SCI 2014 Adopting Release, 79 FR at 72279-81. Indirect
SCI systems are subject to Regulation SCI's requirements with
respect to security standards.
---------------------------------------------------------------------------

    Similarly, Regulation S-P (currently and as it would be amended)
also has a distinct focus. The policies and procedures required under
Regulation S-P, both currently and as proposed to be amended, are
limited to protecting a certain type of information--customer records
or information and consumer report information \478\--and they apply to
such information even when stored outside of SCI systems or indirect
SCI systems. Furthermore, these policies and procedures need not
address other types of information stored on the systems of the broker-
dealer or transfer agent.
---------------------------------------------------------------------------

    \478\ Or as proposed herein, ``customer information'' and
``consumer information.'' See proposed rules 248.30(e)(5) and
(e)(1), respectively.
---------------------------------------------------------------------------

    Proposed Rule 10 would have a broader scope than Regulation SCI and
Regulation S-P (currently and as they would be amended) because it
would require Market Entities to establish, maintain, and enforce
written policies

and procedures that are reasonably designed to address their
cybersecurity risks.\479\ Unlike Regulation SCI, these requirements
would therefore cover SCI systems, indirect SCI systems, and
information systems that are not SCI systems or indirect SCI systems.
And, unlike Regulation S-P, the proposed requirements would also
encompass information beyond customer information and consumer
information.
---------------------------------------------------------------------------

    \479\ See paragraphs (b) and (e) of proposed Rule 10 (setting
forth the requirements of Covered Entities and Non-Covered Entities,
respectively, to have policies and procedures to address their
cybersecurity risks).
---------------------------------------------------------------------------

    To illustrate, a Market Entity could use one comprehensive set of
policies and procedures to satisfy the requirements of proposed Rule 10
and the existing and proposed cybersecurity-related requirements of
Regulation SCI and Regulation S-P, so long as: (1) the cybersecurity-
related policies and procedures required under Regulation S-P and
Regulation SCI fit within and are consistent with the scope of the
policies and procedures required under proposed Rule 10; and (2) and
the policies and procedures requirements of proposed Rule 10 also
address the more narrowly-focused existing and proposed cybersecurity-
related policies and procedures requirements under Regulation SCI and
Regulation S-P.
ii. Consistency of the Policies and Procedures Requirements
Covered Entities
    As discussed above, the Market Entities that would be SCI Entities
under the existing and proposed requirements of Regulation SCI would be
subject the policies and procedures requirements of proposed Rule 10
applicable to Covered Entities. In addition, broker-dealers and
transfer agents are subject to the requirements of Regulation S-P
(currently and as it would be amended).\480\ Transfer agents would be
Covered Entities under proposed Rule 10 and, therefore, subject to the
policies and procedures requirements of that rule applicable to Covered
Entities.\481\ Further, the two categories of broker-dealers that
likely would have the largest volume of customer information and
consumer information subject to the existing or proposed requirements
of Regulation S-P would be Covered Entities under proposed Rule 10:
carrying broker-dealers and introducing broker-dealers.\482\ For these
reasons, the Commission first analyzes the potential overlap between
proposed Rule 10 and the current and proposed requirements of
Regulation SCI and Regulation S-P by taking into account the policies
and procedures requirements of proposed Rule 10 that would apply to
Covered Entities.
---------------------------------------------------------------------------

    \480\ As discussed above, SEC-registered transfer agents are
subject to the Regulation S-P Disposal Rule but not to the
Regulation S-P Safeguards Rule. The proposed amendments to
Regulation S-P would apply the Regulation S-P Safeguards Rule and
the Regulation S-P Disposal Rule to all transfer agents.
    \481\ See paragraph (b)(1) of proposed Rule 10 (setting forth
the policies and procedures requirements for Covered Entities).
    \482\ See paragraphs (a)(1)(i)(A) and (B) of proposed Rule 10
(defining, respectively, carrying broker-dealers and introducing
broker-dealers as Covered Entities).
---------------------------------------------------------------------------

Regulation SCI and Regulation S-P General Policies and Procedures
Requirements
    Regulation SCI, Regulation S-P, and proposed Rule 10 all include
requirements that address certain cybersecurity-related risks.
Regulation SCI requires an SCI Entity to have reasonably designed
policies and procedures to ensure that its SCI systems and, for
purposes of security standards, indirect SCI systems, have levels of
capacity, integrity, resiliency, availability, and security, adequate
to maintain the SCI entity's operational capability and promote the
maintenance of fair and orderly markets.\483\
---------------------------------------------------------------------------

    \483\ See 17 CFR 242.1001(a)(1).
---------------------------------------------------------------------------

    The Regulation S-P Safeguards Rule requires broker-dealers (but not
transfer agents) to adopt written policies and procedures that address
administrative, technical, and physical safeguards for the protection
of customer records and information.\484\ The Regulation S-P Safeguards
Rule further provides that these policies and procedures must: (1)
insure the security and confidentiality of customer records and
information; (2) protect against any anticipated threats or hazards to
the security or integrity of customer records and information; and (3)
protect against unauthorized access to or use of customer records or
information that could result in substantial harm or inconvenience to
any customer.\485\ Additionally, the Regulation S-P Disposal Rule
requires broker-dealers and SEC-registered transfer agents that
maintain or otherwise possess consumer report information for a
business purpose to properly dispose of the information by taking
reasonable measures to protect against unauthorized access to or use of
the information in connection with its disposal.\486\
---------------------------------------------------------------------------

    \484\ See 17 CFR 248.30(a).
    \485\ See 17 CFR 248.30(a)(1) through (3).
    \486\ See 17 CFR 248.30(b)(2). Regulation S-P currently defines
the term ``disposal'' to mean: (1) the discarding or abandonment of
consumer report information; or (2) the sale, donation, or transfer
of any medium, including computer equipment, on which consumer
report information is stored. See 17 CFR 248.30(b)(1)(iii).
---------------------------------------------------------------------------

    Proposed Rule 10 would require a Covered Entity to establish,
maintain, and enforce written policies and procedures that are
reasonably designed to address the Covered Entity's cybersecurity
risks. In addition, Covered Entities would be required to include the
following elements in their policies and procedures: (1) periodic
assessments of cybersecurity risks associated with the Covered Entity's
information systems and written documentation of the risk assessments;
(2) controls designed to minimize user-related risks and prevent
unauthorized access to the Covered Entity's information systems; (3)
measures designed to monitor the Covered Entity's information systems
and protect the Covered Entity's information from unauthorized access
or use, and oversight of service providers that receive, maintain, or
process information, or are otherwise permitted to access the Covered
Entity's information systems; (4) measures to detect, mitigate, and
remediate any cybersecurity threats and vulnerabilities with respect to
the Covered Entity's information systems; and (5) measures to detect,
respond to, and recover from a cybersecurity incident and written
documentation of any cybersecurity incident and the response to and
recovery from the incident.\487\
---------------------------------------------------------------------------

    \487\ See sections II.B.1.a. through II.B.1.e. of this release
(discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

    As discussed earlier, the inclusion of these elements in proposed
Rule 10 is designed to enumerate the core areas that Covered Entities
would need to address when designing, implementing, and assessing their
policies and procedures.\488\ Taken together, these requirements are
designed to position Covered Entities to be better prepared to protect
themselves against cybersecurity risks, to mitigate cybersecurity
threats and vulnerabilities, and to recover from cybersecurity
incidents. They are also designed to help ensure that Covered Entities
focus their efforts and resources on the cybersecurity risks associated
with their operations and business practices.
---------------------------------------------------------------------------

    \488\ See section II.B.1. of this release.
---------------------------------------------------------------------------

    A Covered Entity that implements reasonably designed policies and
procedures in compliance with the requirements of proposed Rule 10
described above that cover its SCI systems and indirect SCI systems
should generally satisfy the existing general policies and procedures

requirements of Regulation SCI that pertain to cybersecurity.\489\
Similarly, policies and procedures implemented by a Covered Broker-
Dealer that are reasonably designed in compliance with the requirements
of proposed Rule 10 should generally satisfy the existing general
policies and procedures requirements of the Regulation S-P Safeguards
Rule discussed above that pertain to cybersecurity, to the extent that
such information is stored electronically and, therefore, falls within
the scope of proposed Rule 10. In addition, reasonably designed
policies and procedures implemented by a Covered Broker-Dealer or SEC-
registered transfer agent in compliance with the requirements of
proposed Rule 10 should generally satisfy the existing requirements of
the Regulation S-P Disposal Rule discussed above.
---------------------------------------------------------------------------

    \489\ As noted above, the CAT System is a facility of each of
the Participants and an SCI system. See also CAT NMS Plan Approval
Order, 81 FR at 84758. It would also qualify as an ``information
system'' of each national securities exchange and each national
securities association under proposed Rule 10. The CAT NMS Plan
requires the CAT's Plan Processor to follow certain security
protocols and industry standards, including the NIST Cyber Security
Framework, subject to Participant oversight. See, e.g., CAT NMS Plan
at appendix D, section 4.2. For the reasons discussed above and
below with respect to SCI systems, the policies and procedures
requirements of proposed Rule 10 are not intended to be inconsistent
with the security protocols set forth in the CAT NMS Plan. Moreover,
to the extent the CAT NMS Plan requires security protocols beyond
those that would be required under proposed Rule 10, those
additional security protocols should generally fit within and be
consistent with the policies and procedures required under proposed
Rule 10 to address all cybersecurity risks.
---------------------------------------------------------------------------

    Regulation SCI and Regulation S-P Requirements to Oversee Service
Providers. Under the amendments to Regulation SCI, the policies and
procedures required of SCI entities would need to include a program to
manage and oversee third party providers that provide functionality,
support or service, directly or indirectly, for SCI systems and
indirect SCI systems.\490\ In addition, proposed amendments to the
Regulation S-P Safeguards Rule would require broker-dealers and
transfer agents to include written policies and procedures within their
response programs that require their service providers, pursuant to a
written contract, to take appropriate measures that are designed to
protect against unauthorized access to or use of customer information,
including notification to the broker-dealer or transfer agent as soon
as possible, but no later than 48 hours after becoming aware of a
breach, in the event of any breach in security resulting in
unauthorized access to customer information maintained by the service
provider to enable the broker-dealer or transfer agent to implement its
response program expeditiously.\491\
---------------------------------------------------------------------------

    \490\ See Regulation SCI 2023 Proposing Release. These policies
and procedures would need to include initial and periodic review of
contracts with such vendors for consistency with the SCI entity's
obligations under Regulation SCI; and a risk-based assessment of
each third party provider's criticality to the SCI entity, including
analyses of third party provider concentration, of key dependencies
if the third party provider's functionality, support, or service
were to become unavailable or materially impaired, and of any
potential security, including cybersecurity, risks posed. Id.
    \491\ See Regulation S-P 2023 Proposing Release.
---------------------------------------------------------------------------

    Proposed Rule 10 would have several policies and procedures
requirements that are designed to address similar cybersecurity risks
as these proposed amendments to Regulation SCI and Regulation S-P.
First, a Covered Entity's policies and procedures under proposed Rule
10 would need to require periodic assessments of cybersecurity risks
associated with the Covered Entity's information systems and
information residing on those systems.\492\ This element of the
policies and procedures would need to include requirements that the
Covered Entity identify its service providers that receive, maintain,
or process information, or are otherwise permitted to access its
information systems and any of its information residing on those
systems, and assess the cybersecurity risks associated with its use of
these service providers.\493\ Second, under proposed Rule 10, a Covered
Entity's policies and procedures would need to require oversight of
service providers that receive, maintain, or process its information,
or are otherwise permitted to access its information systems and the
information residing on those systems, pursuant to a written contract
between the Covered Entity and the service provider, through which the
service providers would need to be required to implement and maintain
appropriate measures that are designed to protect the Covered Entity's
information systems and information residing on those systems.\494\
---------------------------------------------------------------------------

    \492\ See paragraph (b)(1)(i)(A) of proposed Rule 10; see also
section II.B.1.a. of this release (discussing this requirement in
more detail).
    \493\ See paragraph (b)(1)(i)(A)(2) of proposed Rule 10.
    \494\ See paragraphs (b)(1)(iii)(B) of proposed Rule 10; see
also section II.B.1.c. of this release (discussing this requirement
in more detail).
---------------------------------------------------------------------------

    A Covered Entity that implements these requirements of proposed
Rule 10 with respect to its SCI systems and indirect SCI systems
generally should satisfy the proposed requirements of Regulation SCI
that the SCI entity's policies and procedures include a program to
manage and oversee third party providers that provide functionality,
support or service, directly or indirectly, for SCI systems and
indirect SCI systems. Similarly, a broker-dealer or transfer agent that
implements these requirements of proposed Rule 10 generally would
comply with the proposed requirements of the Regulation S-P Safeguards
Rule relating to the oversight of service providers.
    Regulation SCI and Regulation S-P Unauthorized Access Requirements.
Under the proposed amendments to Regulation SCI, SCI entities would be
required to have a program to prevent the unauthorized access to their
SCI systems and indirect SCI systems, and information residing
therein.\495\ The proposed amendments to the Regulation S-P Disposal
Rule would require broker-dealers and transfer agents that maintain or
otherwise possess consumer information or customer information for a
business purpose to properly dispose of this information by taking
reasonable measures to protect against unauthorized access to or use of
the information in connection with its disposal.\496\ The broker-dealer
or transfer agent would be required to adopt and implement written
policies and procedures that address the proper disposal of consumer
information and customer information in accordance with this
standard.\497\
---------------------------------------------------------------------------

    \495\ See Regulation SCI 2023 Proposing Release.
    \496\ See Regulation S-P 2023 Proposing Release. As discussed
above, the general policies and procedures requirements of the
Regulation S-P Safeguards Rule require the policies and procedures--
among other things--to protect against unauthorized access to or use
of customer records or information that could result in substantial
harm or inconvenience to any customer. See 17 CFR 248.30(a)(3).
    \497\ See Regulation S-P 2023 Proposing Release.
---------------------------------------------------------------------------

    Proposed Rule 10 would have several policies and procedures
requirements that are designed to address similar cybersecurity-related
risks as these proposed requirements of Regulation SCI and the
Regulation S-P Disposal Rule. First, a Covered Entity's policies and
procedures under proposed Rule 10 would need to require controls: (1)
requiring standards of behavior for individuals authorized to access
the Covered Entity's information systems and the information residing
on those systems, such as an acceptable use policy; (2) identifying and
authenticating individual users, including but not limited to
implementing authentication measures that require users to present a
combination of two or more credentials for access verification; (3)
establishing procedures for the timely distribution,

replacement, and revocation of passwords or methods of authentication;
(4) restricting access to specific information systems of the Covered
Entity or components thereof and the information residing on those
systems solely to individuals requiring access to the systems and
information as is necessary for them to perform their responsibilities
and functions on behalf of the Covered Entity; and (5) securing remote
access technologies.\498\
---------------------------------------------------------------------------

    \498\ See paragraphs (b)(1)(ii)(A) through (E) of proposed Rule
10; see also section II.B.1.b. of this release (discussing these
requirements in more detail).
---------------------------------------------------------------------------

    Second, under proposed Rule 10, a Covered Entity's policies and
procedures would need to include measures designed to protect the
Covered Entity's information systems and protect the information
residing on those systems from unauthorized access or use, based on a
periodic assessment of the Covered Entity's information systems and the
information that resides on the systems.\499\ The periodic assessment
would need to take into account: (1) the sensitivity level and
importance of the information to the Covered Entity's business
operations; (2) whether any of the information is personal information;
(3) where and how the information is accessed, stored and transmitted,
including the monitoring of information in transmission; (4) the
information systems' access controls and malware protection; and (5)
the potential effect a cybersecurity incident involving the information
could have on the Covered Entity and its customers, counterparties,
members, registrants, or users, including the potential to cause a
significant cybersecurity incident.\500\
---------------------------------------------------------------------------

    \499\ See paragraph (b)(1)(iii)(A) of proposed Rule 10; see also
section II.B.1.c. of this release (discussing these requirements in
more detail).
    \500\ See paragraphs (b)(1)(iii)(A)(1) through (5) of proposed
Rule 10.
---------------------------------------------------------------------------

    A Covered Entity that implements these requirements of proposed
Rule 10 with respect to its SCI systems and indirect SCI systems
generally should satisfy the proposed requirements of Regulation SCI
that the SCI entity's policies and procedures include a program to
prevent the unauthorized access to their SCI systems and indirect SCI
systems, and information residing therein. Similarly, a broker-dealer
or transfer agent that implements these requirements of proposed Rule
10 should generally satisfy the proposed requirements of the Regulation
S-P Disposal Rule to adopt and implement written policies and
procedures that address the proper disposal of consumer information and
customer information.
    Regulation SCI and Regulation S-P Response Programs. Regulation SCI
requires SCI entities to have policies and procedures to monitor its
SCI systems and indirect SCI systems for SCI events, which include
systems intrusions for unauthorized access, and also requires them to
have policies and procedures that include escalation procedures to
quickly inform responsible SCI personnel of potential SCI events.\501\
---------------------------------------------------------------------------

    \501\ See 17 CFR 242.1001(a)(2)(vii) and (c)(1), respectively.
---------------------------------------------------------------------------

    The amendments to Regulation S-P's safeguards provisions would
require the policies and procedures to include a response program for
unauthorized access to or use of customer information. Further, the
response program would need to be reasonably designed to detect,
respond to, and recover from unauthorized access to or use of customer
information, including procedures, among others: (1) to assess the
nature and scope of any incident involving unauthorized access to or
use of customer information and identify the customer information
systems and types of customer information that may have been accessed
or used without authorization; \502\ and (2) to take appropriate steps
to contain and control the incident to prevent further unauthorized
access to or use of customer information.\503\
---------------------------------------------------------------------------

    \502\ Regulation SCI's obligation to take corrective action may
include a variety of actions, such as determining the scope of the
SCI event and its causes, among others. See Regulation SCI 2014
Adopting Release, 79 FR at 72251, 72317. See also 17 CFR
242.1002(a).
    \503\ See Regulation S-P 2023 Proposing Release. The response
program also would need to have procedures to notify each affected
individual whose sensitive customer information was, or is
reasonably likely to have been, accessed or used without
authorization unless the covered institution determines, after a
reasonable investigation of the facts and circumstances of the
incident of unauthorized access to or use of sensitive customer
information, the sensitive customer information has not been, and is
not reasonably likely to be, used in a manner that would result in
substantial harm or inconvenience. See id.
---------------------------------------------------------------------------

    The amendments to the Regulation S-P Safeguards Rule would require
the policies and procedures to include a response program for
unauthorized access to or use of customer information. Further, the
response program would need to be reasonably designed to detect,
respond to, and recover from unauthorized access to or use of customer
information, including procedures, among others: (1) to assess the
nature and scope of any incident involving unauthorized access to or
use of customer information and identify the customer information
systems and types of customer information that may have been accessed
or used without authorization; and (2) to take appropriate steps to
contain and control the incident to prevent further unauthorized access
to or use of customer information.\504\
---------------------------------------------------------------------------

    \504\ See Regulation S-P 2023 Proposing Release. As discussed
below, the response program also would need to have procedures to
notify each affected individual whose sensitive customer information
was, or is reasonably likely to have been, accessed or used without
authorization unless the covered institution determines, after a
reasonable investigation of the facts and circumstances of the
incident of unauthorized access to or use of sensitive customer
information, the sensitive customer information has not been, and is
not reasonably likely to be, used in a manner that would result in
substantial harm or inconvenience. See id.
---------------------------------------------------------------------------

    Proposed Rule 10 would have several policies and procedures
requirements that are designed to address similar cybersecurity-related
risks as these proposed requirements of the Regulation S-P Safeguards
Rule. First, under proposed Rule 10, a Covered Entity's policies and
procedures would need to require measures designed to detect, mitigate,
and remediate any cybersecurity threats and vulnerabilities with
respect to the Covered Entity's information systems and the information
residing on those systems.\505\ Second, under proposed Rule 10, a
Covered Entity's policies and procedures would need to have measures
designed to detect, respond to, and recover from a cybersecurity
incident, including policies and procedures that are reasonably
designed to ensure (among other things): (1) the continued operations
of the Covered Entity; (2) the protection of the Covered Entity's
information systems and the information residing on those systems; and
(3) external and internal cybersecurity incident information sharing
and communications.\506\
---------------------------------------------------------------------------

    \505\ See paragraph (b)(1)(iv) of proposed Rule 10; see also
section II.B.1.d. of this release (discussing this requirement in
more detail).
    \506\ See paragraph (b)(1)(v) of proposed Rule 10; see also
section II.B.1.e. of this release (discussing this requirement in
more detail).
---------------------------------------------------------------------------

    A Covered Entity that implements reasonably designed policies and
procedures in compliance with these requirements of proposed Rule 10
generally should satisfy the proposed requirements of the Regulation
SCI and Regulation S-P Safeguards Rule to have a response program
relating to response programs for unauthorized access.
    Regulation SCI Review Requirements. Regulation SCI currently
prescribes certain elements that must be included in each SCI entity's
policies and procedures.\507\ These required elements include policies
and procedures that must provide for regular reviews and

testing of SCI systems and indirect SCI systems, including backup
systems, to identify vulnerabilities from internal and external
threats.\508\ In addition, Regulation SCI requires SCI entities to
conduct penetration tests as part of a review of their compliance with
Regulation SCI.\509\ While these reviews must be conducted not less
than once each calendar year, the penetration tests currently need to
be conducted not less than once every three years.\510\ The amendments
to Regulation SCI would increase the required frequency of the
penetration tests to not less than once each calendar year.\511\ The
amendments to Regulation SCI also would require that the penetration
tests include tests of any vulnerabilities of the SCI entity's SCI
systems and indirect SCI systems identified under the existing
requirement to perform regular reviews and testing of SCI systems and
indirect SCI systems, including backup systems, to identify
vulnerabilities from internal and external threats.\512\
---------------------------------------------------------------------------

    \507\ See 17 CFR 242.1001(a)(2).
    \508\ 17 CFR 242.1001(a)(2)(iv).
    \509\ See 17 CFR 242.1003(b)(1)(i).
    \510\ Id.
    \511\ See Regulation SCI 2023 Proposing Release.
    \512\ See Regulation SCI 2023 Proposing Release; 17 CFR
242.1001(a)(2)(iv).
---------------------------------------------------------------------------

    Proposed Rule 10 would have several policies and procedures
requirements that are designed to address similar cybersecurity-related
risks as these existing and proposed requirements of Regulation SCI.
First, a Covered Entity's policies and procedures under proposed Rule
10 would need to require periodic assessments of cybersecurity risks
associated with the Covered Entity's information systems and
information residing on those systems.\513\ Moreover, this element of
the policies and procedures would need to include requirements that the
Covered Entity categorize and prioritize cybersecurity risks based on
an inventory of the components of the Covered Entity's information
systems and information residing on those systems and the potential
effect of a cybersecurity incident on the Covered Entity.\514\ Second,
under proposed Rule 10, a Covered Entity's policies and procedures
would need to require measures designed to detect, mitigate, and
remediate any cybersecurity threats and vulnerabilities with respect to
the Covered Entity's information systems and the information residing
on those systems.\515\
---------------------------------------------------------------------------

    \513\ See paragraph (b)(1)(i)(A) of proposed Rule 10; see also
section II.B.1.a. of this release (discussing this requirement in
more detail).
    \514\ See paragraph (b)(1)(i)(A)(1) of proposed Rule 10.
    \515\ See paragraph (b)(1)(iv) of proposed Rule 10; see also
section II.B.1.d. of this release (discussing this requirement in
more detail).
---------------------------------------------------------------------------

    A Covered Entity that implements these requirements of proposed
Rule 10 with respect to its SCI systems and indirect SCI systems
generally should satisfy the current requirements of Regulation SCI
that the SCI entity's policies and procedures require regular reviews
and testing of SCI systems and indirect SCI systems, including backup
systems, to identify vulnerabilities from internal and external
threats.
    Further, while proposed Rule 10 does not require penetration
testing, the proposed rule--as discussed above--requires measures
designed to protect the Covered Entity's information systems and
protect the information residing on those systems from unauthorized
access or use, based on a periodic assessment of the Covered Entity's
information systems and the information that resides on the
systems.\516\ As discussed earlier, penetration testing could be part
of these measures.\517\ Therefore, the existing and proposed
requirements of Regulation SCI requiring penetration testing could be
incorporated into and should fit within a Covered Entity's policies and
procedures to address cybersecurity risks under proposed Rule 10.
---------------------------------------------------------------------------

    \516\ See paragraph (b)(1)(iii)(A) of proposed Rule 10.
    \517\ See also section II.B.1.c. of this release. The Commission
also is requesting comment above on whether proposed Rule 10 should
be modified to specifically require penetration testing.
---------------------------------------------------------------------------

Non-Covered Broker-Dealers
    Non-Covered Broker-Dealers--which would be subject to Regulation S-
P but not Regulation SCI--are smaller firms whose functions do not play
as significant a role in the U.S. securities markets, as compared to
Covered Broker-Dealers.\518\ For example, Non-Covered Broker-Dealers
tend to offer a more focused and limited set of services such as
facilitating private placements of securities, selling mutual funds and
variable contracts, underwriting securities, and participating in
direct investment offerings.\519\ Further, they do not hold customer
securities and cash or serve as a conduit (i.e., an introducing broker-
dealer) for customers to access their accounts at a carrying broker-
dealer that holds the customers' securities and cash. If these Non-
Covered Broker-Dealers do not possess or maintain any customer
information or consumer information for a business purpose in
connection with the services they provide, they would not be subject to
either the current or proposed requirements of Regulation S-P,
including those that pertain to cybersecurity.
---------------------------------------------------------------------------

    \518\ See section IV.C.2. of this release (discussing the
activities of broker-dealers that would not meet the definition of
``covered entity'' in proposed Rule 10). As discussed below in
section IV.C.2. of this release, the 1,541 broker-dealers that would
meet the definition of ``covered entity'' in proposed Rule 10 had
average total assets of $3.5 billion and average regulatory equity
of $325 million; whereas the 1,969 that would not meet the
definition of ``covered entity'' had average total assets of $4.7
million and regulatory equity of $3 million. This means that broker-
dealers that would not meet the definition of ``covered entity'' in
proposed Rule 10 accounted for about 0.2% of the total assets of all
broker-dealers and 0.1% of total capital for all broker-dealers.
    \519\ See section IV.C.2. of this release (discussing the
activities of broker-dealers that would not meet the definition of
``covered entity'' in proposed Rule 10).
---------------------------------------------------------------------------

    However, Non-Covered Broker-Dealers under proposed Rule 10 that do
possess or maintain customer information or consumer information for a
business purpose would be subject to the current and proposed
requirements of Regulation S-P. Given their smaller size, some of these
Non-Covered Broker-Dealers may store and dispose of the information in
paper form and, therefore, under the existing and proposed requirements
of Regulation S-P would need to address the physical security aspects
of storing and disposing of this information. These paper records would
not be subject to proposed Rule 10.
    Some Non-Covered Broker-Dealers likely would store customer
information and consumer information for a business purpose
electronically on an information system. Under the existing and
proposed requirements of Regulation S-P, these Non-Covered Broker-
Dealers would need to address the cybersecurity risks of storing this
information on an information system. These Non-Covered Broker-Dealers
would be subject the requirements of proposed Rule 10 to establish,
maintain, and enforce written policies and procedures that are
reasonably designed to address their cybersecurity risks taking into
account the size, business, and operations of the firm.\520\ Under
proposed Rule 10, they also would be required to review and assess the
design and effectiveness of their cybersecurity policies and
procedures, including whether the policies and procedures reflect
changes in cybersecurity risk over the time period covered by the

review. This means the Non-Covered Broker-Dealer would need to
comprehensively address all of its cybersecurity risks. The policies
and procedures to address cybersecurity risks required under proposed
Rule 10 would need to address cybersecurity risks involving information
systems on which customer information and consumer information is
stored. Therefore, complying with this requirement of proposed Rule 10
would be consistent with complying with the existing and proposed
requirements of Regulation S-P that relate to cybersecurity.
---------------------------------------------------------------------------

    \520\ See paragraph (e) of proposed Rule 10 (setting forth the
policies and procedures requirements for Market Entities that are
not broker-dealers). See also section II.C. of this release
(discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

    As discussed above, Regulation S-P (currently and as it would be
amended) sets forth certain specific requirements that pertain to
cybersecurity risk; whereas the requirements of proposed Rule 10
applicable to Non-Covered Broker-Dealers more generally require the
firm to establish, maintain, and enforce written policies and
procedures that are reasonably designed to address its cybersecurity
risks taking into account the size, business, and operations of the
firm. As explained above, those more specific existing and proposed
requirements of Regulation S-P are consistent with certain of the
elements--which are based on industry standards for addressing
cybersecurity risk--that Covered Entities would be required to include
in their policies and procedures under proposed Rule 10.\521\ Further,
proposed Rule 10 would require a Non-Covered Broker-Dealer to take into
account its size, business, and operations when designing its policies
and procedures to address its cybersecurity risks. Storing customer
information and consumer information on an information system is the
type of operation a Non-Covered Broker-Dealer would need to take into
account. Consequently, the specific existing and proposed requirements
of Regulation S-P should fit within and be consistent with a Non-
Covered Broker-Dealer's reasonably designed policies and procedures to
address its cybersecurity risks under proposed Rule 10, including the
risks associated with storing customer information and consumer
information on an information system.
---------------------------------------------------------------------------

    \521\ See section II.B.1. of this release (discussing the
policies and procedures requirements for Covered Entities).
---------------------------------------------------------------------------

iii. Regulation ATS and Regulation S-ID
    Certain broker-dealers that operate an ATS are subject to
Regulation ATS and certain broker-dealers that offer and maintain
certain types of accounts for customers are subject to requirements of
Regulation S-ID to establish an identity theft program.\522\
Additionally, SBS Entities and transfer agents could be subject to
Regulation S-ID if they are ``financial institutions'' or
``creditors.'' \523\ As discussed below, Regulation ATS and Regulation
S-ID are more narrowly focused on certain cybersecurity risks as
compared to proposed Rule 10, which focuses on all cybersecurity risks
of a Market Entity. In addition, the current requirements of Regulation
ATS and Regulation S-ID should fit within and be consistent with the
broader policies and procedures required under proposed Rule 10 to
address all cybersecurity risks.
---------------------------------------------------------------------------

    \522\ See 17 CFR 242.301 through 304 (conditions to the
Regulation ATS exemption); 17 CFR 248.201 and 202 (Regulation S-ID
identity theft program requirements).
    \523\ See 17 CFR 248.201 and 202. The scope of Regulation S-ID
includes any financial institution or creditor, as defined in the
Fair Credit Reporting Act (15 U.S.C. 1681) that is required to be
``registered under the Securities Exchange Act of 1934.'' See 17 CFR
248.201(a).
---------------------------------------------------------------------------

    Regulation ATS requires certain broker-dealers that operate an ATS
to review the vulnerability of its systems and data center computer
operations to internal and external threats, physical hazards, and
natural disasters if during at least four of the preceding six calendar
months, such ATS had: (1) with respect to municipal securities, 20
percent or more of the average daily volume traded in the United
States; or (2) with respect to corporate debt securities, 20 percent or
more of the average daily volume traded in the United States.\524\
Therefore, in addition to other potential systems issues, the broker-
dealer would need to address cybersecurity risk of relating to its ATS
system. Further, this requirement applies to systems that support order
entry, order handling, execution, order routing, transaction reporting,
and trade comparison in the particular security.\525\ Therefore, it has
a narrower focus than proposed Rule 10.
---------------------------------------------------------------------------

    \524\ See 17 CFR 242.301(b)(6). Currently, no ATS has crossed
the either of the volume-based thresholds and, therefore, no ATS is
subject to the requirements pertaining, in part, to cybersecurity.
See also Amendments Regarding the Definition of ``Exchange'' and
ATSs Release, 87 FR 15496.
    \525\ See Regulation of Exchanges and Alternative Trading
Systems, Exchange Act Release No. 40760 (Dec. 8, 1998) [63 FR 70844,
70876 (Dec. 22, 1998)].
---------------------------------------------------------------------------

    Regulation ATS also requires all broker-dealers that operate an ATS
to establish adequate written safeguards and written procedures to
protect subscribers' confidential trading information.\526\ The written
safeguards and procedures must include, among other things, limiting
access to the confidential trading information of subscribers to those
employees of the alternative trading system who are operating the
system or responsible for its compliance with these or any other
applicable rules.\527\ These requirements apply to all broker-dealers
that operate an ATS and, as indicated, apply to a narrow set of
information stored on their information systems: the confidential
trading information of the subscribers to the ATS.
---------------------------------------------------------------------------

    \526\ See 17 CFR 242.301(b)(10).
    \527\ See 17 CFR 242.301(b)(10)(i)(A).
---------------------------------------------------------------------------

    As discussed above, Covered Entities under proposed Rule 10--which
would include broker-dealers that operate as an ATS--would be required
to establish, maintain, and enforce written policies and procedures
that are reasonably designed to address the Covered Entity's
cybersecurity risks. In addition, Covered Entities would be required to
include the following elements in their policies and procedures: (1)
periodic assessments of cybersecurity risks associated with the Covered
Entity's information systems and written documentation of the risk
assessments; (2) controls designed to minimize user-related risks and
prevent unauthorized access to the Covered Entity's information
systems; (3) measures designed to monitor the Covered Entity's
information systems and protect the Covered Entity's information from
unauthorized access or use, and oversight of service providers that
receive, maintain, or process information, or are otherwise permitted
to access the Covered Entity's information systems; (4) measures to
detect, mitigate, and remediate any cybersecurity threats and
vulnerabilities with respect to the Covered Entity's information
systems; and (5) measures to detect, respond to, and recover from a
cybersecurity incident and written documentation. Consequently, a
broker-dealer operates an ATS and that implements reasonably designed
policies and procedures in compliance with the requirements of proposed
Rule 10 should generally satisfy the current requirements of Regulation
ATS to review the vulnerability of its systems and data center computer
operations to internal and external threats and to protect subscribers'
confidential trading information to the extent these requirements
pertain to cybersecurity.
    Regulation S-ID requires--among other things--a financial
institution or creditor within the scope of the regulation that offers
or maintains one or more covered accounts to develop and implement a
written identity theft prevention program that is designed to detect,
prevent, and mitigate identity theft in connection with the opening of
a covered account or any existing

covered account.\528\ Regulation S-ID defines the term ``covered
account''--in pertinent part--as an account that the financial
institution or creditor maintains, primarily for personal, family, or
household purposes, that involves or is designed to permit multiple
payments or transactions, such as a brokerage account with a broker-
dealer, and any other account that the financial institution or
creditor offers or maintains for which there is a reasonably
foreseeable risk to customers or to the safety and soundness of the
financial institution or creditor from identity theft, including
financial, operational, compliance, reputation, or litigation
risks.\529\ Therefore, Regulation S-ID is narrowly focused on one
cybersecurity risk--identity theft. Identity theft--as discussed
earlier--is one of the tactics threat actors use to cause harm after
obtaining unauthorized access to personal information.\530\ As a
cybersecurity risk, Market Entities would need to address it as part of
their policies and procedures under proposed Rule 10. Consequently, the
requirement of Regulation S-ID should fit within and be consistent with
a Market Entity's reasonably designed policies and procedures to
address its cybersecurity risks under proposed Rule 10, including the
risks associated with identity theft.
---------------------------------------------------------------------------

    \528\ See 17 CFR 248.201(d)(1).
    \529\ See 17 CFR 248.201(b)(3).
    \530\ See section I.A. of this release.
---------------------------------------------------------------------------

d. Notification and Reporting to the Commission
    Regulation SCI (currently and as it would be amended) provides the
framework for notifying the Commission of SCI events including, among
other things, to: immediately notify the Commission of the event;
provide a written notification on Form SCI within 24 hours that
includes a description of the SCI event and the system(s) affected,
with other information required to the extent available at the time;
provide regular updates regarding the SCI event until the event is
resolved; and submit a final detailed written report regarding the SCI
event.\531\ If proposed Rule 10 is adopted as proposed, it would
require Market Entities that are Covered Entities to provide the
Commission (and other regulators, if applicable) with immediate written
electronic notice of a significant cybersecurity incident affecting the
Covered Entity and, thereafter, report and update information about the
significant cybersecurity incident by filing Part I of proposed Form
SCIR with the Commission (and other regulators, if applicable).\532\
Part I of proposed of Form SCIR would elicit information about the
significant cybersecurity incident and the Covered Entity's efforts to
respond to, and recover from, the incident.
---------------------------------------------------------------------------

    \531\ See 17 CFR 242.1002(b). An ``SCI event'' is an event at an
SCI entity that is: (1) a ``systems disruption,'' which is an event
in an SCI entity's SCI systems that disrupts, or significantly
degrades, the normal operation of an SCI system; (2) a ``systems
intrusion,'' which is any unauthorized entry into the SCI systems or
indirect SCI systems of an SCI entity; or (3) a ``systems compliance
issue,'' which is an event at an SCI entity that has caused any SCI
system of such entity to operate in a manner that does not comply
with the Exchange Act and the rules and regulations thereunder or
the entity's rules or governing documents, as applicable. See 17 CFR
242.1000 (defining the terms ``systems disruption,'' ``system
intrusion,'' and ``system compliance issue'' and including those
terms in the definition of ``SCI event''). The amendments to
Regulation SCI would broaden the definition of ``system intrusion''
to include a cybersecurity event that disrupts, or significantly
degrades, the normal operation of an SCI system, as well as a
material attempted unauthorized entry into the SCI systems or
indirect SCI systems of an SCI entity. Regulation SCI 2023 Proposing
Release.
    \532\ See paragraphs (c)(1) and (2) of proposed Rule 10
(requiring Covered Entities to provide immediate written notice and
subsequent reporting on Part I of proposed Form SCIR of significant
cybersecurity incidents); sections II.B.2. and II.B.4. of this
release (discussing the requirements of paragraphs (c)(1) and (2) of
proposed Rule 10 and Part I of Form SCIR in more detail). Non-
Covered Broker-Dealers also would be subject to an immediate written
electronic notice requirement under paragraph (e)(2) of proposed
Rule 10. However, as discussed above, a Non-Covered Broker-Dealer
likely would not be an SCI Entity.
---------------------------------------------------------------------------

    Consequently, a Covered Entity that is also an SCI entity that
experiences a significant cybersecurity incident under proposed Rule 10
that also is an SCI event would be required to make two filings for the
single incident: one on Part I of proposed Form SCIR and the other on
Form SCI. The Covered Entity also would be required to make additional
filings on Forms SCIR and SCI pertaining to the significant
cybersecurity incident (i.e., to provide updates and final reports).
The approach of having two separate notification and reporting
programs--one under proposed Rule 10 and the other under Regulation
SCI--would be appropriate for the following reasons.
    As discussed earlier, certain broker-dealers and all transfer
agents would not be SCI entities under the current and proposed
requirements of Regulation SCI.\533\ Certain of the broker-dealers that
are not SCI entities (currently and as it would be amended) would be
Covered Entities and all transfer agents would be Covered
Entities.\534\ In addition, the current and proposed reporting
requirements of Regulation SCI are or would be triggered by events
impacting SCI systems and indirect SCI systems. The Covered Entities
that are or would be SCI entities use and rely on information systems
that are not SCI systems or indirect SCI systems under the current and
proposed amendments to Regulation SCI. For these reasons, Covered
Entities could be impacted by significant cybersecurity incidents that
do not trigger the current and proposed notification requirements of
Regulation SCI either because they do not meet the current or proposed
definitions of ``SCI entity'' or the significant cybersecurity incident
does not meet the current or proposed definitions of ``SCI event.''
---------------------------------------------------------------------------

    \533\ See section II.F.1.b. of this release. Currently, broker-
dealers that operate as ATSs and trade certain stocks exceeding
specific volume thresholds are SCI entities. The proposed amendments
to Regulation SCI would expand the definition of ``SCI entity'' to
include broker-dealers that exceed an asset-based size threshold or
a volume-based trading threshold in NMS stocks, exchange-listed
options, agency securities, or U.S. treasury securities. See
Regulation SCI 2023 Proposing Release.
    \534\ See paragraphs (a)(1)(i)(A) and (F) proposed Rule 10
(defining the categories of broker-dealers that would be Covered
Entities); paragraph (a)(1)(ix) proposed Rule 10 (defining transfer
agents as ``covered entities'').
---------------------------------------------------------------------------

    As discussed earlier, the objective of the notification and
reporting requirements of proposed Rule 10 is to improve the
Commission's ability to monitor and evaluate the effects of a
significant cybersecurity incident on Covered Entities and their
customers, counterparties, members, registrants, or users, as well as
assess the potential risks affecting financial markets more
broadly.\535\ For this reason, Part I of proposed Form SCIR is tailored
to elicit information relating specifically to cybersecurity, such as
information relating to the threat actor, and the impact of the
incident on any data or personal information that may have been
accessed.\536\ The Commission and its staff could use the information
reported on Part I of Form SCIR to monitor the U.S. securities markets
and the Covered Entities that support those markets broadly from a
cybersecurity perspective, including identifying cybersecurity threats
and trends from a market-wide view. By requiring all Covered Entities
to report information about a significant cybersecurity incident on a
common form, the information obtained from these filings over time
would create a comprehensive set of data of all significant
cybersecurity incidents impacting Covered Entities that is based on
these entities responding to the same check boxes and questions on the
form. This would facilitate analysis of the data, including analysis
across different Covered Entities and significant cybersecurity
incidents. Eventually, this

set of data and the ability to analyze it by searching and sorting how
different Covered Entities responded to the same questions on the form
could be used to spot common trending risks and vulnerabilities as well
as best practices employed by Covered Entities to respond to and
recover from significant cybersecurity incidents.
---------------------------------------------------------------------------

    \535\ See section II.B.2.a. of this release.
    \536\ See section II.B.2.b. of this release.
---------------------------------------------------------------------------

    The current and proposed definitions of ``SCI event'' include
events that are not related to significant cybersecurity
incidents.\537\ For example, under the current and proposed
requirements of Regulation SCI, the definition of ``SCI event''
includes an event in an SCI entity's SCI systems that disrupts, or
significantly degrades, the normal operation of an SCI system.\538\
Therefore, the definitions are not limited to events in an SCI entity's
SCI systems that disrupt, or significantly degrade, the normal
operation of an SCI system caused by a significant cybersecurity
incident. The information elicited in Form SCI reflects the broader
scope of the reporting requirements of Regulation SCI (as compared to
the narrower focus of proposed Rule 10 on reporting about significant
cybersecurity incidents). For example, the form requires the SCI entity
to identify the type of SCI event: systems compliance issue, systems
disruption, and/or systems intrusion. In addition, Form SCI is tailored
to elicit information specifically about SCI systems. For example, the
form requires the SCI entity to indicate whether the type of SCI system
impacted by the SCI event directly supports: (1) trading; (2) clearance
and settlement; (3) order routing; (4) market data; (5) market
regulation; and/or (6) market surveillance. If the impacted system is a
critical SCI system, the SCI entity must indicate whether it directly
supports functionality relating to: (1) clearance and settlement
systems of clearing agencies; (2) openings, reopenings, and closings on
the primary listing market; (3) trading halts; (4) initial public
offerings; (5) the provision of consolidated market data; and/or (6)
exclusively-listed securities. The form also requires the SCI entity to
indicate if the systems that provide functionality to the securities
markets for which the availability of alternatives is significantly
limited or nonexistent and without which there would be a material
impact on fair and orderly markets.
---------------------------------------------------------------------------

    \537\ See 17 CFR 242.1000 (defining the term ``SCI event'');
Regulation SCI 2023 Proposing Release.
    \538\ See 17 CFR 242.1000 (defining the term ``system
disruption'' and including that term in the definition of ``SCI
event''); Regulation SCI 2023 Proposing Release.
---------------------------------------------------------------------------

e. Disclosure
    Proposed Rule 10 and the existing and proposed requirements of
Regulation SCI and the proposed requirements of Regulation S-P also
have similar, but distinct, requirements related to notification about
certain cybersecurity incidents. Regulation SCI requires that SCI
entities disseminate information to their members, participants, or
customers (as applicable) regarding SCI events.\539\ The proposed
amendments to Regulation S-P would require broker-dealers and transfer
agents to notify affected individuals whose sensitive customer
information was, or is reasonably likely to have been, accessed or used
without authorization.\540\ Proposed Rule 10 would require a Covered
Entity to make two types of public disclosures relating to
cybersecurity on Part II of proposed Form SCIR.\541\ Covered Entities
would be required to make the disclosures by filing Part II of proposed
Form SCIR on EDGAR and posting a copy of the filing on their business
internet websites.\542\ In addition, a Covered Entity that is either a
carrying or introducing broker-dealer would be required to provide a
copy of the most recently filed Part II of Form SCIR to a customer as
part of the account opening process. Thereafter, the carrying or
introducing broker-dealer would need to provide the customer with the
most recently filed form annually. The copies of the form would need to
be provided to the customer using the same means that the customer
elects to receive account statements (e.g., by email or through the
postal service). Finally, a Covered Entity would be required to
promptly make updated disclosures through each of the methods described
above (as applicable) if the information required to be disclosed about
cybersecurity risk or significant cybersecurity incidents materially
changes, including, in the case of the disclosure about significant
cybersecurity incidents, after the occurrence of a new significant
cybersecurity incident or when information about a previously disclosed
significant cybersecurity incident materially changes.
---------------------------------------------------------------------------

    \539\ See 17 CFR 242.1002(c).
    \540\ See Regulation S-P 2023 Proposing Release. The proposed
amendments to Regulation S-P would define ``sensitive customer
information'' to mean any component of customer information alone or
in conjunction with any other information, the compromise of which
could create a reasonably likely risk of substantial harm or
inconvenience to an individual identified with the information. Id.
The proposed amendments would provide example of sensitive customer
information. Id.
    \541\ See paragraph (d)(1) of proposed Rule 10.
    \542\ See section II.B.3.b. of this release (discussing these
proposed requirements in more detail).
---------------------------------------------------------------------------

    Consequently, a Covered Entity would--if it experiences a
``significant cybersecurity incident''--be required to make updated
disclosures under proposed Rule 10 by filing Part II of proposed Form
SCIR on EDGAR, posting a copy of the form on its business internet
website, and, in the case of a carrying or introducing broker-dealer,
by sending the disclosure to its customers using the same means that
the customer elects to receive account statements. Moreover, if Covered
Entity is an SCI entity and the significant cybersecurity incident is
or would be an SCI event under the current or proposed requirements of
Regulation SCI, the Covered Entity also could be required to
disseminate certain information about the SCI event to certain of its
members, participants, or customers (as applicable). Further, if the
Covered Entity is a broker-dealer or transfer agent and, therefore,
subject to Regulation S-P (as it is proposed to be amended), the
broker-dealer or transfer agent also could be required to notify
individuals whose sensitive customer information was, or is reasonably
likely to have been, accessed or used without authorization.
    However, despite these similarities, there are distinct
differences. First, proposed Rule 10, Regulation SCI, and Regulation S-
P (as proposed to be amended) require different types of information to
be disclosed. Second, the disclosures, for the most part, would be made
to different persons: (1) the public at large in the case of proposed
Rule 10; \543\ (2) affected members, participants, or customers (as
applicable) of the SCI entity in the case of Regulation SCI; \544\ and
(3) affected individuals whose sensitive customer information was, or
is reasonably likely to have been, accessed or used without
authorization or, in some cases, all individuals whose information
resides in the customer information system that was accessed or used
without authorization in the case of Regulation S-P (as proposed to be
amended).
---------------------------------------------------------------------------

    \543\ A carrying broker-dealer would be required to make the
disclosures to its customers as well through the means by which they
receive account statements.
    \544\ Information regarding major SCI events is and would be
required to be disseminated by an SCI entity to all of its members,
participants, or customers (as applicable) under the existing and
proposed requirements of Regulation SCI. See Regulation SCI 2023
Proposing Release.
---------------------------------------------------------------------------

    Additionally, the disclosure or notification provided about certain
cybersecurity incidents is different

under proposed Rule 10 and the existing and/or proposed requirements of
Regulation SCI and Regulation S-P, given their distinct goals. For
example, the requirement to disclose summary descriptions of certain
cybersecurity incidents from the current or previous calendar year
publicly on EDGAR, among other methods, under proposed Rule 10 serves a
different purpose than: (1) the member, participant, or customer (as
applicable) dissemination of information regarding SCI events under
Regulation SCI; and (2) the customer notification obligation under the
proposed amendments to Regulation S-P, which would provide more
specific information to individuals affected by a security compromise
involving their sensitive customer information, so that those
individuals may take remedial actions if they so choose.
2. Request for Comment
    The Commission requests comment on the potential duplication or
overlap between the requirements of proposed Rule 10, Regulation SCI
(as it currently exists and as it is proposed to be amended), and
Regulation S-P (as it currently exists and as it is proposed to be
amended). In addition, the Commission is requesting comment on the
following matters:
    91. Should the policies and procedures requirements of proposed
Rule 10 be modified to address Market Entities that also would be
subject to the existing and proposed requirements of Regulation SCI
and/or Regulation S-P? For example, would it be particularly costly or
create practical implementation difficulties to apply the requirements
of proposed Rule 10 (if it is adopted) to have policies and procedures
to address cybersecurity risks to Market Entities even if they also
would be subject to requirements to have policies and procedures under
Regulation SCI and/or Regulation S P that address certain cybersecurity
risks (currently and as they would be amended)? If so, explain why. If
not, explain why not. Are there ways the policies and procedures
requirements of proposed Rule 10 could be modified to minimize these
potential impacts while achieving the separate goals of this proposal
to protect participants in the U.S. securities markets and the markets
themselves from cybersecurity risks? If so, explain how and suggest
specific modifications.
    92. Would it be appropriate to modify proposed Rule 10 to exempt
SCI systems or indirect SCI systems from its policies and procedures
requirements and instead rely on the policies and procedures
requirements of Regulation SCI to address cybersecurity risks to these
information systems of Covered Entities? If so, explain why. If not,
explain why not. What would be the costs and benefits of this approach?
For example, if one set of policies and procedures generally would
satisfy the requirements of both rules, would this approach result in
incremental costs or benefits? Please explain. Would this approach
achieve the objectives of this rulemaking to address cybersecurity
risks to Covered Entities, given that Rule 10 is specifically designed
to address cybersecurity risks and Regulation SCI is designed to
address a broader range of risks to certain information systems? Please
explain. Would this approach create practical implementation and
compliance complexities insomuch as one set of the Covered Entity's
systems would be subject to Regulation SCI (i.e., SCI systems and
indirect SCI systems) and the other set would be subject to Rule 10?
Please explain. If it would create practical implementation and
compliance difficulties, would Covered Entities nonetheless apply
separate policies and procedures requirements to their information
systems based on whether they are or are not SCI systems and indirect
SCI Systems or would they develop a single set of policies and
procedures that comprehensively addresses the requirements of
Regulation SCI and Rule 10? Please explain. Would a comprehensive set
of policies and procedures result in stronger measures to protect SCI
systems and indirect SCI systems from cybersecurity risks? Please
explain. If so, would this be appropriate given the nature of SCI
systems and indirect SCI systems and the roles these systems play in
the U.S. securities markets? Please explain.
    93. Should the policies and procedures requirements of proposed
Rule 10 be modified to address Market Entities that also would be
subject to the requirements of Regulation ATS? If so, explain why. If
not, explain why not.
    94. Should the immediate notification and reporting requirements of
proposed Rule 10 be modified to address Covered Entities that also
would be subject to the existing and proposed requirements of
Regulation SCI? For example, would it be particularly costly or create
practical implementation difficulties to apply the immediate
notification and subsequent reporting requirements of proposed Rule 10
and Part I of proposed Form SCIR (if they are adopted) to Covered
Entities even if they also would be subject to immediate notification
and subsequent reporting requirements under Regulation SCI (as it
currently exists and would be amended)? If so, explain why. If not,
explain why not. Are there ways the notification and reporting
requirements of proposed Rule 10 and Part I of proposed Form SCIR could
be modified to minimize these potential impacts while achieving the
separate goals of this proposal to protect participants in the U.S.
securities markets and the markets themselves from cybersecurity risks?
If so, explain how and suggest specific modifications. For example,
should Part I of proposed Form SCIR be modified to include a section
that incorporates the check boxes and questions of Form SCI so that a
single form could be filed to meet the reporting requirements of
proposed Rule 10 and Regulation SCI? If so, explain why. If not,
explain why not. Are there other ways Part I of proposed Form SCIR
could be modified to combine the elements of Form SCI? If so, explain
how. Should Rule 10 be modified to require that the initial Part I of
Form SCIR must be filed within 24 hours (instead of promptly but not
later than 48 hours) to align the filing timeframe with Regulation SCI?
If so, explain why. If not, explain why not.
    95. Should the public disclosure requirements of proposed Rule 10
be modified to address Covered Entities that also would be subject to
the existing and proposed requirements of Regulation SCI and/or
Regulation S-P? For example, would it be particularly costly or create
practical implementation difficulties to apply the public disclosure
requirements of proposed Rule 10 and Part II of proposed form SCIR (if
they are adopted) to Covered Entities even if they also would be
subject to the current and proposed disclosure requirements of
Regulation SCI and Regulation S-P? If so, explain why. If not, explain
why not. Are there ways the public disclosure requirements of proposed
Rule 10 could be modified to minimize these potential impacts while
achieving the separate goals of this proposal to protect participants
in the U.S. securities markets and the markets themselves from
cybersecurity risks? If so, explain how and suggest specific
modifications. For example, should proposed Rule 10 be modified to
permit the customer notification that would be required under the
amendments to Regulation S-P to satisfy the requirement of proposed
Rule 10 that a Covered Entity that is a carrying broker-dealer or
introducing broker-dealer send a copy of an updated Part II of proposed
Form SCIR to its customers? If so, explain why. If not, explain why
not. Would sending the notification required by proposed Rule 10 and
the

notification required by the proposed amendments to Regulation S-P to
the same customer be confusing to the customer? If so, explain why. If
not, explain why not.

G. Cybersecurity Risk Related to Crypto Assets

    The creation, distribution, custody, and transfer of crypto assets
depends almost exclusively on the operations of information
systems.\545\ Crypto assets, therefore, are exposed to cybersecurity
risks.\546\ Further, crypto assets are attractive targets for threat
actors.\547\ Therefore, information systems that involve crypto assets
may be subject to heightened cybersecurity risks. If Market Entities
engage in business activities involving crypto assets, they could be
exposed to these heighted cybersecurity risks.\548\
---------------------------------------------------------------------------

    \545\ The term ``digital asset'' or ``crypto asset'' refers to
an asset that is issued and/or transferred using distributed ledger
or blockchain technology (``distributed ledger technology''),
including, but not limited to, so-called ``virtual currencies,''
``coins,'' and ``tokens.'' See Custody of Digital Asset Securities
by Special Purpose Broker-Dealers, Exchange Act Release No. 90788
(Dec. 23, 2020) [86 FR 11627, 11627, n.1 (Feb. 26, 2021)]. To the
extent digital assets rely on cryptographic protocols, these types
of assets are commonly referred to as ``crypto assets.'' A crypto
asset may or may not meet the definition of a ``security'' under the
federal securities laws. See, e.g., Report of Investigation Pursuant
to Section 21(a) of the Securities Exchange Act of 1934: The DAO,
Securities Exchange Act Release No. 81207 (July 25, 2017), available
at https://www.sec.gov/litigation/investreport/34-81207.pdf. See
also SEC v. W.J. Howey Co., 328 U.S. 293 (1946). ``Digital asset
securities'' can be referred to as ``crypto asset securities'' and
for purposes of this release, the Commission does not distinguish
between the terms ``digital asset securities'' and ``crypto asset
securities.''
    \546\ See KPMG, Assessing crypto and digital asset risks (May
2022), available at https://advisory.kpmg.us/content/dam/advisory/en/pdfs/2022/assessing-crypto-and-digital-asset-risks.pdf
(``Properly securing digital assets[] is typically viewed as the
biggest risk that companies must address.'').
    \547\ See U.S. Department of Treasury, Crypto-Assets:
Implications for Consumers, Investors, and Businesses (Sept. 2022),
available at https://home.treasury.gov/system/files/136/CryptoAsset_EO5.pdf (``Treasury Crypto Report'') (``Moreover, the
crypto-asset ecosystem has unique features that make it an
increasingly attractive target for unlawful activity, including the
ongoing evolution of the underlying technology, pseudonymity,
irreversibility of transactions, and the current asymmetry of
information between issuers of crypto-assets and consumers and
investors.'').
    \548\ Moreover, if the Market Entity's activities involving
crypto asset securities involve its information systems, the
requirements being proposed in this release would be implicated.
---------------------------------------------------------------------------

    Crypto assets are an attractive target for unlawful activity due,
in large part, to the unique nature of distributed ledger technology.
Possession or control of crypto assets on a distributed ledger is based
on ownership or knowledge of public and private cryptographic key
pairings. These key pairings are somewhat analogous to user names and
passwords and consist of strings of letters and numbers used to sign
transactions on a distributed ledger and to prove ownership of a
blockchain address, which is commonly known as a ``digital wallet.''
\549\ Digital wallets, in turn, generally require the use of internet-
connected hardware and software to receive and transmit information
about crypto asset holdings.
---------------------------------------------------------------------------

    \549\ See, e.g., NIST Glossary (defining ``private key'').
---------------------------------------------------------------------------

    A digital wallet can be obtained by anyone, including a potential
threat actor. If a victim's digital wallet is connected to the
internet, and a threat actor obtains access to the victim's private
key, the threat actor can transfer the contents of the wallet to
another blockchain address (such as the threat actor's own digital
wallet) without authorization from the true owner. It may be difficult
to subsequently track down the identity of the threat actor because the
owner of a digital wallet can remain anonymous (absent additional
attribution information) and because intermediaries involved in the
transfer of crypto assets, such as trading platforms, may not comply
with or may actively claim not to be subject to applicable ``know your
customer'' or related diligence requirements.\550\
---------------------------------------------------------------------------

    \550\ See, e.g., Treasury Crypto Report (``Compared to
registered financial market intermediaries--which are subject to
rules and laws that promote market integrity and govern risks and
business conduct, including identifying, disclosing, and mitigating
conflicts of interest and adhering to AML/CFT requirements--many
crypto-asset platforms may either not yet be in compliance with, or
may actively claim not to be subject to, existing applicable U.S.
laws and regulations, including registration requirements. . . .
When the onboarding process used by platforms is limited or opaque,
the risk that the platform may be used for illegal activities
increases.'').
---------------------------------------------------------------------------

    The current state of distributed ledger technology may present
other challenges to defending against cybercriminal activity. First,
there is no centralized information technology (``IT'') infrastructure
that can dynamically detect and prevent cyberattacks on wallets or
prevent the transfer of illegitimately obtained crypto assets by threat
actors.\551\ This is unlike traditional infrastructures, such as those
used by banks and broker-dealers, where behavioral and historic
transaction patterns can be used to detect and prevent account
takeovers in real-time. Furthermore, distributed ledger technology
often makes it difficult or impossible to reverse erroneous or
fraudulent crypto asset transactions, whereas processes and protocols
exist to reverse erroneous or fraudulent transactions when trading more
traditional assets.\552\ In addition, certain code that governs the
operation of a blockchain and that governs so-called ``smart
contracts'' are often transparent to the public. This provides threat
actors with visibility into potential vulnerabilities associated with
the code, though developers may have limited ability to patch those
vulnerabilities.\553\ These characteristics of distributed ledger
technology, and others, present cybersecurity vulnerabilities that, if
taken advantage of by a threat actor, could lead to financial harm
without meaningful recourse to reverse fraudulent transactions, recover
or replace lost crypto assets, or correct errors.
---------------------------------------------------------------------------

    \551\ See CipherTrace, Cryptocurrency crime and anti-money
laundering report (June 2022), available at https://4345106.fs1.hubspotusercontent-na1.net/hubfs/4345106/CAML%20Reports/CipherTrace%20Cryptocurrency%20Crime%20and%20Anti-Money%20Laundering%20Report%2c%20June%202022.pdf?_hstc=56248308.2ea6daf13b00f00afe4d9acf0886eddf.1667865330143.1667865330143.1667917991763.2&_hssc=56248308.1.1667917991763&_hsfp=247897319 (``CipherTrace
2022 Report'').
    \552\ For example, this is the case with Bitcoin and Ether, the
two crypto assets with the largest market values. See CoinMarketCap,
Today's Cryptocurrency Prices by Market Cap, available at https://coinmarketcap.com/ (``Crypto Asset Market Value Chart''). See also,
e.g., Kaili Wang, Qinchen Wang, and Dan Boneh, ERC-20R and ERC-721R:
Reversible Transactions on Ethereum (Oct. 11, 2022), available at
https://arxiv.org/pdf/2208.00543.pdf#page=16&zoom=100,96,233
(Stanford University proposal discussing the immutability of
Ethereum-based tokens, and proposing that reversible Ethereum
transactions may facilitate more wide-spread adoption of these
crypto assets). With respect to securities, the clearance and
settlement of securities that are not crypto assets are
characterized by infrastructure whereby intermediaries such as
clearing agencies and securities depositories serve as key
participants in the process. The clearance and settlement of crypto
asset securities, on the other hand, may rely on fewer, if any,
intermediaries and remain evolving areas of practices and
procedures.
    \553\ See Treasury Crypto Report (``Smart contracts, which are
widely used by many permissionless blockchains, also present risks
as they combine the features of generally being immutable and
publicly viewable. Taken together, these attributes pose several
vulnerabilities that may be exploited by illicit actors to steal
customer funds: once an attacker finds a bug in a smart contract and
exploits it, immutable smart contract protocols limit developers'
ability to patch the exploited vulnerability, giving attackers more
time to exploit the vulnerability and steal assets.'').
---------------------------------------------------------------------------

    The amount of crypto assets stolen by threat actors annually
continues to increase.\554\ Threat actors looking to

exploit the vulnerabilities associated with crypto assets often employ
social engineering techniques, such as phishing to acquire a user's
cryptographic key pairing information. Phishing tactics that have been
employed to reach and trick crypto asset users into disclosing their
private keys include: (1) monitoring social media for users reaching
out to wallet software support, intervening with direct messages, and
impersonating legitimate support staff who need the user's private key
to fix the problem; (2) distributing new crypto assets at no cost to a
set of wallets in an ``airdrop,'' and then failing transactions on
those assets with an error message to redirect the owner to a phishing
website or a website that installs plug-in software and steals the
user's credentials from a local device; and (3) impersonating a wallet
software provider and stealing private keys directly from the
user.\555\ To the extent that the activities of Market Entities involve
crypto assets, these types of phishing tactics could be used against
their employees.
---------------------------------------------------------------------------

    \554\ See Treasury Crypto Report (noting that of the total
amount of crypto asset based crime in 2021, theft rose by over 500%
year-over-year to $3.2 billion in total); Chainalysis, The 2022
Crypto Crime Report (Feb. 2022), available at https://go.chainalysis.com/2022-Crypto-Crime-Report.html (``Chainalysis 2022
Report'') (predicting that illicit transaction activity will reach
an all-time high in terms of value in 2022, and noting that crypto
asset based crime hit a new all-time high in 2021, with illicit
addresses receiving $14 billion over the course of the year, up from
$7.8 billion in 2020).
    \555\ See Microsoft 365 Defender Research Team, `Ice Phishing'
on the Blockchain (Feb. 16, 2022), available at https://www.microsoft.com/security/blog/2022/02/16/ice-phishing-on-the-blockchain/.
---------------------------------------------------------------------------

    Another related variation of a social engineering attack that is
similar to phishing, but does not involve stealing private keys
directly, is called ``ice phishing.'' In this scheme, the threat actor
tricks the user into signing a digital transaction that delegates
approval and control of the user's wallet to the attacker, allowing the
threat actor to become the so-called ``spender'' of the wallet. Once
the threat actor obtains control over the user's wallet, the threat
actor can transfer all of the crypto assets to a new wallet controlled
by the threat actor.\556\
---------------------------------------------------------------------------

    \556\ See CipherTrace June 2022 Report. Delegating authority to
another user reportedly is a common transaction on decentralized
finance (``DeFi'') platforms, as the user may need to provide the
DeFi platform with approval to conduct transactions with the user's
tokens. In an ``ice phishing'' attack, the attacker modifies the
spender address to the attacker's address. Once the approval
transaction has been signed, submitted, and mined, the spender can
access the funds. The attacker can accumulate approvals over a
period of time and then drain the victim's wallets quickly.
---------------------------------------------------------------------------

    Threat actors also target private keys and crypto assets through
other means, such as installing key logging software,\557\ exploiting
vulnerabilities in code used in connection with crypto assets (such as
smart contracts), and deploying flash loan attacks.\558\ Installing key
logging software, in particular, is an example of malware that threat
actors looking to exploit the vulnerabilities associated with crypto
assets often employ. Other common types of crypto asset-focused malware
techniques include info stealers, clippers, and cryptojackers.\559\
---------------------------------------------------------------------------

    \557\ Key logging can involve a threat actor deploying a
software program designed to record which keys are pressed on a
computer keyboard to obtain passwords or other encryption keys,
therefore bypassing certain security measures. See NIST Glossary
(defining ``key logger''). Key logging software can be installed,
for example, when the victim clicks a link or downloads an
attachment in a phishing email, downloads a Trojan virus that is
disguised as a legitimate file or application, or is directed to a
phony website.
    \558\ See Treasury Crypto Report (``In an innovation unique to
DeFi lending, some protocols may support `flash loans,' which enable
users to borrow, use, and repay crypto assets in a single
transaction that is recorded on the blockchain in the same data
block. Because there is no default risk associated with flash loans,
users can borrow without posting collateral and without risk of
being liquidated. A `flash loan attack' can occur when the temporary
surge of funds obtained in a flash loan is used to manipulate prices
of crypto-assets, often through the interaction of multiple DeFi
services, enabling attackers to take over the governance of a
protocol, change the code, and drain the treasury.''). In 2021, code
exploits and flash loan attacks accounted for 49.8% of all crypto
asset value stolen across all crypto asset services. See Chainalysis
2022 Report.
    \559\ Specifically, ``info stealers'' collect saved credentials,
files, autocomplete history, and crypto asset wallets from
compromised computers. ``Clippers'' can insert new text into the
victim's clipboard, replacing text the user has copied. Hackers can
use clippers to replace crypto asset addresses copied into the
clipboard with their own, allowing them to reroute planned
transactions to their own wallets. ``Cryptojackers'' make
unauthorized use of the computing power of a victim's device to mine
crypto assets. See Chainalysis 2022 Report.
---------------------------------------------------------------------------

    The size and growth of the crypto asset markets, along with the
fact that many participants in these markets (such as issuers,
intermediaries, trading platforms, and service providers) may be acting
in noncompliance with applicable law, continue to make them an
attractive target for threat actors looking for quick financial gain.
The crypto asset ecosystem has exhibited rapid growth in the past few
years. For example, industry reports have suggested that the total
crypto asset market value increased from approximately $135 billion on
January 1, 2019 to just under $2.1 trillion on March 31, 2022.\560\
According to these reports, the crypto asset market value peaked at
almost $3 trillion in November 2021.\561\ Various sources also report
that the market value remains over $1 trillion today.\562\
---------------------------------------------------------------------------

    \560\ See CipherTrace June 2022 Report. The amount of total
activity in the crypto asset markets has increased as well.
According to the CipherTrace June 2022 Report, while the total
activity in 2020 was around $4.3 trillion, there was approximately
$16 trillion of total activity in the first half of 2021 alone. See
id.
    \561\ See id.
    \562\ See Crypto Asset Market Value Chart; see also Treasury
Crypto Report.
---------------------------------------------------------------------------

III. General Request for Comment

    In addition to the specific requests for comment above, the
Commission is requesting comments from all members of the public on all
aspects of the proposed rule and amendments. Commenters are requested
to provide empirical data in support of any arguments or analyses. With
respect to any comments, the Commission notes that they are of the
greatest assistance to this rulemaking initiative if accompanied by
supporting data and analysis of the issues addressed in those comments
and by alternatives to the Commission's proposals where appropriate.

IV. Economic Analysis

A. Introduction

    The Commission is mindful of the economic effects, including the
costs and benefits, of: (1) proposed Rule 10; (2) Parts I and II of
proposed Form SCIR; (3) the proposed amendments to Rules 17a-4, 17ad-7,
and 18a-6; (4) the proposed amendments to existing orders that exempt
certain clearing agencies from registering with the Commission; and (5)
the proposed amendments to paragraph (d)(1) of Rule 3a71-6 to add
proposed Rule 10 and Form SCIR to the list of Commission requirements
eligible for a substituted compliance determination. Section 3(f) of
the Exchange Act provides that when engaging in rulemaking that
requires the Commission to consider or determine whether an action is
necessary or appropriate in the public interest, to also consider, in
addition to the protection of investors, whether the action will
promote efficiency, competition, and capital formation.\563\ Section
23(a)(2) of the Exchange Act also requires the Commission to consider
the effect that the rules and rule amendments would have on
competition, and it prohibits the Commission from adopting any rule
that would impose a burden on competition not necessary or appropriate
in furtherance of the Exchange Act.\564\ The analysis below addresses
the likely economic effects of the proposed rule and form, the proposed
rule amendments, and the proposed amendments to the exemptive orders,
including the anticipated and estimated benefits and costs of these
proposals and their likely effects on efficiency, competition, and
capital formation. The Commission also discusses the potential economic
effects of certain alternatives

to the approaches taken with respect to these proposals.
---------------------------------------------------------------------------

    \563\ See 15 U.S.C. 78c(f).
    \564\ See 15 U.S.C. 78w(a)(2).
---------------------------------------------------------------------------

    As discussed above, Market Entities rely on information systems to
perform functions that support the fair, orderly, and efficient
operation of the U.S. securities markets.\565\ This exposes them and
the U.S. securities markets to cybersecurity risk. According to the
Bank for International Settlements, the financial sector has the
second-largest share of COVID-19-related cybersecurity events between
the end of February and June 2020.\566\ As is the case with other risks
(e.g., market, credit, or liquidity risk), cybersecurity risk can be
addressed through policies and procedures that are reasonably designed
to manage the risk. A second means to address cybersecurity risk to the
U.S. securities markets is through the Commission gathering and sharing
information about significant cybersecurity incidents. This risk also
can be addressed through greater transparency.\567\ For these reasons
(and the reasons discussed throughout the release), the Commission is
proposing Rule 10 and Form SCIR to require that Market Entities address
cybersecurity risks, to improve the Commission's ability to obtain
information about significant cybersecurity incidents impacting Covered
Entities and to require Covered Entities to disclose publicly summary
descriptions of their cybersecurity risks and significant cybersecurity
incidents (if applicable).
---------------------------------------------------------------------------

    \565\ See section I.A. of this release (discussing cybersecurity
risks and the use of information systems by Market Entities).
    \566\ Id. The health sector is ranked first in term of the
cyberattacks.
    \567\ ``The Council recommends that regulators and market
participants continue to work together to improve the coverage,
quality, and accessibility of financial data, as well as improve
data sharing among relevant agencies.'' FSOC 2021 Annual Report, at
16.
---------------------------------------------------------------------------

    It is important to note that the Market Entities serve different
functions in the U.S. securities markets and are subject to different
regulatory regimes. As a result, Market Entities today have varying
approaches to cybersecurity protections and would have different costs
and benefits associated with complying with proposed Rule 10 and for
Covered Entities to file Parts I and II of proposed Form SCIR. In
addition, Market Entities may have different costs and benefits
depending on the size and complexity of their businesses. For example,
because Non-Covered Broker-Dealers likely are materially smaller in
size than Covered Entities, use fewer and less complex information
systems, and have less data stored on information systems, the
obligations of Non-Covered Broker-Dealers under proposed Rule 10 are
more limited, and likely would have lower compliance costs. This could
be the case even though Non-Covered Broker-Dealers may still need to
invest in hardware and software, employ legal and compliance personnel,
or contract with a third party. Furthermore, in addition to the direct
benefits and costs realized by Market Entities, other market
participants, such as investors and third-party service providers would
realize indirect benefits and costs from the adoption of the proposed
rule. The direct and indirect benefits and costs realized by each type
of Market Entity and market participants are discussed below.\568\
---------------------------------------------------------------------------

    \568\ See section IV.D. of this release (discussing these
benefits and costs).
---------------------------------------------------------------------------

    Many of the benefits and costs discussed below are difficult to
quantify. For example, the effectiveness of cybersecurity strengthening
measures taken as a result of proposed Rule 10 depends on the extent to
which they reduce the likelihood of a cybersecurity incident and on the
expected cost of such an incident, including remediation costs in the
event that a cybersecurity incident causes harm. As a result, the
effectiveness of cybersecurity strengthening is subject to numerous
assumptions and unknowns, and thus is difficult to quantify.
Effectively, because cybersecurity infrastructure as well as policies
and procedures help to prevent successful cybersecurity intrusions, the
benefit of cybersecurity protection can be measured as the expected
loss from a cybersecurity incident. In 2020, the average loss in the
financial services industry was $18.3 million, per company per
incident. The average cost of a financial services data breach was
$5.85 million.\569\ Thus, those values would represent the benefit of
avoiding a cybersecurity incident.
---------------------------------------------------------------------------

    \569\ Jennifer Rose Hale, The Soaring Risks of Financial
Services Cybercrime: By the Numbers, Diligent (Apr. 9, 2021),
available at https://www.diligent.com/insights/financial-services/cybersecurity/#.
---------------------------------------------------------------------------

    The Commission has limited information on cybersecurity incidents
impacting Market Entities. For example, as discussed above, certain
Market Entities are SCI entities subject to the requirements of
Regulation SCI. \570\ SCI entities must report SCI events to the
Commission on Form SCI, which could include cybersecurity
incidents.\571\ However, only certain Market Entities are SCI entities
and the reporting requirements of Regulation SCI are limited to SCI
systems and indirect SCI systems, which are a subset of the information
systems used by SCI entities. To the extent that a cybersecurity
incident at a Market Entity that is also a SCI entity is an SCI event,
the Market Entity would be required to file Form SCI. However, only
certain SCI events are also considered to be cybersecurity incidents.
Consequently, the Commission currently has only partial knowledge of
the cybersecurity incidents that occur at Market Entities. The
Commission believes using the benefit and cost values related to SCI
Entities as a basis to estimate the benefits and costs of the proposed
rule for Covered Entities would be instructive but may be under
inclusive.
---------------------------------------------------------------------------

    \570\ See section II.F.1.b. of this release (discussing the
Covered Entities that are subject to Regulation SCI).
    \571\ See section II.F.1.d. of this release (discussing the
reporting requirements of Regulation SCI).
---------------------------------------------------------------------------

    Similarly, the Commission has access to information contained in
confidential anti-money laundering (AML) suspicious activity reports
(``SARs'') that broker-dealers file with the Department of the
Treasury's Financial Crime Enforcement Network (``FinCEN''), which
includes known or suspected cybersecurity incidents.\572\ However, the
SARs filed by broker-dealers with FinCEN do not necessarily include all
of the details associated with an incident, such as whether the
incident was confirmed, the extent of the impact, and how the breach
was remediated. Furthermore, the SAR filing may not be timely, as a
broker-dealer has up to 30 days to file the SAR if a suspect is
identified, or up to 60 days if a suspect is not identified. Issues
that require immediate attention--such as terrorist financing or
ongoing money laundering schemes--must be reported to law
enforcement.\573\ If reporting is not otherwise required by the
Commission or an SRO, a broker-dealer ``may also, but is not required
to'' contact the Commission.\574\ Broker-dealers must make the
supporting documentation available to the Commission and registered
SROs (as well as to FinCEN, law enforcement agencies, and Federal
regulatory authorities that examine for Bank Secrecy Act compliance)
upon request.\575\ The benefits and costs of filing SARs with FinCEN
can serve as a basis to approximate the cost of filing Part I of
proposed Form SCIR. However, the proposed rule would require a

quicker reporting timeline, more information to be provided, and
multiple updates with regard to a given significant cybersecurity
event. Thus, the costs related to complying with SAR filings serves as
a floor for Covered Entities complying with the proposed rule.
---------------------------------------------------------------------------

    \572\ See, e.g., Fergus Shiel and Ben Hallman, International
Consortium of Investigative Journalists, Suspicious Activity
Reports, Explained (Sept. 20, 2020), available at https://www.icij.org/investigations/fincen-files/suspicious-activity-reports-explained/ (stating that approximately 85% of SARs are filed
by a few large banks to report money laundering).
    \573\ See 31 CFR 1023.320(b)(3).
    \574\ See 31 CFR 1023.320(a)(1), (b)(3).
    \575\ See 31 CFR 1023.320(d).
---------------------------------------------------------------------------

    While the Commission has attempted to quantify economic effects
where possible, some of the discussion of economic effects is
qualitative in nature. The Commission seeks comment on all aspects of
the economic analysis, especially any data or information that would
enable the Commission to quantify the proposal's economic effects more
accurately.

B. Broad Economic Considerations

    Market Entities generally have financial incentives to maintain
some level of cybersecurity protection because failure to safeguard
their operations from attacks on their information systems and protect
information about their customers, counterparties, members,
registrants, or users as well as their funds and assets could lead to
losses of funds, assets, and customer information, as well as damage
the Market Entity's reputation. As a result, Market Entities generally
have an incentive to invest some amount of money to address
cybersecurity risk.
    Market Entities' reputational motives generally should encourage
them to invest in measures to protect their information systems from
cybersecurity risk.\576\ Moreover, the damage caused by a significant
cybersecurity incident, including the associated remediation costs, may
exceed that of implementing cybersecurity policies and procedures that
may have prevented the incident and its harmful impacts. As a result,
significant losses arising from a potential significant cybersecurity
incident can encourage Market Entities to invest in cybersecurity
protections today. However, such investments in cybersecurity
protections may not be sufficient. The Investment Company Institute
notes that the remediation costs of $252 million associated with the
2013 data breach experienced by Target Brands, Inc. (``Target'') far
exceeded the cost of the cybersecurity insurance the company purchased
($90 million), resulting in an out-of-pocket loss for Target of $162
million.\577\ PCH Technologies states that in 2020, small companies (1-
49 employees) lost an average of $24,000 per cybersecurity incident.
That loss increased to $50,000 per incident for medium-sized companies
(50-249 employees). Large companies (250-999 employees) and enterprise-
level firms (1,000 employees or more) lost an average of $133,000 and
$504,000 per cybersecurity incident, respectively.\578\
---------------------------------------------------------------------------

    \576\ See Marc Dupuis and Karen Renaud, Scoping the Ethical
Principles of Cybersecurity Fear Appeals, 23 Ethics and Info. Tech.
265 (2021), available at https://doi.org/10.1007/s10676-020-09560-0.
    \577\ See National Law Review, Target Data Breach Price Tag:
$252 Million and Counting (Feb. 26, 2015), available at https://www.natlawreview.com/article/target-data-breach-price-tag-252-million-and-counting.
    \578\ Timothy Guim, Cost of Cyber Attacks vs. Cost of Cyber
Security in 2021, PCH Technologies (July 7, 2021), available at
https://pchtechnologies.com/cost-of-cyber-attacks-vs-cost-of-cyber-
security-in-2021/
#:~:text=1%20Large%20businesses%3A%20Between%20%242%20million%20and%2
0%245,%24500%2C000%20or%20less%20spent%20on%20cybersecurity%20per%20y
ear.
---------------------------------------------------------------------------

    Having an annual penetration testing requirement can help Market
Entities reduce the likelihood of costly data breaches. For instance,
according to one industry source, RSI Security, a penetration test
``can measure [the entity's] system's strengths and weaknesses in a
controlled environment before [the entity has] to pay the cost of an
extremely damaging data breach.'' \579\ For example, RSI Security
explains that penetration testing ``can cost anywhere from $4,000-
$100,000,'' and ``[o]n average, a high quality, professional
[penetration testing] can cost from $10,000-$30,000.'' \580\ RSI
Security, however, was clear that the magnitudes of these costs can
vary with size, complexity, scope, methodology, types, experience, and
remediation measures.\581\ On the other hand, the same article cited
IBM's 2019 Cost of a Data Breach Study, which reported that the average
cost of a data breach is $3.92 million with an average loss of 25,575
records,\582\ which would more than justify ``the average $10,000-
$30,000 bill from a professional, rigorous [penetration testing].''
\583\ Another source estimates a ``high-quality, professional
[penetration testing to cost] between $15,000-$30,000,'' while
emphasizing that ``cost varies quite a bit based on a set of
variables.'' \584\ This is in line with a third source, which states
that ``[a] true penetration test will likely cost a minimum of
$25,000.'' \585\ It is the Commission's understanding that multi-cloud
architecture could introduce more complexity and accordingly,
cybersecurity risks into Market Entities back-up systems, to the extent
they have them.\586\
---------------------------------------------------------------------------

    \579\ RSI Security, What is the Average Cost of Penetration
Testing?, RSI Security Blog (posted Mar. 5,2020), available at
https://blog.rsisecurity.com/what-is-the-average-cost-of-
penetration-testing/
#:~:text=Penetration%20testing%20can%20cost%20anywhere,that%20of%20a%
20large%20company.
    \580\ See RSI Security, What is the Average Cost of Penetration
Testing?, RSI Security Blog (posted Mar. 5, 2020), available at
https://blog.rsisecurity.com/what-is-the-average-cost-of-
penetration-testing/
#:~:text=Penetration%20testing%20can%20cost%20anywhere,that%20of%20a%
20large%20company.
    \581\ See id.
    \582\ See IBM, Cost of a Data Breach Report (2019), available at
https://www.ibm.com/downloads/cas/RDEQK07R (``2019 Cost of Data
Breach Report'').
    \583\ See RSI Security, What is the Average Cost of Penetration
Testing?, RSI Security Blog (posted Mar. 5, 2020), available at
https://blog.rsisecurity.com/what-is-the-average-cost-of-
penetration-testing/
#:~:text=Penetration%20testing%20can%20cost%20anywhere,that%20of%20a%
20large%20company.
    \584\ Gary Glover, How Much Does a Pentest Cost?,
Securitymetrics Blog (Nov. 15, 2022, 8:36 a.m.), available at
https://www.securitymetrics.com/blog/how-much-does-pentest-cost.
    \585\ Mitnick Security, What Should You Budget for a Penetration
Test? The True Cost, Mitnick Security Blog, (posted Jan. 29, 2021,
5:13 a.m.), available at https://www.mitnicksecurity.com/blog/what-should-you-budget-for-a-penetration-test-the-true-cost.
    \586\ For example, security breach possibilities could increase
because of the interconnection of Market Entities through their
multi cloud providers.
---------------------------------------------------------------------------

    Large Market Entities that have economies of scale are able to
implement cybersecurity policies and procedures in a more cost-
effective manner. Smaller Market Entities, on the other hand, generally
do not enjoy the same economies of scale or scope. The marginal cost
for smaller Market Entities when implementing cybersecurity policies
and procedures that are just as robust as those that would be needed by
large Market Entities likely would be relatively high for smaller
Market Entities. As a result, investment costs in cybersecurity
protection at small broker-dealers, for example, (most of which would
be Non-Covered Broker-Dealers under proposed Rule 10) likely will
account for a larger proportion of their revenue than at relatively
large broker-dealers (which likely would be Covered Entities that
realize economies of scale).
    Having policies and procedures in place to address cybersecurity
risk would benefit the customers, counterparties, members, registrants,
or users with whom Market Entities interact. However, a cybersecurity
budget likely is tempered, in part, such that the total sum spent to
address cybersecurity risk provides some, but possibly not complete,
protection against cyberattacks.\587\ Ultimately,

those costs to address cybersecurity risks will be passed on, to the
extent possible, to the persons with whom the Market Entities do
business.\588\
---------------------------------------------------------------------------

    \587\ See Martijn Wessels, Puck van den Brink, Thijmen Verburgh,
Beatrice Cadet, and Theo van Ruijven, Understanding Incentives for
Cybersecurity Investments: Development and Application of a
Typology, 1 Digit. Bus. 1-7 (Oct. 2021), available at https://doi.org/10.1016/j.digbus.2021.100014; Scott Dynes, Eric Goetz, and
Michael Freeman, Cyber Security: Are Economic Incentives Adequate?
(Intern. Conf. on Critical Infrastructure Protection, Conference
Paper, 2007), available at https://doi.org/10.1007/978-0-387-75462-8_2; Brent R. Rowe and Michael P. Gallaher, Private Sector Cyber
Security Investment Strategies: An Empirical Analysis, The Fifth
Workshop on the Economics of Information Security (Mar. 2006),
available at http://www.infosecon.net/workshop/downloads/2006/pdf/18.pdf (``Private Sector Cyber Security Investment Strategies
Analysis''); Nicole van der Meulen, RAND Europe, Investing in
Cybersecurity (Aug. 2015), available at https://repository.wodc.nl/bitstream/handle/20.500.12832/2173/2551-full-text_tcm28-73946.pdf?sequence=4&isAllowed=y.
    \588\ See Derek Mohammed, Cybersecurity Compliance in the
Financial Sector, J. Internet Banking and Com. (2015), available at
https://www.icommercecentral.com/open-access/cybersecurity-compliance-in-the-financial-sector.php?aid=50498.
---------------------------------------------------------------------------

    The level of cybersecurity protection instituted by Market Entities
may be inadequate from the perspective of overall economic
efficiency.\589\ In other words, the chosen level of cybersecurity
protection may, in fact, represent an underinvestment relative to the
optimal level of cybersecurity protection that should be maintained by
Market Entities from an overall economic perspective. Levels of
cybersecurity protection that are not optimal may exacerbate the
occurrence of harmful cybersecurity incidents. Cybersecurity events
have grown in both number and sophistication.\590\ These developments
in the market have significantly increased the negative externalities
that may flow from systems failures.
---------------------------------------------------------------------------

    \589\ Low levels of investment in cybersecurity protection,
which are different from underinvestment in cybersecurity
protection, can be a function of a number of issues, such as firm
budget, available solutions, knowledge of the threat actors'
capabilities, and the performance of in-house or contracted
information technology teams.
    \590\ See, e.g., Chuck Brooks, Alarming Cyber Statistics For
Mid-Year 2022 That You Need To Know (June 3, 2022), available at
https://www.forbes.com/sites/chuckbrooks/2022/06/03/alarming-cyber-statistics-for-mid-year-2022-that-you-need-to-know/?sh=2429c57e7864.
---------------------------------------------------------------------------

    Underinvestment in cybersecurity may occur because a Market Entity
is aware that it would not bear the full cost of a cybersecurity
incident (i.e., some negative externalities may be borne by its
customers, counterparties, members, registrants, or users). As a
result, the Market Entity does not have to internalize the complete
cost of cybersecurity protection when deciding upon its level of
investment. This underinvestment by the Market Entity is considered to
be a moral hazard problem, because other market participants are harmed
by a significant cybersecurity incident and are forced to bear those
costs that spill over to them. At the same time, even though Market
Entities may not bear the full cost of a cybersecurity failure (e.g.,
loss of the personal information or the assets of their customers,
members, registrants, or users), they likely would incur some costs
themselves and therefore have incentives to avoid cybersecurity
failures. These incentives could cause them to implement policies and
procedures to address cybersecurity risk, which would likely result in
benefits that accrue in large part to their customers, counterparties,
members, registrants, or users. Market Entities could do this in order
to avoid the harms that could be caused by a significant cybersecurity
incident (e.g., loss of funds, assets, or personal, confidential, or
proprietary information; damage to or the holding hostage of their
information systems; or reputational damage). As a result, Market
Entities have a potential incentive to rely overly on reactive
solutions to cybersecurity threats and attacks instead of proactive
ones.\591\
---------------------------------------------------------------------------

    \591\ See Private Sector Cyber Security Investment Strategies
Analysis.
---------------------------------------------------------------------------

    1. In the context of cybersecurity, negative externalities arising
from the moral hazard problem can have significant negative
repercussions on the financial system more broadly, particularly due to
the interconnectedness of Market Entities.\592\ Borg notes that the
level of interconnectedness and complexity can have an influence on the
degree of damage that cybersecurity incidents impose on Market Entities
as well as their customers, counterparties, members, registrants, and
users.\593\ As for the availability of substitutes the negative effect
of a cybersecurity incident could be lessened to the extent that there
is one or more competing firms that can complete the task, such as
another broker-dealer or national securities exchange. On the flip
side, significant cybersecurity incidents may be the most damaging when
there are no substitutes available to execute the required task.
---------------------------------------------------------------------------

    \592\ See Anil K. Kashyap and Anne Wetherilt, Some Principles
for Regulating Cyber Risk, 109 Amer. Econ. Assoc. Papers and Proc.
482 (May 2019).
    \593\ See Scott Borg, Economically Complex Cyberattacks, IEEE
Computer Society (2005), available at https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=1556539.
---------------------------------------------------------------------------

    In addition to other firms being negatively affected by a
cybersecurity incident, investors can be negatively affected. For
example, a significant cybersecurity incident at a national securities
exchange could affect its ability to execute trades, causing orders to
go unfilled. Depending on how long it takes the national securities
exchange to resolve the issue, the prices of securities traded on the
exchange may be different from when the orders were originally
placed.\594\ A loss of confidence in an exchange due to a cybersecurity
incident could result in a longer-term reallocation of trading volume
to competing exchanges or other trading venues.\595\ A significant
cybersecurity incident could produce negative effects that spill over
and affect market participants outside of the national securities
exchange itself. It also may adversely affect market confidence, and
curtail economic activity through a reduction in securities trading
among market participants.\596\
---------------------------------------------------------------------------

    \594\ National securities exchanges currently are subject to
certain obligations under Regulation SCI.
    \595\ National securities exchanges may be required to meet
certain regulatory obligations in such circumstances.
    \596\ See Electra Ferriello, Prof. Robert Shiller's U.S. Crash
Confidence Index, Yale School of Management, Intern. Ctr. for Fin.
(Nov. 3, 2020), available at https://som.yale.edu/blog/prof-robert-shillers-us-crash-confidence-index; Gregg E. Berman, Senior Advisor
to the Director, Division of Trading and Markets, Commission, Speech
by SEC Staff: Market Participants and the May 6 Flash Crash (Oct.
2010), available at https://www.sec.gov/news/speech/2010/spch101310geb.htm.
---------------------------------------------------------------------------

    While the negative externalities that arise from the moral hazard
problem are usually depicted as being absorbed by other market
participants, the losses to other parties may be potentially covered in
part or in full by insurance policies.\597\ An even stronger incentive
to underinvest is the possibility that an outside party can make whole
or at least mitigate some of the losses incurred by the various market
participants. Market Entities may underinvest in their cybersecurity
measures due to the moral hazard that results from expectations of
government support.\598\ Most threat

actors primarily have a monetary incentive, and there is a large
monetary incentive to breach cybersecurity protections in the financial
sector. As a result, Covered Entities--such as clearing agencies, large
national securities exchanges, and large carrying broker-dealers--may
be attractive targets to sophisticated threat actors aiming to
compromise or disrupt the U.S. financial system because of the services
they perform to support the functioning of the U.S. securities markets;
the protection of confidential, proprietary, or personal information
they store; or the financial assets they hold. Protection against
``advanced persistent threats'' \599\ from sophisticated threat actors,
whatever their motives, is costly.\600\ The belief--no matter how
misplaced--that a widespread and crippling cybersecurity attack would
be met with government support, such as direct payments for recovery
and immediate cybersecurity investments, could lead to moral hazard
where certain Covered Entities underinvest in defenses aimed at
countering that threat.\601\
---------------------------------------------------------------------------