time, the Participants will require that the CAT's security program
align with current industry standards and best practices as they evolve
in the future.\1089\ To this end, the Plan requires that the Plan
Processor's information security program be reviewed at least annually
by the Operating Committee.\1090\
---------------------------------------------------------------------------

    \1088\ Response Letter III at 5.
    \1089\ Id.
    \1090\ Id.
---------------------------------------------------------------------------

    Regarding security standards applicable to the Participants that
access

CAT Data, the Participants noted that the Plan requires the
Participants to ``establish, maintain and enforce written policies and
procedures reasonably designed . . . to ensure the confidentiality of
the CAT Data obtained from the Central Repository.'' \1091\ The
Participants stated that ``such policies and procedures will be subject
to Reg SCI and oversight by the SEC.'' \1092\ Moreover, in their
response, the Participants stated that ``[i]n the event that relevant
standards evolve, the proposed Plan also requires that ``[e]ach
Participant shall periodically review the effectiveness of the policies
and procedures . . . and take prompt action to remedy deficiencies in
such policies and procedures.'' \1093\
---------------------------------------------------------------------------

    \1091\ Response Letter III at 8.
    \1092\ Id.
    \1093\ Response Letter III at 8.
---------------------------------------------------------------------------

    In response to the commenters that believed that an ongoing
assessment of the risks associated with the CAT System and data should
meet the NIST standards in the Plan, the Participants stated that they
agree that the CAT System should be regularly assessed for security
risks,\1094\ and that the Operating Committee must conduct an annual
review of the Plan Processor's information security program.\1095\ The
Participants further noted that Section 6.2(a)(v)(C) of the Plan
provides that the CCO, in collaboration with the CISO, will retain
independent third parties with appropriate data security expertise to
review and audit on an annual basis the policies, procedures, standards
and real-time tools that monitor and address data security issues for
the Plan Processor and the Central Repository.\1096\
---------------------------------------------------------------------------

    \1094\ Response Letter I at 61.
    \1095\ Response Letter III at 5.
    \1096\ Response Letter I at 61.
---------------------------------------------------------------------------

    In response to the commenter that believed that the Plan Processor
should be FedRAMP certified, the Participants stated that they do not
believe that the Plan Processor should be required to be certified
FedRAMP.\1097\ The Participants stated that requiring FedRAMP
certification could limit the portions of each cloud provider's
solutions that each Bidder may access, while also increasing costs for
the CAT. The Participants stated that furthermore, FedRAMP
certification itself does not provide for additional security controls
beyond those contained in the NIST standards, but rather focuses on
providing a certification and evaluation process for government
applications.\1098\ Moreover, the Participants believe that the
security controls required in the Plan and proposed by the Bidders, as
well as those provided by the Bidders' cloud providers, are robust and
would not be materially enhanced by requiring them to be FedRAMP
certified.\1099\ The Participants also pointed out that regular
independent third party audits, as required by the Plan, also would
help to ensure the security of the CAT and any cloud solutions in
use.\1100\
---------------------------------------------------------------------------

    \1097\ Response Letter III at 5.
    \1098\ Response Letter III at 5.
    \1099\ Response Letter III at 5-6.
    \1100\ Id.
---------------------------------------------------------------------------

    The Commission notes that Appendix D of the Plan addresses the
security standards applicable to the CAT System. Specifically, Section
4.2 of Appendix D of the CAT NMS Plan, as proposed, states that ``[t]he
following industry standards, at a minimum, must be followed as such
standards and requirements may be replaced by successor publications,
or modified, amended, or supplemented and as approved by the Operating
Committee (in the event of a conflict between standards, the more
stringent standard shall apply, subject to the approval of the
Operating Committee).'' \1101\ The Plan then lists several NIST
standards (e.g., NIST 800), FFIEC's ``Authentication Best Practices,''
and ISO/IEC 27001's ``Information Security Management. Appendix D,
Section 4.2, as proposed, also states that the CAT LLC shall join the
Financial Services-Information Sharing and Analysis Center (``FS-
ISAC'') and comparable bodies as the Operating Committee may determine.
---------------------------------------------------------------------------

    \1101\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.2.
---------------------------------------------------------------------------

    Moreover, in the Commission's view, the Participants' commitment in
their response that, at the outset of the operation of CAT, the Plan
Processor will adhere to the relevant standards from the NIST Cyber
Security Framework is a reasonable step toward ensuring a robust
security information program. At this time, the Commission believes
that the NIST Cyber Security Framework provides a reliable and
comprehensive approach to cybersecurity risks and threats, and helps to
ensure that the Plan Processor will be abiding by appropriately
rigorous industry standards to help identify, protect, detect, respond
and recover from cyberattacks, whether internal or external, domestic
or international. Accordingly, the Commission is amending Appendix D,
Section 4.2 of the CAT NMS Plan to add the requirement that Plan
Processor will adhere to the NIST Cyber Security Framework in its
entirety.\1102\ The Commission believes that adherence to the standards
of the NIST Cyber Security Framework provides a reasonable approach to
ensuring that security standards applicable to the CAT System will
reflect high industry standards regarding the protection of CAT Data.
---------------------------------------------------------------------------

    \1102\ The Commission notes that, in contrast to the
Participants' response, the Commission is amending the Plan without
limitation to only ``relevant standards'' because the Commission
believes that the NIST Cyber Security Framework already provides
flexibility to ensure only relevant standards apply, and without
specific reference to NIST 800-53 or ISO 27001. The Commission also
is amending Appendix D, Section 4.2 of the Plan to clarify that the
listed industry standards are not intended to be an exclusive list.
The Commission believes this amendment is appropriate to clarify
that the Participants may adhere to additional industry standards.
---------------------------------------------------------------------------

    In light of the Participants' commitment and ongoing requirement to
adhere to the NIST Cyber Security Framework--which will address the
security of the CAT cloud provided by the Plan Processor--and the
limitations that FedRAMP certification might impose on the cloud
provider's solutions that each bidder might access should the bidder be
chosen as the Plan Processor, the Commission believes that it is
reasonable to not require that the Plan Processor be FedRAMP certified.
In addition, the Commission believes that it is reasonable to allow the
Plan Processor to evaluate whether it should adhere to the data
security and privacy standards like Regulation P, FISMA and ISO 2002,
and whether the connection to the CAT infrastructure should be
protected by TLS/SSL.
    The Commission also notes that in their response, the Participants
stated that with respect to partnerships with other private or public
organizations and information sharing entities, the Participants do not
intend to restrict the CAT LLC's partnership only to the FS-ISAC; the
Participants stated that the CAT LLC may seek to join other industry
groups such as the National Cyber-Forensic & Training Alliance, the
Department of Homeland Security's National Cybersecurity &
Communications Integration Center, or other reputable cyber and
information security alliances.\1103\ The Commission believes the
Participants have appropriately clarified that the provisions in
Appendix D, Section 4.2 of the Plan listing the other organizations
that the CAT LLC may join was not intended to be an exclusive list
because the provision explicitly states that the CAT LLC shall endeavor

to join other ``comparable bodies as the Operating Committee may
determine.''
---------------------------------------------------------------------------

    \1103\ Response Letter III at 6-7.
---------------------------------------------------------------------------

c. CAT User Access Administration
    Many commenters discussed issues related to the administration of
CAT users. One commenter stated that ``[a]ppropriate policies and
procedures should be in place for user access administration, including
provisioning of administrators, user data management, password
management and audit of user access management.'' \1104\ Another
commenter noted the need to train employees and contractors with access
to CAT Data on how to maintain the security and confidentiality of the
data,\1105\ while another commenter supported the establishment of
processes to prevent access to sensitive data by any individuals who
have not attended compliance training.\1106\ One commenter stated that
persons authorized to access CAT Data should have comprehensive
background checks.\1107\
---------------------------------------------------------------------------

    \1104\ SIFMA Letter at 21.
    \1105\ ICI Letter at 9.
    \1106\ UnaVista Letter at 4.
    \1107\ FSR Letter at 5; FSI Letter at 5.
---------------------------------------------------------------------------

    Other commenters discussed the password authentication procedures
in the CAT NMS Plan that are meant to ensure that CAT Data is only
accessed by credentialed personnel. One commenter stated that all
persons with access to the CAT System should have their access secured
via multi-factor authentication as prescribed in OMB Memorandum M-06-
16.\1108\ Another commenter suggested leveraging any authentication
procedures at the entity that employs a person seeking access to CAT
Data, stating that this approach would also allow for automated
deactivation of users that leave the CAT Reporter or Participant.\1109\
---------------------------------------------------------------------------

    \1108\ MFA Letter at 6.
    \1109\ SIFMA Letter at 21. This commenter also generally
recommended automatic deactivation for users who do not access CAT
for a specified period of time (e.g., 6 months), or whose access is
not re-confirmed by the entity who employs the person requesting CAT
Data, or whose firm account has been deactivated. Additionally, the
commenter stated that email addresses for CAT users should be
immutable and should allow for change via administrative review
workflow, and shared user IDs should be prohibited. Id.
---------------------------------------------------------------------------

    In its response to commenters, the Participants noted the
provisions in Appendix D of the Plan that require the Plan Processor to
develop and maintain policies and procedures reasonably designed to
prevent, detect and mitigate the impact of unauthorized access or usage
of data in the Central Repository.\1110\ The Participants further noted
that the Plan requires that such policies and procedures include, at a
minimum, (1) information barriers governing access to and usage of data
in the Central Repository; (2) monitoring processes to detect
unauthorized access to or usage of data in the Central Repository; and
(3) escalation procedures in the event that unauthorized access to or
usage of data is detected.\1111\ The Participants also note that the
Plan requires that passwords be stored according to industry best
practices and recovered by secure channels, and that all logins will be
subject to MFA.\1112\ The Participants further note that the Plan
Processor will have discretion to consider additional controls on user
access in formulating the data security policies and procedures for the
CAT System, including, without limitation, deactivating users who have
not accessed the CAT System for a specified period of time.\1113\
---------------------------------------------------------------------------

    \1110\ Response Letter I at 55-56.
    \1111\ Id.
    \1112\ The Commission notes that certain provisions of the Plan
appeared to require MFA only for access to PII. The Participants
clarified in their response letter that MFA is required for all
logins. Response Letter III at 6.
    \1113\ Response Letter I at 56.
---------------------------------------------------------------------------

    The Commission believes that monitoring the access to CAT to ensure
that only authorized persons are allowed to access the CAT System and
CAT Data is critical to ensuring the security of CAT Data. The
Commission agrees with the Participants that the requirements set out
in Appendix D, and other provisions of the CAT NMS Plan, provide a
reasonable outline of CAT user access administration (including
provisioning of administrators) in general, as well as user data
management and password management.\1114\
---------------------------------------------------------------------------

    \1114\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.4 (discussing an overview of access to CAT Data).
---------------------------------------------------------------------------

    In response to specific commenters that believed that only
individuals with appropriate training should be permitted access to CAT
Data, Section 6.1(m) of the Plan states that ``[t]he Plan Processor
shall develop and, with the prior approval of the Operating Committee,
implement a training program, which will be made available to all
individuals who have access to the Central Repository on behalf of the
Participants or the SEC prior to such individuals being granted access
to the Central Repository, that addresses the security and
confidentiality of all information accessible from the CAT, as well as
the operational risks associated with accessing the Central
Repository.'' \1115\ Appendix D of the Plan also states that the Plan
Processor must provide to the Operating Committee a comprehensive
security plan that covers all components of the CAT System, including
physical assets and personnel, and the training of all persons who have
access to the Central Repository consistent with Article VI, Section
6.1(m).\1116\ Thus, the Commission believes that these Plan provisions,
taken together, indicate that the Plan Processor will require that all
persons that have access to CAT Data will be required to complete
training prior to accessing CAT Data, and expects that only those
persons that have been adequately trained will have access to CAT Data.
---------------------------------------------------------------------------

    \1115\ See CAT NMS Plan, supra note 5, at Section 6.1(m).
    \1116\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.
---------------------------------------------------------------------------

    In response to the commenter that stated that persons authorized to
access CAT Data should have comprehensive background checks, the
Commission notes that the Plan provides that ``in addition to other
policies, procedures and standards generally applicable to the Plan
Processor's employees and contractors, the Plan Processor shall have
hiring standards and shall conduct and enforce background checks (e.g.,
fingerprint-based) for all of its employees and contractors to ensure
the protection, safeguarding and security of the facilities, systems,
networks, equipment and data of the CAT System. . . .'' \1117\ While
the Commission believes that this provision sets out a reasonable
approach to background checks for employees and contractors of the Plan
Processor, the Commission believes that such a requirement generally
should extend to Participants with respect to all of their users that
have access to CAT Data and therefore is amending the Plan to require
that each Participant conduct background checks for its employees and
contractors that will use the CAT System.\1118\ The Commission believes
that this amendment to the Plan is appropriate in order to ensure that
only authorized and qualified persons are using the CAT System.
---------------------------------------------------------------------------

    \1117\ See CAT NMS Plan, supra note 5, at Section 6.1(g).
    \1118\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.4.
---------------------------------------------------------------------------

    The Commission also notes that the Participants have represented
that all logins must be secured by MFA, in response to commenters
concerns that authentication procedures for CAT users should ensure
that only credentialed persons are accessing the CAT Data. In addition,
in response to commenters that expressed concerns about the password
authentication procedures of the Plan Processor, the Commission

notes that the Plan addresses password guidelines such as, for example,
the appropriate complexity of passwords and the recovery of lost
passwords.\1119\ The Commission also believes that the Plan does not
prohibit the Plan Processor from considering an approach to
authenticating a CAT user that would leverage the authentication
procedures at the entity (either a Participant or CAT Reporter) that
employs a person seeking access to CAT Data, as suggested by a
commenter. The Commission believes these provisions, taken together,
provide reasonable protections around CAT user administration.
---------------------------------------------------------------------------

    \1119\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.4 (discussing an overview of the CAT password requirements).
---------------------------------------------------------------------------

    Finally, with respect to another aspect of CAT user access
administration, in their response the Participants noted that they do
not believe that memoranda of understanding or similar agreements
between the CAT LLC and the Participants are necessary since the
Participants will be bound by both their participation in the Plan as
well as the agreement between the CAT LLC and the Plan Processor.\1120\
However, the Participants stated they believe that it is important that
information regarding CAT Data usage, such as contact points and
escalation procedures, be shared between the Plan Processor and the
Participants; therefore, the Participants state they expect to
establish such information sharing agreements between the Plan
Processor and the Participants once the Plan Processor is chosen.
Moreover, the Participants stated, they expect that one of the CISO's
responsibilities would be to make sure that this information is
captured and kept up to date appropriately.\1121\
---------------------------------------------------------------------------

    \1120\ Response Letter III at 8.
    \1121\ Response Letter III at 9.
---------------------------------------------------------------------------

    The Commission notes that the Plan Processor has not yet been
chosen and thus the execution of such memoranda is not appropriate at
this time. However, the Commission believes that explicitly
memorializing issues relating to CAT Data usage between the Plan
Processor and each Participant would be beneficial to the operation of
the CAT System.
    The Commission also notes that, with respect to access, the CAT NMS
Plan provides that the Plan Processor will provide to the Participants
and the Commission access to the Representatives of the Plan Processor
as any Participant or the Commission may reasonably request solely for
the purpose of performing such Person's regulatory and oversight
responsibilities pursuant to the federal securities laws, rules, and
regulations or any contractual obligations.\1122\ The Plan also
provides that the Plan Processor will direct its Representatives to
reasonably cooperate with any inquiry, investigation, or proceeding
conducted by or on behalf of any Participant or the Commission related
to such purpose.\1123\ As filed, this provision would allow the Plan
Processor to refuse access to the Commission and/or Participants upon
its own determination of ``unreasonableness.'' The Commission believes
that Commission or Participant requests for access to Representatives
of the Plan Processor should be considered reasonable, absent other
circumstances. It is therefore amending the Plan to delete the
requirement that the access to Plan Processor Representatives be
``reasonable'' and that the Representatives of the Plan Processor only
be required to ``reasonably'' cooperate with any inquiry,
investigation, or proceeding conducted by or on behalf of the
Commission. The Commission expects that, even without the
``reasonableness'' qualifier, it and the Participants will be
reasonable in requesting access to the Representatives of the Plan
Processor.
---------------------------------------------------------------------------

    \1122\ See CAT NMS Plan, supra note 5, at Section 6.1(u).
    \1123\ Id.
---------------------------------------------------------------------------

d. Downloading CAT Data By Regulators
    Several commenters discussed the security risks associated with the
downloading of CAT Data by regulators. One commenter argued that CAT
Data should never be extracted, removed, duplicated, or copied from the
CAT, noting that such practices would introduce additional risk and
render even the most advanced security measures ineffective.\1124\
Instead, this commenter recommended allowing data to be imported into a
CAT query sub-system if surveillance is needed in conjunction with
external data.\1125\ Another commenter similarly noted the security
risk associated with extracting data from the Central Repository and
stated its preference for an approach ``where the data is accessible by
the Regulators but the data is not extracted and stored outside the
Central Repository, except for extraction of `comparable' data that
would facilitate exemption from duplicative reporting and retirement of
high priority duplicative systems.'' \1126\ This commenter added ``if
combined datasets surveillance is needed (with data external to CAT),
the SROs should be allowed to upload external SRO data to a sandbox
environment within CAT, in order to enable combined surveillance.''
\1127\
---------------------------------------------------------------------------

    \1124\ SIFMA Letter at 20; see also Data Boiler Letter at 26
(stating ``CAT should under ABSOLUTELY NO CIRCUMSTANCE (including
BCP/DR) allow anyone the option of to download the `entire' data
sets, because this essentially opens a `backdoor' to significant
security risk.'').
    \1125\ SIFMA Letter at 20.
    \1126\ FIF Letter at 134.
    \1127\ Id.
---------------------------------------------------------------------------

    Another commenter stated that the CAT NMS Plan's provision
permitting the Commission and SROs to download entire data sets and
analyze the data within the regulator's systems or the regulator's
cloud, and the Plan's proposal to allow broker-dealers to ``verify
certain data that they have submitted to the CAT,'' represent security
risks to CAT Data that the SEC and SROs should avoid.\1128\ This
commenter further noted that having multiple points of access to CAT
Data, and the ability to download CAT Data, raise ``significant
cybersecurity concerns and outweigh the benefit of access to processed
CAT [D]ata.'' \1129\ Another commenter believed that CAT Data should
remain in the Central Repository, but noted that if the Commission
determines to permit the downloading of CAT Data, the CAT NMS Plan
should only allow a user to download CAT Data if the information
security measures available at the user's site equal or exceed those
protecting the data at the Central Repository.\1130\
---------------------------------------------------------------------------

    \1128\ Fidelity Letter at 4.
    \1129\ Id.
    \1130\ ICI Letter at 7.
---------------------------------------------------------------------------

    In response to commenters, the Participants noted that Rule 613
requires regulators to develop and implement a surveillance system, or
enhance existing surveillance systems to make use of CAT Data.\1131\
The Participants stated that regulators should have flexibility in
designing such surveillance systems, including the ability to access
and transfer data where necessary and consistent with appropriate data
security safeguards.\1132\ Such access must be via secure channels
(e.g., secure FTP, API or over encrypted lines) as required in the
Plan.\1133\ The Participants further noted that the Plan requires that
Participants have appropriate policies and procedures in place to
protect such data.\1134\ Specifically, the Plan requires that
Participants establish, maintain and enforce written policies and
procedures reasonably designed to ensure the

confidentiality of CAT Data.\1135\ The Participants also stated that
they believed that all regulators, including the Commission, should be
obligated to establish security measures to protect the security and
confidentiality of CAT Data for security purposes.\1136\
---------------------------------------------------------------------------

    \1131\ Response Letter I at 56.
    \1132\ Id.
    \1133\ Id.
    \1134\ Id.
    \1135\ Id. (citing to CAT NMS Plan, supra note 5, at Section
6.5(f)(iv)).
    \1136\ Id.
---------------------------------------------------------------------------

    The Participants also noted that the CAT NMS Plan requires the Plan
Processor to provide regulators with the ability to perform bulk data
extraction and download of CAT Data.\1137\ The Participants stated they
continue to believe that permitting regulators to download order/
transaction data from the Central Repository for regulatory use (i.e.,
``bulk data extracts'') is important for their regulatory purposes, and
that eliminating or limiting bulk data extracts of the CAT Data may
significantly and adversely impact the Participants' ability to
effectively conduct surveillance of their markets using CAT Data. The
Participants stated that they also plan to enrich their existing
surveillance using bulk data extracts of CAT Data.\1138\
---------------------------------------------------------------------------

    \1137\ Response Letter III at 10 (citing to Appendix D, Section
8.2 (providing that ``the Central Repository must provide for direct
queries, bulk extraction, and download of Data for all regulatory
users.'')).
    \1138\ Response Letter III at 11.
---------------------------------------------------------------------------

    Regarding the security of extracted CAT Data, the Participants
stated that they ``recognize the security concerns raised by bulk data
extracts and any Participant-controlled systems (e.g., Participant
sandboxes residing in the Plan Processor's cloud or a Participant's
local system) used to store and analyze such data extracts, but the
Participants believe that requiring the Participants to adopt and
enforce policies and procedures to address these security issues
appropriately addresses these concerns without diminishing the
surveillance benefits of the CAT.'' \1139\ The Participants noted that
the Plan requires the Participants to ``establish, maintain and enforce
written policies and procedures reasonably designed . . . to ensure the
confidentiality of the CAT Data obtained from the Central Repository.''
\1140\ Accordingly, the Participants stated that Participants must have
policies and procedures reasonably designed to ensure the
confidentiality of CAT Data obtained through bulk data extracts and
maintained in the Participants' systems.\1141\ In their response, the
Participants stated that their own security controls, not those of the
Plan Processor, would apply to such systems as they would be outside
the Plan Processor's control.\1142\ The Participants' represented that
their security controls would be consistent with industry standards,
including security protocols that are compliant with Regulation SCI,
and the Participants would periodically review the effectiveness of
such controls pursuant to their policies and procedures addressing data
security.\1143\
---------------------------------------------------------------------------

    \1139\ Id.
    \1140\ Id.
    \1141\ Id.
    \1142\ Id.
    \1143\ Id.
---------------------------------------------------------------------------

    Regarding the Participants' security controls, the Participants
stated that the CISO would be obligated to escalate issues that could
represent a security threat to CAT Data.\1144\ For example, the
Participants stated that if the CISO observes activity from a CAT
Reporter or Participant that suggests that there may be a security
threat to the Plan Processor or the Central Repository, then the CISO,
in consultation with the CCO, may escalate the matter to the Operating
Committee.\1145\ The Participants stated, however, that they do not
envision, that ``such policy enforcement [by the CISO] would involve a
regulatory enforcement role with regard to the Participants.'' \1146\
The Participants further stated that ``[t]he Plan does not give the
CISO the authority to engage in such regulatory enforcement.\1147\
Moreover, although the Plan permits the Operating Committee to impose
fees for late or inaccurate reporting of information to the CAT, it
does not authorize the Participants to oversee, or serve enforcement
actions against, each other via the Plan Processor. Only the SEC has
such authority under the Securities Exchange Act of 1934.'' \1148\
---------------------------------------------------------------------------

    \1144\ Response Letter III at 7. Notwithstanding the foregoing
example, the Participants noted that the details regarding such an
escalation policy will not be determined until the Plan Processor
has been selected.
    \1145\ Id.
    \1146\ Response Letter III at 8.
    \1147\ Id.
    \1148\ Id.
---------------------------------------------------------------------------

    The Commission believes that ensuring the security and
confidentiality of CAT Data is of utmost importance, and also notes the
Participants' recognition that regulators should have flexibility in
designing such surveillance systems, including the ability to access
and transfer data where necessary and consistent with appropriate data
security safeguards. As described above, the Plan Processor has the
specific responsibility to develop and implement policies, procedures
and control structures related to the security of the CAT System.\1149\
The Plan Processor also is responsible for the security and
confidentiality of all CAT Data received and reported to the Central
Repository, including during all communications between CAT Reporters
and the Plan Processor, data extraction, data manipulation and
transformation, loading to and from the Central Repository, and data
maintenance and storage by the Central Repository.\1150\ The Plan
Processor also must require the establishment of secure controls for
data retrieval and query reports for CAT Data reported to and stored in
the Central Repository.\1151\
---------------------------------------------------------------------------

    \1149\ See CAT NMS Plan, supra note 5, at Section 6.1(c).
    \1150\ See id. at Section 6.5(f)(i), (iv).
    \1151\ See id. at Section 6.5(f)(iv).
---------------------------------------------------------------------------

    While the Plan Processor is responsible for the security of the CAT
Data collected by and stored in the Central Repository, the Commission
agrees with commenters that once CAT Data is extracted into a
Participant's regulatory surveillance system, the Plan Processor can no
longer assure the security of the CAT Data because the details,
requirements and rigor of the policies and procedures regarding the
security of CAT Data at each Participant are beyond the direct control
of the Plan Processor. This is the case whether the CAT Data is
downloaded to a Participant's local server, or downloaded into a
dedicated sandbox within the CAT cloud--and whether the CAT Data that
is downloaded is a subset of all the CAT Data collected by the Central
Repository, or the entirety of the CAT Data (i.e., cloning the entire
CAT database).
    Therefore, the Commission believes that if a Participant chooses to
extract CAT Data, whether into its own local server environment or into
its own sandbox within the CAT cloud, the Participant must have
policies and procedures regarding CAT Data security that are comparable
to those implemented and maintained by the Plan Processor for the
Central Repository, and that each Participant must certify and provide
evidence to the CISO that its policies and procedures for the security
of CAT Data meet the same security standards applicable to the CAT Data
that is reported to, and collected and stored by, the Central
Repository. Given the necessity of ensuring the security of CAT Data
that is collected by and stored in the Central Repository, the
Commission believes that this is a reasonable requirement that will
ensure that CAT Data is subject to the same standards of security,
whether the CAT Data is downloaded by

a Participant onto the Participant's local servers, or downloaded into
the Participant's sandbox within the CAT cloud,\1152\ and therefore, is
amending the plan accordingly.\1153\
---------------------------------------------------------------------------

    \1152\ The Commission also notes that each Participant must
comply with Regulation SCI. Response Letter III at 8.
    \1153\ See CAT NMS Plan, supra note 5 at Section 6.2(b)(vii).
---------------------------------------------------------------------------

    The Commission believes that it is critical to the security of the
CAT Data to assign responsibility to the CISO to review the data
security policies and procedures of Participants that extract CAT Data
into their own systems, whether on a local server or within a sandbox
within the CAT cloud, to determine whether such policies and procedures
are comparable to the data security policies and procedures applicable
to the Central Repository. The Commission further believes that if the
CISO, in consultation with the CCO, finds that any such information
security policies and procedures of a Participant are not comparable to
the policies and procedures applicable to the CAT System, and the issue
is not promptly addressed by the applicable Participant, the CISO, in
consultation with the CCO, will be required to provide notice of any
such deficiency to the Operating Committee.\1154\
---------------------------------------------------------------------------

    \1154\ See id.
---------------------------------------------------------------------------

e. Use of CAT Data for Regulatory and Surveillance Purposes
    One commenter stated that access to CAT Data should be restricted
to Commission and SRO Staff with regulatory and oversight
responsibilities.\1155\ Another commenter stated that the proposed
model and timeframe for regulatory access to the reported data is
consistent with the Commission's broader regulatory objectives.\1156\
Another commenter noted that access should not be granted to the
academic community.\1157\ On the other hand, one commenter believed
that aggregated CAT Data should be made available to the public on a
limited or time-delayed basis, so as to enable more creative approaches
to market surveillance, foster industry collaboration, and augment
regulatory efforts.\1158\
---------------------------------------------------------------------------

    \1155\ Fidelity Letter at 4.
    \1156\ UnaVista Letter at 4.
    \1157\ MFA Letter at 6.
    \1158\ Data Boiler Letter at 14.
---------------------------------------------------------------------------

    The Participants stated that they do not plan to make CAT Data
available for use by the public (or academics or other third parties)
at this time.\1159\ The Participants noted that there may be certain
benefits to this type of expanded access, such as promoting academic
evaluations of the economic costs and benefits of regulatory
policy.\1160\ Nevertheless, the Participants believed that the privacy
and security concerns raised by such public access would outweigh the
potential benefits.\1161\ The Participants stated that this conclusion
is ``in line with the SEC's statements in the adopting release for SEC
Rule 613 that, in light of the privacy and security concerns, `it is
premature to require that the NMS plan require the provision of data to
third parties.' '' \1162\
---------------------------------------------------------------------------

    \1159\ Response Letter I at 44-45.
    \1160\ Id. at 45.
    \1161\ Id.
    \1162\ Id.
---------------------------------------------------------------------------

    The Commission agrees with the Participants and believes that it is
reasonable to continue to limit access to CAT Data to regulatory
authorities for regulatory and surveillance use.\1163\ As previously
noted, the CAT is designed to be a regulatory tool. While the
Commission recognizes that there may be benefits to expanding the
distribution of CAT Data, the Commission also believes that limiting
the use of CAT Data for regulatory and surveillance purposes is
reasonable at this time, given the vast scope of the CAT Data and need
to ensure the security and confidentiality of the CAT Data.\1164\
---------------------------------------------------------------------------

    \1163\ Such purposes include, among other things, analysis and
reconstruction of market events, market analysis and research to
inform policy decisions, market surveillance, examinations,
investigations, and other enforcement functions. See supra note 586.
    \1164\ This limitation on the use of CAT Data for regulatory and
surveillance purposes does not restrict the ability of a Participant
from using the Raw Data that it reports for commercial or other
purposes. See Section IV.D.6.k, infra.
---------------------------------------------------------------------------

    Although not raised by commenters, the Commission emphasizes that
under the Plan the CCO must develop and implement a notification and
escalation process to resolve and remediate any alleged non-compliance
with the rules of the CAT by a Participant or Industry Member, which
shall include appropriate notification and order of escalation to a
Participant, the Operating Committee, or the Commission.\1165\ The
Commission expects that any additional escalation procedures outlined
by the CCO, once the CCO is selected, will adhere to this process.
---------------------------------------------------------------------------

    \1165\ See CAT NMS Plan, supra note 5, at Section 6.2(a)(v)(L).
---------------------------------------------------------------------------

f. Regulation SCI
    Several commenters discussed the applicability of Regulation SCI to
the Central Repository.\1166\ One commenter stated that because the CAT
is an ``SCI System'' and an SCI System of each of the SROs, all
obligations associated with Regulation SCI must be complied with by the
SROs to ensure the security and integrity of the CAT.\1167\ One
commenter stated that Industry Members are not subject to Regulation
SCI and the CAT NMS Plan should ``make clear that Regulation SCI would
not be expanded to apply to an Industry Members [sic] by virtue of its
reporting requirements under the CAT Plan.'' \1168\ Another commenter
stated that because the CAT NMS Plan provides that the Plan Processor
must be compliant with Regulation SCI requirements, compliance with
Regulation SCI requirements should be ``an explicit evaluation
criterion as part of the selection process for the CAT Processor.''
\1169\
---------------------------------------------------------------------------

    \1166\ See CAT NMS Plan, supra note 5, at Section 6.9(b)(xi).
    \1167\ SIFMA Letter at 21-22; see also MFA Letter at 4.
    \1168\ FSR Letter at 6. This commenter also noted that the Plan
Processor should ensure access to the PII complies with Regulation
SCI and any other applicable federal and state privacy laws. Id.
    \1169\ SIFMA Letter at 45.
---------------------------------------------------------------------------

    The Participants noted that the Plan Processor will need to satisfy
all applicable regulations involving database security, including
Regulation SCI, and the Participants have discussed with the Bidders
their responsibilities under Regulation SCI on numerous
occasions.\1170\ They added they do not believe that it is appropriate
that the Plan provide details on how the Plan Processor will ensure
that the Central Repository will comply with Regulation SCI.\1171\
---------------------------------------------------------------------------

    \1170\ Response Letter I at 58.
    \1171\ Id.
---------------------------------------------------------------------------

    The Central Repository, as a facility of each of the Participant
SROs, is an SCI Entity \1172\ and the CAT System is an SCI system, and
thus it must comply with Regulation SCI.\1173\ The CAT NMS Plan states
that data security standards of the CAT System shall, at a minimum,
satisfy all applicable regulations regarding database security,
including provisions of Regulation SCI.\1174\ The Plan Processor thus
must establish, maintain and enforce written policies and procedures
reasonably designed to ensure that the CAT System has levels of
capacity, integrity, resiliency,

availability, and security adequate to maintain its operational
capability to comply with Regulation SCI.
---------------------------------------------------------------------------

    \1172\ An ``SCI Entity'' means an SCI self-regulatory
organization, SCI alternative trading system, plan processor, or
exempt clearing agency subject to the Commission's Automated Review
Program (``ARP''). 17 CFR 242.1000.
    \1173\ An ``SCI System'' means all computer network, electronic,
technical, or automated, or similar systems of, or operated by or on
behalf of, an SCI entity that, with respect to securities, directly
support trading, clearance and settlement, order routing, market
data, market regulation, or market surveillance. 17 CFR 242.1000.
    \1174\ See CAT NMS Plan, supra note 5, at Section 6.9(b)(xi).
---------------------------------------------------------------------------

    According to Regulation SCI, the policies and procedures must
require: (i) The establishment of reasonable current and future
technology infrastructure capacity planning estimates; (ii) periodic
capacity stress tests of such systems to determine their ability to
process transactions in an accurate, timely, and efficient manner;
(iii) a program to review and keep current systems development and
testing methodology for such systems; (iv) regular reviews and testing,
as applicable, of such systems, including backup systems, to identify
vulnerabilities pertaining to internal and external threats, physical
hazards, and natural or manmade disasters; (v) business continuity and
disaster recovery plans that include maintaining backup and recovery
capabilities sufficiently resilient and geographically diverse and that
are reasonably designed to achieve next business day resumption of
trading and two-hour resumption of critical SCI systems following a
wide-scale disruption; (vi) standards that result in such systems being
designed, developed, tested, maintained, operated, and surveilled in a
manner that facilitates the successful collection, processing, and
dissemination of market data; and (vii) monitoring of such systems to
identify potential SCI events.\1175\ Compliance with Regulation SCI
will also require the Plan Processor to periodically review the
effectiveness of the policies and procedures and take prompt action to
remedy deficiencies in such policies and procedures.\1176\
---------------------------------------------------------------------------

    \1175\ 17 CFR 242.1001(a)(2). ``SCI event'' means an event at an
SCI entity that constitutes: (1) A systems disruption; (2) a systems
compliance issue; or (3) a systems intrusion. 17 CFR 242.1000.
    \1176\ 17 CFR 242.1001(a)(3).
---------------------------------------------------------------------------

    For purposes of compliance with Regulation SCI, the Commission has
stated that an SCI entity's policies and procedures shall be deemed to
be reasonably designed if they are consistent with current SCI industry
standards, which are required to be comprised of information technology
practices that are widely available to information technology
professionals in the financial sector and issued by an authoritative
body that is a U.S. governmental entity or agency, association of U.S.
governmental entities or agencies, or widely recognized organization,
although compliance with current SCI industry standards is not the
exclusive means to comply with the requirements of Regulation
SCI.\1177\ To assist SCI entities in developing policies and procedures
consistent with ``current SCI industry standards,'' Staff of the
Commission issued Staff Guidance which lists examples of publications
describing processes, guidelines, frameworks, or standards that an SCI
entity could look to in developing reasonable policies and procedures
to comply with Regulation SCI.\1178\ The standards under the Staff
Guidance address nine subject areas, including application control;
capacity planning; computer operations and production environment
controls; contingency planning; information security and networking;
audit; outsourcing; physical security; and systems development
methodology.\1179\
---------------------------------------------------------------------------

    \1177\ 17 CFR 242.1001(a)(4).
    \1178\ See Staff Guidance on Current SCI Standards, issued on
November 19, 2014, available at https://www.sec.gov/rules/final/2014/staff-guidance-current-sci-industry-standards.pdf.
    \1179\ Id.
---------------------------------------------------------------------------

    The Commission believes that compliance with Regulation SCI will
help to reduce the occurrence of systems issues; improve the resiliency
of the technological infrastructure when systems problems do occur; and
enhance the Commission's oversight of the Central Repository. In
response to a concern by a commenter about the potential of the Plan to
expand the scope of Regulation SCI, the Commission clarifies that
Industry Members will not be subject to Regulation SCI by virtue of
reporting audit trail data to the Central Repository. In addition, in
response to the commenter that stated that the Participants should use
compliance with Regulation SCI as an explicit evaluation criterion as
part of the selection process for the CAT Processor, the Commission
expects that the Participants will evaluate a Bidder's ability to
comply with Regulation SCI as part of its Bidder evaluation process, as
compliance with Regulation SCI is an explicit criteria of the CAT NMS
Plan.
g. Physical Security of CAT Systems
    The CAT NMS Plan requires the Plan Processor to provide a solution
addressing physical security controls for corporate, data center and
any leased facilities where any CAT Data is transmitted or
stored.\1180\ One commenter stated that the data centers housing the
CAT System must, at a minimum, be SOC 2 certified with such
certification annually attested to by a qualified third-party auditor
that is not affiliated with the SROs or the Plan Processor.\1181\ The
Participants stated that they intended for data centers housing the CAT
System to be AICPA SOC 2 certified.\1182\ In addition, the Participants
recommended that the auditor provision should be amended to require a
qualified third-party auditor that is not an affiliate of any of the
Participants or the Plan Processor.\1183\
---------------------------------------------------------------------------

    \1180\ See CAT NMS Plan, supra note 5, at Appendix C, Section
A.4(a).
    \1181\ SIFMA Letter at 21.
    \1182\ Response Letter I at 58.
    \1183\ Id. at 58-59.
---------------------------------------------------------------------------

    The Commission believes that assuring the physical security of the
data centers that house the CAT Data, including PII Data, is a critical
component of the overall security program and the Commission believes
that the Participants' recommendation to amend the standards applicable
to ensure the physical security of the CAT System to reflect that it
will be AICPA SOC 2 certified and audited by a qualified third-party
auditor that is not an affiliate of any Participant or the Plan
Processor is reasonable. The Commission therefore is amending the Plan
accordingly.\1184\
---------------------------------------------------------------------------

    \1184\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.3.
---------------------------------------------------------------------------

h. Encryption of CAT Data
    Commenters discussed the CAT NMS Plan's provisions regarding
encryption of CAT Data, including CAT Data that is PII. One commenter
stated that the CAT NMS Plan's data encryption requirements alone were
not sufficient to protect CAT Data at-rest and PII, and that many more
detailed and technical issues must be considered for the encryption
requirements for the CAT System and CAT Data to be sufficient.\1185\
The commenter also recommended that the CAT Plan require data to be
encrypted both at-rest and in-flight, and that particularly sensitive
pieces of data be isolated and compartmentalized.\1186\ Another
commenter highlighted specific standards for in-transit data (e.g.,
asymmetric encryptions and transport layer security), data at-rest
(e.g., NIST Special Publication 800-57), and data in-use (e.g.,
implementing data protection controls such as disclosing intended use
and duration).\1187\
---------------------------------------------------------------------------

    \1185\ MFA Letter at 8.
    \1186\ Id.; see also SIFMA Letter at 20-21 (stating that ``[t]he
CAT Processor should employ strong, evolving encryption and
decryption standards that are continuously updated to meet the most
stringent data encryption requirements possible'').
    \1187\ FSR Letter at 5-6; see also FIF Letter at 125 (suggesting
that if given the option WORM (write once, read man) technology may
be convenient and cost effective).
---------------------------------------------------------------------------

    One commenter requested that Section 4.1.2 of Appendix D of the
Plan, which addresses the encryption of CAT Data, be amended to make
clear that the monitoring, alerting, auditing, and any other
requirements that apply with

respect to CAT Data also apply to archival CAT Data.\1188\ Another
commenter opined that the encryption and decryption standards used by
the Plan Processor should be continuously updated to meet the most
stringent data encryption requirements possible, and designed to
support end-to-end data encryption, with data decrypted at the desktop
level.\1189\
---------------------------------------------------------------------------

    \1188\ MFA Letter at 8.
    \1189\ SIFMA Letter at 20-21.
---------------------------------------------------------------------------

    Commenters also focused on the particular necessity of encrypting
PII, both when in-transit and at-rest, to ensure it remains secure and
confidential.\1190\ One commenter noted the CAT NMS Plan's requirement
that CAT Data provided to regulators that contains PII be ``masked,''
\1191\ and stated that PII should be masked unless users have
permission to view the PII contained in the CAT Data that has been
requested,\1192\ while another commenter believed that clarification is
needed regarding the meaning of ``masked'' under the CAT NMS
Plan.\1193\
---------------------------------------------------------------------------

    \1190\ FSR Letter at 5; MFA Letter at 8 (also stating that
``[s]trong encryption should be at the heart of the CAT NMS Plan's
efforts to protect data'').
    \1191\ FSR Letter at 4; see also CAT NMS Plan, supra note 5, at
Section 6.10(c)(ii).
    \1192\ Id.
    \1193\ FIF Letter at 135.
---------------------------------------------------------------------------

    The Participants stated that ``given that all three remaining
bidders propose cloud based solutions, all data will be encrypted in-
flight and at-rest.'' \1194\
---------------------------------------------------------------------------

    \1194\ Response Letter III at 5. The Commission notes that as
filed, the CAT NMS Plan had stated that all CAT Data must be
encrypted in-flight using industry best practices, and that PII must
be encrypted both at-rest and in-flight; storage of unencrypted PII
is not permissible; and non-PII CAT Data stored in a Plan Processor
private environment is not required to be encrypted at-rest. See CAT
NMS Plan, supra note 5, at Appendix D, Section 4.1.2; see also
Response Letter I at 57.
---------------------------------------------------------------------------

    The Commission notes that the CAT NMS Plan requires the Plan
Processor to describe how PII encryption is performed and the key
management strategy. The CAT NMS Plan also requires that PII encryption
methods include a secure documented key management strategy such as the
use of HSM(s).
    The Commission agrees with commenters that encryption of CAT Data
is a necessary and critically important means of protecting CAT Data,
including PII. Therefore, given the role that encryption plays in
maintaining the security of CAT Data, the Commission believes that all
CAT Data must be encrypted and is amending the Plan accordingly.\1195\
---------------------------------------------------------------------------

    \1195\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.2.
---------------------------------------------------------------------------

    In response to the commenter that believed that encryption alone
was not sufficient to protect CAT Data at-rest and PII, the Commission
notes that the CAT NMS Plan provides several means of protecting CAT
Data in addition to encryption, including provisions addressing
connectivity and data transfer requirements, parameters for the storage
of CAT Data in general, and PII in particular, and limitations on
access to CAT Data by authorized users only. In addition, the Plan
states that the Technical Specifications, which will be published one
year before Industry Members must report CAT Data to the Central
Repository, will include more details about the data security for
CAT.\1196\ Thus, in response to the commenter that believed that more
detailed and technical issues must be considered for the encryption
requirements for the CAT System and CAT Data to be sufficient, the
Commission believes that preparation and publication of the Technical
Specifications referenced above commits the Participants to undertaking
an analysis of security requirements, in addition to and as a
supplement to, the existing encryption requirements. With respect to
the issues raised by the commenter regarding the specific standards for
in-transit data (including asymmetric encryptions and transport layer
security), data at-rest (e.g., NIST Special Publication 800-57), and
data in-use (e.g., implementing data protection controls such as
disclosing intended use and duration), the Commission notes that, as
amended by the Commission, the Plan requires the Participants to adhere
to all relevant standards in the NIST Cyber Security Framework, which
includes standards regarding encryption.\1197\
---------------------------------------------------------------------------

    \1196\ Id. at Section 6.9(b)(xi).
    \1197\ Response Letter III at 8.
---------------------------------------------------------------------------

    In response to the commenter that stated that encryption and
decryption standards used by the Plan Processor should be continuously
updated to meet the most stringent data encryption requirements
possible, the Commission notes that the CAT NMS Plan provides that all
CAT Data must be encrypted in-flight and at-rest using industry
standard best practices, and that such industry standards may be
replaced by successor publications, or modified, amended, or
supplemented as approved by the Operating Committee.\1198\
---------------------------------------------------------------------------

    \1198\ See CAT NMS Plan, supra note 5, at Appendix D, Sections
4.1.2 and 4.2.
---------------------------------------------------------------------------

    In response to commenters that discussed the need that PII be
``masked,'' the Commission notes that the CAT NMS Plan mandates that
all CAT Data that is returned in response to a regulatory inquiry will
be encrypted, and that PII data returned shall be masked unless users
have permission to view the CAT Data that has been requested.\1199\ The
Commission believes that this requirement adds an additional,
reasonable requirement that protects PII from view, unless the person
seeking PII is authorized to view the PII.
---------------------------------------------------------------------------

    \1199\ Id. at Section 6.10(c).
---------------------------------------------------------------------------

i. Connectivity
    One commenter stated that accessing the CAT System must be done via
secure methods, that the SROs should consider mandating the usage of
private lines rather than encrypted internet connectivity, and that the
CAT Processor's systems should be air-gapped from the internet, thereby
eliminating access to the internet and/or any internal non-CAT systems
used by the Plan Processor.\1200\
---------------------------------------------------------------------------

    \1200\ SIFMA Letter at 20.
---------------------------------------------------------------------------

    With respect to using private lines to connect to the CAT, the
Participants stated that the Plan does not require CAT Reporters to use
private lines to connect to the CAT due to cost concerns, particularly
for smaller broker-dealers.\1201\ Noting that the Plan requires that
CAT Reporters access the CAT via a secure, encrypted connection, the
Participants also cited to Appendix D which states that ``CAT Reporters
must connect to the CAT infrastructure using secure methods such as
private lines or (for smaller broker-dealers) Virtual Private Network
connection over public lines.'' \1202\
---------------------------------------------------------------------------

    \1201\ Response Letter III at 6.
    \1202\ Id.
---------------------------------------------------------------------------

    The Participants noted that pursuant to the Bidders' solutions, the
core CAT architecture would not be accessible via the public
internet.\1203\ The Participants cited to Appendix D, Section 4.1.1 of
the Plan, which states that ``[t]he CAT databases must be deployed
within the network infrastructure so that they are not directly
accessible from external end-user networks. If public cloud
infrastructures are used, Virtual Private Networking and firewalls/
access control lists or equivalent controls such as private network
segments or private tenant segmentation must be used to isolate CAT
Data from unauthenticated public access.'' \1204\
---------------------------------------------------------------------------

    \1203\ Id.
    \1204\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.1.
---------------------------------------------------------------------------

    The Commission believes that the CAT NMS Plan's provisions
regarding connectivity to the Central Repository reflect a reasonable
approach to ensuring secure access to the CAT Data residing within the
Central Repository. The Commission believes that leaving

the option for connection via Virtual Private Network for smaller
broker-dealers is reasonable, given the potential cost of mandating use
of a private line. The Commission also believes that prohibiting access
to the CAT System via the public internet is appropriate, given the
potential risk to the security of the CAT Data residing in the Central
Repository that might be caused by allowing direct access into the CAT
using an unsecure method by unauthenticated users.
j. Breach of CAT Security
    Commenters also discussed the appropriate action to be taken in the
event of a security breach. One commenter recommended that the
Commission define a ``reportable incident'' that would trigger
implementation of the cyber incident report plan.\1205\ Three
commenters recommended that the CAT NMS Plan's cyber incident report
plan include notification procedures in the event of a cyber
incident.\1206\ One commenter specifically stated that the Plan should
require that notice of an incident be provided to the Operating
Committee, affected broker-dealers, other market participants and law
enforcement within a designated period of time (e.g., 24 hours).\1207\
Another commenter agreed, noting that the Plan should provide a clear
mechanism for promptly notifying all victims of a CAT data breach,
including Customers.\1208\ Similarly, another commenter recommended
that the Plan Processor ``release a protocol document describing the
specific procedures it will take upon a breach of CAT, including the
procedure for notifying [P]articipants and allowing them to suspend CAT
submissions temporarily in the event of an ongoing breach.'' \1209\
This commenter also requested that the data security plan include a
process for reviewing data incidents to determine what corrective
actions are required to reduce the likelihood of recurrence.\1210\
---------------------------------------------------------------------------

    \1205\ MFA Letter at 8. This commenter also suggested that the
Plan Processor adopt a ``bug bounty program'' which awards
individuals who report software bugs. Id.
    \1206\ SIFMA Letter at 21; ICI Letter at 8; FSI Letter at 4.
    \1207\ SIFMA Letter at 21.
    \1208\ ICI Letter at 8; see also FSI Letter at 4 (recommending
that investors be notified of a breach).
    \1209\ FSI Letter at 4.
    \1210\ Id.
---------------------------------------------------------------------------

    Some commenters discussed who should bear the cost of a data
breach. One commenter stated that Industry Members should not bear the
cost of a security breach that occurs on the systems of the Commission,
the Participants, the Plan Processor, Central Repository, or ``in-
transit'' amongst the various parties.\1211\ Another commenter
recommended that the CAT Processor, the SROs, and the Commission
indemnify the broker-dealers from any and all liability in the event of
a breach that is in no part the fault of the broker-dealers.\1212\ Two
commenters added that CAT NMS, LLC should purchase an insurance policy
that covers potential breaches and extends to Industry Members and
their obligations vis-[agrave]-vis their clients whose CAT Data is
required to be reported by the CAT Plan.\1213\
---------------------------------------------------------------------------

    \1211\ FSR Letter at 8.
    \1212\ SIFMA Letter at 22; see also FSI Letter at 5 (suggesting
that the Plan Processor should bear responsibility in the event of a
data breach and that the Plan Processor should expressly indemnify
Participants for any costs or damages incurred as a result of a data
breach occurring after they have provided data to the CAT).
    \1213\ FSR Letter at 8; see also SIFMA Letter at 22.
---------------------------------------------------------------------------

    In response to commenters, the Participants noted that the Plan
Processor is required to work with the Operating Committee to develop a
breach protocol in accordance with industry practices.\1214\ However,
the Participants also stated that they believe that providing more
details on these processes or procedures raises security issues.\1215\
Moreover, the Participants noted, the CAT System will be subject to
applicable regulations involving database security, including
Regulation SCI and its requirement to provide notice to the Commission
and to disseminate information about SCI Events to affected CAT
Reporters.\1216\
---------------------------------------------------------------------------

    \1214\ Response Letter I at 58.
    \1215\ Id.
    \1216\ Id.
---------------------------------------------------------------------------

    With respect to breaches of the CAT System and the accompanying
protocols for dealing with breaches, the Commission notes that the CAT
NMS Plan provides that the Plan Processor must develop policies and
procedures governing its responses to systems or data breaches,\1217\
and the Participants added that the Plan Processor will work with the
Operating Committee to develop a breach protocol in accordance with
industry practices.\1218\ According to the CAT NMS Plan, such policies
and procedures will include a formal cyber incident response plan and
documentation of all information relevant to breaches.\1219\ The cyber
incident response plan will provide guidance and direction during
security incidents, and may include items such as guidance on crisis
communications; security and forensic procedures; Customer
notifications; ``playbook'' or quick reference guides that allow
responders quick access to key information; insurance against security
breaches; retention of legal counsel with data privacy and protection
expertise; and retention of a public relations firm to manage media
coverage.\1220\ The CAT NMS Plan further provides that documentation of
information relevant to breaches should include a chronological
timeline of events from the breach throughout the duration of the
investigation; relevant information related to the breach (e.g., date
discovered, who made the discovery, and details of the breach);
response efforts, involvement of third parties, summary of meetings/
conference calls, and communication; and the impact of the breach,
including an assessment of data accessed during the breach and impact
on CAT Reporters.\1221\
---------------------------------------------------------------------------

    \1217\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.5.
    \1218\ Response Letter I at 58.
    \1219\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.5.
    \1220\ Id.
    \1221\ Id.
---------------------------------------------------------------------------

    In response to commenters that requested additional detail about
the CAT NMS Plan breach management protocol, such as the definition of
a ``reportable incident,'' the Commission notes that the Plan requires
the Plan Processor to develop policies and procedures to govern its
responses to systems or data breaches and the Commission expects the
definition of a ``reportable incident'' will be clearly set forth in
those policies and procedures. While the Plan does not explicitly
require it, in response to the commenter that requested that notice of
a breach be provided to the Operating Committee, the Commission expects
that the CAT NMS Plan's cyber incident response plan will incorporate
notice of the breach to the Operating Committee, because the Operating
Committee is the body that manages the CAT LLC. As a Regulation SCI
System, the Plan Processor must also notify the Commission in the event
of an SCI Event.\1222\
---------------------------------------------------------------------------

    \1222\ Pursuant to Regulation SCI, the Commission must be
notified within 24 hours of an SCI Event. See 17 CFR 242.1002(b).
---------------------------------------------------------------------------

    As for commenters that opined on the other parties that should be
notified upon a breach, including affected parties such as Customers,
the Commission notes that the Plan explicitly requires customer
notifications to be included in the cyber incident response plan, and
that the cyber incident response plan may list other market
participants that will be notified upon a breach of the CAT System and
the procedure for notifying

relevant participants of the breach.\1223\ In response to the commenter
that requested that the breach protocol include a process for reviewing
``data incidents'' to determine what corrective actions are required to
reduce the likelihood of recurrence, the Commission notes that the Plan
requires that the impact of the breach be assessed, and the Commission
expects that such assessment will also help identify the corrective
actions that must be taken to reduce the likelihood of recurrence.
---------------------------------------------------------------------------

    \1223\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.5.
---------------------------------------------------------------------------

    In response to the several commenters that discussed issues
surrounding the cost of a breach, including which parties should bear
the cost of a breach, and whether the Plan Processor, the Participants
and the Commission should indemnify the broker-dealers from all
liability in the event of a breach that is no fault of the broker, the
Commission notes that the Plan requires that the Plan Processor's cyber
incident response plan must address insurance issues related to
security breaches and that as part of the discussions on insurance
coverage and liability, further detail about the distribution of costs
will be undertaken. The Commission believes that it is reasonable to
require, at this stage, that the cyber incident response plan outline
the key areas of breach management that must be addressed by the Plan
Processor; further details on the breach management protocols,
including details about who might bear the cost of a breach and under
what specific circumstances, will follow once the Plan Processor is
selected.
k. Use of Raw Data for Commercial or Other Purposes
    Commenters also discussed the CAT NMS Plan's provision permitting a
Participant to use the Raw Data \1224\ it reports for commercial or
other purposes as long as such use is not prohibited by applicable law,
rule or regulation.\1225\ One commenter believed that the Plan should
be amended to state specifically when a Participant may--or more
importantly, according to the commenter, may not--use Raw Data or CAT
Data for commercial purposes.\1226\ This commenter also noted
inconsistencies in the Participants' commercial use of data.\1227\
Specifically, the commenter noted that Section 6.5(f)(i)(A) of the Plan
states that each SRO may use ``the CAT Data it reports to the Central
Repository for regulatory, surveillance, commercial or other purposes
as permitted by applicable law, rule or regulation,'' and Section
6.5(h) permits a Participant to ``use the Raw Data it reports to the
Central Repository for regulatory, surveillance, commercial or other
purposes as otherwise not prohibited by applicable law, rule or
regulation.'' \1228\ Another commenter stated that the CAT NMS Plan
should be amended to clarify that Participants may not use data stored
in the Central Repository--beyond the data that the SROs submit to the
CAT--for their own commercial purposes.\1229\ One commenter provided
two recommendations designed to ensure that Participants do not use the
CAT NMS Plan to ``enlarge the scope of data that they commercialize.''
\1230\ First, the commenter believed that the Plan should specify that
no Participant may commercialize customer identifying information,
regardless of whether applicable law expressly prohibits its
commercialization. Second, the Plan should limit the scope of data
subject to commercialization by narrowing the definition of Raw Data to
include only data that a Participant must report under Rule 613 or the
Plan.\1231\
---------------------------------------------------------------------------

    \1224\ ``Raw Data'' means Participant Data and Industry Member
Data that has not been through any validation or otherwise checked
by the CAT System. See CAT NMS Plan, supra note 5, at Section 1.1.
The Commission notes that the Section 6.5(h) of the CAT NMS Plan
also limits the use by a Participant of the Raw Data that the
Participant has reported to the Central Repository; a Participant
may not use the Raw Data reported by another Participant.
    \1225\ ICI Letter at 10; SIFMA Letter at 31.
    \1226\ SIFMA Letter at 31.
    \1227\ Id.
    \1228\ Id.
    \1229\ KCG Letter at 9.
    \1230\ ICI Letter at 10.
    \1231\ Id.
---------------------------------------------------------------------------

    In response to commenters, the Participants stated that they
continue to believe that it is appropriate for the CAT NMS Plan to
permit the Participants to use their Raw Data for commercial or other
purposes.\1232\ Therefore, the Participants do not propose to prohibit
such use.\1233\ Nevertheless, to address the concern raised by a
commenter that the CAT NMS Plan inconsistently uses the terms ``Raw
Data'' and ``CAT Data'' in Sections 6.5(f)(i)(A) Section 6.5(h) of the
CAT NMS Plan, the Participants recommended that the term ``Raw Data''
replace the term ``CAT Data'' in Section 6.5(f)(i)(A) of the
Plan.\1234\
---------------------------------------------------------------------------

    \1232\ Response Letter I at 43.
    \1233\ Id.
    \1234\ Id.
---------------------------------------------------------------------------

    As an initial matter, the Commission finds that it is reasonable to
amend the Plan to replace the term ``CAT Data'' with ``Raw Data'' in
Section 6.5(f)(i)(A) of the Plan, to remove any inconsistency and
potential confusion. The Commission also finds that the CAT NMS Plan's
provisions regarding the use of Raw Data by a Participant is a
reasonable approach to the use of audit trail data that is reported by
the Participant itself. In response to the commenter's request that the
Commission define the circumstances under which a Participant cannot
use its Raw Data, the Commission finds that the CAT NMS Plan's
provision that the use must not be prohibited by applicable law, rule
or regulation is sufficient guidance to Participants regarding their
use of the Raw Data used for commercial or other purposes.\1235\
Similarly, the Commission believes that the CAT NMS Plan's definition
of ``Raw Data'' is sufficiently clear and further addresses the
comments that the Participants may expand the audit trail data that
Participants may use for commercial or other purposes. The Commission
notes that the CAT NMS Plan's definition of ``Raw Data'' limits such
data to ``Participant Data'' or ``Industry Member Data.'' \1236\ In
this regard, in response to the commenter with concerns about a
Participant commercializing customer identifying information, the
Commission notes that a Participant would never be in a position to
report customer identifying information itself; therefore, a
Participant could not use customer identifying information for
commercial or other purposes. The Commission also believes that,
pursuant to the CAT NMS Plan, the Participants may not use CAT Data for
commercial purposes.
---------------------------------------------------------------------------

    \1235\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(i)(A).
    \1236\ See id. at Section 1.1.
---------------------------------------------------------------------------

l. Ownership of CAT Data
    Several commenters discussed the ownership of CAT Data. Two
commenters believed that the CAT NMS Plan should be amended to indicate
that broker-dealers retain ownership rights in all of the data they
report to the CAT.\1237\ In response to commenters, Participants stated
that Rule 613 does not address broker-dealer CAT Reporters' ownership
rights with respect to the CAT Data, and the Participants do not
believe that it is appropriate to address such ownership rights in the
Plan.\1238\
---------------------------------------------------------------------------

    \1237\ SIFMA Letter at 30; KCG Letter at 7-8.
    \1238\ Response Letter I at 44.
---------------------------------------------------------------------------

    The Commission believes that it is reasonable for the CAT NMS Plan
not to address ownership rights to the data that broker-dealers report
to the Central Repository. The resolution of legal questions regarding
ownership rights to the data that is reported to the Central

Repository by broker-dealers is not required by Rule 613; is outside
the scope of Rule 613; and is not necessary to find that the Plan meets
the approval standard of Rule 608.
m. Bulk Access to an Industry Member's CAT Data
    A few commenters discussed whether Industry Members should be
permitted access to their own reported audit trail data through bulk
data exports. One commenter stated that it ``would be highly beneficial
for CAT Reporters to have access to their own data'' to assist with
error identification and correction, and stressed the importance of
building such access into CAT as part of the initial design, even if
CAT Reporters were not permitted such access during the initial phase
of CAT.\1239\ To address security concerns, the commenter suggested
that retrieval of PII data should be limited to a set of CAT Reporter
personnel who are responsible for entering and correcting customer
information.\1240\ Another commenter noted that broker-dealers should
be permitted to access, export and use their data within the Central
Repository at no charge and that ``[a]llowing broker-dealers to access
their own data will be beneficial for surveillance and internal
compliance programs and may incentivize firms to make other internal
improvements including, among other things, reducing potential
errors.'' \1241\ This commenter also argued that broker-dealers should
not be subject to additional fees to simply retrieve data they already
submitted to the CAT, noting that CAT is the only broker-dealer
regulatory reporting service for which the SROs have proposed to impose
system-specific fees on broker-dealers.'' \1242\ Another commenter
stated that ``[a]llowing CAT Reporters to access their own data would
be beneficial for surveillance and internal compliance programs. If
data access is considered as part of the initial design of the Central
Repository, we believe the benefits outweigh the cost.'' \1243\ One
commenter argued that independent software vendors also should have
fair, reasonable, and non-discriminatory access, at their client's
request, to the data submitted or stored at the Central Repository on
their client's behalf.\1244\ In support, this commenter noted that OATS
permitted access to determine reporting accuracy by ``matching in both
directions,'' so that reporters could address matching errors.\1245\
---------------------------------------------------------------------------

    \1239\ FIF Letter at 61.
    \1240\ Id.
    \1241\ SIFMA Letter at 30. In this regard, this commenter noted
that broker-dealers could use their CAT reported data to run complex
searches and generate reports to (1) meet their regulatory
surveillance requirements; (2) conduct best execution analysis; and
(3) conduct transaction costs analysis. Id.
    \1242\ Id.; see also KCG Letter at 7.
    \1243\ TR Letter at 8.
    \1244\ Bloomberg Letter at 7.
    \1245\ Id. (noting further that independent software vendors
could build sophisticated analytics to aid this).
---------------------------------------------------------------------------

    In response to these comments, the Participants noted that during
the development of the Plan, the SROs considered whether to provide
Industry Members with access to their own data through bulk data
exports.\1246\ Based on the data security and cost considerations, the
Participants stated that they determined that such access was not a
cost-effective requirement for the CAT.\1247\ Accordingly, the CAT NMS
Plan was drafted to state that ``[n]on-Participant CAT Reporters will
be able to view their submissions online in a read-only, non-exportable
format to facilitate error identification and correction.'' \1248\
---------------------------------------------------------------------------

    \1246\ Response Letter I at 44.
    \1247\ Id.
    \1248\ See CAT NMS Plan, supra note 5, at Appendix D, Section
10.1.
---------------------------------------------------------------------------

    In light of the comments that the Commission received and further
evaluation of the issue, however, in their response, the Participants
stated that they now believe that there may be merit to providing
Industry Members and their vendors with bulk access to the CAT
Reporters' own unlinked CAT Data.\1249\ For example, the Participants
stated that such access may facilitate the CAT Reporters' error
analysis and internal surveillance and that it may expedite the
retirement of duplicative reporting systems.\1250\ However, the
Participants noted, providing bulk data access also raises a variety of
operational, security, cost and other issues related to the CAT.\1251\
The Participants stated that they would need to address this additional
functionality with the Plan Processor; in addition, the Participants
stated that inclusion of this functionality would create additional
burdens on the CAT and the Plan Processor and, therefore, may require
additional funding from CAT Reporters for such access to the CAT
Data.\1252\ Therefore, the Participants stated that they will consider
this issue once the CAT is operational.\1253\
---------------------------------------------------------------------------

    \1249\ Response Letter I at 44.
    \1250\ Id.
    \1251\ Id.
    \1252\ Id.
    \1253\ Id.
---------------------------------------------------------------------------

    The Commission recognizes the commenters' desire for bulk access to
their own data for surveillance and internal compliance purposes, as
well as possible error correction purposes. The Commission also
recognizes the Participants' initial approach of not permitting such
access for security and cost purposes, as set forth in their response.
Given the complexity of initially implementing the CAT, the Commission
believes that the Participants' approach that limits Industry Members
to only being able to view their submissions online in a read-only,
non-exportable format to facilitate error identification and correction
is a reasonable approach at the present time. The Commission notes the
Participants' representation that they will consider offering bulk
access to the audit trail data reported by Industry Members once CAT is
operational. The Commission expects the Participants to fulfill this
commitment and as part of their evaluation, the Commission expects that
the Participants may consider whether a fee for such access would be
appropriate and how such a fee might impact the funding of the
CAT.\1254\
---------------------------------------------------------------------------

    \1254\ The Commission preliminarily believes that if the
Participants decide to provide access to broker-dealer CAT
Reporters, an amendment to the CAT Plan would be required as this
would expand the Plan's restriction that CAT Data only be used by
Participants for regulatory and surveillance purposes. See CAT NMS
Plan, supra note 5, at Section 6.5(h).
---------------------------------------------------------------------------

    The Commission disagrees with the commenters that recommended
providing access to CAT Data for independent software vendors.\1255\
Given the highly sensitive nature of the CAT Data, the Commission
believes that it is reasonable to not allow access to parties other
than the SROs and the Commission. If the Participants decide to propose
granting such access after gaining experience with CAT operations, and
are able to ensure the security of data, the Commission will consider,
based on the analysis presented, whether granting access to CAT
Reporters and other non-regulator industry members is reasonable.
---------------------------------------------------------------------------

    \1255\ Bloomberg Letter at 7.
---------------------------------------------------------------------------

    The Commission also notes that, as discussed in Section IV.H, the
Commission is amending Section 6.6 of the Plan to require that, within
24 months of effectiveness of the Plan, the Participants provide the
Commission with a report discussing the feasibility, benefits, and
risks of allowing an Industry Member to bulk download the Raw Data it
submitted to the Central Repository.\1256\
---------------------------------------------------------------------------

    \1256\ See Section IV.H, supra.
---------------------------------------------------------------------------

n. Regulator Use Cases
    One commenter noted that the Plan does not provide any details on
how

regulators will be able to perform their day-to-day analysis using CAT
Data.\1257\ Specifically, this commenter analyzed the limitations of
the CAT NMS Plan in light of the regulator use cases (``Regulator Use
Cases'') contained in the Adopting Release, which provided further
detail about how regulators envisioned using, accessing, and analyzing
audit trail data under CAT.\1258\ This commenter made three
recommendations that the commenter believed would provide additional
clarity to the CAT NMS Plan: (i) The Plan should clearly specify the
analytical capability requirements of the CAT to inform the SROs about
the level and limits of the Central Repository's analytical
capabilities; (ii) the Plan should precisely describe the technology
enhancements required by the SROs and the Commission to effectively and
efficiently use the CAT Data; and (iii) the Regulator Use Cases should
be a key criteria in the selection of the Plan Processor, which would
require Bidders to prove that their solution is capable of facilitating
regulators' need to extract and analyze the data.\1259\
---------------------------------------------------------------------------

    \1257\ SIFMA Letter at 32-33.
    \1258\ Id. at 31-33.
    \1259\ Id. at 33.
---------------------------------------------------------------------------

    The Commission recognizes the commenter's concerns about the lack
of details in the CAT NMS Plan regarding how regulators will be able to
perform their day-to-day analysis using CAT Data, in light of the
Regulator Use Cases. The Commission notes, however, that in the
Adopting Release the Commission stated that it was not including the
Regulator Use Cases and accompanying questions to endorse a particular
technology or approach to the consolidated audit trail; rather, the
Regulator Use Cases and accompanying questions were designed to aid the
SROs' understanding of the types of useful, specific information that
the CAT NMS Plan could contain that would assist the Commission in its
evaluation of the Plan.\1260\ The Commission noted that its description
of Regulator Use Cases includes a non-exclusive list of factors that
SROs could consider when developing the NMS plan.\1261\ Thus, the
Commission believes that the Regulator Use Cases were not intended to
serve as a list of specific requirements regarding analytical
capability or technological enhancements that should be addressed by
the Participants in the CAT NMS Plan. In response to the comment that
the Regulator Use Cases should be a key criteria in the selection of
the Plan Processor, the Commission reiterates that the Regulator Use
Cases were not intended to be used as selection criteria for the Plan
but were meant to elicit the types of useful information from the
bidders that would assist in the Commission in its evaluation of the
CAT NMS Plan.
---------------------------------------------------------------------------

    \1260\ See Adopting Release, supra note 13, at 45798.
    \1261\ Id.
---------------------------------------------------------------------------

o. Obligations on Participants and the Commission Regarding Data
Security and Confidentiality
    Under the CAT NMS Plan as noticed, certain obligations are imposed,
or required to be imposed by the Plan Processor upon the Participants
and the Commission regarding data security and confidentiality.\1262\
However, Commissioners and employees of the Commission are excluded
from certain of these obligations.\1263\
---------------------------------------------------------------------------

    \1262\ See CAT NMS Plan, supra note 5, at Sections 6.5(f)(i)(A)-
(B), 6.5(f)(i)(D), 6.5(f)(iii), 6.5(f)(iv)(B), 6.5(g), Appendix D,
Sections 4.1.4, 4.1.6, 11.3; see also supra Section III.25.
    \1263\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(i)(A)-
(B).
---------------------------------------------------------------------------

    Two commenters opined on these provisions. One stated that ``the
security of the confidential data stored in the Central Repository and
other CAT systems must be of the highest quality and that no authorized
users with access to CAT Data should be exempt from any provisions
regarding security requirements and standards set forth in the Plan.''
\1264\ Another commenter expressed concern that the Plan does not
require Commission Staff to abide by the same security protocols for
handling PII that other users of CAT Data are required to follow and
urged the Commission to adopt these safeguards.\1265\
---------------------------------------------------------------------------

    \1264\ NYSE Letter at 2-4 (noting that ``[i]f employees of the
Commission with access to the data stored in the Central Repository
or other CAT systems are subject to security standards less
stringent than those applicable to other authorized users, the data
obtained and held by those individuals may be subject to heightened
risk of a data breach.'').
    \1265\ Garrett Letter at 1-2.
---------------------------------------------------------------------------

    Specifically, one commenter objected to the exclusion of
Commissioners and employees of the Commission from Section 6.5(f)(i)(A)
of the Plan, which provides that the Plan Processor must require
individuals with access to the Central Repository to use appropriate
confidentiality safeguards and to use CAT Data only for surveillance
and regulatory purposes.\1266\ In addition, the commenter argued that
Section 6.5(g) of the Plan, which requires the Participants to
establish and enforce policies and procedures regarding CAT Data
confidentiality, should also apply to the Commission.\1267\ Similarly,
another commenter sees no reason why the Commission should not have to
follow the requirements of Section 6.5(g) and emphasized that the
Commission needs to follow adequate policies and procedures when
handling PII.\1268\ However, the first commenter noted that it ``do[es]
not believe that individuals performing their employment duties should
be subject to personal liability and that such liability would not
reduce security risks,'' and objected to Section 6.5(f)(i)(B) of the
Plan, which requires the submission of a ``Safeguard of Information
Affidavit'' providing for personal liability for misuse of data.\1269\
---------------------------------------------------------------------------

    \1266\ NYSE Letter at 3.
    \1267\ Id. at 3-4 (citing U.S. Government Accountability Office
(``GAO'') report discussing certain weaknesses in the Commission's
information security policies).
    \1268\ Garrett Letter at 1 (noting also that computer systems at
the Federal Deposit Insurance Corporation, Internal Revenue Service,
Federal Reserve, and Office of Personnel Management have all
recently been compromised by cyberattacks and that an April 2016 GAO
report identified several weaknesses related to the SEC's
cybersecurity protocols that the Commission has not yet addressed).
    \1269\ NYSE Letter at 3 (also objecting to the terms ``misuse''
and ``data'' (rather than CAT Data) as overly broad and imprecise).
---------------------------------------------------------------------------

    In response to these comments, the Participants stated that they
agree that the Plan's security program must take into consideration all
users with access to CAT Data, including the Commission, and noted that
Commission Staff had requested the exclusion of Commission employees
and Commissioners from subsections (A) and (B) of Section 6.5(f)(i) of
the Plan.\1270\ The Participants, nevertheless, recommended removing
these exclusions and applying the requirements of Section 6.5(g) to the
Commission.\1271\
---------------------------------------------------------------------------

    \1270\ Response Letter I at 60.
    \1271\ Id. at 60-61.
---------------------------------------------------------------------------

    The Commission takes very seriously concerns about maintaining the
security and confidentiality of CAT Data and believes that it is
imperative that all CAT users, including the Commission, implement and
maintain a robust security framework with appropriate safeguards to
ensure that CAT Data is kept confidential and used only for
surveillance and regulatory purposes. However, the Commission is not a
party to the Plan.\1272\ By statute, the Commission is the regulator of
the Participants, and the Commission will oversee and enforce their
compliance with the Plan.\1273\ To impose obligations

on the Commission under the Plan would invert this structure, raising
questions about the Participants monitoring their own regulator's
compliance with the Plan.\1274\ Accordingly, the Commission does not
believe it is appropriate for its security and confidentiality
obligations, or those of its personnel, to be reflected through Plan
provisions.\1275\ Rather, the obligations of the Commission and its
personnel with respect to the security and confidentiality of CAT Data
should be reflected through different mechanisms than those of the
Participants. The Commission reiterates that in each instance the
purpose of excluding Commission personnel from these provisions is not
to subject the Commission or its personnel to more lenient data
security or confidentiality standards. Despite these differences in the
origins of their respective obligations, the rules and policies
applicable to the Commission and its personnel will be comparable to
those applicable to the Participants and their personnel.
---------------------------------------------------------------------------

    \1272\ See 17 CFR 242.608(a)(1) (stating that NMS plans are
filed by two or more SROs).
    \1273\ See 17 CFR 242.608(b)(2), (c), (d); 17 CFR 242.613(h).
    \1274\ Such an approach also has the potential to create tension
with the existing oversight of the Commission conducted by the
Office of the Inspector General and the Government Accountability
Office.
    \1275\ Moreover, Commission employees are generally immune from
personal liability for actions performed in the course of their
duties. See, e.g., Gilbert v. Digress, 756 F.2d 1455, 1458 (9th Cir.
1985) (``the bar of sovereign immunity cannot be avoided by naming
officers and employees of the United States as defendants''); Clark
v. Library of Congress, 750 F.2d 89, 103-04 (D.C. Cir. 1984) (absent
a specific waiver by the government, sovereign immunity bars
constitutional suits for money damages against government employees
in their official capacity, even in cases where the employee acted
outside his authority); 28 U.S.C. 2679 (barring claims against
government employees under the Federal Tort Claims Act).
---------------------------------------------------------------------------

    The Commission and its personnel are subject to a number of
existing federal and Commission rules and policies regarding the
security and confidentiality of information that they encounter in the
course of their employment. These rules and policies apply with equal
force to data that Commission personnel can access in the CAT. For
example, existing laws and regulations prohibit Commission personnel
from disclosing non-public information \1276\ without
authorization.\1277\ CAT Data available to Commission personnel will
contain non-public information. Thus, Commission personnel who disclose
or otherwise misuse this data would potentially be subject to criminal
penalties (including fines and imprisonment), as well as disciplinary
action (including termination of employment), civil injunction, and
censure by professional associations (for attorneys and
accountants).\1278\ The Commission believes that the protections
described above provide as strong a deterrent against the possible
misuse of CAT Data by Commission personnel as would the submission of
the ``Safeguard of Information Affidavit'' required by Section
6.5(f)(i)(B).\1279\
---------------------------------------------------------------------------

    \1276\ See, e.g., 5 CFR 2635.703(b) (``Nonpublic information is
information that the employee gains by reason of Federal employment
and that he knows or reasonably should know has not been made
available to the general public.'').
    \1277\ See, e.g., 15 U.S.C. 78x(b) (``It shall be unlawful for
any member, officer, or employee of the Commission to disclose to
any person other than a member, officer, or employee of the
Commission, or to use for personal benefit, any information
contained in any application, statement, report, contract,
correspondence, notice, or other document filed with or otherwise
obtained by the Commission (1) in contravention of the rules and
regulations of the Commission under [the Freedom of Information
Act], or (2) in circumstances where the Commission has determined
pursuant to such rules to accord confidential treatment to such
information''); 17 CFR 200.735-3(b)(2)(i) (``A member or employee of
the Commission shall not . . . [d]ivulge to any unauthorized person
or release in advance of authorization for its release any nonpublic
Commission document, or any information contained in any such
document or any confidential information: (A) In contravention of
the rules and regulations of the Commission promulgated under [the
Freedom of Information Act], [the Privacy Act], and [the Sunshine
Act]; or (B) in circumstances where the Commission has determined to
accord such information confidential treatment''); 5 CFR 2635.703(a)
(``An employee shall not engage in a financial transaction using
nonpublic information, nor allow the improper use of nonpublic
information to further his own private interest or that of another,
whether through advice or recommendation, or by knowing unauthorized
disclosure.'').
    \1278\ See, e.g., 18 U.S.C. 1905 (``Whoever, being an officer or
employee of the United States or of any department or agency thereof
. . . publishes, divulges, discloses, or makes known in any manner
or to any extent not authorized by law any information coming to him
in the course of his employment or official duties, . . . which
information concerns or relates to the trade secrets, processes,
operations, style of work, or apparatus, or to the identity,
confidential statistical data, amount or source of any income,
profits, losses, or expenditures of any person, firm, partnership,
corporation, or association; . . . shall be fined under this title,
or imprisoned not more than one year, or both; and shall be removed
from office or employment''); 5 U.S.C. 552a(h)(i)(1) (``Criminal
penalties--Any officer or employee of an agency, who by virtue of
his employment or official position, has possession of, or access
to, agency records which contain individually identifiable
information the disclosure of which is prohibited by this section or
by rules or regulations established thereunder, and who knowing that
disclosure of the specific material is so prohibited, willfully
discloses the material in any manner to any person or agency not
entitled to receive it, shall be guilty of a misdemeanor and fined
not more than $5,000'').
    \1279\ A comment from one Participant suggested that persons
with access to the Central Repository--regardless of whether they
are employed by the Plan Processor, the Commission, or a
Participant--should not be subject to personal liability for the
misuse of data. The Commission is not amending the Plan to remove
personal liability from all categories of such persons. The
inclusion in the Plan of a provision providing for personal
liability for the misuse of data indicates that the Participants
more broadly believe that this is an appropriate and potentially
effective way of deterring misuse of data, including by their own
employees. And, in the Commission's view, the Participants' belief
is reasonable.
---------------------------------------------------------------------------

    In addition, the Commission already has robust information security
policies and procedures developed in accordance with federal directives
and NIST standards that prohibit the unauthorized disclosure and
inappropriate use of confidential data. Moreover, the Commission will
review and update, as necessary, its existing confidentiality and data
use policies and procedures to account for access to the CAT, and, like
the Participants, will periodically review the effectiveness of these
policies and procedures and take prompt action to remedy deficiencies
in such policies and procedures. Like other information security
controls over information resources that support federal operations and
assets, the Commission's policies and procedures applicable to CAT must
comply with the Federal Information Security Modernization Act of 2014
and the NIST standards required thereunder,\1280\ and will be subject
to audits by the SEC Office of Inspector General and the GAO.
---------------------------------------------------------------------------

    \1280\ Public Law 113-283 (Dec. 18, 2014); NIST, Security and
Privacy Controls for Federal Information Systems and Organizations,
Special Publication 800-53, revision 4 (Gaithersburg, Md.: April
2013); NIST, Contingency Planning Guide for Federal Information
Systems, Special Publication 800-34, revision 1 (Gaithersburg, Md.:
May 2010).
---------------------------------------------------------------------------

    Notwithstanding the existence of these protections, in light of the
scope and nature of CAT Data, the Commission recognizes the need to
ensure that it has in place a comprehensive framework for CAT data
security. Accordingly, a cross-divisional steering committee of senior
Commission Staff is being formed to design policies and procedures
regarding Commission and Commission Staff access to, use of, and
protection of CAT Data. The policies and procedures will consider, but
not be limited to, access controls, appropriate background checks,
usage and data protection, as well as incident response. In developing
these policies and procedures, the steering committee will, of
necessity, take into account how the data collection and other systems
are developed in connection with the creation of the CAT. The
Commission will ensure that its policies and procedures impose
protections upon itself and its personnel that are comparable to those
required under the provisions in the Plan from which the

Commission and its personnel are excluded.
    For these reasons, the Commission does not believe that the Plan
should be amended to remove the exclusion of ``employees and
Commissioners of the SEC'' from Section 6.5(f)(i)(A)-(B) or to extend
the requirements of Section 6.5(g) to the Commission. Similarly, the
Commission does not believe that the requirements in Section 6.5(g)
that Participants establish and enforce policies and procedures
designed to ensure the confidentiality of CAT Data obtained from the
Central Repository and to limit the use of such data to surveillance
and regulatory purposes can or should be extended to the Commission.
Moreover, the Commission is further amending the Plan, as set forth
below, to remove the Commission from certain other obligations.
    First, the Commission is amending the Plan to provide that Section
6.5(f)(iii) does not apply to the Commission or its personnel. As
proposed, this provision provided that the Participants and the
Commission must, as promptly as reasonably practicable, but in any
event within twenty-four hours, report instances of non-compliance with
policies and procedures or breaches of the security of the CAT to the
CCO. The Commission received no comments on this provision. The
Commission notes that, consistent with presidential directives and
guidance from the OMB and the Department of Homeland Security United
States Computer Emergency Readiness Team (``US-CERT''), its existing
incident response policies and procedures require Commission employees
to promptly convey any known instances of non-compliance with data
security and confidentiality policies and procedures or breaches of the
security of its systems to the CISO of the Commission, and this policy
will apply to any instances of non-compliance or breaches that occur
with respect to the CAT. The Commission's policies and procedures
regarding the CAT will also address conveying information regarding any
such incidents to the CCO when appropriate.
    Second, for the reasons discussed above, the Commission is amending
the Plan to clarify that Section 6.5(f)(iv)(B) does not apply to the
Commission or its personnel. As proposed, this provision stated that
the Plan Processor must ``require the establishment of secure controls
for data retrieval and query reports by Participant regulatory Staff
and the Commission.'' \1281\ The Commission received no comments on
this provision. The Commission will ensure that comparable controls
governing data retrieval and query reports from the CAT will be
included, as applicable, in its policies and procedures.
---------------------------------------------------------------------------

    \1281\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(iv)(B).
---------------------------------------------------------------------------

    Third, the Commission is amending the Plan to clarify that the
requirement to test changes to CAT functionality in Appendix D, Section
11.3 applies only to the Participants. As proposed, this provision
stated that, with respect to changes to CAT functionality and
infrastructure, the Plan Processor must ``[d]efine the process by which
changes are to be tested by CAT Reporters and regulators.'' The
Commission received no comments on this provision. For the reasons
discussed above, the Commission is narrowing this provision so that it
is applicable only to the Participants. However, the Commission intends
to take part in the testing of changes in CAT functionality or
infrastructure that would affect the way Commission personnel access
and use the CAT System.
    Fourth, for the reasons discussed above, the Commission is amending
the Plan to exclude the Commission and its personnel from certain CAT
user access provisions in Appendix D, Sections 4.1.4 and 4.1.6 of the
CAT NMS Plan. The Plan, as proposed, provided that the Plan Processor
shall ``implement and maintain a mechanism to confirm the identity of
all individuals permitted to access the CAT Data stored in the Central
Repository and maintain a record of all instances where such CAT Data
was accessed.'' \1282\ Specifically, Appendix D, Section 4.1.4 of the
CAT NMS Plan provides: that ``[p]eriodic reports detailing the current
list of authorized users and the date of their most recent access must
be provided to Participants, the SEC and the Operating Committee,''
that the ``reports of the Participants and the SEC will include only
their respective list of users,'' that the ``Participants and the SEC
must provide a response to the report confirming that the list of users
is accurate,'' and that the ``Plan Processor must log every instance of
access to Central Repository data by users.''
---------------------------------------------------------------------------

    \1282\ See CAT NMS Plan, supra note 5, at Section 6.5(f)(i)(D).
---------------------------------------------------------------------------

    In addition, the CAT NMS Plan provides that ``[a] full audit trail
of PII access (who accessed what data, and when) must be maintained,''
that ``[t]he Chief Compliance Officer and the Chief Information
Security Officer shall have access to daily PII reports that list all
users who are entitled for PII access, as well as the audit trail of
all PII access that has occurred for the day being reported on,'' and
that ``[t]he chief regulatory officer, or other such designated officer
or employee at each Participant and the Commission must, at least
annually, review and certify that people with PII access have the
appropriate level of access for their role.'' \1283\
---------------------------------------------------------------------------

    \1283\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.6.
---------------------------------------------------------------------------

    For the reasons discussed above, the Commission is amending the
Plan to exclude the Commission from the provisions that require the
Commission to ``provide a response to the report confirming that the
list of users is accurate'' and to ``review and certify that people
with PII access have the appropriate level of access for their role.''
\1284\ However, in accordance with Commission information security
policies and procedures, the Commission will periodically review the
appropriateness of CAT access by personnel and work with the Plan
Processor to ensure the list of SEC users authorized to access CAT Data
in the Central Repository is appropriate.
---------------------------------------------------------------------------

    \1284\ Id. at Appendix D, Sections 4.1.4 and 4.1.6.
---------------------------------------------------------------------------

7. Personally Identifiable Information
a. Protections Around PII, Regulatory Access to PII
    A number of commenters discussed the Plan Processor's provisions to
protect the PII reported to and stored in the Central Repository. Two
commenters noted that PII should be held to the ``highest'' or ``most
stringent'' standards of information protection.'' \1285\ However, one
commenter stated that ``the protection and security of PII in CAT is
``good enough.'' \1286\ Another commenter recommended that the Plan
provide further details as to how PII data will be treated and
confidentiality maintained, specifically during extraction and
transmission of the data.\1287\
---------------------------------------------------------------------------

    \1285\ TR Letter at 8; SIFMA Letter at 22; see also NYSE Letter
at 3 (discussing CAT Data, including PII reported to the Central
Repository, and noting that the security of the confidential data
stored in the Central Repository and other CAT systems must be of
the highest quality).
    \1286\ Data Boiler Letter at 29 (stating ``PII should properly
be safeguarded . . . . but nothing will be absolutely ``bullet-
proof.'').
    \1287\ SIFMA Letter at 44 (suggesting that the Bidders should be
evaluated on how their proposed solutions will meet the
confidentiality requirements by a technical panel of experts with
representation from broker-dealers).
---------------------------------------------------------------------------

    Commenters also discussed the Plan's provisions regarding access to
PII. One commenter noted that ``access to PII data should be provided
only in the rarest of instances (i.e., SEC investigations for
securities law

violations), as regulators and other authorized users should be able to
perform the majority, if not all, of their regulatory and oversight
responsibilities by utilizing non-PII data, such as the CAT Customer-
ID.'' \1288\ Another commenter stated that there should be controls,
policies and procedures to prohibit the downloading of certain
sensitive information, such as PII, and suggested limiting Participant
access to sensitive data only to specific enforcement actions.\1289\
One commenter recommended that PII data never be exported, extracted,
copied or downloaded in any manner or form from the CAT
environment.\1290\ This commenter added that PII data should not be
included in email or other electronic communications, and advocated for
use of a special CAT information management tool.\1291\ Another
commenter believed the PII should be excluded from direct query tools,
reports or bulk data extraction.\1292\
---------------------------------------------------------------------------

    \1288\ SIFMA Letter at 22.
    \1289\ FIF Letter at 134-135.
    \1290\ SIFMA Letter at 22.
    \1291\ Id.
    \1292\ FSI Letter at 3.
---------------------------------------------------------------------------

    In their response, the Participants noted that Section
6.10(c)(i)(B) of the Plan provides that ``[t]he user-defined direct
queries and bulk extracts will provide authorized users with the
ability to retrieve CAT Data via a query tool or language that allows
users to query all available attributes and data sources.'' \1293\ The
Participants clarified that no customer-related information, including
PII, will be included in response to queries of the broader order and
transaction database, nor will it be available in bulk extract
form.\1294\ Instead, the Participants stated that customer-related
information, such as PII, will be stored in a separate database, which
can be accessed only in accordance with heightened security
protocols.\1295\ In such case, a regulatory user would have to be
specifically authorized to access the database with PII and other
customer-related information.\1296\ The Participants stated that they
expect that the Plan Processor and the CISO will establish policies and
procedures to identify abnormal usage of the database containing
customer-related information, and to escalate concerns as necessary;
and noted that the details regarding such policies and procedures will
be determined once the Plan Processor has been selected.\1297\
---------------------------------------------------------------------------

    \1293\ Response Letter III at 10.
    \1294\ Id.
    \1295\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.6.
    \1296\ For example, in their Response Letter, the Participants
noted that if a regulatory user received a tip about a particular
person, such user, if he or she were appropriately authorized to do
so, could search the customer-related information database and view
unmasked information to identify the person's Customer-ID, and then
use the Customer-ID to query the broader order and transaction
database to view the relevant activity for that Customer-ID.
Response Letter III at 10.
    \1297\ Id.
---------------------------------------------------------------------------

    With respect to the standards of protection for PII, the Commission
notes that the Plan Processor must adhere to the NIST Risk Management
Framework and implement baseline security controls identified in NIST
Special Publication 800-53, which the Commission believes, when applied
properly, are sufficiently rigorous industry standards for the
protection of sensitive data such as PII.\1298\ The Commission also
believes that the Participants' general approach to treating PII
differently--and with more stringent protections--than other CAT Data
is also reasonable, given the highly sensitive nature of PII, and the
risk that an individual Customer's orders and transactions could be
identified should the Central Repository's data security protections be
breached. Thus, the Commission believes that the Plan's provisions
which limit who can access PII and how PII can be accessed are a
reasonable means of ensuring the protection of PII. Specifically, the
Commission believes that requiring access to PII to follow RBAC,
adhering to the ``least privileged'' practice of limiting access,\1299\
restricting access to PII to those with a ``need-to-know,'' and
requiring that any login system that is able to access PII must be
further secured via MFA, are reasonable.\1300\
---------------------------------------------------------------------------

    \1298\ See Section IV.D.6.b, supra.
    \1299\ The Commission understands that the ``least privileged''
practice entails limiting access to the minimal level of access to
PII that will allow normal functioning.
    \1300\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.4.
---------------------------------------------------------------------------

    The Commission also believes that the Participants' approach to the
use of PII is a reasonable means of protecting PII of Customers
reported to the Central Repository. Specifically, the Commission
believes that the Plan's provisions setting out specific parameters
applicable to the inclusion of PII in queries, as described by the
Participants, is a reasonable approach to controlling the disclosure of
PII and helps to ensure that PII will only be used by regulators for
regulatory and surveillance purposes and, as set out in the Plan, for
market reconstruction and analysis.
    The Commission notes that the Plan and the Participants' response
affirms that access to PII data will only be provided to a limited set
of authorized individuals, and only for the limited purpose of
conducting regulatory and surveillance activities.\1301\ The Plan also
contains an explicit prohibition on the ability to bulk download
sensitive information such as PII, and this protection must be
reinforced through the Plan Processor's controls, policies and
procedures.
---------------------------------------------------------------------------

    \1301\ The Commission notes that regulatory uses includes, among
other things, analysis and reconstruction of market events, market
analysis and research to inform policy decisions, market
surveillance, examinations, investigations, and other enforcement
functions. See supra note 586.
---------------------------------------------------------------------------

    Thus, the Commission believes that the Plan's provisions addressing
the protections of PII, and the limitations on its access and use,
provide a reasonable framework for the protection of PII. While it is
concluding that the Plan sets forth a reasonable framework for the
protection of PII, the Commission notes that the Plan Processor will
continually assess, and the CISO and Operating Committee will
vigorously oversee, the adequacy of the security of CAT Data, and in
particular PII, and will promptly and thoroughly address any
deficiencies that are identified.\1302\
---------------------------------------------------------------------------

    \1302\ See CAT NMS Plan, supra note 5, at Section 6.1(o)(ii)
(requiring the Plan Processor to provide the Operating Committee
regular reports addressing, among other things, data security issues
for the Plan Processor and the Central Repository taking into
account the data security requirements set forth in Appendix D).
---------------------------------------------------------------------------

b. PII Scope: Customer Identifying Information and Customer Account
Information
    One commenter requested clarification on the scope of PII, stating
``[t]he exact scope of PII should be defined, i.e., are all fields
associated with a customer included as PII?'' \1303\ In their response,
the Participants provided additional clarification on their
interpretation of PII, as well as on the scope of the Plan's
protections for all customer-related information.\1304\ Specifically,
the Participants clarified that they view all customer-related
information--not only PII, but also Customer Identifying Information
and Customer Account Information--as the type of highly sensitive
information that requires the highest level of protection under the
Plan.\1305\ The Participants further stated that because there is some
inconsistency in how these terms are used in the Plan, to the extent
that any statement in the Plan, including Section 6.10(c) of the Plan,
and Appendices C or D thereto, are inconsistent with the above
description, the Participants recommend that the Commission amend

the Plan to address any potential confusion.\1306\
---------------------------------------------------------------------------

    \1303\ FIF Letter at 135.
    \1304\ Response Letter III at 9-10.
    \1305\ Response Letter III at 9.
    \1306\ Response Letter III at 10.
---------------------------------------------------------------------------

    The Commission agrees with the Participants and believes that the
security of Customer Identifying Information and Customer Account
Information, irrespective of whether it meets a common understanding of
the definition of PII, should be subject to the highest standards of
protection. Accordingly, the Commission is amending the definition of
PII in Section 1.1 of the CAT NMS Plan to provide that PII means
``personally identifiable information, including a social security
number or tax identifier number or similar information; Customer
Identifying Information and Customer Account Information.'' The
Commission believes that this amendment is reasonable in that it will
ensure that all information that identifies a Customer will be afforded
the same high levels of protection as data that the Participants
initially defined as PII.
c. Storage of PII
    Commenters also discussed the policies and procedures addressing
storage of PII as a means to enhance the security and confidentiality
of PII reported to the Central Repository. A few commenters stated that
PII should be stored separately from other CAT Data.\1307\ One
commenter stated that ``PII must be segregated from other transactional
data that will be stored by the CAT Processor.'' \1308\ Another
commenter opined that, while it does not believe that the CAT NMS Plan
should mandate a particular storage method, it supported requiring PII
to be stored separately, given its sensitive nature and the potential
for identify theft or fraud.\1309\
---------------------------------------------------------------------------

    \1307\ FSR Letter at 4; FSI Letter at 3; SIFMA Letter at 22; see
also MFA Letter at 8 (stating that particularly sensitive pieces of
data should be isolated or compartmentalized).
    \1308\ FIF Letter at 125. Similarly, another commenter
recommended that PII data not overlap with access to the other
transaction data available in the CAT. See SIFMA Letter at 23.
    \1309\ FSI Letter at 3.
---------------------------------------------------------------------------

    In their response, the Participants clarified that they view all
customer-related information (i.e., PII, including Customer Identifying
Information and Customer Account Information) as highly sensitive
information that requires the highest level of protection and, as such,
all customer-related information will be stored in a different,
physically separated architecture.\1310\
---------------------------------------------------------------------------

    \1310\ Response Letter III at 9.
---------------------------------------------------------------------------

    The Commission believes that the CAT NMS Plan's provisions
regarding the storage of PII set forth a reasonable framework for the
security of such data. The Plan further provides that the CAT
infrastructure may not be commingled with other non-regulatory systems,
including being segmented to the extent feasible on a network level,
and data centers housing CAT systems must be AICPA SOC-2 certified by a
qualified third party auditor that is not an affiliate of any
Participant or the Plan Processor.\1311\
---------------------------------------------------------------------------

    \1311\ See CAT NMS Plan, supra note 5, at Appendix D, Section
4.1.3; see also Response Letter I at 58-59.
---------------------------------------------------------------------------

8. Implementation Schedule
    The CAT NMS Plan sets forth timeframes for key CAT implementation
events and milestones, such as when the Plan Processor will release the
Technical Specifications, begin accepting data from Participants, begin
accepting data from Industry Members for testing purposes, and when
Industry Members must begin reporting to CAT.\1312\
---------------------------------------------------------------------------

    \1312\ See Section III.27, supra.
---------------------------------------------------------------------------

a. Specificity and Timing of Implementation Milestones
    One commenter stated that the CAT NMS Plan does not provide
sufficient detail to allow for implementation planning.\1313\ Another
commenter argued that the CAT development milestones are unacceptable
because they do not promote the objective of facilitating improved
market surveillance.\1314\
---------------------------------------------------------------------------

    \1313\ FIF Letter at 43.
    \1314\ Data Boiler Letter at 17.
---------------------------------------------------------------------------

    Other commenters suggested extending the implementation schedule
for CAT.\1315\ One commenter suggested that there should be additional
time to reassess and more carefully tailor the schedules and milestones