information systems, including whether it is proprietary or vender-
supplied software; (5) the nature and volume of the information they
store on information systems (e.g., personal, confidential, and/or
proprietary information); (6) the complexity and scale of their
information systems (i.e., the size of their IT footprint); (7) the
location of their information systems; (8) the number of users
authorized to access their information systems; (9) the types of
devices permitted to access their information systems (e.g., company-
owned or personal desktop computers, laptop computers, or smart
phones); (10) the extent to which they conduct international operations
and allow access to their information systems from international
locations; and (11) the extent to which employees access their
information systems from remote locations, including international
locations. In categorizing and prioritizing cybersecurity risks, the
Covered Entity generally should consider consulting with, among others,
personnel familiar with the Covered Entity's operations, its business
partners, and third-party cybersecurity experts.\218\ In addition, a
Covered Entity could consider an escalation protocol in its risk
assessment plan to ensure that its senior officers, including
appropriate legal and compliance personnel, receive necessary
information regarding cybersecurity risks on a timely basis.\219\ Only
after assessing, categorizing, and prioritizing its cybersecurity risks
can a Covered Entity establish, maintain, and enforce reasonably
designed cybersecurity policies and procedures under proposed Rule 10
to address those risks.
---------------------------------------------------------------------------

    \216\ See paragraph (b)(1)(i)(A)(1) of proposed Rule 10. See
generally CISA Cyber Essentials Starter Kit (``Consider how much
your organization relies on information technology to conduct
business and make it a part of your culture to plan for
contingencies in the event of a cyber incident. Identify and
prioritize your organization's critical assets and the associated
impacts to operations if an incident were to occur. Ask the
questions that are necessary to understanding your security
planning, operations, and security-related goals. Develop an
understanding of how long it would take to restore normal
operations. Resist the ``it can't happen here'' pattern of thinking.
Instead, focus cyber risk discussions on ``what-if'' scenarios and
develop an incident response plan to prepare for various cyber
events and scenarios.'').
    \217\ See paragraph (a)(3) of proposed Rule 10; see also
paragraphs (a)(2), (a)(4), and (a)(5) of proposed Rule 10 (defining,
respectively, the terms ``cybersecurity incident,'' cybersecurity
threat,'' and ``cybersecurity vulnerability,'' which are used in the
definition of ``cybersecurity risk'').
    \218\ See generally CISA Cyber Essentials Starter Kit (``[H]ave
conversations with your staff, business partners, vendors, managed
service providers, and others within your supply chain. . . .
Maintain situational awareness of cybersecurity threats and explore
available communities of interest. These may include sector-specific
Information Sharing and Analysis Centers, government agencies, law
enforcement, associations, vendors, etc.'').
    \219\ See generally id. (stating that organizational leaders
drive cybersecurity strategy, investment, and culture, and that
leaders should, among other things: (1) use risk assessments to
identify and prioritize allocation of resources and cyber
investments; (2) perform a review of all current cybersecurity and
risk policies and identify gaps or weaknesses; and (3) develop a
policy roadmap, prioritize policy creation and updates based on the
risk to the organization as determined by business leaders and
technical staff).
---------------------------------------------------------------------------

    A Covered Entity also would need to reassess and re-prioritize its
cybersecurity risks periodically. The Covered Entity would need to
determine the frequency of these assessments and the types of
developments in

cybersecurity risk that would trigger an assessment based on its
particular circumstances. Consequently, the Covered Entity generally
should consider whether to reassess its cybersecurity risks to reflect
internal changes as they arise, such as changes to its business, online
presence, or customer website access, or external changes, such as
changes in the evolving technology and cybersecurity threat
landscape.\220\ The Covered Entity generally should also consider
raising any material changes in its risk assessment plan to senior
officers, as appropriate. In assessing ongoing and emerging
cybersecurity threats, a Covered Entity could monitor and consider
updates and guidance from private sector and governmental resources,
such as the FS-ISAC and CISA.\221\
---------------------------------------------------------------------------

    \220\ See generally id. (``Maintain awareness of current events
related to cybersecurity. Be proactive; alert staff to hazards that
the organization may encounter. Maintain vigilance by asking
yourself: what types of cyber attack[s] are hitting my peers or
others in my industry? What tactics were successful in helping my
peers limit damage? What does my staff need to know to help protect
the organization and each other? On a national-level, are there any
urgent cyber threats my staff need to know about?'').
    \221\ The FS-ISAC is a global private industry cyber
intelligence sharing community solely focused on financial services.
Additional information about FS-ISAC is available at https://www.fsisac.com. Often, private industry groups maintain
relationships and information sharing agreements with government
cybersecurity organizations, such as CISA. Private sector companies,
such as information technology and cybersecurity consulting
companies, may have insights on cybersecurity (given the access
their contractual status gives them to customer networks) that the
government initially does not. See, e.g., Verizon DBIR; Microsoft
Report. For example, private-sector cybersecurity firms may often be
in the position to spot new malicious cybersecurity trends before
they become more widespread and common.
---------------------------------------------------------------------------

    Second, the policies and procedures would need to require the
Covered Entity to identify its service providers that receive,
maintain, or process information, or are otherwise permitted to access
its information systems and the information residing on those systems,
and assess the cybersecurity risks associated with its use of these
service providers.\222\ Covered Entities are exposed to cybersecurity
risks through the technology of their service providers.\223\ Having
identified the relevant service providers, the Covered Entity would
need to assess how they expose it to cybersecurity risks. In
identifying these cybersecurity risks, the service provider's
cybersecurity practices would be relevant, including: (1) how the
service provider protects itself against cybersecurity risk; and (2)
its ability to respond to and recover from cybersecurity incidents.
---------------------------------------------------------------------------

    \222\ See paragraph (b)(1)(i)(A)(2) of proposed Rule 10;
paragraphs (a)(6) and (7) of proposed Rule 10 (defining,
respectively, the terms ``information'' and ``information
systems''). Oversight of third-party service provider or vendor risk
is a component of many cybersecurity frameworks. See, e.g., NIST
Framework (discussing supply chain risks associated with products
and services an organization uses).
    \223\ See GAO Cyber Security Report (``Increased connectivity
with third-party providers and the potential for increased cyber
risk is a concern in the financial industry as core systems and
critical data are moved offsite to third parties.''). For purposes
of proposed Rule 10, the Covered Entity's assessment of service
providers should not be limited to only certain service providers,
such as those that provide core functions or services for the
Covered Entity. Rather, the cybersecurity risk of any service
provider that receives, maintains, or processes information, or is
otherwise permitted to access the information systems of the Covered
Entity and the information residing on those systems should be
evaluated. Furthermore, it is possible that a service provider for a
Covered Entity may itself be a Covered Entity under proposed Rule
10. For example, a carrying broker-dealer may be a service provider
for a number of introducing broker-dealers.
---------------------------------------------------------------------------

    A Covered Entity generally should take into account whether a
cybersecurity incident at a service provider could lead to process
failures or the unauthorized access to or use of information or
information systems. For example, a Covered Entity may use a cloud
service provider to maintain required books and records. If all of the
Covered Entity's books and records were concentrated at this cloud
service provider and a cybersecurity incident disrupts or degrades the
cloud service provider's information systems, there could potentially
be detrimental data loss affecting the ability of the Covered Entity to
provide services and comply with regulatory obligations. Accordingly,
as part of identifying the cybersecurity risks associated with using a
cloud service provider, a Covered Entity should consider how the
service provider will secure and maintain data and whether the service
provider has response and recovery procedures in place such that any
compromised or lost data in the event of a cybersecurity incident can
be recovered and restored.
    Finally, the Covered Entity's risk assessment policies and
procedures would need to require written documentation of these risk
assessments.\224\ This documentation would be relevant to the reviews
performed by the Covered Entity to analyze whether the policies and
procedures need to be updated, to inform the Covered Entity of risks
specific to it, and to support responses to cybersecurity risks by
identifying cybersecurity threats to information systems that, if
compromised, could result in significant cybersecurity incidents.\225\
It also could be used by Commission and SRO staff and possibly internal
auditors of the Covered Entity to examine for adherence to the risk
assessment policies and procedures.
---------------------------------------------------------------------------

    \224\ See paragraph (b)(1)(i)(B) of proposed Rule 10.
    \225\ See paragraph (b)(2) of proposed Rule 10 (which would
require a Covered Entity to review and assess the design and
effectiveness of the cybersecurity policies and procedures,
including whether the policies and procedures reflect changes in
cybersecurity risk over the time period covered by the review). See
also section II.B.1.f. of this release (discussing the review
proposal in more detail).
---------------------------------------------------------------------------

b. User Security and Access
    Proposed Rule 10 would specify that the Covered Entity's
cybersecurity risk management policies and procedures must include
controls designed to minimize user-related risks and prevent
unauthorized access to the Covered Entity's information systems and the
information residing on those systems.\226\ Further, the rule would
require that these policies and procedures include controls addressing
five specific aspects relating to user security and access.
---------------------------------------------------------------------------

    \226\ See paragraph (b)(1)(ii) of proposed Rule 10; paragraphs
(a)(6) and (7) of proposed Rule 10 (defining, respectively, the
terms ``information'' and ``information systems''). See generally
NIST Framework (providing that the second core element of the
framework is ``protect''--meaning develop and implement appropriate
safeguards to ensure delivery of critical services); CISA Cyber
Essentials Starter Kit (stating with respect to user security and
access that (among other things): (1) the authority and access
granted employees, managers, and customers into an organization's
digital environment needs limits; (2) setting approved access
privileges requires knowing who operates on an organization's
systems and with what level of authorization and accountability; and
(3) organizations should ensure only those who belong on their
``digital workplace have access''); IOSCO Cybersecurity Report
(stating that network access controls are one of the types of
controls trading venues use as the protection function).
---------------------------------------------------------------------------

    First, there would need to be controls requiring standards of
behavior for individuals authorized to access the Covered Entity's
information systems and the information residing on those systems, such
as an acceptable use policy.\227\ Second, there would need to be
controls for identifying and authenticating individual users, including
but not limited to implementing authentication measures that require
users to present a combination of two or more credentials for access
verification.\228\ Third, there would need to be controls for
establishing procedures for the timely distribution, replacement, and
revocation of passwords or methods of

authentication.\229\ Fourth, there would need to be controls for
restricting access to specific information systems of the Covered
Entity or components thereof and the information residing on those
systems solely to individuals requiring access to the systems and
information as is necessary for them to perform their responsibilities
and functions on behalf of the Covered Entity.\230\ Fifth, there would
need to be controls for securing remote access technologies.\231\
---------------------------------------------------------------------------

    \227\ See paragraph (b)(1)(ii)(A) of proposed Rule 10.
    \228\ See paragraph (b)(1)(ii)(B) of proposed Rule 10.
    \229\ See paragraph (b)(1)(ii)(C) of proposed Rule 10.
    \230\ See paragraph (b)(1)(ii)(D) of proposed Rule 10.
    \231\ See paragraph (b)(1)(ii)(E) of proposed Rule 10;
paragraphs (a)(6) and (7) of proposed Rule 10 (defining,
respectively, the terms ``information'' and ``information
systems'').
---------------------------------------------------------------------------

    The objective of these policies, procedures, and controls would be
to protect the Covered Entity's information systems from unauthorized
access and improper use. There are a variety of controls that a Covered
Entity, based on its particular circumstances, could include in these
policies and procedures to make them reasonably designed to achieve
this objective. For example, access to information systems could be
controlled through the issuance of user credentials, digital rights
management with respect to proprietary hardware and copyrighted
software, authentication and authorization methods (e.g., multi-factor
authentication and geolocation), and tiered access to personal,
confidential, and proprietary information and data and network
resources.\232\ Covered Entities may wish to consider multi-factor
authentication methods that are not based solely on SMS-delivery (e.g.,
text message delivery) of authentication codes, because SMS-delivery
methods may provide less security than other non-SMS based multi-factor
authentication methods. Furthermore, Covered Entities could require
employees to attend cybersecurity training on how to secure sensitive
data and recognize harmful files prior to obtaining access to certain
information systems. The training generally could address best
practices in creating new passwords, filtering through suspicious
emails, or browsing the internet.\233\
---------------------------------------------------------------------------

    \232\ See generally CISA Cyber Essentials Starter Kit (stating
that organizations should (among other things): (1) learn who is on
their networks and maintain inventories of network connections
(e.g., user accounts, vendors, and business partners); (2) leverage
multi-factor authentication for all users, starting with privileged,
administrative and remote access users; (3) grant access and
administrative permissions based on need-to-know basis; (4) leverage
unique passwords for all user accounts; and (5) develop IT policies
and procedures addressing changes in user status (e.g., transfers
and terminations).
    \233\ See generally CISA Cyber Essentials Starter Kit (stating
that organizations should (among other things) leverage basic
cybersecurity training to improve exposure to cybersecurity
concepts, terminology, and activates associated with implementing
cybersecurity best practices).
---------------------------------------------------------------------------

    Further, a Covered Entity could use controls to monitor user access
regularly in order to remove users that are no longer authorized. These
controls generally should address the Covered Entity's employees (e.g.,
removing access for employees that leave the firm) and external users
of the Covered Entity's information systems (e.g., customers that no
longer use the firm's services or external service providers that no
longer are under contract with the firm to provide it with any
services). In addition, controls to monitor for unauthorized login
attempts and account lockouts, and the handling of customer requests,
including for user name and password changes, could be a part of
reasonably designed policies and procedures. Similarly, controls to
assess the need to authenticate or investigate any unusual customer,
member, or user requests (e.g., wire transfer or withdrawal requests)
could be a part of reasonably designed policies and procedures.
    A Covered Entity also generally should take into account the types
of technology through which its users access the Covered Entity's
information systems. For example, mobile devices (whether firm-issued
or personal devices) that allow employees to access information systems
and personal, confidential, or proprietary information residing on
these systems may create additional and unique vulnerabilities,
including when such devices are used internationally. Consequently,
controls limiting mobile or other devices approved for remote access to
those issued by the firm or enrolled through a mobile device manager
could be part of reasonably designed policies and procedures.
    In addition, a Covered Entity could consider controls with respect
to its network perimeter such as securing remote network access used by
teleworking and traveling employees. This could include controls to
identify threats on a network's endpoints. For example, Covered
Entities could consider using software that monitors and inspects all
files on an endpoint, such as a mobile phone or remote laptop, and
identifies and blocks incoming unauthorized communications. Covered
Entities generally would need to consider potential user-related and
access risks relating to the remote access technologies used at their
remote work and telework locations to include controls designed to
secure such technologies. For example, a Covered Entity's personnel
working remotely from home or a co-working space may create unique
cybersecurity risks--such as unsecured or less secure Wi-Fi--that
threat actors could exploit to access the Covered Entity's information
systems and the information residing on those systems. Accordingly, a
Covered Entity could consider whether its user security and access
policies, procedures, and controls should have controls requiring
approval of mobile or other devices for remote access, and whether
training on device policies would be appropriate. The training for
remote workers in particular could focus on phishing, social
engineering, compromised passwords, and the consequences of weak
network security.
c. Information Protection
    Information protection is a key aspect of managing cybersecurity
risk.\234\ Therefore, proposed Rule 10 would specify that the Covered
Entity's cybersecurity risk management policies and procedures would
need to address information protection in two ways.\235\ First, the
policies and procedures would need to include measures designed to
protect the Covered Entity's information systems and protect the
information residing on those systems from unauthorized access or use,
based on a periodic assessment of the Covered

Entity's information systems and the information that resides on the
systems.\236\ The periodic assessment would need to take into account:
(1) the sensitivity level and importance of the information to the
Covered Entity's business operations; (2) whether any of the
information is personal information; \237\ (3) where and how the
information is accessed, stored and transmitted, including the
monitoring of information in transmission; (4) the information systems'
access controls and malware protection; \238\ and (5) the potential
effect a cybersecurity incident involving the information could have on
the Covered Entity and its customers, counterparties, members,
registrants, or users, including the potential to cause a significant
cybersecurity incident.\239\
---------------------------------------------------------------------------

    \234\ See generally NIST Framework (``The Protect Function
supports the ability to limit or contain the impact of a potential
cybersecurity event. Examples of outcome Categories within this
Function include: Identity Management and Access Control; Awareness
and Training; Data Security; Information Protection Processes and
Procedures; Maintenance; and Protective Technology.''); IOSCO
Cybersecurity Report (``There are numerous controls and protection
measures that regulated entities may wish to consider in enhancing
their cyber security. Such measures can be organizational (like the
establishment of security operations centers) or technical (like
anti-virus and intrusion prevention systems). Risk assessments help
determine the minimum level of controls to be implemented within a
project, an application or a database. In addition, employee
training and awareness initiatives are critical parts of any cyber
security program, including induction programs for newcomers,
general training, as well as more specific training (for instance,
social engineering awareness). Proficiency tests could be conducted
to demonstrate staff understanding and third party training could
also be organized. Other initiatives which contribute to raising
employees' awareness of cyber security threats include monthly
security bulletins emailed to all employees, regular communications
regarding new issues and discovered vulnerabilities, use of posters
and screen savers, and regular reminders sent to employees. Mock
tests can also be conducted to assess employees' preparedness.
Employees are also often encouraged to report possible attacks.'').
    \235\ See paragraph (b)(1)(iii) of proposed Rule 10.
    \236\ See paragraph (b)(1)(iii)(A) of proposed Rule 10;
paragraphs (a)(6) and (7) of proposed Rule 10 (defining,
respectively, the terms ``information'' and ``information
systems''). See generally CISA Cyber Essentials Starter Kit (``Learn
what information resides on your network. Inventory critical or
sensitive information. An inventory of information assets provides
an understanding of what you are protecting, where that information
resides, and who has access. The inventory can be tracked in a
spreadsheet, updated quickly and frequently'').
    \237\ See paragraph (a)(9) of proposed Rule 10 (defining the
term ``personal information'').
    \238\ See generally CISA Cyber Essentials Starter Kit
(``Leverage malware protection capabilities. Malware is designed to
spread quickly. A lack of defense against it can completely corrupt,
destroy or render your data inaccessible.'').
    \239\ See paragraphs (b)(1)(iii)(A)(1) through (5) of proposed
Rule 10. See generally CISA Cyber Essentials Starter Kit (``Learn
how your data is protected. Data should be handled based on its
importance to maintaining critical operations in order to understand
what your business needs to operate at a basic level. For example,
proprietary research, financial information, or development data
need protection from exposure in order to maintain operations.
Understand the means by which your data is currently protected;
focus on where the protection might be insufficient. Guidance from
the Cyber Essentials Toolkits, including authentication, encryption,
and data protection help identify methods and resources for how to
best secure your business information and devices.'').
---------------------------------------------------------------------------

    By performing these assessments, a Covered Entity should be able to
determine the measures it would need to implement to prevent the
unauthorized access or use of information residing on its information
systems. Measures that could be used for this purpose include
encryption, network segmentation, and access controls to ensure that
only authorized users have access to personal, confidential, and
proprietary information and data or critical systems. Measures to
identify suspicious behavior also could be used for this purpose. These
measures could include consistent monitoring of systems and personnel,
such as the generation and review of activity logs, identification of
potential anomalous activity, and escalation of issues to senior
officers, as appropriate. Further data loss prevention measures could
include processes to identify personal, confidential, or proprietary
information and data (e.g., account numbers, Social Security numbers,
trade information, and source code) and block its transmission to
external parties. Additional measures could include testing of systems,
including penetration tests. A Covered Entity also could consider
measures to track the actions taken in response to findings from
testing and monitoring, material changes to business operations or
technology, or any other significant events. Appropriate measures for
preventing the unauthorized use of information may differ depending on
the circumstances of a Covered Entity, such as the systems used by the
Covered Entity, the Covered Entity's relationship with service
providers, or the level of access granted by the Covered Entity to
employees or contractors. Appropriate measures generally should evolve
with changes in technology and the increased sophistication of
cybersecurity attacks.
    Second, the policies and procedures for protecting information
would need to require oversight of service providers that receive,
maintain, or process the Covered Entity's information, or are otherwise
permitted to access the Covered Entity's information systems and the
information residing on those systems, pursuant to a written contract
between the covered entity and the service provider.\240\ Further,
pursuant to that written contract, the service provider would be
required to implement and maintain appropriate measures, including the
practices described in paragraphs (b)(1)(i) through (v) of proposed
Rule 10, that are designed to protect the Covered Entity's information
systems and information residing on those systems. These policies and
procedures could include measures to perform due diligence on a service
provider's cybersecurity risk management prior to using the service
provider and periodically thereafter during the relationship with the
service provider. Covered Entities also could consider including
periodic contract review processes that allow them to assess whether,
and help to ensure that, their agreements with service providers
contain provisions that require service providers to implement and
maintain appropriate measures designed to protect the Covered Entity's
information systems and information residing on those systems.
---------------------------------------------------------------------------

    \240\ See paragraph (b)(1)(iii)(B) of proposed Rule 10;
paragraphs (a)(6) and (7) of proposed Rule 10 (defining,
respectively, the terms ``information'' and ``information
systems'').
---------------------------------------------------------------------------

d. Cybersecurity Threat and Vulnerability Management
    Rule 10 would specify that the Covered Entity's cybersecurity risk
management policies and procedures must include measures designed to
detect, mitigate, and remediate any cybersecurity threats and
vulnerabilities with respect to the Covered Entity's information
systems and information residing on those systems.\241\ Because Covered
Entities depend on information systems to process, store, and transmit
personal, confidential, and proprietary information and data and to
conduct critical business functions, it is essential that they manage
cybersecurity threats and vulnerabilities effectively.\242\ Moreover,
detecting, mitigating, and remediating threats and vulnerabilities is
essential to preventing significant cybersecurity incidents.
---------------------------------------------------------------------------

    \241\ See paragraph (b)(1)(iv) of proposed Rule 10; paragraphs
(a)(4) through (7) of proposed Rule 10 (defining, respectively, the
terms ``cybersecurity threat,'' ``cybersecurity vulnerability,''
``information,'' and ``information systems''). See generally NIST
Framework (providing that the third core element of the framework is
``detect''--meaning develop and implement appropriate activities to
identify the occurrence of a cybersecurity event); CISA Cyber
Essentials Starter Kit (stating regarding detection that
organizations should (among other things): (1) learn what is
happening on their networks; (2) manage network and perimeter
components, host and device components, data at rest and in transit,
and user behavior and activities: and (3) actively maintain
information as it will provide a baseline for security testing,
continuous monitoring, and making security-based decisions); IOSCO
Cybersecurity Report (``External and internal monitoring of traffic
and logs generally should be used to detect abnormal patterns of
access (e.g., abnormal user activity, odd connection durations, and
unexpected connection sources) and other anomalies. Such detection
is crucial as attackers can use the period of presence in the
target's systems to expand their footprint and their access gaining
elevated privileges and control over critical systems. Many
regulated entities have dedicated cyber threat teams and engage in
file servers integrity and database activity monitoring to prevent
unauthorized modification of critical servers within their
organization's enterprise network. Different alarm categories and
severity may be defined.'').
    \242\ See section I.A.2. of this release (discussing how Covered
Entities use information systems).
---------------------------------------------------------------------------

    Measures to detect cybersecurity threats and vulnerabilities could
include ongoing monitoring (e.g., comprehensive examinations and risk
management processes), including, for example, conducting network,
system, and application vulnerability assessments. This could include
scans or reviews of internal systems, externally facing systems, new
systems, and systems used by service providers. Further, measures could
include monitoring industry and government

sources for new threat and vulnerability information that may assist in
detecting cybersecurity threats and vulnerabilities.\243\
---------------------------------------------------------------------------

    \243\ See generally CISA, National Cyber Awareness System--
Alerts, available at https://us-cert.cisa.gov/ncas/alerts (providing
information about current security issues, vulnerabilities, and
exploits).
---------------------------------------------------------------------------

    Measures to mitigate and remediate an identified threat or
vulnerability are more effective if they minimize the window of
opportunity for attackers to exploit vulnerable hardware and software.
These measures could include, for example, implementing a patch
management program to ensure timely patching of hardware and software
vulnerabilities and maintaining a process to track and address reports
of vulnerabilities.\244\ Covered Entities also generally should
consider the vulnerabilities associated with ``end of life systems''
(i.e., systems in which software is no longer supported by the
particular vendor and for which security patches are no longer issued).
These measures also could establish accountability for handling
vulnerability reports by, for example, establishing processes for their
intake, assignment, escalation, remediation, and remediation testing.
For example, a Covered Entity could use a vulnerability tracking system
that includes severity ratings, and metrics for measuring the time it
takes to identify, analyze, and remediate vulnerabilities.
---------------------------------------------------------------------------

    \244\ See generally CISA Cyber Essentials Starter Kit (stating
that organizations should: (1) enable automatic updates whenever
possible; (2) replace unsupported operating systems, applications
and hardware; and (3) test and deploy patches quickly).
---------------------------------------------------------------------------

    Covered Entities also could consider role-specific cybersecurity
threat and vulnerability response training.\245\ For example, training
could include secure system administration courses for IT
professionals, vulnerability awareness and prevention training for web
application developers, and social engineering awareness training for
employees and executives. Covered Entities that do not proactively
address threats and discovered vulnerabilities face an increased
likelihood of having their information systems--including the Covered
Entity's information residing on those systems--accessed or disrupted
by threat actors or otherwise compromised. The requirement for Covered
Entities to include cybersecurity threats and vulnerabilities measures
in their cybersecurity policies and procedures is designed to address
this risk and help ensure threats and vulnerabilities are adequately
and proactively addressed by Covered Entities.
---------------------------------------------------------------------------

    \245\ See generally CISA Cyber Essentials Starter Kit
(``Leverage basic cybersecurity training. Your staff needs a basic
understanding of the threats they encounter online in order to
effectively protect your organization. Regular training helps
employees understand their role in cybersecurity, regardless of
technical expertise, and the actions they take help keep your
organization and customers secure. Training should focus on threats
employees encounter, like phishing emails, suspicious events to
watch for, and simple best practices individual employees can adopt
to reduce risk. Each aware employee strengthens your network against
attack, and is another `sensor' to identify an attack.'').
---------------------------------------------------------------------------

e. Cybersecurity Incident Response and Recovery
    Proposed Rule 10 would specify that the Covered Entity's
cybersecurity risk management policies and procedures must include
measures designed to detect, respond to, and recover from a
cybersecurity incident.\246\ Further, the rule would require that these
measures include policies and procedures that are reasonably designed
to ensure: (1) the continued operations of the Covered Entity; (2) the
protection of the Covered Entity's information systems and the
information residing on those systems; \247\ (3) external and internal
cybersecurity incident information sharing and communications; and (4)
the reporting of significant cybersecurity incidents pursuant to the
requirements of paragraph (c) of proposed Rule 10 discussed below.\248\
---------------------------------------------------------------------------

    \246\ See paragraph (b)(1)(v) of proposed Rule 10; paragraph
(c)(2) of proposed Rule 10 (defining the term ``cybersecurity
incident''). See generally NIST Framework (providing that the fourth
core element of the framework is ``respond''--meaning develop and
implement appropriate activities to take action regarding a detected
cybersecurity incident; and providing that the fifth core element of
the framework is ``recover''--meaning develop and implement
appropriate activities to maintain plans for resilience and to
restore any capabilities or services that were impaired due to a
cybersecurity incident).
    \247\ See paragraphs (a)(6) and (7) of proposed Rule 10
(defining, respectively, the terms ``information'' and ``information
systems'').
    \248\ See section II.B.2. of this release (discussing the
requirements to report significant cybersecurity incidents);
paragraph (a)(10) of proposed Rule 10 (defining the term
``significant cybersecurity incident''). See generally CISA Cyber
Essentials Starter Kit (stating regarding response and recovery that
the objective is to limit damage and accelerate restoration of
normal operations and, to this end, organizations (among other
things) can: (1) leverage business impact assessments to prioritize
resources and identify which systems must be recovered first; (2)
``learn who to call for help (e.g., outside partners, vendors,
government/industry responders, technical advisors and law
enforcement);'' (3) develop an internal reporting structure to
detect, communicate and contain attacks; and (4) develop in-house
containment measures to limit the impact of cyber incidents when
they occur); IOSCO Cybersecurity Report (``Regulated entities
generally should consider developing response plans for those types
of incidents to which the organization is most likely to be subject.
Elements associated with response plans may include: preparing
communication/notification plans to inform relevant stakeholders;
conducting forensic analysis to understand the anatomy of a breach
or an attack; maintaining a database recording cyber attacks; and
conducting cyber drills, firm specific simulation exercises as well
as industry-wide scenario exercises.'').
---------------------------------------------------------------------------

    Cybersecurity incidents can lead to significant business
disruptions, including losing the ability to send internal or external
communications, transmit information, or connect to internal or
external systems necessary to carry out the Covered Entity's critical
functions and provide services to customers, counterparties, members,
registrants, or users.\249\ They also can lead to the inability to
access accounts holding cash or other financial assets of the Covered
Entity or its customers, counterparties, members, registrants, or
users.\250\ Therefore, the proposed incident response and recovery
policies and procedures are designed to place the Covered Entity in a
position to respond to a cybersecurity incident, which should help to
reduce business disruptions and other harms the incident may cause the
Covered Entity or its customers, counterparties, members, registrants,
or users. A cybersecurity program with a clear incident response plan
designed to ensure continued operational capability, and the protection
of, and access to, personal, confidential, or proprietary information
and data, even if a Covered Entity loses access to its systems, would
assist in mitigating the effects of a cybersecurity incident.\251\ A
Covered Entity, therefore, may wish to consider maintaining physical
copies of its incident response plan--and other cybersecurity policies
and procedures--to help ensure they can be accessed and implemented
during a cybersecurity incident.
---------------------------------------------------------------------------

    \249\ See sections I.A.1. and I.A.2. of this release (discussing
these consequences).
    \250\ Id.
    \251\ See generally CISA Cyber Essentials Starter Kit (``Plan,
prepare, and conduct drills for cyber-attacks and incidents as you
would a fire or robbery. Make your reaction to cyber incidents or
system outages an extension of your other business contingency
plans. This involves having incident response plans and procedures,
trained staff, assigned roles and responsibilities, and incident
communications plans.'').
---------------------------------------------------------------------------

    Covered Entities generally should focus on operational capability
in creating reasonably designed policies and procedures to ensure their
continued operations in the event of a cybersecurity incident (e.g.,
the ability to withstand a DoS attack). The objective is to place
Covered Entities in a position to be able to continue providing
services to other Market Entities and other participants in the U.S.
securities markets (including investors) and, thereby, continue to
support the fair, orderly, and efficient

operation of the U.S. securities markets. For example, this requirement
is designed to place Covered Entities in a position to be able to
continue to perform market and member surveillance and oversight in the
case of SROs, clearance and settlement in the case of clearing
agencies, and brokerage or dealing activities in the case of broker-
dealers and SBSDs.
    The ability of Covered Entities to recover from a cybersecurity
incident in a timeframe that minimizes disruptions to their business or
regulatory activities is critically important to the fair, orderly, and
efficient operations of the U.S. securities markets and, therefore, to
the U.S. economy, investors, and capital formation. A Covered Entity
generally should consider implementing safeguards, such as backing up
data, which can help facilitate a prompt recovery that allows the
Covered Entity to resume operations following a cybersecurity
incident.\252\ A Covered Entity also generally should consider whether
to designate personnel to perform specific roles in the case of a
cybersecurity incident. This could entail identifying and/or hiring
personnel or third parties who have the requisite cybersecurity and
recovery expertise (or are able to coordinate effectively with outside
experts) as well as identifying personnel who should be kept informed
throughout the response and recovery process. In addition, a Covered
Entity could consider an escalation protocol in its incident response
plan to ensure that its senior officers, including appropriate legal
and compliance personnel, receive necessary information regarding
cybersecurity incidents on a timely basis.\253\
---------------------------------------------------------------------------

    \252\ See generally CISA Cyber Essentials Starter Kit
(``Leverage protections for backups, including physical security,
encryption and offline copies. Ensure the backed-up data is stored
securely offsite or in the cloud and allows for at least seven days
of incremental rollback. Backups should be stored in a secure
location, especially if you are prone to natural disasters.
Periodically test your ability to recover data from backups. Online
and cloud storage backup services can help protect against data loss
and provide encryption as an added level of security. Identify key
files you need access to if online backups are unavailable to access
your files when you do not have an internet connection.'').
    \253\ See generally CISA Cyber Essentials Starter Kit (stating
that: (1) organizations should develop an internal reporting
structure to detect, communicate, and contain attacks and that
effective communication plans focus on issues unique to security
breaches; (2) a standard reporting procedure will reduce confusion
and conflicting information between leadership, the workforce, and
stakeholders; and (3) communication should be continuous, since most
data breaches occur over a long period of time and not instantly and
that it should come from top leadership to show commitment to action
and knowledge of the situation).
---------------------------------------------------------------------------

    Moreover, as discussed in further detail below, under proposed Rule
10, a Covered Entity would need to give the Commission immediate
written electronic notice of a significant cybersecurity incident after
having a reasonable basis to conclude that the incident has occurred or
is occurring.\254\ Further, the Covered Entity would need to report
information about the significant cybersecurity incident promptly, but
no later than 48 hours, after having a reasonable basis to conclude
that the incident has occurred or is occurring by filing Part I of
proposed Form SCIR with the Commission.\255\ Thereafter, the Covered
Entity would need to file an amended Part I of proposed Form SCIR with
the Commission under certain circumstances.\256\ Accordingly, proposed
Rule 10 would require the Covered Entity to include in its incident
response and recovery policies and procedures measures designed to
ensure compliance with these notification and reporting
requirements.\257\ The Covered Entity also may wish to implement a
process to determine promptly whether and how to contact local and
Federal law enforcement authorities, such as the FBI, about an
incident.\258\
---------------------------------------------------------------------------

    \254\ See paragraph (c)(1) of proposed Rule 10. See also section
II.B.2. of this release (discussing this proposed notification
requirement in more detail).
    \255\ See paragraph (c)(2) of proposed Rule 10. See also section
II.B.2. of this release (discussing this proposed reporting
requirement in more detail).
    \256\ The circumstances under which an amended Part I of
proposed Form SCIR would need to be filed are discussed below in
section II.B.2. of this release.
    \257\ See paragraph (b)(1)(v)(A)(4) of proposed Rule 10.
    \258\ For example, the FBI has instructed individuals and
organizations to contact their nearest FBI field office to report
cybersecurity incidents or to report them online at https://www.ic3.gov/Home/FileComplaint. See FBI, What We Investigate, Cyber
Crime, available at https://www.fbi.gov/investigate/cyber. See also
CISA Cyber Essentials Starter Kit (``As part of your incident
response, disaster recovery, and business continuity planning
efforts, identify and document partners you will call on to help.
Consider building these relationships in advance and understand what
is required to obtain support. CISA and the Federal Bureau of
Investigation (FBI) provide dedicated hubs for helping respond to
cyber and critical infrastructure attacks. Both have resources and
guidelines on when, how, and to whom an incident is to be reported
in order to receive assistance. You should also file a report with
local law enforcement, so they have an official record of the
incident.'').
---------------------------------------------------------------------------

    A Covered Entity also could consider including periodic testing
requirements in its incident response and recovery policies and
procedures.\259\ These tests could assess the efficacy of the policies
and procedures to determine whether any changes are necessary, for
example, through tabletop or full-scale exercises. Relatedly, proposed
Rule 10 would require that the incident response and recovery policies
and procedures include written documentation of a cybersecurity
incident, including the Covered Entity's response to and recovery from
the incident.\260\ This record could be used by the Covered Entity to
assess the efficacy of, and adherence to, its incident response and
recovery policies and procedures. It further could be used as a
``lessons-learned'' document to help the Covered Entity respond more
effectively the next time it experiences a cybersecurity incident. The
Commission staff and SRO staff also would use the records to review
compliance with this aspect of proposed Rule 10.
---------------------------------------------------------------------------

    \259\ See generally CISA Cyber Essentials Starter Kit (``Lead
development of an incident response and disaster recovery plan
outlining roles and responsibilities. Test it often. Incident
response plans and disaster recovery plans are crucial to
information security, but they are separate plans. Incident response
mainly focuses on information asset protection, while disaster
recovery plans focus on business continuity. Once you develop a
plan, test the plan using realistic simulations (known as ``war-
gaming''), where roles and responsibilities are assigned to the
people who manage cyber incident responses. This ensures that your
plan is effective and that you have the appropriate people involved
in the plan. Disaster recovery plans minimize recovery time by
efficiently recovering critical systems.'').
    \260\ See paragraph (b)(1)(v)(B) of proposed Rule 10.
---------------------------------------------------------------------------

f. Annual Review and Required Written Reports
    In addition to requiring a Covered Entity to establish, maintain,
and enforce written policies and procedures to address cybersecurity
risk, proposed Rule 10 would require the Covered Entity, at least
annually, to: (1) review and assess the design and effectiveness of the
cybersecurity policies and procedures, including whether the policies
and procedures reflect changes in cybersecurity risk over the time
period covered by the review; and (2) prepare a written report that
describes the review, the assessment, and any control tests performed,
explains their results, documents any cybersecurity incident that
occurred since the date of the last report, and discusses any material
changes to the policies and procedures since the date of the last
report.\261\ The annual review requirement is designed to require the
Covered Entity to evaluate whether its cybersecurity policies and
procedures continue to work as designed. In making this assessment,
Covered Entities generally should consider whether changes are needed
to ensure their continued effectiveness, including oversight of any
delegated responsibilities. As discussed earlier, the sophistication of
the tactics,

techniques, and procedures employed by threat actors is
increasing.\262\ The review requirement is designed to impose a
discipline on Covered Entities to be vigilant in assessing whether
their cybersecurity risk management policies and procedures continue to
be reasonably designed to address this risk.
---------------------------------------------------------------------------

    \261\ See paragraph (b)(2) of proposed Rule 10.
    \262\ See section I.A.1. of this release (discussing, for
example, how cybersecurity threats are evolving); see also Bank of
England CBEST Report (stating that ``[t]he threat actor community,
once dominated by amateur hackers, has expanded to include a broad
range of professional threat actors, all of whom are strongly
motivated, organised and funded'').
---------------------------------------------------------------------------

    The review would need to be conducted no less frequently than
annually. As discussed above, one of the required elements that would
need to be included in the policies and procedures is the requirement
to perform periodic assessments of cybersecurity risks associated with
the covered entity's information systems and information residing on
those systems.\263\ Based on the findings of those risk assessments, a
Covered Entity could consider whether to perform a review prior to the
one-year anniversary of the last review. In addition, the occurrence of
a cybersecurity incident or significant cybersecurity incident
impacting the Covered Entity or other entities could cause the Covered
Entity to consider performing a review before the next annual review is
required.
---------------------------------------------------------------------------

    \263\ See paragraph (b)(1)(i) of proposed Rule 10. See also
section II.B.1.a. of this release (discussing the assessment
proposal in more detail).
---------------------------------------------------------------------------

    The Covered Entity would need to document the review in a written
report.\264\ The required written report generally should be prepared
or overseen by the persons who administer the Covered Entity's
cybersecurity program. This report requirement is designed to assist
the Covered Entity in evaluating the efficacy of organization's
cybersecurity risk management policies and procedures. Additionally,
the requirement to review and assess the design and effectiveness of
the cybersecurity policies and procedures includes whether they reflect
changes in cybersecurity risk over the time period covered by the
review. Therefore, the Covered Entity generally would need to take into
account the periodic assessments of cybersecurity risks performed
pursuant to the requirements of paragraphs (b)(1)(i)(A) and
(b)(1)(iii)(A) of proposed Rule. This could provide Covered Entities
with valuable insights into potential enhancements to the policies and
procedures to keep them up-to-date (i.e., reasonably designed to
address emerging cybersecurity threats). For example, incorporating the
cybersecurity risk assessments into the required written report could
provide senior officers who review the report with information on the
specific risks identified in the assessments. This could lead them to
ask questions and seek relevant information regarding the effectiveness
of the Covered Entity's cybersecurity risk management policies and
procedures and its implementation in light of those risks. This could
include questions as to whether the Covered Entity has adequate
resources with respect to cybersecurity matters, including access to
cybersecurity expertise.
---------------------------------------------------------------------------

    \264\ See paragraph (b)(2)(ii) of proposed Rule 10.
---------------------------------------------------------------------------

g. Request for Comment
    The Commission requests comment on all aspects of the requirements
that Covered Entities establish, maintain, and enforce written policies
and procedures to address their cybersecurity risks, the elements that
would need to be included in the cybersecurity risk management policies
and procedures, and the required (at least) annual review of the
cybersecurity risk management policies and procedure under paragraph
(b) of proposed Rule 10. In addition, the Commission is requesting
comment on the following specific aspects of the proposals:
    21. In designing the cybersecurity risk management policies and
procedures requirements of proposed Rule 10, the Commission considered
a number of sources cited in the sections above, including, in
particular, the NIST Framework and the CISA Cyber Essentials Starter
Kit. Are there other sources the Commission should use? If so, identify
them and explain why they should be considered and how they could
inform potential modifications to the cybersecurity risk management
policies and procedures requirements.
    22. Should the policies and procedures requirements of paragraph
(b)(1) of proposed Rule 10 be modified? For example, are there other
elements that should be included in cybersecurity risk management
policies and procedures? If so, identify them and explain why they
should be included. Should any of the minimum required elements be
eliminated? If so, identify them and explain why it would be
appropriate to eliminate them from the rule.
    23. Should the policies and procedures requirements of paragraph
(b)(1) of proposed Rule 10 be modified to provide more flexibility in
how a Covered Entity implements them? If so, identify the requirements
that are too prescriptive and explain why and suggest ways to make them
more flexible without undermining the objective of having Covered
Entities adequately address cybersecurity risks.
    24. Should the policies and procedures requirements of paragraph
(b)(1) of proposed Rule 10 be modified to provide less flexibility in
how a Covered Entity had to implement them? If so, identify the
requirements that should be more prescriptive and explain why and
suggest ways to make them more prescriptive without undermining the
objective of having Covered Entities implement cybersecurity risk
management policies and procedures that address their particular
circumstances.
    25. Should the policies and procedures requirements of paragraph
(b)(1) of proposed Rule 10 be deemed to be reasonably designed if they
are consistent with industry standards comprised of cybersecurity risk
management practices that are widely available to cybersecurity
professionals in the financial sector and issued by an authoritative
body that is a U.S. governmental entity or agency, association of U.S.
governmental entities or agencies, or widely recognized organization?
If so, identify the standard or standards and explain why it would be
appropriate to deem the policies and procedures requirements of
paragraph (b)(1) of proposed Rule 10 reasonably designed if they are
consistent with the standard or standards.
    26. The policies and procedures requirements of paragraph (b)(1) of
proposed Rule 10 would require Covered Entities to cover
``information'' and ``information systems'' as defined, respectively,
in paragraphs (a)(6) and (7) of proposed Rule 10 without limitation.
Should the proposed policies and procedures requirements of paragraph
(b)(1) of proposed Rule 10 be modified to address a narrower set of
information and information systems? If so, describe how the narrower
set of information and information systems should be defined and why it
would be appropriate to limit the policies and procedures requirements
to this set of information and information systems. For example, should
the policies and procedures requirements of paragraph (b)(1) of
proposed Rule 10 be limited to information and information systems
that, if compromised, would result in, or would be reasonably likely to
result in, harm to the Covered Entity or others? If so, explain why. If
not, explain why not. Is there another way to limit the application of
the policies and procedures requirements to certain information and
information systems that would not undermine the objective

that Covered Entities implement policies and procedures that adequately
address their cybersecurity risks? If so, explain how.
    27. Should the requirements of paragraph (b)(1)(i) of proposed Rule
10 relating to periodic assessments of the cybersecurity risks
associated with the Covered Entity's information systems and
information residing on those systems be modified? If so, explain why.
If not, explain why not.
    28. Should the requirements of paragraph (b)(1)(i)(A)(1) of
proposed Rule 10 relating to categorizing and prioritizing
cybersecurity risks based on an inventory of the components of the
Covered Entity's information systems and information residing on those
systems and the potential effect of a cybersecurity incident on the
Covered Entity be modified? If so, explain why. If not, explain why
not.
    29. Should the requirements of paragraph (b)(1)(i)(A)(2) of
proposed Rule 10 relating to identifying the Covered Entity's service
providers that receive, maintain, or process information, or are
otherwise permitted to access the Covered Entity's information systems
and any of the Covered Entity's information residing on those systems,
and assess the cybersecurity risks associated with the Covered Entity's
use of these service providers be modified? If so, explain why. If not,
explain why not. Certain Covered Entities may use data feeds from
third-party providers that do not receive, maintain, or process
information for the Covered Entity but that could nonetheless cause
significant disruption for the Covered Entity if they were the subject
of a cybersecurity incident. For example, broker-dealers may subscribe
to third-party data feeds to satisfy their obligations for best
execution under the federal securities laws. If a third-party provider
of data feeds experienced a cybersecurity breach, it could lead to
faulty market information being shared with the broker-dealer, which
could in turn impact the broker-dealer's ability to operate and execute
trades for its customers. Likewise, SBS Entities might rely on data
from counterparties. Should the Commission require the risk assessment
to include service providers that provide data feeds to Covered
Entities but do not otherwise have access to the Covered Entities'
information systems? If so, should the risk assessment be limited to
only those third parties who provide data critical to the Covered
Entity's business operations? Are there other cybersecurity risks
associated with utilizing a third party who provides data feeds that
should be addressed? If so, identify the risks and explain how they
could be addressed.
    30. Should the requirements of paragraph (b)(1)(i)(B) of proposed
Rule 10 relating to requiring written documentation of the risk
assessments required by paragraph (b)(1)(i)(A) of proposed Rule 10 be
modified? If so, explain why. If not, explain why not.
    31. Should the requirements of paragraph (b)(1)(ii) of proposed
Rule 10 relating to controls designed to minimize user-related risks
and prevent unauthorized access to the Covered Entity's information
systems and the information residing on those systems? If so, explain
why. If not, explain why not. Should requirements of paragraph
(b)(1)(ii) of proposed Rule 10 be modified to revise the requirement to
include the following identified controls: (1) controls requiring
standards of behavior for individuals authorized to access the Covered
Entity's information systems and the information residing on those
systems, such as an acceptable use policy; (2) controls identifying and
authenticating individual users, including but not limited to
implementing authentication measures that require users to present a
combination of two or more credentials for access verification; (3)
controls establishing procedures for the timely distribution,
replacement, and revocation of passwords or methods of authentication;
(4) controls restricting access to specific information systems of the
Covered Entity or components thereof and the information residing on
those systems solely to individuals requiring access to the systems and
information as is necessary for them to perform their responsibilities
and functions on behalf of the Covered Entity; and (5) securing remote
access technologies? If so, explain why. If not, explain why not. For
example, should this paragraph of the proposed rule be modified to
include any additional type of controls? If so, identify the controls
and explain why they should be included. Should the text of the
proposed controls be modified? For example, should the control
pertaining to the timely distribution, replacement, and revocation of
passwords or methods of authentication use a word other than
``distribution''? If so, explain why and suggest an alternative word
that would be more appropriate. Would ``establishment'' or ``setting
up'' be more appropriate in this context? Should this paragraph of the
proposed rule be modified to eliminate any of the identified controls?
If so, identify the control and explain why it should be eliminated.
For example, could the control pertaining to implementing
authentication measures requiring users to present a combination of two
or more credentials for access verification potentially become
obsolete? If so, explain why and suggest an alternative control that
could incorporate this requirement as well as other authentication
controls that may develop in the future.
    32. CISA has developed a catalog of cyber ``bad practices'' that
are exceptionally risky and can increase risk to an organization's
critical infrastructure.\265\ These bad practices include the use of
unsupported (or end-of-life) software, use of known or default
passwords and credentials, and the use of single-factor authentication.
In addition, the Federal Financial Institutions Examination Council
(``FFIEC'') has issued guidance on authentication and access to
financial institution services and systems, and suggests that the use
of single-factor authentication as a control mechanism has shown to be
inadequate against certain cyber threats and adverse impacts from
ransomware, customer account fraud, and identity theft.\266\ Instead,
the FFIEC guidance suggests the use of multi-factor authentication and
other measures, such as specific authentication solutions, password
controls, and access and transaction controls. Should paragraph
(b)(1)(ii) of proposed Rule 10 be modified to specifically require
controls that users provide multi-factor authentication before they can
access an information system of the Covered Entity? If so, explain why.
If not, explain why not. Would it be appropriate to require multi-
factor authentication for all of the Covered Entity's information
systems or for a more limited set of information systems? For example,
should multi-factor authentication be required for public-facing
information systems such as applications that provide users access to
their accounts at the Covered Entity and not required for internal
information systems used by the Covered Entity's employees? If so,
explain why. If not, explain why not.

Should multi-factor authentication be required regardless of whether
the information system is public facing if personal, confidential, or
proprietary information resides on the information system? If so,
explain why. If not, explain why not. Should the rule require phishing-
resistant multi-factor authentication? If so, explain why. If not,
explain why not.
---------------------------------------------------------------------------

    \265\ See CISA, Bad Practices, available at https://www.cisa.gov/BadPractices.
    \266\ See FFIEC, Authentication and Access to Financial
Institution Services and Systems (Aug. 2021), available at https://www.ffiec.gov/guidance/Authentication-and-Access-to-Financial-Institution-Services-and-Systems.pdf. See also FDIC and the Office
of the Comptroller of the Currency (``OCC''), Joint Statement on
Heightened Cybersecurity Risk (Jan. 16, 2020), available at https://www.occ.gov/news-issuances/bulletins/2020/bulletin-2020-5a.pdf
(noting that identity and access management controls include
multifactor authentication to segment and safeguard access to
critical systems and data on an organization's network).
---------------------------------------------------------------------------

    33. Should the requirements of paragraph (b)(1)(iii)(A) of proposed
Rule 10 relating to measures designed to monitor the Covered Entity's
information systems and protect the information residing on those
systems from unauthorized access or use be modified? For example,
should the requirements of paragraph (b)(1)(iii)(A) of proposed Rule 10
specifically require encryption of certain information residing on the
Covered Entity's information systems? If so, explain why. If not,
explain why not.
    34. The measures discussed in paragraph (b)(1)(iii)(A) of proposed
Rule 10 designed to monitor the Covered Entity's information systems
and protect the information residing on those systems from unauthorized
access or use would need to be based on a periodic assessment of the
Covered Entity's information systems and the information that resides
on the systems that takes into account: (1) the sensitivity level and
importance of the information to Covered Entity's business operations;
(2) whether any of the information is personal information; (3) where
and how the information is accessed, stored and transmitted, including
the monitoring of information in transmission; (4) the information
systems' access controls and malware protection; and (5) the potential
effect a cybersecurity incident involving the information could have on
the Covered Entity and its customers, counterparties, members, or
users, including the potential to cause a significant cybersecurity
incident. Should this paragraph of the proposed rule be modified to
include any additional factors that would need to be taken into
account? If so, identify the factors and explain why they should be
taken into account. Should this paragraph of the proposed rule be
modified to eliminate any of the identified factors that should be
taken into account? If so, identify the factors and explain why they
should be eliminated.
    35. Should the requirements of paragraph (b)(1)(iii)(A) of proposed
Rule 10 relating periodic assessments of the Covered Entity's
information systems and information residing of the systems be modified
to specifically require periodic (e.g., semi-annual or annual)
penetration tests? If so, explain why. If not, explain why not. If
proposed Rule 10 should be modified to require periodic penetration
tests, should the rule specify the information systems and information
to be tested? If so, explain why. If not, explain why not. For example,
should the penetration tests be performed on all information systems
and information of the Covered Entity? Alternatively, should the
penetration tests be performed: (1) on a random selection of
information systems and information; (2) on a prioritized selection of
the information systems and information residing on them that are most
critical to the Covered Entity's functions or that maintain information
that if accessed by or disclosed to persons not authorized to view it
could cause the most harm to the Covered Entity or others; and/or (3)
on information systems for which the Covered Entity has identified
vulnerabilities pursuant to the requirements of paragraph (b)(1)(iv) of
proposed Rule 10? Please explain the advantages and disadvantages of
each potential approach to requiring penetration tests.
    36. Should the requirements of paragraph (b)(1)(iii)(B) of proposed
Rule 10 relating to the oversight of service providers that receive,
maintain, or process the Covered Entity's information, or are otherwise
permitted to access the Covered Entity's information systems and the
information residing on those systems, pursuant to a written contract
between the covered entity and the service provider, through which the
service providers are required to implement and maintain appropriate
measures, including the practices described in paragraphs (b)(1)(i)
through (v) of proposed Rule 10, that are designed to protect the
Covered Entity's information systems and information residing on those
systems be modified? If so, explain why. If not, explain why not. For
example, would there be practical difficulties with implementing the
requirement to oversee the service providers through a written
contract? If so, explain why. If not, explain why not. Are there
alternative approaches to addressing the cybersecurity risk that arises
when Covered Entities use service providers? If so, describe them and
explain why they would be appropriate in terms of addressing this risk.
For example, rather than addressing this risk through written contract,
could it be addressed through policies and procedures to obtain written
assurances or certifications from service providers that the service
provider manages cybersecurity risk in a manner that would be
consistent with how the Covered Entity would need to manage this risk
under paragraph (b) of proposed Rule 10? If so, explain why and
describe the type of assurances or certifications Covered Entities
could reasonably obtain to ensure that their service providers are
taking appropriate measures to manage cybersecurity risk? In
responding, please explain how assurances or certifications would be an
appropriate alternative to written contracts in terms of addressing the
cybersecurity risk caused by the use of service providers.
    37. Should the requirements of paragraph (b)(1)(iv) of proposed
Rule 10 relating to measures designed to detect, mitigate, and
remediate any cybersecurity threats and vulnerabilities with respect to
the Covered Entity's information systems and the information residing
on those systems be modified? If so, explain why. If not, explain why
not.
    38. Should the requirements of paragraph (b)(1)(v)(A) of proposed
Rule 10 relating to measures designed to detect, respond to, and
recover from a cybersecurity incident be modified? If so, explain why.
If not, explain why not. For example, these measures would need to
include policies and procedures that are reasonably designed to ensure:
(1) the continued operations of the covered entity; (2) the protection
of the Covered Entity's information systems and the information
residing on those systems; (3) external and internal cybersecurity
incident information sharing and communications; and (4) the reporting
of significant cybersecurity incidents pursuant to paragraph (c) of
proposed Rule 10. Would these four specific design objectives required
of the policies and procedures place the Covered Entity in a position
to effectively detect, respond to, and recover from a cybersecurity
incident? If so, explain why. If not, explain why not. Should this
paragraph of the proposed rule be modified to include any additional
design objectives for these policies and procedures? If so, identify
the design objectives and explain why they should be included. For
example, should the rule require policies and procedures that are
designed to recover from a cybersecurity incident within a specific
timeframe such as 24, 48, or 72 hours or some other period? If so,
identify the recovery period and explain why it would be appropriate.
Should this paragraph of the proposed rule be modified to eliminate any
of the specified design objectives? If so, identify the design
objectives and explain why they should be eliminated.

    39. Should the requirements of paragraph (b)(1)(v)(B) of proposed
Rule 10 relating to written documentation of any cybersecurity
incidents be modified? If so, explain why. If not, explain why not. For
example, should the written documentation requirements apply to a
narrower set of incidents than those that would meet the definition of
``cybersecurity incident'' under proposed Rule 10? If so, describe the
narrower set of incidents and explain why it would be appropriate to
limit the written documentation requirements to them.
    40. Should the requirements of paragraph (b)(2) of proposed Rule 10
relating to the review and assessment of the policies and procedures
and a written report of the review by modified? If so, explain why. If
not, explain why not. For example, this paragraph would require: (1) a
review and assessment of the design and effectiveness of the
cybersecurity risk management policies and procedures, including
whether the policies and procedures reflect changes in cybersecurity
risk over the time period covered by the review; and (2) the
preparation of a written report that describes the review, the
assessment, and any control tests performed, explains their results,
documents any cybersecurity incident that occurred since the date of
the last report, and discusses any material changes to the policies and
procedures since the date of the last report. Should the review
requirement be modified to provide greater flexibility based on the
Covered Entity's assessment of what it believes would be most effective
in light of its cybersecurity risks? If so, explain why. If not,
explain why not. Should the review, assessment, and report be required
on a more frequent basis such as quarterly? If so, explain why. If not,
explain why not. Should the review, assessment, and report requirement
be triggered after certain events regardless of when the previous
review was conducted? If so, explain why. If not, explain why not. For
example, should the requirement be triggered if the Covered Entity
experiences a significant cybersecurity incident or undergoes a
significant business event such as a merger, acquisition, or the
commencement of a new business line that relies on information systems?
If so, explain why and suggest how a ``significant business event''
should be defined for the purposes of the review and assessment
requirement. If not, explain why not. Should the rule require that
persons with a minimum level of cybersecurity expertise or experience
must perform the review and assessment or that the review and
assessment must be performed by a senior officer of the Covered Entity?
If so, explain why. If not, explain why not. Should the rule require
that the review and assessment be performed by personnel who are not
involved in designing and implementing the cybersecurity policies and
procedures? If so, explain why. If not, explain why not. Should the
rule require that the annual report be subject to periodic third-party
audits or reviews? If so, explain why. If not, explain why not. Should
the Commission provide guidance to clarify how the review and report
requirements of paragraph (b)(2) proposed Rule 10 interact with the
requirements that SBS Entities perform assessments under 17 CFR
240.15Fk-1 or reviews under 17 CFR 250.15c3-4(c)(3)? If so, explain
why. If not, explain why not.
2. Notification and Reporting of Significant Cybersecurity Incidents
a. Timing and Manner of Notification and Reporting
    FSOC observed that ``[s]haring timely and actionable cybersecurity
information can reduce the risk that cybersecurity incidents occur and
can mitigate the impacts of those that do occur.'' \267\ The Commission
is proposing to require that Covered Entities provide immediate notice
and subsequent reports about significant cybersecurity incidents to the
Commission and, in the case of certain Covered Entities, other
regulators. The objective is to improve the Commission's ability to
monitor and evaluate the effects of a significant cybersecurity
incident on Covered Entities and their customers, counterparties,
members, registrants, or users, as well as assess the potential risks
affecting financial markets more broadly.
---------------------------------------------------------------------------

    \267\ FSOC 2021 Annual Report.
---------------------------------------------------------------------------

    For these reasons, proposed Rule 10 would require a Covered Entity
to provide immediate written electronic notice to the Commission of a
significant cybersecurity incident upon having a reasonable basis to
conclude that the incident has occurred or is occurring.\268\ The
Commission would keep the notices nonpublic to the extent permitted by
law. The notice would need to identify the Covered Entity, state that
the notice is being given to alert the Commission of a significant
cybersecurity incident impacting the Covered Entity, and provide the
name and contact information of an employee of the Covered Entity who
can provide further details about the nature and scope of the
significant cybersecurity incident.
---------------------------------------------------------------------------

    \268\ See paragraph (c)(1) of proposed Rule 10. See also
paragraph (a)(10) of proposed Rule 10 (defining the term
``significant cybersecurity incident''). As discussed below in
section II.C. of this release, Non-Covered Broker-Dealers would be
subject to an identical immediate written electronic notice
requirement. See paragraph (e)(2) of proposed Rule 10. If proposed
Rule 10 is adopted, it is anticipated that a dedicated email address
would be set up to receive the notices from Covered Entities and
Non-Covered Broker-Dealers. See, e.g., Staff Guidance for Filing
Broker-Dealer Notices, Statements and Reports, available at https://www.sec.gov/divisions/marketreg/bdnotices; Staff Statement on
Submitting Notices, Statements, Applications, and Reports for
Security-Based Swap Dealers and Major Security-Based Swap
Participants Pursuant to the Financial Responsibility Rules
(Exchange Act Rules 18a-1 through 18a-10), available at https://www.sec.gov/tm/staff-statement-on-submissions.
---------------------------------------------------------------------------

    The immediate notice would need to be submitted by the Covered
Entity electronically in written form (as opposed to permitting the
notice to made telephonically).\269\ The Commission is proposing a
written notification requirement because of the number of Market
Entities that would be subject to the requirement and because of the
different types of Market Entities.\270\ A written notification would
also facilitate the Commission in identifying patterns and trends
across Market Entities experiencing significant cybersecurity
incidents.
---------------------------------------------------------------------------

    \269\ See paragraph (c)(1) of proposed Rule 10. But see 17 CFR
242.1002(b)(1) (requiring an SCI entity to provide the Commission
with immediate notice after having a reasonable basis to conclude
that an SCI event has occurred without specifying that the notice be
written); OCC, Federal Reserve Board, FDIC, Computer-Security
Incident Notification Requirements for Banking Organizations and
Their Bank Service Providers, 86 FR 66424 (Nov. 23, 2021) (requiring
a banking organization to provide notice to a designated point of
contact of a computer-security incident through telephone, email, or
similar methods).
    \270\ Non-Covered Broker-Dealers also would be subject to an
immediate written electronic notice requirement under paragraph
(e)(2) of proposed Rule 10 and, therefore, the Commission
potentially could receive notices from all types of Market Entities.
As discussed in section V.C. of this release, it is estimated that
1,989 Market Entities would be Covered Entities and 1,969 broker-
dealers would be Non-Covered Entities resulting in a 3,958 total
Market Entities. This is a far larger number of entities than the 47
entities that currently are SCI entities.
---------------------------------------------------------------------------

    The notice requirement would be triggered when the Covered Entity
has a reasonable basis to conclude that a significant cybersecurity
incident has occurred or is occurring.\271\ This does not mean that the
Covered Entity can wait until it definitively concludes that

a significant cybersecurity incident has occurred or is occurring. In
the early stages of discovering the existence of a cybersecurity
incident, it may not be possible for the Covered Entity to conclude
definitively that it is a significant cybersecurity incident. For
example, the Covered Entity may need to assess which information
systems have been subject to the cybersecurity incident and the impact
that the incident has had on those systems before definitively
concluding that it is a significant cybersecurity incident.\272\ The
objective of the notification requirement is to alert the Commission
staff as soon as the Covered Entity detects the existence of a
cybersecurity incident that it has a reasonable basis to conclude is a
significant cybersecurity incident and not to wait until the Covered
Entity definitively concludes it is a significant cybersecurity
incident. This would provide the Commission staff with the ability to
begin to assess the situation at an earlier stage of the cybersecurity
incident.
---------------------------------------------------------------------------

    \271\ The notice requirement for Non-Covered Broker-Dealers also
would be triggered when the broker-dealer has a reasonable basis to
conclude that a significant cybersecurity incident has occurred or
is occurring. See paragraph (e)(2) of proposed Rule 10.
    \272\ See paragraph (a)(2) of proposed Rule 10 (defining
``cybersecurity incident'' to mean an unauthorized occurrence on or
conducted through a Market Entity's information systems that
jeopardizes the confidentiality, integrity, or availability of the
information systems or any information residing on those systems).
---------------------------------------------------------------------------

    This proposed immediate written notification requirement is
modelled on other notification requirements that apply to broker-
dealers and SBSDs pursuant to other Exchange Act rules. Under these
existing requirements, broker-dealers and certain SBSDs must provide
the Commission with same-day written notification if they undergo
certain adverse events, including falling below their minimum net
capital requirements or failing to make and keep current required books
and records.\273\ The objective of these requirements is to provide the
Commission staff with the opportunity to respond when a broker-dealer
or SBSD is in financial or operational difficulty.\274\ Similarly, the
written notification requirements of proposed Rule 10 are designed to
provide the Commission staff with the opportunity to begin assessing
the situation promptly when a Covered Entity is experiencing a
significant cybersecurity incident by, for example, assessing the
Covered Entity's operating status and engaging in discussions with the
Covered Entity to understand better what steps it is taking to protect
its customers, counterparties, members, registrants, or users. In
addition, a Covered Entity that is a broker-dealer would need to
provide the written notice to its examining authority, and a transfer
agent would need to provide the written notice to its ARA.\275\ The
objective is to notify other supervisory authorities to allow them the
opportunity to respond to the significant cybersecurity incident
impacting the Covered Entity.
---------------------------------------------------------------------------

    \273\ See 17 CFR 240.17a-11 (notification rule for broker-
dealers); 17 CFR 240.18a-8 (notification rule for SBS Entities).
    \274\ See Recordkeeping and Reporting Requirements for Security-
Based Swap Dealers, Major Security-Based Swap Participants, and
Broker-Dealers; Capital Rule for Certain Security-Based Swap
Dealers, Exchange Act Release No. 71958 (Apr. 17, 2014) [79 FR
25194, 25247 (May 2, 2014)] (``SBS Entity Recordkeeping and
Reporting Proposing Release'').
    \275\ See paragraphs (c)(1)(i) and (ii) of proposed Rule 10.
Non-Covered Broker-Dealers also would be required to provide the
written notice to their examining authority. See paragraph (e)(2) of
proposed Rule 10.
---------------------------------------------------------------------------

    As discussed above, the immediate written electronic notice is
designed to alert the Commission on a confidential basis to the
existence of a significant cybersecurity incident impacting a Covered
Entity so the Commission staff can begin to assess the event. It is not
intended as a means to report written information about the significant
cybersecurity incident. Therefore, in addition to the immediate written
electronic notice, a Covered Entity would be required to report
detailed information about the significant cybersecurity incident by
filing, on a confidential basis, Part I of proposed Form SCIR with the
Commission through the Electronic Data Gathering, Analysis, and
Retrieval System (``EDGAR'' or ``EDGAR system'').\276\ Because of the
sensitive nature of the information and the fact that threat actors
could potentially use it to cause more harm, the Commission would not
make the filings available to the public to the extent permitted by
law.
---------------------------------------------------------------------------

    \276\ See paragraph (c)(2) of proposed Rule 10. As discussed
below, Part II of proposed Form SCIR would be used by Covered
Entities to make public disclosures about the cybersecurity risks
they face and the significant cybersecurity incidents they
experienced during the current or previous calendar year. See
sections II.B.2. and II.B.4. of this release (discussing these
proposed requirements). Non-Covered Broker-Dealers would not be
subject to the requirements to file Part I and Part II of proposed
Form SCIR.
---------------------------------------------------------------------------

    As with the notice, the requirement to file Part I of proposed Form
SCIR would be triggered when the Covered Entity has a reasonable basis
to conclude that a significant cybersecurity incident has occurred or
is occurring. Therefore, the notification and reporting requirements
would be triggered at the same time. However, in order to provide the
Covered Entity time to gather the information that would be elicited by
Part I of proposed Form SCIR, the Covered Entity would need to file the
form promptly, but no later than 48 hours, upon having a reasonable
basis to conclude that a significant cybersecurity incident has
occurred or is occurring.
    Proposed Rule 10 also would require the Covered Entity to file an
amended Part I of proposed Form SCIR with updated information about the
significant cybersecurity incident in four circumstances.\277\ In each
case, the amended Part I of proposed Form SCIR would need to be filed
promptly, but no later than 48 hours, after the update requirement is
triggered. First, the Covered Entity would need to file an amended Part
I of proposed Form SCIR if any information previously reported to the
Commission on the form pertaining to the significant cybersecurity
incident becomes materially inaccurate.\278\ Second, the Covered Entity
would need to file an amended Part I of proposed Form SCIR if any new
material information pertaining to the significant cybersecurity
incident previously reported to the Commission on the form is
discovered.\279\ The Commission staff generally would use the
information reported on Part I of proposed Form SCIR to assess the
operating status of the Covered Entity and assess the impact that the
significant cybersecurity incident could have on other participants in
the U.S. securities markets. The requirement to file an amended Part I
of proposed Form SCIR under the first and second circumstances is
designed to ensure the Commission and Commission staff have reasonably
accurate and complete information when undertaking these activities.
---------------------------------------------------------------------------

    \277\ See paragraphs (c)(2)(ii)(A) through (D) of proposed Rule
10.
    \278\ See paragraph (c)(2)(ii)(A) of proposed Rule 10.
    \279\ See paragraph (c)(2)(ii)(B) of proposed Rule 10.
---------------------------------------------------------------------------

    Third, the Covered Entity would need to file an amended Part I of
proposed Form SCIR after the significant cybersecurity incident is
resolved.\280\ A significant cybersecurity incident impacting a Covered
Entity would be resolved when the situation no longer meets the
definition of ``significant cybersecurity incident.'' \281\ The
resolution of a significant cybersecurity incident would be a material
development in the situation and, therefore, would be a reporting
trigger under proposed Rule 10.
---------------------------------------------------------------------------

    \280\ See paragraph (c)(2)(ii)(C) of proposed Rule 10.
    \281\ See paragraph (a)(10) of proposed Rule 10 (defining the
term ``significant cybersecurity incident'').

---------------------------------------------------------------------------

    Finally, if the Covered Entity conducted an internal investigation
pertaining to the significant cybersecurity incident, it would need to
file an amended Part I of proposed Form SCIR after the investigation is
closed.\282\ This would be an investigation of the significant
cybersecurity incident that seeks to determine the cause of the
incident or to examine whether there was a failure to adhere to the
Covered Entity's policies and procedures to address cybersecurity risk
or whether those policies and procedures are effective. An internal
investigation could be conducted by the Covered Entity's own personnel
(e.g., internal auditors) or by external consultants hired by the
Covered Entity. The closure of an internal investigation would be a
reporting trigger under proposed Rule 10 because it could yield
material new information about the incident that had not been reported
in a previously filed Part I of proposed Form SCIR.
---------------------------------------------------------------------------

    \282\ See paragraph (c)(2)(ii)(D) of proposed Rule 10.
---------------------------------------------------------------------------

    As with the immediate written electronic notice, a Covered Broker-
Dealer would need to promptly transmit a copy of each Part I of
proposed Form SCIR it files with the Commission to its examining
authority, and a transfer agent would need to promptly transmit a copy
of each Part I of proposed Form SCIR it files with the Commission to
its ARA.\283\ The objective is to provide these other supervisory
authorities with the same information about the significant
cybersecurity incident that the Commission receives.
---------------------------------------------------------------------------

    \283\ See paragraphs (c)(2)(iii)(A) and (B) of proposed Rule 10.
---------------------------------------------------------------------------

    In this regard, the reporting requirements under proposed Rule 10
would provide the Commission and its staff with information to
understand better the nature and extent of a particular significant
cybersecurity incident and the efficacy of the Covered Entity's
response to mitigate the disruption and harm caused by the incident.
The Commission staff could use the reports to focus on the Covered
Entity's operating status and to facilitate their outreach to, and
discussions with, personnel at the Covered Entity who are addressing
the significant cybersecurity incident. For example, certain
information provided in a report may be sufficient to address any
questions the staff has about the incident; and in other instances
staff may want to ask follow-up questions to get a better understanding
of the matter. In addition, the reporting would provide the staff with
a view into the Covered Entity's understanding of the scope and impact
of the significant cybersecurity incident. All of this information
would be used by the Commission and its staff in assessing the impact
of the significant cybersecurity incident on the Covered Entity.
    The information provided to the Commission under the proposed
reporting requirements also would be used to assess the potential
cybersecurity risks affecting U.S. securities markets more broadly.
This information could be useful in assessing other and future
significant cybersecurity incidents. For example, these reports could
assist the Commission in identifying patterns and trends across Covered
Entities, including widespread cybersecurity incidents affecting
multiple Covered Entities at the same time. Further, the reports could
be used to evaluate the effectiveness of various approaches to respond
to and recover from a significant cybersecurity incident.
b. Part I of Proposed Form SCIR
    Proposed Rule 10 would require a Covered Entity to report
information about a significant cybersecurity incident confidentially
on Part I of proposed Form SCIR.\284\ The form would elicit certain
information about the significant cybersecurity incident through check
boxes, date fields, and narrative fields. Covered Entities would file
Part I of proposed Form SCIR electronically with the Commission using
the EDGAR system in accordance with the EDGAR Filer Manual, as defined
in Rule 11 of Regulation S-T,\285\ and in accordance with the
requirements of Regulation S-T.\286\
---------------------------------------------------------------------------

    \284\ See paragraph (c)(2) of proposed Rule 10.
    \285\ See 17 CFR 232.11.
    \286\ See paragraphs (c)(2)(i) and (ii) of proposed Rule 10. As
discussed below in section II.B.4. of this release, the Covered
Entity would need to file Part I of proposed Form SCIR using a
structured data language.
---------------------------------------------------------------------------

    A Covered Entity would need to indicate on Part I of proposed Form
SCIR whether the form is being filed with respect to a significant
cybersecurity incident as an initial report, amended report, or final
amended report by checking the appropriate box. As discussed above,
proposed Rule 10 would require a Covered Entity to file Part I of
proposed Form SCIR upon having a reasonable basis to conclude that a
significant cybersecurity incident has occurred or is occurring.\287\
This would be the initial Part I of proposed Form SCIR with respect to
the significant cybersecurity incident.\288\ Thereafter, a Covered
Entity would be required to file an amended Part I of proposed Form
SCIR with respect to the significant cybersecurity incident after: (1)
any information previously reported to the Commission on Part I of
proposed Form SCIR pertaining to the significant cybersecurity incident
becomes materially inaccurate; (2) any new material information
pertaining to the significant cybersecurity incident previously
reported to the Commission on Part I of proposed Form SCIR is
discovered; (3) the significant cybersecurity incident is resolved; or
(4) an internal investigation pertaining to a significant cybersecurity
incident is closed.\289\ If a Covered Entity checks the box indicating
that the filing is a final Part I of proposed Form SCIR, the firm also
would need to check the appropriate box to indicate why a final form
was being filed: either the significant cybersecurity incident was
resolved or an internal investigation pertaining to the incident was
closed.
---------------------------------------------------------------------------

    \287\ See paragraph (c)(2)(i) of proposed Rule 10. See also
section II.B.2.a. of this release (discussing the proposed filing
requirements in more detail).
    \288\ See Instruction B.1. of proposed Form SCIR.
    \289\ See paragraphs (c)(2)(ii)(A) through (D) of proposed Rule
10.
---------------------------------------------------------------------------

    Part I of proposed Form SCIR would elicit information about the
Covered Entity that would be used to identify the filer.\290\ In
particular, the Covered Entity would need to provide its full legal
name and business name (if different from its legal name), tax
identification number, unique identification code (``UIC'') (if the
filer has a UIC), central index key (``CIK number''),\291\ and main
address.\292\ The instructions to proposed Form SCIR (which would be
applicable to Parts I and II) would provide that a UIC is an
identification number that has been issued by an internationally
recognized standards-setting system (``IRSS'') that has been recognized
by the Commission pursuant to Rule 903(a) of Regulation SBSR.\293\
Currently, the Commission has recognized only the Global Legal Entity
Identifier Foundation (``GLEIF'')--which is responsible for overseeing
the Global Legal Entity Identifier System (``GLEIS'')--as an IRSS.\294\
Part I of

proposed Form SCIR also would elicit the name, phone number, and email
address of the contact employee of the Covered Entity.\295\ The contact
employee would need to be an individual authorized by the Covered
Entity to provide the Commission with information about the significant
cybersecurity incident (i.e., information the individual can provide
directly) and make information about the incident available to the
Commission (e.g., information the individual can provide by, for
example, making other employees of the Covered Entity available to
answer questions of the Commission staff).\296\ The Covered Entity also
would need to indicate the type of Market Entity it is by checking the
appropriate box or boxes.\297\ For example, if the Covered Entity is
dually registered as a broker-dealer and SBSD, it would need to check
the box for each of those entity types.
---------------------------------------------------------------------------

    \290\ See Line Items 1.A. through 1.E. of Part I of proposed
Form SCIR.
    \291\ A CIK number is used on the Commission's computer systems
to identify persons who have filed disclosures with the Commission.
    \292\ See Line Items 1.A. through 1.C. of Part I of proposed
Form SCIR.
    \293\ See Instruction A.5.g. of proposed Form SCIR. See also,
e.g., Form SBSE available at https://www.sec.gov/files/form-sbse.pdf
(providing a similar definition of UIC).
    \294\ See Regulation SBSR--Reporting and Dissemination of
Security-Based Swap Information, Exchange Act Release No. 74244
(Feb. 11, 2015), 80 FR 14563, 14632 (Mar. 19, 2015) (``Regulation
SBSR Release''). LEIs are unique alphanumeric codes that identify
legal entities in financial transactions in international markets.
See Financial Stability Board (``FSB''), Options to Improve Adoption
of the LEI, in Particular for Use in Cross-Border Payments (July 7,
2022). Information associated with the LEI, which is a globally-
recognized digital identifier that is not specific to the
Commission, includes the ``official name of the legal entity as
recorded in the official registers[,]'' the entity's address,
country of incorporation, and the ``legal form of the entity.'' Id.
Accordingly, in proposing to require each Covered Entity to provide
its UIC if it has a UIC, the Commission is proposing to require each
Covered Entity identify itself with an LEI if it has an LEI.
    \295\ See Line Item 1.D. of Part I of proposed Form SCIR.
    \296\ See Instruction B.4. of proposed Form SCIR.
    \297\ See Line Item 1.E. of Part I of proposed Form SCIR
(setting forth check boxes to indicate whether the Covered Entity is
a broker-dealer, clearing agency, MSBSP, the MRSB, a national
securities association, a national securities exchange, SBSD, SBSDR,
or transfer agent).
---------------------------------------------------------------------------

    Page 1 of Part I of proposed Form SCIR also would contain fields
for the individual executing the form to sign and date the form. By
signing the form, the individual would: (1) certify that the form was
executed on behalf of, and with the authority of, the Covered Entity;
(2) represent individually, and on behalf of the Covered Entity, that
the information and statements contained in the form are current, true
and complete; and (3) represent individually, and on behalf of the
Covered Entity, that to the extent any information previously submitted
is not amended such information is current, true, and complete. The
form of the certification is designed to ensure that the Covered
Entity, through the individual executing the form, provides information
that the Commission and Commission staff can rely on to evaluate the
operating status of the Covered Entity, assess the impact the
significant cybersecurity incident may have on other participants in
the U.S. securities markets, and formulate an appropriate response to
the incident.
    Line Items 2 through 14 of Part I of proposed Form SCIR would
elicit information about the significant cybersecurity incident and the
Covered Entity's response to the incident. After discovering the
existence of a significant cybersecurity incident, a Covered Entity may
need time to determine the scope and impact of the incident in order to
provide meaningful responses to these questions. For example, the
Covered Entity may be working diligently to investigate and resolve the
significant cybersecurity incident at the same time it would be
required to complete and file Part I of proposed Form SCIR. The Covered
Entity's priorities in the early stages after detecting the significant
cybersecurity incident may be to devote its staff resources to
mitigating the harms caused by the incident or that could be caused by
the incident if necessary corrective actions are not promptly
implemented. Moreover, during this period, the Covered Entity may not
have a complete understanding of the cause of the significant
cybersecurity incident, all the information systems impacted by the
incident, the harm caused by the incident, or how to best resolve and
recover from the incident (among other relevant information).
    Therefore, the first form filed with respect to a given significant
cybersecurity incident should include information that is known to the
Covered Entity at the time of filing and not include speculative
information. If information is unknown at the time of filing, the
Covered Entity should indicate that on the form. Understanding the
aspects of the significant cybersecurity incident that are not yet
known would inform the Commission's assessment. The process of filing
an amended Part I of proposed Form SCIR is designed to update earlier
filings as information becomes known to the Covered Entity. In
particular, proposed Rule 10 would require the Covered Entity to file
an amended Part I of proposed Form SCIR if information reported on a
previously filed form pertaining to the significant cybersecurity
incident becomes materially incomplete because new information is
discovered.\298\ Therefore, as the Covered Entity reasonably concludes
that additional information about the significant cybersecurity
incident is necessary to make its filing not materially inaccurate, it
would need to file amended forms. In this way, the reporting
requirements of proposed Rule 10 are designed to provide the Commission
and Commission staff with current known information and provide a means
for the Covered Entity to report information as it becomes known.
---------------------------------------------------------------------------

    \298\ See paragraph (c)(2)(ii)(B) of proposed Rule 10.
---------------------------------------------------------------------------

    This does not mean that the Covered Entity can refrain from
providing known information in Part I of proposed Form SCIR. As
discussed above, the Covered Entity must certify through the individual
executing the form that the information and statements in the form are
current, true, and complete, among other things. A failure to provide
current, true, and complete information that is known to the Covered
Entity would be inconsistent with this required certification. In
addition, failing to investigate the significant cybersecurity incident
would be inconsistent with the policies and procedures required by
proposed Rule 10. As discussed above, the cybersecurity incident
response and recovery policies and procedures that would be required by
proposed Rule 10 would need to include policies and procedures that are
reasonably designed to ensure the reporting of significant
cybersecurity incidents as required by the rule.\299\ The failure to
diligently investigate the significant cybersecurity incident could
indicate that the Covered Entity's incident response and recovery
policies and procedures are not reasonably designed or are not being
enforced by the Covered Entity as required by proposed Rule 10.\300\
Moreover, reasonably designed policies and procedures to detect,
respond to, and recover from a cybersecurity incident, as required by
proposed Rule 10 generally should require diligent investigation of the
significant cybersecurity incident.\301\ Further, diligently
investigating the significant cybersecurity incident would be in the
interest of the Covered Entity as it could lead to a quicker resolution
of the incident by revealing--for example--its cause and impact.
---------------------------------------------------------------------------

    \299\ See paragraph (b)(1)(v)(A)(4) of proposed Rule 10. See
also section II.B.1.e. of this release (discussing these proposed
required policies and procedures in more detail).
    \300\ See paragraph (b)(1) of proposed Rule 10 (requiring that
the Covered Entity establish, maintain, and enforce written policies
and procedures that are reasonably designed to address the covered
entity's cybersecurity risks).
    \301\ See paragraph (b)(1)(v)(A) of proposed Rule 10. See also
section II.B.1.e. of this release (discussing these proposed
required policies and procedures in more detail).
---------------------------------------------------------------------------

    In terms of the information about the significant cybersecurity
incident elicited in Part I of proposed Form SCIR, the Covered Entity
first would be required to provide the approximate

date that it discovered the significant cybersecurity incident.\302\ As
discussed above, a Covered Entity would be required to provide the
Commission with immediate written electronic notice of a significant
cybersecurity incident upon having a reasonable basis to conclude that
the incident has occurred or is occurring.\303\ This can be based on,
for example, the Covered Entity reviewing or receiving a record, alert,
log, or notice about the incident. In addition, reaching this
conclusion would trigger the requirement to file promptly (but within
48 hours) an initial Part I of proposed Form SCIR with the Commission
to first report the significant cybersecurity incident using the
form.\304\ The date that would need to be reported on proposed Part I
of Form SCIR is the date the Covered Entity has a reasonable basis to
conclude that the incident has occurred or is occurring.\305\
---------------------------------------------------------------------------

    \302\ See Line Item 2 of Part I of proposed Form SCIR.
    \303\ See paragraph (c)(1) of proposed Rule 10. See also section
II.B.2.a. of this release (discussing the proposed notification
requirement in more detail).
    \304\ See paragraph (c)(2)(i) of proposed Rule 10. See also
section II.B.2.a. of this release (discussing the proposed reporting
trigger in more detail).
    \305\ See Instruction B.5.a. of proposed Form SCIR.
---------------------------------------------------------------------------

    Line Item 3 of Part I of proposed Form SCIR would elicit
information about the approximate duration of the significant
cybersecurity incident.\306\ First, the Covered Entity would need to
indicate whether the significant cybersecurity incident is
ongoing.\307\ The form would provide the option of answering yes, no,
or unknown. Second, the Covered Entity would need to provide the
approximate start date of the cybersecurity incident or indicate that
it does not know the start date.\308\ The start date may be well before
the date the Covered Entity discovered the significant cybersecurity
incident. Therefore, the start date of the incident reported on Line
Item 3 may be different than the discovery date reported on Line Item
2. Third, the Covered Entity would need to provide the approximate date
the significant cybersecurity incident is resolved.\309\ This would be
the date the Covered Entity was no longer undergoing a significant
cybersecurity incident.\310\ As discussed above, the resolution of the
significant cybersecurity incident triggers the requirement to file an
amended Part I of proposed Form SCIR under proposed Rule 10.\311\
---------------------------------------------------------------------------

    \306\ See Line Items 3.A. through 3.C. of Part I of proposed
Form SCIR.
    \307\ See Line Item 3.A. of Part I of proposed Form SCIR.
    \308\ See Line Item 3.B. of Part I of proposed Form SCIR.
    \309\ See Line Item 3.C. of Part I of proposed Form SCIR.
    \310\ See Instruction B.5.b. of proposed Form SCIR. See also
paragraph (a)(10) of proposed Rule 10 (defining the term
``significant cybersecurity incident'').
    \311\ See paragraph (c)(2)(ii)(C) of proposed Rule 10. See
section II.B.2.a. of this release (discussing the notification
requirements in more detail).
---------------------------------------------------------------------------

    Line Item 4 of Part I of proposed Form SCIR would require the
Covered Entity to indicate whether an internal investigation pertaining
to the significant cybersecurity incident was being conducted. An
``internal investigation'' would be defined as a formal investigation
of the significant cybersecurity incident by internal personnel of the
Covered Entity or external personnel hired by the Covered Entity that
seeks to determine any of the following: the cause of the significant
cybersecurity incident; whether there was a failure to adhere to the
Covered Entity's policies and procedures to address cybersecurity risk;
or whether the Covered Entity's policies and procedures to address
cybersecurity are effective.\312\ If an internal investigation is
conducted, the Covered Entity also would need to provide the date the
investigation was closed. As discussed above, the closure of an
internal investigation pertaining to the significant cybersecurity
incident triggers the requirement to file an amended Part I of Form
SCIR under proposed Rule 10.\313\
---------------------------------------------------------------------------

    \312\ See Instruction A.5.d. of proposed Form SCIR.
    \313\ See paragraph (c)(2)(ii)(D) of proposed Rule 10. See also
section II.B.2.a. of this release (discussing the notification
requirement in more detail).
---------------------------------------------------------------------------

    Line Item 5 of Part I of proposed Form SCIR would require the
Covered Entity to indicate whether a law enforcement or government
agency (other than the Commission) had been notified of the significant
cybersecurity incident.\314\ If so, the Covered Entity would need to
identify each law enforcement or government agency. The Commission and
Commission staff could use this information to coordinate with other
law enforcement and government agencies if needed both to assess the
incident and to share information as appropriate to understand the
impact of the incident better.
---------------------------------------------------------------------------

    \314\ See Line Item 5 of Part I of proposed Form SCIR.
---------------------------------------------------------------------------

    Line Item 6 of Part I of proposed Form SCIR would require the
Covered Entity to describe the nature and scope of the significant
cybersecurity incident, including the information systems affected by
the incident and any effect on the Covered Entity's critical
operations.\315\ This item would enable the Commission to obtain
information about the incident to understand better how it is impacting
the Covered Entity's operating status and whether the Covered Entity
can continue to provide services to its customers, counterparties,
members, registrants, or users. This would include understanding which
services and systems have been impacted and whether the incident was
the result of a cybersecurity incident that occurred at a service
provider.
---------------------------------------------------------------------------

    \315\ See Line Item 6 of Part I of proposed Form SCIR.
---------------------------------------------------------------------------

    Line Item 7 of Part I of proposed Form SCIR would require the
Covered Entity to indicate whether the threat actor(s) causing the
significant cybersecurity incident has been identified.\316\ If so, the
Covered Entity would be required to identify the threat actor(s). In
addition, the Covered Entity would need to indicate in Line Item 7
whether there has been communication(s) from or with the threat
actor(s) that caused or claims to have caused the significant cyber
security incident.\317\ The Covered Entity would need to answer the
question even if the threat actor(s) has not been identified. If there
had been communications, the Covered Entity would need to describe
them. This information would help the Commission staff to assess
whether the same threat actor(s) had sought to access information
systems of other Commission registrants and to warn other registrants
(as appropriate) about the threat posed by the actor(s). It also could
help in developing measures to protect against the risk to Commission
registrants posed by the threat actor. In addition, the information
would help the Commission assess the impact on the Covered Entity
experiencing the significant cybersecurity incident to the extent other
Commission registrants has been attacked by the same threat actor(s)
using similar tactics, techniques, and procedures.
---------------------------------------------------------------------------

    \316\ See Line Item 7.A. of Part I of proposed Form SCIR.
    \317\ See Line Item 7.B. of Part I of proposed Form SCIR.
---------------------------------------------------------------------------

    Line Item 8 of Part I of proposed Form SCIR would require the
Covered Entity to describe the actions taken or planned to respond to
and recover from the significant cybersecurity incident.\318\ The
objective is to obtain information to assess the Covered Entity's
operating status, including its critical operations. This information
also could assist the Commission and Commission staff in considering if
the response measures are effective or ineffective in addressing the
Covered Entity's significant cybersecurity incident.
---------------------------------------------------------------------------

    \318\ See Line Item 8 of Part I of proposed Form SCIR.
---------------------------------------------------------------------------

    Line Item 9 of Part I of proposed Form SCIR would require the
Covered Entity

to indicate whether any data was stolen, altered, or accessed or used
for any other unauthorized purpose.\319\ The Covered Entity would have
the option of checking yes, no, or unknown. If yes, the Covered Entity
would need to describe the nature and scope of the data. This
information would help the Commission and its staff understand the
potential harm to the Covered Entity and its customers, counterparties,
members, registrants, or users that could result from the compromise of
the data. It also would provide insight into how the significant
cybersecurity incident could impact other Market Entities.
---------------------------------------------------------------------------

    \319\ See Line Item 9 of Part I of proposed Form SCIR.
---------------------------------------------------------------------------

    Line Item 10 of Part I of proposed Form SCIR would require the
Covered Entity to indicate whether any personal information was lost,
stolen, modified, deleted, destroyed, or accessed without authorization
as a result of the significant cybersecurity incident.\320\ The Covered
Entity would have the option of checking yes, no, or unknown. If yes,
the Covered Entity would need to describe the nature and scope of the
information. Additionally, if the Covered Entity answered yes, it would
need to indicate whether notification has been provided to persons
whose personal information was lost, stolen, damaged, or accessed
without authorization.\321\ If the answer is no, the Covered Entity
would need to indicate whether this notification is planned.\322\ For
the purposes of proposed Form SCIR, the term ``personal information''
would have the same meaning as that term is defined in proposed Rule
10.\323\ The compromise of personal information can have severe
consequences on the persons to whom the information relates. For
example, it potentially can be used to steal their identities or access
their accounts at financial institutions to steal assets held in those
accounts. Consequently, this information would help the Commission
assess the extent to which the significant cybersecurity incident has
created this risk and the potential harm that could result from the
compromise of personal data.
---------------------------------------------------------------------------

    \320\ See Line Item 10.A. of Part I of proposed Form SCIR.
    \321\ See Line Item 10.B.i. of Part I of proposed Form SCIR.
    \322\ See Line Item 10.B.ii. of Part I of proposed Form SCIR.
    \323\ See Instruction A.5.e. of proposed Form SCIR. See also
paragraph (a)(9) of proposed Rule 10 (defining ``personal
information'' to mean any information that can be used, alone or in
conjunction with any other information, to identify a person, such
as name, date of birth, place of birth, telephone number, street
address, mother's maiden name, government passport number, Social
Security number, driver's license number, electronic mail address,
account number, account password, biometric records, or other non-
public authentication information).
---------------------------------------------------------------------------

    Line Item 11 of Part I of proposed Form SCIR would require the
Covered Entity to indicate whether any of its assets were lost or
stolen as a result of the significant cybersecurity incident.\324\ The
Covered Entity would have the option of checking yes, no, or unknown.
If yes, the Covered Entity would need to describe the types of assets
that were lost or stolen and include an approximate estimate of their
value, if known. This question is not limited to particular types of
assets and, therefore, the Covered Entity would need to respond
affirmatively if, among other types of assets, financial assets such as
cash and securities were lost or stolen or intellectual property was
lost or stolen. The loss or theft of the Covered Entity's assets could
potentially cause the entity to fail financially or put a strain on its
liquidity. Further, to the extent counterparties become aware of the
loss or theft, it could cause them to withdraw assets from the entity
or stop transacting with the entity further straining its financial
condition. Consequently, the objective is to understand whether the
significant cybersecurity incident has created this risk and whether
there may be other spillover effects or consequences to the U.S.
securities markets.
---------------------------------------------------------------------------

    \324\ See Line Item 11 of Part I of proposed Form SCIR.
---------------------------------------------------------------------------

    Line Item 12 of Part I of proposed Form SCIR would require the
Covered Entity to indicate whether any assets of the Covered Entity's
customers, counterparties, clients, members, registrants, or users were
lost or stolen as a result of the significant cybersecurity
incident.\325\ The Covered Entity would have the option of checking
yes, no, or unknown. If yes, the Covered Entity would need to describe
the types of assets that were lost or stolen and include an approximate
estimate of their value, if known. Additionally, if the Covered Entity
answered yes, it would need to indicate whether notification has been
provided to persons whose assets were lost or stolen.\326\ If the
answer is no, the Covered Entity would need to indicate whether this
notification is planned.\327\
---------------------------------------------------------------------------

    \325\ See Line Item 12.A. Part I of proposed Form SCIR.
    \326\ See Line Item 11.B.i. of Part I of proposed Form SCIR.
    \327\ See Line Item 12.B.ii. of Part I of proposed Form SCIR.
---------------------------------------------------------------------------

    Certain types of Covered Entities hold assets belonging to other
persons or maintain ownership records of the assets of other
persons.\328\ For example, certain broker-dealers maintain custody of
securities and cash for other persons and clearing agencies hold
clearing deposits of their members. A significant cybersecurity
incident impacting a Covered Entity that results in the loss or theft
of assets can cause severe financial hardship to the owners of those
assets. It also can impact the financial condition of the Covered
Entity if it is liable for the loss or theft. Consequently, the
objective is to understand whether the significant cybersecurity
incident has created this risk.
---------------------------------------------------------------------------

    \328\ See Section I.A.2. of this release (discussing the
functions of Market Entities).
---------------------------------------------------------------------------

    As discussed in more detail below, proposed Rule 10 would require a
Covered Entity to make a public disclosure that generally describes
each significant cybersecurity incident that has occurred during the
current or previous calendar year and promptly update this disclosure
after the occurrence of a new significant cybersecurity incident or
when information about a previously disclosed significant cybersecurity
incident materially changes.\329\ The Covered Entity would be required
to make the disclosure on the Covered Entity's business internet
website and by filing Part II of proposed Form SCIR through the EDGAR
system.\330\ In addition, if the Covered Entity is a carrying or
introducing broker-dealer, it would need to make the disclosure to its
customers using the same means that a customer elects to receive
account statements.\331\
---------------------------------------------------------------------------

    \329\ See paragraph (d)(1)(ii) of proposed Rule 10. See also
sections II.B.3. and II.B.4. of this release (discussing these
proposed disclosure requirements in more detail).
    \330\ See paragraphs (d)(2)(i) and (ii) of proposed Rule 10.
    \331\ See paragraph (d)(3) of proposed Rule 10. See section
II.B.3.b. of this release (discussing the broker-dealer disclosure
requirement in more detail).
---------------------------------------------------------------------------

    Line Item 13 of Part I of proposed Form SCIR would require the
Covered Entity to indicate whether the significant cybersecurity
incident has been disclosed pursuant to the requirements of proposed
Rule 10.\332\ The Covered Entity also would need to indicate whether it
made the required disclosures of Part II of proposed Form SCIR on its
website and through EDGAR and, if it had made the disclosure, it would
need to indicate the date of the disclosure.\333\ A Covered Entity that
is a carrying or introducing broker-dealer would need to indicate
separately