[Federal Register Volume 79, Number 57 (Tuesday, March 25, 2014)]
[Proposed Rules]
[Pages 16248-16250]
[FR Doc No: 2014-06497]

-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 39

[Docket No. FAA-2014-0180; Directorate Identifier 2014-CE-004-AD]
RIN 2120-AA64

Airworthiness Directives; Przedsiebiorstwo Doswiadczalno-
Produkcyjne Szybownictwa ``PZL-Bielsko'' Model SZD-50-3 ``Puchacz''
Sailplanes

AGENCY: Federal Aviation Administration (FAA), Department of
Transportation (DOT).

ACTION: Notice of proposed rulemaking (NPRM).

-----------------------------------------------------------------------

SUMMARY: We propose to adopt a new airworthiness directive (AD) for
Przedsiebiorstwo Doswiadczalno-Produkcyjne Szybownictwa ``PZL-Bielsko''
Model SZD-50-3 ``Puchacz'' sailplanes that would supersede AD 2004-11-
10. This proposed AD results from mandatory continuing airworthiness
information (MCAI) originated by an aviation authority of another
country to identify and correct an unsafe condition on an aviation
product. The MCAI describes the unsafe condition as fatigue damage of
the welded joint between the airbrake torque tube and the airbrake
control system lever located inside the fuselage. We are issuing this
proposed AD to require actions to address the unsafe condition on these
products.

DATES: We must receive comments on this proposed AD by May 9, 2014.

ADDRESSES: You may send comments by any of the following methods:
     Federal eRulemaking Portal: Go to http://www.regulations.gov. Follow the instructions for submitting comments.
     Fax:<PHONE_NUMBER>.
     Mail: U.S. Department of Transportation, Docket
Operations, M-30, West Building Ground Floor, Room W12-140, 1200 New
Jersey Avenue SE., Washington, DC 20590.
     Hand Delivery: U.S. Department of Transportation, Docket
Operations, M-30, West Building Ground Floor, Room W12-140, 1200 New
Jersey Avenue SE., Washington, DC 20590, between 9 a.m. and 5 p.m.,
Monday through Friday, except Federal holidays.
    For service information identified in this proposed AD, contact
Allstar PZL Glider, Sp. z o. o., ul. Cieszynska 325, 43-300 Bielsko-
Biala, Poland; telephone: +48 33 812 50 26; fax: +48 33 812 3739;
email<EMAIL_ADDRESS>Internet: http://szd.com.pl/en/products/szd-50-3-puchacz. You may review copies of the referenced service
information at the FAA, Small Airplane Directorate, 901 Locust, Kansas
City, Missouri 64106. For information on the availability of this
material at the FAA, call<PHONE_NUMBER>.

Examining the AD Docket

    You may examine the AD docket on the Internet at http://www.regulations.gov by searching for and locating Docket No. FAA-2014-
0180; or in person at the Docket Management Facility between 9 a.m. and
5 p.m., Monday through Friday, except Federal holidays. The AD docket
contains this proposed AD, the regulatory evaluation, any comments
received, and other information. The street address for the Docket
Office (telephone<PHONE_NUMBER>) is in the ADDRESSES section. Comments
will be available in the AD docket shortly after receipt.

FOR FURTHER INFORMATION CONTACT: Jim Rutherford, Aerospace Engineer,
FAA, Small Airplane Directorate, 901 Locust, Room 301, Kansas City,
Missouri 64106; telephone:<PHONE_NUMBER>; fax:<PHONE_NUMBER>; email:
<EMAIL_ADDRESS>
SUPPLEMENTARY INFORMATION:

Comments Invited

    We invite you to send any written relevant data, views, or
arguments about this proposed AD. Send your comments to an address
listed under the ADDRESSES section. Include ``Docket No. FAA-2014-0180;
Directorate Identifier 2014-CE-004-AD'' at the beginning of your
comments. We specifically invite comments on the overall regulatory,
economic, environmental, and energy aspects of this proposed AD. We
will consider all comments received by the closing date and may amend
this proposed AD because of those comments.
    We will post all comments we receive, without change, to http://regulations.gov, including any personal information you provide. We
will also post a report summarizing each substantive verbal contact we
receive about this proposed AD.

Discussion

    On May 27, 2004, we issued AD 2004-11-10, Amendment 39-13656 (69 FR
31872; June 8, 2004). That AD required actions intended to address an
unsafe condition on Przedsiebiorstwo Doswiadczalno-Produkcyjne
Szybownictwa ``PZL-Bielsko'' Model SZD-50-3 ``Puchacz'' sailplanes.
    Since we issued AD 2004-11-10 (69 FR 31872; June 8, 2004), service
information has been introduced that identifies new inspection and
replacement requirements on the airbrake torque tube and the airbrake
control system lever.
    The European Aviation Safety Agency (EASA), which is the Technical
Agent for the Member States of the European Community, has issued EASA
AD No.: 2014-0015, dated January 14, 2014 (referred to after this as
``the MCAI''), to correct an unsafe condition for the specified
products. The MCAI states:

    Several occurrences of airbrake torque tube failure were
reported on SZD-50-3 ``Puchacz'' sailplanes. In all cases, as a
result of disruption of the welded joint between torque tube and the
lever, the broken torque tube detached from the lever located in the
fuselage. The result of subsequent investigations identified fatigue
damage, as a consequence of periodical striking load exceeding the
established maximum value, to be a possible failure cause.
Additionally, corrosion damage was identified at internal surface of
the opened tube.
    This condition, if not detected and corrected, would inhibit the
function of the airbrake, possibly resulting in reduced control of
the sailplane.
    Prompted by these findings, Allstar PZL issued Service Bulletin
(SB) No. BE-052/SZD-50-3/2003 to provide inspection instructions.
CAO of Poland issued AD SP-0052-2003-A to require a one-time
inspection of the airbrake torque tube in the area of welded joint
in accordance with that SB.
    Since that AD was issued, Allstar PZL issued SB No. BE-062/SZD-
50-3/2013 to introduce repetitive inspections and accomplishment
instructions for reinforced torque tube inspections.
    For the reasons described above, this AD supersedes CAO of
Poland AD SP-0052-2003-A and requires repetitive inspections of the
airbrake torque tube and, depending on findings, replacement with a
serviceable part.

You may examine the MCAI on the Internet at http://www.regulations.gov
by searching for and locating Docket No. FAA-2014-0180.

Relevant Service Information

    Allstar PZL Glider has issued Allstar PZL Glider Sp. Z o.o.
Mandatory Service Bulletin No. BE-062/SZD-50-3/2013 ``Puchacz'', dated
September 16, 2013. The actions described in this service information
are intended to correct the unsafe condition identified in the MCAI.

FAA's Determination and Requirements of the Proposed AD

    This product has been approved by the aviation authority of another
country, and is approved for operation in the United States. Pursuant
to our bilateral agreement with this State of

Design Authority, they have notified us of the unsafe condition
described in the MCAI and service information referenced above. We are
proposing this AD because we evaluated all information and determined
the unsafe condition exists and is likely to exist or develop on other
products of the same type design.

Costs of Compliance

    We estimate that this proposed AD will affect 5 products of U.S.
registry. We also estimate that it would take about 5 hours for the
proposed annual inspection of sailplanes equipped with the old version
torque tube; 1 hour for the proposed annual inspection of sailplanes
equipped with the new version torque tube; and 5 hours for the proposed
1,000-hour annual inspection of sailplanes equipped with the new
version torque tube. The average labor rate is $85 per work-hour.
    In addition, we estimate that any necessary follow-on actions would
take about 5 work-hours and require parts costing $875, for a cost of
$1,300 per product. We have no way of determining the number of
products that may need these actions.

Authority for This Rulemaking

    Title 49 of the United States Code specifies the FAA's authority to
issue rules on aviation safety. Subtitle I, section 106, describes the
authority of the FAA Administrator. ``Subtitle VII: Aviation
Programs,'' describes in more detail the scope of the Agency's
authority.
    We are issuing this rulemaking under the authority described in
``Subtitle VII, Part A, Subpart III, Section 44701: General
requirements.'' Under that section, Congress charges the FAA with
promoting safe flight of civil aircraft in air commerce by prescribing
regulations for practices, methods, and procedures the Administrator
finds necessary for safety in air commerce. This regulation is within
the scope of that authority because it addresses an unsafe condition
that is likely to exist or develop on products identified in this
rulemaking action.

Regulatory Findings

    We determined that this proposed AD would not have federalism
implications under Executive Order 13132. This proposed AD would not
have a substantial direct effect on the States, on the relationship
between the national Government and the States, or on the distribution
of power and responsibilities among the various levels of government.
    For the reasons discussed above, I certify this proposed
regulation:
    (1) Is not a ``significant regulatory action'' under Executive
Order 12866,
    (2) Is not a ``significant rule'' under the DOT Regulatory Policies
and Procedures (44 FR 11034, February 26, 1979),
    (3) Will not affect intrastate aviation in Alaska, and
    (4) Will not have a significant economic impact, positive or
negative, on a substantial number of small entities under the criteria
of the Regulatory Flexibility Act.

List of Subjects in 14 CFR Part 39

    Air transportation, Aircraft, Aviation safety, Incorporation by
reference, Safety.

The Proposed Amendment

    Accordingly, under the authority delegated to me by the
Administrator, the FAA proposes to amend 14 CFR part 39 as follows:

PART 39--AIRWORTHINESS DIRECTIVES

0
1. The authority citation for part 39 continues to read as follows:

    Authority:  49 U.S.C. 106(g), 40113, 44701.

Sec.  39.13  [Amended]

0
2. Amend Sec.  39.13 by removing Amendment 39-13656 (69 FR 31872, June
8, 2004), and adding the following new AD:

Przedsiebiorstwo Doswiadczalno-Produkcyjne Szybownictwa ``PZL-
Bielsko'': Docket No. FAA-2014-0180; Directorate Identifier 2014-CE-
004-AD.

(a) Comments Due Date

    We must receive comments by May 9, 2014.

(b) Affected ADs

    This AD supersedes AD 2004-11-10, Amendment 39-13656 (69 FR
31872, June 8, 2004).

(c) Applicability

    This AD applies to Przedsiebiorstwo Doswiadczalno-Produkcyjne
Szybownictwa ``PZL-Bielsko'' Model SZD-50-3 ``Puchacz'' sailplanes,
all serial numbers, certificated in any category.

(d) Subject

    Air Transport Association of America (ATA) Code 27: Flight
Controls.

(e) Reason

    This AD was prompted by continuing airworthiness information
(MCAI) originated by an aviation authority of another country to
identify and correct an unsafe condition on an aviation product. The
MCAI describes the unsafe condition as fatigue damage of the welded
joint between the airbrake torque tube and the airbrake control
system lever located inside the fuselage. We are issuing this AD to
detect and correct fatigue damage of the airbrake torque tube and
the airbrake control system lever which may cause a malfunction of
the airbrake, resulting in loss of control of the sailplane.

(f) Actions and Compliance

    Unless already done, do the following actions in paragraphs
(f)(1) through (f)(6) of this AD:
    (1) For sailplanes equipped with the old version torque tube,
with or without reinforced corner: Initially within 30 days after
the effective date of this AD and repetitively thereafter at
intervals not to exceed every 12 months or 100 hours time-in-service
(TIS), whichever occurs first, do a detailed inspection of the
airbrake torque tube following the inspection procedures in
paragraph (2)(b) in Allstar PZL Glider Sp. Z o.o. Service Bulletin
No. BE-062/SZD-50-3/2013 ``Puchacz'', dated September 16, 2013.
    (2) For sailplanes equipped with the new type torque tube, with
reinforced corner: Initially within 30 days after the effective date
of this AD and repetitively thereafter at intervals not to exceed
every 12 months or 100 hours TIS, whichever occurs first, visually
inspect the welded joint of the airbrake torque tube following the
conditions of inspection, first bulleted item of paragraph
(2)(a)(2), in Allstar PZL Glider Sp. Z o.o. Service Bulletin No. BE-
062/SZD-50-3/2013 ``Puchacz'', dated September 16, 2013.
    (3) For sailplanes equipped with the new type torque tube, with
reinforced corner: During the first 1,000-hour inspection after the
effective date of this AD, and then repetitively at each scheduled
1,000-hour inspection, do a detailed inspection of the welded joint
of the airbrake torque tube following the inspection procedures in
paragraph (2)(b) in Allstar PZL Glider Sp. Z o.o. Service Bulletin
No. BE-062/SZD-50-3/2013 ``Puchacz'', dated September 16, 2013.
    (4) For all sailplanes: If during any inspection required by
paragraph (f)(1), (f)(2), or (f)(3) of this AD any damage is found
as detailed in paragraph (2)(c) of PZL Glider Sp. Z o.o. Service
Bulletin No. BE-062/SZD-50-3/2013 ``Puchacz'', dated September 16,
2013, replace the airbrake torque tube as described in the Post-
inspection procedures, paragraph (2)(c), of Allstar PZL Glider Sp. Z
o.o. Service Bulletin No. BE-062/SZD-50-3/2013 ``Puchacz'', dated
September 16, 2013.
    (5) For all sailplanes: Replacement of an airbrake torque tube,
as required by paragraph (4) of this AD, does not constitute
terminating action for inspection requirements of paragraphs (f)(1),
(f)(2), and (f)(3) of this AD.
    (6) For all sailplanes: Compliance with the requirements of
paragraphs (f)(1), (f)(2) or (f)(3) of this AD can be demonstrated
by incorporating the applicable required inspections and follow-on
corrective actions, as specified in Allstar PZL Glider Sp. Z o.o.
Service Bulletin No. BE-062/SZD-50-3/2013 ``Puchacz'', dated
September 16, 2013 into the approved instructions for continued
airworthiness (ICA) of the maintenance program.

(g) Other FAA AD Provisions

    The following provisions also apply to this AD:
    (1) Alternative Methods of Compliance (AMOCs): The Manager,
Standards Office, FAA, has the authority to approve AMOCs for this
AD, if requested using the procedures found in 14 CFR 39.19. Send
information to ATTN: Jim Rutherford, Aerospace Engineer, FAA, Small
Airplane Directorate, 901 Locust, Room 301, Kansas City, Missouri
64106; telephone:<PHONE_NUMBER>; fax:<PHONE_NUMBER>; email:
<EMAIL_ADDRESS>Before using any approved AMOC on any
airplane to which the AMOC applies, notify your appropriate
principal inspector (PI) in the FAA Flight Standards District Office
(FSDO), or lacking a PI, your local FSDO.
    (2) Airworthy Product: For any requirement in this AD to obtain
corrective actions from a manufacturer or other source, use these
actions if they are FAA-approved. Corrective actions are considered
FAA-approved if they are approved by the State of Design Authority
(or their delegated agent). You are required to assure the product
is airworthy before it is returned to service.

(h) Related Information

    Refer to MCAI European Aviation Safety Agency (EASA) AD No.:
2014-0015, dated January 14, 2014, for related information. You may
examine the MCAI on the Internet at http://www.regulations.gov by
searching for and locating Docket No. FAA-2014-0180. For service
information related to this AD, contact Allstar PZL Glider, Sp. z o.
o., ul. Cieszynska 325, 43-300 Bielsko-Biala, Poland; telephone: +48
33 812 50 26; fax: +48 33 812 3739; email<EMAIL_ADDRESS>
Internet: http://szd.com.pl/en/products/szd-50-3-puchacz. You may
review copies of the referenced service information at the FAA,
Small Airplane Directorate, 901 Locust, Kansas City, Missouri 64106.
For information on the availability of this material at the FAA,
call<PHONE_NUMBER>.

    Issued in Kansas City, Missouri, on March 19, 2014.
James E. Jackson,
Acting Manager, Small Airplane Directorate, Aircraft Certification
Service.
[FR Doc. 2014-06497 Filed 3-24-14; 8:45 am]
BILLING CODE 4910-13-P


[Federal Register Volume 87, Number 134 (Thursday, July 14, 2022)]
[Notices]
[Pages 42218-42221]
[FR Doc No: 2022-15004]

=======================================================================
-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-95233; File No. SR-FICC-2022-003]

Self-Regulatory Organizations; Fixed Income Clearing Corporation;
Order Approving a Proposed Rule Change To Require Applicants and
Members To Maintain or Upgrade Their Network or Communications
Technology

July 8, 2022.

I. Introduction

    On May 20, 2022, Fixed Income Clearing Corporation (``FICC'') filed
with the Securities and Exchange Commission (``Commission'') proposed
rule change SR-FICC-2022-003 (``Proposed Rule Change'') pursuant to
Section 19(b)(1) of the Securities Exchange Act of 1934 (``Act'') \1\
and Rule 19b-4 thereunder.\2\ The Proposed Rule Change was published
for comment in the Federal Register on May 31, 2022.\3\ The Commission
did not receive any comment letters on the proposed rule change. For
the reasons discussed below, the Commission is approving the Proposed
Rule Change.
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 78s(b)(1).
    \2\ 17 CFR 240.19b-4.
    \3\ Securities Exchange Act Release No. 94972 (May 24, 2022), 87
FR 32489 (May 31, 2022) (SR-FICC-2022-003) (``Notice of Filing'').
---------------------------------------------------------------------------

II. Description of the Proposed Rule Change

A. Background

    FICC proposes to modify its Government Securities Division Rulebook
(``GSD Rules''), Mortgage-Backed Securities Division Clearing Rules
(``MBSD Rules''), and Electronic Pool Notification Rules of MBSD (``EPN
Rules,'' and, together with the GSD Rules and the MBSD Rules, the

``Rules'') \4\ to require its Members and applicants for membership
(collectively, ``members'') to upgrade and maintain their network
technology, and communications technology or protocols, to meet
standards that FICC would identify and publish via Important Notice on
its website, as described more fully below.
---------------------------------------------------------------------------

    \4\ FICC's Rules are available at https://www.dtcc.com/~/media/
Files/Downloads/legal/rules/ficc_gov_rules.pdf; https://
www.dtcc.com/~/media/Files/Downloads/legal/rules/
ficc_mbsd_rules.pdf; https://www.dtcc.com/~/media/Files/Downloads/
legal/rules/ficc_mbsd_epnrules.pdf.
---------------------------------------------------------------------------

    FICC is made up of two divisions, the Government Securities
Division (FICC/GSD) and the Mortgage Backed Securities Division (FICC/
MBSD), each providing clearing services in a different portion of the
fixed income market.\5\ FICC/GSD provides clearing, settlement, risk
management, central counterparty services, and a guarantee of trade
completion for U.S. government and agency securities.\6\ FICC/MBSD
provides clearing, netting, settlement, risk management, and pool
notification services to major market participants trading in pass-
through MBS issued by the Ginnie Mae, Freddie Mac, and Fannie Mae.\7\
In light of its critical role in the marketplace, FICC was designated a
Systemically Important Financial Market Utility (``SIFMU'') under Title
VIII of the Dodd-Frank Wall Street Reform and Consumer Protection Act
of 2010.\8\ Due to FICC's unique position in the marketplace, a failure
or a disruption at FICC could, among other things, increase the risk of
significant liquidity problems spreading among financial institutions
or markets, and thereby threaten the stability of the financial system
in the United States.\9\
---------------------------------------------------------------------------

    \5\ See Financial Stability Oversight Counsel 2012 Annual
Report, Appendix A (``FSOC 2012 Report''), available at http://www.treasury.gov/initiatives/fsoc/Documents/2012-20Annual-20Report.pdf.
    \6\ Id.
    \7\ Id.
    \8\ 12 U.S.C. 5465(e)(1). See FSOC 2012 Report, supra note 5.
    \9\ See FSOC 2012 Report, Appendix A, supra note 5.
---------------------------------------------------------------------------

    FICC's Rules currently do not require, either as part of an
application for membership or as an ongoing membership requirement, any
level or version for network technology, such as a web browser or other
technology, or any level or version of communications technology or
protocols, such as email encryption, secure messaging, or file
transfers, that members may use to connect to or communicate with
FICC.\10\ Therefore, FICC currently maintains multiple network and
communications methods and protocols to interact with its members.\11\
This includes some outdated communication technologies in order to
support members that continue to use such older technologies.\12\ FICC
believes that continuing to use such outdated technologies could render
communications between FICC and some of its members vulnerable to cyber
risks.\13\ Additionally, members' use of outdated technology delays
FICC's implementation of its own internal system upgrades, which by
doing so, risks losing connectivity between FICC and a number of its
members.\14\ Finally, FICC states that it currently expends additional
resources, both in personnel and equipment, to maintain outdated
communications channels.\15\
---------------------------------------------------------------------------

    \10\ Notice of Filing, supra note 3, at 32490.
    \11\ Id.
    \12\ Id.
    \13\ Id.
    \14\ Id.
    \15\ Id.
---------------------------------------------------------------------------

    To mitigate the foregoing security concerns and resource
inefficiencies, FICC proposes to require its members to upgrade and
maintain network technology, communication technology, and protocol
standards, in accordance with applicable technology standards that FICC
would identify and publish via Important Notice on its website from
time to time.\16\ FICC would base these requirements on standards set
forth by widely accepted organizations such as the National Institute
of Standards and Technology (``NIST'') and the internet Engineer Task
Force (``IETF'').\17\
---------------------------------------------------------------------------

    \16\ Id., at 32490-91.
    \17\ Id. NIST is part of the U.S. Department of Commerce. The
IETF is an open standards organization that develops and promotes
voluntary internet standards, in particular, the technical standards
that comprise the internet protocol suite (TCP/IP). For example,
NIST Special Publication 800-52 revision 2, specifies servers that
support government-only applications shall be configured to use
Transport Layer Security (``TLS'') 1.2 and should be configured to
use TLS 1.3 as well. See https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf. (TLS, the successor of the
now-deprecated Secure Sockets Layer (``SSL''), is a cryptographic
protocol designed to provide communications security over a computer
network.) These servers should not be configured to use TLS 1.1 and
shall not use TLS 1.0, SSL 3.0, or SSL 2.0. Additionally, the IETF
formally deprecated TLS versions 1.0 and 1.1 in March of 2021,
stating that ``[t]hese versions lack support for current and
recommended cryptographic algorithms and mechanisms, and various
government and industry profiles of applications using TLS now
mandate avoiding these old TLS versions. . . . Removing support for
older versions from implementations reduces the attack surface,
reduces opportunity for misconfiguration, and streamlines library
and product maintenance.'' See https://datatracker.ietf.org/doc/rfc8996/. FICC would also require members to discontinue using File
Transfer Protocol (``FTP''), which FICC believes to be an insecure
protocol because it transfers user authentication data (username and
password) and file data as plain-text (not encrypted) over the
network. Notice of Filing, supra note 3, at 32490-91.
---------------------------------------------------------------------------

    To implement the proposed changes, FICC would revise its Rules to
require members to maintain or upgrade their network technology,
communications technology, or protocols on the systems that connect to
FICC, to the version FICC requires, within the time period FICC
requires.\18\ Consistent with the guidance from NIST and other
standards organizations, FICC would require the use of TLS 1.2, Secure
FTP (``SFTP''), and other modern technology and communication standards
and protocols, by its members for communication with FICC.\19\ FICC
would publish such requirements via Important Notice on its
website.\20\ FICC also proposes to amend its Rules to provide that
failure to perform a necessary technology upgrade within the required
timeframe would subject members to a monetary fine.\21\
---------------------------------------------------------------------------

    \18\ Notice of Filing, supra note 3, at 32490-91.
    \19\ Id.
    \20\ Id.
    \21\ Notice of Filing, supra note 3, at 32490-91.
---------------------------------------------------------------------------

III. Discussion and Commission Findings

    Section 19(b)(2)(C) of the Act \22\ directs the Commission to
approve a proposed rule change of a self-regulatory organization if it
finds that such proposed rule change is consistent with the
requirements of the Act and the rules and regulations thereunder
applicable to such organization. After careful consideration, the
Commission finds that the Proposed Rule Change is consistent with the
requirements of the Act and the rules and regulations applicable to
FICC. In particular, the Commission finds that the Proposed Rule Change
is consistent with Sections 17A(b)(3)(F) \23\ and (b)(3)(G) \24\ of the
Act and Rules 17Ad-22(e)(17) \25\ and (e)(21) \26\ thereunder.
---------------------------------------------------------------------------

    \22\ 15 U.S.C. 78s(b)(2)(C).
    \23\ 15 U.S.C. 78q-1(b)(3)(F).
    \24\ 15 U.S.C. 78q-1(b)(3)(G).
    \25\ 17 CFR 240.17Ad-22(e)(17)(i) and (ii).
    \26\ 17 CFR 240.17Ad-22(e)(21)(iv).
---------------------------------------------------------------------------

A. Consistency With Section 17A(b)(3)(F) of the Act

    Section 17A(b)(3)(F) of the Act requires that the rules of a
clearing agency be designed to, among other things, promote the prompt
and accurate clearance and settlement of securities transactions and
assure the safeguarding of securities and funds which are in the
custody or control of the clearing agency or for which it is
responsible.\27\
---------------------------------------------------------------------------

    \27\ 15 U.S.C. 78q-1(b)(3)(F).
---------------------------------------------------------------------------

    As described above, FICC proposes to require its members to upgrade
and maintain network technology, and

communication technology and protocol standards, that meet the
standards identified by FICC and published via Important Notice to
FICC's website from time to time. FICC would use standards set forth by
widely accepted organizations such as NIST and the IETF as the
requirements. The proposed requirements would enable FICC to avoid
communicating with its members using outdated technologies that present
security vulnerabilities to FICC. Specifically, as an initial matter,
the proposed requirements would enable FICC to discontinue using
communication technologies such as TLS 1.0, TLS 1.1, SSL 2.0, SSL 3.0,
and FTP, which have been deemed not secure by organizations such as
NIST and/or the IETF. Removing support for such outdated technologies
would reduce FICC's potential exposure to cyberattacks and other cyber
vulnerabilities.
    If not adequately addressed, the risk of cyberattacks and other
cyber vulnerabilities could affect FICC's network and, in turn, FICC's
ability to clear and settle securities transactions, or to safeguard
the securities and funds which are in FICC's custody or control, or for
which it is responsible. FICC designed the proposed requirements for
members to upgrade their communications technology to address those
risks, as described above. Accordingly, the Commission finds the
proposed technology requirements on FICC's members would promote the
prompt and accurate clearance and settlement of securities transactions
and assure the safeguarding of securities and funds which are in the
custody or control of FICC or for which it is responsible, consistent
with the requirements of Section 17A(b)(3)(F) of the Act.\28\
---------------------------------------------------------------------------

    \28\ Id.
---------------------------------------------------------------------------

B. Consistency With Section 17A(b)(3)(G) of the Act

    Section 17A(b)(3)(G) of the Act requires the rules of a clearing
agency to provide that its participants shall be appropriately
disciplined for violation of any provision of the rules of the clearing
agency by fine or other fitting sanction.\29\ As noted above, FICC
proposes to require its members to upgrade and maintain network
technology, communication technology, and protocol standards, in
accordance with applicable technology standards that FICC would
identify and publish via Important Notice on its website. The proposed
requirements would enable FICC to avoid communicating with its members
using outdated technologies that present security vulnerabilities to
FICC. If not adequately addressed, such vulnerabilities could affect
FICC's network and its ability to operate. FICC also proposes to amend
its Rules to provide that failure to perform a necessary technology
upgrade within the required timeframe would subject members to a
monetary fine. Because the proposed monetary fine should incentivize
FICC's members to upgrade and maintain secure communications
technology, thereby reducing FICC's operational risks, the Commission
finds the proposed rule change is consistent with the requirements of
Section 17A(b)(3)(G) of the Act.\30\
---------------------------------------------------------------------------

    \29\ 15 U.S.C. 78q-1(b)(3)(G).
    \30\ Id. Additionally, by including the monetary fine provision
in its Rules, FICC would enable its members to better identify and
evaluate the material costs they might incur by participating in
FICC, consistent with Rule 17Ad-22(e)(23)(ii). under the Act, which
requires a covered clearing agency to establish, implement,
maintain, and enforce written policies and procedures reasonably
designed to provide sufficient information to enable participants to
identify and evaluate the risks, fees, and other material costs they
incur by participating in the covered clearing agency. See 17 CFR
240.17Ad-22(e)(23)(ii).
---------------------------------------------------------------------------

C. Consistency With Rule 17Ad-22(e)(17) Under the Act

    Rule 17Ad-22(e)(17)(i) under the Act requires that each covered
clearing agency establish, implement, maintain and enforce written
policies and procedures reasonably designed to manage the covered
clearing agency's operational risks by identifying the plausible
sources of operational risk, both internal and external, and mitigating
their impact through the use of appropriate systems, policies,
procedures, and controls.\31\ FICC's operational risks include cyber
risks to its electronic systems.
---------------------------------------------------------------------------

    \31\ 17 CFR 240.17Ad-22(e)(17)(i).
---------------------------------------------------------------------------

    As described above, FICC and its members connect electronically to
communicate with one another. However, FICC's Rules currently do not
require any level or version for network technology, such as a web
browser or other technology, or any level or version of communications
technology or protocols, such as email encryption, secure messaging, or
file transfers, that members may use to connect to or communicate with
FICC. As a result, FICC maintains some outdated communication
technologies in order to support members that continue to use such
older technologies. Continuing to use such outdated technologies could
render communications between FICC and some of its members vulnerable
to cyber risks.
    To mitigate the foregoing cyber risks, FICC proposes to require its
members to upgrade and maintain network technology, and communication
technology and protocol standards that meet the standards identified by
FICC from time to time. The proposed technology requirements should
reduce FICC's cyber risk by requiring members to upgrade and maintain
communications technology based on standards set forth by widely
accepted organizations such as NIST and the IETF, thereby decreasing
the operational risks presented to FICC. Because the proposed
technology requirements would help FICC mitigate plausible sources of
external operational risk, the Commission finds the proposed changes
are consistent with the requirements of Rule 17Ad-22(e)(17)(i) under
the Act.\32\
---------------------------------------------------------------------------

    \32\ Id.
---------------------------------------------------------------------------

    Rule 17Ad-22(e)(17)(ii) under the Act requires that each covered
clearing agency establish, implement, maintain and enforce written
policies and procedures reasonably designed to manage the covered
clearing agency's operational risks by ensuring, in part, that systems
have a high degree of security, resiliency, and operational
reliability.\33\ As noted above, FICC's operational risks include cyber
risks.
---------------------------------------------------------------------------

    \33\ 17 CFR 240.17Ad-22(e)(17)(ii).
---------------------------------------------------------------------------

    As described above, FICC's Rules currently do not require any level
or version for network technology, such as a web browser or other
technology, or any level or version of communications technology or
protocols, such as email encryption, secure messaging, or file
transfers, that members may use to connect to or communicate with FICC.
FICC designed the proposed technology requirements to reduce cyber
risks by requiring its members to upgrade and maintain communications
technology based on standards set forth by widely accepted
organizations such as NIST and the IETF. Requiring FICC's members to
use only secure communications technology would reduce FICC's cyber
risks and thereby strengthen the security, resiliency, and operational
reliability of FICC's network and other systems. Because the proposed
technology requirements would enhance FICC's ability to ensure that its
systems have a high degree of security, resiliency, and operational
reliability, the Commission finds the Proposed Rule Change is
consistent with the requirements of Rule 17Ad-22(e)(17)(ii) under the
Act.\34\
---------------------------------------------------------------------------

    \34\ Id.

---------------------------------------------------------------------------

D. Consistency With Rule 17Ad-22(e)(21) Under the Act

    Rule 17Ad-22(e)(21)(iv) under the Act requires that each covered
clearing agency establish, implement, maintain and enforce written
policies and procedures reasonably designed to have the covered
clearing agency's management regularly review the efficiency and
effectiveness of its use of technology and communication
procedures.\35\
---------------------------------------------------------------------------

    \35\ 17 CFR 240.17Ad-22(e)(21)(iv).
---------------------------------------------------------------------------

    As mentioned above, FICC maintains multiple network and
communication methods to interact with its members, including certain
outdated communication technologies necessary to support members that
continue to use such older technologies. FICC believes that continuing
to use such outdated technologies could render communications between
FICC and some of its members vulnerable to cyber risks. Additionally,
members' use of outdated technology delays FICC's implementation of its
own internal system upgrades, which by doing so, risks losing
connectivity between FICC and a number of its members. Finally, FICC
states that it currently expends unnecessary resources to maintain
outdated communications channels. In other words, FICC has subjected
its network communication methods to review for efficiency and
effectiveness. As a result, to enhance the efficiency and effectiveness
of its technology and communication procedures, FICC proposes to
require its members to upgrade and maintain network technology,
communication technology, and protocol standards, in accordance with
applicable technology standards that FICC would identify and publish
via Important Notice on its website. Because the Proposed Rule Change
is an outgrowth of FICC's review of the efficiency and effectiveness of
its technology and communication procedures, the Commission finds the
Proposed Rule Change is consistent with the requirements of Rule 17Ad-
22(e)(21)(iv) under the Act.\36\
---------------------------------------------------------------------------

    \36\ Id.
---------------------------------------------------------------------------

IV. Conclusion

    On the basis of the foregoing, the Commission finds that the
Proposed Rule Change is consistent with the requirements of the Act and
in particular with the requirements of Section 17A of the Act \37\ and
the rules and regulations promulgated thereunder.
---------------------------------------------------------------------------

    \37\ 15 U.S.C. 78q-1.
---------------------------------------------------------------------------

    It is therefore ordered, pursuant to Section 19(b)(2) of the Act
\38\ that Proposed Rule Change SR-FICC-2022-003, be, and hereby is,
approved.\39\
---------------------------------------------------------------------------

    \38\ 15 U.S.C. 78s(b)(2).
    \39\ In approving the Proposed Rule Change, the Commission
considered the proposals' impact on efficiency, competition, and
capital formation. 15 U.S.C. 78c(f).

    For the Commission, by the Division of Trading and Markets,
pursuant to delegated authority.\40\
---------------------------------------------------------------------------

    \40\ 17 CFR 200.30-3(a)(12).
---------------------------------------------------------------------------

J. Matthew DeLesDernier,
Assistant Secretary.
[FR Doc. 2022-15004 Filed 7-13-22; 8:45 am]
BILLING CODE 8011-01-P