intervals and why?
    66. The Commission notes that items (i)(B), (C), and (D) would each
require the establishment of policies and procedures for: Testing of
capacity, testing methodology, and testing for vulnerabilities,
respectively. The Commission also notes that the need for improved
testing was a recurring theme during the Roundtable and discussed in
several comment letters.\206\ The Commission requests comment on
whether the testing policies and procedures requirements in proposed
Rule 1000(b)(1)(i)(B), (C), and (D) would be sufficiently comprehensive
to foster development of the types of testing that Roundtable panelists
and commenters recommended. Why or why not? Please be specific. Should
the Commission require certain types of testing by SCI entities? Why or
why not? Please be specific. If so, what specific types of testing
should the Commission require in proposed Regulation SCI? Please
describe in detail.
---------------------------------------------------------------------------

    \206\ See text accompanying supra note 72, discussing
recommendations by Roundtable panelists and commenters to lower
rates of error in software development by improving testing
opportunities and participation in testing by member firms. See also
text accompanying supra note 180.
---------------------------------------------------------------------------

    67. Should the Commission require SCI entities to have, and make
available to their members or participants, certain infrastructure or
mechanisms that would aid industry-wide testing or direct testing with
an SCI entity, such as test facilities or test symbols? Why or why not?
If so, please specify what types of infrastructures or mechanisms
should be required.
    68. Should the Commission require industry-wide testing for certain
types of anticipated technology deployments? \207\ Why or why not? If
so, what should be the criteria for identifying anticipated technology
deployments that warrant mandatory industry-wide testing and which
market participants should be required to participate? Please explain
in detail.
---------------------------------------------------------------------------

    \207\ See also infra Section III.C.7 (discussing, among other
things, the requirement of proposed Rule 1000(b)(9)(ii) that an SCI
entity coordinate the testing of the SCI entity's business
continuity and disaster recovery plans, including its backup
systems, with other SCI entities).
---------------------------------------------------------------------------

    69. Should the Commission require SCI entities to mandate that
their members or participants participate in direct testing with such
SCI entities for certain types of anticipated technology deployments by
the members or participants? \208\ Why or why not? If so, what should
be the criteria for identifying anticipated technology deployments that
warrant mandatory testing with an SCI entity? Should the Commission
identify such criteria, or should SCI entities identify such criteria?
Please explain.
---------------------------------------------------------------------------

    \208\ See also infra Section III.C.7 (discussing, among other
things, the requirement of proposed Rule 1000(b)(9)(i) that an SCI
entity require participation by designated members or participants
in scheduled functional and performance testing of the operation of
the SCI entity's business continuity and disaster recovery plans,
including its backup systems).
---------------------------------------------------------------------------

    70. Similarly, would proposed item (i)(E), regarding policies and
procedures for business continuity and disaster recovery plans, be
sufficiently comprehensive to foster the establishment of the types of
contingency plans discussed by Roundtable panelists and Roundtable
commenters, such as predetermined communication plans, escalation
procedures, and/or kill switches? \209\ Why or why not? Should proposed
Regulation SCI expressly require that an SCI entity's contingency plans
include such details? \210\ Why or why not? Please explain. Should SCI
entities' contingency plans and the testing of such plans be required
to account for specific types of disaster or threat scenarios, such as
an extreme volume surge, the failure of a major market participant,
and/or a terrorist or cyber attack? Why or why not? Please explain. If
so, what other types of scenarios should such plans take into account?
Please be specific.
---------------------------------------------------------------------------

    \209\ See discussion of Roundtable in supra Section I.D. The
Commission is not proposing at this time any requirements related to
kill switches.
    \210\ See also infra Section III.C.3.a, discussing proposed Rule
1000(b)(3), which would require an SCI entity, upon any responsible
SCI personnel becoming aware of an SCI event, to begin to take
appropriate corrective action, including, at a minimum, mitigating
potential harm to investors and market integrity resulting from the
SCI event and devoting adequate resources to remedy the SCI event as
soon as reasonably practicable, and the associated request for
comment.
---------------------------------------------------------------------------

    71. There was considerable discussion at the Roundtable about kill
switches, with several panelists advocating the kill switch proposal
outlined in the Industry Working Group comment letter,\211\ while
others expressed concerns.\212\ The Commission is not proposing at this
time any requirements related to kill switches. However, do commenters
believe that the implementation of kill switches, as outlined in the
Industry Working Group comment letter, would assist SCI entities in
maintaining the integrity of their systems? Why or why not? If so, how,
if at all, should the Commission foster the development of coordinated
contingency plans among SCI SROs and SCI ATSs that would include such a
kill switch mechanism?
---------------------------------------------------------------------------

    \211\ See letter from Industry Working Group, supra note 74 and
accompanying text.
    \212\ See, e.g., letter from TDA, supra note 74.
---------------------------------------------------------------------------

    72. Should the Commission include the criteria of geographic
diversity in the requirement relating to business continuity and
disaster recovery plans in proposed Rule 1000(b)(1)(i)(E)? Why or why
not? Please explain. Should the Commission specify minimum standards
for ``geographically diverse'' in proposed Rule 1000(b)(1)(i)(E)? Why
or why not? If so, what would be an appropriate standard?
    73. Is the next business day resumption of trading following a
wide-scale disruption requirement in

proposed Rule 1000(b)(1)(i)(E) appropriate? Why or why not? Is the two-
hour resumption of clearance and settlement services following a wide-
scale disruption an appropriate requirement for an SCI entity that is a
registered clearing agency or ``exempt clearing agency subject to
ARP?'' Why or why not?
    74. As discussed above, the U.S. national securities exchanges
closed for two business days in October 2012 in the wake of Superstorm
Sandy, even though the securities industry's annual test of how trading
firms, market operators, and their utilities could operate through an
emergency using backup sites, backup communications, and disaster
recovery facilities occurred without significant incident on October
27, 2012, just two days before the storm.\213\ As discussed in greater
detail below, proposed Rule 1000(b)(9) would require SCI entities to
mandate participation by designated members or participants in
scheduled testing of the operation of their business continuity and
disaster recovery plans, including backup systems, and to coordinate
such testing with other SCI entities.\214\ Are there other industry
practices related to proposed Regulation SCI that should be considered
further in light of the two-day closure of the U.S. securities markets
during the storm? If so, what are they? For example, for SCI entities
that are trading markets, should the Commission limit the extent to
which an SCI entity's business continuity and disaster recovery plans
may involve changing how trading may be conducted? For example, the
NYSE, pursuant to its rules, initially proposed to conduct trading only
electronically on October 29, 2012, using NYSE Arca systems, rather
than conduct trading both electronically as well as on a physical
trading floor, as it normally does.\215\ Should an SCI entity that is
experiencing a wide-scale disruption be permitted to offer its members
or participants an alternative that significantly differs from its
usual method of operation? Please explain. What are the costs and
benefits associated with each type of approach?
---------------------------------------------------------------------------

    \213\ See supra Section I.D.
    \214\ See infra Section III.C.7.
    \215\ See supra Section I.D.
---------------------------------------------------------------------------

    75. Should business continuity and disaster recovery plans
involving backup data centers be required to be tested in a live
``production'' environment on a periodic basis (e.g., annually, or at
some other frequency)? Why or why not? Please explain.
    76. The Commission understands that certain entities that would be
defined as SCI entities (such as registered clearing agencies) are
already effectively operating under business resumption requirements of
less than one business day. Should the Commission consider revising the
proposed next business day resumption requirement for trading to a
shorter or longer period, for example, a specific number of hours less
or more than one business day or within the business day for certain
entities that play a significant role within the securities markets?
Why or why not? Similarly, should the proposed two-hour resumption
standard for clearance and settlement services be shortened or
lengthened? Why or why not?
    77. Following a systems disruption (including, for example,
activation of an SCI entity's business continuity plan), should the
Commission require user testing and certification prior to resuming
operation of the affected systems? Why or why not? If so, what should
the testing requirements be? Should they vary depending on the type of
system(s) affected? To whom should an SCI entity certify that an
affected system or group of systems is ready to resume operation?
    78. Is the requirement in proposed Rule 1000(b)(1)(i)(F) for
``standards that result in such systems being designed, developed,
tested, maintained, operated, and surveilled in a manner that
facilitates the successful collection, processing, and dissemination of
market data'' appropriate? Are there other factors that the Commission
should consider in determining whether standards to process data are
adequate? Or, should some of the proposed standards be eliminated or
modified? If so, please explain how and why.
    79. Do commenters believe there are specific internal controls or
other mechanisms that would reinforce the effectiveness of an SCI
entity's reasonably designed policies and procedures under proposed
Rule 1000(b)(1)? Why or why not? Please explain. How do SCI entities
presently use specific internal controls or other mechanisms to
maintain the SCI entity's operational capability and promote the
maintenance of fair and orderly markets? How do commenters generally
view the advantages and disadvantages of specific internal controls or
other mechanisms? The Commission is not proposing to prescribe specific
internal controls under proposed Rule 1000(b)(1). Should the Commission
propose that any particular internal controls or other mechanisms be
required (for example, that a senior officer be designated to be
responsible for the SCI entity's compliance with proposed Regulation
SCI, or that personnel of the SCI entity certify that the SCI entity's
policies and procedures are reasonably designed)?
    80. Would any of the Commission's proposed requirements under
proposed Rule 1000(b)(1) create inappropriate barriers to entry for new
entities seeking to register with the Commission as an SRO, ATS, or
plan processor? Would any of the proposed requirements inappropriately
limit the growth or expansion of entities currently registered with the
Commission as an SRO, ATS, or plan processor? Why or why not?
    81. As noted above, the Commission proposes that policies and
procedures would be deemed to be reasonably designed for purposes of
proposed Rule 1000(b)(1) if they are consistent with current SCI
industry standards. Do commenters agree with this approach? Why or why
not? What are the advantages or disadvantages of such an approach?
    82. Do commenters believe that the publications listed in Table A
represent publications that are suitable for purposes of proposed Rule
1000(b)(1)(ii) and that should be the ``current SCI industry
standards'' for purposes of proposed Rule 1000(b)(1)(ii)? Why or why
not? If not, what publications would be appropriate? Do commenters
believe that SCI entities currently follow the industry standards
contained in the publications listed in Table A?
    83. Are there areas within one of the nine identified domains that
these publications do not cover? For example, should the Commission
identify additional publications that provide industry standards for
specific areas such as personnel security or information security risk
management? If so, please identify any such publications that would be
appropriate for the Commission to apply to SCI entities. Are there
other areas that commenters believe are not covered at all by the
publications listed in Table A that should be included? If so, what
publications would be appropriate for such areas? Are there any areas
within one of the nine identified domains that commenters believe
should not be included? If so, why not?
    84. Should any of the publications listed in Table A be eliminated?
If so, which ones and why? Are there any publications that should be
added? If so, which ones and why? Are there industry practices that
apply to, or are developed by, entities related to the securities
markets that should be considered? If so, what are they and why? Are
there any types of SCI entities for which the proposed publications
would not be appropriate? If so, which

types of entities and why? How should any such possible concerns be
addressed? The Commission notes that many of the publications in Table
A have been issued by either NIST or FFIEC. Do commenters believe that
SCI entities generally currently follow the industry standards issued
by one of these organizations more frequently than the other? If so,
which one and why? Is one organization's publications more appropriate
or preferable for SCI entities? If so, please explain. What are the
advantages and/or disadvantages of the publications issued by each
organization?
    85. The Commission seeks comment on whether commenters believe that
the identified publications, and the industry standards within, are
adequate in terms of the detail, specificity and scope. Are there areas
in which the industry standards listed in the publications in Table A
should be modified to provide adequate guidance to SCI entities? If so,
please explain in detail. For example, the Commission understands that
many businesses, including SCI entities, now utilize cloud computing as
part of their operations, and the Commission has identified industry
standards with respect to cloud computing among the publications listed
in Table A. However, do commenters believe that these industry
standards provide an adequate level of specificity to allow an SCI
entity to ascertain how to comply with such standards? Further, do the
industry standards contained in the publications in Table A cover all
of the relevant areas related to a particular subject area (such as
cloud computing)? Similarly, the Commission notes that it has
identified publications with respect to capacity planning, but that the
industry standards in such publications focus primarily on continuity
of operations. As such, the Commission seeks comment on whether
commenters believe that the identified publications with respect to
capacity planning are adequate in terms of the detail, specificity, and
scope? Specifically, do these publications provide an adequate level of
specificity to allow an SCI entity to ascertain how to comply with such
standards, and do the industry standards cover all of the necessary
areas related to a particular subject area such as capacity planning?
Why or why not? As noted above, compliance with the industry standards
contained in the publications on Table A would not be the exclusive
means to comply with the requirements of proposed Rule 1000(b)(1).
    86. Do commenters agree with the Commission's proposed policies and
procedures approach to the requirements of proposed Rule 1000(b)(1)?
Why or why not? If not, is there another approach that is more
appropriate? If so, please describe and explain. Do commenters agree
with the Commission's proposed approach to deem an SCI entity's
policies and procedures to be reasonably designed if they are
consistent with current SCI industry standards, as provided for in
proposed Rule 1000(b)(1)(ii)? Why or why not? How do commenters believe
the actions of SCI entities might differ if such a provision were not
available? What are the costs and benefits of the Commission's approach
? What would be the costs and benefits of other approaches? Please
explain.
    87. Do commenters agree or disagree with the Commission's proposed
criteria to evaluate publications suitable for inclusion on Table A as
an SCI industry standard and to update such list? Do commenters agree
with the proposed criteria that identified publications should be: (i)
Comprised of information technology practices that are widely available
for free to information technology professionals in the financial
sector; and (ii) issued by an authoritative body that is a U.S.
governmental entity or agency, association of U.S. governmental
entities or agencies, or widely recognized organization? Why or why
not? Are there other criteria that would be more appropriate? Should
the proposed criteria allow for a publication that may be available for
an incidental charge rather than being required to be available for
free? Why or why not? How frequently should such list of publications
be updated and revised and what should the process be to update and/or
revise them?
    88. Are there SCI entities for which the proposed requirements in
Rule 1000(b)(1) would be inappropriate (e.g., not cost effective)? If
so, please identify such type of entity or entities, or the
characteristics of such entity or entities, and explain which proposed
requirements would be inappropriate and why. Would cost burden be an
appropriate reason to omit an SCI entity or proposed requirement
generally? Alternatively, would cost burden be an appropriate reason to
omit an SCI entity or proposed requirement, on a case-by-case basis, as
the Commission determined to be consistent with Exchange Act
requirements?
    89. When the Commission adopts new rules, or when SCI SROs
implement rule changes, SCI SROs and their members often need to make
changes to their systems to comply with such new rules. Would the
requirements of proposed Rule 1000(b)(1) add additional time to this
process and would the requirements increase the amount of time SCI
entities would need to adjust their systems for Commission or SCI SRO
rule changes? If so, how much additional time would SCI SROs need to
adjust their systems? If not, should proposed Regulation SCI or another
Commission rule require SCI SROs to provide minimum advance notice to
their members of anticipated technology deployments prior to the
implementation of any associated new rule or rule change by the SCI
SRO? Why or why not? If so, how much advance notice should be required
(e.g., a few days, a week, 30 days, 60 days, some other period)? Along
with any such advance notice, should SCI SROs be required to offer to
its members the opportunity to test such change with the SCI SRO prior
to deployment of the new technology and implementation of any
associated new rule or rule change? Why or why not? Should there be a
similar requirement for other types of SCI entities? Why or why not? If
so, what types of entities and what sorts of requirements should be
included?
    90. Do commenters believe the potential additional time SCI SROs
allocate to this process would result in fewer SCI events by helping to
ensure that SCI SROs properly implement systems changes? Why or why
not? How would the benefits and costs of such potential additional time
compare? Please be as specific as possible.
    91. The Commission generally solicits comments on its proposed
process for updating current SCI industry standards. Do commenters
believe that it would be appropriate that Commission staff, from time
to time, issue notices to update the list of previously identified
publications containing SCI industry standards after receiving
appropriate input from interested persons? Is there a more appropriate
method? If so, what would it be? If not, why not?
    92. Would such a process in allow for Commission staff to receive
sufficient input from the public, including experts, SCI entities, and
other market participants regarding the appropriate standards it should
update, and how to do so? Why or why not?
    93. Would it be useful, for example, to provide notice to the
public that it was focusing on a given domain or standard and seek
comment on a domain-by-domain, or standard-by-standard, basis? Would it
be useful for the Commission to set up a committee to advise Commission
staff on such standards? If so, which groups or types of market
participants should be represented on such a committee and

why? Is there any other process that the Commission or its staff should
use to help it obtain useful input? Would it be appropriate to instead
require SROs, for example, to submit an NMS plan under Rule 608 of
Regulation NMS that contained standards? Why or why not?
    94. If the Commission, its staff, or another entity seeks to
develop a set of standards that is more focused on the specific
businesses and systems of SCI entities, do commenters agree that the
industry standards contained in the publications listed in Table A
would be appropriate to be used as a starting point for this effort?
Why or why not? If not, what publication(s) should be used as a
starting point? Please describe in detail and explain.
    95. Do commenters believe it would be feasible to establish
industry standards through means other than identification through
Table A? For example, should SCI entities take the lead in developing
such standards? Why or why not? If so, how should the process be
organized and what parameters should be put in place to facilitate the
process? For example, should SCI entities jointly develop industry
standards that apply to all SCI entities or should the various types of
SCI entities (e.g., national securities exchanges, ATSs, plan
processors, clearing agencies) work separately to develop their own
standards? Should one or more industry organizations take the lead in
developing such standards? If so, which ones, and why? Should any such
standards identified by the SCI entities and/or industry organizations
be formally approved or disapproved by the Commission as part of any
such process?
2. Systems Compliance
    Proposed Rule 1000(b)(2)(i) would require each SCI entity to
establish, maintain, and enforce written policies and procedures
reasonably designed to ensure that its SCI systems operate in the
manner intended, including in a manner that complies with the federal
securities laws and rules and regulations thereunder and the entity's
rules and governing documents, as applicable.\216\ Whereas proposed
Rule 1000(b)(1) concerns the robustness of the SCI entity's SCI systems
and SCI security systems--i.e., such systems' capacity and resiliency
against failures and security threats--proposed Rule 1000(b)(2)
concerns the SCI entity's establishment of policies and procedures
reasonably designed to ensure the operational compliance of an SCI
entity's SCI systems with applicable laws, rules, and the SCI entity's
governing documents. Diligent discharge of this proposed obligation to
establish, maintain, and enforce written policies and procedures would
establish the organizational framework for an SCI entity to meet its
other obligations under proposed Regulation SCI. In particular, with
respect to SCI SROs, compliance with proposed Rule 1000(b)(2)(i) should
help to ensure that SCI SROs comply with Section 19(b)(1) of the
Exchange Act, which requires each SRO to file with the Commission
copies of any proposed rule or any proposed change in, addition to, or
deletion from the rules of the SRO.\217\ Therefore, compliance with
this proposed requirement may help ensure not only that SCI SROs
operate in compliance with the Exchange Act, but also help reinforce
existing processes for filing SRO rule changes in order to better
assist market participants and the public in understanding how the SCI
systems of SCI SROs are intended to operate.\218\
---------------------------------------------------------------------------

    \216\ See supra Section III.B.3.b, discussing the definition of
``systems compliance issue.''
    \217\ See 15 U.S.C. 78s(b)(1).
    \218\ SCI SROs would similarly be assisted in meeting their
obligations to file plan amendments to SCI Plans under Rule 608 of
Regulation NMS.
---------------------------------------------------------------------------

    Because of the complexity of SCI systems and the breadth of the
federal securities laws and rules and regulations thereunder and the
SCI entities' rules and governing documents, the Commission
preliminarily believes that it would be appropriate to provide an
explicit safe harbor for SCI entities and their employees in order to
provide greater clarity as to how they can ensure that their conduct
will comply with this provision. Therefore, the Commission is proposing
Rules 1000(b)(2)(ii) and (iii), which would provide a safe harbor from
liability under proposed Rule 1000(b)(2)(i) for SCI entities and
persons employed by SCI entities, respectively, as further described
below.
    Specifically, proposed Rule 1000(b)(2)(ii) would provide that an
SCI entity would be deemed not to have violated proposed Rule
1000(b)(2)(i) if: (A) the SCI entity has established and maintained
policies and procedures reasonably designed to provide for: (1) Testing
of all SCI systems and any changes to such systems prior to
implementation; (2) periodic testing of all such systems and any
changes to such systems after their implementation; (3) a system of
internal controls over changes to such systems; (4) ongoing monitoring
of the functionality of such systems to detect whether they are
operating in the manner intended; (5) assessments of SCI systems
compliance performed by personnel familiar with applicable federal
securities laws and rules and regulations thereunder and the SCI
entity's rules and governing documents, as applicable; and (6) review
by regulatory personnel of SCI systems design, changes, testing, and
controls to prevent, detect, and address actions that do not comply
with applicable federal securities laws and rules and regulations
thereunder and the SCI entity's rules and governing documents, as
applicable; (B) the SCI entity has established and maintained a system
for applying such policies and procedures which would reasonably be
expected to prevent and detect, insofar as practicable, any violations
of such policies and procedures by the SCI entity or any person
employed by the SCI entity; and (C) the SCI entity: (1) has reasonably
discharged the duties and obligations incumbent upon the SCI entity by
such policies and procedures, and (2) was without reasonable cause to
believe that such policies and procedures were not being complied with
in any material respect.
    The Commission preliminarily believes that, if an SCI entity
establishes and maintains policies and procedures reasonably designed
to provide for the items in proposed Rule 1000(b)(2)(ii)(A)(1)-(6),
such policies and procedures would meet the requirement articulated in
proposed Rule 1000(b)(2)(i). Specifically, the Commission preliminarily
believes that items (1) and (2), which, for purposes of qualifying for
the safe harbor, would require SCI entities to have policies and
procedures requiring the testing of SCI systems and changes to such
systems before they are put into production and periodically
thereafter, should help SCI entities to identify potential problems
before such problems have the ability to impact markets and investors.
Items (3) and (4), which, for purposes of qualifying for the safe
harbor, would require a system of internal controls over changes to SCI
systems and ongoing monitoring of the functionality of such systems,
would provide a framework for SCI entities seeking to bring newer,
faster, and more innovative SCI systems online. In conjunction with
ongoing monitoring, the Commission preliminary believes the policies
and procedures proposed to be required in items (3) and (4) for
purposes of qualifying for the safe harbor, would help prevent SCI
systems becoming noncompliant resulting from, for example, inattention
or failure to review compliance with established written policies and
procedures.

    Further, the Commission preliminarily believes that item (5)
(which, for purposes of qualifying for the safe harbor, would require
that an SCI entity establish, maintain, and enforce written policies
and procedures for assessments of SCI systems compliance by personnel
familiar with applicable federal securities laws, rules and regulations
thereunder, and the SCI entity's rules and governing documents), in
conjunction with item (6) (which, for purposes of qualifying for the
safe harbor, would require policies and procedures directing that
regulatory personnel review SCI systems design, changes, testing, and
controls), would help foster coordination between the information
technology and regulatory staff of an SCI entity so that SCI events and
other issues related to an SCI entity's SCI systems would be more
likely to be addressed by a team of staff in possession of the
requisite range of knowledge and skills to help ensure compliance with
the SCI entity's obligations under proposed Regulation SCI.
    Insofar as an SCI entity follows them to qualify for the safe
harbor, proposed items (5) and (6) also are intended to help to ensure
that an SCI entity's business interests do not undermine regulatory,
surveillance, and compliance functions and, more broadly, the
requirements of the federal securities laws, during the development,
testing, implementation, and operation processes for SCI systems. Thus,
proposed items (1)-(6) together, insofar as SCI entities follow them to
qualify for the safe harbor, are meant to promote the development and
implementation of policies and procedures consistent with the
functioning of SCI systems of SCI entities as planned and as described
by the SCI entity's rules and governing documents, as well as in
compliance with applicable federal securities laws and rules.\219\
---------------------------------------------------------------------------

    \219\ See supra note 154-156 and accompanying text.
---------------------------------------------------------------------------

    In addition to establishing and maintaining the policies and
procedures described in proposed Rule 1000(b)(2)(ii)(A)(1)-(6), to
qualify for the safe harbor, an SCI entity would also be required to
satisfy two additional requirements. First, under proposed Rule
1000(b)(2)(ii)(B), it would be required to have established and
maintained a system for applying such policies and procedures which
would reasonably be expected to prevent and detect, insofar as
practicable, any violations of such policies and procedures by the SCI
entity or any person employed by the SCI entity. In addition, under
proposed Rule 1000(b)(2)(ii)(C), the SCI entity would be required to:
(1) Have reasonably discharged the duties and obligations incumbent
upon it by such policies and procedures; and (2) have been without
reasonable cause to believe that such policies and procedures were not
being complied with in any material respect. To the extent an SCI
entity seeks to qualify for the safe harbor, the elements of proposed
Rules 1000(b)(2)(ii)(B) and (C) would require not only that its
policies and procedures are reasonably designed to achieve SCI systems
compliance, as described in items (A)(1)-(6) above, but also that, as
part of such policies and procedures, the SCI entity establishes and
maintains a system for applying those policies and procedures, and
enforces its policies and procedures, in a manner that would reasonably
allow it to prevent and detect violations of the policies and
procedures. Proposed Rules 1000(b)(2)(ii)(B) and (C) are also designed
to ensure that the SCI entity reasonably discharges duties and
obligations incumbent upon it by such policies and procedures and is
without reasonable cause to believe that such policies and procedures
were not being complied with in any material respect.
    In addition, proposed Rule 1000(b)(2)(iii) would provide a safe
harbor from liability for individuals. Specifically, proposed Rule
1000(b)(2)(iii) would provide that a person employed by an SCI entity
shall be deemed not to have aided, abetted, counseled, commanded,
caused, induced, or procured the violation by any other person of
proposed Rule 1000(b)(2)(i) if the person employed by the SCI entity
has reasonably discharged the duties and obligations incumbent upon
such person by such policies and procedures, and was without reasonable
cause to believe that such policies and procedures were not being
complied with in any material respect. The Commission preliminarily
believes that the safe harbor for individuals under proposed Rule
1000(b)(2)(iii) would appropriately provide protection from liability
under Rule 1000(b)(2) to employees of SCI entities who reasonably
conduct their assigned responsibilities under the SCI entity's policies
and procedures and do not have reasonable cause to believe the policies
and procedures were not being complied with in any material respect.
    In this regard, an SCI entity would not be deemed to violate
proposed Rule 1000(b)(2)(i) merely because it experienced a systems
compliance issue, and could take advantage of the safe harbor for SCI
entities if it satisfied the elements enumerated in proposed Rule
1000(b)(2)(ii).\220\ Likewise, an employee of an SCI entity, including
an employee involved in the design or implementation of policies and
procedures under the rule, would not be deemed to have aided, abetted,
counseled, commanded, caused, induced, or procured the violation by any
other person of proposed Rule 1000(b)(2)(i) merely because the SCI
entity at which he or she worked experienced a systems compliance
issue, whether or not the employee was able to take advantage of the
safe harbor for individuals under proposed Rule 1000(b)(2)(iii).
---------------------------------------------------------------------------

    \220\ The language of proposed Rules 1000(b)(2)(ii)(B) and (C)
is drawn in significant part from language in Section 15(b)(4)(E) of
the Exchange Act, 15 U.S.C. 78o(b)(4)(E), which generally provides a
safe harbor from liability for failure to supervise, with a view to
preventing violations of the securities laws, another person who is
subject to his or her supervision and who commits such a violation.
---------------------------------------------------------------------------

Request for Comment
    96. The Commission requests comment generally on all aspects of
proposed Rule 1000(b)(2). Do commenters believe that it is appropriate
to limit the application of the requirements of proposed Rule
1000(b)(2)(i) to SCI systems? Why or why not? Please explain. Do
commenters agree with the requirements of the proposed safe harbor for
SCI entities? Why or why not? Specifically, with respect to proposed
Rule 1000(b)(2)(ii)(A)(1), which would include in the safe harbor a
requirement that each SCI entity establish and maintain written
policies and procedures that provide for testing of all SCI systems and
any changes to such systems prior to implementation, should certain
types of SCI systems be excluded from the proposed requirement? If so,
please specify which types and explain.
    97. Should the Commission specify the interval at which SCI
entities would be required to conduct the periodic testing of all SCI
systems contemplated by the safe harbor under proposed Rule
1000(b)(2)(ii)(A)(2)? Why or why not? And if so, what would be an
appropriate interval? Should certain types of SCI systems be tested on
a more or less frequent basis? If so, please specify which types and
explain.
    98. With respect to proposed Rule 1000(b)(2)(ii)(A)(3), which would
include in the safe harbor a requirement that an SCI entity establish
and maintain written policies and procedures that provide for a system
of internal controls over changes to SCI

systems, should the Commission specify minimum standards for internal
controls? If so, please explain why, as well as what such standards
should be.
    99. With respect to proposed Rule 1000(b)(2)(ii)(A)(4), which would
include in the safe harbor a requirement that an SCI entity establish
and maintain written policies and procedures that provide for ongoing
monitoring of the functionality of SCI systems to detect whether they
are operating in the manner intended, should the Commission specify the
frequency with which the monitoring of such systems' functionality
should occur? If so, please explain. Should the Commission require
different monitoring frequencies depending on the type of SCI system?
Why or why not? If so, what should they be? Please explain.
    100. For purposes of the safe harbor and proposed Rule
1000(b)(2)(ii)(A)(5), do commenters believe the Commission should
require that the assessments of SCI systems compliance be performed by
persons having specified qualifications? Why or why not? If so, what
would be appropriate and/or necessary qualifications for such
personnel?
    101. Proposed Rule 1000(b)(2)(ii)(A)(6) would include in the safe
harbor a requirement that each SCI entity establish and maintain
policies and procedures that provide for review by regulatory personnel
of SCI systems design, changes, testing, and controls to prevent,
detect, and address actions that are not in compliance with applicable
federal securities laws and rules and regulations thereunder and the
SCI entity's rules and governing documents, as applicable. Do
commenters believe, for purposes of qualifying for the safe harbor, the
roles and allocations of responsibility for personnel in proposed Rules
1000(b)(2)(ii)(A)(5) and (6) are appropriate? Why or why not?
    102. Do commenters agree that in order for an SCI entity to qualify
for the safe harbor from liability under proposed Rule 1000(b)(2)(i),
it should, in addition to establishing and maintaining the policies and
procedures described in proposed Rule 1000(b)(2)(ii)(A)(1)-(6), be
required to establish and maintain a system for applying such policies
and procedures which would reasonably be expected to prevent and
detect, insofar as practicable, any violations of such policies and
procedures by the SCI entity or any person employed by the SCI entity?
Why or why not? To qualify for the safe harbor from liability under
proposed Rule 1000(b)(2)(i), should an SCI entity be further required
to: have reasonably discharged the duties and obligations incumbent
upon the SCI entity by such policies and procedures; and be without
reasonable cause to believe that such policies and procedures were not
being complied with in any material respect? Why or why not? Please
explain.
    103. Do commenters agree with the requirements for the proposed
safe harbor for individuals in proposed Rule 1000(b)(2)(iii), which
would provide that a person employed by an SCI entity shall be deemed
not to have aided, abetted, counseled, commanded, caused, induced, or
procured the violation by any other person of proposed Rule
1000(b)(2)(i) if the person employed by the SCI entity: has reasonably
discharged the duties and obligations incumbent upon such person by
such policies and procedures; and was without reasonable cause to
believe that such policies and procedures were not being complied with
in any material respect? Why or why not? Should a similar safe harbor
be available to individuals other than persons employed by SCI
entities? Why or why not? Please explain.
    104. Do commenters agree with the Commission's proposed policies
and procedures approach to the requirements of proposed Rule
1000(b)(2)? Why or why not? If not, is there another approach that is
more appropriate? If so, please describe and explain. As discussed
above, the Commission is proposing to include safe harbor provisions in
proposed Rule 1000(b)(2) for SCI entities and employees of SCI
entities. The Commission preliminarily believes that, in the context of
proposed Regulation SCI, this approach may be appropriate to provide
clarity and guidance to SCI entities and SCI entity employees on one
method to comply with the proposed general standard in proposed Rule
1000(b)(2)(i). The Commission solicits commenters' views on the
Commission's proposed approach. Specifically, do commenters agree with
the Commission's proposed approach to provide safe harbors for SCI
entities and employees of SCI entities from liability under proposed
Rule 1000(b)(2)(i)? Why or why not? How do commenters believe the
actions of SCI entities or behavior of employees of SCI entities might
differ if the safe harbors under proposed Rule 1000(b)(2) were not
available? What are the costs and benefits of the Commission's approach
to provide safe harbors? What would be the costs and benefits of other
approaches? Please explain.
    105. Do commenters believe there are specific internal controls or
other mechanisms that would reinforce the effectiveness of an SCI
entity's reasonably designed policies and procedures under proposed
Rule 1000(b)(2)? Why or why not? Please explain. How do SCI entities
presently use specific internal controls or other mechanisms to ensure
that their systems operate in a manner that complies with the federal
securities laws and rules and regulations thereunder and their rules
and governing documents, as applicable? How do commenters generally
view the advantages and disadvantages of specific internal controls or
other mechanisms? The Commission is not proposing to prescribe specific
internal controls related to compliance with proposed Rule 1000(b)(2).
Should the Commission propose that any particular internal controls or
other mechanisms be required (for example, that a senior officer be
designated to be responsible for the SCI entity's compliance with
proposed Regulation SCI, or that personnel of the SCI entity certify
that the SCI entity's policies and procedures are reasonably designed)?
3. SCI Events--Action Required; Notification
    Proposed Rule 1000(b)(3)-(5) would govern the actions an SCI entity
must take upon any responsible SCI personnel becoming aware of an SCI
event, whether it be a systems disruption, systems compliance issue, or
systems intrusion.\221\
---------------------------------------------------------------------------

    \221\ See supra Section III.B.3 for a discussion of the proposed
definition of systems disruption, systems compliance issue, and
systems intrusion.
---------------------------------------------------------------------------

a. Corrective Action
    Proposed Rule 1000(b)(3) would require an SCI entity, upon any
responsible SCI personnel becoming aware of an SCI event, to begin to
take appropriate corrective action including, at a minimum, mitigating
potential harm to investors and market integrity resulting from the SCI
event and devoting adequate resources to remedy the SCI event as soon
as reasonably practicable. The Commission is proposing this requirement
to make clear that, upon learning of an SCI event, an SCI entity would
be required to take the steps necessary to remedy the problem or
problems causing the SCI event and mitigate the effects of the SCI
event, if any, on customers, market participants and the securities
markets.
    Proposed Rule 1000(a) would define ``responsible SCI personnel'' to
mean, for a particular SCI system or SCI security system impacted by an
SCI event, any personnel, whether an

employee or agent, of an SCI entity having responsibility for such
system. The proposed definition is intended to include any personnel
used by the SCI entity that has responsibility for the specific
system(s) impacted by a given SCI event. Thus, such personnel would
include, for example, any technology, business, or operations staff
with responsibility for such systems. With respect to systems
compliance issues, such personnel would also include regulatory, legal,
or compliance personnel with legal or compliance responsibility for
such systems. In addition, such ``responsible SCI personnel'' would not
be limited to managerial or senior-level employees of the SCI entity.
For example, the proposed definition is intended to include a junior
systems analyst responsible for monitoring the operations or testing of
an SCI system or SCI security system. The proposed definition would
also include not only applicable employees of the SCI entity, but
applicable agents of the SCI entity as well. Thus, for example, if an
SCI entity were to contract the monitoring of the operations of a given
SCI system to an external firm, the proposed definition of
``responsible SCI personnel'' would include the personnel of such firm
that were responsible for the monitoring. The proposed definition,
however, is not intended to include all personnel of an SCI entity. For
example, personnel of the SCI entity who have no responsibility for any
SCI system or SCI security system of an SCI entity are not intended to
be included in the proposed definition.
b. Commission Notification
    Proposed Rule 1000(b)(4) would address the obligation of an SCI
entity to notify the Commission upon any responsible SCI personnel
becoming aware of an SCI event.\222\ Proposed Rule 1000(b)(4)(i) would
require an SCI entity, upon any responsible SCI personnel \223\
becoming aware of a systems disruption that the SCI entity reasonably
estimates would have a material impact on its operations or on market
participants, any systems compliance issue, or any systems intrusion
(``immediate notification SCI event''), to notify the Commission of
such SCI event, which may be done orally or in writing (e.g., by
email). Proposed Rule 1000(b)(4)(ii) would require an SCI entity to
submit a written notification pertaining to any SCI event to the
Commission within 24 hours of any responsible SCI personnel becoming
aware of the SCI event. Proposed Rule 1000(b)(4)(iii) would require an
SCI entity to submit to the Commission continuing written updates on a
regular basis, or at such frequency as reasonably requested by a
representative of the Commission, until such time as the SCI event is
resolved.\224\
---------------------------------------------------------------------------

    \222\ Proposed Rule 1000(b)(5), addressed in Section III.C.3.c
below, would address whether and when an SCI entity would be
required to disseminate information regarding an SCI event to its
members or participants.
    \223\ See supra III.C.3.a (discussing definition of
``responsible SCI personnel'').
    \224\ See supra Section III.B.3.d, for a discussion of
dissemination SCI events.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(4) also would require that any written
notification to the Commission made pursuant to proposed Rules
1000(b)(4)(ii) or 1000(b)(4)(iii) be made electronically on new
proposed Form SCI (Sec.  249.1900), and include all information as
prescribed in Form SCI and the instructions thereto.\225\ To help
ensure that the Commission and its staff receive all information known
by the SCI entity relevant to aiding the Commission's understanding of
an SCI event, proposed Rule 1000(b)(4)(iv) would provide that a written
notification under proposed Rule 1000(b)(4)(ii) must include all
pertinent information known about an SCI event, including: (1) A
detailed description of the SCI event; (2) the SCI entity's current
assessment of the types and number of market participants potentially
affected by the SCI event; (3) the potential impact of the SCI event on
the market; and (4) the SCI entity's current assessment of the SCI
event, including a discussion of the SCI entity's determination
regarding whether the SCI event is a dissemination SCI event or
not.\226\ In addition, to the extent available as of the time of the
initial notification, Exhibit 1 would require inclusion of the
following information: (1) A description of the steps the SCI entity is
taking, or plans to take, with respect to the SCI event; (2) the time
the SCI event was resolved or timeframe within which the SCI event is
expected to be resolved; (3) a description of the SCI entity's rule(s)
and/or governing documents, as applicable, that relate to the SCI
event; and (4) an analysis of the parties that may have experienced a
loss, whether monetary or otherwise, due to the SCI event, the number
of such parties, and an estimate of the aggregate amount of such
loss.\227\
---------------------------------------------------------------------------

    \225\ New proposed Form SCI is discussed in detail in Section
III.E below.
    \226\ See proposed Rule 1000(b)(4)(iv)(A)(1).
    \227\ See proposed Rule 1000(b)(4)(iv)(A)(2).
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(4)(iv)(B) would require an SCI entity to
update any of the pertinent information contained in previous written
notifications, including any information required by proposed Rule
1000(b)(4)(iv)(A)(2) that was not available at the time of initial
submission. Subsequent notifications would be required to update any of
the pertinent information previously provided until the SCI event is
resolved.
    Proposed Rule 1000(b)(4)(iv)(C) would further require an SCI entity
to provide a copy of any information disseminated to date regarding the
SCI event to its members or participants or on the SCI entity's
publicly available Web site.
    The Commission preliminarily believes an SCI entity's obligation to
notify the Commission of significant SCI events should begin upon any
responsible SCI personnel becoming aware of an SCI event. Thus, for all
immediate notification SCI events, an SCI entity would be required to
notify the Commission of the SCI event. Such notification could be made
orally (e.g., by telephone) or in a written form (e.g., by email). The
Commission preliminarily believes that, by not prescribing the precise
method of communication for an initial notification of an immediate
notification SCI event under proposed Rule 1000(b)(4)(i), SCI entities
would have the needed flexibility to determine the most appropriate
method.\228\ Further, if the responsible SCI personnel became aware of
such an SCI event outside of normal business hours, the SCI entity
would still be required to notify the Commission at that time rather
than, for example, the start of the next business day. For all SCI
events, including immediate notification SCI events, an SCI entity
would be required to submit a written notification pertaining to such
SCI event to the Commission on Form SCI, and follow up with regular
written updates until the SCI event is resolved. Even if an SCI entity
had notified the Commission of an immediate notification SCI event in
writing as would be permitted under proposed Rule 1000(b)(4)(i), the
SCI entity would still be required to submit a separate written
notification on Form SCI pursuant to proposed Rule 1000(b)(4)(ii).\229\
---------------------------------------------------------------------------

    \228\ The Commission expects that it would establish a telephone
hotline, designated email accounts, or similar arrangements, to
enable receipt of notifications of immediate notification SCI
events.
    \229\ See proposed Rule 1000(b)(4)(iv), which would require that
written notifications under 1000(b)(4)(ii) be submitted on Form SCI,
and which would not provide for the ability of SCI entities to
submit a written notification of an immediate notification SCI event
on Form SCI.

---------------------------------------------------------------------------

    The Commission preliminarily believes that the proposed
notification requirement for immediate notification SCI events, the
proposed 24-hour time frame for submission of written notices, and the
proposed continuing update requirement, are appropriately tailored to
help the Commission and its staff quickly assess the nature and scope
of an SCI event, and help the SCI entity identify the appropriate
response to the SCI event, including ways to mitigate the impact of the
SCI event on investors and promote the maintenance of fair and orderly
markets. These requirements would help to ensure not only that the
Commission and its staff are kept apprised of such SCI events,
including their causes and their effect on the markets, but also that
the Commission is aware of the steps and resources necessary to correct
such SCI events, mitigate their effects on other SCI entities and the
market, and prevent recurrence to the extent possible. The Commission
also preliminarily believes that the proposal to require an SCI entity
to update the Commission regularly regarding an SCI event, or at such
frequency as reasonably requested by a representative of the
Commission, until the SCI event is resolved, provides appropriate
flexibility to the Commission to request additional information as
necessary, depending on the facts and circumstances of the SCI event
and the SCI entity's progress in resolving it. At the same time, the
Commission recognizes that the information required to be provided to
it by an SCI entity about an immediate notification SCI event under
proposed Rule 1000(b)(4)(i) would represent the SCI entity's initial
assessment of the SCI event, and that even the written notification on
Form SCI required under proposed Rule 1000(b)(4)(ii) may, in some
cases, be a preliminary assessment of the SCI event for which the SCI
entity may still be in the process of analyzing and assessing the
precise facts and circumstances related to the SCI event. Thus, the
Commission is proposing to only require that SCI entities provide
certain key information for the written notification required under
proposed Rule 1000(b)(4)(ii),\230\ and only provide certain additional
details ``to the extent available as of the time of the notification.''
\231\ In addition, the Commission's proposal allows for the SCI entity
to subsequently ``update any information previously provided regarding
the SCI event, including any information required by paragraph
(b)(4)(iv)(A)(2) which was not available at the time of the
notification made pursuant to paragraph (b)(4)(ii).'' \232\
---------------------------------------------------------------------------

    \230\ See proposed Rule 1000(b)(4)(iv)(A)(1).
    \231\ See proposed Rule 1000(b)(4)(iv)(A)(2).
    \232\ See proposed Rule 1000(b)(4)(iv)(B).
---------------------------------------------------------------------------

    Comprehensive reporting of all SCI events would facilitate the
Commission's regulatory oversight of the national securities markets.
The proposed reporting requirements should provide the Commission with
an aggregate and comprehensive set of data on SCI events, a significant
improvement over the current state of administration, whereby SCI
entities report events through multiple methods and with varying
consistency.\233\ The aggregated data that would result from the
reporting of SCI events would also permit the Commission to analyze
such data, e.g., to examine the most common types of events and the
types of systems most often affected. This ability to more efficiently
analyze a comprehensive set of data would help the Commission to carry
out its oversight responsibilities because it would help the Commission
identify more effectively, for example, areas of persistent or
recurring problems across the systems of all SCI entities.
---------------------------------------------------------------------------

    \233\ Currently, there is no Commission rule specifically
requiring SCI entities to notify the Commission of systems problems
in writing or in a specific format. Nevertheless, voluntary
communications of systems problems to Commission staff occur in a
variety of ways, including by telephone and email. The Commission
notes that proposed Rule 1000(b)(4) would impose a new reporting
requirement on SCI entities, regardless of whether they currently
voluntarily notify the Commission of SCI events on an ad hoc basis.
As such, the Commission preliminarily believes that a history of
voluntarily reporting such events to the Commission would not lessen
the future burden of reporting such events to the Commission on Form
SCI as required under proposed Rule 1000(b)(4).
---------------------------------------------------------------------------

    As discussed in greater detail below, the Commission also
preliminarily believes that submission of required notifications by SCI
entities by filing Form SCI in an electronic format would be less
burdensome and a more efficient filing process for SCI entities and the
Commission than the submission of such notices in non-standardized ad
hoc formats, as they are currently provided under the ARP Program.\234\
---------------------------------------------------------------------------

    \234\ See infra Section III.D.2 discussing proposed Rule
1000(d), requiring electronic filings on new proposed Form SCI, and
Section III.E, discussing information proposed to be required to be
submitted on new Form SCI. See also infra note 235 and accompanying
text.
---------------------------------------------------------------------------

c. Dissemination of Information to Members or Participants \235\
---------------------------------------------------------------------------

    \235\ The requirements relating to dissemination of information
relating to dissemination SCI events to members or participants
proposed to be included in Regulation SCI relate solely to
Regulation SCI. Nothing in proposed Regulation SCI should be
construed as superseding, altering, or affecting the reporting
obligations of SCI entities under other federal securities laws or
regulations. Accordingly, in the case of an SCI event, SCI entities
subject to the public company reporting requirements of Section 13
or Section 15(d) of the Exchange Act would need to ensure compliance
with their disclosure obligations pursuant to those provisions
(including, for example, with respect to Regulation S-K and Forms
10-K, 10-Q and 8-K) in addition to their disclosure and reporting
obligations under Regulation SCI. See, e.g., CF Disclosure Guidance:
Topic No. 2, Cybersecurity (October 13, 2011), available at: http://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm. As an
additional example, nothing in proposed Regulation SCI should be
construed as superseding the obligations such SCI entities may have
under Regulation FD.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(5) would require information relating to
dissemination SCI events to be disseminated to members or participants,
and specify the nature and timing of such disseminations, with a
limited delay permitted for certain systems intrusions, as discussed
further below.\236\ Proposed Rule 1000(b)(5)(i)(A) would require that
an SCI entity, promptly after any responsible SCI personnel \237\
becomes aware of a dissemination SCI event other than a systems
intrusion, disseminate to its members or participants the following
information about such SCI event: (1) The systems affected by the SCI
event; and (2) a summary description of the SCI event. In addition,
proposed Rule 1000(b)(5)(i)(B) would require an SCI entity to further
disseminate to its members or participants, when known: (1) A detailed
description of the SCI event; (2) the SCI entity's current assessment
of the types and number of market participants potentially affected by
the SCI event; and (3) a description of the progress of its corrective
action for the SCI event and when the SCI event has been or is expected
to be resolved. Proposed Rule 1000(b)(5)(i)(C) would further require an
SCI entity to provide regular updates to members or participants on any
of the information required to be disseminated under proposed Rules
1000(b)(5)(i)(A) and (i)(B).
---------------------------------------------------------------------------

    \236\ See supra Section III.B.3.d for a discussion of
dissemination SCI events.
    \237\ See supra III.C.3.a (discussing definition of
``responsible SCI personnel'').
---------------------------------------------------------------------------

    For the disseminations of information to members or participants to
be meaningful, the Commission preliminarily believes it would be
necessary for an SCI entity to describe the SCI event in sufficient
detail to enable a member or participant to determine whether and how
it was affected by the SCI event and make appropriate decisions based
on that determination. For example, the Commission preliminarily
believes that a general statement that a systems disruption occurred
that impacted trading for a certain period of time would not be
sufficient. The

dissemination of information should, for example, specify with
particularity such information as necessary to provide readers
meaningful context with regard to the issue, which may include but is
not limited to, details relating to, if applicable: the magnitude of
the issue (such as estimates with respect to the number of shares
affected, numbers of stocks affected, and total dollar volumes of the
affected trades); the specific system(s) or part of the system(s) that
caused the issue; the Commission and SCI entity rule(s) that relate
most directly to the issue; the specific time periods in which the
issue occurred, including whether the issue may be ongoing; and the
specific names of the securities affected. The Commission preliminarily
believes these proposed items, which concern the timing, nature, and
foreseeable possible consequences of a systems problem, comprise the
appropriate minimum detail that a member or participant would need to
assess whether an SCI event affected or would potentially affect that
member or participant, and would assist members and participants in
making investment or business decisions based on disclosed facts rather
than on speculation regarding, for example, the cause of a market
disruption.\238\
---------------------------------------------------------------------------

    \238\ See supra note 160, referring to Roundtable panelists
suggesting that communication and disclosure are important elements
of risk mitigation.
---------------------------------------------------------------------------

    The Commission preliminarily believes that it is appropriate to
require that the information specified by proposed Rule
1000(b)(5)(i)(A) be disseminated by the SCI entity to its members or
participants promptly after any responsible SCI personnel becomes aware
of an applicable dissemination SCI event. The Commission also
preliminarily believes that it is appropriate to require the further
dissemination of information specified by proposed Rule
1000(b)(5)(i)(B) ``when known'' by the SCI entity. These requirements
reflect the Commission's preliminary view that, given the sensitivities
of such dissemination of information, it is important that, before
information is shared with the SCI entity's members or participants,
the SCI entity be given a reasonable amount of time to gather, confirm,
and preliminarily analyze facts regarding a dissemination SCI event.
The Commission preliminarily believes that the value of dissemination
of information to an SCI entity's members or participants in these
circumstances is enhanced when the SCI entity has taken an appropriate
amount of time to ensure that the information it is sharing with its
members or participants is accurate, such that incorrect information
does not cause or exacerbate market confusion. At the same time, the
Commission preliminarily believes that it is important that basic
information about dissemination SCI events, such as those items
required by proposed Rule 1000(b)(5)(i)(A), be made available to
members or participants promptly.
    The proposed requirement relating to dissemination of information
to members or participants of dissemination SCI events, other than
systems intrusions as specified in proposed Rule 1000(b)(5)(i), is
intended to aid members or participants of SCI entities in determining
whether their trading activity has been or might be impacted by the
occurrence of an SCI event at an SCI entity, so that they could
consider that information in making trading decisions, seeking
corrective action or pursuing remedies, or taking other responsive
action. Further, the requirement to disseminate information regarding
dissemination SCI events could provide an incentive for SCI entities to
devote more resources and attention to improving the integrity and
compliance of their systems and preventing the occurrence of SCI
events.
    Proposed Rule 1000(b)(5)(ii) would provide a limited exception to
the proposed requirement of prompt dissemination of information to
members or participants for certain systems intrusions.\239\ Proposed
Rule 1000(b)(5)(ii) would require an SCI entity, promptly after any
responsible SCI personnel becomes aware of a systems intrusion, to
disseminate to its members or participants a summary description of the
systems intrusion, including a description of the corrective action
taken by the SCI entity and when the systems intrusion was resolved or
an estimate of when the systems intrusion is expected to be resolved,
unless the SCI entity determines that dissemination of such information
would likely compromise the security of the SCI entity's SCI systems or
SCI security systems, or an investigation of the systems intrusion, and
documents the reasons for such determination.\240\ The Commission
preliminarily believes that information relating to all dissemination
SCI events, including systems intrusions, should be disseminated to
members or participants, but that there may be circumstances in which
such dissemination of information relating to a systems intrusion
should be delayed, for example, to avoid compromising the investigation
or resolution of a systems intrusion.\241\ If an SCI entity determines
to delay the dissemination of information to members or participants
relating to a systems intrusion, it would be required to make an
affirmative determination and document the reasons for such
determination that such dissemination would likely compromise the
security of its SCI systems or SCI security systems, or an
investigation of the systems intrusion. If it cannot make such a
determination, or at whatever point in time such a determination no
longer applies, information relating to the systems intrusion would be
required to be disseminated to the SCI entity's members or
participants.
---------------------------------------------------------------------------

    \239\ As noted in supra note 235, the requirements relating to
information disseminations to members or participants proposed to be
included in Regulation SCI, including the proposal to permit an SCI
entity to delay such dissemination for certain systems intrusions,
relate solely to Regulation SCI. Nothing in proposed Regulation SCI
should be construed as superseding, altering, or affecting the
reporting obligations of SCI entities under other federal securities
laws or regulations.
    \240\ Unlike proposed Rule 1000(b)(5), proposed Rule 1000(b)(4)
(relating to Commission notification), discussed above in Section
III.C.3.b, would not provide for a delay in reporting any systems
intrusions to the Commission.
    \241\ See supra note 239.
---------------------------------------------------------------------------

    The information required to be disseminated to members or
participants for systems intrusions by proposed Rule 1000(b)(5)(ii) is
not as extensive as that required to be disseminated to members or
participants for other types of dissemination SCI events. The
Commission is sensitive to the fact that dissemination of too much
detailed information regarding a systems intrusion may provide hackers
or others seeking unauthorized entry into the systems of an SCI entity
with insights into the potential vulnerabilities of the SCI entity's
systems. At the same time, the occurrence of a systems intrusion may
reveal a weakness in the SCI systems or SCI security systems of the SCI
entity that warrants dissemination of information about such event to
the SCI entity's members or participants. Proposed Rule 1000(b)(5)(ii)
is therefore intended to strike an appropriate balance by requiring
dissemination to members or participants, which may be delayed when
necessary, of key summary information about a given systems intrusion.
Request for Comment
    106. The Commission requests comment on all aspects of proposed
Rules 1000(b)(3), (4), and (5).
    107. Do commenters believe the proposed definition of ``responsible
SCI personnel'' in proposed Rule 1000(a) is appropriate? Why or why
not? Please

explain. Is the proposed definition sufficiently clear? If not, why
not? Should the proposed definition only apply to personnel of a given
seniority, such as managerial personnel or officers of an SCI entity?
Why or why not? Should the proposed definition include both employees
and agents of an SCI entity? Why or why?
    108. As proposed to be required by Rule 1000(b)(3), do commenters
believe the Commission should require an SCI entity, upon any
responsible SCI personnel becoming aware of an SCI event, to begin to
take appropriate corrective action including, at a minimum, mitigating
potential harm to investors and market integrity resulting from the SCI
event and devoting adequate resources to remedy the SCI event as soon
as reasonably practicable? If not, why not? Should the proposed
requirement that an SCI entity take corrective action be triggered by
something other than awareness of an SCI event? If so, what would be an
appropriate trigger, and why?
    109. In addition to requiring an SCI entity to take appropriate
corrective action, should the Commission also require an SCI entity to
have written policies and procedures regarding how it should respond to
SCI events, such as an incident response plan that, for example, would
lay out in advance of any SCI event the courses of action,
responsibilities of personnel, chains of command, or similar
information regarding how the SCI entity and its personnel should
respond to various SCI event scenarios? Why or why not? Would such a
requirement be useful? What would be the potential costs and benefits
of such a requirement? Would SCI entities be able to meet the
requirements of proposed Rule 1000(b)(3) without developing such
response plans? \242\ Why or why not? Do SCI entities have such plans
in place today? If so, please describe.
---------------------------------------------------------------------------

    \242\ See also supra Section III.C.1.a (requesting comment on
proposed Rule 1000(b)(1)(i)(E) regarding policies and procedures for
development of business continuity plans and on whether the
Commission and/or SCI SROs should propose rules governing how such
plans are tested).
---------------------------------------------------------------------------

    110. With respect to proposed Rule 1000(b)(4), do commenters
believe the proposal to require an SCI entity to report all SCI events
to the Commission is appropriate?
    111. Are there SCI events that should not be required to be
reported to the Commission? If so, what are they, and why should
reporting of such SCI events not be required? Or, as an alternative,
would it be appropriate for the Commission to require SCI entities to
keep and preserve the documentation relating to certain types of SCI
events without sending that documentation to the Commission? Why or why
not? If so, how would commenters recommend the Commission distinguish
between SCI events that should be reported to the Commission and those
that should only be subject to a recordkeeping requirement? What do
commenters believe might be the advantages or disadvantages of such an
alternative approach? Do commenters believe proposed Rule 1000(b)(4)
may require the reporting of types of issues or types of information
that may not be critical to the goals of proposed Regulation SCI?
Please be specific and describe such situations.
    112. What criteria do ARP participants currently use for reporting
ARP events? How many SCI events would an SCI entity expect to report
each year?
    113. For immediate notification SCI events, is the initial
notification requirement in proposed Rule 1000(b)(4)(i) to the
Commission appropriate? Why or why not? If so, should this requirement
apply to such SCI events that occur outside normal business hours as
well? If not, what should be the requirement? Should the Commission
require a different notification procedure for immediate notifications
that might occur outside normal business hours? What are the advantages
and disadvantages of different methods of immediate notifications?
Please describe. Do commenters agree that those systems disruptions
that the SCI entity reasonably estimates would have a material impact
on its operations or on market participants should be subject to the
immediate notification requirement? Why or why not? Please explain. Do
commenters agree that all systems compliance issues should be subject
to the immediate notification requirement? Why or why not? Do
commenters agree that all systems intrusions should be subject to the
immediate notification requirement? Why or why not? Should additional
types of SCI events be subject to the immediate notification
requirement? If so, which types of SCI events? Please be specific.
    114. Do commenters agree with the proposed 24-hour written
notification requirement for all SCI events?
    115. Do commenters believe it is appropriate to require that
written updates be submitted regularly until an SCI event is resolved,
or at such frequency as reasonably requested by a representative of the
Commission?
    116. Do commenters believe the proposed required dissemination of
information to an SCI entity's members or participants regarding
dissemination SCI events set forth in proposed Rule 1000(b)(5) are
appropriate? If not, why not? Do commenters believe that requiring the
dissemination of information about dissemination SCI events to members
or participants would promote dissemination of information to persons
who are most directly affected by such events? Why or why not? With
respect to proposed Rule 1000(b)(5), should any of the proposed
requirements relating to dissemination of information to members or
participants be eliminated or modified? \243\ Please explain. What
other information, if any, should be required to be disseminated to
members or participants? Please explain. Could these proposed
requirements have any negative or unintended impact on the market or
market participants? If so, please explain.
---------------------------------------------------------------------------

    \243\ See also infra Section III.E.1, discussing proposed
Exhibit 3 to Form SCI, which would require that an SCI entity
provide a copy of any information disseminated to date regarding an
SCI event to its members or participants or on the SCI entity's
publicly available Web site.
---------------------------------------------------------------------------

    117. Do commenters agree with the timing requirements contained in
proposed Rule 1000(b)(5)? Do commenters agree that the initial
dissemination of information to members or participants should be
required promptly after an SCI entity's responsible SCI personnel
becomes aware of a dissemination SCI event, as would be required by
proposed Rule 1000(b)(5)(i)(A)? Do commenters believe that more
specific timing requirements would be more appropriate? If so, what
should such requirements be? Should there be a specific time period
requirement with respect to subsequent updates on the status of the
dissemination SCI event? Why or why not? For example, should there be a
requirement that an SCI entity provide updates daily or weekly? If so,
what additional specificity should be included?
    118. Do commenters believe it is appropriate to permit an SCI
entity to delay the dissemination of information to members or
participants for certain systems intrusions as proposed in Rule
1000(b)(5)(ii)? Should an SCI entity be required to immediately
disseminate information to members or participants regarding a systems
intrusion, with delays permitted only when the Commission specifically
authorizes the delay? Why or why not? Should the proposed rule impose a
maximum period of time that an SCI entity may delay its dissemination
of information to members or participants for certain systems
intrusions? Why or why not? If

so, what should such a maximum period of time be and should the rule
set forth a specific maximum time period applicable to all instances?
Please explain.
    119. Are there types of dissemination SCI events that should not be
required to be disseminated to members or participants? If so, what are
they, and why should it not be required?
    120. Should dissemination of information to members or participants
of any types of dissemination SCI events, other than those that are
systems intrusions, be delayed? If so, please describe the types of SCI
events and explain why. In addition, please describe the time period
within which commenters believe such types of dissemination SCI events
should be disseminated and why such time period would be appropriate.
    121. For any types of dissemination SCI events for which commenters
believe information should either not be required to be disseminated to
members or participants or be permitted to have a delay in
dissemination in certain circumstances (such as for systems
intrusions), what might be the impact of such non-dissemination or
delay in dissemination with respect to different types of market
participants?
    122. Are there SCI entities for which the proposed requirements in
Rules 1000(b)(3), (b)(4), and (b)(5) would not be appropriate (e.g.,
not cost-effective)? If so, please identify such entity or entities, or
the characteristics of such entity or entities, and explain which
proposed requirements would be inappropriate and why. Is the fact that
they might not be cost-effective an appropriate reason to omit them
generally for those SCI entities, or on a case-by-case basis, as the
Commission determined to be consistent with Exchange Act requirements?
    123. What are the current practices of SCI entities with respect to
the dissemination of information about systems issues to members or
participants? What type of information do SCI entities currently
disseminate? Please describe.
4. Notification of Material Systems Changes
    Proposed Rule 1000(b)(6) addresses notification to the Commission
regarding planned material systems changes,\244\ which the Commission
believes is important to help ensure it has information about important
changes at an SCI entity that may affect the SCI entity's ability to
effectively oversee the operations of its systems. Proposed Rule
1000(b)(6) would require an SCI entity, absent exigent circumstances,
to notify the Commission in writing at least 30 calendar days before
implementation of any planned material systems changes including a
description of the planned material systems changes as well as the
expected dates of commencement and completion of implementation of such
changes. A written notification to the Commission made pursuant to
paragraph (b)(6) would be required to be made electronically on Form
SCI and include all information as prescribed in Form SCI and the
instructions thereto.\245\
---------------------------------------------------------------------------

    \244\ See supra Section III.B.4 (discussing the proposed
definition of material systems change).
    \245\ See infra Section III.E.2, discussing proposed new Form
SCI and electronic submission of the notices required by proposed
Rule 1000(b)(6).
---------------------------------------------------------------------------

    The Commission preliminarily believes that the proposed 30 calendar
day requirement regarding pre-implementation written notification to
the Commission of planned material systems changes would be an
appropriate time period. The Commission has found through its
experience with the current ARP Inspection Program that this amount of
advance notice typically is needed to allow Commission staff to
effectively monitor technology developments associated with a planned
material systems change. A shorter timeframe might not provide
sufficient time for Commission staff to understand the impact of the
systems change; a longer time frame might unnecessarily interfere with
SCI entities' flexibility in planning and implementing systems changes.
    If exigent circumstances existed, or if the information previously
provided to the Commission regarding any planned material systems
change has become materially inaccurate, the SCI entity would be
required to notify the Commission, either orally or in writing, with
any oral notification to be memorialized within 24 hours after such
oral notification by a written notification, as early as reasonably
practicable.\246\ The existence of exigent circumstances would be
determined by the SCI entity and might exist where, for example, a
systems compliance issue or systems intrusion were discovered that
requires immediate corrective action to ensure compliance with the
Exchange Act and the rules and regulations thereunder, and/or the SCI
entity's own rules and procedures. In such cases, it would not be
prudent or desirable to delay corrective action simply to permit the 30
calendar days' advance notice required in non-exigent circumstances. In
addition, there may be circumstances where the information previously
provided to the Commission regarding a material systems change has
become materially inaccurate. For example, if a material systems
change's expected implementation completion date were to be
substantially delayed because of an inability to procure systems
components, or due to difficulties in systems programming, an update to
reflect this development would enable the Commission to make further
inquiry (as appropriate) in order to understand the potential
consequences of the delay. Similarly, an update would be required if
the SCI entity were to decide to significantly alter the scope of its
planned material systems change.
---------------------------------------------------------------------------

    \246\ See proposed Rule 1000(b)(6)(ii).
---------------------------------------------------------------------------

    The Commission notes further that, in such cases, an SCI entity
might separately be obligated to notify the Commission or its members
or participants pursuant to proposed Rules 1000(b)(4) and (5), as
discussed above.\247\
---------------------------------------------------------------------------

    \247\ See supra Section III.B.3.
---------------------------------------------------------------------------

Request for Comment
    124. The Commission requests comment generally on proposed Rule
1000(b)(6). Is the proposed requirement to notify the Commission in
advance of implementation of material systems changes appropriate?
    125. Should the Commission provide additional guidance on, or
define, what constitutes ``exigent circumstances'' that would obviate
the need for advance notification? If so, what information,
clarification, or definition would be helpful, and why?
    126. Do commenters believes that an SCI entity should be required
to provide updated information to the Commission regarding a planned
material systems change if the information previously provided to the
Commission regarding such change were to become materially inaccurate?
Why or why not?
    127. Do commenters believe that the proposed notification
requirements would discourage an SCI entity from making necessary
systems changes? Why or why not?
    128. Is the proposed requirement that an SCI entity report all
material systems changes too broad or too narrow? Why or why not?
Should all material systems changes be reported to the Commission? If
not, which systems changes should be excluded? Do commenters believe
the proposed rule should specify quantitative criteria or other minimum
thresholds for the effect of a change to an SCI entity's systems on the
entity's capacity, security, and operations, beyond which the SCI
entity would be

required to notify the Commission of the change?
    129. Do commenters believe it is appropriate for the Commission to
require a standardized format for disclosing planned material systems
changes on new proposed Form SCI? If not, why not? What would be a
better approach?
    130. Are there SCI entities for which the proposed requirements in
Rule 1000(b)(6) would not be appropriate (e.g., cost-effective)? If so,
please identify such entity or entities, or the characteristics of such
entity or entities, and explain which proposed requirements would be
inappropriate and why. If they are not cost-effective, would that be an
appropriate reason to omit them generally for those SCI entities, or on
a case-by-case basis, as the Commission determined to be consistent
with Exchange Act requirements?
    131. How often do SCI entities make material systems changes?
5. Review of Systems
    Proposed Rule 1000(b)(7) would require an SCI entity to conduct an
SCI review of the SCI entity's compliance with Regulation SCI not less
than once each calendar year, and submit a report of the SCI review to
senior management of the SCI entity no more than 30 calendar days after
completion of such SCI review. Proposed Rule 1000(a) would define the
term ``SCI review'' to mean a review, following established procedures
and standards, that is performed by objective personnel having
appropriate experience in conducting reviews of SCI systems and SCI
security systems, and which review contains: (1) A risk assessment with
respect to such systems of the SCI entity; and (2) an assessment of
internal control design and effectiveness to include logical and
physical security controls, development processes, and information
technology governance, consistent with industry standards.\248\ In
addition, such review would be required to include penetration test
reviews of the SCI entity's network, firewalls, development, testing
and production systems at a frequency of not less than once every three
years.\249\ The proposed requirement for an annual SCI review would
formalize a practice in place under the current ARP Inspection Program
in which SROs conduct annual systems reviews following established
audit procedures and standards that result in the presentation of a
report to senior SRO management on the recommendations and conclusions
of the review.\250\
---------------------------------------------------------------------------

    \248\ See infra discussion of proposed Rule 1000(b)(8). See also
supra publications listed in Table A, Domain: Audit.
    \249\ See proposed Rule 1000(a).
    \250\ See supra notes 17-21 and accompanying text. Although ARP
policy statements used the term ``independent,'' the Commission is
using the term ``objective'' in proposed Regulation SCI to
distinguish the meaning of ``objective'' from the meaning of
``independent,'' which may be considered a term of art in the
context of financial accounting audits.
---------------------------------------------------------------------------

    The risk assessment with respect to SCI entity's systems and
assessment of internal control design and effectiveness should help an
SCI entity assess the effectiveness of its information technology
practices and determine where to best devote resources, including
identifying instances in which the SCI entity was not in compliance
with the policies and procedures required by proposed Rules 1000(b)(1)
and (2). The penetration test reviews of the SCI entity's network,
firewalls, and development, testing and production systems should help
an SCI entity evaluate the system's security and resiliency in the face
of attempted and successful systems intrusions. In requiring a
frequency of not less than once every three years for penetration test
reviews, the Commission seeks to balance the frequency of such tests
with the costs associated with performing the tests.\251\
---------------------------------------------------------------------------

    \251\ See infra Section IV.D.2.d (estimating, among other
things, the cost of conducting SCI reviews, including penetration
test reviews).
---------------------------------------------------------------------------

    For such assessments and reviews to be effective, the Commission
preliminarily believes that it is important that they be conducted by
objective personnel having appropriate experience performing such types
of reviews. The Commission is not proposing a definition of the term
``objective,'' but preliminarily believes that to satisfy the criterion
that an SCI review be conducted by ``objective personnel,'' it should
be performed by persons who have not been involved in the development,
testing, or implementation of the systems being reviewed.\252\ The
Commission preliminarily believes that persons who were not involved in
the process for development, testing, or implementation of such systems
would likely be in a better position to identify weaknesses and
deficiencies that were not identified in the development, testing, and
implementation stages. As proposed, the SCI review could be performed
by personnel of the SCI entity (e.g., an SCI entity's internal audit
department) or an external firm with objective personnel.
---------------------------------------------------------------------------

    \252\ See also supra ARP II note 1 at 22492 n.9.
---------------------------------------------------------------------------

    In addition, proposed Rule 1000(b)(7) would require an SCI entity
to submit a report of the SCI review to senior management of the SCI
entity no more than 30 calendar days after completion of such SCI
review.\253\ The proposed 30-day time frame is based on the
Commission's experience with the current ARP Inspection Program that an
entity is able within 30 calendar days to consider the review and
prepare a report for senior management consideration prior to
submission to the Commission.
---------------------------------------------------------------------------

    \253\ This proposed requirement would formalize a recommendation
under the current ARP Inspection Program. See supra note 21 and
accompanying text.
---------------------------------------------------------------------------

Request for Comment
    132. The Commission requests comment on all aspects of proposed
Rule 1000(b)(7). Is the proposed definition of ``SCI review''
appropriate? Why or why not? And, if not, what would be an appropriate
definition?
    133. Is the proposed scope of the SCI review appropriate? Why or
why not? Is it sufficiently clear? Why or why not? Should the SCI
review include, as proposed in Rule 1000(a), an assessment of internal
control design and effectiveness to include logical and physical
security controls, development processes, and information technology
governance, consistent with industry standards? Why or why not? Should
it include, as proposed in Rule 1000(a), penetration test reviews of
the SCI entity's network, firewalls, development, testing and
production systems? Is the proposed frequency of such penetration test
reviews (i.e., not less than once every three years) appropriate? Why
or why not? Should it be more or less frequent? Why or why not?
    134. Do commenters agree with the proposed requirement that the
review be performed by persons with appropriate experience conducting
reviews of SCI systems and SCI security systems? Should the Commission
define how it would evaluate whether a person or persons performing the
review would satisfy the proposed requirement that they have
appropriate systems review experience? Are there any credentials or
specific qualifications that the Commission should require or specify
as meeting the requirement? For example, should the Commission specify
that a review be conducted by a Certified Information System Auditor
(CISA) or GIAC Systems and Network Auditor (GSNA) certification? \254\
---------------------------------------------------------------------------

    \254\ For further information regarding these certifications,
see, e.g., http://www.isaca.org/Certification/CISA-Certified-Information-Systems-Auditor/What-is-CISA/Pages/default.aspx and
http://www.giac.org/certifications.

---------------------------------------------------------------------------

    135. Should the term ``objective personnel'' be defined or further
clarified? If so, what should be such definition?
    136. Are there other elements that should be included in the scope
of the SCI review? If so, which ones? For example, should the review
include an assessment of the systems' compliance with the federal
securities laws and rules and regulations thereunder or the entity's
rules or governing documents as applicable? Why or why not?
    137. Under what circumstances do SCI entities presently use outside
consultants or other third parties to review their systems and
controls? When such outside reviews are conducted, what is the scope
and the stated purpose? How do outside reviews compare to internal
reviews by audit or other staff in terms of scope or other factors?
What are the considerations used by SCI entities in determining whether
and when to engage outside consultants? How do commenters generally
view the advantages and disadvantages of internal v. external reviews?
The Commission is not proposing at this time any requirements related
to third party reviews. Should the Commission propose to require that
SCI review be conducted by third parties?
    138. What are the current practices of SCI entities with respect to
reviews of their SCI systems and SCI security systems? How often are
such reviews conducted? Who conducts such reviews? What do such reviews
entail? What types of assessments or tests are included in such
reviews? Do such reviews include penetration test reviews? Please
describe.
    139. Do commenters agree with the proposal to require an SCI entity
to submit a report of the SCI review to senior management of the SCI
entity no more than 30 calendar days after completion of such SCI
review? Why or why not? Is the 30-day time frame reasonable? Would a
shorter or longer time period be more appropriate, such as 20, 45, or
60 days? If so, what should such a time period be and why? Please
explain.
6. Periodic Reports
    Proposed Rule 1000(b)(8)(i) would require an SCI entity to submit
to the Commission a report of the SCI review required by paragraph
(b)(7), together with any response by senior management, within 60
calendar days after its submission to senior management of the SCI
entity.
    The proposed requirement to submit a report of the SCI review
required by paragraph (b)(7), together with any response by senior
management, within 60 calendar days after its submission to senior
management of the SCI entity, is designed to ensure that the senior
management of the SCI entity is aware of any issues with its systems
and promptly establishes plans for resolving such issues. The
Commission preliminarily believes that the report would also help
ensure that the Commission and its staff receive the report and any
management response in a timely manner,\255\ would help to ensure that
the Commission is aware of areas that may warrant more focused
attention during its inspections (i.e., which SCI entities would
already have identified for itself through its SCI review), and would
allow the Commission to review the SCI entity's progress in resolving
any systems issues. Further, the proposed requirement to submit the
annual report within 60 calendar days after its submission to senior
management is based on the Commission's experience with the current ARP
Inspection Program that 60 calendar days after completion of an annual
review or report is a sufficient period of time to enable senior
management to consider such review or report before submitting it to
the Commission.
---------------------------------------------------------------------------

    \255\ See infra Section III.E.3 and General Instructions to the
Form, explaining that, ``within 60 calendar days after its
submission to senior management of the SCI entity, the SCI entity
shall attach [as Exhibit 5] the report of the SCI review of the SCI
entity's compliance with Regulation SCI, together with any response
by senior management.''
---------------------------------------------------------------------------

    In addition, proposed Rule 1000(b)(8)(ii) would require each SCI
entity to submit a report within 30 calendar days after the end of June
and December of each year containing a summary description of the
progress of any material systems change during the six-month period
ending on June 30 or December 31, as the case may be, and the date, or
expected date, of completion of implementation of such changes. The
proposed requirement to submit these semi-annual reports within 30
calendar days of the end of each semi-annual period is designed to
ensure that the Commission would have regularly updated information
with respect to the status of ongoing material systems changes that
were originally reported pursuant to proposed Rule 1000(b)(6).\256\
This proposed requirement would formalize a practice in place under the
current ARP Inspection Program in which senior information technology,
audit, and compliance staff of certain SROs prepare such reports in
advance of meeting with Commission staff periodically throughout the
year to present and discuss recently completed systems projects and
proposed systems projects. Further, the proposed requirement to submit
the semi-annual report within 30 calendar days after the end of the
applicable semi-annual period is based on the Commission's experience
with the current ARP Inspection Program that 30 calendar days after
completion of a report is a sufficient time period to enable senior
management to consider such report before submitting it to the
Commission. The Commission is proposing to require these reports to be
submitted to the Commission on a semi-annual basis because the proposal
would separately require information relating to planned material
systems changes to be submitted (absent exigent circumstances or when
information regarding any planned material systems change becomes
materially inaccurate) at least 30 calendar days before their
implementation \257\ and thus requiring an ongoing summary report more
frequently would not, in the Commission's preliminary view, be
necessary. On the other hand, the Commission is concerned that a longer
period of time (such as on an annual basis) would permit significant
updates and milestones relating to systems changes to occur without
notice to the Commission.
---------------------------------------------------------------------------

    \256\ As discussed above in supra Section III.C.4, proposed Rule
1000(b)(6)(ii) would require SCI entities to provide the Commission
with an update if the information it previously provided to the
Commission regarding any planned material systems change had become
materially inaccurate.
    \257\ See proposed Rule 1000(b)(6); see supra notes 244-247 and
accompanying text.
---------------------------------------------------------------------------

    Pursuant to proposed Rule 1000(b)(8)(iii), the reports required to
be submitted to the Commission by proposed Rule 1000(b)(8) would be
required to be submitted electronically as prescribed in Form SCI and
the instructions thereto.\258\
---------------------------------------------------------------------------

    \258\ See infra Section III.E discussing new proposed Form SCI
and its contemplated use by SCI entities to submit reports and other
required information to the Commission electronically in a
standardized format with attachments when and as required.
---------------------------------------------------------------------------

Request for Comment
    140. Do commenters believe it would be appropriate to require SCI
entities to submit a report of an SCI review to the Commission within
60 calendar days of its submission to senior management of the SCI
entity? Should the Commission lengthen or shorten the time period for
submission? Why or why not? If so, what is an appropriate period?

    141. Is the proposed requirement to submit semi-annual reports on
material systems changes necessary or appropriate? Do commenters
believe it would be appropriate to require each SCI entity to submit a
semi-annual report within 30 calendar days after the end of each semi-
annual period containing a description of the progress of any material
systems change during the applicable semi-annual period and the date,
or expected date, of completion of implementation? Should the
Commission lengthen or shorten the 30-day period for submission? Is the
semi-annual submission requirement appropriate or should these reports
be required to be submitted more or less frequently? If so, please
state what such frequency should be and why.
    142. Are there any other reports the Commission should require of
SCI entities? If so, please explain.
    143. Are there SCI entities for which the proposed requirements in
Rule 1000(b)(8) would not be cost-effective? If so, please identify
such entity or entities, or the characteristics of such entity or
entities. For proposed requirements that commenters believe would not
be cost-effective, would that be an appropriate reason to omit them
generally for those SCI entities, or on a case-by-case basis, as the
Commission determines to be consistent with Exchange Act requirements?
7. Proposed Rule 1000(b)(9): SCI Entity Business Continuity and
Disaster Recovery Plans Testing Requirements for Members or
Participants
    The Commission is proposing Rule 1000(b)(9), which would address
testing of SCI entity business continuity and disaster recovery plans,
including backup systems, by SCI entity members or participants.
Specifically, proposed Rule 1000(b)(9)(i) would require an SCI entity,
with respect to its business continuity and disaster recovery plans,
including its backup systems, to require participation by designated
members or participants in scheduled functional and performance testing
of the operation of such plans, in the manner and frequency as
specified by the SCI entity, at least once every 12 months. Proposed
Rule 1000(b)(9)(ii) would further require an SCI entity to coordinate
such testing on an industry- or sector-wide basis with other SCI
entities. Proposed Rule 1000(b)(9)(iii) would require each SCI entity
to designate those members or participants it deems necessary, for the
maintenance of fair and orderly markets in the event of the activation
of its business continuity and disaster recovery plans, to participate
in the testing of such plans. Proposed Rule 1000(b)(9)(iii) would also
require each SCI entity to notify the Commission of such designations
and its standards for designation on Form SCI and promptly update such
notification after any changes to its designations or standards.\259\
---------------------------------------------------------------------------

    \259\ The proposed rule does not specify when the Commission
would need to be notified about the designations and standards
because SCI entities would be required to provide an initial
notification at such point as when proposed Regulation SCI were
effective, and subsequent updates only promptly after its
designations and/or standards changed.
---------------------------------------------------------------------------

    The Commission preliminarily believes that the testing
participation requirement in proposed Rule 1000(b)(9) would help an SCI
entity to ensure that its efforts to develop effective business
continuity and disaster recovery plans are not undermined by a lack of
participation by its members or participants that the SCI entity
believes would be necessary to the success of such plans if they were
to be put into effect. The Commission further preliminarily believes
that the appropriate standard for measuring whether a business
continuity and disaster recovery plans can be activated successfully is
whether such activation would likely result in the maintenance of fair
and orderly markets, a goal Congress found important in adopting
Section 11A of the Exchange Act.\260\
---------------------------------------------------------------------------

    \260\ See Section 11A(a)(1)(C) and (a)(2), 15 U.S.C. 76k-
1(a)(1)(C) and (a)(2).
---------------------------------------------------------------------------

    The 2003 Interagency White Paper, which underlies the requirement
in proposed Rule 1000(b)(1)(i)(E) pertaining to business continuity and
disaster recovery plans,\261\ identifies three important business
continuity objectives that would apply to SCI entities: (1) Rapid
recovery and timely resumption of critical operations following a wide-
scale disruption; (2) rapid recovery and timely resumption of critical
operations following the loss or inaccessibility of staff in at least
one major operating location; and (3) a high level of confidence,
through ongoing use or robust testing, that critical internal and
external continuity arrangements are effective and compatible.\262\ The
2003 Interagency White Paper also states that it is a ``sound
practice'' for organizations to ``routinely use or test recovery and
resumption arrangements.'' \263\ Further, the Commission's 2003 Policy
Statement on Business Continuity Planning for Trading Markets states,
among other things, that market centers, including SROs, are to: (1)
Have in place a business continuity plan that anticipates the
resumption of trading in the securities traded by that market no later
than the next business day following a wide-scale disruption; (2)
maintain appropriate geographic diversity between primary and back-up
sites in order to assure resumption of trading activities by the next
business day; and (3) confirm the effectiveness of the backup
arrangements through testing.\264\ SCI entities that currently
participate in the ARP Inspection Program are familiar with the
standards identified in the 2003 Interagency White Paper and the
Commission's 2003 Policy Statement on Business Continuity Planning for
Trading Markets.
---------------------------------------------------------------------------

    \261\ The 2003 Interagency White Paper is included in Table A as
a proposed SCI industry standard. See supra Section III.C.1.b.
    \262\ See supra note 195.
    \263\ See id.
    \264\ See supra notes 32 and 196.
---------------------------------------------------------------------------

    As noted above,\265\ the experience of the equities and options
markets in the wake of Superstorm Sandy demonstrates the importance of
not only an SCI entity itself being able to operate following an event
that triggers its business continuity and disaster recovery plans, but
also that the members or participants of the SCI entity be able to
conduct business with such SCI entity when its business continuity and
disaster recovery plans have been activated. The Commission
preliminarily believes that, even if an SCI entity is able to operate
following an event that triggers its business continuity and disaster
recovery plans, unless there is effective participation by certain of
its members or participants in the testing of such plans, the objective
of ensuring resilient and available markets in general,\266\ and the
maintenance of fair and orderly markets in particular, would not be
achieved. Accordingly, the Commission preliminarily believes that it is
appropriate to require SCI entities to designate members or
participants they believe are necessary to the successful activation of
their business continuity and disaster recovery plans, including backup
systems, and require them to participate in the testing of such plans.
---------------------------------------------------------------------------

    \265\ See supra notes 78-83 and accompanying text.
    \266\ See proposed Rule 1000(b)(1) (requiring SCI entities to
have policies and procedures relating to, among other things,
resiliency and availability) and supra Section III.C.1.
---------------------------------------------------------------------------

    Under the proposed rule, each SCI entity would need to schedule,
and require their designated members or participants to participate in,
scheduled ``functional and performance testing'' \267\ of the entity's
business continuity and

disaster recovery plans. Such functional and performance testing should
include not only testing of connectivity, but also testing of an SCI
entity's systems, such as order entry, execution, clearance and
settlement, order routing, and the transmission and/or receipt of
market data, as applicable, to determine if they can operate as
contemplated by its business continuity and disaster recovery plans.
---------------------------------------------------------------------------

    \267\ As commonly understood, functional testing examines
whether a system operates in accordance with its specifications,
whereas performance testing examines whether a system is able to
perform under a particular workload.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(9)(i) would require that testing of an SCI
entity's business continuity and disaster recovery plans occur at least
once every 12 months. This proposed requirement reflects the
Commission's preliminary view that the testing of business continuity
and disaster recovery plans, including backup systems, must occur
regularly if such plans are to be effective when an actual disaster or
disruption occurs. The Commission preliminarily believes that its
proposed required testing frequency of at least once every 12 months is
the minimum frequency that would be consistent with seeking to ensure
that testing is meaningful and effective.\268\ However, the proposed
rule would not prevent an SCI entity from conducting testing and
requiring participation by members or participants in such testing more
frequently than once every 12 months, if the SCI entity believes it is
necessary or if, for example, it materially modifies its business
continuity and disaster recovery plans.
---------------------------------------------------------------------------

    \268\ Consistent with the frequency of testing under proposed
Rule 1000(b)(9), the Securities Industry and Financial Markets
Association coordinates an industry-wide business continuity test
each year in October. See http://www.sifma.org/services/bcp/industry-testing. See also supra notes 81-82 and accompanying text.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(9)(i) would also provide an SCI entity with
discretion to determine the precise manner and content of the testing.
Thus, for example, the SCI entity would have discretion to determine,
for example, the duration of the testing, the sample size of
transactions tested, the scenarios tested, and the scope of the test.
The Commission preliminarily believes that SCI entities are in the best
position to structure the details of the test in a way that would
maximize its utility.
    Although proposed Rule 1000(b)(9)(i) would give SCI entities
discretion to determine the precise manner and content of the testing,
the Commission is also proposing Rule 1000(b)(9)(ii), which would
require an SCI entity to coordinate its testing on an industry- or
sector-wide basis with other SCI entities.\269\ The proposed
coordination requirement is designed to enhance the value of testing by
requiring SCI entities to work together to schedule and conduct the
testing in as efficient and effective a manner as possible. Given that
trading in the U.S. securities markets today is dispersed among a wide
variety of exchanges, ATSs, and other trading venues, and is often
conducted through sophisticated algorithmic trading strategies that
access many trading platforms simultaneously, the Commission
preliminarily believes that requiring SCI entities to coordinate
testing is necessary to ensure the goal of achieving robust and
effective business continuity and disaster recovery plans, because it
would result in testing under more realistic market conditions. In
addition, the Commission is cognizant that situations that trigger
implementation of an SCI entity's business continuity and disaster
recovery plans are often not limited in scope to a single SCI entity,
but may affect multiple, or even all, SCI entities at the same time.
Thus, proposed Rule 1000(b)(9)(ii)'s requirement is designed to foster
better coordination and cooperation across the securities industry such
that the markets, investors, and all market participants may benefit
from more efficient and meaningful testing. Further, the Commission
preliminarily believes that it would be more cost-effective for market
participants to participate in the testing of the business continuity
and disaster recovery plans of SCI entities on an industry- or sector-
wide basis because such coordination would likely reduce duplicative
testing efforts.
---------------------------------------------------------------------------

    \269\ Thus, to satisfy the requirement of proposed Rule
1000(b)(9)(ii), an SCI entity could coordinate its testing with all
SCI entities, or an appropriate subset of them, such as by asset
class(es) (NMS stocks, non-NMS stocks, municipal debt, corporate
bonds, options) or type of SCI entity (national securities
exchanges, clearing agencies, plan processors).
---------------------------------------------------------------------------

    While proposed Rule 1000(b)(9)(ii) would require SCI entities to
coordinate testing on an industry- or sector-wide basis, it would
provide discretion to SCI entities to determine how to best meet this
requirement because the Commission preliminarily believes that SCI
entities currently are best suited to find the most efficient and
effective way to test. Of course, as noted above, each SCI entity may
require its members or participants to participate in additional
testing beyond the industry- or sector-wide testing under proposed Rule
1000(b)(9)(ii).
    Proposed Rule 1000(b)(9)(iii) would require each SCI entity to
designate those members or participants it deems necessary, for the
maintenance of fair and orderly markets in the event of the activation
of its business continuity and disaster recovery plans, to participate
in the testing of such plans. In addition, proposed Rule
1000(b)(9)(iii) would require each SCI entity to provide to the
Commission on Form SCI its standards for determining which members or
participants are necessary for the maintenance of fair and orderly
markets in the event of the activation of its business continuity and
disaster recovery plans and promptly update such notification following
any changes to such standards. The Commission believes that the
viability of an SCI entity's business continuity and disaster recovery
plans, and the usefulness of its backup systems, depend upon the
ability of such members or participants to be ready, able, and willing
to use such systems during an actual disaster or disruption. The
proposed requirement that designated members or participants be
required to test such plans in advance reflects the Commission's
preliminary view that the proposed testing would enhance the value of
SCI entities' business continuity and disaster recovery plans, and
thereby advance the goal of achieving resilient and available
markets.\270\
---------------------------------------------------------------------------

    \270\ See supra note 266.
---------------------------------------------------------------------------

    For SCI SROs, proposed Rule 1000(b)(9)(iii) would require SRO rules
pursuant to Section 19(b) of the Exchange Act, setting forth the
standards for designation. For an SCI ATS or an exempt clearing agency
subject to ARP, the requirement in proposed Rule 1000(b)(9)(iii) would
be satisfied by setting forth such standards in its internal
procedures, as well as any subscriber or similar agreement, as
applicable. For an SCI entity that is a plan processor, proposed Rule
1000(b)(9)(iii) would require an amendment to the applicable SCI Plan
pursuant to Rule 608 of Regulation NMS, setting forth such standards.
Further, proposed Rule 1000(b)(9)(iii) would require each SCI entity to
provide to the Commission on Form SCI the list of designated members or
participants and promptly update such notification following any
changes to the designations.\271\
---------------------------------------------------------------------------

    \271\ As discussed in infra Section III.E, Form SCI would also
require SCI entities to attach the relevant provision of their rules
(for SCI SROs), SCI Plans (for plan processors) or subscriber or
similar agreements (for SCI ATSs and exempt clearing agencies
subject to ARP) that require designated members or participants to
participate in the testing required by proposed Rule 1000(b)(9).
---------------------------------------------------------------------------

Request for Comment
    144. The Commission requests comment generally on proposed Rule
1000(b)(9).

    145. Do commenters believe the proposal to require an SCI entity,
with respect to its business continuity and disaster recovery plans,
including its backup systems, to require participation by designated
members or participants in scheduled functional and performance testing
of the operation of such plans, in the manner and frequency as
specified by the SCI entity, is appropriate? Why or why not? Is the
proposed requirement that SCI entities require participation in
``functional and performance testing'' appropriate? Why or why not? Is
the term ``functional and performance testing'' clear? If not, why not
and what would be a better description of the nature of the proposed
required testing?
    146. Do commenters believe it is appropriate to require that such
testing occur at least once every 12 months? Why or why not? Would
another minimum interval for such testing, such as bi-annually, semi-
annually, or quarterly, be more appropriate? Please explain. Would it
be appropriate to also require such testing to occur following a
material change to the SCI entity's business continuity and disaster
recovery plans? Why or why not? If yes, would it be appropriate to
require such testing within 90 days of the material change? Why or why
not? Would another time period be more appropriate? If so, what should
such time period be?
    147. Should the Commission give SCI entities discretion in
designating the members or participants that must participate in the
testing of the business continuity and disaster recovery plans? Why or
why not? Should the Commission instead specify standards for such
designation? If so, what should the standards be based on? For example,
should the standards be based on the size, volume traded or cleared,
and/or geographic proximity of a member or participant to the SCI
entity's backup systems? Why or why not? Should only members or
participants that execute or clear transactions above a certain volume
threshold and/or that account for a certain percentage of trading
volume on the SCI entity be required to participate? Why or why not? If
so, what should be such threshold or thresholds (e.g., 0.5 percent, 1
percent, 5 percent)? Should an SCI entity be required to mandate
participation in testing by some other subset of members or
participants? For example, should such subset comprise members or
participants that account for a certain percentage of trading in each
or all of the equities, options, or fixed-income markets traded through
the SCI entity? Why or why not? If so, what should be such threshold
(e.g., 0.5 percent, 1 percent, 5 percent)? Or, should testing be
mandated only for certain types of market participants (e.g., market
makers, clearing broker-dealers, retail broker-dealers)? If so, for
which types of market participants should testing be mandatory and why?
Please explain. Alternatively, should all members or participants of an
SCI entity (or certain types of SCI entities, e.g., plan processors) be
required to participate in the testing of its business continuity and
disaster recovery plans? Why or why not?
    148. Do commenters believe those members or participants that would
likely be designated by SCI entities under proposed Rule
1000(b)(9)(iii) currently have the ability, including the
infrastructure, to participate in the required testing? Do commenters
believe all members or participants of SCI entities currently have the
ability, including the infrastructure, to participate in such testing?
What would be the costs and benefits to a member or participant of an
SCI entity to participate in such testing, including for such member or
participant to establish and maintain connectivity to an SCI entity's
backup systems? What would be the economic effect of this proposed
rule, particularly with regard to a member or participant? Please
describe in detail and provide data to support your views if possible.
    149. Should an SCI entity be required to notify the Commission on
Form SCI of its standards for designating members or participants for
testing and its list of designated members or participants? Why or why
not? Should an SCI entity be required to promptly update such
Commission notification if its standards for designation or list of
designated members or participants change? Why or why not? Is there a
more appropriate time period for updating Commission notifications
(e.g., 7 days following a change, 30 days following a change,
quarterly)? Please explain.
    150. Proposed Rule 1000(b)(9)(i) would require each SCI entity to
mandate participation by designated members or participants in
``functional and performance testing'' of its business continuity and
disaster recovery plans, including its backup systems, but would leave
to the discretion of the SCI entity the details regarding the manner of
testing. Should the Commission be more prescriptive with respect to
such testing? For example, should the Commission require that SCI
entities periodically operate from their backup facilities during
regular trading hours? Why or why not? Please explain. Are there other
details that the Commission should prescribe in relation to the
proposed rule? If so, please explain.
    151. Proposed Rule 1000(b)(9)(ii) would require SCI entities to
coordinate testing on an industry- or sector-wide basis, but would not
specify how or the parameters. Do commenters believe it is appropriate
to leave such discretion to SCI entities? Why or why not? Are the terms
``industry-wide'' and ``sector-wide'' clear? Should the Commission
define these terms? If so, what would be appropriate definitions? Would
such an approach foster the creation of meaningful, efficient testing
of business continuity and disaster recovery plans across SCI entities
and their members or participants? Why or why not? If not, what would
be a more appropriate approach? Should the Commission require a minimum
number of SCI entities needed to satisfy the coordination requirement
of proposed Rule 1000(b)(9)(ii)? Or should that requirement only be
satisfied if all SCI entities (or all SCI entities within a sector of
the industry) participate? Why or why not? Should the Commission
mandate a minimum list of actions that SCI entities must take to
satisfy the requirement of proposed Rule 1000(b)(9)(ii)? If so, what
actions should be required and why? If not, why not?
    152. Should the Commission require SCI entities to submit reports
on the results of their testing of business continuity and disaster
recovery plans or reports of any systems testing that was not
successful? If not, why not? If so, should such reports be required to
be submitted within a specified time frame or in a specified manner or
format? Please explain. In addition, should the Commission require SCI
entities to submit reports on systems testing opportunities required of
or made available to members or subscribers and the extent to which
such members or subscribers participate in such opportunities?
    153. Would proposed Rule 1000(b)(9) enhance investor confidence in