FINRA's implementation costs because FINRA is already working in an
AWS environment and is thus unlikely to face many of the
implementation costs that other Participants will face in
implementing SAWs. Consequently, the Commission is reducing its
estimate of FINRA's implementation costs by 75%. FINRA's share of
implementation costs is (2.4/1.7 x $10,005,000 x 25%) = $3,531,176.
Thus the Commission preliminary estimate of implementation costs
would be $18,144,000 + $3,531,176 = $21,675,176.

                                           Table 4--Estimated Participant Group Incremental SAW Use Costs ($)
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                  Single exchange                 Exchange group                    Association
                                                         -----------------------------------------------------------------------------------------------
                                                             Instances         Cost          Instances         Cost          Instances         Cost
--------------------------------------------------------------------------------------------------------------------------------------------------------
Basic instance..........................................               5           6,000              25          26,000             150         154,000
Cluster compute instance................................               0               0              30       1,169,000             120       4,676,000
Advanced instance.......................................               0               0              15         942,000              30       1,912,000
Shared services & common charge.........................               5          30,000              70         420,000             300       1,800,000
SAW storage.............................................          100 TB          31,000            2 PB         589,000            5 PB       1,463,000
                                                         -----------------------------------------------------------------------------------------------
    Total...............................................  ..............          67,000  ..............       3,146,000  ..............      10,005,000
--------------------------------------------------------------------------------------------------------------------------------------------------------

    The Commission preliminarily believes that some provisions of the
proposed amendments will entail indirect costs that regulators will
incur to access and use CAT Data. The requirements that Participants
work within SAWs and only access Customer and Account Attributes data
through SAWs may raise the costs of regulatory access to CAT Data, or
cause Participants to make operational changes to how they perform
their regulatory duties in response to the decreased flexibility of the
Plan under the proposed amendments. By

restricting the use of most data access methods to SAWs or Excepted
Environments, the CAT NMS Plan may make it more difficult or impossible
for Participants to perform certain functions in the manner they
currently do, for example by limiting the set of regulatory tools that
are available to perform surveillance or enforcement investigations.
This may result in some Participants developing new tools to perform
these functions, or entering into RSAs and 17d-2 agreements with
another regulator to avoid incurring such costs.
c. Amendments for Excepted Environments
    The proposed amendments add provisions to the CAT NMS Plan that set
forth a process by which Participants may be granted an exception from
the requirement that Participants use their respective SAWs to access
CAT Data through the user-defined direct query and bulk extract
tools.\675\ The Commission also proposes to add provisions to the CAT
NMS Plan that would set forth implementation and operational
requirements for any Excepted Environments.
---------------------------------------------------------------------------

    \675\ See supra Part II.C.5.
---------------------------------------------------------------------------

    The Commission preliminarily believes that providing for exceptions
for the SAW usage requirements offers three benefits. First, the
Commission preliminarily believes that provisions allowing for
exceptions to the SAW usage requirements may allow Participants to
achieve or maintain the security standards required by the CAT NMS Plan
\676\ more efficiently. Some Participants may have significant
investments in private analytic environments and regulatory tools that
they currently use or are developing to conduct regulatory activities
in their analytic environments. To the extent that it would be
impossible, impractical, or inefficient to adapt these processes to the
SAWs, a mechanism for an exception to this policy may allow
Participants to achieve the security standards required by the CAT NMS
Plan without bearing the expense of redeveloping or implementing these
processes within the SAWs. Further, if a Participant is able to conduct
these activities with IT resources that would otherwise be idle if the
Participant moved its activities to the SAW, an exception process may
prevent the inefficiency of underutilizing existing resources.
---------------------------------------------------------------------------

    \676\ See supra text accompanying note 623.
---------------------------------------------------------------------------

    Second, the Commission preliminarily believes that provisions in
the proposed amendments that provide for an annual review process for
the continuance of any exceptions that are granted would provide a
procedure and timeline for remedying security deficiencies in Excepted
Environments.\677\ Although the CAT NMS Plan currently requires the
CISO to review information security policies and procedures of the
Participants that are related to the CAT, under the proposed
amendments, this review will include a third-party security assessment
and documentation of detailed design specifications of the
Participant's security implementation. The Commission preliminarily
believes that this additional information is likely to improve the
quality of the review of the Participant's data security because it
extends beyond information in the Participant's policies and procedures
related to CAT. This may allow identification and remediation of
security deficiencies that might not have been identified under the CAT
NMS Plan. To the extent that these provisions identify security
deficiencies that would otherwise not be identified, or identifies
these deficiencies more rapidly, they may improve the security of CAT
Data because the CAT NMS Plan does not currently establish procedures
for periodic third-party review of Participants' private analytic
environments, nor does it provide timelines for addressing any security
deficiencies identified within these environments.
---------------------------------------------------------------------------

    \677\ See supra Part II.C.5.
---------------------------------------------------------------------------

    Third, the Commission preliminarily believes that provisions in the
proposed amendments that require the Plan Processor to monitor some
elements of security within Excepted Environments may improve CAT Data
security by providing additional monitoring in Excepted Environments.
The proposed amendments require Participants operating Excepted
Environments to facilitate security monitoring within those
environments by the Plan Processor. To the extent that this provides
additional monitoring in Excepted Environments rather than substituting
for monitoring by Participants with Excepted Environments, security
monitoring of those environment may increase in effectiveness under the
proposed amendments.
    Finally, the Commission preliminarily believes that provisions of
the proposed amendments that establish third-party security audits for
Exempted Environments may improve CAT Data security. Currently, under
the CAT NMS Plan, Participants are expected to establish comparable
security protocols to those required for the central repository for all
environments from which Participants access CAT Data. While the CAT NMS
Plan currently requires the Plan Processor CISO to review Participants'
policies and procedures to verify they are comparable to those for the
central repository, the proposed amendments require that Exempted
Environments undergo third-party security audits when they are first
approved, and annually thereafter. Because these audits have a broader
scope than the policy and procedure review required by the CAT NMS
Plan, the Commission preliminarily believes they may provide a more
comprehensive review of Participant security. To the extent that these
third-party audits identify potential security concerns that would
otherwise persist, security of CAT Data may improve.
    The Commission preliminarily believes that Participants will make
the decision to seek exceptions or work within the SAW at the
Participant Group level.\678\ The Commission estimates that if all nine
Participant Groups were to obtain exceptions to the SAW use
requirements, the Participants would incur initial costs of $3.5MM
\679\ to apply for exceptions and the Plan Processor would incur
initial costs of $1.0MM to evaluate those applications and validate
Excepted Environments. The Commission further estimates Participants
would incur $2.7MM \680\ in annual ongoing costs to update exception
applications and the Plan Processor would incur $1.2MM in annual
ongoing costs to process those applications and monitor Excepted
Environments. Cost estimates are presented in Table 5 and discussed
below.
---------------------------------------------------------------------------

    \678\ The Commission preliminarily believes that Participant
Groups that operate multiple exchanges perform most regulatory
duties that would require CAT Data centrally. Consequently, the
Commission expects that application costs for multiple exchange
Participant Groups would not be substantially more complex than
those for a Participant Group that does not operate multiple
exchanges.
    \679\ ($1,289,600 + $2,250,000) = $3,539,600.
    \680\ ($417,400 + $2,250,000) = $2,667,400.

                       Table 5--Costs for Nine Participant Groups To Obtain Exceptions ($)
----------------------------------------------------------------------------------------------------------------
                                                                           Participants           Plan processor
                            Activity                             -----------------------------------------------
                                                                       Labor         External          Labor
----------------------------------------------------------------------------------------------------------------
Initial
    Third party security assessment.............................  ..............       2,250,000  ..............
    Prepare detailed design specification.......................         801,200  ..............
    Submit materials to CCO, CISO, SWG..........................          16,800  ..............  ..............
    Develop policies and procedures to review applications......  ..............  ..............          56,000
    Plan Processor review of exception application..............  ..............  ..............         825,800
    Plan Processor validation of Excepted Environment...........  ..............  ..............         167,000
    Implement Participant systems to enable monitoring..........         471,600  ..............  ..............
                                                                 -----------------------------------------------
        Total initial costs for nine Participant Groups.........       1,289,600       2,250,000       1,048,800
----------------------------------------------------------------------------------------------------------------
Annual
    Third party security assessment.............................  ..............       2,250,000  ..............
    Update application materials................................         400,600  ..............  ..............
    Submit materials to CCO, CISO, SWG..........................          16,800  ..............  ..............
    Maintain and update application review policies.............  ..............  ..............          31,700
    Plan Processor review of application........................  ..............  ..............         825,800
    Plan Processor monitoring of Excepted Environments..........  ..............  ..............         302,600
                                                                 -----------------------------------------------
        Total ongoing costs for nine Participant Groups.........         417,400       2,250,000       1,160,100
----------------------------------------------------------------------------------------------------------------

    The Commission estimates that each Participant Group would incur an
initial, one-time cost of approximately $250,000 \681\ in external
consulting costs to obtain the required security assessment from a
named and independent third party security assessor. Providing the
required detailed design specifications would result in an additional
$89,000 \682\ in labor costs. Submitting those materials to the CCO,
CISO, the members of the Security Working Group (and their designees),
and Commission observers of the Security Working Group would entail an
additional $1,900 \683\ in labor costs. Participants would face
additional costs to implement processes required by the detailed design
specifications that facilitate the Plan Processor's monitoring of
Excepted Environments. The Commission preliminarily estimates each
Participant Group seeking an exception would incur labor costs of
approximately $52,400 \684\ to implement those processes.
---------------------------------------------------------------------------

    \681\ See supra Part II.D.3.d.i. ($250,000 per group x 9 groups)
= $2,250,000.
    \682\ Labor costs include 200 hours by a senior systems analyst,
40 hours by a compliance attorney, 20 hours by the chief compliance
officer, and 10 hours by a director of compliance. (200 hours x
$291/hour + 40 hours x $374/hour + 20 hours x $543 + 10 hours x
$500) = $89,020. ($89,020 per group x 9 groups) = $801,180.
    \683\ Labor costs include 5 hours by a compliance attorney. (5
hours x $374/hour) = $1,870. ($1,870 per group x 9 groups) =
$16,830.
    \684\ The Commission preliminarily believes that development
costs for the processes that produce log files that support Plan
Processor monitoring would require similar development activities to
developing the automated monitoring processes themselves. See supra
note 510. ($52,400 per group x 9 groups) = $471,600.
---------------------------------------------------------------------------

    In order to maintain the SAW exception, the Commission
preliminarily believes that each Participant Group would incur costs of
$250,000 \685\ to obtain an updated security assessment. The Commission
preliminarily estimates that the costs associated with updating
application materials would be approximately $44,500,\686\ which is
half of the cost to initially prepare the materials to support the
exception application.\687\ The Commission further estimates that each
Participant Group would spend $1,900 \688\ in labor costs submitting
these materials to the CCO, the CISO, the members of the Security
Working Group (and their designees), and Commission observers of the
Security Working Group.
---------------------------------------------------------------------------

    \685\ See supra Part III.D.3.c.i.
    \686\ Costs for initial application materials are $89,020 to
prepare detailed design specifications. $44,510 is half of this
total. ($44,510 per group x 9 groups) = $400,590.
    \687\ See supra Part III.D.3.d.i.
    \688\ Labor costs include 5 hours by a compliance attorney. (5
hours x $374/hour) = $1,870. ($1,870 per group x 9 groups) =
$16,830.
---------------------------------------------------------------------------

    The Plan Processor would incur costs to develop policies and
procedures governing the review of applications for exceptions to the
SAW use requirement. The Commission preliminarily estimates that the
Plan Processor will incur labor costs of $56,000 \689\ to develop these
policies and procedures, and annual ongoing costs of $31,700 \690\ to
maintain and update these policies and procedures.
---------------------------------------------------------------------------

    \689\ See supra note 523.
    \690\ See supra note 524.
---------------------------------------------------------------------------

    The Plan Processor will incur costs to review exception
applications.\691\ Each initial exception application would cause the
Plan Processor to incur one-time labor costs of approximately
$91,760.\692\ Review of materials for continuation of exceptions would
cause the Plan Processor to incur the same review costs annually.
---------------------------------------------------------------------------

    \691\ See supra Part III.D.3.d.ii.
    \692\ See supra Part III.D.3.d.ii. The PRA estimates that the
Plan Processor would incur $91,760 in labor costs to review each
application. In this analysis, the Commission assumes all nine
Participant Groups would apply for exceptions. (9 Participant Groups
x $91,760 per application) = $825,840.
---------------------------------------------------------------------------

    The Plan Processor will incur costs to notify the Operating
Committee that each Excepted Environment is compliant with the detailed
design specifications that Participants provide as part of their
application materials for an exception.\693\ The Commission
preliminarily estimates that the Plan Processor will incur $18,550
\694\ in labor costs to evaluate each Excepted Environment and notify
the Operating Committee. Should the Plan Processor need to notify a
Participant Group of an identified non-compliance with the detailed
design specifications, additional costs would be incurred.\695\
---------------------------------------------------------------------------

    \693\ Id.
    \694\ See supra note 531. The PRA estimates that the Plan
Processor would incur $18,550 in labor costs to validate each
Excepted Environments. In this analysis, the Commission assumes all
nine Participant Groups would apply for exceptions. (9 Participant
Groups x $18,550 per validation) = $166,950.
    \695\ Id.
---------------------------------------------------------------------------

    The Plan Processor will incur costs to monitor the Excepted
Environments in accordance with the detailed design

specifications and notify the Participant of any identified non-
compliance. The Commission preliminarily estimates the Plan Processor
will incur annual ongoing costs of $302,600 \696\ to perform these
tasks.
---------------------------------------------------------------------------

    \696\ See supra note 534.
---------------------------------------------------------------------------

    The proposed amendments require that each Participant using a non-
SAW environment simultaneously notify the Plan Processor, the members
of the Security Working Group (and their designees), and Commission
observers of the Security Working Group of any material changes to its
security controls for the non-SAW environment. The Commission cannot
predict how many such changes would occur because the Commission does
not know how often each Participant Group would make changes to its
Excepted Environment that would necessitate material changes to its
security controls, but for each such instance, the Commission
preliminarily estimates the notifying Participant Group would incur
labor costs of approximately $5,200.\697\
---------------------------------------------------------------------------

    \697\ Labor costs include 10 hour of Senior Systems Analyst
labor, 3 hours by a compliance attorney, and 2 hours by the CISO.
For the CISO, hourly rate calculations use the hourly rate for a
Chief Compliance Officer. (10 hours x $291/hour + 3 hours x $374/
hour + 2 hours x $543/hour) = $5,118.
---------------------------------------------------------------------------

    The Commission recognizes that by providing an exception procedure
to the requirement that Participants employ the user-defined direct
query and bulk extract tools to access CAT Data within SAWs,
variability across environments from where CAT Data is accessed and
analyzed will necessarily increase. The amendments will provide for a
level of security in Excepted Environments that will be similar but not
identical to security within SAWs because Excepted Environments may
implement security controls, policies, and procedures differently than
SAWs. The Commission preliminarily believes the risk of individual
Excepted Environments being less secure than SAWs is mitigated by the
review process of applications for exceptions and Plan Processor
verification and monitoring steps required by the proposed amendments.
4. OTQT and Logging
    The CAT NMS Plan does not limit the amount of CAT Data a regulator
can extract or download through the online targeted query tool
(``OTQT''); the CAT NMS Plan only states that the Plan Processor must
define the maximum number of records that can be viewed in the OTQT as
well as the maximum number of records that can be downloaded.\698\
---------------------------------------------------------------------------

    \698\ See supra Part II.D.
---------------------------------------------------------------------------

    The proposed amendments would remove the ability of the Plan
Processor to define the maximum number of records that can be
downloaded via the OTQT, and instead limit the maximum number of
records that can be downloaded via the OTQT to no more than 200,000
records per query request.\699\ The Plan does not explicitly prevent
use of the OTQT to download significant quantities of CAT Data,
although the OTQT does not provide access to all fields in
transactional CAT Data that are available through the user defined
direct query tool, (``UDDQ''). Because the Plan does not currently
distinguish between what types of analytic environments (SAWs versus
Excepted Environments) may access particular tools (i.e., OTQT versus
UDDQ), this may not be a significant security distinction under the
Plan because downloading such data through the OTQT would be merely
less efficient than doing so with other data extraction tools if either
approach were available in a given analytic environment. However, with
the proposed amendments' provisions that restrict the use of the UDDQ
and bulk extract methods to Plan Processor provided SAWs and Excepted
Environments, some regulatory users may be incentivized to use a
succession of queries to download larger samples of CAT Data using the
OTQT to avoid the need to work within the SAWs or Excepted
Environments.
---------------------------------------------------------------------------

    \699\ See supra Part II.D.
---------------------------------------------------------------------------

    The Commission preliminarily believes that by limiting the number
of records of CAT Data that can be extracted from the OTQT, the
proposed amendments are likely to result in more regulatory analysis of
CAT Data being performed within the security perimeter established by
the CISP of the Plan Processor because regulatory activities that
require extraction of more than 200,000 records would need to be
performed using the UDDQ or by bulk extraction, activities that would
be limited to Plan Processer provided SAWs or Excepted Environments
under the proposed amendments. The Commission preliminarily believes
that this is likely to reduce the attack surface of CAT by reducing the
magnitude of CAT Data accessed outside of these potentially more secure
environments. The Commission recognizes, however, that limiting the use
of the OTQT to queries that extract fewer than 200,000 records may also
reduce regulatory use of CAT Data to the extent that a regulatory user
may not have the technical skills that would be required to use other
access methods.\700\
---------------------------------------------------------------------------

    \700\ The Commission preliminarily believes that access to CAT
Data through the UDDQ would require greater technical skills on the
part of the user such as knowledge of a structured query language
and an understanding of structured databases.
---------------------------------------------------------------------------

    The proposed amendments extend the information in log files that
the Participants are required under the Plan to submit to the Operating
Committee monthly, specifically, by defining the term ``delivery of
results'' and requiring the logging of access and extraction of CAT
Data.\701\ The Commission estimates that the Plan Processor will incur
one-time labor costs of $87,960 \702\ to make the initial necessary
programming and systems changes to log delivery of results of queries
of CAT Data and the access and extraction of CAT Data. In addition, the
Plan Processor would incur an annual ongoing expense of $5,100 \703\ to
generate and provide the additional information in monthly reports
required by the proposed amendments. The Commission preliminarily
estimates that the Participants would incur ongoing annual labor costs
of $970,200 \704\ for the Operating Committee to review the additional
information in the monthly reports. Further, the requirement that
limits the number of records that can be extracted through use of the
OTQT may make it impossible for some regulatory functions that are
required only situationally (such as ad hoc queries to investigate
trading by a single trader in all symbols or by multiple traders in a
single symbol) to be performed outside the SAW (or Excepted
Environments). This restriction may cause some Participants to
establish SAWs, obtain an exception, or extend their use of RSAs for
activities that are performed infrequently. This outcome may be more
costly to these Participants than working less efficiently through the
OTQT in ad hoc situations because it may be less costly to Participants
to use the OTQT inefficiently than to make these alternative
arrangements for only occasional use.
---------------------------------------------------------------------------

    \701\ See supra Part III.D.4.
    \702\ See supra Part III.D.4.
    \703\ See supra Part III.D.4.
    \704\ Cost estimate assumes each Participant would annually
incur 12 hours of Operating Committee Member labor and 108 hours of
Compliance Manager labor. (12 hours x $381/hour + 108 hours x $317/
hour) = $38,808 per Participant. Collectively, Participants would
incur ($38,808 per Participant x 25 Participants) = $970,200.
---------------------------------------------------------------------------

5. CAT Customer and Account Attributes
    As noted above, the Commission granted the Participants' PII
Exemption

Request to allow for an alternative approach to generating a Customer-
ID and to allow for an alternative approach which would exempt the
reporting of dates of birth and account numbers associated with retail
customers who are natural persons.\705\ This exemptive relief allows
the Participants to implement an alternative approach to generating
Customer-ID(s), subject to certain conditions set forth in the
exemptive relief, but does not bar the Participants from implementing
the Plan's original Customer-ID approach.
---------------------------------------------------------------------------

    \705\ See supra Part II.E.
---------------------------------------------------------------------------

    The baseline for customer and account information availability in
CAT assumes the implementation of the alternative approach described in
the PII Exemption Order and the creation of the CCID Subsystem. The
exemptive relief includes certain conditions that also are included in
the baseline for the proposed amendments.\706\ First, the exemptive
relief requires that the Participants ``ensure the timeliness,
accuracy, completeness, and integrity of interim value[s]'' in the CCID
Subsystem.\707\ Second, the Participants must assess the overall
performance and design of the CCID Alternative process and the CCID
Subsystem as part of each annual Regular Written Assessment of the Plan
Processor.
---------------------------------------------------------------------------

    \706\ See PII Exemption Order, supra note 164, at 16157.
    \707\ See id.
---------------------------------------------------------------------------

    The Commission proposes to amend the CAT NMS Plan to: (1) Delete
the Industry Member reporting of ITINs/SSNs, dates of birth and account
numbers for natural persons and require the reporting of year of birth;
(2) establish a process for creating Customer-ID(s); (3) impose
specific obligations on the Plan Processor that will support the
revised reporting requirements and creation of Customer-ID(s); and (4)
amend existing provisions of the CAT NMS Plan to reflect the new
reporting requirements and process for creating Customer-ID(s), as
further discussed below.\708\ These provisions reflect the PII
exemptive relief previously granted by the Commission.
---------------------------------------------------------------------------

    \708\ See supra Part II.E.
---------------------------------------------------------------------------

    The Commission preliminarily believes that the provisions of the
proposed amendments discussed in this section largely reflect exemptive
relief and current implementation specifications of the Participants,
with the exception of the requirement that customer addresses reported
to the CAIS have separate fields for street numbers and names. Because
the specifications are still in development, the Commission
preliminarily believes that the cost impact of this provision on
Participants is likely to be de minimis. The Commission further
preliminarily believes that CAT Reporters have not implemented an
alternative street address specification and the costs to CAT Reporters
to implement this change will be de minimis because the requirement
does not require additional information to be reported.
    The proposed amendments include provisions that by design, reduce
certain options for future development of the Plan. For example, the
Participants would not be able to decide at a later date to no longer
use their exemptive relief and instead change the CAT implementation to
conform to the Plan as it stands at that time. Although the Commission
believes that the Participants would be unlikely to take such an
approach in the future after incurring the costs to secure exemptive
relief and implement alternative approaches required by such relief, it
recognizes that the proposed amendments curtail that option to the
Participants.
6. Customer Identifying Systems Workflow
    The Commission is proposing to amend the CAT NMS Plan to define the
workflow for accessing Customer and Account Attributes, and to
establish access restrictions.\709\ Accordingly, the Commission
proposes to amend the CAT NMS Plan to (1) specify how existing data
security requirements apply to Customer and Account Attributes; (2)
define the Customer Identifying Systems Workflow and the General
Requirements for accessing Customer Identifying Systems; (3) establish
general requirements that must be met by Regulatory Staff before
accessing the Customer Identifying Systems, which access will be
divided between two types of access--manual access and programmatic
access; and (4) establish the specific requirements for each type of
access to the Customer Identifying Systems. Some of these provisions
would reflect the PII exemptive relief previously granted by the
Commission, making the alternative approach described in the PII
Exemption Order a requirement of the Plan. The Commission discusses
potential benefits of the proposed new provisions of the Plan relative
to the baseline below.
---------------------------------------------------------------------------

    \709\ See supra Part II.F.
---------------------------------------------------------------------------

    The proposed amendments would replace the term ``PII'' with
``Customer and Account Attributes'' and to reflect that Customer
Identifying Systems, including CAIS, now contain the information that
identifies a Customer; prohibit Customer and Account Attributes from
being included in the result sets to queries of transactional CAT Data;
and update requirements related to the PII access audit trail to
reflect the CAIS approach. These requirements mirror requirements for
access to customer information already contained in the Plan or the PII
Exemptive Order.\710\ The Commission preliminarily believes that these
provisions may avoid inefficiencies in implementation to the extent
that Participants might make investments in implementation activities
that do not reflect the approach to customer information and account
attributes outlined in the exemptive relief.
---------------------------------------------------------------------------

    \710\ See supra Part II.F.1.
---------------------------------------------------------------------------

    The proposed amendments include provisions that limit access to the
Customer Identifying Systems to two types of access--manual and
programmatic. The Commission preliminarily believes that this may
improve the security of CAT Data by limiting access to CAIS data to two
defined access methods. The Commission preliminarily believes that by
doing so the likelihood that customer information might be compromised
in a potential breach will be decreased. To the extent that a bad actor
would be limited in his or her ability to access customer information
in a manner other than these two access pathways, customer information
within the CAT System should be more secure.
    The proposed amendments include provisions that establish that
access to Customer Identifying Systems are subject to certain
restrictions, including requiring that authorization to use
Programmatic CAIS Access or Programmatic CCID Subsystem Access be
requested and approved by the Commission.\711\ The Commission
preliminarily believes that this authorization step may reduce the risk
of inappropriate use of customer and account information by ensuring
that programmatic access that can potentially return information about
a large group of customers is only granted when an appropriate
regulatory use exists. Further, the Commission preliminarily believes
this requirement may reduce the amount of CAT Data exposed to
regulators as they perform their duties because it may increase
regulatory use of manual as opposed to programmatic access to the CCID
Subsystem and CAIS when manual access is sufficient for a regulatory
purpose.
---------------------------------------------------------------------------

    \711\ See supra Part II.F.5.

---------------------------------------------------------------------------

    The proposed amendments would establish programmatic access as a
required element of the CAT NMS Plan.\712\ The provision of
programmatic access enables authorized Regulatory Staff to query the
CAIS and CCID Subsystems to access information on multiple customers or
accounts simultaneously.\713\ The Commission recognizes that allowing
programmatic access to CAIS and CCID data by authorized users
potentially will allow Regulatory Staff to be exposed to a greater
quantity of Customer and Account Attributes. To the extent that this
exposure provides more opportunities for this data to be used
inappropriately, this may reduce the confidentiality of CAIS and CCID
data. However, the Commission preliminarily believes the Commission
authorization step required before programmatic access can be exercised
mitigates this risk because the application review process requires
documentation establishing the regulatory purpose of the programmatic
access, and provides for an approval process based on such access being
generally consistent with specific standards that would justify such
access.\714\
---------------------------------------------------------------------------

    \712\ See supra Part II.
    \713\ See supra Part II.F.7.
    \714\ See supra Part II.F.6.
---------------------------------------------------------------------------

    The Commission preliminarily estimates that the Plan Processor will
incur labor costs of $620,200 \715\ to establish programmatic access to
the CCID Subsystem and CAIS.
---------------------------------------------------------------------------

    \715\ The estimates assumes 640 hours each of labor by a Senior
Database Administrator, a Senior Programmer and a Senior Business
Analyst. (640 hours x $349/hour + 640 hours x $339/hour + 640 hours
x $281/hour) = $620,160.
---------------------------------------------------------------------------

    Under the proposed amendments, Participants that require
programmatic access to the CAIS or CCID Subsystems would need to apply
for authorization from the Commission.\716\ The Commission cannot
estimate how many Participants would need to apply for authorization,
or how many applications might be required for each Participant that
would access these subsystems. The Commission preliminarily estimates
that each application for authorization would cause a Participant to
incur $19,100 \717\ in labor costs.
---------------------------------------------------------------------------

    \716\ Id.
    \717\ Labor cost estimate assumes 15 hours of attorney labor, 10
hours of compliance manager labor, 10 hours of operations specialist
labor and 15 hours by a chief compliance officer. (15 hours x $426/
hour + 10 hours x $317/hour + 10 hours x $140/hour + 15 hours x
$543/hour) = $19,105.
---------------------------------------------------------------------------

    The Commission preliminarily estimates that the requirements to
maintain and provide to Participants, the Commission, and the Operating
Committee monthly audit reports that track permissions for and access
to Customer Identifying Systems will result in an aggregate ongoing
annual cost to the Plan Processor of $373,500 \718\ per year.
---------------------------------------------------------------------------

    \718\ See supra note 552.
---------------------------------------------------------------------------

    In addition, the requirement that regulators obtain Commission
approval before exercising programmatic access to the CCID Subsystem or
the CAIS may reduce or delay regulatory use of the customer data
contained in these databases. The Commission recognizes that a possible
indirect cost of the proposed amendments is less overall regulatory use
of CAT Data. In the CAT NMS Plan Approval Order, the Commission
discussed certain benefits that were likely to result from CAT,
including benefits from analysis and reconstruction of market
events.\719\ To the extent that provisions of the proposed amendments
complicate access to CAT Data, prohibit its use for purposes that are
both regulatory and commercial, or make use of CAT Data more expensive
to regulators, fewer of these benefits may accrue to investors.
---------------------------------------------------------------------------

    \719\ See CAT NMS Plan Approval Order, supra note 3, at Part
V.E.2. For example, in the wake of a market event, a regulator might
perform an analysis of cross-market trading before the event. To the
extent that making such an analysis public is a commercial as well
as regulatory activity under the proposed amendments, fewer such
analyses are likely to be performed.
---------------------------------------------------------------------------

7. Participants' Data Confidentiality Policies
    To maintain CAT Data confidentiality, the Plan requires the
Participants to implement policies related to information barriers,
restricts access only to designated persons for regulatory purposes,
and imposes penalties for non-compliance to these requirements.\720\
The Plan currently requires each Participant to periodically review the
effectiveness of these policies and procedures, and that they take
prompt action to remedy deficiencies in such policies and procedures.
The Plan does not require the Participants to make their policies
related to data confidentiality publicly available. Although
Participants may disclose data confidentiality policies relating to
information collected from customers in the course of business, these
policies do not generally extend to policies and procedures in place to
deal with CAT Data.
---------------------------------------------------------------------------

    \720\ See supra Part II.G.
---------------------------------------------------------------------------

    As discussed below, the Commission is proposing amendments to
modify and supplement the Plan to provide additional specificity
concerning data usage and confidentiality policies and procedures and
to make the policies publicly available.\721\
---------------------------------------------------------------------------

    \721\ See id.
---------------------------------------------------------------------------

    The proposed amendments would modify the existing Plan provisions
designed to protect the confidentiality of CAT Data so that they apply
to the Proposed Confidentiality Policies, and Participant-specific
procedures and usage restriction controls.\722\ As a result of this
change, Participants would be required to report any instance of
noncompliance with the data confidentiality policies, procedures, and
usage restrictions adopted by such Participant to the Chief Compliance
Officer within 24 hours of becoming aware. While the Plan currently
requires reporting of a CAT security breach within 24 hours, it does
not require reporting instances of noncompliance with the Proposed
Confidentiality Policies or procedures and usage restriction controls
adopted by such Participant pursuant to Section 6.5(g)(i). The
Commission preliminarily believes that this requirement will improve
the security of CAT Data in two ways. First, bringing any instance of
noncompliance to the attention of the Chief Compliance Officer would
provide an opportunity for such a weakness to be addressed and reduce
the risk of future instances of noncompliance to the extent that an
instance of noncompliance may demonstrate a weakness in the Proposed
Confidentiality Policies, procedures, or usage restrictions, and such a
weakness can then be addressed when it would not have otherwise been.
Second, the Commission preliminarily believes that the notification
requirement may elevate the profile of the Proposed Confidentiality
Policies among the Participants because an instance of noncompliance
could not be handled through solely internal channels, instead
triggering review by the Chief Compliance Officer. This may incentivize
the Participants to more effectively implement these policies to avoid
instances of noncompliance.
---------------------------------------------------------------------------

    \722\ See supra Part II.G.1.
---------------------------------------------------------------------------

    The proposed amendments would require the Proposed Confidentiality
Policies to be identical across Participants. While the proposed
amendments allow for each Participant to establish its own procedures
and usage restrictions to operationalize these policies, accommodating
the Participants' organizational, technical and structural uniqueness,
the overarching policies would be centrally established and common
across Participants. The Commission preliminarily believes that having
common data confidentiality policies

across Participants may avoid unnecessary variation across Participants
in how they meet the data confidentiality requirements of the Plan.
However, the Commission recognizes it is also possible that the
Participants could adopt relatively weak central policies that would
ultimately reduce the security of CAT Data. The Commission
preliminarily believes this outcome is unlikely because central
development of these policies allows the Participants to access their
collective expertise in creation of these policies. The Commission
recognizes that in situations where policies are centrally developed,
it is possible that an individual Participant might have developed
stronger policies and procedures in the absence of the proposed
amendments. However, the Commission believes this potential outcome is
mitigated by the fact that having multiple Participants involved in the
development of these policies is likely to result in more robust
policies because more expertise can be incorporated into their
development.
    The proposed amendments would define ``Regulatory Staff'' and limit
access to CAT Data to persons designated by Participants, which persons
must be Regulatory Staff or technology and operations staff that
require access solely to facilitate access to and usage of CAT Data
stored in the Central Repository by Regulatory Staff.\723\ Currently,
the CAT NMS Plan has numerous references to ``regulatory staff,'' and
outlines benefits and limitations on such regulatory staff, including
the ability to access all CAT Data, but does not define the term or
provide any guidance or limitations on how Participants may identify
``regulatory staff.'' \724\ The Commission preliminarily believes that
defining Regulatory Staff may improve the confidentiality of CAT Data
by preventing expansive interpretations of this term (such as
classifying staff members that have primarily business functions as
Regulatory Staff) that could result in non-Regulatory Staff of
Participants having exposure to CAT Data that might be used
inappropriately.
---------------------------------------------------------------------------

    \723\ See supra Part II.G.2.
    \724\ See, e.g., CAT NMS Plan, supra note 3, at Section
6.5(f)(ii) and Appendix D, Sections 6.1, 6.2, 8.1.
---------------------------------------------------------------------------

    The proposed amendments would require that the Proposed
Confidentiality Policies limit non-Regulatory Staff access to CAT Data
to circumstances in which there is a specific regulatory need for such
access and a Participant's Chief Regulatory Officer (or similarly
designated head(s) of regulation), or designee, provides written
approval for each instance of access by non-Regulatory Staff. The Plan
has no provision that bars non-Regulatory Staff from accessing CAT
Data, though it does limit the use of CAT Data to only regulatory or
surveillance purposes. The Commission preliminarily believes that the
proposed amendments would further limit the number of individuals that
have access to CAT Data by barring access to non-Regulatory Staff
members (subject to proposed exceptions) and that limiting the number
of individuals that have access to CAT Data reduces the risk that it
would ultimately be used inappropriately because fewer people would
have the opportunity to engage in an inappropriate use. However, while
the requirement that non-Regulatory Staff not have access to CAT Data
may reduce the risk of CAT Data being used inappropriately, the
Commission also recognizes that this restriction may slow a
Participant's ability to respond to urgent situations such as a market
event. A provision to allow a Participant's Chief Regulatory Officer to
allow such access may mitigate inefficiencies such as a slowed response
to a market event that could result from an absolute prohibition of
staff other than Regulatory Staff accessing CAT Data. For example, in
the case of a market event, a Participant's analysis of events may need
access to expert staff in operations or business functions of the
Participant, and the need for rapid analysis of CAT Data may warrant
such an exception to further this regulatory purpose. The Commission
recognizes that providing this access to staff other than Regulatory
Staff may increase the risk that CAT Data would be used inappropriately
because additional Participant Staff would necessarily be exposed to
CAT Data in such a case. However, the Commission preliminarily believes
this risk is mitigated by the requirement that the Participant's Chief
Regulatory Officer (or similarly designated head(s) of regulation)
provide written permission for such access because it is likely to
limit its use to exceptional situations because ensuring the
confidentiality of CAT Data is among the Chief Regulatory Officer's (or
similarly designated head(s) of regulation's) primary responsibilities
and because the CAT NMS Plan requires CAT Data only to be accessed for
surveillance or regulatory purposes. Furthermore, establishing
documentation of such instances will facilitate the Plan Processor's
and independent accountant's \725\ review of the Participant's
compliance with the Proposed Confidentiality Policies. This may further
limit the use of and any additional risk posed by this provision only
to exceptional circumstances because such use is likely to be reviewed
by the independent auditor.
---------------------------------------------------------------------------

    \725\ The role of independent accountants in reviewing
Participants' compliance is discussed further below.
---------------------------------------------------------------------------

    The proposed amendments would limit the extraction of CAT Data to
the minimum amount necessary to achieve specific surveillance or
regulatory purposes.\726\ The Commission preliminarily believes that
this provision may improve CAT Data security by reducing the attack
surface of CAT because extracted data would reside outside of the scope
of the CAT security provisions and would be beyond the Plan Processor's
security monitoring scope.
---------------------------------------------------------------------------

    \726\ See supra Part II.G.3.a.
---------------------------------------------------------------------------

    The proposed amendments would require the Proposed Confidentiality
Policies to define the individual roles and regulatory activities of
specific users, including those users requiring access to Customer and
Account Attributes, of the CAT.\727\ The Commission preliminarily
believes that this provision may improve the security of CAT Data by
allowing the Participants to identify regulatory users whose roles do
not regularly require access to more sensitive information stored in
the CCID Subsystem and CAIS and restrict that access. To the extent
that fewer users have access to this more sensitive data, the risk of
inappropriate use of customer information may be reduced.
---------------------------------------------------------------------------

    \727\ See supra Part II.G.3.b.
---------------------------------------------------------------------------

    The proposed amendments require that Participants incorporate
policies relating to the access of Customer and Account Attributes,
Programmatic CAIS Access, and Programmatic CCID Subsystem Access in the
Proposed Confidentiality Policies.\728\ This requirement would result
in the adoption of a common policy for access to Customer and Account
Attributes across Participants. The Commission preliminarily believes
that this may improve security of CAT Data by reducing variation among
policies across Participants.\729\ The proposed amendments also require
that the Proposed Confidentiality Policies be reasonably designed to
implement and satisfy the Customer and Account Attributes data
requirements of Section 4.1.6 of Appendix D such that Participants must
be able to demonstrate

that a Participant's ongoing use of Programmatic CAIS and/or CCID
Subsystem access is in accordance with the Customer Identifying Systems
Workflow.\730\
---------------------------------------------------------------------------

    \728\ See supra Part II.G.3.c.
    \729\ See supra note 640.
    \730\ See supra Part II.F.7 and Part II.F.8.
---------------------------------------------------------------------------

    The proposed amendments would require that each Participant shall
engage an independent accountant annually to perform an examination of
compliance with the policies required by the Proposed Confidentiality
Policies.\731\ The Commission preliminarily believes that this
provision may improve the security of CAT Data by facilitating external
review of the Participants' compliance with the Proposed
Confidentiality Policies by an independent third party. To the extent
that this independent third party identifies deficiencies in the
Participants' compliance with the Proposed Confidentiality Policies
that would not otherwise be identified and the identification of such
deficiencies leads to remediation that makes such deficiencies less
likely to recur, the Commission preliminarily believes these provisions
may improve CAT Data security.
---------------------------------------------------------------------------

    \731\ See supra Part II.G.4.
---------------------------------------------------------------------------

    The Commission preliminarily believes that provisions of the
proposed amendments discussed in this section would entail one-time
costs of $1.2MM,\732\ and ongoing annual costs of $1.9MM.\733\ These
costs are summarized in Table 6 and discussed further below.
---------------------------------------------------------------------------

    \732\ ($1,115,900 + $50,000 + $10,900) = $1,216,800.
    \733\ ($480,600 + $1,442,500 + $5,400) = $1,928,500.

                            Table 6--Summary of Costs for Policies and Procedures ($)
----------------------------------------------------------------------------------------------------------------
                                                           Participants                   Plan processor
                    Activity                     ---------------------------------------------------------------
                                                       Labor         External          Labor         External
----------------------------------------------------------------------------------------------------------------
Initial
    Develop central Proposed Confidentiality             254,900          50,000  ..............  ..............
     Policies...................................
    Review and approve Proposed Confidentiality   ..............  ..............          10,900  ..............
     Policies...................................
    Develop procedures to implement the PCP.....         901,000  ..............  ..............  ..............
                                                 ---------------------------------------------------------------
        Total...................................       1,155,900          50,000          10,900  ..............
----------------------------------------------------------------------------------------------------------------
Annual
    Review Proposed Confidentiality Policies and          51,000           5,000  ..............  ..............
     remediate..................................
    Review and approve Proposed Confidentiality   ..............  ..............           5,400  ..............
     Policies...................................
    Maintain and remediate procedures...........         289,700  ..............  ..............  ..............
    Annual third party audit....................         139,900       1,437,500  ..............  ..............
                                                 ---------------------------------------------------------------
        Total...................................         480,600       1,442,500           5,400  ..............
----------------------------------------------------------------------------------------------------------------

    The proposed amendments would require that the Participants jointly
develop the Proposed Confidentiality Policies. The Commission
preliminarily estimates the Participants will incur labor costs of
$254,900 \734\ to develop these policies.\735\
---------------------------------------------------------------------------

    \734\ Labor cost estimate assumes 150 hours by Chief Regulatory
Officers, 150 hours by Chief Compliance Officers, 100 hours by
Compliance Managers, 50 hours by Compliance Attorneys, 20 hours by
Sr. Operations Managers and 10 hours by Deputy General Counsels. An
additional 20 hours would be required for Operating Committee
members to review and approve the policies. Labor costs for
Operating Committee members assume an hourly rate for a Vice
President of Operations. Hourly rate estimated by using the median
annual salary from www.payscale.com, multiplying by 5.35 to account
for other compensation, benefits and overhead and adjusting for 1800
hours of labor per year. (($128,159 x 5.35/1800 = $381/hour). The
Commission estimates the hourly rate of a Chief Regulatory Officer
as 125% of the rate of a Chief Compliance Officer, or $543/hour x
1.25 = $679/hour. (150 hours x $679/hour + 150 hours x $543/hour +
100 hours x $317/hour + 50 hours x $374/hour + 20 x $374/hour + 10
hours x $612/hour + 20 hours x $381/hour) = $254,920.
    \735\ See supra Part III.D.7.
---------------------------------------------------------------------------

    The Commission preliminarily estimates that it would require 10
hours by the CCO and 10 hours by the CISO, both employees of the Plan
Processor, to review the Proposed Confidentiality Policies. The
Commission preliminarily estimates that this would result in the Plan
Processor incurring $10,900 \736\ in labor costs.\737\ The Commission
also preliminarily believes that the Participants will consult with
outside legal counsel in the drafting of the Proposed Confidentiality
Policies, and estimates this external cost to be $50,000.\738\
---------------------------------------------------------------------------

    \736\ Labor cost estimate assumes 10 hours of CCO labor and 10
hours of CISO labor. (10 hours x $543/hour + 10 x $543/hour) =
$10,860.
    \737\ See supra Part III.D.7.
    \738\ Id.
---------------------------------------------------------------------------

    The proposed amendments would require the Participants to jointly
review the effectiveness of the Proposed Confidentiality Policies
annually and take prompt action to remedy deficiencies in such
policies.\739\ The Commission preliminarily estimates that this review
would require approximately 20% of the labor of the initial effort to
jointly draft those policies because presumably many of the policies
would not need revision annually. Consequently, the Commission
preliminarily estimates that the Participants would annually incur
$51,000 \740\ in labor costs and outside legal costs of $5,000 \741\ to
complete these tasks. In addition, the Commission preliminarily
estimates the Plan Processor would incur annual labor costs of $5,400
\742\ to review updates to the Proposed Confidentiality Policies.\743\
---------------------------------------------------------------------------

    \739\ Id.
    \740\ $254,900 x 20% = $50,980.
    \741\ See supra Part III.D.7.
    \742\ See supra Part III.D.7. The Commission assumes review of
the Proposed Confidentiality Policies would require half the labor
of initial review of the policies. See supra note 736. $10,860 x 50%
= $5,430.
    \743\ See supra Part III.D.7. The Commission is assuming that
such updates would occur annually. If updates were more frequent,
costs would be proportionately higher.
---------------------------------------------------------------------------

    After the Participants jointly develop the Proposed Confidentiality
Procedures, each Participant would incur costs to develop procedures
and usage restriction controls to implement those policies. The
Commission preliminarily believes that Participants will perform this
task at the Participant Group level of organization: For example, a
Participant Group that controls four exchanges will centrally develop
those policies and then individualize them as necessary across its
exchanges.

The Commission preliminarily estimates that the Participants
collectively would incur labor costs of $901,000 \744\ to initially
develop and draft the procedures and usage restriction controls. The
Commission preliminarily estimates that the ongoing annual labor cost
to Participants of maintaining and reviewing the procedures and usage
restriction controls and taking prompt action to remedy deficiencies in
such policies, procedures and usage restriction controls would be
approximately $289,700.\745\
---------------------------------------------------------------------------

    \744\ See supra note 568. Labor cost estimate includes 96 hours
by an Attorney, 96 hours by a Compliance Manager, 30 hours by a
Senior Systems Analyst, 30 hours by an Operations Specialist, 20
hours by a Chief Compliance Officer and 10 hours by a Director of
Compliance. (96 hours x $426/hour + 96 hours x $317/hour + 30 hours
x $291/hour + 30 hours x $140/hour + 20 hours x $543/hour + 10 hours
x $500/hour) = $100,118. ($100,118 per group x 9 groups) = $901,062.
    \745\ See supra note 569. Labor cost estimate includes 28 hours
by an Attorney, 28 hours by a Compliance Manager, 8 hours by a
Senior Systems analyst, 8 hours by an Operations Specialist, 10
hours by a Chief Compliance Officer and 5 hours by a Director of
Compliance. (28 hours x $426/hour + 28 hours x $317/hour + 8 hours x
$291/hour + 8 hours x $140/hour + 10 hours x $543/hour + 5 hours x
$500/hour) = $32,182. ($32,182 x 9) = $289,638.
---------------------------------------------------------------------------

    The proposed amendments would require each Participant to engage an
independent accounting firm annually to perform an examination of
compliance with the policies required by Section 6.5(g)(i) and submit
the examination report to the Commission.\746\ The Commission
preliminarily estimates that each Participant would incur labor costs
of $5,600 \747\ to satisfy this requirement, as well as $57,500 \748\
in external consulting costs.
---------------------------------------------------------------------------

    \746\ See supra Part III.D.7. It is possible that Participants
may realize economies of scale by engaging for this review at the
Participant Group level. However, because the third party audit is
required for each Participant regardless of Participant Group
membership, the Commission preliminarily believes that it is
appropriate to estimate this expense at the Participant level
because efficiencies in third-party reviews is not under the
Participants' direct control.
    \747\ Labor cost estimate assumes 3 hours of Chief Compliance
Officer labor, 5 hours of Compliance Manager labor, 3 hours of
Compliance Attorney labor, 2 hours of Senior Systems Analyst labor,
and 2 hours of Senior Programmer labor. (3 hours x $543/hour + 5
hours x $317/hour + 3 hours x $374/hour + 2 hours x $291/hour + 2
hours x $339/hour) = $5,596. ($5,596 per Participant x 25
Participants) = $139,900.
    \748\ See supra note 574. ($57,500 per Participant x 25
Participants) = $1,437,500.
---------------------------------------------------------------------------

8. Regulator & Plan Processor Access
    The Plan does not specify any restrictions on data sources used in
the development of CAT systems, tools and applications. Currently, Plan
Processor staff and contractors are not prohibited from using any CAT
Data during development and testing activities.
    The proposed amendments would restrict such development and testing
activities to non-production data in all cases for CAIS data. Further,
they would restrict such development activities to non-production data
for transactional data, unless it were not possible to do so. In such a
case, development work could access the oldest available production
data. The Commission preliminarily believes that these provisions may
improve the confidentiality of CAT Data by preventing Plan Processor
employees and contractors having exposure to CAT Data that might be
used inappropriately.
    The Commission preliminarily believes that test transactional data
has already been prepared and used in the implementation of CAT
reporting. However, the Plan Processor may need to prepare test data to
be used in development work for systems, tools and applications that
would access the CAIS. The Commission preliminarily estimates that the
Plan Processor will incur costs of $10,270 \749\ to create this data
and make it available to Plan Processor staff and contractors
performing this development and testing work.
---------------------------------------------------------------------------

    \749\ Estimate assumes 20 hours of Senior Programmer labor and
10 hours of Senior Database Administrator labor. (20 hours x $339/
hour + 10 hours x $349/hour) = $10,270.
---------------------------------------------------------------------------

    The Commission preliminarily believes that provisions of the
proposed amendments that prohibit any use of CAT Data that has both
regulatory and other uses may reduce Participants' use of CAT Data.
While the Plan already prohibits commercial use of CAT Data, it does
not specifically prohibit a regulatory use that also serves a non-
regulatory purpose. This proposed amendment may prevent some
Participants from using CAT Data in a rule filing that might lead the
Commission to approve or disapprove a filing that could reduce trading
costs to some investors. The Commission preliminarily believes that it
is unlikely that such a rule filing would be approved or disapproved
due to the Participants' inability to support their rule filings with
CAT Data because Participants retain the ability to analyze their own
in-house data in support of their rule filings, and to provide both
quantitative arguments based on that in-house data as well as
qualitative arguments that support those rule filings.
9. Secure Connectivity
    The Plan allows CAT Data reporters and users to connect over
private lines or secured public lines.\750\ There is no specific
requirement that any reporters use private lines and connectivity
requirements do not differentiate between Participants and Industry
Members in this regard.\751\ Since approval of the Plan, the
Participants have determined that they will connect to the CAT
infrastructure using only private lines. However, the Commission
recognizes that no language in the Plan requires that Participants will
use only private lines in the future.
---------------------------------------------------------------------------

    \750\ See supra Part II.I.
    \751\ The distinction between Industry Members and Participants
may be significant because while Participants are reporters of CAT
Data, they are also users of CAT Data in their regulatory roles and
thus have the ability to access and extract CAT Data. Industry
Members are not potential users of CAT Data.
---------------------------------------------------------------------------

    The Plan Processor requires two-factor authentication for
connection to CAT. Authentication incorporates a geolocation blacklist
including 16 countries.\752\
---------------------------------------------------------------------------

    \752\ See FINRA CAT Industry Member Onboarding Guide at https://www.catnmsplan.com/sites/default/files/2020-02/FINRA-CAT-Onboarding-Guide-v1.5.pdf, item 7, page 19.
---------------------------------------------------------------------------

    Currently, the CAT NMS Plan imposes requirements on data centers
housing CAT Systems (whether public or private), but does not impose
any geographical restrictions or guidelines. The Commission believes
that all current CAT Data centers are located in the United States.
    The proposed amendments would require Participants to connect to
CAT infrastructure using private lines, and Industry Members to connect
to CAT using secure methods such as private lines for machine-to-
machine interfaces or encrypted Virtual Private Network connections
over public lines for manual web-based submissions.\753\ The proposed
amendments would also require the Plan Processor to implement
capabilities to restrict access through an ``allow list'' that would
only allow access to CAT from countries where CAT reporting or
regulatory use is both necessary and expected.\754\ In addition, the
proposed amendments would require that CAT Data centers be located in
the United States.\755\
---------------------------------------------------------------------------

    \753\ See supra Part II.I.
    \754\ An ``allow list'' could be based on geography, server or
IP. This is discussed further below.
    \755\ See supra Part II.I.
---------------------------------------------------------------------------

    The Commission preliminarily believes these provisions of the
proposed amendments will improve the security of CAT Data in two ways.
First, although all Participants currently plan to connect to CAT using
private lines,

codifying this decision reduces the risk that, at a later date, one or
more Participants might elect to connect with CAT in a less secure
manner than with private lines, as they currently plan to connect to
CAT. Furthermore, the Commission preliminarily believes that because
Participants are not only reporters, but also users of CAT Data in
their regulatory roles, ensuring that they connect to CAT in the most
secure manner may further safeguard CAT Data by making the normal
access mode for CAT Data be through private lines.\756\ The Commission
recognizes that this restriction may also prevent the Participants from
electing to connect to CAT through a more secure method developed in
the future that does not rely upon private lines. The Commission
preliminarily believes this concern is mitigated by the Participants'
ability to amend the Plan at a later date to allow such an access
method.
---------------------------------------------------------------------------

    \756\ The Commission preliminarily believes that use of the
Online Targeted Query Tool through encrypted connections over public
lines may still occur, but because of the 200,000 row limit to OTQT
queries, it would be more difficult for a bad actor that gained
access through a public line to access CAT Data if the Plan
Processor is able to make other tools only available to users
connecting through private lines. To the extent that the Plan
Processor does not restrict access to other tools to users not
connecting through public lines, this potential benefit would not be
realized.
---------------------------------------------------------------------------

    Second, the Commission preliminarily believes that the requirement
to establish ``allow listing'' procedures to allow connections to CAT
only to those countries where CAT reporting or regulatory use is both
necessary and expected might reduce the risk of a security breach by
limiting connections from other sources.
    The Commission preliminarily estimates that provisions of the
proposed amendments concerning secure connectivity will cause the Plan
Processor to incur initial one-time labor costs of $33,100 \757\ and
ongoing annual labor costs of $3,100.\758\
---------------------------------------------------------------------------

    \757\ ($13,700 + $19,400) = $33,100.
    \758\ ($1,200 + $1,900) = $3,100.
---------------------------------------------------------------------------

    The Commission preliminarily estimates that requiring the Plan
Processor to develop ``allow listing'' capability will cause the Plan
Processor to incur initial one-time implementation labor costs of
$13,700.\759\ Maintaining this list will cause the Plan Processor to
incur $1,200 \760\ in ongoing annual costs. In addition, the Plan
Processor is estimated to incur $19,400 \761\ in one-time labor costs
to implement procedures to allow access to CAT if the source location
for a particular instance of access request cannot be determined
technologically. The Commission estimates that the Plan Processor will
incur $1,900 \762\ in annual ongoing costs to maintain and enforce this
restriction.
---------------------------------------------------------------------------

    \759\ See supra note 577.
    \760\ See supra note 579.
    \761\ See supra note 581.
    \762\ See supra note 583.
---------------------------------------------------------------------------

    The Commission recognizes that the requirement that CAT data
centers be located in the United States may prevent the Plan Processor
from locating CAT data centers in other areas that might reduce the
costs associated with maintaining CAT data centers. This could cause
future costs of CAT to be higher than they might be otherwise.\763\
---------------------------------------------------------------------------

    \763\ See supra Part II.I for policy discussion of this
requirement.
---------------------------------------------------------------------------

10. Breach Management Policies and Procedures
    The Plan includes a requirement for reporting noncompliance
incidents and security breaches to the Chief Compliance Officer.\764\
The Plan also requires the Plan Processor to develop policies and
procedures governing its responses to systems or data breaches,
including a formal cyber incident response plan, and documentation of
all information relevant to breaches.\765\ CAT LLC has stated that in
the event of unauthorized access to CAT Data that it will ``. . .take
all reasonable steps to investigate the incident, mitigate potential
harm from the unauthorized access and protect the integrity of the CAT
System. CAT LLC also will report unauthorized access to law
enforcement, the SEC and other authorities as required or as it deems
appropriate. CAT LLC will notify other parties of unauthorized access
to CAT Data where required by law and as it otherwise deems
appropriate. CAT LLC will maintain insurance that is required by law.''
\766\
---------------------------------------------------------------------------

    \764\ See supra Part II.J.
    \765\ See supra Part II.J.
    \766\ See CAT NMS Plan website frequently asked questions,
``What happens if there is unauthorized access to CAT Data?'' #S.11
at https://www.catnmsplan.com/faq.
---------------------------------------------------------------------------

    The proposed amendments would require the formal cyber incident
response plan to incorporate corrective actions and breach
notifications, modeled after similar provisions in Regulation SCI.\767\
Because of the lack of specificity in requirements for the cyber
incident response in the Plan, it is possible that Participants might
satisfy the existing provisions without providing for breach
notifications to affected CAT Reporters, the Participants and the
Commission, and prompt remediation of security threats. While the
Commission believes it is unlikely the Participants would leave a
security threat unaddressed, it also preliminarily believes that
requiring procedures to be in place to deal with an incident ahead of
time facilitates a quicker response should such an incident occur
because procedures can specify who is to be involved in the response
and in what capacity, and where authority lies in making the response.
---------------------------------------------------------------------------

    \767\ See supra Part II.J.
---------------------------------------------------------------------------

    The proposed amendments would require the formal cyber incident
response plan to include taking appropriate corrective action that
includes, at a minimum, mitigating potential harm to investors and
market integrity, and devoting adequate resources to remedy the systems
or data breach as soon as reasonably practicable. While the Commission
preliminarily believes that the Participants are likely to take
corrective action in the wake of a security breach without this
explicit provision in the Plan, to the extent that this provision
hastens the Participants' corrective action in the wake of a cyber
incident, this provision may improve the security of CAT Data by
reducing potential harm to investors and market integrity that may
accrue if such a response were delayed.
    In addition, the proposed amendments would require the Plan
Processor to provide breach notifications of systems or data breaches
to CAT Reporters that it reasonably estimates may have been affected,
as well as to the Participants and the Commission, promptly after any
responsible Plan Processor personnel have a reasonable basis to
conclude that a systems or data breach has occurred. In addition, the
proposed amendments state that the cyber incident response plan must
provide for breach notifications. The Commission preliminarily believes
that breach notifications in the wake of a cyber incident may reduce
harm to CAT reporters and investors whose data was exposed through a
cyber incident. While the proposed amendments allow for delay in breach
notification when such notification could expose environments from
which CAT Data is accessed and analyzed to greater security risks, or
compromise an investigation into the breach, the proposal would require
the affirmative documentation of the reasons for the Plan Processor's
determination to temporarily delay a breach notification, which is
important to prevent the Plan Processor from improperly invoking this
exception.
    The proposed amendments would provide an exception to the
requirement for breach notifications for systems or data breaches
``that the Plan Processor reasonably estimates would have no or

a de minimis impact on the Plan Processor's operations or on market
participants.'' The Commission preliminarily believes that the
exception to the breach notification requirement may help to focus the
Plan Processor's resources on security issues with more significant
impacts. Importantly, even for a breach that the Plan Processor
believes to be a de minimis breach, the Plan Processor would be
required to document all information relevant to such a breach. This
would increase the likelihood that the Plan Processor has all the
information necessary should its initial determination that a breach is
de minimis prove to be incorrect, so that it could promptly provide
breach notifications as required. In addition, maintaining
documentation for all breaches, including de minimis breaches, would be
helpful in identifying patterns among systems or data breaches. While
the Commission preliminarily believes that these limitations on the
breach notification requirement may slightly limit the benefits of
breach notification in the wake of a breach, it preliminarily believes
these modifications may reduce the potential impact of a breach in the
case of the delay notification provision because it would facilitate
accurate later notification if deemed necessary.
    The Commission preliminarily believes that requiring breach
management policies and procedures and the cyber incident response plan
to incorporate new elements required by the proposed amendments would
result in a one-time labor cost of $49,800 \768\ for the Plan
Processor.\769\ Further, the Commission estimates that the Plan
Processor will incur an ongoing labor cost of $42,200 \770\ to
maintain, update and enforce these policies and procedures and the
cyber incident response plan. The Commission believes that the
Participants would incur initial labor costs of $9,500 \771\ for review
and approval of the updated cyber incident response plan by the
Operating Committee.\772\
---------------------------------------------------------------------------

    \768\ See supra note 585.
    \769\ See supra Part III.D.9.
    \770\ See supra note 588.
    \771\ Labor costs include one hour per Participant of Vice
President of Operations labor. Hourly rate estimated by using the
median annual salary from www.payscale.com, multiply by 5.35 to
account for other compensation, benefits and overhead and adjusting
for 1800 hours of labor per year. (($128,159 x 5.35/1800 = $381/
hour). (25 hours x $381/hour) = $9,525.
    \772\ Id.
---------------------------------------------------------------------------

11. Firm Designated ID and Allocation Reports
    Prior to approval of the CAT NMS Plan, the Commission granted
exemptive relief related to allocations of orders, which relieved the
Participants from the requirement to link allocations to orders and
allowed the usage of ``Allocation Reports.'' \773\ This exemptive
relief is conditioned on, among other things, the Central Repository
having the ability to use information provided in Allocation Reports to
link the subaccount holder to those with authority to trade on behalf
of the account. However, the CAT NMS Plan as approved does not
currently explicitly require Customer and Account Attributes be
reported for Firm Designated IDs that are submitted in Allocation
Reports, as it does for Firm Designed IDs that are submitted in
connection with the original receipt or origination of an order.\774\
---------------------------------------------------------------------------

    \773\ See supra Part II.K.
    \774\ See CAT NMS Plan, supra note 3, at Section 6.5(d)(ii)(C).
However while the CAT NMS Plan does require such information for
Firm Designated IDs that are submitted in Allocation Reports, it is
required in a separate provision, Section 6.5(d)(iv). See supra Part
II.K.
---------------------------------------------------------------------------

    The proposed amendments would require that Customer and Account
Attributes must be reported for Firm Designated IDs submitted in
connection with Allocation Reports, and not just for Firm Designated
IDs submitted in connection with the original receipt or origination of
an order.\775\ The Commission preliminarily believes that these
provisions of the proposed amendments are unlikely to have significant
economic benefits and costs because implementation of the exemptive
relief is already underway and thus its benefits and costs are included
in the baseline.
---------------------------------------------------------------------------

    \775\ See supra Part II.K.
---------------------------------------------------------------------------

B. Impact on Efficiency, Competition, and Capital Formation

    The Commission preliminarily believes that the proposed amendments
are likely to have effects on efficiency and competition, with minimal
if any effects on capital formation. The Commission anticipates
moderate mixed effects on efficiency due to negative effects on the
efficiency with which Participants perform their regulatory tasks but
positive effects on the efficiency by which the CAT NMS Plan is
implemented by Participants by standardizing policies and procedures
across Participants and improving efficiencies in how Participants
perform some regulatory activities. The Commission preliminarily
believes that the proposed amendments will have minor mixed effects on
competition. In the case of the market for regulatory services, the
Commission preliminarily believes that competition may increase due to
additional Participants seeking out RSAs if the amendments are adopted.
In the case of the market to serve as Plan Processor, the Commission
preliminarily believes the proposed amendments may serve to increase
the switching costs Participants would face in replacing the Plan
Processor, thus reducing competition in this market. The Commission
preliminarily believes that the proposed amendments would not
significantly affect capital formation.
1. Baseline for Efficiency, Competition and Capital Formation in the
Market for Regulatory Services
    There are currently nine Participant Groups.\776\ The 24 national
securities exchanges are each Plan Participants. The exchanges are
currently controlled by eight separate entities and thus comprise eight
Participant Groups; four of these operate a single exchange.\777\ The
sole national securities association, FINRA, is also a CAT NMS Plan
Participant and comprises its own Participant Group.
---------------------------------------------------------------------------

    \776\ See supra note 611.
    \777\ Cboe Global Markets, Inc. controls BYX, BZX, C2, EDGA,
EDGX, and Cboe; Miami Internal Holdings, Inc. controls Miami
International, MIAX Emerald, and MIAX PEARL; Nasdaq, Inc. controls
BX, GEMX, ISE, MRX, PHLX, and Nasdaq; Intercontinental Exchange,
Inc. controls NYSE, Arca, American, Chicago, and National. The four
entities that control a single-exchange are IEX Group which controls
IEX, a consortium of broker-dealers which controls BOX, Long Term
Stock Exchange, Inc. which controls LTSE, and MEMX Holdings LLC,
which controls MEMX LLC.
---------------------------------------------------------------------------

    Participants compete in the market for regulatory services. These
services include conducting market surveillance, cross-market
surveillance, oversight, compliance, investigation, and enforcement, as
well as the registration, testing, and examination of broker-dealers.
Although the Commission oversees exchange Participants' supervision of
trading on their respective venues, the responsibility for direct
supervision of trading on an exchange resides in the Participant that
operates the exchange. Currently, Participants compete to provide
regulatory services in at least two ways.
    First, because Participants are responsible for regulating trading
within venues they operate, their regulatory services are bundled with
their operation of the venue. Consequently, for a broker-dealer,
selecting a trading venue also entails the selection of a provider of
regulatory services surrounding the trading activity.
    Second, Participants could provide this supervision not only for
their own venues, but for other Participants' venues as well through
the use of RSAs

or a plan approved pursuant to Rule 17d-2 under the Exchange Act.
    Consequently, Participants compete to provide regulatory services
to venues they do not operate. Because providing trading supervision is
characterized by high fixed costs (such as significant IT
infrastructure and specialized personnel), some Participants could find
that another Participant could provide some regulatory services more
efficiently or at a lower cost than they would incur to provide this
service in-house. Currently, nearly all the Participants that operate
equity and option exchanges contract with FINRA for some or much of
their trading surveillance and routine inspections of members'
activity. FINRA provides nearly 100% of the cross-market surveillance
for equity markets. Within options markets, through RSAs FINRA provides
approximately 50% of cross-market surveillance. As a result, the market
for regulatory services in the equity and options markets currently has
one dominant competitor: FINRA. This may provide relatively uniform
levels of surveillance across trading venues.
    As discussed in the CAT NMS Plan Approval Order,\778\ as exchanges
provide data to the Central Repository to comply with requirements of
the Plan, it will become less costly from an operational standpoint for
Participants to contract with other Participants to conduct both within
market and cross-market surveillance of members because data will
already be centralized and uniform due to Plan requirements.
---------------------------------------------------------------------------

    \778\ See CAT NMS Plan Approval Order, supra note 3, at Part
IV.G.1.c.
---------------------------------------------------------------------------

2. Efficiency
    The Commission preliminarily believes that the proposed amendments
will have moderate and mixed effects on efficiency. The Commission
preliminarily believes that improvements to CAT Data security from the
proposed amendments may improve efficiency by reducing the likelihood
of a CAT Data breach. To the extent that the likelihood of a data
breach is reduced, the Commission preliminarily believes that taking
measures that may prevent a data breach is inherently more efficient
than remediating the consequences of a data breach after it has
occurred. The Commission preliminarily believes that provisions of the
proposed amendments that require the creation and use of SAWs and set
forth requirements that will apply to such workspaces may have negative
effects on the efficiency with which Participants perform their
regulatory tasks. To the extent that participants implement the current
CAT NMS Plan in a manner that is efficient for them individually,
provisions increasing uniformity may reduce efficiency by requiring
some Participants to abandon decisions that were efficient for them in
favor of a potentially less efficient mandated alternative. Finally,
the Commission preliminarily believes that the relatively more
standardized SAW environments may also enable efficiencies in how
Participants perform regulatory activities by facilitating commercial
opportunities to license tools between Participants.
    The Commission preliminarily believes that improvements to CAT Data
security from the proposed amendments may improve efficiency by
reducing the likelihood of a CAT Data breach. Because the costs of a
data breach are potentially high and would be borne primarily by
investors and CAT Data reporters and because the economic impact of a
significant data breach is likely to exceed the costs of measures in
the proposed amendments that are designed to prevent such a data
breach, the Commission preliminarily believes that to the extent that
the likelihood of a data breach is reduced, taking measures that may
prevent a data breach is inherently more efficient than remediating the
consequences of a data breach after it occurred.
    The Commission preliminarily believes that provisions of the
proposed amendments that require the creation and use of SAWs and set
forth requirements that will apply to such workspaces are likely to
have negative effects on the efficiency with which Participants perform
their regulatory tasks. The CAT NMS Plan as it currently stands does
not include provisions for the manner in which Participants access and
work with CAT Data beyond the security provisions discussed
previously.\779\ Currently, Participants discharge their regulatory
duties through a number of approaches, with some Participants
performing those duties in their private analytic workspaces while
others outsource many of their regulatory duties, particularly those
requiring data that is not collected by their normal operations, to
other Participants through the use of RSAs or under a plan approved
pursuant to Rule 17d-2 under the Exchange Act.\780\ The Commission
believes this diversity of approaches represents strategic choices on
the part of Participants.
---------------------------------------------------------------------------

    \779\ See supra Part IV.B.1.
    \780\ See supra Part IV.D.1.
---------------------------------------------------------------------------

    Rule 613 requires that Participants update their surveillance and
oversight activities to make use of CAT Data that will be made
available through the Plan.\781\ Planned approaches for incorporating
CAT Data into regulatory activities that may currently be optimal for a
Participant, such as performing most of its regulatory duties in-house,
may become more difficult for Participants. For example, a
Participant's regulatory staff may be proficient in technical
infrastructure that may not be available or might be less efficient in
the SAWs. Consequently, adapting to the requirements of the proposed
amendments may reduce the efficiency with which a Participant can
discharge its regulatory duties with staff and infrastructure already
in place.
---------------------------------------------------------------------------

    \781\ See discussion of the adoption of Rule 613(a)(3)(iv), 77
FR 45788 (Aug. 1, 2012), available at: https://www.govinfo.gov/content/pkg/FR-2012-08-01/pdf/2012-17918.pdf.
---------------------------------------------------------------------------

    Further, working within the SAW may be less efficient than
alternative environments Participants might have selected to access and
analyze CAT Data. The proposed amendments impose some uniformity across
SAWs and the Commission preliminarily believes that this uniformity
reduces the flexibility of design options for Participants in designing
their analytic environments, which may result in more costly or less
efficient solutions.\782\ The Commission preliminarily believes that
these reductions in efficiency are partially mitigated by provisions in
the proposed amendments that provide for exceptions to the SAW use
requirement although it recognizes that exercising these provisions is
also costly to Participants.\783\
---------------------------------------------------------------------------

    \782\ See supra Part IV.A.
    \783\ See supra Part IV.D.
---------------------------------------------------------------------------

    In addition, the Commission preliminarily believes that provisions
of the proposed amendments that require regulators to secure Commission
approval before exercising programmatic access to the Customer
Information Subsystems will impose costs \784\ upon regulators. These
provisions are likely to delay regulators' access to such data as well,
further reducing the efficiency with which regulators perform duties
that rely upon programmatic access of Customer Identifying Systems.
---------------------------------------------------------------------------

    \784\ See supra Part IV.A.6.
---------------------------------------------------------------------------

    While the Commission recognizes that provisions of the proposed
amendments that reduce the options Participants have (for example, by
requiring use of a SAW or an Exempted Environment)

are likely to impact how regulators perform their regulatory duties,
the Commission preliminarily believes security improvements to CAT Data
may partially mitigate these inefficiencies. The proposed amendments
are intended to reduce the likelihood of a CAT Data breach. To the
extent that security in environments from which Participants access and
analyze CAT Data is improved, the likelihood that investors and CAT
Data reporters are harmed by a data breach and the likelihood that
Participants will need to address the consequences of a data breach,
are likely to be reduced. While Participants are likely to see
reductions in the efficiency with which they perform their regulatory
duties, investors and CAT Data reporters, the parties likely to
experience the greatest harm in the event of a data breach, directly
benefit from improvements to security from the proposed amendments.
    The Commission preliminarily believes other provisions of the
proposed amendments are likely to increase efficiency. The Commission
preliminarily believes that standardizing implementation of security
protocols through the common detailed design specifications may be more
efficient than having each Participant that implements a SAW or
Excepted Environment for CAT Data because it avoids duplication of
effort. This may also improve efficiency by reducing the complexity of
security monitoring of environments from which CAT Data is accessed and
analyzed.
    The Commission preliminarily believes that the relatively more
standardized SAW environments may also lead to efficiencies in how
Participants perform regulatory activities. To the extent that
Participants will be working in similar environments on similar
regulatory tasks, tools developed to facilitate one Participant's
activities in the SAW may be potentially useful to others. This may
facilitate commercial opportunities to license tools between
Participants, possibly improving efficiency to the extent that
licensing agreements are less costly than development activities. Such
tools may also be superior to those developed by a Participant in
isolation because there may be opportunities over time for common tools
to be updated to reflect evolving best practices.
3. Competition
    The Commission preliminarily believes that the proposed amendments
will have minor mixed effects on competition. In the case of the market
for regulatory services, the Commission preliminarily believes that
competition may increase due to additional Participants seeking out
RSAs if the amendments are adopted.
    In the CAT NMS Plan Approval Order, the Commission discussed
potential changes to competition in the market for regulatory
services.\785\ The Commission preliminarily believes that the proposed
amendments could further increase competition in the market of
regulatory services because the proposed amendments' provisions
requiring the creation and use of SAWs and limiting access to Customer
Identifying Systems to SAWs may incentivize other Participants to enter
such agreements as providers of regulatory services or as customers of
other Participants that provide such services. Participants are likely
to face additional operational challenges in performing regulatory
duties using CAT Data because of the proposed amendments, particularly
in the case of a Participant that elects to work in an Exempted
Environment and thus cannot access Customer Identifying Systems from
their primary analytic environment without also maintaining a SAW.
Consequently, it is possible some Participants that otherwise would
have performed some of these duties in house may instead choose to
outsource. An increase in the market for these services may incentivize
Participants to enter into or increase their competition within this
market as providers of regulatory services.
---------------------------------------------------------------------------

    \785\ See CAT NMS Plan Approval Order, supra note 3, at Part
V.G.1.c.
---------------------------------------------------------------------------

4. Capital Formation
    Because the proposed amendments concern the security of data used
by regulators to reconstruct market events, monitor market behavior,
and investigate misconduct, the Commission preliminarily does not
anticipate that the proposed rules would encourage or discourage assets
being invested in the capital markets and thus do not expect the rules
will significantly affect capital formation.

C. Alternatives

1. Private Contracting for Analytic Environments
    The Commission considered an alternative wherein the Participants
would be required to work in analytic environments that would be
provided by individual Participants, instead of SAWs provided by the
Plan Processor, unless they sought exceptions so they could work in
Excepted Environments. This alternative approach would differ from the
baseline by requiring Participants to obtain an exception if they did
not choose to work within the analytic environments currently being
developed by the Plan Processor.
    Under the alternative approach, security monitoring of the analytic
environments might be less uniform. Responsibility for the
implementation of security controls and monitoring compliance of those
controls would reside with the Participant that provided the analytic
environment.\786\ This would be likely to result in the security of
some implementations being greater than others, for example if security
monitoring in some analytic environments occurred more frequently than
in others. This could result in some implementations being less secure
than they would be under the proposed approach where the Plan Processor
is responsible for security monitoring in the SAWs and has more
involvement in the configuration of the SAWs.\787\ The Commission
recognizes that this variability could also lead to some analytic
environments being more secure than they would be under the proposed
approach.
---------------------------------------------------------------------------

    \786\ See supra Part IV.B.2.
    \787\ To the extent that a bad actor would focus an incursion
attempt upon the least secure environment, reducing variability
between environments may improve CAT Data security by reducing
vulnerabilities within environments from where CAT Data is accessed
and analyzed.
---------------------------------------------------------------------------

    The Commission also preliminarily believes that the alternative
approach might be less efficient than the proposed approach. Under the
alternative, each Participant would need to configure its analytic
environment and develop security protocols within its analytic
environment. Under the current proposal, some of these tasks would be
performed by the Plan Processor.\788\ This duplication of effort across
Participants may be inefficient.
---------------------------------------------------------------------------

    \788\ See supra Part II.C.
---------------------------------------------------------------------------

    The Commission preliminarily believes that the alternative approach
may also be more costly to Participants. Cloud computing resources
exhibit volume pricing discounts. Under the proposed approach, the Plan
Processor would presumably contract for all the cloud computing
resources required by the Participants collectively. This may reduce
not only recurring operating costs for the SAWs, but implementation
costs including costs incurred to contract with the cloud services
provider. The Commission cannot determine if the Plan Processor would
share any savings that result with individual Participants that
contracted for SAWs through the Plan Processor, but the potential for
favorable pricing exists.

2. Not Allowing for Exceptions to the SAW Use Requirement
    The Commission considered an alternative approach that would not
provide an exception process to the requirement that Participants use
SAWs when employing the UDDQ and bulk extract tools to access and
analyze CAT Data. Under the alternative approach, each Participant
would use a SAW provided by the Plan Processor to perform its
regulatory duties with CAT Data.
    The Commission preliminarily believes that under the alternative
approach, there would necessarily be less variability in the security
of environments from which CAT Data is accessed and analyzed. To the
extent that variation results in some environments being more secure
than others, the proposed approach could potentially lead to the
existence of relatively weaker security controls within some
environments. On the other hand, it is not necessarily true that
Excepted Environments would have weaker security than SAWs because an
Excepted Environment could have security controls that exceed those
within SAWs. However, the Commission recognizes that under the
alternative approach, variability between environments that access and
analyze CAT Data is likely to be minimized because security controls
for all SAWs would be configured by the Plan Processor.
    The alternative approach prevents participants from seeking
exceptions to the requirement that CAT data be analyzed in a SAW, which
may be suboptimal for some participants because they have alternative
analytic environments and in which they plan to access and analyze CAT
Data. The Commission preliminarily believes that under this alternative
approach, Participants may achieve or maintain the security standards
required by the CAT NMS Plan less efficiently than they might under the
proposed amendments because Participants have significant investments
in private analytic environments and regulatory tools that could not be
used in the absence of an exception process.\789\
---------------------------------------------------------------------------

    \789\ See supra Part IV.A.3.c.
---------------------------------------------------------------------------

3. Alternative Download Size Limits for the Online Targeted Query Tool
    The Commission considered alternative download size limits for the
OTQT. Under the proposed approach, downloads through the OTQT are
limited to extracting no more than 200,000 records per query
result.\790\ Under the alternative approach, downloads through the OTQT
would be limited to a different number of maximum records.
---------------------------------------------------------------------------

    \790\ See supra Part II.D.
---------------------------------------------------------------------------

    The Commission preliminarily believes that increasing the proposed
download size limit such that more records could be downloaded through
a single OTQT query might reduce inefficiencies that may result from
the 200,000 record download limit.\791\ However, increasing this limit
would also allow more CAT Data to be extracted from CAT, increasing the
attack surface of CAT.
---------------------------------------------------------------------------

    \791\ See supra Part IV.A.4.
---------------------------------------------------------------------------

    The Commission preliminarily believes that decreasing the download
size limit such that fewer records could be downloaded through a single
OTQT query might potentially increase inefficiencies that may result
from the 200,000 download limit. However, decreasing this limit would
also allow less CAT Data to be extracted through OTQT, decreasing the
attack surface of CAT.
4. Allowing Access to Customer Identifying Systems From Excepted
Environments
    The Commission considered an alternative approach where
Participants would be able to access data in Customer Identifying
Systems from Excepted Environments. Under the proposed approach, access
to Customer Identifying Systems is only available through SAWs.
    The Commission preliminarily believes that the alternative approach
might reduce inefficiencies that Participants working within Excepted
Environments are likely to experience under the proposed amendments. It
is possible that under the proposal, some Participants may seek
exceptions to work within Excepted Environments and may have no need of
a SAW outside of their need to access data within the CAIS. The
proposed restriction on Customer Identifying Systems access from SAWs
may reduce efficiency by forcing some Participants to maintain a
minimal SAW that they do not use other than to access Customer
Identifying Systems, or cause them to enter into 17d-2s or RSAs in
order to satisfy those regulatory duties they cannot otherwise perform
in their Excepted Environments. The Commission preliminarily believes
that the alternative approach may provide less security for sensitive
customer and account information contained in Customer Identifying
Systems. As discussed previously, Customer and Account Attribute data
is among the most sensitive data in CAT.\792\ To the extent that
Excepted Environments increase the variability of security across
environments that access and analyze CAT Data,\793\ restricting
Customer Identifying Systems access to within SAWs provides more
uniform security across environments accessing this data and thus may
improve its security to the extent that one or more Excepted
Environments exist that are not as secure as SAWs.
---------------------------------------------------------------------------

    \792\ See supra Part II.C.2.
    \793\ See supra Part IV.C.2.
---------------------------------------------------------------------------

D. Request for Comment on the Economic Analysis

    The Commission is sensitive to the potential economic effects,
including the costs and benefits, of the proposed amendments to the CAT
NMS Plan. The Commission has identified above certain costs and
benefits associated with the proposal and requests comment on all
aspects of its preliminary economic analysis. The Commission encourages
commenters to identify, discuss, analyze, and supply relevant data,
information, or statistics regarding any such costs or benefits. In
particular, the Commission seeks comment on the following:
    179. Please explain whether you believe the Commission's analysis
of the potential effects of the proposed amendments to the CAT NMS Plan
is reasonable.
    180. The Commission preliminarily believes that the proposed
amendments may improve the efficiency of CAT implementation by
explicitly defining the scope of the information security program
required by the CAT NMS Plan. Do you agree? Are there other economic
effects of defining the scope of the information security program that
the Commission should consider?
    181. Please explain if you agree or disagree with the Commission's
assessment of the benefits of the proposed amendments. Are there
additional benefits that the Commission should consider?
    182. Do you believe the Commission's cost estimates are reasonable?
If not, please provide alternative estimates where possible. Are there
additional costs that the Commission should consider?
    183. Please explain whether you agree with the Commission's
assessment of potential conflicts of interests involving the Security
Working Group. Are there further conflicts of interest that the
Commission should consider? Are there factors that the Commission has
not considered that may further mitigate

potential conflicts of interest involving the Security Working Group?
    184. In its calculations of cost estimates, the Commission assumes
that the hourly labor rate for the CISO is equivalent to that of a
Chief Compliance Officer. Do you agree with this assumption? If not,
please provide an alternative estimate if possible.
    185. In its calculation of cost estimates, the Commission assumes
that the hourly rate of a Chief Regulatory Officer as 125% of the rate
of a Chief Compliance Officer. Do you agree with this assumption? If
not, please provide an alternate estimate if possible.
    186. In its calculation of cost estimates, the Commission estimates
the hourly rate of an Operating Committee member using an adjusted
hourly rate for a Vice President of Operations of $381 per hour. Is
this estimate reasonable? If not, please provide an alternate estimate
if possible.
    187. Do you agree or disagree with the Commission's assessment of
the benefits of providing for exceptions for the SAW usage
requirements? Are there additional benefits of the SAW exception
provision that the Commission should consider?
    188. The Commission preliminarily believes that each Participant
Group will establish a single SAW or Excepted Environment because it
preliminarily believes that each Participant Group largely centralizes
its regulatory functions that would require CAT Data. Are there reasons
why a single Participant Group may wish to have multiple SAWs? Are
there reasons some Participant Groups may decide to maintain both a SAW
and an Excepted Environment?
    189. The Commission preliminarily believes that the proposed
amendments' provisions related to the CISP may improve the security of
CAT Data because, to the extent that security controls are implemented
more uniformly than they would be under the current CAT NMS Plan, they
reduce variability in security control implementation. Do you agree?
Are there additional economic effects of provisions of the proposed
amendments related to the CISP that the Commission should consider?
    190. The Commission preliminarily believes that the requirement
that the Plan Processor must evaluate and notify the Operating
Committee that each Participant's SAW has achieved compliance with the
detailed design specifications before that SAW may connect to the
Central Repository will further increase uniformity of security control
implementations. Do you agree? Are there other economic effects of this
provision that the Commission should consider?
    191. Do you agree that provisions allowing for exceptions to the
SAW usage requirement may allow Participants to achieve or maintain the
security standards required by the CAT NMS Plan more efficiently? Are
there other economic effects of this provision that the Commission
should consider?
    192. The proposed amendments require that each Participant using a
non-SAW environment simultaneously notify the Plan Processor, the
members of the Security Working Group (and their designees), and
Commission observers of the Security Working Group of any material
changes to its security controls for the non-SAW environment. How often
would a Participant Group make changes to its Excepted Environment that
would necessitate material changes to its security controls?
    193. The proposed amendments require that Participants would need
to implement processes in Excepted Environments to enable Plan
Processor security monitoring. The Commission preliminarily believes
that development costs for the processes that produce log files that
support Plan Processor monitoring would require similar development
activities to developing the automated monitoring processes themselves.
Do you agree? Please provide alternate estimates of the costs of these
development activities if possible.
    194. The Commission believes that by limiting the number of records
of CAT Data that can be extracted through the OTQT will increase
security by limiting the data that is accessed outside of secure
environments. Do you agree? Are there other economic effects of
limiting the number of records that can be extracted through the OTQT
that the Commission should consider?
    195. The Commission preliminarily believes that limiting the number
of records of CAT Data that can be extracted through the OTQT this may
reduce the regulatory use of CAT Data. Do you agree with this
assessment? Are there additional indirect costs to regulators from this
provision that the Commission should consider?
    196. The Commission preliminarily believes that requiring the Plan
Processor to evaluate and validate each Participant's SAW before that
SAW may connect to the Central Repository will further increase
uniformity of security control implementations. Do you agree? Are there
other economic effects of requiring the Plan Processor to perform this
evaluation and validation that the Commission should consider?
    197. The Commission preliminarily believes that standardizing
implementation of security protocols through the common detailed design
specifications may be more efficient than having each Participant that
implements a SAW or private environment for CAT Data do so
independently because it avoids duplication of effort. Do you agree?
Are there other economic effects of these provisions that the
Commission should consider?
    198. The Commission preliminarily believes that the requirement
that customer addresses be reported to CAIS with separate fields for
street number and street name is likely to have a de minimis economic
impact upon both Participants and CAT Reporters. Do you agree? If
possible, please provide cost estimates for providing this information
in separate fields.
    199. Do you agree with the Commission's cost estimates for the Plan
Processor to establish programmatic access to the Customer Identifying
Systems? Please provide alternative estimates if possible. Are there
additional direct or indirect costs to providing this programmatic
access that the Commission should consider?
    200. Do you agree that placing restrictions on access to Customer
Identifying Systems to Regulatory Staff will reduce the risk of
inappropriate use of customer and account information? Are there
additional economic effects of these restrictions that the Commission
should consider?
    201. Do you agree with the Commission's analysis of the economic
effects of provisions of the proposed amendments that prohibit any use
of CAT Data that has both regulatory and commercial uses? Are there
additional economic effects of these provisions that the Commission
should consider?
    202. The proposed amendments would require the Participants to
periodically review the effectiveness of the Proposed Confidentiality
Policies and take prompt action to remedy deficiencies in such
policies. The Commission preliminarily estimates that this review would
require approximately 20% of the labor of the initial effort to jointly
draft those policies because presumably many of the policies would not
need revision with each review. Do you agree? Please provide
alternative cost estimates if possible.
    203. The Commission preliminarily believes that providing an
exception allowing non-regulatory staff to access CAT data in certain
circumstances may help avoid inefficiencies where a Participant's
response to a market event

is slowed due to prohibitions on staff other than Regulatory Staff
having access to CAT Data. Do you agree? Are there additional economic
effects of providing this exception that the Commission should
consider?
    204. The Commission preliminarily believes the risk that CAT data
will be misused by allowing non-regulatory staff to use the data in
certain circumstances is mitigated by the requirement that the
Participant's Chief Regulatory Officer provide written permission for
such access. Do you agree? Are there additional security risks or
economic effects of these provisions that the Commission should
consider?
    205. The Commission preliminarily believes that the Plan Processor
has transactional test data available for its staff and contractors to
use for development activities. Do you agree? If not, please provide an
estimate of the costs the Plan Processor would incur to create such
test data.
    206. The Commission believes that the ability to amend the plan in
the future mitigates the concern that participants may be prevented in
the future from using more secure methods to connect to CAT that have
yet to be developed. Do you agree? Are there other indirect costs of
these provisions that the Commission should consider?
    207. The Commission preliminarily believes that the proposed
amendments are likely to have moderate mixed effects on efficiency. Do
you agree? Are there other effects of the proposed amendments on
efficiency that the Commission should consider?
    208. The Commission preliminarily believes that the proposed
amendments are likely to have minor mixed effects on competition. Do
you agree? Are there other effects of the proposed amendments on
competition that the Commission should consider?
    209. The Commission preliminarily believes that the proposed
amendments' effects on capital formation likely won't be significant.
Do you agree? Are there other effects of the proposed amendments on
capital formation that the Commission should consider?
    210. Do you believe that provisions of the proposed amendments that
require the creation and use of SAWs and set forth requirements that
will apply to such workspaces may have negative effects on the
efficiency with which Participants perform their regulatory tasks? Are
there other economic effects of these provisions that the Commission
should consider?
    211. The Commission preliminarily believes that the relatively more
standardized SAW environments may also enable efficiencies in how
Participants perform regulatory activities by facilitating commercial
opportunities to license tools between Participants. Do you agree? Are
there other economic effects of these provisions that the Commission
should consider?
    212. The Commission preliminarily believes that provisions of the
proposed amendments that require the creation and use of SAWs and set
forth requirements that will apply to such workspaces are likely to
have negative effects on the efficiency with which Participants perform
their regulatory tasks. Do you agree? Are there other economic effects
on how Participants perform their regulatory tasks that the Commission
should consider?
    213. The Commission preliminarily believes that the uniformity
across SAWs imposed by the plan reduces the flexibility of design
options for Participants potentially resulting in in more costly and/or
less efficient solutions. Do you agree with this assessment? In what
manner could the flexibility of design options available to
Participants be affected by the proposed amendments?
    214. Do you agree that the potential reductions in efficiency due
to the imposed uniformity across SAWs are partially mitigated by
provisions in the proposed amendments that providing for exceptions to
the SAW use requirement?
    215. The Commission preliminarily believes that the proposed
amendments could further increase competition in the market of
regulatory services because the proposed amendments' provision
requiring the creation and use of secure analytical workspaces may
incentivize other Participants to enter such agreements as providers of
regulatory services or as customers of other Participants that provide
such services. Are there likely to be additional economic effects on
how Participants provide and use 17d-2 and RSA agreements?
    216. Do you believe that the alternative approach of private
contracting for analytic environments would likely lead to some
implementations to be less secure than they would be under the proposed
approach? Are there additional economic effects of the alternative
approach that the Commission should consider?
    217. Do you agree with the Commission's analysis of the alternative
approach of not allowing exceptions to the SAW use requirement? Are
there additional economic effects of the alternative approach that the
Commission should consider?
    218. The proposed amendments would limit downloads through the OTQT
to 200,000 records. Would an alternative limit to download size have
security or efficiency benefits?
    219. Do you agree with the Commission's analysis of the alternative
approach of allowing access to CAIS from Exempted Environments? Are
there additional economic effects of the alternative approach that the
Commission should consider?

V. Consideration of Impact on the Economy

    For purposes of the Small Business Regulatory Enforcement Fairness
Act of 1996 (``SBREFA''),\794\ the Commission requests comment on the
potential effect of this proposal on the United States economy on an
annual basis. The Commission also requests comment on any potential
increases in costs or prices for consumers or individual industries,
and any potential effect on competition, investment, or innovation.
Commenters are requested to provide empirical data and other factual
support for their views, to the extent possible.
---------------------------------------------------------------------------

    \794\ Public Law 104-121, Title II, 110 Stat. 857 (1996)
(codified in various sections of 5 U.S.C., 15 U.S.C. and as a note
to 5 U.S.C. 601).
---------------------------------------------------------------------------

VI. Regulatory Flexibility Act Certification

    The Regulatory Flexibility Act (``RFA'') \795\ requires Federal
agencies, in promulgating rules, to consider the impact of those rules
on small entities. Section 603(a) \796\ of the Administrative Procedure
Act,\797\ as amended by the RFA, generally requires the Commission to
undertake a regulatory flexibility analysis of all proposed rules, or
proposed rule amendments, to determine the impact of such rulemaking on
``small entities.'' \798\ Section 605(b) of the RFA states that this
requirement shall not apply ``to any proposed or final rule if the head
of the agency certifies that the rule will not, if promulgated, have a
significant economic impact on a substantial number of small
entities.'' \799\
---------------------------------------------------------------------------

    \795\ 5 U.S.C. 601 et seq.
    \796\ 5 U.S.C. 603(a).
    \797\ 5 U.S.C. 551 et seq.
    \798\ The Commission has adopted definitions for the term
``small entity'' for purposes of Commission rulemaking in accordance
with the RFA. Those definitions, as relevant to this proposed
rulemaking, are set forth in 17 CFR 240.0-10. See Securities
Exchange Act Release No. 18451 (January 28, 1982), 47 FR 5215
(February 4, 1982) (File No. AS-305).
    \799\ 5 U.S.C. 605(b).
---------------------------------------------------------------------------

    The proposed amendments to the CAT NMS Plan would only impose
requirements on national securities

exchanges registered with the Commission under Section 6 of the
Exchange Act and FINRA. With respect to the national securities
exchanges, the Commission's definition of a small entity is an exchange
that has been exempt from the reporting requirements of Rule 601 of
Regulation NMS, and is not affiliated with any person (other than a
natural person) that is not a small business or small
organization.\800\ None of the national securities exchanges registered
under Section 6 of the Exchange Act that would be subject to the
proposed amendments are ``small entities'' for purposes of the RFA. In
addition, FINRA is not a ``small entity.'' \801\ For these reasons, the
proposed rule will not apply to any ``small entities.'' Therefore, for
the purposes of the RFA, the Commission certifies that the proposed
amendments would not have a significant economic impact on a
substantial number of small entities.
---------------------------------------------------------------------------

    \800\ See 17 CFR 240.0-10(e).
    \801\ See 13 CFR 121.201
---------------------------------------------------------------------------

    The Commission requests comment regarding this certification. In
particular, the Commission solicits comment on the following:
    220. Do commenters agree with the Commission's certification that
the proposed amendments would not have a significant economic impact on