thereunder, and their own rules and governing documents, as applicable,
and the requirement for Commission notification of systems compliance
issues is intended to assist the Commission in its oversight of such
compliance. With respect to the regulatory immunity of SROs, the
Commission notes that, although courts have found that SROs are
entitled to absolute immunity from private claims under certain
circumstances,\675\ if an SRO fails to comply with the provisions of
the Exchange Act, the rules or regulations thereunder, or its own
rules, the Commission is still authorized to impose sanctions.\676\ As
such, like other SCI entities, SROs are not immune from Commission
sanctions. Finally, as discussed in detail above, the Commission does
not believe that it would be appropriate to provide a safe harbor for
all problems that are self-reported to the Commission by SCI entities
and individuals.
---------------------------------------------------------------------------

    \674\ The Commission notes that the General Instructions to Form
SCI, Item G. Paperwork Reduction Act Disclosure, provides that the
Commission ``will keep the information collected pursuant to Form
SCI confidential to the extent permitted by law.'' See infra Section
IV.C.2.
    \675\ The Commission notes that SRO immunity applies only under
certain circumstances. In particular, ``when acting in its capacity
as a SRO, [the SRO] is entitled to immunity from suit when it
engages in conduct consistent with the quasi-governmental powers
delegated to it pursuant to the Exchange Act and the regulations and
rules promulgated thereunder.'' See DL Capital Group, LLC v. NASDAQ
Stock Market, Inc., 409 F.3d 93, 97 (2d Cir. 2005) (quoting
D'Alessio v. New York Stock Exchange, Inc., 258 F.3d 93, 106 (2d
Cir. 2001)).
    \676\ See 15 U.S.C. 78s(g).
---------------------------------------------------------------------------

c. Minimum Elements of Reasonable Policies and Procedures
    The safe harbor for SCI entities in proposed Rule 1000(b)(2)(ii)
specified that, to qualify for the safe harbor, the SCI entity's
policies and procedures must be reasonably designed to provide for: (1)
Testing of all SCI systems and any changes to such systems prior to
implementation; (2) periodic testing of all SCI systems and any changes
to such systems after their implementation; (3) a system of internal
controls over changes to SCI systems; (4) ongoing monitoring of the
functionality of SCI systems to detect whether they are operating in
the manner intended; (5) assessments of SCI systems compliance
performed by personnel familiar with applicable federal securities laws
and rules and regulations thereunder and the SCI entity's rules and
governing documents, as applicable; and (6) review by regulatory
personnel of SCI systems design, changes, testing, and controls to
prevent, detect, and address actions that do not comply with applicable
federal securities laws and rules and regulations thereunder and the
SCI entity's rules and governing documents, as applicable. In the SCI
Proposal, the Commission asked whether each element of the proposed
safe harbor for SCI entities was appropriate.\677\ Several commenters
addressed one or more of the proposed safe harbor elements.
---------------------------------------------------------------------------

    \677\ See Proposing Release, supra note 13, at 18116-17.
---------------------------------------------------------------------------

    As discussed above, rather than adopting the proposed safe harbor
for SCI entities, the Commission is specifying non-exhaustive, general

minimum elements that an SCI entity must include in its systems
compliance policies and procedures. The minimum elements are based on
the proposed safe harbor. These elements are: (i) Testing of all SCI
systems and any changes to SCI systems prior to implementation; (ii) a
system of internal controls over changes to SCI systems; (iii) a plan
for assessments of the functionality of SCI systems designed to detect
systems compliance issues, including by responsible SCI personnel and
by personnel familiar with applicable provisions of the Act and the
rules and regulations thereunder and the SCI entity's rules and
governing documents; and (iv) a plan of coordination and communication
between regulatory and other personnel of the SCI entity, including by
responsible SCI personnel, regarding SCI systems design, changes,
testing, and controls designed to detect and prevent systems compliance
issues. Each of these elements is discussed below.
    As noted above, some commenters requested more guidance or
certainty regarding the safe harbor elements (e.g., by including
bright-line tests and minimum standards).\678\ As discussed above in
Section IV.B.2.b, the Commission is not adopting a safe harbor but is
specifying the minimum elements that an SCI entity must include in its
systems compliance policies and procedures. By generally requiring
policies and procedures to be reasonably designed and specifying non-
exhaustive, general minimum elements of systems compliance policies and
procedures, the Commission intends to provide specificity on how to
comply with Rule 1001(b), and at the same time provide a reasonable
degree of flexibility to SCI entities in establishing and maintaining
policies and procedures that are appropriately tailored to each SCI
entity.
---------------------------------------------------------------------------

    \678\ See supra notes 645-647 and accompanying text.
---------------------------------------------------------------------------

    Regarding elements (1) and (2) of the proposed safe harbor, a few
commenters opposed the inclusion of a requirement that an SCI entity
conduct periodic testing of systems absent systems changes.\679\ One
commenter stated that it performs testing prior to implementation of
trading systems changes in the production environment and conducts
regression testing to ensure that the changes did not introduce any
undesired side-effects.\680\ This commenter explained that the proposed
periodic testing requirement would impose additional cost and not
provide any benefit.\681\ One commenter believed that the pre- and
post-implementation testing components of the safe harbor, which would
apply to all systems changes, could potentially drive SCI entities to
take a narrow view of what constitutes a systems change.\682\ Another
commenter sought further guidance from the Commission on the scope of
periodic testing of all SCI systems and whether, for example, systems
testing would be required following a systems change if the SCI entity
has already provided notice of the systems change to the
Commission.\683\ One commenter requested clarification that the testing
described in proposed Rules 1000(b)(2)(ii)(A)(1) and (2) refers to
testing to ensure that SCI systems operate in the manner intended, and
noted that testing should not be required to be periodic, but instead
should be based on the relative risks of non-compliance arising from
any changes being introduced into production or any changes to the
applicable laws or rules.\684\ One commenter stated that it believed
that the frequency and type of testing under proposed Rules
1000(b)(2)(ii)(A)(1) and (2) are open to interpretation.\685\
---------------------------------------------------------------------------

    \679\ See FINRA Letter at 33; BATS Letter at 7; and ISE Letter
at 7.
    \680\ See ISE Letter at 7.
    \681\ See id. See also FINRA Letter at 33.
    \682\ See Direct Edge Letter at 6. This commenter expressed
concern that, under the proposed approach, any opening of a customer
port, the removal of access rights from a departing employee, and
the previously unscheduled closing of the market for the death of a
U.S. president all involve ``changes'' to SCI systems that need to
be tracked, approved, and catalogued within the construct of an
enterprise-wide change management system. See id. This commenter
stated that these ``changes'' cannot all be tested, either prior to
or after implementation, without an extraordinary amount of
redundancy and bureaucracy, if at all. See id. This commenter
therefore suggested requiring instead ``[a]ppropriate testing of
[SCI] systems and changes to such systems prior to their
implementation.'' See id.
    \683\ See OCC Letter at 11.
    \684\ See MSRB Letter at 13-14.
    \685\ See NYSE Letter at 30.
---------------------------------------------------------------------------

    After consideration of the views of commenters, the Commission
believes that testing of SCI systems and changes to such systems prior
to implementation is appropriate for inclusion as a required element of
systems compliance policies and procedures. As noted in the SCI
Proposal, elements (1) and (2) of the proposed safe harbor were
intended to help SCI entities to identify potential problems before
such problems have the ability to impact markets and investors.\686\
The Commission believes that testing prior to implementation of SCI
systems and prior to implementation of any SCI systems changes would
likely be an important component for achieving this goal and it is
included as a required element of systems compliance policies and
procedures.\687\ In contrast, the Commission believes that the value of
the proposed element for additional testing in the absence of systems
changes may be variable, depending on the SCI system or change to an
SCI system at issue.\688\ At the same time, each SCI entity should
consider on an ongoing basis what steps it needs to take in order to
ensure that its policies and procedures are reasonably designed,
including whether its policies and procedures should provide for
testing of certain systems changes after their implementation to ensure
that they operate in compliance with the Exchange Act and relevant
rules.
---------------------------------------------------------------------------

    \686\ See Proposing Release, supra note 13, at 18115.
    \687\ With respect to a commenter's concern that ``changes'' to
SCI systems could include, for example, any opening of a customer
port, the removal of access rights from a departing employee, and
the previously unscheduled closing of the market for the death of a
U.S. president, the Commission does not view these as changes to an
SCI entity's systems, because the Commission believes that these
actions are part of an SCI entity's standard operations. See supra
note 682. In particular, the Commission believes that the opening of
a customer port, the removal of access rights, and the closing of
the market are existing functionalities at SCI entities, and are
routinely performed by SCI entities without the need to change
existing functionalities.
    \688\ See supra notes 681-682 and accompanying text. The
Commission notes that a commenter asked about the scope of periodic
testing under the proposed safe harbor, and whether systems testing
under the proposed safe harbor would be required following a systems
change if the SCI entity has already provided notice of the systems
change to the Commission. Another commenter noted that testing under
the proposed safe harbor should not be required to be periodic, but
instead could be based on the relative risks of non-compliance
arising from any changes being introduced into production or any
changes to applicable laws or rules. The Commission is not requiring
periodic testing or testing following systems changes in Rule
1001(b), and, as discussed above, the Commission is not adopting the
proposed safe harbor.
---------------------------------------------------------------------------

    With regard to element (3) of the proposed safe harbor, one
commenter stated that it is unclear what minimum standards are required
for the internal controls under proposed Rule
1000(b)(2)(ii)(A)(3).\689\ As discussed above, the Commission believes
it is appropriate to set forth minimum elements of systems compliance
policies and procedures that are broad enough to provide SCI entities
with reasonable flexibility to design their policies and procedures
based on the nature, size, technology, business model, and other
aspects of their businesses. Therefore, while the Commission believes
that a system of internal controls over changes to SCI systems is
appropriate for inclusion as a required element of systems compliance
policies and

procedures, the Commission is not specifying the minimum standard for
internal controls. As stated in the SCI Proposal, a system of internal
controls and ongoing monitoring of systems functionality are intended
to help ensure that an SCI entity adopts a framework that will help it
bring newer, faster, and more innovative SCI systems online without
compromising due care, and to help prevent SCI systems from becoming
noncompliant resulting from, for example, inattention or failure to
review compliance with established written policies and procedures. The
Commission believes that such internal controls would likely include,
for example, protocols that provide for: Communication and cooperation
between legal, business, technology, and compliance departments in an
SCI entity; appropriate authorization of systems changes by relevant
departments of the SCI entity prior to implementation; review of
systems changes by legal or compliance departments prior to
implementation; and monitoring of systems changes after implementation.
---------------------------------------------------------------------------

    \689\ See NYSE Letter at 30.
---------------------------------------------------------------------------

    With regard to elements (4)-(6) of the proposed safe harbor, one
commenter noted that the proposed requirement related to ongoing
monitoring was too broad and should be eliminated or revised to be more
flexible.\690\ This commenter noted that the proposal for ``monitoring
of the functionality of [SCI] systems to detect whether they are
operating in the manner intended'' is potentially quite broad and seems
to suggest some form of independent validation.\691\ Another commenter
asked the Commission to clarify how the testing requirements in
proposed Rules 1000(b)(2)(ii)(1) and (2) (testing prior to and after
implementation) differ from those in proposed Rule 1000(b)(2)(ii)(A)(5)
(assessments of systems compliance by personnel familiar with
applicable laws and rules).\692\ One commenter noted that the
monitoring, assessments, and reviews under proposed Rules
1000(b)(2)(ii)(A)(4), (5), and (6) are unclear.\693\ Two commenters
sought guidance on how an SCI entity could satisfy the requirements
related to reviews and assessments by legal and compliance personnel
(i.e., proposed Rules 1000(b)(2)(ii)(A)(5) and (6)).\694\ One of these
commenters suggested that each SCI entity be given the discretion to
determine the level of familiarity necessary to qualify as personnel
able to undertake the assessments and which personnel are regulatory
personnel, and asked whether these two categories of personnel are
different.\695\ Another commenter also sought clarification on the
meaning of the term ``regulatory personnel'' and suggested that each
SCI entity should have discretion in determining which of its employees
constitute regulatory personnel.\696\ One commenter expressed concern
that review by regulatory personnel of SCI systems would unreasonably
expose non-technology persons to potential liability if an SCI entity
suffers a malfunction.\697\
---------------------------------------------------------------------------

    \690\ See FINRA Letter at 33-34.
    \691\ See id.
    \692\ See MSRB Letter at 13.
    \693\ See NYSE Letter at 30.
    \694\ See FINRA Letter at 34-35; and MSRB Letter at 13.
    \695\ See MSRB Letter at 13-14.
    \696\ See OCC Letter at 11. See also FINRA Letter at 34-35
(requesting more guidance on which types of personnel are intended
to fulfill the requirements of proposed Rules 1000(b)(2)(ii)(A)(5)
and (6)).
    \697\ See ITG Letter at 14.
---------------------------------------------------------------------------

    After consideration of the views of commenters, the Commission
believes that ``a plan for assessments of the functionality of SCI
systems designed to detect systems compliance issues, including by
responsible SCI personnel and by personnel familiar with applicable
provisions of the Act and the rules and regulations thereunder and the
SCI entity's rules and governing documents'' is appropriate for
inclusion as a required element of systems compliance policies and
procedures. In particular, rather than ``ongoing monitoring of the
functionality of [SCI] systems to detect whether they are operating in
the manner intended'' and also ``assessments of SCI systems compliance
. . . ,'' the Commission believes that ``a plan for assessments'' of
SCI systems compliance would be more appropriate.\698\ The Commission
notes that ``a plan for assessments'' could include, for example, not
only a plan for monitoring, but also a plan for testing or assessments,
as appropriate, and at a frequency (e.g., periodic or continuous) that
is based on the SCI entity's risk assessment of each of its SCI
systems.\699\ The Commission is not specifying the manner and frequency
of assessments that must be set forth in such plan because the
Commission believes that each SCI entity will likely be in the best
position to assess and determine the assessment plan that is most
appropriate for its SCI systems. The Commission emphasizes that the
nature and frequency of the assessments contemplated by an SCI entity's
plan will vary based on a range of factors, including the entity's
governance structure, business lines, and legal and compliance
framework. The plan for assessments does not require the SCI entity to
conduct a specific kind of assessment, nor does it require that
assessments be performed at a certain frequency. The plan, however, may
address the specific reviews required by Rule 1003(b)(1).
---------------------------------------------------------------------------

    \698\ The Commission notes that ``a plan for assessments'' is
derived from a combination of the ``ongoing monitoring'' and
``assessments'' elements of the proposed SCI entity safe harbor.
Because ``a plan for assessments'' could provide for ongoing (i.e.,
periodic or continuous) monitoring, the Commission believes that it
would be duplicative to include both monitoring and a plan for
assessments as required elements of systems compliance policies and
procedures.
    \699\ See supra note 690 and accompanying text (discussing the
view of a commenter that the proposed element of the SCI entity safe
harbor related to ongoing monitoring was too broad and should be
eliminated or revised to be more flexible) and supra note 694 and
accompanying text (discussing comments seeking guidance on how an
SCI entity could satisfy the requirements related to reviews and
assessments by legal and compliance personnel). Further, in response
to a commenter, a plan for assessments is different from the testing
of SCI systems prior to implementation of systems changes. See supra
note 692 and accompanying text.
---------------------------------------------------------------------------

    In addition, in response to a commenter's concern that the proposed
safe harbor element of ``monitoring of the functionality of [SCI]
systems to detect whether they are operating in the manner intended''
is potentially quite broad and seems to suggest some form of
independent validation, the Commission notes that it is not requiring
SCI entities to include independent validation in their assessment
plans.\700\ However, if an SCI entity determines that its reasonably
designed systems compliance policies and procedures should provide for
independent validation in its assessment plan under certain
circumstances, then the SCI entity should design its policies and
procedures accordingly. In that case, pursuant to Rule 1001(b), which
requires an SCI entity to establish, maintain, and enforce its written
policies and procedures, the SCI entity would be required to enforce
its own policies and procedures, including those related to independent
validation.
---------------------------------------------------------------------------

    \700\ See supra note 691 and accompanying text.
---------------------------------------------------------------------------

    In addition, the Commission believes that ``a plan of coordination
and communication between regulatory and other personnel of the SCI
entity, including by responsible SCI personnel, regarding SCI systems
design, changes, testing, and controls designed to detect and prevent
systems compliance issues'' is appropriate for inclusion as a required
element of systems compliance policies and procedures. As noted in the
SCI Proposal, assessments of SCI systems compliance by personnel
familiar with applicable laws and rules

and regulatory personnel review of SCI systems design, changes,
testing, and controls are intended to help foster coordination between
the information technology and regulatory staff of an SCI entity so
that SCI events and other issues related to SCI systems would be more
likely to be addressed by a team of staff in possession of the
requisite range of knowledge and skills.\701\ They are also intended to
help ensure that an SCI entity's business interests do not undermine
regulatory, surveillance, and compliance functions and, more broadly,
the requirements of the Exchange Act, during the development, testing,
implementation, and operation processes for SCI systems.\702\ The
Commission believes that a plan of coordination and communication
between regulatory and other personnel, including by responsible SCI
personnel, would further these same goals.
---------------------------------------------------------------------------

    \701\ See Proposing Release, supra note 13, at 18116.
    \702\ For example, profit incentive could lead an SCI entity to
introduce a new functionality before regulatory personnel are able
to adequately check that the functionality will operate in
compliance with relevant laws and rules.
---------------------------------------------------------------------------

    The Commission expects that an SCI entity will determine for itself
the responsible SCI personnel and other personnel who have sufficient
knowledge of relevant laws and rules to be able to effectively
implement systems assessments,\703\ such that the SCI entity's policies
and procedures are reasonably designed to ensure that SCI systems
operate in compliance with the Exchange Act and relevant rules, as
required by Rule 1001(b).\704\ Similarly, the Commission expects that
an SCI entity will determine for itself the regulatory and other
personnel, including responsible SCI personnel, who have sufficient
knowledge with respect to the legal and technical aspects of systems
design, changes, testing, and controls to engage in coordination and
communication regarding such operations, such that the SCI entity's
policies and procedures are reasonably designed to ensure that its SCI
systems operate in compliance with the Exchange Act and relevant rules,
as required by Rule 1001(b).\705\
---------------------------------------------------------------------------

    \703\ See supra notes 694-696 and accompanying text (describing
comments on the proposed safe harbor related to who would be
involved in systems assessments).
    \704\ Criteria for identification of such personnel could, for
example, be set forth in the SCI entity's systems compliance
policies and procedures.
    \705\ Some commenters expressed concern regarding the potential
liability for regulatory personnel. See supra note 697 and
accompanying text. The Commission discusses individual liability in
Section IV.B.2.d below.
---------------------------------------------------------------------------

    One commenter sought clarity on how an SCI entity would satisfy the
requirement that it does ``not have reasonable cause to believe the
policies and procedures were not being complied with.'' \706\ Another
commenter stated that there is no guidance for SCI entities on how to
appropriately follow the procedures that they have developed and stated
that as proposed, it would be reasonable to interpret the safe harbor
as excluding any SCI entity that suffers a significant systems
event.\707\ One commenter believed that the Commission should resolve
any potential ambiguity between the requirements of proposed Rule
1000(b)(2)(ii)(C)(1) (requiring SCI entities to reasonably discharge
the duties and obligations set forth in the policies and procedures)
and proposed Rule 1000(b)(2)(ii)(C)(2) (requiring that SCI entities not
have reasonable cause to believe such policies and procedures were not
being complied with).\708\ As discussed throughout this section, the
Commission is not adopting the proposed safe harbor for SCI entities.
Therefore, as adopted, Rule 1001(b) does not include the provisions of
proposed Rules 1000(b)(2)(ii)(B) and (C). Further, the Commission
believes that proposed Rules 1000(b)(2)(ii)(B) and (C) reiterated the
requirements for SCI entities to establish, maintain, and enforce their
systems compliance policies and procedures, and provided an example of
how SCI entities could satisfy these requirements. For example, the SCI
Proposal noted that proposed Rules 1000(b)(2)(ii)(B) and (C) specified
that an SCI entity's policies and procedures must be reasonably
designed to achieve SCI systems compliance, and that, as part of such
policies and procedures, the SCI entity must establish and maintain
systems for applying those policies and procedures, and enforce its
policies and procedures, in a manner that would reasonably allow it to
prevent and detect violations of the policies and procedures.\709\ The
Commission believes that Rule 1001(b), as adopted, provides flexibility
to SCI entities regarding their methods for establishing, maintaining,
and enforcing their systems compliance policies and procedures.
---------------------------------------------------------------------------

    \706\ See FINRA Letter at 35.
    \707\ See OTC Markets Letter at 15.
    \708\ See MSRB Letter at 13-15.
    \709\ See Proposing Release, supra note 13, at 18116.
---------------------------------------------------------------------------

d. Individual Safe Harbor
    Proposed Rule 1000(b)(2)(iii) set forth a safe harbor for
individuals. It provided that a person employed by an SCI entity would
be deemed not to have aided, abetted, counseled, commanded, caused,
induced, or procured the violation by any other person of proposed Rule
1000(b)(2)(i) if the person employed by the SCI entity has reasonably
discharged the duties and obligations incumbent upon such person by the
policies and procedures, and was without reasonable cause to believe
that such policies and procedures were not being complied with in any
material respect.
    In the SCI Proposal, the Commission asked whether commenters agreed
with the requirements of the proposed safe harbor for employees of SCI
entities, and whether a similar safe harbor should be available to
individuals other than employees of SCI entities.\710\ Some commenters
specifically addressed the proposed safe harbor for individuals.\711\
Several commenters urged that individuals not be subject to liability
under Regulation SCI absent an intentional act of willful
misconduct.\712\ Two commenters questioned the need for a safe harbor
for individuals generally,\713\ and one commenter stated

that inclusion of a safe harbor would unnecessarily and severely limit
the Commission's ability to deter violations through meaningful
enforcement actions.\714\ Two commenters questioned why the proposed
safe harbor for individuals was limited to SCI entity employees.\715\
One commenter expressed concern that the proposed safe harbor for
individuals could be counterproductive and create an environment of
second-guessing and distrust, where employees act in a way to avoid
potential liability (i.e., each person would be effectively deputized
to police others' actions).\716\ A few commenters added that the
proposed safe harbor for individuals, and the resulting implication of
potential individual liability, may have the unintended consequence of
limiting the ability of SCI entities to hire the best available talent
in information technology, risk-management, and compliance
disciplines.\717\ One commenter questioned why the proposed safe harbor
for individuals would apply only to actions of aiding any other person
and not apply to any actions of the reporting individual.\718\
---------------------------------------------------------------------------

    \710\ See id. at 18117, question 103.
    \711\ See, e.g., Angel Letter; Direct Edge Letter; FINRA Letter;
FSR Letter; and MSRB Letter.
    \712\ See Direct Edge Letter at 6; and MSRB Letter at 17. See
also supra notes 650 and 654 and accompanying text (discussing
comments suggesting individual safe harbors). One commenter
suggested that the safe harbor should provide that a person employed
by an SCI entity shall be deemed not to have aided, abetted,
counseled, commanded, caused, induced, or procured the violation by
any other person unless such violation directly or indirectly
relates to the duties and obligations of such person under the
policies and procedures described in Rule 1000(b)(2)(i) and such
person: (A) Has not reasonably discharged the applicable duty or
obligation under such policies and procedures; (B) was not directed
by his or her supervisor, SCI entity legal counsel, SCI senior
management, or the governing body of the SCI entity to act in a
manner that would constitute such a failure to discharge such duty
or obligation; and (C) acted recklessly or intentionally with
respect to such failure to discharge such duty or obligation. See
MSRB Letter at 17. The Commission believes that elements (A) and (B)
of this commenter's suggestion are consistent with the adopted
individual safe harbor. In particular, the Commission notes that the
safe harbor specifies that an individual must have reasonably
discharged the duties and obligations incumbent upon such person by
the SCI entity's policies and procedures. The Commission believes
that there can be instances where a person has reasonably discharged
his or her duties and obligations under the SCI entity's policies
and procedures, even though such person was directed by his or her
supervisor, SCI entity legal counsel, SCI entity senior management,
or the governing body of the SCI entity to act in a manner that is
inconsistent with his or her duties that are set forth the policies
and procedures. For example, the SCI entity's reasonably designed
policies and procedures could specifically set forth circumstances
where certain personnel of the SCI entity may direct another person
to act outside of his or her duties or obligations that are set
forth in the policies and procedures.
    \713\ See FINRA Letter at 35; and FSR Letter at 3-8 (stating
that the proposed rule lacks clarity over why individuals need a
safe harbor when the policies and procedures requirement is placed
exclusively on SCI entities, and lacks clarity regarding to whom SCI
entities or SCI personnel would be liable for a breach and how
liability would be apportioned between market participants for an
SCI event). See also MSRB Letter at 15 (seeking further
clarification from the Commission regarding the nature of the
potential liabilities faced by individuals).
    \714\ See Better Markets Letter at 6.
    \715\ See FINRA Letter at 35; and MSRB Letter at 17. These
commenters suggested extending the safe harbor to contractors,
consultants, and other non-employees used by SCI entities in
connection with their SCI systems. See FINRA Letter at 35; and MSRB
Letter at 17.
    \716\ See MSRB Letter at 15-17.
    \717\ See Direct Edge Letter at 6; and MSRB Letter at 17.
    \718\ See Angel Letter at 4.
---------------------------------------------------------------------------

    After careful consideration of these comments, the Commission is
adopting the individual safe harbor with certain modifications. With
respect to the commenter who expressed concern that a safe harbor would
``unnecessarily and severely'' limit the Commission's ability to deter
violations through meaningful enforcement actions,\719\ the Commission
notes that Regulation SCI only imposes obligations directly on SCI
entities and the Commission is not adopting a safe harbor for SCI
entities. Further, personnel of SCI entities qualify for the individual
safe harbor under Rule 1001(b) only if they satisfy certain
requirements.\720\ In particular, in connection with a Commission
finding that an SCI entity violated Rule 1001(b), the individual safe
harbor will not apply if an SCI entity personnel failed to reasonably
discharge his or her duties and obligations under the policies and
procedures. In addition, for an SCI entity personnel who is responsible
for or has supervisory responsibility over an SCI system, the
individual safe harbor also will not apply if he or she had reasonable
cause to believe that the policies and procedures related to such an
SCI system were not in compliance with Rule 1001(b) in any material
respect. Therefore, the Commission does not believe that the individual
safe harbor will ``unnecessarily and severely'' limit the Commission's
ability to deter violations.
---------------------------------------------------------------------------

    \719\ See supra note 714 and accompanying text.
    \720\ As discussed below in this section, the Commission is
extending the safe harbor to all personnel of an SCI entity, rather
than only persons employed by an SCI entity, as proposed.
---------------------------------------------------------------------------

    With respect to commenters who questioned the need for an
individual safe harbor because Rule 1001(b) imposes an obligation on
SCI entities,\721\ the Commission agrees that Regulation SCI imposes
direct obligations on SCI entities, and does not impose obligations
directly on personnel of SCI entities. At the same time, as with all
other violations of the Exchange Act and rules that impose obligations
on an entity, there is a potential for secondary liability for an
individual who aided and abetted or caused a violation. The Commission
is therefore revising the individual safe harbor to clarify that
personnel of an SCI entity shall be deemed not to have aided, abetted,
counseled, commanded, caused, induced, or procured the violation by
``an SCI entity'' (rather than ``any other person'') of Rule 1001(b) if
the elements of the safe harbor are satisfied.
---------------------------------------------------------------------------

    \721\ See supra note 713 and accompanying text.
---------------------------------------------------------------------------

    As noted above, one commenter questioned why the proposed safe
harbor for individuals would only apply to actions of aiding another
and not apply to any direct violative action of the reporting
individual.\722\ The Commission notes that the individual safe harbor
only applies to actions of aiding, abetting, counseling, commanding,
causing, inducing, or procuring the violation by an SCI entity because
Regulation SCI does not impose any direct obligations on personnel of
SCI entities. Therefore, individuals could not be found to be in
violation of Regulation SCI, except through aiding, abetting,
counseling, commanding, causing, inducing, or procuring the violation
by an SCI entity of Regulation SCI.
---------------------------------------------------------------------------

    \722\ See supra note 718 and accompanying text.
---------------------------------------------------------------------------

    With respect to commenters who suggested extending the individual
safe harbor to contractors, consultants, and other non-employees used
by SCI entities in connection with their SCI systems,\723\ the
Commission agrees with these comments and is extending the safe harbor
to all ``personnel of an SCI entity,'' rather than only persons
employed by an SCI entity, as was proposed. Specifically, the
Commission believes that contractors, consultants, and other similar
non-employees may act in a capacity similar to an SCI entity's
employees, and thus should be able to avail themselves of the
individual safe harbor if they satisfy its requirements.
---------------------------------------------------------------------------

    \723\ See supra note 715 and accompanying text.
---------------------------------------------------------------------------

    To be covered by the individual safe harbor, for which the
individual has the burden of proof, personnel of an SCI entity must:
(i) Have reasonably discharged the duties and obligations incumbent
upon such person by the SCI entity's policies and procedures; and (ii)
be without reasonable cause to believe that the policies and procedures
relating to an SCI system for which such person was responsible, or had
supervisory responsibility, were not established, maintained, or
enforced in accordance with Rule 1001(b) in any material respect.
Element (i) of the adopted individual safe harbor is substantively
unchanged from the proposal. For the reasons discussed below in this
section, element (ii) of the adopted individual safe harbor specifies
that it applies only to a person who is responsible for or has
supervisory responsibility over an SCI system. In addition, rather than
requiring an individual to be without reasonable cause to believe that
systems compliance policies and procedures ``were not being complied
with in any material respect'' as proposed, element (ii) of the adopted
safe harbor requires the applicable personnel to be without reasonable
cause to believe that the relevant systems compliance policies and
procedures ``were not established, maintained, or enforced'' in
accordance with Rule 1001(b) in any material respect. The Commission
notes that element (ii) of the adopted safe harbor tracks the language
of the general requirement under Rule 1001(b) that an SCI entity
``establish, maintain, and enforce'' written policies and procedures
reasonably designed to ensure systems compliance, and appropriately
reflects the responsibilities of a person who is responsible for or has
supervisory responsibility over an SCI system.\724\
---------------------------------------------------------------------------

    \724\ As noted below, the Commission believes it is appropriate
in the context of the safe harbor that, if a person with
responsibility over an SCI system becomes aware of potential
material non-compliance of the SCI entity's policies and procedures
related to that system, such person should take action to review and
address, or direct other personnel to review and address, such
material non-compliance.

---------------------------------------------------------------------------

    The Commission believes that it is appropriate to not provide a
safe harbor to a person with responsibility over an SCI system if such
person had reasonable cause to believe that the policies and procedures
for such system were not established, maintained, or enforced as
required by Rule 1001(b) in a material respect. The limited application
of this element to such personnel (rather than to any person employed
by an SCI entity as proposed) is intended to mitigate commenters'
concerns that the proposed safe harbor would create an environment of
distrust and limit the ability of SCI entities to hire high quality
personnel.\725\ In particular, personnel who are not responsible for
and do not have supervisory responsibility over SCI systems can qualify
for the individual safe harbor, regardless of their belief regarding
the reasonableness of the SCI entity's systems compliance policies and
procedures. Therefore, such personnel would not be ``deputized to
police'' the actions of other personnel, as a commenter believed they
would.\726\ Further, with respect to personnel who are responsible for
or have supervisory responsibility over an SCI system, such personnel
likely already have the responsibility to supervise others' activities
related to that SCI system, which would provide such personnel with
information to form a reasonable belief regarding the reasonableness of
the policies and procedures. Because Rule 1001(b) is intended to help
prevent the occurrence of systems compliance issues at SCI entities,
the Commission believes that it is appropriate for supervisory
personnel to be knowledgeable regarding the entity's policies and
procedures regarding systems compliance, which may be accomplished
through training provided by the SCI entity. Moreover, the Commission
believes it is appropriate in the context of the safe harbor that, if a
person with responsibility over an SCI system becomes aware of
potential material non-compliance of the SCI entity's policies and
procedures related to that system, such person should take action to
review and address, or direct other personnel to review and address,
such material non-compliance. Finally, to further mitigate commenters'
concern that potential individual liability may limit the hiring
ability of SCI entities,\727\ as noted above, personnel of an SCI
entity will not be deemed to have aided, abetted, counseled, commanded,
caused, induced, or procured the violation by an SCI entity of
Regulation SCI merely because the SCI entity experienced a systems
compliance issue, whether or not the person was able to take advantage
of the individual safe harbor.
---------------------------------------------------------------------------

    \725\ See supra notes 716-717 and accompanying text.
    \726\ See supra note 716 and accompanying text.
    \727\ See supra note 717 and accompanying text.
---------------------------------------------------------------------------

    As noted above, with respect to a personnel of an SCI entity who is
not responsible for and does not have supervisory responsibility over
SCI systems, the safe harbor provides that such personnel shall be
deemed not to have aided, abetted, counseled, commanded, caused,
induced, or procured the violation by an SCI entity of Rule 1001(b) if
such person has reasonably discharged the duties and obligations
incumbent upon him or her by the systems compliance policies and
procedures. Therefore, unlike personnel who are responsible for or have
supervisory responsibility over SCI systems, these persons would not be
liable even if the SCI entity itself did not have reasonably designed
systems compliance policies and procedures or did not enforce its
policies and procedures, as long as they discharged their duties and
obligations under the policies and procedures in a reasonable
manner.\728\ The Commission believes this safe harbor is appropriate
because the persons who will seek to rely on this safe harbor are those
who do not have responsibility for the establishment, maintenance, and
enforcement of the policies and procedures, or the actions of other
personnel of the SCI entity.
---------------------------------------------------------------------------

    \728\ The Commission believes that, in order for a person to
reasonably discharge his duties and obligations under the SCI
entity's policies and procedures, that person must be able to
understand his duties and obligations under such policies and
procedures, which may be accomplished through training provided by
the SCI entity.
---------------------------------------------------------------------------

    With respect to commenters who argued that individuals should not
be subject to liability under Regulation SCI absent an intentional act
of willful misconduct,\729\ the Commission notes again that Regulation
SCI imposes direct obligations only on SCI entities, and not on
individuals. However, as with all other violations of provisions of the
Exchange Act and rules that impose obligations on an entity, there is a
potential for secondary liability for an individual who aided and
abetted or caused a violation. As discussed above in the context of SCI
entities, all SCI entities are required to comply with the Exchange
Act, the rules and regulations thereunder, and their own rules and
governing documents, as applicable, and the purpose of Rule 1001(b) is
to effectively help ensure compliance of the operation of SCI systems
with the Exchange Act, the rules and regulations thereunder, and their
own rules and governing documents. The Commission does not believe that
the rule would further this goal to the same degree if the Commission
adopts commenters' suggestions for the individual safe harbor (i.e.,
personnel of an SCI entity are permitted to cause an SCI entity to be
out of compliance with Rule 1001(b) so long as the personnel did not
act intentionally or willfully).
---------------------------------------------------------------------------

    \729\ See supra note 712 and accompanying text.
---------------------------------------------------------------------------

3. SCI Events: Corrective Action; Commission Notification;
Dissemination of Information--Rule 1002
    Adopted Rule 1002, which corresponds to proposed Rules 1000(b)(3)-
(5), requires an SCI entity to take corrective action, notify the
Commission, and disseminate information regarding certain SCI events.
a. Triggering Standard
    As proposed, the obligation of an SCI entity to take corrective
action (proposed Rule 1000(b)(3)), notify the Commission (proposed Rule
1000(b)(4)), and disseminate information (proposed Rule 1000(b)(5))
would have been triggered upon ``any responsible SCI personnel becoming
aware of'' an SCI event.\730\ Proposed Rule 1000(a) defined
``responsible SCI personnel'' to mean, for a particular SCI system or
SCI security system impacted by an SCI event, any personnel, whether an
employee or agent, of an SCI entity having responsibility for such
system.\731\ In the SCI Proposal, the Commission noted that this
proposed definition was intended to include any personnel of the SCI
entity having responsibility for the specific system(s) impacted by a
given SCI event.\732\ The Commission stated that such personnel would
include any technology, business, or operations staff with
responsibility for such systems, and with respect to systems compliance
issues, any regulatory, legal, or compliance personnel with legal or
compliance responsibility for such systems.\733\ The Commission also

explained that ``responsible SCI personnel'' would not be limited to
managerial or senior-level employees of the SCI entity and could
include junior personnel with responsibility for a particular
system.\734\
---------------------------------------------------------------------------

    \730\ See proposed Rules 1000(b)(3), 1000(b)(4)(i)-(ii), and
1000(b)(5)(i)-(ii).
    \731\ See proposed Rule 1000(a) and Proposing Release, supra
note 13, at Section III.C.3.a.
    \732\ See Proposing Release, supra note 13, at 18118.
    \733\ See id.
    \734\ See id.
---------------------------------------------------------------------------

    After considering the views of commenters, the Commission is
modifying the proposed standard for triggering corrective action,
Commission notification, and dissemination of information obligations
in adopted Rule 1002, including by amending the definition of
responsible SCI personnel, as discussed below.
Responsible SCI Personnel
    Many commenters expressed concern that the proposed definition of
responsible SCI personnel was too broad.\735\ These commenters
generally urged the Commission to revise the scope of the definition to
cover only those employees in management or supervisory roles that have
responsibility over an SCI system, rather than including relatively
junior or inexperienced employees.\736\ Some of these commenters stated
that junior employees and/or technology personnel may not have the
training or breadth of knowledge or experience necessary to identify,
analyze, and determine whether a systems issue is an SCI event under
the rule.\737\ Similarly, one commenter advocated limiting responsible
SCI personnel to employees with full knowledge and authority over a
system.\738\ Some commenters also suggested that SCI entities should
have the discretion to decide which employees are responsible SCI
personnel.\739\
---------------------------------------------------------------------------

    \735\ See, e.g., Omgeo Letter at 13; MSRB Letter at 6; BATS
Letter at 8; Liquidnet Letter at 3; CME Letter at 7; OCC Letter at
12; Joint SROs Letter at 12; FINRA Letter at 25-26; and OTC Markets
Letter at 19. See also NYSE Letter at 19 (stating that the proposed
definition was too vague and suggesting an alternative approach).
See also infra note 761 and accompanying text.
    \736\ See, e.g., Omgeo Letter at 13; MSRB Letter at 6, 18; NYSE
Letter at 19; BATS Letter at 8; Liquidnet Letter at 3; CME Letter at
7; OCC Letter at 12; Joint SROs Letter at 12; FINRA Letter at 25-26;
and OTC Markets Letter at 19. Similarly, with regard to the
Commission notification requirement in proposed Rule 1000(b)(4), one
commenter stated that the obligation to notify the Commission should
only be triggered when the responsible SCI personnel notifies the
officer or senior staff responsible for the SCI system or systems
generally. See DTCC Letter at 9.
    \737\ See, e.g., OCC Letter at 12; FINRA Letter at 25-26; and
OTC Markets Letter at 19.
    \738\ See FIF Letter at 3, 5.
    \739\ See, e.g., Liquidnet Letter at 3; NYSE Letter at 19; and
Joint SROs Letter at 12.
---------------------------------------------------------------------------

    Similarly, several commenters emphasized the importance of
escalation policies and procedures, pursuant to which technology staff
or junior employees could assess a systems problem and escalate the
issue up the chain of command to management as well as legal and/or
compliance personnel, who will help determine whether a systems issue
was an SCI event and whether the obligations under Regulation SCI are
triggered.\740\ These commenters argued that the rule should allow
entities to adopt and follow such escalation procedures rather than
triggering the obligations under Regulation SCI upon one employee's
awareness of a systems issue.\741\ One commenter also asserted that
limiting the definition of responsible SCI personnel would be
appropriate if the Commission also required a robust escalation
procedure.\742\
---------------------------------------------------------------------------

    \740\ See, e.g., OCC Letter at 12; FINRA Letter at 25-26; Omgeo
Letter at 13; FIF Letter at 5; and NYSE Letter at 19-20.
    \741\ See, e.g., OCC Letter at 12; FINRA Letter at 25-26; Omgeo
Letter at 13; FIF Letter at 5; and NYSE Letter at 19-20.
    \742\ See FIF Letter at 5.
---------------------------------------------------------------------------

    Some commenters also expressed concern about the potential
liability that responsible SCI personnel could face if the rule were
adopted as proposed, given the breadth of the definition of
``responsible SCI personnel.'' \743\ Specifically, commenters asserted
that, as a result of including junior and information technology
personnel within the definition and the potential liability of such
individuals, the proposed provision would make it more difficult for
SCI entities to attract and retain high quality information technology
employees.\744\ Another commenter noted that responsible operations or
technical personnel may not be in a position to make legal
determinations about when a compliance issue has arisen.\745\
---------------------------------------------------------------------------

    \743\ See, e.g., NYSE Letter at 19; BATS Letter at 8; Joint SROs
Letter at 13; and OTC Markets Letter at 18. See also supra note 717.
    \744\ See, e.g., NYSE Letter at 19; BATS Letter at 8; Joint SROs
Letter at 13; and OTC Markets Letter at 18. These commenters
therefore recommended that the definition include only senior
personnel who would more appropriately be responsible for making a
determination as to whether an SCI event had occurred given their
knowledge and authority.
    \745\ See Omgeo Letter at 13.
---------------------------------------------------------------------------

    After consideration of the views of commenters, the Commission has
revised the term ``responsible SCI personnel'' to mean, ``for a
particular SCI system or indirect SCI system impacted by an SCI event,
such senior manager(s) of the SCI entity having responsibility for such
system, and their designee(s).'' \746\ The Commission agrees that the
proposed definition of responsible SCI personnel was broad and,
consistent with the views of some commenters, believes that it is
appropriate to instead focus the adopted definition on senior personnel
of SCI entities that have responsibility for a particular system.\747\
The Commission believes that adopting a more focused definition of
responsible SCI personnel to include only senior managers having
responsibility for a given system (and their designees) addresses
commenters' concerns that the obligations of the rule could have been
triggered upon the awareness of junior or inexperienced employees who
lack the knowledge or experience to be able to make a determination
regarding whether an SCI event had, in fact, occurred.\748\ The
Commission believes that the revised definition is a better approach
than the proposed definition because, consistent with suggestions from
some commenters, it will appropriately allow SCI entities to adopt
procedures that would require personnel of an SCI entity to escalate a
systems issue to senior individuals who are responsible for a
particular system and who have the ability and authority to
appropriately analyze and assess the issue affecting the SCI system or
indirect SCI system, and their designees, as applicable.\749\
---------------------------------------------------------------------------

    \746\ See adopted Rule 1000.
    \747\ See generally supra notes 735-738 and accompanying text.
    \748\ See supra notes 736-737. See also note 738 and
accompanying text.
    \749\ See supra Section IV.B.1.b (discussing Rule
1001(a)(1)(2)(vii), which requires an SCI entity to have policies
and procedures to provide for monitoring of SCI systems, and
indirect SCI systems, as applicable, to identify potential SCI
events, and escalate them to responsible SCI personnel); and infra
notes 758-761 and accompanying text.
---------------------------------------------------------------------------

    The Commission also notes that, consistent with some commenters'
recommendations, under the adopted rule, SCI entities will be afforded
flexibility to determine which personnel to designate as ``responsible
SCI personnel.'' \750\ Specifically, SCI entities will need to
affirmatively identify one or more senior managers that have
responsibility for each of its SCI systems or indirect SCI
systems.\751\ In addition, the Commission notes that the definition of
responsible SCI personnel affords SCI entities with the flexibility to
designate one or more other personnel as designees for a given
system.\752\ The Commission believes that it is important to include
designees within the definition of responsible SCI personnel to provide
an SCI entity with the flexibility that it may need, and

which the Commission believes is necessary, given the varying sizes,
natures, and complexities of each SCI entity. A senior manager may name
a designee (or designees) who would also have responsibility for a
given system with regard to Regulation SCI, for example, if the senior
manager is absent, is occupied with other oversight responsibilities
for a period of time, or because of other practical limitations, is
otherwise unavailable to assess the SCI entity's obligations under
Regulation SCI at a given point in time. The Commission believes it is
likely that the designation of a designee and such designee's
particular responsibilities with regard to an SCI system or indirect
SCI system would be addressed by an SCI entity's policies and
procedures, as discussed below. However, the Commission notes that
while the definition of ``responsible SCI personnel'' does not permit
the senior manager having responsibility for an applicable system to
disclaim responsibility under the rule by delegating it fully to one or
more designees (i.e., the adopted rule reads ``and their designees''
rather than ``or their designees''), it may assist SCI entities in
fulfilling their responsibilities under Regulation SCI by allowing them
to delegate to personnel other than senior managers such that those
designees can also serve in the role of responsible SCI personnel.
---------------------------------------------------------------------------

    \750\ See supra note 739 and accompanying text.
    \751\ See Rule 1001(c).
    \752\ The Commission notes that the rules do not, however,
require SCI entities to have designees. Rather, each SCI entity has
the discretion to have designees if they choose to do so.
---------------------------------------------------------------------------

    The Commission further believes that the modifications to the
definition addresses some commenters' concerns regarding the potential
liability of junior SCI personnel, as the obligations of the rule are
now triggered only when senior managers, rather than junior employees,
having responsibility for a particular system have a reasonable basis
to conclude that an SCI event has occurred.\753\ Further, the
Commission reiterates that Regulation SCI imposes direct obligations on
SCI entities and does not impose obligations directly on personnel of
SCI entities. For these reasons, the Commission believes that an SCI
entity's ability to attract and retain employees should not be
negatively affected by the requirements of Regulation SCI, as
adopted.\754\ The Commission also reiterates that the occurrence of an
SCI event may be probative, but is not determinative of whether an SCI
entity violated Regulation SCI.\755\
---------------------------------------------------------------------------

    \753\ See supra notes 743-744 and accompanying text.
    \754\ See supra notes 721 and 743-744 and accompanying text. The
Commission notes that commenters' concerns regarding potential
liability of employees were related to the scope of the proposed
definition of responsible SCI personnel and the effect on the hiring
and retention of junior and information technology personnel.
Commenters believed that the definition should instead focus on
senior managers who could appropriately be held responsible given
their responsibilities and authority to take necessary actions under
the rule.
    \755\ See, e.g., supra notes 470 and 627 and accompanying text.
---------------------------------------------------------------------------

    In light of the more focused definition of responsible SCI
personnel and consistent with commenters' suggestions,\756\ the
Commission believes it is appropriate to also adopt a policies and
procedures requirement with respect to the designation of responsible
SCI personnel and escalation procedures. As discussed above, many
commenters highlighted the importance of escalation procedures and
advocated for their use as an alternative to the adoption of a broader
definition of responsible SCI personnel.\757\ Specifically, the
Commission is adopting Rule 1001(c), which requires each SCI entity to
``[e]stablish, maintain, and enforce reasonably designed written
policies and procedures that include the criteria for identifying
responsible SCI personnel, the designation and documentation of
responsible SCI personnel, and escalation procedures to quickly inform
responsible SCI personnel of potential SCI events.'' The Commission
believes that it is important for an SCI entity's policies and
procedures to have a defined set of criteria for identifying
responsible SCI personnel so that such personnel are identified in a
consistent manner across all of an SCI entity's operations and with
regard to all of its SCI systems and indirect SCI systems. The
Commission believes that SCI entities are best suited to establish the
appropriate criteria for such a designation but notes that such
criteria could include, for example, consideration of the level of
knowledge, skills, and authority necessary to take the required actions
under the rules. The Commission also believes it is important for
policies and procedures to include the designation and documentation of
responsible SCI personnel, so that it is clear to all employees of the
SCI entity who the designated responsible SCI personnel are for
purposes of the escalation procedures and so that Commission staff can
easily identify such responsible SCI personnel in the course of its
inspections and examinations and other interactions with SCI entities.
The Commission also believes that, given the more focused definition of
responsible SCI personnel, escalation procedures to quickly inform
responsible SCI personnel of potential SCI events are necessary to help
ensure that the appropriate person(s) are provided notice of potential
SCI events so that any appropriate actions can be taken in accordance
with the requirements of Regulation SCI without unnecessary delay. Such
escalation procedures would establish the means by which, and actions
required for, escalating information regarding a systems issue that may
be an SCI event up the chain of command to the responsible SCI
personnel, who will be responsible for determining whether an SCI event
has occurred and what resulting obligations may be triggered. The
Commission notes that each SCI entity may establish escalation
procedures that conform to its needs, organization structure, and size.
By requiring that responsible SCI personnel are ``quickly inform[ed]''
of potential SCI events, the Commission intends to require that
escalation procedures emphasize promptness and ensure that responsible
SCI personnel are informed of potential SCI events without delay. At
the same time, the rule does not prescribe a specific time requirement
in order to give flexibility to SCI entities in recognition that
immediate notification may not be possible or feasible. Further,
similar to adopted Rules 1001(a) and 1001(b), Rule 1001(c) requires
that an SCI entity periodically review the effectiveness of the
policies and procedures related to responsible SCI personnel, and to
take prompt action to remedy deficiencies in such policies and
procedures.
---------------------------------------------------------------------------

    \756\ See supra notes 740-742 and accompanying text and infra
notes 759-761 and accompanying text.
    \757\ See supra notes 740-742 and accompanying text.
---------------------------------------------------------------------------

Becomes Aware
    Several commenters criticized the proposed requirement that certain
obligations under Regulation SCI be triggered when a responsible SCI
personnel ``becomes aware'' of an SCI event. Some commenters stated
that the standard was vague and lacked clarity regarding when, exactly,
responsible SCI personnel would be deemed to become aware of an SCI
event.\758\ Further, some commenters noted that the ``becomes aware''
standard emphasized immediate action over methodical escalation,
diagnosis, and resolution procedures.\759\ As noted above, several
commenters emphasized the importance of escalation policies and
procedures, and argued that the rule should allow entities to adopt and
follow such escalation procedures rather

than triggering the obligations under Regulation SCI upon one
employee's awareness of a systems issue.\760\ Another commenter
suggested specific revisions to the triggering standard so that the
phrase ``responsible SCI personnel becoming aware'' would be eliminated
entirely and replaced with ``SCI entity having a reasonable basis to
conclude,'' which it believed would allow for escalation through a
normal chain of command.\761\
---------------------------------------------------------------------------

    \758\ See, e.g., BATS Letter at 8-9; NYSE Letter at 19; and
Joint SROs Letter at 12.
    \759\ See Joint SROs Letter at 3, 9, and 12. See also OCC Letter
at 12; FINRA Letter at 25-26; Omgeo Letter at 13; FIF Letter at 5;
and NYSE Letter at 19-20.
    \760\ See supra notes 740-742 and accompanying text.
    \761\ See NYSE Letter at 19.
---------------------------------------------------------------------------

    With regard to the Commission notification requirements
specifically,\762\ one commenter suggested that SCI entities should
only be required to notify the Commission ``upon confirming the
existence of an SCI event,'' \763\ while another commenter stated that
the rule should require notification to the Commission as soon as
reasonably practicable after responsible personnel becomes aware of the
SCI event.\764\ Similarly, one commenter believed that the ``becomes
aware'' standard was problematic because it would require notification
before an SCI entity has accurate information upon which to act.\765\
---------------------------------------------------------------------------

    \762\ See infra Section IV.B.3.c (discussing the Commission
notification requirement for SCI events).
    \763\ See Direct Edge Letter at 8.
    \764\ See Omgeo Letter at 17.
    \765\ See FIF Letter at 5 (urging that notification be required
when ``accurate and actionable'' information is provided to
responsible SCI personnel). See also BATS Letter at 9.
---------------------------------------------------------------------------

    After consideration of the views of commenters, the Commission has
determined to revise the triggering standard so that SCI entities will
be required to comply with the obligations of adopted Rule 1002 upon
responsible SCI personnel having ``a reasonable basis to conclude''
that an SCI event has occurred, as suggested by a commenter.\766\ This
standard permits an SCI entity to gather relevant information and
perform an initial analysis and assessment as to whether a systems
issue may be an SCI event, rather than requiring an SCI entity to take
corrective action, notify the Commission, and/or disseminate
information about an SCI event immediately upon responsible SCI
personnel becoming aware of an SCI event.\767\ Thus, the Commission
believes that the ``reasonable basis to conclude'' standard should
provide some additional flexibility and time for judgment to determine
whether there is a ``reasonable basis to conclude'' in contrast to the
``becomes aware'' standard which many commenters noted would be
difficult to apply in practice due to the difficulty of determining
when an individual, in fact, ``becomes aware'' of an SCI event.\768\
Further, the Commission believes that, consistent with commenters'
recommendations, the revised standard, in conjunction with the revised
definition of ``responsible SCI personnel,'' will allow an SCI entity
to adopt and follow its internal escalation policies and procedures to
inform senior SCI entity personnel of systems issues, and allow
meaningful assessment of the issues by such senior management prior to
triggering obligations of the rule.\769\ At the same time, the
Commission believes that the obligations of the rule will continue to
be triggered in a timely manner because the Commission is adopting a
separate requirement in Rule 1001(c), as noted above, for escalation
procedures to quickly inform responsible SCI personnel of potential SCI
events.
---------------------------------------------------------------------------

    \766\ See adopted Rules 1002(a), (b), and (c). See also supra
note 761.
    \767\ See supra notes 759 and 763-765 and accompanying text.
Additionally, the Commission does not agree with the commenter who
stated that notification should be required only as soon as
reasonably practicable after responsible personnel become aware of
an SCI event because that standard would unnecessarily delay the
requirement for an SCI entity to take necessary actions under the
rule and the Commission's knowledge of an SCI event. See supra note
764.
    \768\ See supra note 758 and accompanying text.
    \769\ See supra notes 758-760 and accompanying text. The
Commission believes that the adopted standard similarly allows for
escalation of a systems issue to senior officials because the
Commission believes that having ``a reasonable basis to conclude''
is a good indication that an SCI event has likely occurred and does
not require that the responsible SCI personnel come to a definitive
conclusion, which would cause unnecessary delay in taking the
actions required by Regulation SCI. Rather, once responsible SCI
personnel have a reasonable basis to conclude that an SCI event has
occurred, the Commission believes that an SCI entity should begin to
take corrective action, provide notice to the Commission, and/or
disclose such event, as applicable, because these requirements are
designed to ensure that the SCI entity begins to take action in a
timely fashion to mitigate potential harm arising from the incident
and that the Commission and relevant market participants are kept
apprised of an SCI event even where a definitive conclusion is not
yet available. The Commission does not agree with the commenter that
it should apply the triggering standard only to the SCI entity
rather than responsible SCI personnel. The Commission notes, as
discussed above, that the adopted definition of responsible SCI
personnel imposes obligations only upon the senior personnel of an
SCI entity that have responsibility for a particular system.
Additionally, the Commission believes that it is important to apply
the triggering standard to responsible SCI personnel rather than to
the SCI entity because, when combined with an SCI entity's policies
and procedures with respect to the designation of responsible SCI
personnel and escalation and monitoring procedures, the triggering
standard is designed to ensure that senior managers are provided
notice of potential SCI events so that any appropriate actions can
be taken in accordance with the requirements of Regulation SCI
without unnecessary delay.
---------------------------------------------------------------------------

b. Corrective Action--Rule 1002(a)
    Proposed Rule 1000(b)(3) required an SCI entity, upon any
responsible SCI personnel becoming aware of an SCI event, to begin to
take appropriate corrective action including, at a minimum, mitigating
potential harm to investors and market integrity resulting from the SCI
event and devoting adequate resources to remedy the SCI event as soon
as reasonably practicable.\770\ The corrective action requirement is
being adopted substantially as proposed, but with the triggering
standard modified as discussed above.\771\
---------------------------------------------------------------------------

    \770\ See proposed Rule 1000(b)(3) and Proposing Release, supra
note 13, at 18117.
    \771\ See supra Section IV.B.3.a (discussing the triggering
standard).
---------------------------------------------------------------------------

    Two commenters supported the corrective action provision
generally.\772\ Several commenters stated that the proposed requirement
put too great an emphasis on immediately taking corrective action at
the expense of thoroughly analyzing the SCI event and its cause,
considering potential remedies, and/or acting in accordance with
internal policies and procedures before committing to a plan to take
corrective action.\773\ One group of commenters suggested that the rule
should make clear that ``corrective action'' should also include a
variety of other potential actions, such as communicating with
responsible parties, diagnosing the root cause, disclosing to members
and the public, and mitigating potential harm by following their
policies and procedures.\774\ Another commenter stated that, in certain
circumstances, it is ``aggressive to presume that one individual's
knowledge should prompt an immediate response by the SCI [e]ntity at
large.'' \775\ This commenter further stated that a standard requiring
an SCI entity to mitigate potential harm to investors is extremely
vague.\776\
---------------------------------------------------------------------------

    \772\ See MSRB Letter at 17 and DTCC Letter at 9-10.
    \773\ See SIFMA Letter at 3; OCC Letter at 14; Joint SROs Letter
at 11; LiquidPoint Letter at 4; DTCC Letter at 10; and Direct Edge
Letter at 7.
    \774\ See Joint SROs at 11.
    \775\ See Direct Edge Letter at 7.
    \776\ Id.
---------------------------------------------------------------------------

    As adopted, Rule 1002(a) requires an SCI entity, upon any
responsible SCI personnel having a reasonable basis to conclude that an
SCI event has occurred, to begin to take appropriate corrective action
including, at a minimum, mitigating potential harm to investors and
market integrity resulting

from the SCI event and devoting adequate resources to remedy the SCI
event as soon as reasonably practicable. The Commission continues to
believe that this provision of Regulation SCI is important to make
clear that each SCI entity has the obligation to respond to SCI events
with appropriate steps necessary to remedy the problem or problems
causing such SCI event and mitigate the negative effects of the SCI
event, if any, on market participants and the securities markets more
broadly. As discussed below, the specific steps that an SCI entity will
need to take to mitigate the harm will be dependent on the particular
systems issue, its causes, and the estimated impact of the event, among
other factors. To the extent that a systems issue affects not only the
particular users of an SCI system, but also has a more widespread
impact on the market generally, as may be likely with regard to systems
issues affecting critical SCI systems, the SCI entity will need to
consider how it might mitigate any potential harm to the overall market
to help ensure market integrity. For example, an SCI entity would need
to take steps to regain a system's ability to process transactions in
an accurate, timely, and efficient manner, or to ensure the accurate,
timely, and efficient collection, processing, and dissemination of
market data.
    As noted above, many of the comments on this requirement are
related to the standard for triggering the obligation to take
corrective action under this provision, namely ``upon any SCI
responsible personnel becoming aware of'' an SCI event. As discussed
above, the Commission has further focused the scope of the term
``responsible SCI personnel'' in response to commenters' concerns that
the term was too broad and could inappropriately capture junior and/or
inexperienced employees. Further, as discussed above, the Commission
has revised the ``becomes aware'' standard to instead trigger
obligations when responsible personnel have ``a reasonable basis to
conclude'' an SCI event has occurred. As explained above, the
Commission believes that these important modifications are responsive
to commenters' concerns that the corrective action requirement could be
triggered upon the knowledge of only one individual or a junior
employee of a systems issue without sufficient time to analyze and
assess the systems problem and follow internal escalation procedures.
Under the adopted standard, only when (i) suspected systems problems
are escalated to senior managers of the SCI entity who have
responsibility for the SCI system or indirect SCI system experiencing
an SCI event and their designees, and (ii) such personnel have ``a
reasonable basis to conclude'' that an SCI event has occurred are the
appropriate corrective actions required by Rule 1002(a) triggered.
    Further, in response to commenters who stated that the proposed
rule places too large an emphasis on immediate corrective action,\777\
in addition to the modifications noted above which are intended to
allow for appropriate time for an SCI entity to perform an initial
analysis and preliminary investigation into a potential systems issue
before the obligations under Rule 1002(a) are triggered, the Commission
notes that it does not use the term ``immediate'' in either the
proposed or adopted rules. Rather, the Commission emphasizes that the
rule requires that corrective action be taken ``as soon as reasonably
practicable'' once the triggering standard has been met. The Commission
believes that, because the facts and circumstances of each specific SCI
event will be different, this standard ensures that an SCI entity will
take necessary corrective action soon after an SCI event, but not
without sufficient time to first consider what is the appropriate
action to remedy the SCI event in a particular situation and how such
action should be implemented.
---------------------------------------------------------------------------

    \777\ See supra notes 773-775 and accompanying text.
---------------------------------------------------------------------------

    Moreover, the Commission has considered the comment that the rule
prescribe in more specificity the particular types of corrective action
that must be taken by an SCI entity and believes that it is appropriate
to adopt, as proposed, a rule that requires more generally that
``appropriate'' corrective action be taken and requires that, at a
minimum, the SCI entity take appropriate steps to mitigate potential
harm to investors and market integrity resulting from the SCI event and
devote adequate resources to remedy the SCI event. The Commission notes
that the rule is designed to afford flexibility to SCI entities in
determining how to best respond to a particular SCI event in order to
remedy the problem causing the SCI event and mitigate its effects. As a
general matter, though, the Commission agrees that such corrective
action would likely include a variety of actions, such as those
identified by one group of commenters, including determining the scope
of the SCI event and its causes, making a determination regarding its
known and anticipated impact, following adequate internal diagnosis and
resolution policies and procedures, and taking additional action to
respond as each SCI entity deems appropriate.\778\ The Commission also
notes that certain other specific types of corrective action identified
by such commenters are already required by other provisions of
Regulation SCI, such as communicating and escalating the issue to
responsible personnel and making appropriate disclosures to members or
participants regarding the SCI event.\779\
---------------------------------------------------------------------------

    \778\ See supra note 774 and accompanying text.
    \779\ See adopted Rule 1001(c) (requiring policies and
procedures that include, among other things, escalation procedures
to quickly inform responsible SCI personnel of potential SCI events)
and Rule 1002(c) (requiring dissemination of information regarding
SCI events).
---------------------------------------------------------------------------

c. Commission Notification--Rule 1002(b)
i. Proposed Rule 1000(b)(4)
    Proposed Rule 1000(b)(4) addressed the Commission notification
obligations of an SCI entity upon any responsible SCI personnel
becoming aware of an SCI event.\780\ Specifically, proposed Rule
1000(b)(4)(i) required an SCI entity, upon any responsible SCI
personnel becoming aware of a systems disruption that the SCI entity
reasonably estimated would have a material impact on its operations or
on market participants, any systems compliance issue, or any systems
intrusion (``immediate notification SCI event''), to notify the
Commission of such SCI event, which could be done orally or in writing
(e.g., by email). Proposed Rule 1000(b)(4)(ii) required an SCI entity
to submit a written notification pertaining to any SCI event to the
Commission within 24 hours of any responsible SCI personnel becoming
aware of the SCI event. Proposed Rule 1000(b)(4)(iii) required an SCI
entity to submit to the Commission continuing written updates on a
regular basis, or at such frequency as reasonably requested by a
representative of the Commission, until such time as the SCI event was
resolved.
---------------------------------------------------------------------------

    \780\ See proposed Rule 1000(b)(4) and Proposing Release, supra
note 13, at Section III.C.3.b.
---------------------------------------------------------------------------

    Proposed Rule 1000(b)(4)(iv) detailed the types of information that
was required for written notifications under proposed Rule
1000(b)(4).\781\ In

addition, proposed Rule 1000(b)(4)(iv)(C) required an SCI entity to
provide a copy of any information disseminated regarding the SCI event
to its members or participants or on the SCI entity's publicly
available Web site.
---------------------------------------------------------------------------

    \781\ Specifically, the SCI Proposal required written
notifications and updates to be made electronically and required
initial written notifications to include all pertinent information
known about an SCI event, including: (1) A detailed description of
the SCI event; (2) the SCI entity's current assessment of the types
and number of market participants potentially affected by the SCI
event; (3) the potential impact of the SCI event on the market; and
(4) the SCI entity's current assessment of the SCI event, including
a discussion of the SCI entity's determination regarding whether the
SCI event was a dissemination SCI event or not. In addition, as
proposed, to the extent available as of the time of the initial
notification, Exhibit 1 to Form SCI would have required inclusion of
the following information: (1) A description of the steps the SCI
entity was taking, or planned to take, with respect to the SCI
event; (2) the time the SCI event was resolved or timeframe within
which the SCI event was expected to be resolved; (3) a description
of the SCI entity's rule(s) and/or governing documents, as
applicable, that related to the SCI event; and (4) an analysis of
the parties that may have experienced a loss, whether monetary or
otherwise, due to the SCI event, the number of such parties, and an
estimate of the aggregate amount of such loss. See proposed Rule
1000(b)(4)(iv)(A).
---------------------------------------------------------------------------

    As described below, adopted Rule 1002(b) retains the general
framework of proposed Rule 1000(b)(4) for Commission notification of
SCI events, but makes several modifications in response to comments.
Comments Regarding Commission Notification of SCI Events
    One commenter generally supported proposed Rule 1000(b)(4), stating
that it would enhance transparency and might allow the Commission to
see patterns in small, seemingly non-material SCI events that are
worthy of attention.\782\ However, many other commenters expressed
concerns about proposed Rule 1000(b)(4).\783\ Many of these commenters
stated that the scope of proposed Rule 1000(b)(4) was too broad, and
that the notification requirement would lead to over-reporting to the
Commission.\784\ Commenters also suggested various ways to revise the
reporting requirement. For example, several commenters recommended
requiring notification to the Commission only for ``material'' or
``significant'' events.\785\ For example, one commenter recommended
reporting most SCI events as part of the annual SCI review process,
while focusing Commission notification on material SCI events.\786\
Similarly, another commenter suggested that SCI entities should only be
required to report information relating to ``impactful'' systems
disruptions in an annual report to the Commission rather than in near
real time reports.\787\ Another commenter recommended requiring
notification only for systems issues that warrant notification to an
SCI entity's subscribers or participants.\788\ Some commenters
recommended a risk-based approach under which each SCI event would be
subject to a risk-based assessment, in which the obligation to notify
the Commission would be based on the attendant risk, with only material
events requiring notification.\789\
---------------------------------------------------------------------------

    \782\ See Lauer Letter at 6. The Commission also notes that,
although many other commenters expressed reservations with proposed
Rule 1000(b)(4), many of these commenters also expressed their
general support for a notification rule that is more limited in
scope. See, e.g., ITG Letter at 12 (stating that a reduction in
notifications would result in lower costs, reduce the over-reporting
of events, and allow the Commission to focus on events that warrant
review); and FINRA Letter at 18 (``FINRA fully supports the
Commission's goal of ensuring that Commission staff is informed of
events that could potentially impact the market'').
    \783\ See, e.g. NYSE Letter at 21; BATS Letter at 12-13; ITG
Letter at 12; FINRA Letter at 16-17; Omgeo Letter at 16; SIFMA
Letter at 13; ISE Letter at 6; OCC Letter at 11; and CME Letter at
9.
    \784\ See, e.g., NYSE Letter at 22; Omgeo Letter at 16; SIFMA
Letter at 14; ISE Letter at 6; and OCC Letter at 12.
    \785\ See, e.g., ITG Letter at 12; CME Letter at 9; DTCC Letter
at 8; and Omgeo Letter at 15.
    \786\ See FIF Letter at 4.
    \787\ See BATS Letter at 10.
    \788\ See OTC Markets Letter at 19 (stating that the
notification requirement to the Commission should be aligned with
the current industry practice of notifying SCI entities' subscribers
of material events, explaining that competitive forces motivate
entities to promptly notify subscribers about significant issues).
    \789\ See, e.g., OCC Letter at 13; SIFMA Letter at 13; Omgeo
Letter at 1; FINRA Letter at 14; and NYSE Letter at 25.
---------------------------------------------------------------------------

    Commenters also identified potential problems resulting from a
notification requirement that they perceived as too broad. For example,
one commenter stated that the notification requirements have the
potential to create efficiency issues, delay system remediation, create
substantial resource demands, and create instability, which would
diminish an SCI entity's ability to be responsive to investors and
damage market efficiency.\790\ Similarly, several commenters stated
that the proposed Commission notification provision would require SCI
entities to divert resources to comply with the requirement which, in
turn, would risk delaying resolution of the SCI event that is being
reported on.\791\ Other commenters suggested that the proposed rule
would result in large volumes of data and reporting, which would
present challenges to, and burdens on, SCI entities as well as
Commission staff.\792\ One commenter also questioned the extent to
which the reported information provided by the notifications would be
useful to the Commission.\793\
---------------------------------------------------------------------------

    \790\ See UBS Letter at 3.
    \791\ See Omgeo Letter at 16; MSRB Letter at 19; and OCC Letter
at 14.
    \792\ See SunGard Letter at 5; and Joint SROs Letter at 7.
    \793\ See NYSE Letter at 22.
---------------------------------------------------------------------------

    Some commenters focused their comments on the proposal's
requirements for Commission reporting of systems intrusions and offered
alternative approaches to reporting systems intrusions. One commenter
stated that, in order to limit the number of notifications, SCI
entities should be required to investigate and keep a record of all
systems intrusions that did not cause a material disruption of service,
or that were a malicious (but unsuccessful) attempt in gaining
unauthorized access to confidential data, and make these records
available to the Commission staff if requested.\794\ Another commenter
recommended that non-material systems intrusions be recorded within the
SCI entity's records.\795\ Another commenter suggested that systems
intrusions in a development or testing environment should only be
reportable if there is a likelihood that the same issue or
vulnerabilities exist in the current production environment and cannot
be verified within a certain period, such as, for example, 24 to 48
hours.\796\ In addition, one commenter suggested that, for systems
intrusions, rather than impose the Commission notification requirement
on SCI entities, the Commission should instead require SCI entities to
establish policies and procedures reasonably designed to prevent,
detect, and respond to systems intrusions.\797\
---------------------------------------------------------------------------

    \794\ See Omgeo Letter at 12.
    \795\ See DTCC Letter at 8.
    \796\ See FINRA Letter at 11-12.
    \797\ See BATS Letter at 12. This commenter believed that the
cost of the proposed requirement would outweigh any benefits because
the proposed rule would require SCI entities to ``rapidly
investigate and report a multitude of minor incidents that regularly
occur during the normal course of business.'' Id.
---------------------------------------------------------------------------

    One commenter stated that the Commission should support the
enhancement of the Financial Services Information Sharing and Analysis
Center (``FS-ISAC'') \798\ and another commenter suggested that non-
material cyber-relevant events be provided to and disseminated through
FS-ISAC rather than the Commission.\799\ Some commenters further
suggested that certain systems intrusions should be reported to FS-
ISAC.\800\
---------------------------------------------------------------------------

    \798\ FS-ISAC is a service that gathers information from a
multitude of sources related to threat, vulnerability, and risk of
cyber and physical security and communicates timely notifications
and authoritative information specifically designed to help protect
critical systems and assets from physical and cybersecurity threats.
See FS-ISAC: Financial Services--Information Sharing and Analysis
Center, available at: www.fsisac.com.
    \799\ See BIDS Letter at 10; and Omgeo Letter at 12.
    \800\ See SIFMA Letter at 14 (recommending that systems
intrusions be reported to FS-ISAC in addition to the Commission);
and Omgeo Letter at 12 and 21 (recommending that non-material
systems intrusions be reported solely to FS-ISAC).
---------------------------------------------------------------------------

    Other commenters stated that reporting a systems compliance issue
is

reporting a legal conclusion, and that requiring an SCI entity to do so
would overburden them with extensive technical and legal analysis and
potentially expose those entities to Commission sanctions or
litigation.\801\ Several commenters expressed concerns regarding the
confidentiality of the information provided pursuant to proposed Rule
1000(b)(4), and stated that the such information should be confidential
and protected from public disclosure.\802\ One of these commenters
requested that the Commission confirm in the final rule that the
information will remain confidential.\803\
---------------------------------------------------------------------------

    \801\ See OTC Markets Letter at 16. See also NYSE Letter at 16.
    \802\ See NYSE Letter at 24; Joint SROs Letter at 12; and DTCC
Letter at 11.
    \803\ See DTCC Letter at 11.
---------------------------------------------------------------------------

    Commenters also raised other general concerns and made suggestions
with regard to proposed Rule 1000(b)(4). One commenter argued that the
proposed rules could cause SCI entities to release information before
all relevant factors are known, which could be counterproductive and
harmful.\804\ Another commenter was concerned that SCI entities would
be required to provide notification reports multiple times to different
Commission staff for the same event.\805\ Another commenter suggested
that the proposed requirement is onerous and costly and thus, to
realize benefits, the Commission, based on notifications received from
SCI entities, should provide regular summary-level feedback that
communicates the types, frequency, severity, and impact of market
incidents across all reporting entities and other related data on the
root cause of problems.\806\ Another commenter suggested that the
Commission provide examples, such as publications and reference
blueprints, which could be useful to SCI entities as they attempt to
understand the types of SCI events that warrant Commission
notification.\807\ Finally, some commenters broadly questioned the
Commission's legal authority to adopt Regulation SCI as proposed,
asserting, among other things that the Commission's proposed
notification requirement was beyond its legal authority.\808\
---------------------------------------------------------------------------

    \804\ See ITG Letter at 13.
    \805\ See NYSE Letter at 22. Another commenter suggested that
the notification requirement with respect to system disruptions
should make clear that multiple notifications are not required if a
disruption impacts multiple SCI entities. See FINRA Letter at 22.
    \806\ See BIDS Letter at 10.
    \807\ See SunGard Letter at 6.
    \808\ See NYSE Letter at 4-6; and OTC Markets at 6. See infra
notes 833-837 and accompanying text (discussing ``Commission Legal
Authority'').
---------------------------------------------------------------------------

ii. Rule 1002(b)
    After careful consideration of the comments on proposed Rule
1000(b)(4), the Commission is adopting Rule 1002(b), with several
modifications in response to comments.\809\
---------------------------------------------------------------------------

    \809\ Specific comments on proposed Rules 1000(b)(4)(i)-(iii)
that are not discussed above are discussed below in conjunction with
the Commission's response to those comments.
---------------------------------------------------------------------------

Overview
    The Commission notes that, even without the modifications the
Commission is making in adopted Rule 1002(b), the proposed Commission
notification rule would require Commission notice of fewer SCI events
than as proposed as a result of the adopted definitions of SCI systems,
indirect SCI systems, systems disruption, and systems compliance issue,
and the revised triggering standard discussed above. In addition, the
Commission has determined to refine the scope of the adopted Commission
notification requirement by incorporating a risk-based approach that
requires SCI entities, for purposes of Commission notification, to
divide SCI events into two main categories: SCI events that ``[have]
had, or the SCI entity reasonably estimates would have, no or a de
minimis impact on the SCI entity's operations or on market
participants'' (``de minimis'' SCI events); and SCI events that are not
de minimis SCI events. De minimis SCI events will not be subject to an
immediate Commission notification requirement as proposed. Instead, all
de minimis SCI events will be subject to recordkeeping requirements,
and de minimis systems disruptions and de minimis systems intrusions
will be subject to a quarterly reporting obligation, as set forth in
adopted Rule 1002(b)(5). For SCI events that are not de minimis,
Commission notification will be governed by adopted Rules 1002(a)(1)-
(4), which is substantially similar to proposed Rules 1000(b)(4)(ii)-
(iv), but relaxed in certain respects in response to comment, as
discussed below.
Effect of Revised Definitions and Revised Triggering Standard on
Commission Notification Requirement
    The Commission believes that the revisions made to a number of
definitions already focus the scope of the Commission notification
requirement in adopted Rule 1002(b) from the SCI Proposal. For example,
elimination of member regulation and member surveillance systems from
the adopted definition of SCI systems will substantially reduce the
potential number of SCI events that would be subject to Commission
notification under the proposal.\810\ Likewise, systems problems that
would otherwise meet the definition of SCI event do not meet the
definition of an SCI event if they occur in the development or testing
environment.\811\ In addition, the Commission believes that the revised
definition of ``systems disruption'' and ``systems compliance issue''
also will result in fewer systems issues being identified as SCI
events.\812\ In tandem with the revised definitions, the Commission
also believes that the revised triggering standard for notification of
SCI events, which affords an SCI entity time to evaluate whether a
potential SCI event is an actual SCI event, will also result in fewer
SCI events being subject to the requirements of Rules 1002(b)(1)-
(4).\813\ The Commission believes that these changes respond to
comments that proposed Rule 1000(b)(4) was overbroad and overly
burdensome for SCI entities.\814\
---------------------------------------------------------------------------

    \810\ See supra Section IV.A.2.b (discussing the definition of
``SCI systems'').
    \811\ See supra note 796 and accompanying text. See also supra
Section IV.A.2.b (discussing the definition of ``SCI systems'').
According to one commenter who supported excluding non-market
systems from the definition of SCI systems and the notification and
dissemination requirements, applying the reporting requirements to
non-market systems ``would significantly increase the volume of the
reports the Commission receives.'' FINRA Letter at 10. (``If the
definition of SCI systems is broadly construed to apply to non-
market regulatory and surveillance systems, approximately 111 FINRA
systems could be subject to Regulation SCI.'') FINRA Letter at 7.
    \812\ See supra Section IV.A.3 (discussing the definition of
``SCI event,'' ``systems disruption,'' and ``systems compliance
issue'').
    \813\ See supra Section IV.B.3.a (discussing the definition of
``responsible SCI personnel'') and Section IV.B.3.a (discussing the
triggering standard).
    \814\ See supra note 784 and accompanying text. See also Section
VI (discussing comments regarding the burdens associated with
proposed Rule 1000(b)(4)).
---------------------------------------------------------------------------

Exclusion of De Minimis SCI Events From Immediate Notification
Requirements: Adopted Rule 1002(b)(5)
    Adopted Rule 1002(b)(5) states that the requirements of Rules
1002(b)(1)-(4) do not apply to any SCI event that has had, or the SCI
entity reasonably estimates would have, no or a de minimis impact on
the SCI entity's operations or on market participants. For such de
minimis events, Rule 1002(b)(5) requires that an SCI entity: (i) Make,
keep, and preserve records relating to all such SCI events; and (ii)
submit to the Commission a report, within 30 calendar days after the
end of each calendar quarter, containing a summary description of such
systems

disruptions and systems intrusions, including the SCI systems and, for
systems intrusions, indirect SCI systems, affected by such systems
disruptions and systems intrusions during the applicable calendar
quarter.
    The Commission believes that this exception will result in a less
burdensome reporting framework for de minimis SCI events than for other
SCI events, and therefore responds to comment that the proposed
reporting framework was too burdensome. The Commission believes that
the quarterly reporting of de minimis systems disruptions and de
minimis systems intrusions will reduce the frequency and volume of SCI
event notices submitted to the Commission and also will allow both the
SCI entity and its personnel, as well as the Commission and its staff,
to focus their attention and resources on other, more significant SCI
events. Consistent with taking a risk-based approach in other aspects
of Regulation SCI, the Commission believes this modification from the
SCI Proposal will result in more focused Commission monitoring of SCI
events than if this aspect of the SCI Proposal was adopted without
modification. Further, by reducing the number of SCI event notices
provided to the Commission on an immediate basis as compared to the SCI
Proposal, the adopted rule should also impose lower compliance costs
and fewer burdens than if this aspect of the SCI Proposal was adopted
without modification.
    However, the Commission has determined not to incorporate a
materiality threshold as requested by some commenters,\815\ to limit
the Commission reporting requirements to those events that are
considered by SCI entities to be truly disruptive to the markets, as
suggested by other commenters,\816\ or to limit the Commission
reporting requirement only to those events that warrant notification to
an SCI entity's subscribers or participants, as suggested by still
other commenters.\817\ The Commission has made this determination
because while there may be SCI events with little apparent impact on an
SCI entity's operations or on market participants and the burden on an
SCI entity to provide immediate notice to the Commission every time
such an event occurs may not justify the benefit of providing such
notice to the Commission on an immediate basis, the Commission does not
believe that such de minimis events are irrelevant or that the
Commission should never be made aware of them. To fulfill its oversight
role, the Commission believes that the Commission and its staff should
regularly be made aware of de minimis systems disruptions and de
minimis systems intrusions and should have ready access to records
regarding de minimis systems compliance issues that SCI entities are
facing and addressing because, as the regulator of the U.S. securities
markets, it is important that the Commission and its staff have access
to information regarding all SCI events (including de minimis SCI
events) and their impact on the technology systems and systems
compliance of SCI entities, which may also provide useful insights into
learning about indications of more impactful SCI events. The Commission
has, however, determined to distinguish the timing of its receipt of
information regarding SCI events based on their impact: those SCI
events that an SCI entity reasonably estimates to have a greater impact
are subject to ``immediate'' notification upon responsible SCI
personnel having a reasonable basis to conclude that an SCI event has
occurred; and those SCI events that an SCI entity reasonably estimates
to have no or a de minimis impact are subject to recordkeeping
obligations, and for de minimis systems disruptions and de minimis
systems intrusions, a quarterly summary notification. Despite
commenters' arguments to the contrary that de minimis SCI events do not
warrant the Commission's and its staff's attention, the Commission
believes that quarterly reporting of de minimis systems disruptions and
de minimis systems intrusions and review of records regarding de
minimis systems compliance issues is beneficial to the Commission and
its staff in understanding SCI entity systems operations at the level
of the individual SCI entity, as well as across the spectrum of SCI
entities, and to monitor compliance with the Exchange Act and rules
thereunder. The Commission notes that, while it is not requiring that
de minimis systems compliance issues be submitted to the Commission in
quarterly reports, Commission staff may request records relating to
such de minimis systems compliance issues as necessary. The Commission
encourages and does not intend to inhibit an evaluation by SCI entities
of systems compliance issues, including de minimis systems compliance
issues, which may inherently involve legal analysis.
---------------------------------------------------------------------------

    \815\ See, e.g., supra note 785 and accompanying text.
    \816\ See, e.g., supra notes 785-787.
    \817\ See supra note 788.
---------------------------------------------------------------------------

    As noted, some commenters focused specifically on systems
intrusions, urging the Commission to modify or significantly reduce the
instances in which notice of systems intrusions would be required,\818\
or provide that non-material systems intrusions not be reported at all,
and only be recorded by the SCI entity.\819\ The Commission believes
that the recordkeeping and quarterly reporting requirement for de
minimis systems intrusions described in Rule 1002(b)(5) is partially
responsive to these comments, but also believes that notice of
intrusions in SCI systems and indirect SCI systems is important to
allow the Commission and its staff to detect patterns or understand
trends in the types of systems intrusions that may be occurring at
multiple SCI entities. However, as compared to what would have been
required if the SCI Proposal was adopted without modification, the
Commission expects that the exception from the immediate reporting
requirement provided for de minimis SCI events under Rule 1002(b)(5)
will result in a much lower number of systems intrusions that SCI
entities will be required to immediately report to the Commission than
commenters believed,\820\ and will achieve this result without
compromising the Commission's interest in receiving more timely
notification of impactful SCI events.
---------------------------------------------------------------------------

    \818\ See supra notes 794-797 and accompanying text.
    \819\ See supra notes 794-795 and accompanying text.
    \820\ See, e.g., supra note 794 and accompanying text
(discussing a commenter's suggestion to limit the number of
notifications by requiring recordkeeping of all systems intrusions
that did not cause a material disruption of service or that were a
malicious (but unsuccessful) attempt in gaining unauthorized access
to confidential data).
---------------------------------------------------------------------------

    In addition, some commenters suggested that certain types of
systems intrusions or non-material SCI events be reported exclusively
to FS-ISAC or to both the Commission and FS-ISAC, and some advocated
that the Commission support the enhancement of FS-ISAC.\821\ The
Commission believes that FS-ISAC, and other information sharing
services play an important role in assisting SCI entities and other
entities with respect to security issues. Consistent with views shared
by several members of the third panel at the Cybersecurity Roundtable,
to the extent SCI entities determine that such information sharing
services are useful, the Commission encourages SCI entities to
cooperate with and share information relating to information security
threats and related issues with such entities to

further enhance their utility.\822\ At the same time, for the reasons
discussed above,\823\ the Commission believes that it is important that
the Commission directly receive information regarding systems
intrusions from SCI entities, through immediate notifications or
quarterly reports, as applicable.
---------------------------------------------------------------------------

    \821\ See supra notes 799-800 and accompanying text.
    \822\ See supra notes 39-40 and accompanying text. During the
Cybersecurity Roundtable, panelists referenced other services that
they believed useful to SROs, including the Financial Services
Sector Coordinating Council for Critical Infrastructure Protection
and Homeland Security (FSSCC), the Clearing House and Exchange Forum
(CHEF), and the Worldwide Federation of Exchange's recently
established Global Exchanges Cyber Security Working Group (GLEX).
See supra note 39.
    \823\ See supra notes 904-906 and accompanying text.
---------------------------------------------------------------------------

    In response to comments that recordkeeping of non-material SCI
events would be more appropriate than reporting, the Commission
believes that quarterly reporting of de minimis systems disruptions and
de minimis systems intrusions will better achieve the goal of keeping
Commission staff informed regarding the nature and frequency of SCI
events that arise but are reasonably estimated by the SCI entity to
have a de minimis impact on the entity's operations or on market
participants. Importantly, submission and review of regular reports
will facilitate Commission staff comparisons among SCI entities and
thereby permit the Commission and its staff to have a more holistic
view of the types of systems operations challenges that were posed to
SCI entities in the aggregate.
    With regard to de minimis systems compliance issues, however, the
Commission believes the goals of Regulation SCI can be achieved through
the SCI entity's obligation to keep, and provide to representatives of
the Commission upon request, records of such de minimis systems
compliance issues. The Commission believes that systems compliance
issues generally are more specific to a particular entity's systems and
rules and less likely, as compared to systems disruptions and systems
intrusions, to raise market-wide issues that could affect several SCI
entities. Accordingly, information on such events are less likely to
provide valuable insight into trends and risks across the industry and,
therefore, the Commission believes that the benefits of receiving
quarterly reports on such de minimis systems compliance issues would be
less relative to de minimis systems disruptions and de minimis systems
intrusions. Further, the Commission notes that, based on Commission
staff's experience with notifications of compliance-related issues at
SROs, the Commission believes that SCI entities will experience a
relatively small number of systems compliance issues each year, and
thus, its regular examinations of SCI entities will provide an adequate
mechanism for reviewing and addressing de minimis systems compliance
issues affecting SCI entities. As noted above, Commission staff may
request records relating to such de minimis systems compliance issues
as necessary.
    In response to the concerns raised by one commenter that the
notification requirements have the potential to create efficiency
issues, delay system remediation, create substantial resource demands,
and create instability, the Commission believes that these concerns
have been mitigated by the numerous changes made from the proposal,
such as the adoption of a quarterly reporting framework for de minimis
systems disruptions and de minimis systems intrusions and revised
definitions of the terms SCI systems, indirect SCI systems, systems
disruption, and systems compliance issue, in addition to the reduction
in the obligations SCI entities have with respect to reporting
requirements.\824\ In addition, ARP entities today are able to
regularly notify the Commission of systems related issues, such as
systems outages, and the Commission therefore believes that the
notification requirements will not require a majority of SCI entities
to develop policies and procedures that are incongruous with their
current practice. Moreover, the Commission believes that providing SCI
entities with 30 days after the end of each quarter is adequate time
for an SCI entity to prepare its report without unduly diverting SCI
entity resources away from focusing on SCI events occurring in real
time.\825\
---------------------------------------------------------------------------

    \824\ See supra note 790.
    \825\ See supra notes 791-793 and accompanying text.
---------------------------------------------------------------------------

    The Commission believes that requiring SCI entities to report de
minimis systems disruptions and de minimis systems intrusions quarterly
balances the interest of SCI entities in having a limited reporting
burden for such types of events with the Commission's interest in
oversight of the information technology programs and systems compliance
of SCI entities.\826\ Similarly, the Commission believes that requiring
recordkeeping of de minimis systems compliance issues allows the
Commission to adequately monitor compliance with the Exchange Act and
rules thereunder, while reducing the burdens on SCI entities with
regard to providing information to the Commission on such de minimis
systems compliance issues. Accordingly, the Commission has determined
to exclude certain SCI events from the immediate Commission reporting
requirements, subject to certain recordkeeping and reporting
requirement for such events, as applicable.\827\
---------------------------------------------------------------------------

    \826\ The Commission notes an SCI entity should be prepared for
the possibility that Commission staff may, whether upon request
pursuant to Rule 1002(b)(3), Rule 1005(b)(3), or Rule 1007 or during
an examination of its compliance with Regulation SCI, include a
review of the entity's classification of SCI events as de minimis
SCI events under Rule 1002(b).
    \827\ While the facts and circumstances surrounding a particular
SCI event will ultimately determine the severity of a given event,
including whether the event is reasonably estimated to be a de
minimis event, a wide range of factors may be relevant to an SCI
entity in making such a determination. For example, such factors
could include, but are not limited to: whether critical SCI systems
are impacted; the duration of the SCI event; whether there is a loss
of redundancy (that negatively impacts, for example, a source of
power, telecommunications, or other key service); whether an
alternate trading system is available following a trading system
disruption; the size of the affected market trading volume; whether
the processes for trade completion or clearance and settlement are
adversely impacted; whether settlement is completed on time; whether
an event is resolved prior to the market's open; whether a post-
trade event is resolved before the market closes; whether a
failover, despite being successful, results in a given system
operating without a backup; and the number of securities symbols
that are adversely affected.
---------------------------------------------------------------------------

    As described above, the de minimis exception from the immediate
Commission notification requirements applies to systems compliance
issues as well as systems disruptions and systems intrusions. The
Commission believes that this approach strikes a balance that will help
focus the Commission's and SCI entities' resources on those systems
compliance issues with more significant impacts. Even if an SCI entity
determines that the impact of the systems compliance issue is none or
negligible, however, the Commission believes that it should have ready
access to records regarding such systems compliance issues, and notes
that Rule 1002 requires that an SCI entity take corrective action with
respect to all SCI events, including de minimis systems compliance
issues.\828\
---------------------------------------------------------------------------

    \828\ See infra note 829 and accompanying text.
---------------------------------------------------------------------------

    The Commission recognizes that in many cases, the discovery of a
potential systems compliance issue may be of a different nature than
the discovery of potential systems disruptions or systems intrusions,
as the latter types of events often have an immediately apparent and
negative impact on the operations of a given system of the SCI entity.
In contrast, in many instances, a systems compliance issue may require
the involvement of various personnel

(potentially including compliance and/or legal personnel) and a period
of time may be required to afford such personnel the chance to perform
a preliminary legal analysis to analyze whether a systems compliance
issue had, in fact, occurred. Because Rule 1002(b)(1) only requires
notification to the Commission when responsible SCI personnel have a
``reasonable basis to conclude'' that a non-de minimis SCI event has
occurred, the Commission believes it is appropriate for an SCI entity
to notify the Commission of a non-de minimis systems compliance issue
after it has conducted such a preliminary legal analysis, unless the
nature of the issue makes it readily identifiable as a systems
compliance issue.\829\ Further, if an SCI entity determines that a
systems compliance issue is de minimis, such event will not be required
to be reported immediately to the Commission, but rather the SCI entity
will be required to keep, and provide to representatives of the
Commission upon request, records of such de minimis systems compliance
issue. Thus, the Commission believes that, as adopted, the requirements
with respect to systems compliance issues are reasonable because SCI
entities are afforded flexibility to assess and understand potential
SCI events and are not required to notify the Commission prior to
forming a reasonable basis to conclude that an SCI event has occurred.
The Commissions also believes that, as part of its oversight of the
securities markets, it should have access to information regarding de
minimis systems compliance issues when requested. And, although some
commenters expressed concern that a systems compliance issue is a legal
conclusion that requires time to analyze and could possibly expose the
entity to liability if reported,\830\ as discussed above, the
Commission believes these concerns will be mitigated by the revised
triggering standard for the obligations in Rule 1002.\831\ However,
while commenters are correct that the occurrence of a systems
compliance issue may expose an SCI entity to liability,\832\ the
occurrence of an SCI event will not necessarily cause a violation of
Regulation SCI. Further, the occurrence of a systems compliance issue
also does not necessarily mean that the SCI entity will be subject to
an enforcement action. Rather, the Commission will exercise its
discretion to initiate an enforcement action if the Commission
determines that action is warranted, based on the particular facts and
circumstances of an individual situation.
---------------------------------------------------------------------------

    \829\ At the same time, the Commission cautions SCI entities
against unnecessarily delaying Commission notifications of SCI
events, including systems compliance issues. The Commission notes
that the notification requirement is triggered when responsible SCI
personnel have a reasonable basis to conclude that an SCI event has
occurred and not, for example, when responsible SCI personnel have
definitively concluded that an SCI event has occurred. As discussed
above, the Commission does not believe it is appropriate for an SCI
entity to delay notifying its regulator of a systems compliance
issue once the SCI entity has a reasonable basis to conclude there
is one. See supra note 828 and accompanying text.
    \830\ See OTC Markets Letter at 16; and NYSE Letter at 16.
    \831\ See supra Section IV.B.3.a (discussing the triggering
standard).
    \832\ If an SRO fails to, among other things, comply with the
provisions of the Exchange Act, the rules or regulations thereunder,
or its own rules, the Commission is authorized to impose sanctions.
See 15 U.S.C. 78s(g).
---------------------------------------------------------------------------

Commission Legal Authority
    As noted above, some commenters broadly questioned the Commission's
legal authority to adopt certain provisions of Regulation SCI as
proposed, including those relating to Commission notification of SCI
events, as well as Commission notification of material systems
changes.\833\ Section 11A(a)(2) of the Exchange Act directs the
Commission, having due regard for the public interest, the protection
of investors, and the maintenance of fair and orderly markets, to use
its authority under the Exchange Act to facilitate the establishment of
a national market system for securities in accordance with the
Congressional findings and objectives set forth in Section 11A(a)(1) of
the Exchange Act. Among the findings and objectives in Section
11A(a)(1) is that ``[n]ew data processing and communications techniques
create the opportunity for more efficient and effective market
operations'' and ``[i]t is in the public interest and appropriate for
the protection of investors and the maintenance of fair and orderly
markets to assure . . . the economically efficient execution of
securities transactions.'' In addition, Sections 6(b), 15A, and
17A(b)(3) of the Exchange Act impose obligations on national securities
exchanges, national securities associations, and clearing agencies,
respectively, to be ``so organized'' and ``[have] the capacity to . . .
carry out the purposes of [the Exchange Act].''
---------------------------------------------------------------------------

    \833\ See supra note 808 and accompanying text. See infra note
1268 (noting comments relating to the Commission's legal authority
for the proposed access provision, which the Commission has
determined not to adopt in its final rules because the Commission
can adequately assess an SCI entity's compliance with Regulation SCI
through existing recordkeeping requirements and examination
authority, as well as through the new recordkeeping requirement in
Rule 1005 of Regulation SCI).
---------------------------------------------------------------------------

    Consistent with this statutory authority, the Commission is
adopting Regulation SCI to require, among other things, that SCI
entities: (1) Provide certain notices and reports to the Commission to
improve Commission oversight of securities market infrastructure; and
(2) have comprehensive policies and procedures in place to help ensure
the robustness and resiliency of their technological systems, and also
that their technological systems operate in compliance with the
Exchange Act, rules thereunder, and with their own rules and governing
documents. These requirements are important to furthering the
directives in Section 11A(a)(2) of the Exchange Act that the
Commission, having due regard for the public interest, the protection
of investors, and the maintenance of fair and orderly markets,
facilitate the establishment of a national market system for securities
in accordance with the Congressional findings and objectives set forth
in Section 11A(a)(1) of the Exchange Act, including the economically
efficient execution of securities transactions.
    As discussed in Section I, the U.S. securities markets have been
transformed in recent years by technological advancements that have
enhanced the speed, capacity, efficiency, and sophistication of the
trading functions that are available to market participants. Central to
these technological advancements have been changes in the automated
systems that route and execute orders, disseminate quotes, clear and
settle trades, and transmit market data. At the same time, however,
these technological advances have generated an increasing risk of
operational problems with automated systems, including failures,
disruptions, delays, and intrusions. Accordingly, in today's securities
markets, properly functioning technology is central to the maintenance
of fair and orderly markets, the national market system, and the
efficient and effective market operations and the execution of
securities transactions. While the Commission's ARP Inspection Program
has been active in this area, the Commission has not adopted rules
specific to these matters. The Commission believes that the adoption of
Regulation SCI, with the modifications from the SCI Proposal as
discussed above, and compliance with the regulation by SCI entities,
will further the goals of the national market system. It will help to
ensure the capacity, integrity, resiliency, availability, and security
of the automated systems of entities important

to the functioning of the U.S. securities markets, as well as reinforce
the requirement that such systems operate in compliance with the
Exchange Act and rules and regulations thereunder, thus strengthening
the infrastructure of the U.S. securities markets and improving its
resilience when technological issues arise. In addition, Regulation SCI
establishes an updated and formalized regulatory framework, thereby
helping to ensure more effective Commission oversight of these systems
whose proper functioning is central to the maintenance of fair and
orderly markets and for the continued operation of the national market
system. For these reasons, the Commission disagrees with the comments
questioning the Commission's legal authority to adopt Regulation SCI.
    More specifically, the Commission disagrees with comment regarding
its legal authority under Rule 1002(b) related to Commission
notification of SCI events. As discussed above, having immediate notice
and continuing updates of non-de minimis SCI events, quarterly reports
related to de minimis systems disruptions and de minimis systems
intrusions, and recordkeeping requirements for de minimis SCI events,
directly enables the Commission to have more effective oversight of the
systems whose proper functioning is central to the maintenance of fair
and orderly markets and for the continued operation of the national
market system. In this respect, Rule 1002(b) is integral to furthering
the statutory purposes of Section 11A of the Act under which the
Commission is directed to act. Moreover, the Commission underscores
that the adopted Commission notification provisions would require
immediate Commission notice of fewer SCI events than as proposed
because the adopted definitions of SCI systems, indirect SCI systems,
systems disruption, and systems compliance issue have been refined from
the proposal, and de minimis SCI events are not subject to immediate
notice.