Atelsek, et al., Major Cloud Providers and Customers Face Cost and
Pricing Headwinds, spglobal.com (May 10, 2022), available at https://www.spglobal.com/marketintelligence/en/news-insights/research/major-cloud-providers-and-customers-face-cost-and-pricing-headwinds;
see also David Friend, The Coming Era of Simple, Fast, Incredibly
Cheap Cloud Storage, Cloudtweaks.com (Nov. 15, 2022, 9:12 a.m.),
available at https://cloudtweaks.com/2018/02/fast-incredibly-cheap-cloud-storage/ (describing the significant price drop for cloud
storage as of 2018, and explaining that ``the prices for cloud
storage are heading in the same direction.''). These trends may be
reversing. See Jean Atelsek, et al., (``Rising energy costs and
supply chain woes threaten to push up costs for the cloud
hyperscalers in building and operating their data centers;
therefore, cloud infrastructure prices are poised to increase.'');
Frederic Lardinois, Google Cloud Gets More Expensive, TechCrunch+
(Mar. 14, 2022, 11:54 p.m.), available at https://techcrunch.com/2022/03/14/inflation-is-real-google-cloud-raises-its-storage-prices/
.
    \761\ For example, according to one source, as of 2020, ``55% of
enterprise executives [were planning] to increase their
cybersecurity budgets in 2021 and 51% are adding full-time cyber
staff in 2021.'' Louis Columbus, The Best Cybersecurity Predictions
for 2021 Roundup, Forbes.com (Dec. 15, 2020), available at https://www.forbes.com/sites/louiscolumbus/2020/12/15/the-best-cybersecurity-predictions-for-2021-roundup/?sh=6d6db8b65e8c.
---------------------------------------------------------------------------

    Taking these varied considerations into account, the Commission
estimates that, adjusted for inflation since 2014, the 2014 figures
remain reasonable ranges for non-PRA costs associated with Rule 1001(a)
and (b) in 2023, without accounting for the proposed amendments in Rule
1001(a). In other words, the Commission estimates that a new SCI entity
in 2023 will incur an initial non-PRA cost of between approximately
$407,000 and $3.1 million and an ongoing annual non-PRA cost of between
approximately $272,000 and $2.0 million to comply with the original
provisions of Regulation SCI from 2014.
    To account for the proposed amendments, the Commission
preliminarily estimates that, based on staff experience with current
SCI entities' compliance practices, the non-PRA cost of complying with
the amended provisions could be up to approximately 20% of the
estimated non-PRA cost for complying with the original (i.e.,
unamended) Rule 1001(a). Accordingly, the Commission estimates that a
new SCI entity would incur an additional initial cost of between
approximately $81,000 and $611,000 and an additional ongoing annual
cost of between approximately $54,000 and $407,000 to comply with the
amended provisions of Rule 1001(a).\762\ Combined with the non-PRA
costs estimates above for complying with the rest of Rule 1001(a) and
(b), a new SCI entity will incur an additional initial non-PRA cost of
between approximately $489,000 and $3.7 million \763\ and an additional
ongoing annual non-PRA cost of between approximately $326,000 and $2.4
million, plus the PRA costs estimated above.\764\ The Commission
estimates that, in the aggregate, all new SCI entities will incur a
total initial non-PRA cost of between approximately $10.3 million and
$77.0 million to comply with the policies and procedures required by
Rule 1001(a) and (b).\765\ In addition, the Commission estimates that,
in the aggregate, new SCI entities will incur total annual ongoing non-
PRA cost of between approximately $6.9 million and $51.3 million.\766\
Depending on the price-sensitivity of their customers and the
availability of alternative providers, new SCI entities may pass on
some of these costs to their customers.\767\
---------------------------------------------------------------------------

    \762\ These figures are 20% of the range from the Regulation SCI
Adopting Release, adjusted for inflation from 2014 to 2023.
    \763\ These figures are 120% of the range from the Adopting
Release of Regulation SCI, adjusted for inflation since 2014.
    \764\ These figures are approximately 120% of the range from the
Adopting Release of Regulation SCI, adjusted for inflation since
2014.
    \765\ The Commission currently estimates there are 23 new SCI
entities, two of which are excluded from the economic analysis as
explained above. The range of $10.3 million and $77.0 million
represents 21 times the per-entity initial cost range from the
Regulation SCI Adopting Release, adjusted for inflation since 2014.
    \766\ The range of $6.9 million and $51.3 million represents 21
times the per-entity ongoing annual cost range from the Regulation
SCI Adopting Release, adjusted for inflation since 2014.
    \767\ See, e.g., Jonathan Baker, Orley Ashenfelter, David
Ashmore & Signe-Mary McKernan, Identifying the Firm-Specific Cost
Pass-Through Rate, Federal Trade Commission. Bureau of Economics 1
(1998), available at https://www.ftc.gov/sites/default/files/documents/reports/identifying-firm-specific-cost-pass-through-rate/wp217.pdf.
---------------------------------------------------------------------------

    In addition, with respect to the periodic reviews required by Rule
1001(a)(3), (b)(3), and (c)(2), there may be additional indirect costs
if an SCI entity takes prompt or unplanned remedial action following
the discovery of deficiencies in its policies and procedures.
Specifically, the new SCI entities may need to delay or shift their
resources away from profitable projects and reallocate their resources
towards taking prompt or unplanned remedial actions required by the
rules. It is nevertheless difficult to assess such indirect costs
imposed on SCI entities because the Commission lacks information
necessary to provide a reasonable estimate and such indirect costs will
be circumstance-specific.
(2) Compliance Costs for Existing SCI Entities
    Existing SCI entities should incur new costs only to comply with
the proposed amendments to Rule 1001(a). With respect to PRA costs, the
Commission estimates total initial costs of approximately $8.2 million
and annual costs of approximately $1.1 million for all current SCI
entities.\768\ For non-PRA costs associated with these amendments, the
Commission estimates that the non-PRA cost of complying with the
amended provisions could be up to approximately 20% of the estimated
non-PRA cost for complying with the original (i.e., unamended) Rule
1001(a), as explained above. Accordingly, the Commission estimates that
an existing SCI entity would incur an additional initial non-PRA cost
of between approximately $81,000 and $611,000 and an additional ongoing
annual non-PRA cost of between approximately $54,000 and $407,000 to
comply with the amended provisions of Rule 1001(a).\769\ The Commission
in turn estimates that, in the aggregate, current SCI entities will
incur a total initial non-PRA cost of between approximately $3.8
million and $28.7 million to comply with the policies and procedures
required by Rule 1001(a) and (b).\770\ In addition, the Commission
estimates that, in the aggregate, current SCI entities will incur total
annual ongoing non-PRA cost of between approximately $2.6 million and
$19.1 million.\771\
---------------------------------------------------------------------------

    \768\ See section IV.D.7. These include costs for existing
entities to comply only with Rule 1001(a), and for new entities to
comply with Rule 1001(a) through (c).
    \769\ These figures are 20% of the range from the Regulation SCI
Adopting Release, adjusted for inflation since 2014.
    \770\ The Commission currently estimates there are 47 current
SCI entities. The range of $3.8 million and $28.7 million represents
47 times the per-entity cost range from the SCI Adopting Release,
adjusted for inflation since 2014.
    \771\ The range of $2.6 million and $19.1 million represents 47
times the per-entity cost range from the SCI Adopting Release,
adjusted for inflation since 2014.
---------------------------------------------------------------------------

(3) Other Costs for All SCI Entities and Other Affected Parties
    Proposed Rule 1001(a)(2)(ix) could raise costs of third-party
service providers insofar as they may have to renegotiate contracts and
change the terms of their services to accommodate the requirements of
SCI entities. SCI entities could also incur costs in enforcing their
third-party provider management program. In particular, to the extent
that accommodating the terms and conditions that would be demanded by
SCI entities under proposed Rule 1001(a)(2)(ix) would be costly to
third-party service providers, SCI entities could face higher prices
from third-party providers, though any change in prices would also
depend upon market conditions (such as the level of competition amongst
third-party service providers for the type of services sought after by
the SCI entity, the relative bargaining power of the SCI entity in
negotiations with third-party service providers, new entry into the
market for third-party services, and willingness of service providers
to absorb costs or pass costs to other customers).
Request for Comment
    106. For current SCI entities, do you agree that the Commission's
specified ranges reasonably capture the non-paperwork burden costs
owing to Rule 1001(a) and (b) that you have incurred above and beyond
amounts you were already spending to ensure your SCI systems' capacity,
integrity, resiliency, availability, and security under the existing
requirements of Regulation SCI?

    107. For new SCI entities, do you agree that the Commission's
specified ranges reasonably capture the non-paperwork burden costs
owing to Rule 1001(a) and (b) that you expect to incur above and beyond
the amounts you were already spending to ensure your SCI systems'
capacity, integrity, resiliency, availability, and security under the
existing requirements of Regulation SCI?
    108. For current and new SCI entities, do you agree that the
Commission's specified ranges for the non-paperwork cost of complying
with the proposed amendments to Rule 1001(a) and (b), at 20 percent of
the specified ranges for Rule 1001(a) and (b), reasonably capture such
costs that you expect to incur, above and beyond amounts you are
already spending to ensure your SCI systems' capacity, integrity,
resiliency, availability, and security owing to the proposed
amendments?
    109. If you are a current SCI entity and currently inventory and
classification of all SCI systems, critical SCI systems, and indirect
SCI systems, how does your activity differ from the requirements of the
rule proposal? What have been the benefits and costs of this activity?
    110. If you are a current SCI entity and have a program with
respect to the lifecycle management of SCI systems, does it address the
acquisition, integration, support, refresh, and disposal of such
systems, as applicable? How does your activity differ from the
requirements of the rule proposal? What have been the benefits and
costs of this activity?
    111. If you are a current SCI entity and you currently have a
third-party provider management program to ensure that your SCI systems
contractors perform their work in accordance with the requirements of
Regulation SCI, how does your activity differ from the requirements of
the rule proposal? What have been the benefits and costs of this
activity?
    112. If you are a current SCI entity and you currently require an
initial and periodic review of contracts with service providers for
consistency with your obligations under Regulation SCI, how does your
activity differ from the requirements of the rule proposal? What have
been the benefits and costs of this activity?
    113. If you are a current or proposed SCI entity and you currently
conduct a risk-based assessment of each third-party provider's
criticality, to your operations, how does your activity differ from the
requirements of the rule proposal? What have been the benefits and
costs of this activity?
    114. If you are a current SCI entity and your policies and
procedures include a program to prevent the unauthorized access to SCI
systems and information residing therein, how does your activity differ
from the requirements of the rule proposal? What have been the benefits
and costs of this activity?
    115. The Commission requests that commenters provide relevant data
and analysis to assist us in determining the economic consequences of
the proposed amendments related to third-party providers' management.
In particular, the Commission requests data and analysis regarding the
costs SCI entities and third-party providers may incur, and benefits
they may receive, from the proposed amendments.
    116. Do you agree with the Commission's analysis of the benefits of
the proposed amendments related to third-party providers' management?
Why or why not? Please explain in detail.
    117. Do you agree with the Commission's analysis of the costs of
the proposed amendments related to third-party providers' management?
Why or why not? Please explain in detail.
b. Rule 1002--Corrective Action, Commission Notification, and
Information Dissemination
    Regulation SCI requires SCI entities to take appropriate corrective
actions in response to SCI events (Rule 1002(a)), notify the Commission
of SCI events (Rule 1002(b)), and disseminate information regarding
certain major SCI events to all members or participants of an SCI
entity and certain other SCI events to affected members or participants
(Rule 1002(c)). Rule 1000, in turn, defines SCI events to include
systems disruptions, systems compliance issues, and systems intrusions.
The Commission is proposing two amendments that affect these
provisions. First, it is proposing to expand the definition of systems
intrusion in Rule 1000. Second, it is proposing to amend Rule
1002(b)(5) to eliminate the exception to the reporting requirement for
de minimis systems intrusions and instead require the reporting of all
systems intrusions, whether de minimis or not, within the time frames
specified in paragraphs (b)(1) through (4).
    New SCI entities will need to comply with these requirements of
Rules 1000 and 1002, and their proposed amendments, for the first time.
Existing SCI entities will need to apply the new definition of systems
intrusion in Rule 1000 to the requirements of Rule 1002, including the
amendments to Rule 1002(c). We discuss below the benefits and costs of
these provisions and amendments for new and existing SCI entities.
i. Benefits
(1) Rule 1000--Definition of SCI Events
    In general, the definition of SCI event (and its component parts)
in Rule 1000 circumscribe the scope of the substantive requirements in
Rule 1002. Therefore, many of the costs and benefits associated with
the definitions are incorporated in the discussion of the substantive
requirements. The benefits associated with scoping the substantive
requirements for Rule 1002 through the specific definitions of systems
disruption, systems compliance issue, and systems intrusion are
discussed at length in the 2014 SCI Adopting Release \772\ and would
apply to the new SCI entities. We summarize those benefits here and
discuss the benefits for both new and current SCI entities resulting
from expanding the definition of systems intrusion.
---------------------------------------------------------------------------

    \772\ See SCI Adopting Release, supra note 1, at 72423-27.
---------------------------------------------------------------------------

    Systems Disruption. Rule 1000 of Regulation SCI currently defines a
``systems disruption'' as an event in an SCI entity's SCI systems that
disrupts, or significantly degrades, the normal operation of an SCI
system. This definition would remain unchanged. As the Commission noted
in 2014, the definition sets forth a standard that SCI entities can
apply in a wide variety of circumstances to determine in their
discretion whether a systems issue should be appropriately categorized
as a systems disruption. The inclusion of systems disruptions in the
definition of SCI event, along with the requirements Rule 1002 should
help effectively reduce the severity and duration of events for new SCI
entities that harm pricing efficiency, price discovery, and liquidity
and help Commission oversight of the securities markets.
    Systems Compliance Issues. Under Rule 1000, a systems compliance
issue is an event at an SCI entity that has caused any SCI system of
such entity to operate in a manner that does not comply with the Act
and the rules and regulations thereunder or the entity's rules or
governing documents, as applicable. The Commission stated in 2014 that
inclusion of systems compliance issues in the definition of SCI event
and the resulting applicability of the Commission reporting,
information dissemination, and recordkeeping requirements are important
to help ensure that SCI

systems are operated by SCI entities in compliance with the Exchange
Act, rules thereunder, and their own rules and governing documents.
    System Intrusion. Rule 1000 of Regulation SCI currently defines a
``systems intrusion'' as any unauthorized entry into the SCI systems or
indirect SCI systems of an SCI entity. The Commission is proposing to
expand the definition of systems intrusions to include any
cybersecurity attack that disrupts, or significantly degrades, the
normal operation of an SCI system. This revision includes cybersecurity
events that cause disruption on an SCI entity's SCI systems or indirect
SCI systems, whether or not the event resulted in an entry into or
access to such systems. In addition, the proposed revised definition
would include any significant attempted unauthorized entry into the SCI
systems or indirect SCI systems of an SCI entity, as determined by the
SCI entity pursuant to established reasonable written criteria. This
revision is intended to capture unsuccessful, but significant, attempts
to enter an SCI entity's SCI systems or indirect SCI systems. The
definition, including the proposed amendments, will apply to new SCI
entities for the first time while the proposed amendments will apply to
existing SCI entities.
    In the SCI Adopting Release, the Commission discussed the benefits
of including a system intrusion in the definition of an SCI event for
which the requirements of Rule 1002 apply. These same benefits extend
to the new SCI entities. Specifically, the Commission stated that
unauthorized access, destruction, and manipulation of SCI systems and
indirect SCI systems could adversely affect the markets and market
participants because intruders could force systems to operate in
unintended ways that could create significant disruptions in securities
markets. Therefore, the inclusion of systems intrusions in the
definition of SCI events can help reduce the risk of such adverse
effects for new SCI entities.
    The proposed changes, which would apply to new and current SCI
entities, would update the definition to include additional types of
incidents that are currently considered to be cybersecurity events that
are not included in the current definition. If an incident meets the
definition, it must then comply with the requirements for corrective
action, Commission notice, and information dissemination in Rule 1002.
The proposed changes to the definition would thus ensure that the
Commission and its staff are made aware when an SCI entity is the
subject of a significant cybersecurity threat, including those that may
be ultimately unsuccessful, which would provide important information
regarding threats that may be posed to other entities in the securities
markets, including other SCI entities. Because such cybersecurity
events can cause serious harm and disruption to an SCI entity's
operations, the Commission believes that the definition of systems
intrusion should be broadened to include cybersecurity events that may
not entail actually entering or accessing the SCI entity's SCI systems
or indirect SCI systems, but still cause disruption or significant
degradation, as well as significant attempted unauthorized entries. By
requiring SCI entities to submit SCI filings for these new types of
systems intrusions, the Commission believes that the revised definition
of systems intrusion would also provide the Commission and its staff
more complete information to assess the security status of the SCI
entity, and also assess the impact or potential impact that
unauthorized activity could have on the security of the SCI entity's
affected systems as well on other SCI entities and market participants.
(2) Rule 1002--Corrective Action, Commission Notice, Information
Dissemination
    As noted, Rule 1002 prescribes certain required actions for SCI
entities upon any responsible SCI personnel having a reasonable basis
to conclude that an SCI event has occurred. The requirements of Rule
1002(a) and (c) remain substantively unchanged from current Regulation
SCI except additional events are scoped into the Rules for existing SCI
entities through the proposed expanded definition of systems intrusion.
These provisions will therefore primarily affect new SCI entities. We
discuss generally the benefits of the expanded definition above and do
not repeat those here.\773\
---------------------------------------------------------------------------

    \773\ The SCI Adopting Release considered the benefits and costs
of the specific definitions for each type of SCI event. See SCI
Adopting Release, supra note 1, at 72404-08. Those costs and
benefits remain the same for new SCI entities to which these
definitions would apply and are not repeated here, except with
respect to the definition of systems intrusions, which the
Commission proposes to amend. To the extent that the primary effect
of these definitions is realized through the requirements in Rule
1002 to take corrective action, notify the Commission, and
disseminate information, we discuss the effects of applying those
requirements on new SCI entities below.
---------------------------------------------------------------------------

    Corrective Action (Rule 1002(a)). Rule 1002(a) requires an SCI
entity to begin to take appropriate corrective action upon any
responsible SCI personnel having a reasonable basis to conclude that an
SCI event has occurred. Rule 1002(a) also requires corrective action to
include, at a minimum, mitigating potential harm to investors and
market integrity resulting from the SCI event, and devoting adequate
resources to remedy the SCI event as soon as reasonably practicable.
Thus, it would not be appropriate for an SCI entity to delay the start
of corrective action once its responsible SCI personnel have a
reasonable basis to conclude that an SCI event has occurred, and the
SCI entity would be required to focus on mitigating potential harm to
investors and market integrity resulting from the SCI event and
devoting adequate resources to remedy the SCI event as soon as
reasonably practicable. This provision remains unchanged for existing
SCI entities, except to the extent they must comply with the
requirements for additional events scoped in under the expanded
definition of systems intrusion, as noted above. For both current and
new SCI entities, the benefits of expanding the definition to include
certain types of systems intrusions that are not covered by Regulation
SCI would include a potential reduction in the length or severity of
systems disruptions caused by these types of intrusions and would thus
reduce the negative effects of those interruptions on the SCI entity
and on market participants.
    The corrective action requirement of Regulation SCI will likely
reduce the length of systems disruptions, systems compliance issues,
and systems intrusions, and thus reduce the negative effects of those
interruptions on the SCI entity and market participants. Additionally,
to the extent that corrective action could involve wide-scale systems
upgrades, some SCI entities may potentially seek to accelerate capital
expenditures, for example, by updating their systems with newer
technology earlier than they might have otherwise to comply with
Regulation SCI. As such, Rule 1002(a) could further help ensure that
SCI entities invest sufficient resources as soon as reasonably
practicable to address systems issues.
    New SCI entities will become subject to Rule 1002(a) for the first
time. The Commission believes that new SCI entities already have a
variety of procedures in place to take corrective actions when system
issues occur. However, Rule 1002(a) may require modifications to those
existing practices in part because the rule specifies the

timing and enumerates certain goals for corrective action.\774\
---------------------------------------------------------------------------

    \774\ See SCI Adopting Release, supra note 1, at 72423.
---------------------------------------------------------------------------

    Commission Notification (Rule 1002(b)). Rule 1002(b) requires an
SCI entity to notify the Commission of the SCI event immediately upon
any responsible SCI personnel having a reasonable basis to conclude
that an SCI event has occurred. Within 24 hours of any responsible SCI
personnel having a reasonable basis to conclude that an SCI event has
occurred, an SCI entity is required to submit to the Commission a more
detailed written notification, on a good faith, best efforts basis,
pertaining to the SCI event. Until such time as the SCI event is
resolved and the SCI entity's investigation of the SCI event is closed,
the SCI entity is required to provide updates regularly, or at such
frequency as requested by a representative of the Commission. The SCI
entity is also required to submit a detailed final written notification
after the SCI event is resolved and the SCI entity's investigation of
the event is closed (and an additional interim written notification, if
the SCI event is not resolved or the investigation is not closed within
a specified period of time). Finally, paragraph (b)(5) currently
provides an exception to the reporting requirements of paragraphs
(b)(1) through (4) for de minimis SCI events, and SCI entities are
currently required to submit a summary to the Commission with respect
to systems disruptions and systems intrusions only on a quarterly
basis. The Commission is proposing to amend this provision to require
SCI entities to exclude systems intrusions from this exception so that
SCI entities will need to report systems intrusions, whether de minimis
or not, within the time frames specified in paragraphs (b)(1) through
(4). This would eliminate quarterly reporting for de minimis systems
intrusions. Thus, for current SCI entities, the difference concerns the
time frame for, and manner of, reporting de minimis systems intrusions
while new SCI entities will be subject to the entire Commission
notification regime for the first time.
    For the new SCI entities, Rule 1002(b) as a whole would enhance the
effectiveness of Commission oversight of the operation of these
entities. For example, SCI events notification results in greater
transparency for the Commission, including ensuring that the Commission
has a view into problems at particular SCI entities for regulatory
purposes as well as perspective on the effect of a single problem to
the market at-large.\775\ Further, the requirements of submitting
notifications pertaining to the SCI events to the Commission, set forth
by Rule 1002(b), could help prevent systems failures from being
dismissed as momentary issues, because notification would help focus
the SCI entity's attention on the issue and encourage allocation of SCI
entity resources to resolve the issue as soon as reasonably
practicable.
---------------------------------------------------------------------------

    \775\ See SCI Adopting Release, supra note 1, at 72424 (citing
letter by David Lauer).
---------------------------------------------------------------------------

    Both new and current SCI entities would be subject to the new
reporting requirements under the proposed revisions to Rule 1001(b)(5).
These revisions eliminate the need for entities to determine if an
intrusion (which should be rare and also may be difficult to assess)
meets the de minimis threshold before it notifies the Commission, and
instead would require reporting to the Commission for all systems
intrusions at the time of the event, which will provide more timely
information to the Commission. This may result in more frequent
reporting for systems intrusions while also eliminating quarterly
reporting of systems intrusions, as compared to the baseline.
    Information Dissemination (Rule 1002(c)). Rule 1002(c) currently
requires an SCI entity to disseminate information regarding certain
major SCI events to all of its members or participants and certain
other SCI events to affected members or participants. Specifically,
promptly after any responsible SCI personnel having a reasonable basis
to conclude that an SCI event has occurred, an SCI entity is required
to disseminate certain information regarding the SCI event. When
certain additional information becomes known, the SCI entity is
required to promptly disseminate such information to those members or
participants (or, as proposed, in the case of an SCI broker-dealer,
customers) of the SCI entity that any responsible SCI personnel has
reasonably estimated may have been affected by the SCI event. Until the
SCI event is resolved, the SCI entity is required to provide regular
updates on the required information. In the case of a major SCI event,
where the impact is most likely to be felt by many market participants,
dissemination of information to all members, participants, or
customers, as applicable, of the SCI entity is required. A major SCI
event is defined to mean an SCI event that has any impact on a critical
SCI system or a significant impact on the SCI entity's operations or on
market participants.
    The information dissemination requirement currently does not apply
to SCI events to the extent that they relate to market regulation or
market surveillance systems and de minimis SCI events. The Commission
is proposing to add to these exceptions for the information
dissemination requirement, a systems intrusion that is a significant
attempted unauthorized entry into the SCI systems or indirect SCI
systems. Accordingly, Rule 1002(c) remains mostly unchanged for
existing SCI entities, except to the extent they must comply with the
requirements for additional events scoped in under the expanded
definition of systems intrusion (the benefits of which are discussed
above) and except for systems intrusions that are significant attempted
unauthorized entries, which are exempted from the information
dissemination requirements. New SCI entities, however, will become
subject to the information dissemination requirements for the first
time.
    Rule 1002(c) is expected to help market participants--specifically
the members, participants, or customers, as applicable of new SCI
entities estimated to be affected by an SCI event and, in the case of
major SCI events, all members, participants, or customers of a new SCI
entity--to better evaluate the operations of SCI entities by requiring
certain information about the SCI event to be disclosed. Furthermore,
increased awareness of SCI events through information disseminated to
members, participants, or customers, as applicable, should provide new
SCI entities additional incentives to maintain robust systems and
minimize the occurrence of SCI events. More robust SCI systems and the
reduction in the occurrence of SCI events at new SCI entities could
reduce interruptions in price discovery processes and liquidity flows.
For example, in 2014, a commenter stated that sharing information about
hardware failures, systems intrusions, and software glitches will alert
others in the industry about such problems and help reduce system-wide
costs of diagnosing problems, as well as result in improved responses
to technology problems.\776\
---------------------------------------------------------------------------

    \776\ See SCI Adopting Release, supra note 1, at 72426 n. 931
(citing letter from James Angel).
---------------------------------------------------------------------------

    With respect to the new exception for significant attempted
unauthorized entries, which impacts new and existing SCI entities, the
Commission is concerned that disseminating information about
unsuccessful attempted entries to members or

participants of an SCI entity would create unnecessary distractions,
particularly since the SCI entity's security controls were able, in
fact, to repel the cybersecurity event. In addition, disseminating
information regarding unsuccessful intrusions could result in the
threat actors being unnecessarily alerted that they have been detected,
which could make it more difficult to identify the attackers and halt
their efforts on an ongoing, more permanent basis.
    The Commission recognizes that many of the new SCI entities are
currently subject to other regulatory requirements to maintain policies
and procedures that address the provisions required by these rules, as
discussed in detail above.\777\ Similarly, some existing SCI entities
engage in current market practices consistent with the expanded
definition of systems intrusion.
---------------------------------------------------------------------------

    \777\ See sections III.A.2.a.ii, III.A.2.b.ii, III.A.2.c.i.,
V.B.1.a.ii, V.B.1.b.ii, and V.B.1.c.ii.
---------------------------------------------------------------------------

    The benefits from the policy and procedure requirements in Rule
1002(a) through (c) for the new SCI entities (and the costs, as
discussed below), will therefore depend on the extent to which their
current operations already align with the rule's requirements, given
both existing regulation and current practice.
    While some of the existing regulations that apply to the proposed
new SCI entities may be consistent with or similar to the policy and
procedure requirements of Regulation SCI discussed in this section, the
Commission believes it is nevertheless appropriate to apply these
policy and procedure requirements to the new SCI entities and that
doing so would benefit participants in the securities markets in which
these entities operate.
    Overall, applying the specific and comprehensive requirements set
forth in Rule 1002(a) through (c) of Regulation SCI to the new SCI
entities would enhance and build on any existing policies and
procedures, thereby furthering the goals of Regulation SCI to
strengthen the technology infrastructure of the U.S. securities markets
and improve its resilience.
ii. Costs
    We discuss below the costs of complying with the requirements of
Rule 1002, applying the definitions in Rule 1000, including the amended
definition of systems intrusion. Because the definitions themselves
have no associated costs, all of the costs associated with the amended
definition flow through the substantive requirements. New SCI entities
will need to comply with these requirements for the first time whereas
costs for the existing SCI entities are attributed to the expanded
definition of systems intrusion and the amendment to Rule 1002(b)(5).
Relative to the current practice and baseline, the proposed rule
expansion of the definition of the intrusion would likely result in
more frequent reporting by the SCI entities to the Commission, which is
reflected in the costs estimates below.
    Corrective Action (Rule 1002(a)). Rule 1002(a) could impose
modestly higher costs for new SCI entities in responding to SCI events
relative to their current practice. In the PRA analysis, the Commission
estimates those costs as approximately $1.2 million in initial and $0.4
million in annual costs.\778\ Furthermore, if Regulation SCI reduces
the frequency and severity of SCI events in the future, the cost of
corrective action could similarly decline over time. Nevertheless, the
Commission lacks data regarding the degree to which Regulation SCI will
reduce the frequency and severity of SCI events at new SCI entities.
---------------------------------------------------------------------------

    \778\ See section IV.D.7. For purposes of this Economic
Analysis, there are two fewer entities than under the PRA analysis,
lowering these estimated costs. See supra note 700.
---------------------------------------------------------------------------

    In addition, if a new SCI entity is required to take corrective
action sooner than it might have without the requirements of Regulation
SCI, this may impose indirect costs (i.e., opportunity costs) to such
SCI entities because they may have to delay or reallocate their
resources away from profitable projects and direct their resources
toward taking corrective action required by the rule. It is difficult
to assess indirect costs imposed on new SCI entities without having
comprehensive and detailed information on the value of the potential
foregone projects of those SCI entities. The facts and circumstances of
each specific SCI event will be different.
    Existing SCI entities may incur new costs associated with
corrective action for additional systems intrusions scoped in under the
expanded definition. The Commission estimates a one-time total cost of
approximately $0.5 million for all existing SCI entities to update
their procedures to account for additional types of systems
intrusions.\779\
---------------------------------------------------------------------------

    \779\ See section IV.D.2.b, IV.D.7.
---------------------------------------------------------------------------

    To the extent new SCI entities currently undertake correction
action consistent with the Rule 1002(a) requirements, they could incur
lower PRA costs to comply with the requirements of Rule 1002(a) than
entities without such existing requirements. Similarly, to the extent
many existing SCI entities currently undertake corrective action
consistent with the expanded definition of systems intrusion, they
could incur lower PRA costs to comply with the amended requirements of
Rule 1002(a) than entities without such existing requirements.
    Notification of SCI Events (Rule 1002(b)). The compliance costs
associated with Rule 1002(b) are attributed to the paperwork burden of
Commission notifications of SCI events, including recordkeeping and
submission of quarterly reports with respect to de minimis SCI events,
as applicable. For new SCI entities, these costs include costs to
comply with the notification requirements, as amended, for the first
time. Existing SCI entities would incur costs complying with the
amendment to Rule 1002(b)(5) as well as the costs associated with
notification for new events scoped in under the expanded definition of
systems intrusions. These are discussed in detail in section IV.
    For Rule 1002(b)(1), the Commission estimates approximately $0.1
million in initial and annual costs for existing and new SCI entities
alike.\780\ For Rule 1002(b)(2), the Commission estimates approximately
$1.3 million in initial and annual costs for existing SCI entities and
$1.5 million in initial and annual costs for new SCI entities.\781\ For
Rule 1002(b)(3), the Commission estimates approximately $0.2 million in
initial and annual costs for existing SCI entities and $0.2 million in
initial and annual costs for new SCI entities.\782\ For Rule
1002(b)(4), the Commission estimates approximately $2.0 million in
initial and annual costs for existing SCI entities and $2.3 million in
initial and annual costs for new SCI entities.\783\ Finally, for Rule
1002(b)(5), the Commission estimates a savings for existing SCI
entities, as noted above, and approximately $1.2 million in initial and
annual costs for new SCI entities.\784\
---------------------------------------------------------------------------

    \780\ See section IV.D.7; see also supra note 700.
    \781\ See id.
    \782\ Id.
    \783\ Id.
    \784\ Id.
---------------------------------------------------------------------------

    To the extent new SCI entities currently provide notification
consistent with the Rule 1002(b) requirements, they could incur lower
PRA costs to comply with the requirements of Rule 1002(b) than entities
without such existing practices.
    Information Dissemination (Rule 1002(c)). While some new SCI
entities currently provide their members or participants and, in some
cases, market

participants or the public more generally, with notices of certain
systems issues (e.g., system outages), Rule 1002(c) may impose new
requirements that they have not currently implemented. As such, the
requirements of Rule 1002(c) will impose costs--which are attributed to
paperwork burdens--on new SCI entities with respect to preparing,
drafting, reviewing, and making the information available to members or
participants, or, in the case of an SCI broker-dealer, customers. For
new SCI entities the Commission estimates approximately $1.3 million in
costs, initially and annually, for disseminating information about SCI
events and systems affected, as required by Rule 1002(c)(1).\785\ For
new entities, the Commission also estimates approximately $1.6 million
in initial costs and $0.4 million in annual costs to develop processes
to identify the nature of a critical system, major SCI event, or a de
minimis SCI event for purposes of disseminating this information.\786\
---------------------------------------------------------------------------

    \785\ See section IV.D.7. For purposes of this Economic
Analysis, there are two fewer entities than under the PRA analysis,
lowering these estimated costs. See supra note 700.
    \786\ See section IV.D.2.d, IV.D.7; see also supra note 700.
---------------------------------------------------------------------------

    Existing SCI entities may incur new costs associated with
information dissemination for additional systems intrusions scoped in
under the expanded definition. The Commission estimates approximately
$0.7 million in initial and annual PRA costs for existing SCI entities,
and $0.4 million in initial and annual costs for new SCI entities, for
disseminating information about system intrusions as required by the
proposed revisions to Rule 1002(c)(2).\787\ These costs are discussed
in more detail in section IV.
---------------------------------------------------------------------------

    \787\ See section IV.D.7; supra note 700.
---------------------------------------------------------------------------

    To the extent new SCI entities currently disseminate information
consistent with the Rule 1002(c) requirements, they could incur lower
PRA costs to comply with the requirements of Rule 1002(c) than entities
without such existing requirements. Similarly, to the extent many
existing SCI entities currently disseminate information consistent with
the expanded definition of systems intrusion, they could incur lower
PRA costs to comply with the amended requirements of Rule 1002(c) than
entities without such existing practices.
    Identification of Nature of System or Event. To comply with the
requirements of Rule 1002, SCI entities need to identify certain types
of events and systems issues, including whether the event is de
minimis. Current SCI entities would already have such processes in
place to comply with the existing requirements of Regulation SCI. The
Commission understands that many new SCI entities likely already have
some internal procedures for determining the severity of a systems
issue.
    As a new SCI entity must determine whether an SCI event has
occurred and whether it is a de minimis SCI event, Rule 1002 may impose
one-time implementation costs on new SCI entities associated with
developing a process or modifying its existing process to ensure that
they are able to quickly and correctly make such determinations, as
well as ongoing costs in reviewing the adopted process. As explained in
detail in section IV, we estimate new SCI entities would incur an
initial PRA cost of $1,641,024 and an ongoing annual PRA cost of
$362,418 to develop these processes.
    To the extent new SCI entities currently have a process in place
for identifying certain types of events and system issues consistent
with the relevant Rule 1002 requirements, they could incur lower PRA
costs to comply with the relevant requirements of Rule 1002 than
entities without such existing requirements.
c. Rule 1003--Material Systems Changes and SCI Review
i. Reports to the Commission (Rule 1003(a))
    Rule 1003(a)(1) requires an SCI entity to provide quarterly reports
to the Commission describing completed, ongoing, and planned material
systems changes to its SCI systems and the security of indirect SCI
systems, during the prior, current, and subsequent calendar quarters.
Rule 1003(a)(1) also requires an SCI entity to establish reasonable
written criteria for identifying a change to its SCI systems and the
security of its indirect SCI systems as material. Rule 1003(a)(2)
requires an SCI entity to promptly submit a supplemental report to
notify the Commission of a material error in or material omission from
a previously submitted report. These requirements remain unchanged. New
SCI entities, however, will become subject to them for the first time.
We discuss the benefits and costs of applying these provisions to new
SCI entities below.
(1) Benefits
    The notification requirement would be beneficial because it permits
the Commission and its staff to have up-to-date information regarding
an SCI entity's systems development progress and plans, to aid in
understanding the operations and functionality of the systems, and any
material changes thereto, without requiring SCI entities to submit a
notification to the Commission for each material systems change.\788\
---------------------------------------------------------------------------

    \788\ See SCI Adopting Release, supra note 1, at 72337-38.
---------------------------------------------------------------------------

    The Commission recognizes that some of the new SCI entities are
currently subject to other material systems change notification
requirements and that most, if not all, new SCI entities have some
internal processes for documenting systems changes as discussed in
detail above.\789\ Accordingly, the Commission notification
requirements in Rule 1003(a) would be new for most but not all of the
new SCI entities.
---------------------------------------------------------------------------

    \789\ See sections III.A.2.a.ii, III.A.2.b.ii, III.A.2.c.i.,
V.B.1.a.ii, V.B.1.b.ii, and V.B.1.c.ii.
---------------------------------------------------------------------------

    The benefits from the policy and procedure requirements in Rule
1003(a) for the new SCI entities (and the costs, as discussed below),
will therefore depend on the extent to which their current operations
already align with the rule's requirements, given both existing
regulation and current practice.
    While some of the existing regulations that apply to the proposed
new SCI entities may be consistent with or similar to the policy and
procedure requirements of Regulation SCI discussed in this section, the
Commission believes it is nevertheless appropriate to apply these
policy and procedure requirements to the new SCI entities and doing so
would benefit participants in the securities markets in which these
entities operate. Overall, applying the specific and comprehensive
requirements set forth in Rule 1003(a) of Regulation SCI to the new SCI
entities would complement any existing requirements and enhance any
reporting of material systems changes already in place for these
entities.
Costs
    The compliance costs of Rule 1003(a) primarily entail costs
associated with preparing and submitting Form SCI in accordance with
the instructions thereto. The initial and ongoing PRA cost estimates
associated with preparing and submitting Form SCI with regard to
material systems changes under Rule 1003(a)(1) and (2) are discussed in
detail in section V. The Commission does not expect Rule 1003(a) would
impose significant costs on SCI entities other than those discussed in
section IV. For new SCI entities, the Commission estimates
approximately $1.0 million in initial PRA costs and $0.3 million in
annual PRA costs to establish

reasonable written criteria for identifying material changes to SCI
systems and to the security of indirect SCI systems.\790\ For new SCI
entities, the Commission also estimates approximately $3.6 million
initially and annually in PRA costs associated with material system
change notices.\791\ The Commission acknowledges that the actual cost
for each new entity may differ depending on their existing processes
for documenting system changes and whether the necessary information is
readily available. The Commission does not expect Rule 1003(a) to
impose significant costs on new SCI entities besides the costs
discussed here. To the extent new SCI entities are currently subject to
other material systems change notification regulatory requirements and
have existing processes for documenting systems changes that align with
the Rule 1003(a) requirements, they could incur lower costs to comply
with the requirements of Rule 1003(a) than entities without such
existing requirements.
---------------------------------------------------------------------------

    \790\ See section IV.D.7. For purposes of this Economic
Analysis, there are two fewer entities than under the PRA analysis,
lowering these estimated costs. See supra note 700.
    \791\ Id.
---------------------------------------------------------------------------

ii. Annual SCI Review (Rules 1000 and 1003(b))
    Rule 1003(b) requires SCI entities to conduct an annual SCI review
and works in conjunction with the definition of ``SCI review'' from
Rule 1000. Under the current definition, SCI review includes ``(1) A
risk assessment with respect to such systems of an SCI entity; and (2)
An assessment of internal control design and effectiveness of its SCI
systems and indirect SCI systems to include logical and physical
security controls, development processes, and information technology
governance, consistent with industry standards.'' \792\ Rule 1003(b)(1)
then requires an annual SCI review, ``provided, however, that (i)
Penetration test reviews . . . shall be conducted at a frequency of not
less than once every three years; and (ii) Assessment of SCI systems
directly supporting market regulation or market surveillance shall be
conducted at a frequency based upon the risk assessment conducted as
part of the SCI review, but in no case less than once every three
years.'' \793\ Rule 1003(b)(2) and (3) require each SCI entity to
submit its annual SCI review report to, respectively, ``senior
management of the SCI entity for review'' and ``to the Commission and
to the board of director of the SCI entity, or the equivalent of such
board'' within specified time frames.\794\
---------------------------------------------------------------------------

    \792\ 17 CFR 242.1000.
    \793\ 17 CFR 242.1003(b)(1).
    \794\ 17 CFR 242.1003(b)(2) and (3).
---------------------------------------------------------------------------

    The Commission proposes to make changes to the definition of ``SCI
review.'' Specifically, under the proposed amendment, ``SCI review''
would include, for both SCI systems and indirect SCI systems, an annual
assessment, using appropriate risk management methodology, of risks
related to capacity, integrity, resiliency, availability, and security,
and internal control design and operating effectiveness, and annual
penetration test reviews (increased from at least one review every
three years), and a review of third-party provider management risks and
controls. Rule 1003(b) would also be amended to require more specific
information to be included in the SCI review report, including a list
of the controls reviewed and a description of each such control; the
findings of the SCI review, including, at a minimum, assessments of the
risks described above; a summary, including the scope of testing and
resulting action plan, of each penetration test review; and a
description of each deficiency and weakness identified by the SCI
review. In addition, the revisions would make mandatory that a response
from senior management to the report is included when it is submitted
to the Commission and board, whereas previously the language appeared
permissive.
(1) Benefits
    The SCI review requirement would have SCI entities assess the
relative strengths and weaknesses of their systems which may help, in
turn, improve systems and reduce the number of SCI events. The
reduction in occurrence of SCI events could reduce interruptions in the
price discovery process and liquidity flows, as discussed above. In
addition, the efficiency of the Commission's oversight (e.g.,
inspection) of SCI entities' systems would be enhanced.
    The proposed increase in the frequency of penetration testing
reviews, which applies to both new and existing SCI entities, should
better prepare SCI entities against cyber threats, which are increasing
in numbers and becoming more sophisticated. For this reason, the
proposed amendment is expected to further strengthen the security,
integrity, and resilience of all SCI entities. Having an annual
penetration testing requirement can help SCI entities reduce the
likelihood of costly data breaches.\795\ For instance, according to one
industry source, RSI Security, a penetration test ``can measure [the
entity's] system's strengths and weaknesses in a controlled environment
before [the entity has] to pay the cost of an extremely damaging data
breach.'' \796\
---------------------------------------------------------------------------

    \795\ See, e.g., Mirza Asrar Baig, How Often Should You
Pentest?, Forbes.com (Jan. 22, 2021), available at https://www.forbes.com/sites/forbestechcouncil/2021/01/22/how-often-should-you-pentest/?sh=b667999573c6.
    \796\ RSI Security, What is the Average Cost of Penetration
Testing?, RSI Security Blog (Mar. 5, 2020), available at https://
blog.rsisecurity.com/what-is-the-average-cost-of-penetration-
testing/#:~:text=Penetration%20testing%20can%20cost%20anywhere,that%2
0of%20a%20large%20company.
---------------------------------------------------------------------------

    The requirement to review third-party provider management risks and
controls will work in conjunction with the proposed amendment to Rule
1001(a)(2) requiring inclusion of a third-party provider management.
The additional benefit of requiring an annual review of third-party
provider management risks and controls is to ensure the benefits
provided by the amendment to Rule 1001(a)(2) are properly realized and
further increasing the likelihood that third-party providers provide
functionality, support or services that are consistent with the
requirements of Regulation SCI.
    The Commission understands that many existing SCI entities have
already adopted practices that may align with some of the provisions of
the proposed amendment to Rule 1003(b).
    The Commission also understands that many new SCI entities
currently undertake annual systems reviews and that senior management
and/or the board of directors or a committee thereof reviews reports of
such reviews as discussed in detail above.\797\ However, the scope of
the systems reviews, and the level of senior management and/or board
involvement in such reviews, can vary.
---------------------------------------------------------------------------

    \797\ See sections III.A.2.a.ii, III.A.2.b.ii, III.A.2.c.i.,
V.B.1.a.ii, V.B.1.b.ii, and V.B.1.c.ii.
---------------------------------------------------------------------------

    The benefits from the policy and procedure requirements in Rule
1003(b) for the new SCI entities (and the costs, as discussed below)
and the benefits from the amended policy and procedure requirements in
Rule 1003(b) for the existing SCI entities, will therefore depend on
the extent to which their current operations already align with the
rule's requirements, given both existing regulation and current
practice.
    For example, with respect to broker-dealers, prior Commission and
FINRA exam results indicate that many if not most large broker-dealers
conduct risk assessments of internal control design and effectiveness.
Additionally, some

broker-dealers provide annual cybersecurity reports to the board. The
Commission understands that nearly all large broker-dealers conduct
penetration testing \798\ of systems considered critical although not
all firms conduct such testing annually. Many of these current market
practices align with the policy and procedure requirements of
Regulation SCI discussed in this section.
---------------------------------------------------------------------------

    \798\ Supra note 619. According to FINRA's 2018 RCA, 100% of
higher revenue firms include penetration testing as a component in
their overall cybersecurity program. Other factors these firms
consider in evaluating the relevance of penetration testing include
the degree to which they manage or store confidential or critical
data such as trading strategies, customer PII, information about
mergers and acquisitions or confidential information from other
entities (for example, in the case of clearing firms).
---------------------------------------------------------------------------

    While some of the existing regulations that apply to the proposed
new SCI entities or current market practices may be consistent with or
similar to some of the policy and procedure requirements of Regulation
SCI discussed in this section, the Commission believes it is
nevertheless appropriate to apply these policy and procedure
requirements to the new SCI entities and that doing so would benefit
participants in the securities markets in which these entities operate.
    Overall, applying the specific and comprehensive requirements set
forth in Rule 1003(b) of Regulation SCI to the new SCI entities would
enhance and build on any existing policies and procedures, thereby
furthering the goals of Regulation SCI to strengthen the technology
infrastructure of the U.S. securities markets and improve its
resilience.
(2) Costs
    New SCI entities will incur costs to comply with the review
requirements for the first time, and existing SCI entities will incur
costs to comply with the amended provisions. The initial and ongoing
paperwork burden associated with conducting an SCI review, submitting a
report of the SCI review to senior management of the SCI entity for
review, and submitting a report of the SCI review and the response by
senior management to the Commission and to the board of directors of
the SCI entity or the equivalent of such board is discussed in detail
in section IV. For existing SCI entities, the Commission estimates
approximately $7.4 million in initial and annual costs, while for new
SCI entities the Commission estimates approximately $9.6 million in
initial and annual costs.\799\ The paperwork burden estimates provided
here for new SCI entities include the costs of complying with the
proposed amended versions of the Rule, namely the proposed additional
requirements for conducting the SCI review, the requirement that SCI
entities include more specific information in their SCI review reports,
and related recordkeeping.\800\
---------------------------------------------------------------------------

    \799\ See section IV.D.7. For purposes of this Economic
Analysis, there are two fewer entities than under the PRA analysis,
lowering these estimated costs. See supra note 700.
    \800\ See section IV.D.3.
---------------------------------------------------------------------------

    To the extent new SCI entities currently undertake annual systems
reviews and that senior management and/or the board of directors or a
committee thereof reviews reports of such reviews consistent with the
Rule 1003(a) requirements, they could incur lower PRA costs to comply
with the requirements of Rule 1003(a) than entities without such
existing practices. Similarly, to the extent many existing SCI entities
have already adopted practices that are consistent with some of the
provisions of the proposed amendment to Rule 1003(b), they could incur
lower PRA costs to comply with the requirements of Rule 1003(a) than
entities without such existing practices.
    With respect to the increased frequency for the penetration test
review, this requirement will impose non-paperwork compliance costs in
addition to those captured by the PRA estimates for both new and
existing SCI entities. For example, RSI Security explains that
penetration testing ``can cost anywhere from $4,000-$100,000,'' and
``[o]n average, a high quality, professional [penetration testing] can
cost from $10,000-$30,000.'' \801\ RSI Security, however, was clear
that the magnitudes of these costs can vary with size, complexity,
scope, methodology, types, experience, and remediation measures.\802\
Another source estimates a ``high-quality, professional [penetration
testing to cost] between $15,000-$30,000,'' while emphasizing that
``cost varies quite a bit based on a set of variables.'' \803\ This is
in line with a third source, which states that ``[a] true penetration
test will likely cost a minimum of $25,000.'' \804\ The Commission
preliminarily believes that the cost of penetration testing will range
between $25,000 and $100,000 for new and existing SCI entities, in
light of the complexity and scope required, although the costs may be
somewhat lower depending on the frequency with which such testing and
review are currently conducted by new and existing SCI entities. The
Commission acknowledges the non-paperwork costs of the proposed
increase in the frequency of a penetration test review, and seeks
feedback on these costs.
---------------------------------------------------------------------------

    \801\ See RSI Security, supra note 796.
    \802\ See id.
    \803\ Gary Glover, How Much Does a Pentest Cost?,
Securitymetrics Blog (Nov. 15, 2022, 8:36 a.m.), available at
https://www.securitymetrics.com/blog/how-much-does-pentest-cost.
    \804\ Mitnick Security, What Should You Budget for a Penetration
Test? The True Cost, Mitnick Security Blog, (Jan. 29, 2021, 5:13
a.m.), available at https://www.mitnicksecurity.com/blog/what-should-you-budget-for-a-penetration-test-the-true-cost.
---------------------------------------------------------------------------

Request for Comment
    118. For current and proposed SCI entities, how often do you
(already) perform penetration testing and how much does it cost?
d. Rule 1004--Business Continuity and Disaster Recovery Plan Testing
    Rule 1004(b) requires the testing of an SCI entity's business
continuity and disaster recovery plans at least once every 12 months.
Rule 1004(a) and (b) require participation in such testing by those
members or participants that an SCI entity reasonably determines are,
taken as a whole, the minimum number necessary for the maintenance of
fair and orderly markets in the event of the activation of its BC/DR
plans. Rule 1004(c) requires an SCI entity to coordinate such testing
on an industry- or sector-wide basis with other SCI entities.\805\ The
Commission is proposing to amend Rule 1004 to require that third-party
providers also participate in such testing. Therefore, for current SCI
entities, the difference is to include third-party providers in its
testing. For new SCI entities, the entire provision is a new
obligation. We discuss below the benefits and costs of applying this
provision, including the proposed amendments, to new and existing SCI
entities.
---------------------------------------------------------------------------

    \805\ One avenue for coordinating such testing is through
SIFMA's voluntary Industry-Wide Business Continuity Test. See SIFMA,
Industry-Wide Business Continuity Test (Oct. 15, 2022), available at
https://www.sifma.org/resources/general/industry-wide-business-continuity-test/.
---------------------------------------------------------------------------

i. Benefits
    As discussed above, requiring the new SCI entities to test their
BC/DR plans would likely improve backup infrastructure and lead to
fewer market-wide shutdowns, which should help facilitate continuous
liquidity flows in markets, reduce pricing errors, and thus improve the
quality of the price discovery process.\806\ Moreover, Rule 1004 would
help ensure fair and orderly markets in the event of the activation of
BC/DR plans.
---------------------------------------------------------------------------

    \806\ See sec. V.C.1.; see also SCI Adopting Release, supra note
1, at 72429.
---------------------------------------------------------------------------

    In addition, for both new and existing SCI entities, the proposed
requirement to establish standards for the

designation of third-party providers and their participation in the
currently scheduled functional and performance testing of the operation
of BC/DR plans will help those SCI entities ensure that their efforts
to develop effective BC/DR plans are not undermined by a lack of
participation by third-party providers that the SCI entity believes are
necessary to the successful activation of such plans.
    Although the Commission finds it impracticable to quantify these
benefits in dollar terms,\807\ the Commission believes it would be
helpful to consider the cost of an unplanned outage. For example, the
Commission considers a reduced occurrence of a potential outage as a
benefit of complying with Regulation SCI. As discussed above, one
source of cost estimates for an unplanned outage is the Ponemon
Institute's 2016 Cost of Data Center Outages report.\808\ According to
the report, the total cost per minute of an unplanned outage was $8,851
for the average data center the Institute surveyed in 2016.\809\ This
implies a cost of $531,060 per hour of an unplanned outage at the
time.\810\ Moreover, outages themselves can also last far longer than
one hour. For example, natural disasters, such as hurricanes, can often
lead to lengthy outages lasting 200 to 400 hours.\811\ Taken together,
this data suggests potentially significant benefits to having an
adequate policy and procedure in place to ensure business continuity
and disaster relief plans for SCI entities.
---------------------------------------------------------------------------

    \807\ As discussed in section V.D.1. multiple factors would
affect the harm to the overall economy from an unplanned outage at
an SCI entity.
    \808\ See supra note 696.
    \809\ Id. at 14.
    \810\ The report also showed that this figure was increasing
over time. The same figure was $5,617/min in 2010 and $7,908/min in
2013. See id.
    \811\ See Data Foundry, How Much Should You Spend On Business
Continuity and Disaster Recovery (Dec. 12, 2019), available at
https://www.datafoundry.com/blog/much-spend-business-continuity-disaster-recovery.
---------------------------------------------------------------------------

    The benefits from the BC/DR requirements in Rule 1004 for the
current and new SCI entities (and the costs, as discussed below) will
depend on the extent to which their current operations already align
with the rule's requirements, given both existing regulation and
current practice. Based on discussion with industry participants, the
Commission understands that some existing SCI entities already require
third-party service provider participation in testing despite not being
required to do so currently under Regulation SCI. For these SCI
entities, there may be incremental benefits from making the third-party
service provider participation a requirement under the Regulation and
ensuring that they continue to include these parties in such testing
going forward.
    Some new SCI entities, either due to existing regulatory
requirements or on their own volition, also already require some of
their members or participants, as well as third-party providers, to
participate in performance testing of BC/DR plans or offer the
opportunity to do so on a voluntary basis, although such participation
may be limited in nature (e.g., testing for connectivity to backup
systems). However, existing requirements for the new SCI entities may
differ from the requirements of Rule 1004. For example, FINRA Rule 4370
does not require the functional and performance testing and
coordination of industry or sector-testing of such plans.
    With respect to SBSDRs, the requirements of Regulation SCI are more
specific and comprehensive in terms of testing business continuity and
disaster recovery plans than the principles-based requirements of Rule
13n-6. The requirements of Regulation SCI would thus exist and operate
in conjunction with Rule 13n-6 and help ensure that SBSDR market
systems are robust, resilient, and secure and enhance Commission
oversight of these systems. Moreover, to the extent the systems of
SBSDRs that relate to the securities-based swap markets function
separately (or could function separately in the future) from the
systems of SDRs that relate to the swaps markets, applying Rule 1004 to
these entities would help to ensure effective testing of BC/DR plans
for the specific systems relevant to the securities markets and would
subject these systems to enhanced Commission oversight.
    Similarly, the Commission recognizes that exempt clearing agencies
that this rule proposal would newly scope into Regulation SCI are
currently required to have BC/DR plans and test them at least annually
with the participation of customers, critical utilities, critical
service providers, other clearing agencies, other market
infrastructures, and any other institution with which interdependencies
have been identified in the business continuity policy. Overall,
applying the specific and comprehensive requirements set forth in Rule
1004 would complement existing requirements and enhance the BC/DR plans
tests already in place for these entities.
ii. Costs
    The mandatory testing of SCI entity BC/DR plans, including backup
systems, as required under amended Rule 1004, will result in costs to
SCI entities. For current SCI entities, the increase in the cost would
come from the requirement to include designated third-party providers
in when testing their BC/DR plans--to the extent they have not been
doing so. In addition, because the proposed requirements of Rule 1004
would require participation by various other parties, including
designated members, participants, and other third parties, these
parties may also bear costs of Rule 1004. We discuss these various
costs below.
    Costs to New and Existing SCI Entities. It is the Commission's
understanding that some new SCI entities already engage with their
members, participants or customers, as applicable, or third-party
providers when testing BC/DR plans. Furthermore, as mentioned above,
market participants, including new SCI entities, already coordinate
certain BC/DR plans testing to an extent. However, Rule 1004 mandates
participation in testing for new SCI entities that do not currently
participate, requires coordination when testing BC/DR plans, and
requires their members, market participants, or their third-party
providers participate.
    In particular, Rule 1004 requires SCI entities to designate their
members, participants, or third-party providers to participate in BC/DR
plans testing and to coordinate such testing with other SCI entities on
an industry- or sector-wide basis. The requirement of member,
participant, or third-party provider designation in BC/DR plans testing
under Rule 1004 may impose new costs even for those that currently have
BC/DR plan testing, as an SCI would have to allocate resources towards
initially establishing and later updating standards for the designation
of its members and participants and third-party providers for testing.
For example, systems reconfiguration for functional and performance
testing and establishing an effective coordinated test script could be
a complex process and result in additional costs, but it is an
important first step in establishing robust and effective BC/DR plans
testing. Furthermore, the requirement to coordinate industry- or
sector-wide testing would impose additional administrative costs
because an SCI entity would be required to notify its members,
participants, or third-party providers and also organize, schedule, and
manage the coordinated testing.
    Many of the costs associated with Rule 1004 are costs estimated in
the PRA in section IV. For existing SCI entities the Commission
estimates approximately $1.4 million in initial costs and $0.5 million
in annual costs,

while for new SCI entities the Commission estimates approximately $3.2
million in initial costs and $1.1 million in annual costs.\812\ In
addition to the PRA costs, the Commission believes that new SCI
entity's may incur non-paperwork costs associated with the mandatory
testing of BC/DR plans, including backup systems; however, the
Commission finds it impracticable to provide a quantified estimate of
these specific non-paperwork costs for new SCI entities because the
Commission does not have detailed information regarding the current
level of engagement by members or participants in BC/DR testing and the
associated costs, or the details of the BC/DR testing that new SCI
entities would implement pursuant to Rule 1004.
---------------------------------------------------------------------------

    \812\ See section IV.D.4. For purposes of this Economic
Analysis, there are two fewer entities than under the PRA analysis,
lowering these estimated costs. See supra note 700.
---------------------------------------------------------------------------

    In addition, both new and existing SCI entities may incur costs
beyond the PRA costs to comply with the requirement that third-party
providers be included in the testing requirement. The Commission
acknowledges that there will be significant variations in incremental
cost for new and existing SCI entities beyond the costs of complying
with the rest of the testing requirements, depending on the
relationship of each SCI entity with the third-party provider and the
need to revise any contractual agreement between them. But in any
situation where a third-party provider is already required to provide a
continuous service plan (such as 24/7 connectivity), the incremental
cost of having the third-party provider participate in the BC/DR
testing should be modest. To the extent existing and new SCI entities
already have BC/DR plan testing that align with the Rule 1004
requirements, they could incur lower costs to comply with the
requirements of Rule 1004 than entities without such existing BC/DR
plan testing.
    Costs to SCI Entity Members, Participants, and Third-Party
Providers. Rule 1004 will also impose costs on SCI entity designated
members, participants and third-party providers. Although members,
participants, and third-party providers will incur costs as a result of
Rule 1004, those that are likely to be designated to participate in
business continuity and disaster recovery plans testing are those that
conduct a high level of activity with the SCI entity or those that play
an important role for the SCI entity and who are more likely to have
already established connections to the SCI entity's backup site. It is
the Commission's understanding that most of the larger members,
participants, and third-party providers already have established
connectivity with the SCI entity's backup site and already monitor and
maintain such connectivity, and thus the additional connectivity costs
imposed by Rule 1004 would be modest to these members or
participants.\813\ The Commission, however, finds it impracticable to
provide a quantified estimate of the specific costs for SCI entity
members, participants or third-party providers associated with the
mandatory testing required by Rule 1004 as such data or information is
not required to be provided by SCI entities to the Commission under
Regulation SCI. Nevertheless, the Commission preliminarily believes,
for similar reasons as provided in the section discussing non-paperwork
burden estimates for Rule 1001(a) and (b), that the figures from 2014
remain reasonable approximations for new SCI entities in 2023, after
adjusting for inflation since 2014.\814\
---------------------------------------------------------------------------

    \813\ See SCI Adopting Release, supra note 1, at 72430.
    \814\ After adjusting for inflation since 2014, the cost of BD/
DR plan testing ranges from approximately $31,000 to $76,000 per
year, per member or participant. The aggregate annual cost for
designated members and participants to participate in BC/DR testing
is approximately $84.0 million after adjusting for inflation since
2014.
---------------------------------------------------------------------------

    Because SCI entities have an incentive to limit the imposition of
the cost and burden associated with testing to the minimum necessary to
comply with the rule, given the option, most SCI entities would likely,
in the exercise of reasonable discretion, prefer to designate the
fewest number of members, participants, or third-party providers to
participate in testing and meet the requirements of the rule, than to
designate more.
    The Commission believes that the cost associated with Rule 1004 is
unlikely to induce the designated members or participants to reduce the
number of SCI entities through which they trade and adversely affect
price competitiveness in markets. As noted above, the Commission also
recognizes that costs to some SCI entity members, participants, or
third-party providers associated with Rule 1004 could vary depending on
the BC/DR plans being tested, and to the extent they participate. Based
on industry sources, the Commission understands that most of the larger
members or participants of SCI entities already maintain connectivity
with the backup systems of SCI entities.\815\ However, the Commission
understands that there is a lower incidence of smaller members or
participants maintaining connectivity with the backup sites of SCI
entities. As such, the Commission believes that the compliance costs
associated with Rule 1004 would be higher for those members,
participants, or third-party providers that are designated for testing
by SCI entities who would need to invest in additional infrastructure
to participate in such testing.\816\
---------------------------------------------------------------------------

    \815\ SCI Adopting Release, supra note 1, at 72430.
    \816\ Id.
---------------------------------------------------------------------------

    As discussed above, Rule 1001(a) does not require backup facilities
of SCI entities fully duplicate the features of primary
facilities.\817\ Further as discussed in section IV.B.6, SCI entity
members, participants, or third-party providers are not required by
Regulation SCI to maintain the same level of connectivity with the
backup sites of an SCI entity as they do with the primary sites. In the
event of a wide-scale disruption in the securities markets, the
Commission acknowledges that SCI entities and their members,
participants, or third-party providers may not be able to provide the
same level of service as on a normal trading day. However, when BC/DR
plans are in effect due to a wide-scale disruption in the securities
markets, the requirements of Rule 1004 should help ensure adequate
levels of service and pricing efficiency, to facilitate trading and
maintain fair and orderly markets without imposing excessive costs on
SCI entities and market participants by requiring them to maintain the
same connectivity with the backup systems as with the primary
sites.\818\
---------------------------------------------------------------------------

    \817\ SCI Adopting Release, supra note 1, at 72353.
    \818\ See id.
---------------------------------------------------------------------------

Request for Comment
    119. If you are a current or proposed SCI entity and you currently
require any of your service providers to participate in your scheduled
business continuity or disaster recovery testing, how does your
activity differ from the requirements of the rule proposal? What have
been the benefits and costs of this activity?
    120. If you are a current or proposed SCI entity and your business
continuity or disaster recovery plans address the unavailability of
your third-party providers, how does your activity differ from the
requirements of the rule proposal? What have been the benefits and
costs of this activity?
e. Rules 1005 Through 1007--Recordkeeping and Electronic Filing
    Rules 1005 through 1007 relate to recordkeeping requirements,
filing and submission requirements, and

requirements for service bureaus. SCI entities are required by Rule
1005 of Regulation SCI to make, keep, and preserve certain records
related to their compliance with Regulation SCI.\819\ Rule 1006 of
Regulation SCI provides for certain requirements relating to the
electronic filing on Form SCI, of any notification, review,
description, analysis, or report to the Commission required to be
submitted under Regulation SCI.\820\ Rule 1007 of Regulation SCI
requires a written undertaking when records are required to be filed or
kept by an SCI entity under Regulation SCI, or are prepared or
maintained by a service bureau or other recordkeeping service on behalf
of the SCI entity.\821\
---------------------------------------------------------------------------

    \819\ See 17 CFR 242.1005. Rule 1005(a) of Regulation SCI
relates to recordkeeping provisions for SCI SROs, whereas Rule
1005(b) relates to the recordkeeping provision for SCI entities
other than SCI SROs.
    \820\ See 17 CFR 242.1006.
    \821\ See 17 CFR 242.1007.
---------------------------------------------------------------------------

    Rule 1005(c) currently requires that the recordkeeping period
survives even if an SCI entity ceases to do business or ceases to be
registered under the Exchange Act. The Commission proposes to amend
Rule 1005(c) so that this record retention provision also applies to an
SCI entity that remains in business as a registered entity but
``otherwise [ceases] to be an SCI entity.'' Therefore, for existing SCI
entities, this is the only difference from the current recordkeeping
requirement in Rule 1005(c). For new SCI entities, all of the
requirements in Rules 1005 through 1007 are new obligations. We discuss
below the benefits and costs of applying these provisions to new and
existing SCI entities.
i. Benefits
    The Commission believes that Rules 1005 and 1007 would allow
Commission staff to inspect and examine the new SCI entities for their
compliance with Regulation SCI, and would increase the likelihood that
Commission staff can identify conduct inconsistent with Regulation SCI.
Preserved information should provide the Commission with an additional
source to help determine the causes and consequences of one or more SCI
events and better understand how such events may have impacted trade
execution, price discovery, liquidity, and investor participation.
Consequently, the Commission believes that the requirements of Rules
1005 and 1007 would help ensure compliance of the new SCI entities with
Regulation SCI and help realize the potential benefits (e.g., better
pricing efficiency, price discovery, and liquidity flows) of the
regulation.
    Rule 1006 requires SCI entities to electronically file all written
information to the Commission on Form SCI.\822\ Rule 1006 would provide
a uniform manner in which the Commission receives--and SCI entities
provide--written notifications, reviews, descriptions, analyses, or
reports required by Regulation SCI. Rule 1006 should add efficiency for
the new SCI entities in drafting and submitting the required reports,
and for the Commission in reviewing, analyzing, and responding to the
information provided.
---------------------------------------------------------------------------

    \822\ Except for notifications submitted pursuant to Rule
1002(b)(1) and (3).
---------------------------------------------------------------------------

    The Commission recognizes that all of the new SCI entities are
currently subject to the Commission and other regulatory recordkeeping
requirements.\823\ However, records relating to Regulation SCI may not
be specifically addressed in the recordkeeping requirements of certain
rules. The benefits from the recordkeeping requirements in Rules 1005
and 1007 for the new SCI entities (and the costs, as discussed below),
will therefore depend on the extent to which their current operations
already align with the rule's requirements, given both existing
regulation and current practice.
---------------------------------------------------------------------------

    \823\ See, e.g., 17 CFR 240.17a-3 and 240.17a-4, applicable to
broker-dealers.
---------------------------------------------------------------------------

    The proposed amendment to Rule 1005(c) will apply to new and
existing SCI entities. Although many SCI events may be resolved in a
short time frame, there may be other SCI events that may not be
discovered for an extended period of time after their occurrences, or
may take significant periods of time to fully resolve. In such cases,
having an SCI entity's records available after it has ceased to be an
SCI entity or be registered under the Exchange Act would add to the
scope of historical records available for review in the event of an SCI
event. This is a particular issue for entities whose coverage under the
rule might vary over time, depending on when the entities--or their
systems--meet the rule's coverage thresholds. For these entities,
uniform record retention periods will also facilitate comparative
review of risk and compliance trends. These benefits will be limited if
entities and systems of entities tend to continue meeting coverage
requirements over time, without a break in coverage.
ii. Costs
    The recordkeeping requirements of Rules 1005 and 1007 will impose
additional costs, including a one-time cost to set up or modify an
existing recordkeeping system to comply with Rules 1005 and 1007. The
initial and ongoing compliance costs associated with the recordkeeping
requirements are attributed to paperwork burdens, which are discussed
in section IV above.\824\
---------------------------------------------------------------------------

    \824\ When monetized, the paperwork burden associated with all
recordkeeping requirements would result in approximately $278,460
initially and $40,950 annually for all new SCI entities in the
aggregate. The Commission estimates that a New SCI Entity other than
an SCI SRO will incur a one-time cost of $900 for information
technology costs for purchasing recordkeeping software, for a total
of $18,900. See section IV.D.7. For purposes of this Economic
Analysis, there is two fewer entities than under the PRA analysis,
lowering these estimated costs. See supra note 700.
---------------------------------------------------------------------------

    With respect to Rule 1006, all costs associated with Form SCI are
attributed to the paperwork burdens discussed in section IV. For
existing SCI entities the Commission estimates approximately $21.0
million in initial costs and $12.0 million in annual costs, while for
new SCI entities the Commission estimates approximately $41.7 million
in initial costs and $25.8 million in annual costs.\825\
---------------------------------------------------------------------------

    \825\ See section IV.D.7; supra note 700.
---------------------------------------------------------------------------

    Every new SCI entity will be required to have the ability to
electronically submit Form SCI through the EFFS system, and every
person designated to sign Form SCI will be required to have an
electronic signature and a digital ID. The Commission believes that
this requirement will not impose an additional burden on new SCI
entities, as these entities likely already prepare documents in an
electronic format that is text searchable or can readily be converted
into a format that is text searchable.
    The Commission also believes that many new SCI entities currently
have the ability to access the EFFS system and electronically submit
Form SCI, such that the requirement to submit Form SCI electronically
will not impose significant new implementation or ongoing costs.\826\
The Commission also believes that some of the persons who will be
designated to sign Form SCI already have digital IDs and the ability to
provide an electronic signature. To the extent that some persons do not
have digital IDs, the additional cost to obtain and maintain digital
IDs is accounted for in the paperwork burden, discussed in section IV
above.\827\
---------------------------------------------------------------------------

    \826\ The initial and ongoing costs associated with various
electronic submissions of Form SCI for the new SCI entities are
discussed in the Paperwork Reduction Act section above. See supra
section IV.D.6.
    \827\ See id.

---------------------------------------------------------------------------

D. Efficiency, Competition, and Capital Formation Analysis

    As previously discussed in section C, the proposed amendments to
Regulation SCI would reduce the impact of market disruptions arising as
a result of natural disasters, third-party provider service outages,
cybersecurity events, hardware or software malfunctions. We expect that
the proposed amendments will reduce the frequency, severity, and
duration of systems issues that occur in the context of these events,
and will thus decrease the number of trading interruptions. The
proposed amendments will thus improve market efficiency, price
discovery, and liquidity, because trading interruptions interfere with
the process through which information gets incorporated into security
prices. In addition, by reducing trading interruptions, the proposed
amendments will have beneficial effects across markets, because of the
interconnectedness of securities markets. For example, an interruption
in the market for equity securities could harm the price discovery
process in the options markets, reducing the flow of liquidity across
markets. As a result, we expect the proposed amendments, if adopted,
would improve price efficiency in securities markets.\828\
---------------------------------------------------------------------------

    \828\ See sections V.D.1 and V.D.3.
---------------------------------------------------------------------------

    Prices that accurately convey information about fundamental value
improve the efficiency with which capital is allocated across projects
and firms, thus promoting capital formation. In addition, we expect the
proposed amendments to encourage capital formation by reinforcing
investors' confidence in market transactions.
    The proposed amendments to Regulation SCI could affect competition
among SCI entities because the compliance costs could differ among SCI
entities. For example, current SCI entities are expected to face
smaller incremental compliance costs than new SCI entities. New SCI
entities that have been subject to similar regulations could also face
smaller incremental compliance costs than those who have not. Even
among new SCI entities, certain provisions can be more costly for some
than others. For example, the initial compliance costs of the systems
resumption requirements could differ among new SCI entities.
Specifically, as mentioned above, Rule 1004's BC/DR testing
requirements may require greater incremental costs for smaller SCI
entities that have not already been engaged in BC/DR testing. Lastly,
some of the new SCI entities may already have practices that are
aligned with at least some of the requirements under amended Regulation
SCI compared to the baseline, reducing their incremental compliance
costs.
    In addition to competition among SCI entities, the compliance costs
imposed by the proposed amendments to Regulation SCI could have an
effect on competition where SCI entities and non-SCI entities compete,
such as in the markets for trading services (e.g., broker-dealers).
Specifically, since non-SCI entities do not have to incur the
compliance costs associated with Regulation SCI, SCI entities could
find it difficult to pass on their own compliance costs to investors or
customers without losing investors or customers to non-SCI entities.
This would adversely affect the profits of SCI entities. That said, by
expanding the set of SCI entities, the proposed amendments would ensure
that, where there is currently competition between existing SCI
entities and the new entities under this proposed rule then these
competing entities are subject to similar SCI compliance requirements.
    The proposed threshold-based tests for scoping a broker-dealer into
Regulation SCI could bring about a potential unintended effect of
deterring growth among broker-dealers and discouraging potential
benefits of scale economies. For example, to the extent a certain
broker-dealer may take otherwise-unwanted steps to keep its trading
volumes or asset level low, or spin off entities and not realize scale
economies, all for the purpose of avoiding being subject to regulation,
this can be inefficient for the economy. Likewise, the proposal to
apply regulation SCI to all exempt clearing agencies would mean that
any entity that seeks to become a clearing agency will automatically be
subject to Regulation SCI and will thus bear the associated compliance
cost.
    The compliance costs associated with Rule 1004 could raise barriers
to entry and affect competition among members or participants of SCI
entities. Specifically, to the extent that members or participants
could be subject to designation in BC/DR plan testing and could incur
additional compliance costs, the member or participant designation
requirement of Rule 1004 could raise barriers to entry. In addition, as
discussed above, the compliance costs of the rule will likely be higher
for smaller members or participants of SCI entities compared to larger
members or participants of SCI entities. The adverse effect on
competition may be mitigated to some extent, as the most likely members
or participants to be designated for testing are larger members or
participants who already maintain connectivity with an SCI entity's
backup systems. Further, the adverse effect on competition for smaller
members or participants could be partially mitigated to the extent that
larger firms, which are members of multiple SCI entities, could incur
additional compliance costs as these larger member firms could be
subject to multiple designations for business continuity and disaster
recovery plan testing.\829\
---------------------------------------------------------------------------

    \829\ Id. at 72433.
---------------------------------------------------------------------------

E. Reasonable Alternatives

    In formulating our proposal, we have considered various
alternatives. Those alternatives are discussed below and we have also
requested comments on certain of these alternatives.
1. Limiting the Scope of the Regulation SCI Provisions for New SCI
Entities
    The Commission has considered whether all of the obligations set
forth in Regulation SCI should apply to the new SCI entities or whether
only certain requirements should be imposed, such as those requiring
written policies and procedures, notification of systems problems,
business continuity and disaster recovery testing, and penetration
testing.\830\ For example, the Commission has considered if SBSDRs
should be subject to full Regulation SCI requirements, similar to SCI
plan processors, or should be subject to only some of the Regulation
SCI requirements, given differing levels of automation and stages of
regulatory development of the SBS market.
---------------------------------------------------------------------------

    \830\ Such an approach is similar to that taken regarding the
competing consolidators in Market Data Consolidator rule. The Market
Data Consolidator rule subjects competing consolidators that do not
meet the earning thresholds to some, but not all, obligations that
apply to competing consolidators. 17 CFR 242.614.
---------------------------------------------------------------------------

    The Commission believes that these alternatives would reduce some
of the benefits as well as some of the costs compared to the proposed
rules. The lower costs from limiting the Regulation SCI requirements,
such as periodic reviews of policies and procedures or Commission
notification, for some new entities could result in lower barriers to
entry and could increase competition in the relevant markets compared
to the proposed rules. However, taking into consideration the large
size of the new SCI entities and, therefore, their externalities on
some other SCI entities in case of system failure, the Commission
believes these effects on the competition may not be significant enough
to warrant forgoing benefits

(such as timely notifications to the Commission) in addition to the
reduced effectiveness of the regulation. Moreover, not requiring
specific SCI requirements for certain new SCI entities would likely
result in less uniform treatment across current and new SCI entities
performing similar functions.\831\
---------------------------------------------------------------------------

    \831\ See supra section III.A.2.
---------------------------------------------------------------------------

2. Mandating Compliance With Current SCI Industry Standards
    The Commission has considered the alternative of mandating
compliance with current SCI industry standards. This alternative would
require that the policies and procedures of SCI entities required under
Rule 1001(a) comply with ``current SCI industry standards'' rather than
simply making such compliance a safe harbor under Rule 1001(a)(4).\832\
This alternative would ensure that an SCI entity have policies and
procedures consistent with current SCI industry standards. These
standards likely have the advantage of economy of scale as several
entities in that industry adopted the standards and thus the standards
benefit from more innovative efficiencies than in-house standards.
Moreover, mapping policies and procedures to the industry standard
would help facilitate the Commission's inspection and enforcement
capabilities.
---------------------------------------------------------------------------

    \832\ Proposed Rule 1000(a)(4) defines ``current SCI industry
standards'' as ``information technology practices that are widely
available to information technology professionals in the financial
sector and issued by an authoritative body that is a U.S.
governmental entity or agency, association of U.S. governmental
entities or agencies, or widely recognized organization.''
---------------------------------------------------------------------------

    Based on Commission staff experience, however, this alternative
would not be an appropriate solution for all SCI entities. One reason
is that given the differences exhibited by various SCI entities and the
complexity of each SCI entity's operations, it may not be suitable for
each one to find a current SCI industry standard that suits its needs
without substantial modification and customization. To this extent, the
Commission sees a great value in allowing each SCI entity to customize
its policies and procedures to address the specific operational risks
it faces. It is the Commission's understanding that a number of current
SCI entities have developed and implemented policies and procedures
largely based on industry standards, but they have also customized them
based on the size, risks, and unique characteristics of SCI entities.
For this reason, mandating compliance with a current SCI industry
standard may be an inefficient approach. For the larger and more
complex-structured SCI entities, losing flexibility to design systems
or develop policies and procedures by mandating the industry standards
could also result in less effective policies and procedures or
adversely affect integrity, resiliency, availability, or security of
SCI systems.
3. Requiring Diversity of Back-Up Plan Resources
    With respect to critical SCI systems, the Commission has considered
mandating multi-vendor backups. This alternative would require that SCI
entities that utilize third-party providers to operate critical SCI
systems have geographically diverse backup systems that are operated by
a different third-party provider (e.g., multi-cloud). As previously
discussed, there can be significant advantages for an entity moving its
systems from an on-premises, internally run data center to cloud
service providers (CSPs), which may include cost efficiencies,
automation, increased security, and resiliency, and the ability to
leverage the opportunity to reengineer or otherwise update their
systems and applications to run more efficiently.\833\
---------------------------------------------------------------------------

    \833\ See section III.C.2.
---------------------------------------------------------------------------

    However, each SCI entity is obligated to satisfy the requirements
of Regulation SCI for systems operated on behalf the SCI entity by a
third party. This necessarily requires an individualized assessment of
the costs and risks associated with managing the CSP relationship, and
determining that the CSPs' backup and recovery capabilities are
sufficiently resilient, geographically diverse, and reasonably designed
to achieve timely recovery following a wide-scale disruption.\834\
Further, while reducing the risk of over-reliance on a single vendor
and the chance of system failures-for example, due to the same
vulnerabilities within a vendor--a multi-cloud strategy would add
additional costs including negotiation, contract, deployment, and
management costs; and it is the Commission's understanding that multi-
cloud architecture could introduce more complexity and, accordingly,
operational and cybersecurity risks into the SCI back-up systems.\835\
In place of a prescriptive alternative of mandating multi-vendor
backups, the Commission is proposing, in Rule 1001(a)(2)(v) and (ix), a
more flexible approach under which each SCI entity must consider CSPs
and other third-party providers as part of a risk-based assessment of
the providers' criticality and their role in the entity's business
continuity and disaster recovery planning.
---------------------------------------------------------------------------

    \834\ See id.
    \835\ For example, security breach possibilities could increase
because of the interconnection of SCI systems between multi cloud
providers.
---------------------------------------------------------------------------

4. Penetration Testing Frequency
    With respect to the penetration testing frequency, the Commission
has considered requiring longer (e.g., every 2 years) or shorter
(quarterly, every 6 months) frequencies for penetration testing, rather
than the currently proposed annual (a reduction from the current rule
of every three years). When the Commission adopted Regulation SCI in
2014, the Commission decided to require penetration test reviews ``not
less than once every three years in recognition of the potentially
significant costs that may be associated with the performance of such
tests.'' \836\ Nevertheless, as mentioned above, markets have changed
since the adoption of Regulation SCI. In particular, cybersecurity has
become a more pervasive concern for all types of businesses, including
SCI entities. In addition, the Commission understands that industry
practices with respect to penetration testing has evolved such that
tests occur on a much more frequent basis, as businesses confront the
threat of cybersecurity events on a wider scale. To this extent, the
Commission has considered whether penetration testing should be
conducted at least once quarterly, every 6 months, or every 2 years.
---------------------------------------------------------------------------

    \836\ SCI Adopting Release, supra note 1, at 72344.
---------------------------------------------------------------------------

    The Commission understands industry practices generally tend to
recommend at least one penetration test review a year. Requiring
penetration test reviews more frequently could further strengthen
security and reduce cybersecurity events at SCI entities. Nevertheless,
the Commission believes that requiring all SCI entities to conduct such
reviews more than once every year may be too much of a drain on the
institution's resources, due to the estimated cost of $10,000 to
$30,000 per test,\837\ and given the wide scope of annual testing to be
conducted as part of an annual review under proposed Rule 1003(b).\838\
Moreover, while some entities may need to perform multiple tests each
year on different components of their environment, for other entities a
requirement for multiple tests may be counterproductive, if the testing
cycle

does not provide time to implement security investments.
---------------------------------------------------------------------------

    \837\ See section V.D.3.c.
    \838\ See proposed Rules 1000, 1001(a)(2)(iv) (penetration
testing as part of an annual review under Rule 1003(b) must include
testing of ``network, firewalls, and production systems, including
of any vulnerabilities of . . . SCI systems and indirect SCI
systems,'' including vulnerabilities ``pertaining to internal and
external threats, physical hazards, and natural or manmade
disasters'').
---------------------------------------------------------------------------

5. Attestation for Critical SCI System Vendors
    Given the importance of critical SCI systems and SCI entities'
increasing reliance on third-party providers, the Commission has
considered requiring attestation (such as by an SCI entity's chief
executive officer or general counsel) that contracts with third-party
providers for critical SCI systems comply with the SCI entity's
obligations under Regulation SCI. Such an attestation requirement would
further ensure that SCI entities are negotiating contract terms with
third-party providers for critical SCI systems in a manner that is
consistent with Regulation SCI's requirements. However, an attestation
requirement for each such contract may have limited value, and may be
overly time-consuming and resource-intensive, relative to the value of
the attestation requirement.
    The value of an attestation requirement will be limited, given that
proposed Rule 1001(a)(2)(ix) would require each SCI entity to have a
program to manage and oversee third-party providers, or to the extent
that they already provide attestations to their customers (which, in
turn, may vary to the degree that they are in competition with like
entities). At the same time, an attestation requirement may have
significant costs.
    For SCI entities these costs may include the direct costs of
updating their oversight processes in order to ensure that their
attestations are accurate and in compliance; training their in-house
personnel on the third-party service provider's methods for operating
critical IT systems; and conducting oversight of the service provider's
subcontractors as well as oversight of the service provider itself. SCI
entities may also incur costs if they move critical system functions
in-house or consolidate vendors to reduce the risk or burden of the
attestation requirement, which could result in lower-quality or less
efficient services. Furthermore, requiring the attestation by SCI
entity's senior officers could increase the due diligence cost of the
attestation requirement. Senior officers making attestations may
require additional liability insurance, higher compensation or lower
incentive pay as a share of overall compensation. Finally, the service
providers themselves may face increased costs as part of their efforts
to help the SCI entity make the relevant attestation, including
contract renegotiation costs, upgrading operations, and responding to
information requests from the SCI entity. These costs, in turn, might
be passed to the SCI entity and ultimately to its participants,
members, or customers.
    The Commission believes the additional costs could be
disproportionate to the benefits of an attestation requirement. For
these reasons, the Commission has decided against including an
attestation requirement.
6. Transaction Activity Threshold for SCI Broker-Dealers
    With respect to the transaction activity threshold used to scope
broker-dealers within Regulation SCI as discussed in section III.A.2.b,
the Commission has considered as an alternative whether to set a higher
(more limited) or lower (more expansive) threshold than the proposed
10% threshold. For example, the Commission has considered if only
broker-dealers with transaction activity thresholds above 15% should be
included as SCI broker-dealers \839\ but determined that this would
fail to scope within Regulation SCI some of the largest and most
significant broker-dealers that pose technological vulnerabilities and
risks to the maintenance of fair and orderly markets. This would have
the effect of decreasing costs moderately for broker-dealers no longer
within the scope of Regulation SCI at the expense of a significant
decrease in benefits otherwise associated with the improvements to fair
and orderly markets, as described above.
---------------------------------------------------------------------------

    \839\ The Commission believes that the proposed threshold of 5%
of total assets is a reasonable approach to identifying the largest
broker-dealers. See section III.A.2.b.iii (discussing proposed
thresholds for an ``SCI broker-dealer''). The Commission has
considered as an alternative to further scope in the broker-dealers
with transaction activity thresholds above 15%. Regulation SCI would
only be applicable to an estimated ten broker-dealers based on the
analysis of data which include broker-dealer FOCUS Report Form X-
17A-5 Schedule II filings from Q4 2021 to Q3 2022. Also for
additional detail on the calculation of total assets of all security
broker-dealers, see supra note 127. Data also include Consolidated
Audit Trail (CAT) data from Jan. 2022 to June 2022, the plan
processors (SIPs) of the CTA/CQ Plans and Nasdaq UTP Plan. CTA Plan,
available at https://www.ctaplan.com; Nasdaq UTP Plan, available at
https://www.utpplan.com, Options Price Reporting Authority (OPRA)
data, TRACE for Treasury Securities data from Jan. 2022 to June
2022, regulatory TRACE data from Jan. 2022 to June 2022, and FINRA
TRACE.
---------------------------------------------------------------------------

    Similarly, the Commission has also considered whether all broker-
dealers with transaction activity thresholds above 5% should be
included as SCI broker-dealers,\840\ but determined that this would
scope within Regulation SCI several broker-dealers that are not among
the most significant broker-dealers that pose technological
vulnerabilities and risks to the maintenance of fair and orderly
markets. This would have the effect of increasing costs for marginal
firms without a comparable increase in benefits associated with an
improvement of fair and orderly markets.
---------------------------------------------------------------------------

    \840\ The Commission believes that the proposed threshold of 5%
of total assets is a reasonable approach to identifying the largest
broker-dealers. See section III.A.2.b.iii (discussing proposed
thresholds for an ``SCI broker-dealer''). The Commission has
considered as an alternative to further scope in the broker-dealers
with transaction activity thresholds above 5%. Regulation SCI would
only be applicable to an estimated 29 broker-dealers based on the
analysis of data which include broker-dealer FOCUS Report Form X-
17A-5 Schedule II filings from Q4 2021 to Q3 2022. Also for
additional detail on the calculation of total assets of all security
broker-dealers, see supra note 127. Data also include Consolidated
Audit Trail (CAT) data from Jan. 2022 to June 2022, the plan
processors (SIPs) of the CTA/CQ Plans and Nasdaq UTP Plan. CTA Plan,
available at https://www.ctaplan.com; Nasdaq UTP Plan, available at
https://www.utpplan.com, Options Price Reporting Authority (OPRA)
data, TRACE for Treasury Securities data from Jan. 2022 to June
2022, regulatory TRACE data from Jan. 2022 to June 2022, and FINRA
TRACE.
---------------------------------------------------------------------------

    In addition, with respect to the transaction activity threshold
used to scope broker-dealers within Regulation SCI as discussed in
section III.A.2.b, the Commission has also considered as an alternative
whether to apply the proposed 10% threshold to principal trades only,
rather than all transactions. Accordingly, the Commission considered
whether to include as an SCI entity any registered broker-dealer that,
irrespective of the size of its balance sheet, consistently trades for
its own account at a substantially high level in certain enumerated
asset classes, scaled as a percentage of total average daily dollar
volume, as reported by applicable reporting organizations. Under the
alternative, ten broker-dealer firms \841\ would have been scoped in as
``SCI broker-dealers,'' which are among the 17 ``SCI broker-dealers''
subject to the proposed Regulation SCI.
---------------------------------------------------------------------------

    \841\ The estimated ten broker-dealer firms are based on the
analysis of data which include broker-dealer FOCUS Report Form X-
17A-5 Schedule II filings from Q4 2021 to Q3 2022. Also for
additional detail on the calculation of total assets of all security
broker-dealers, see supra note 127. Data also include Consolidated
Audit Trail (CAT) data from Apr. 2022 to Sept. 2022, the plan
processors (SIPs) of the CTA/CQ Plans and Nasdaq UTP Plan. CTA Plan,
available at https://www.ctaplan.com; Nasdaq UTP Plan, available at
https://www.utpplan.com, Options Price Reporting Authority (OPRA)
data, TRACE for Treasury Securities data from Apr. 2022 to Sept.
2022, regulatory TRACE data from Apr. 2022 to Sept. 2022, and FINRA
TRACE.
---------------------------------------------------------------------------

    This alternative approach to the transaction activity threshold
would identify those broker-dealers that

generate significant liquidity in specified types of securities markets
and could also be considered a proxy for those that also engage in
substantial agency trading and other business. Because the alternative
would also scope in fewer broker-dealers as SCI entities, this
alternative would also impose fewer total costs compared to the
proposed approach.
    However, the Commission preliminarily believes that limiting the
extension of Regulation SCI to broker-dealers that engage in
significant trading activity for their own account in one or more of
the enumerated asset classes and generate significant liquidity on
which fair and orderly markets rely would fail to acknowledge the
substantial role that executing brokers acting as agents also play in
the markets. Accordingly, the alternative approach would fail to scope
within Regulation SCI some of the largest and most significant broker-
dealers that pose technological vulnerabilities and risks to the
maintenance of fair and orderly markets. In the Commission's view,
using all transaction activity rather than limiting the analysis to
principal trades is a more appropriate measure for estimating the
significance of a broker-dealer's footprint in the markets and the
effect that its sudden unavailability could have on the fair and
orderly market functioning.
    Thus, while the alternative would likely scope in fewer broker-
dealers as SCI entities, and thus reduce the aggregate costs of
extending Regulation SCI, compared to the proposal, it would also limit
the extensive benefits, discussed above, associated with applying
Regulation SCI to additional broker-dealers that play a critical role
in the market.
7. Limitation on Definition of ``SCI Systems'' for SCI Broker-Dealers
    Additionally, the Commission considered leaving the original
definition of ``SCI systems'' unrevised such that any broker-dealer
that were to only meet or exceed the trading activity threshold of 10%
for any asset class would have been subject to Regulation SCI
requirements for all of its systems, not only those systems with
respect to the type of securities for which an SCI broker-dealer
satisfies the trading activity threshold. Leaving the definition
unrevised would scope in SCI broker-dealer systems with respect to
classes of securities with a lower volume of trading, for which system
unavailability is less likely to pose a risk to the maintenance of fair
and orderly markets. This would have the effect of increasing costs for
SCI broker-dealers with limited trading activity in one or more other
cases of securities, while yielding a potential benefit in terms of
risk reduction with respect to the maintenance of fair and orderly
markets.

VI. Regulatory Flexibility Act Certification

    The Regulatory Flexibility Act (``RFA'') \842\ requires Federal
agencies, in promulgating rules, to consider the impact of those rules
on small entities. Section 603(a) \843\ of the Administrative
Procedures Act,\844\ as amended by the RFA, generally requires the
Commission to undertake a regulatory flexibility analysis of all
proposed rules, or proposed rule amendments, to determine the impact of
such rulemaking on ``small entities.'' \845\ Section 605(b) of the RFA
states that this requirement shall not apply to any proposed rule or
proposed rule amendment which, if adopted, would not have a significant
economic impact on a substantial number of small entities.\846\
---------------------------------------------------------------------------

    \842\ 5 U.S.C. 601 et seq.
    \843\ 5 U.S.C. 603(a).
    \844\ 5 U.S.C. 551 et seq.
    \845\ Although section 601(b) of the RFA defines the term
``small entity,'' the statute permits agencies to formulate their
own definitions. The Commission has adopted definitions for the term
``small entity'' for purposes of Commission rulemaking in accordance
with the RFA. Those definitions, as relevant to this proposed
rulemaking, are set forth in 17 CFR 240.0-10 (``Rule 0-10'').
    \846\ See 5 U.S.C. 605(b).
---------------------------------------------------------------------------

A. ``Small Entity'' Definitions

    For purposes of Commission rulemaking in connection with the RFA, a
small entity includes an exchange that has been exempt from the
reporting requirements of Rule 601 under Regulation NMS, and is not
affiliated with any person (other than a natural person) that is not a
small business or small organization. A small entity also includes a
broker-dealer with total capital (net worth plus subordinated
liabilities) of less than $500,000 on the date in the prior fiscal year
as of which its audited financial statements were prepared pursuant to
17 CFR 240.17a-5(d) (``Rule 17a-5(d)'' under the Exchange Act),\847\
or, if not required to file such statements, a broker-dealer with total
capital (net worth plus subordinated liabilities) of less than $500,000
on the last business day of the preceding fiscal year (or in the time
that it has been in business, if shorter); and is not affiliated with
any person (other than a natural person) that is not a small business
or small organization. Furthermore, a small entity includes a
securities information processor that: (1) had gross revenues of less
than $10 million during the preceding fiscal year (or in the time it
has been in business, if shorter); (2) provided service to fewer than
100 interrogation devices or moving tickers at all times during the
preceding fiscal year (or in the time that it has been in business, if
shorter); and (3) is not affiliated with any person (other than a
natural person) that is not a small business or small organization
under 17 CFR 240.0-10.\848\ A small entity additionally includes a
clearing agency that (1) Compared, cleared and settled less than $500
million in securities transactions during the preceding fiscal year (or
in the time that it has been in business, if shorter); (2) had less
than $200 million of funds and securities in its custody or control at
all times during the preceding fiscal year (or in the time that it has
been in business, if shorter); and (3) is not affiliated with any
person (other than a natural person) that is not a small business or
small organization as defined in 17 CFR 240.0-10.\849\
---------------------------------------------------------------------------

    \847\ 17 CFR 240.17a-5(d).
    \848\ 17 CFR 240.0-10(g).
    \849\ 17 CFR 240.0-10(d).
---------------------------------------------------------------------------

B. Current SCI Entities

    Currently, SCI entities comprise SCI SROs, SCI ATSs, plan
processors, SCI competing consolidators, and certain exempt clearing
agencies. The Commission believes that none of these entities would be
considered small entities for purposes of the RFA.
1. SCI SROs
    As discussed in section II.B.1 above, Regulation SCI currently
applies to SCI SROs, which is defined as any national securities
exchange, registered securities association, or registered clearing
agency, or the Municipal Securities Rulemaking Board; provided however,
that for purposes of 17 CFR 242.1000, the term SCI self-regulatory
organization shall not include an exchange that is notice registered
with the Commission pursuant to 15 U.S.C. 78f(g) or a limited purpose
national securities association registered with the Commission pursuant
to 15 U.S.C. 78o-3(k).\850\ Currently, there are 35 SCI SROs.
---------------------------------------------------------------------------

    \850\ See 17 CFR 242.1000.
---------------------------------------------------------------------------

    Based on the Commission's existing information about the entities
that are subject to proposed Regulation SCI, the Commission believes
that SCI SROs would not fall within the definition of ``small entity''
as described above.
    As stated, the Commission has defined a ``small entity'' as an
exchange that has been exempt from the reporting requirements of Rule
601 of Regulation NMS and is not affiliated with any

person (other than a natural person) that is not a small business or
small organization.\851\ None of the national securities exchanges
registered under section 6 of the Exchange Act that would be subject to
the proposed rule and form is a ``small entity'' for purposes of the
RFA.
---------------------------------------------------------------------------

    \851\ See paragraph (e) of Rule 0-10.
---------------------------------------------------------------------------

    There is only one national securities association (FINRA), and the
Commission has previously stated that it is not a small entity as
defined by 13 CFR 121.201.\852\
---------------------------------------------------------------------------

    \852\ See, e.g., Securities Exchange Act Release No. 62174 (May
26, 2010), 75 FR 32556, 32605 n.416 (June 8, 2010) (``FINRA is not a
small entity as defined by 13 CFR 121.201.'').
---------------------------------------------------------------------------

    As stated, a small entity includes, when used with reference to a
clearing agency, a clearing agency that: (1) compared, cleared, and
settled less than $500 million in securities transactions during the
preceding fiscal year; (2) had less than $200 million of funds and
securities in its custody or control at all times during the preceding
fiscal year (or at any time that it has been in business, if shorter);
and (3) is not affiliated with any person (other than a natural person)
that is not a small business or small organization.\853\
---------------------------------------------------------------------------

    \853\ See paragraph (d) of Rule 0-10.
---------------------------------------------------------------------------

    Based on the Commission's existing information about the clearing
agencies currently registered with the Commission, the Commission
preliminarily believes that such entities exceed the thresholds
defining ``small entities'' set out above. While other clearing
agencies may emerge and seek to register as clearing agencies, the
Commission preliminarily does not believe that any such entities would
be ``small entities'' as defined in Exchange Act Rule 0-10.
2. The MSRB
    The Commission's rules do not define ``small business'' or ``small
organization'' for purposes of entities like the MSRB. The MSRB does
not fit into one of the categories listed under the Commission rule
that provides guidelines for a defined group of entities to qualify as
a small entity for purposes of Commission rulemaking under the
RFA.\854\ The RFA in turn, refers to the Small Business Administration
(``SBA'') in providing that the term ``small business'' is defined as
having the same meaning as the term ``small business concern'' under
section 3 of the Small Business Act.\855\ The SBA provides a
comprehensive list of categories with accompanying size standards that
outline how large a business concern can be and still qualify as a