issued guidance for cyber resilience for FMIs, including CSDs,
securities settlement systems (``SSSs''), CCPs, and trade
repositories. See CPMI-IOSCO, Guidance on cyber resilience for
financial market infrastructures (June 2016), available at https://www.iosco.org/library/pubdocs/pdf/IOSCOPD535.pdf; see also CPMI-
IOSCO, Implementation monitoring of the PFMI: Level 3 assessment on
Financial Market Infrastructures' Cyber Resilience (Nov. 2022),
available at https://www.iosco.org/library/pubdocs/pdf/IOSCOPD723.pdf (presenting the results of an assessment of the state
of cyber resilience (as of February 2021) of FMIs from 29
jurisdictions that participated in the exercise in 2020 to 2022).
---------------------------------------------------------------------------

h. SBS Entities
    The SBS Entities covered by the proposed rulemaking are SBSDs and
MSBSPs. An SBSD generally refers to any person who: (1) holds itself
out as a dealer in security-based swaps; (2) makes a market in
security-based swaps; (3) regularly enters into security-based swaps
with counterparties as an ordinary course of business for its own
account; or (4) engages in any activity causing it to be commonly known
in the trade as a dealer or market maker in security-based swaps.\107\
An SBSD does not, however, include a person that enters into security-
based swaps for such person's own account, either individually or in a
fiduciary capacity, but not as a part of regular business.\108\
---------------------------------------------------------------------------

    \107\ See 15 U.S.C. 78c(a)(71); 17 CFR 240.3a71-1 et seq.
    \108\ See 15 U.S.C. 78c(a)(71)(C); 17 CFR 240.3a71-1(b).
---------------------------------------------------------------------------

    An MSBSP generally includes any person that is not a security-based
swap dealer and that satisfies one of the following three alternative
statutory tests: (1) it maintains a ``substantial position'' in
security-based swaps, excluding positions held for hedging or
mitigating commercial risk and positions maintained by any employee
benefit plan (or any contract held by such a plan) for the primary
purpose of hedging or mitigating any risk directly associated with the
operation of the plan, for any of the major security-based swap
categories determined by the Commission; (2) its outstanding security-
based swaps create substantial counterparty exposure that could have
serious adverse effects on the financial stability of the U.S. banking
system or financial markets; or (3) it is a ``financial entity'' that
is ``highly leveraged'' relative to the amount of capital it holds (and
that is not subject to capital requirements by an appropriate federal
banking agency) and maintains a ``substantial position'' in outstanding
security-based swaps in any major category as determined by the
Commission.\109\ Currently, there are no MSBSPs registered with the
Commission.
---------------------------------------------------------------------------

    \109\ See 15 U.S.C. 78c(a)(67); 17 CFR 240.3a67-1 et seq.
---------------------------------------------------------------------------

    SBS Entities play (or, in the case of MSBSPs, could play) a
critical role in the U.S. security-based swap market.\110\ SBS Entities
rely on information systems to transact in security-based swaps with
other market participants, to receive and deliver collateral, to create
and maintain books and records, and to obtain market information to
update books and records, and manage risk.
---------------------------------------------------------------------------

    \110\ Currently, this role is fulfilled by SBSDs, given there
are no MSBSPs registered with the Commission.
---------------------------------------------------------------------------

    A disruption to an SBS Entity's operations caused by a significant
cybersecurity incident could have a large negative impact on the U.S.
security-based swap market given the concentration of dealers in this
market. Further, a disruption in the security-based swap market could
negatively impact the broader securities markets by, for example,
causing participants to liquidate positions related to, or referenced
by, the impacted security-based swaps to mitigate losses to
participants' positions or portfolios or due to loss of trading
confidence. A disruption in the security-based swap market also could
negatively impact the broader securities markets by causing
participants to liquidate the collateral margining the security-based
swaps for similar reasons or to cover margin calls. The consequences of
a business disruption to an SBS Entity's functions--such as those that
may be caused by a significant cybersecurity incident--may be amplified
because, unlike many other securities transactions, securities-based
swap transactions give rise to an ongoing obligation between
transaction counterparties during the life of the transaction.\111\
This means that each counterparty bears the risk of its counterparty's
ability to perform under the terms of a security-based swap until the
transaction is terminated. A disruption of an SBS Entity's normal
business activities because of a significant cybersecurity incident
could produce spillover or contagion by negatively affecting the
willingness or the ability of market participants to extend credit to
each other, and could substantially reduce liquidity and valuations for
particular types of financial instruments.\112\ The security-based swap
market is large \113\ and thus a disruption of an SBS Entity's
operations due to a significant cybersecurity incident could negatively
impact sectors of the U.S. economy.\114\
---------------------------------------------------------------------------

    \111\ See Further Definition of ``Swap Dealer,'' ``Security-
Based Swap Dealer,'' ``Major Swap Participant,'' ``Major Security-
Based Swap Participant'' and ``Eligible Contract Participant'',
Exchange Act Release No. 66868 (Apr. 27, 2012) [77 FR 30596, 30616-
17 (May 23, 2012)] (``Further Definition Release'') (noting that
``[i]n contrast to a secondary market transaction involving equity
or debt securities, in which the completion of a purchase or sale
transaction can be expected to terminate the mutual obligations of
the parties to the transaction, the parties to a security-based swap
often will have an ongoing obligation to exchange cash flows over
the life of the agreement'').
    \112\ See Cross-Border Security-Based Swap Activities; Re-
Proposal of Regulation SBSR and Certain Rules and Forms Relating to
the Registration of Security-Based Swap Dealers and Major Security-
Based Swap Participants, Exchange Act Release No. 69490 (May 1,
2013) [78 FR 30967, 30980-81 (May 23, 2013)] (``Cross-Border
Proposing Release'').
    \113\ See, e.g., Commission, Report on Security-Based Swaps
Pursuant to Section 13(m)(2) of the Securities Exchange Act of 1934
(July 15, 2022) available at https://www.sec.gov/files/report-on-security-based-swaps-071522.pdf.
    \114\ See Cross-Border Proposing Release, 78 FR at 30972 (``The
Dodd-Frank Act was enacted, among other reasons, to promote the
financial stability of the United States by improving accountability
and transparency in the financial system. The 2008 financial crisis
highlighted significant issues in the over-the-counter (`OTC')
derivatives markets, which . . . are capable of affecting
significant sectors of the U.S. economy.'') (footnotes omitted).
---------------------------------------------------------------------------

    Further, a significant cybersecurity incident at an SBS Entity
could provide a gateway for threat actors to attack the exchanges,
SBSDRs, clearing agencies, counterparties, and other SBS Entities to

which the firm is connected through information systems and networks of
interconnected information systems. Moreover, the information systems
that link SBS Entities to other Market Entities are vectors that expose
the SBS Entity to cybersecurity risk arising from threats that
originate in information systems outside the SBS Entity's control. SBS
Entities also store proprietary and confidential information about
their counterparties on their information systems, including financial
information they use to perform credit analysis. A significant
cybersecurity incident at an SBS Entity could lead to the improper use
of this information to harm the counterparties (e.g., public exposure
of confidential financial information) or provide the unauthorized user
with an unfair advantage over other market participants (e.g., trading
based on confidential business information).
i. Transfer Agents
    A transfer agent is any person who engages on behalf of an issuer
of securities or on behalf of itself as an issuer of securities in
(among other functions): (1) tracking, recording, and maintaining the
official record of ownership of each issuer's securities; (2) canceling
old certificates, issuing new ones, and performing other processing and
recordkeeping functions that facilitate the issuance, cancellation, and
transfer of those securities; (3) facilitating communications between
issuers and registered securityholders; and (4) making dividend,
principal, interest, and other distributions to securityholders.\115\
To perform these functions, transfer agents maintain records and
information related to securityholders that may include names,
addresses, phone numbers, email addresses, employers, employment
history, bank and specific account information, credit card
information, transaction histories, securities holdings, and other
detailed and individualized information related to the transfer agents'
recordkeeping and transaction processing on behalf of issuers. With
advances in technology and the expansion of book-entry ownership of
securities, transfer agents today increasingly rely on technology and
automation to perform the core recordkeeping, processing, and transfer
services described above, including the use of computer systems to
store, access, and process the information related to securityholders
they maintain on behalf of issuers. A significant cybersecurity
incident that impacts these systems could cause harm to investors by,
for example, preventing the transfer agent from transferring ownership
of securities or preventing investors from receiving dividend,
interest, or principal payments.
---------------------------------------------------------------------------

    \115\ See Transfer Agent Regulations, Exchange Act Release No.
76743 (Dec. 22, 2015) [80 FR 81948, 81949 (Dec. 31, 2015)].
---------------------------------------------------------------------------

    Further, a significant cybersecurity incident at a transfer agent
could provide a gateway for threat actors to attack other Market
Entities that connect to it through information systems and networks of
interconnected information systems. Moreover, the information systems
that link transfer agents to other Market Entities expose the transfer
agent to cybersecurity risk arising from threats that originate in
information systems outside the transfer agent's control. The records
stored by transfer agents on their information systems include
proprietary information about securities ownership and corporate
actions. A significant cybersecurity incident at a transfer agent could
lead to the improper use of this information to harm securities holders
(e.g., public exposure of their confidential financial information or
the use of that information to steal their identities) or provide the
unauthorized user with an unfair advantage over other market
participants (e.g., trading based on confidential business
information).

B. Overview of the Proposed Cybersecurity Requirements

    As discussed above, the U.S. securities markets are part of the
critical infrastructure of the United States.\116\ In this regard, they
play a central role in the U.S. economy in terms of facilitating the
flow of capital, including the savings of individual investors. The
fair, orderly, and efficient operation of the U.S. securities markets
depends on Market Entities being able to perform their critical
functions, and Market Entities are increasingly relying on information
systems and interconnected networks of information systems to perform
these functions. These information systems are targets of threat
actors. Moreover, Market Entities--as financial institutions--are
choice targets for threat actors seeking financial gain or to inflict
economic harm. Further, threat actors are using increasingly
sophisticated and constantly evolving tactics, techniques, and
procedures to attack information systems. In addition to threat actors,
cybersecurity risk also can be caused by the errors of employees,
service providers, or business partners. The interconnectedness of
Market Entities increases the risk that a significant cybersecurity
incident can simultaneously impact multiple Market Entities causing
harm to the U.S. securities markets.
---------------------------------------------------------------------------

    \116\ See section I.A. of this release (discussing cybersecurity
risk and how critical operations of Market Entities are exposed to
cybersecurity risk).
---------------------------------------------------------------------------

    For these reasons, it is critically important that Market Entities
take steps to protect their information systems and the information
residing on those systems from cybersecurity risk. A Market Entity that
fails to do so is more vulnerable to succumbing to a significant
cybersecurity incident. As discussed above, a significant cybersecurity
incident can cause serious harm not only to the Market Entity but also
to its customers, counterparties, members, registrants, or users, or to
any other market participants (including other Market Entities) that
interact with the Market Entity. Therefore, it is vital to the U.S.
securities markets and the participants in those markets that all
Market Entities address cybersecurity risk, which, as discussed above,
is increasingly threatening the financial sector.
    Consequently, the Commission is proposing new Rule 10 and new Form
SCIR to require that Market Entities address cybersecurity risks, to
improve the Commission's ability to obtain information about
significant cybersecurity incidents impacting Market Entities, and to
improve transparency about the cybersecurity risks that can cause
adverse impacts to the U.S. securities markets.\117\ Under proposed
Rule 10, certain broker-dealers, the MSRB, and all clearing agencies,
national securities associations, national securities exchanges,
SBSDRs, SBS Entities, and transfer agents would be defined as a
``covered entity'' (collectively, ``Covered Entities'').\118\
---------------------------------------------------------------------------

    \117\ In designing the requirements of proposed Rule 10, the
Commission considered several cybersecurity sources (which are cited
in the relevant sections below), including the NIST Framework, the
NIST Glossary, and CISA's Cyber Essentials Starter Kit (information
about CISA's Cyber Essentials Starter Kit is available at: https://www.cisa.gov/publication/cisa-cyber-essentials). The Commission also
considered definitions in relevant federal statutes including the
Federal Information Security Modernization Act of 2014, Public Law
113-283 (Dec. 18, 2014); 44 U.S.C. 3551 et seq. (``FISMA'') and the
Cyber Incident Reporting for Critical Infrastructure Act of 2022,
H.R. 2471, 117th Cong. (2021-2022); 6 U.S.C. 681 et seq.
(``CIRCIA'').
    \118\ The following broker-dealers would be Covered Entities:
(1) broker-dealers that maintain custody of securities and cash for
customers or other broker-dealers (``carrying broker-dealers''); (2)
broker-dealers that introduce their customer accounts to a carrying
broker-dealer on a fully disclosed basis (``introducing broker-
dealers''); (3) broker-dealers with regulatory capital equal to or
exceeding $50 million; (4) broker-dealers with total assets equal to
or exceeding $1 billion; (5) broker-dealers that operate as market
makers; and (6) broker-dealers that operate an ATS (sometimes
collectively referred to as ``Covered Broker-Dealers''). Broker-
dealers that do not fall into one of these six categories (sometimes
collectively referred to as ``Non-Covered Entities'' or ``Non-
Covered Broker-Dealers'') would not be Covered Entities for the
purposes of proposed Rule 10. See also section II.A.1.b. of this
release (discussing the categories of broker-dealers that would be
``Covered Entities'' in greater detail).

---------------------------------------------------------------------------

    Proposed Rule 10 would require all Market Entities (Covered
Entities and Non-Covered Entities) to establish, maintain, and enforce
written policies and procedures that are reasonably designed to address
their cybersecurity risks.\119\ All Market Entities also, at least
annually, would be required to review and assess the design and
effectiveness of their cybersecurity policies and procedures, including
whether the policies and procedures reflect changes in cybersecurity
risk over the time period covered by the review.\120\ They also would
be required to prepare a report (in the case of Covered Entities) and a
record (in the case of Non-Covered Entities) with respect to the annual
review. CISA states that organizations should ``approach cyber as
business risk.'' \121\ Like other business risks (e.g., market, credit,
or liquidity risk), cybersecurity risk can be addressed through
policies and procedures that are reasonably designed to manage the
risk. Finally, all Market Entities would need to give the Commission
immediate written electronic notice of a significant cybersecurity
incident upon having a reasonable basis to conclude that the
significant cybersecurity incident has occurred or is occurring.\122\
---------------------------------------------------------------------------

    \119\ See paragraphs (b) through (d) of proposed Rule 10
(setting forth the requirements for Market Entities that meet the
definition of ``covered entity''); paragraph (e)(1) of proposed Rule
10 (setting forth the requirements for Market Entities that are not
Covered Entities (i.e., Non-Covered Broker-Dealers)). See also
sections II.B.1. and II.C. of this release (discussing these
proposed requirements in more detail). As discussed in sections
II.F. and IV.C.1.b. of this release, certain categories of Market
Entities are subject to existing requirements to address aspects of
cybersecurity risk or that may relate to cybersecurity. These other
requirements, however, do not address cybersecurity risk as
directly, broadly, or comprehensively as the requirements of
proposed Rule 10.
    \120\ See paragraph (b)(2) of proposed Rule 10; paragraph (e)(1)
of proposed Rule 10. See also sections II.B.1.f. and II.C. of this
release (discussing these proposed requirements in more detail).
    \121\ See CISA Cyber Essentials Starter Kit (``Ask yourself what
type of impact would be catastrophic to your operations? What
information if compromised or breached would cause damage to
employees, customers, or business partners? What is your level of
risk appetite and risk tolerance? Raising the level of awareness
helps reinforce the culture of making informed decisions and
understanding the level of risk to the organization.'').
    \122\ See paragraph (c)(1) of proposed Rule 10; paragraph (e)(2)
of proposed Rule 10. See also sections II.B.2.a. and II.C. of this
release (discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

    Market Entities that meet the definition of ``covered entity''
would be subject to certain additional requirements under proposed Rule
10.\123\ First, as discussed in more detail below, the written policies
and procedures that Covered Entities would need to establish, maintain,
and enforce would need to include the following elements:
---------------------------------------------------------------------------

    \123\ Compare paragraphs (b) through (d) of proposed Rule 10
(setting forth the requirements for Covered Entities), with
paragraph (e) of proposed Rule 10 (setting forth the requirements
for Non-Covered Entities).
---------------------------------------------------------------------------

     Periodic assessments of cybersecurity risks associated
with the Covered Entity's information systems and written documentation
of the risk assessments;
     Controls designed to minimize user-related risks and
prevent unauthorized access to the Covered Entity's information
systems;
     Measures designed to monitor the Covered Entity's
information systems and protect the Covered Entity's information from
unauthorized access or use, and oversee service providers that receive,
maintain, or process information, or are otherwise permitted to access
the Covered Entity's information systems;
     Measures to detect, mitigate, and remediate any
cybersecurity threats and vulnerabilities with respect to the Covered
Entity's information systems; and
     Measures to detect, respond to, and recover from a
cybersecurity incident and written documentation of any cybersecurity
incident and the response to and recovery from the incident.\124\
---------------------------------------------------------------------------

    \124\ See sections II.B.1.a. through II.B.1.e. of this release
(discussing these proposed requirements in more detail). In the case
of Non-Covered Entities, as discussed in more detail below in
section II.C. of this release, the design of the cybersecurity risk
management policies and procedures would need to take into account
the size, business, and operations of the broker-dealer. See
paragraph (e) of proposed Rule 10.
---------------------------------------------------------------------------

    Second, Covered Entities--in addition to providing the Commission
with immediate written electronic notice of a significant cybersecurity
incident--would need to report and update information about the
significant cybersecurity incident by filing Part I of proposed Form
SCIR with the Commission.\125\ The form would elicit information about
the significant cybersecurity incident and the Covered Entity's efforts
to respond to, and recover from, the incident.
---------------------------------------------------------------------------

    \125\ See sections II.B.2. and II.B.4. of this release
(discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

    Third, Covered Entities would need to disclose publicly summary
descriptions of their cybersecurity risks and the significant
cybersecurity incidents they experienced during the current or previous
calendar year on Part II of proposed Form SCIR.\126\ The form would
need to be filed with the Commission and posted on the Covered Entity's
business internet website. Covered Entities that are carrying or
introducing broker-dealers also would need to provide the form to
customers at account opening, when information on the form is updated,
and annually.
---------------------------------------------------------------------------

    \126\ See sections II.B.3. and II.B.4.of this release
(discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

    Covered Entities and Non-Covered Entities would need to preserve
certain records relating to the requirements of proposed Rule 10 in
accordance with amended or existing recordkeeping requirements
applicable to them or, in the case of exempt clearing agencies,
pursuant to conditions in relevant exemption orders.\127\
---------------------------------------------------------------------------

    \127\ See sections II.B.5. and II.C. of this release (discussing
these proposed requirements in more detail).
---------------------------------------------------------------------------

    Finally, the Commission is proposing amendments to address the
potential availability of substituted compliance to non-U.S. SBS
Entities with respect to the proposed cybersecurity requirements.\128\
---------------------------------------------------------------------------

    \128\ See sections II.D. of this release (discussing these
proposed amendments in more detail).
---------------------------------------------------------------------------

    In developing the proposed requirements summarized above with
regard to SBSDRs and SBS Entities, the Commission consulted and
coordinated with the CFTC and the prudential regulators in accordance
with section 712(a)(2) of Title VII of the Dodd-Frank Act. In
accordance with section 752 of Title VII of the Dodd-Frank Act, the
Commission has consulted and coordinated with foreign regulatory
authorities through Commission staff participation in numerous
bilateral and multilateral discussions with foreign regulatory
authorities addressing the regulation of OTC derivatives markets.

II. Discussion of Proposed Cybersecurity Rule

A. Definitions

    Proposed Rule 10 would define a number of terms for the purposes of
its requirements.\129\ These definitions also would be used for the
purposes of Parts

I and II of proposed Form SCIR.\130\ The defined terms are intended to
tailor the risk management, notification, reporting, and disclosure
requirements of proposed Rule 10 to the distinctive aspects of
cybersecurity risk as compared with other risks Market Entities face
(e.g., market, credit, or liquidity risk).\131\
---------------------------------------------------------------------------

    \129\ See paragraph (a) of proposed Rule 10.
    \130\ See sections II.B.2. and II.B.3. of this release
(discussing Parts I and II of proposed Form SCIR in more detail).
    \131\ See paragraphs (a)(2) through (9) of proposed Rule 10
(defining, respectively, the terms ``cybersecurity incident,''
``cybersecurity risk,'' ``cybersecurity threat,'' ``cybersecurity
vulnerability,'' ``information,'' ``information systems,''
``personal information,'' and ``significant cybersecurity
incident'').
---------------------------------------------------------------------------

1. ``Covered Entity''
a. Market Entities That Meet the Definition of ``Covered Entity'' Would
Be Subject to Additional Requirements
    Proposed Rule 10 would define the term ``covered entity'' to
identify the types of Market Entities that would be subject to certain
additional requirements under the rule.\132\ As discussed above,
proposed Rule 10 would require all Market Entities to establish,
maintain, and enforce written policies and procedures that are
reasonably designed to address their cybersecurity risks.\133\ All
Market Entities also, at least annually, would be required to review
and assess the design and effectiveness of their cybersecurity risk
management policies and procedures, including whether the policies and
procedures reflect changes in cybersecurity risk over the time period
covered by the review.\134\ They also would be required to prepare a
report (in the case of Covered Entities) or a record (in the case of
Non-Covered Entities) with respect to the annual review. Further, all
Market Entities would need to give the Commission immediate written
electronic notice of a significant cybersecurity incident upon having a
reasonable basis to conclude that the significant cybersecurity
incident has occurred or is occurring.\135\ As discussed above, Market
Entities use information systems that expose them to cybersecurity risk
and that risk is increasing due to the interconnectedness of the
information systems and the sophistication of the tactics used by
threat actors. Therefore, regardless of their function,
interconnectedness, or size, all Market Entities would be subject to
these requirements designed to address cybersecurity risks.
---------------------------------------------------------------------------

    \132\ See paragraphs (a)(1)(i) through (ix) of proposed Rule 10
(defining these Market Entities as ``covered entities''). A Market
Entity that falls within the definition of ``covered entity'' for
purposes of proposed Rule 10 may not necessarily meet the definition
of a ``covered entity'' for purposes of certain federal statutes,
such as, but not limited to, CIRCIA and any regulations promulgated
thereunder. CIRCIA, among other things, requires the Director of
CISA to issue and implement regulations defining the term ``covered
entity'' and requiring covered entities to report covered cyber
incidents and ransom payments as the result of ransomware attacks to
CISA in certain instances.
    \133\ See paragraph (b)(1) of proposed Rule 10 (setting forth
the requirement for Market Entities that meet the definition of
``covered entity''); paragraph (e)(1) of proposed Rule 10 (setting
forth the requirement for Market Entities that do not meet the
definition of ``covered entity,'' which, as discussed above, would
be certain smaller broker-dealers).
    \134\ See paragraph (b)(2) of proposed Rule 10; paragraph (e)(1)
of proposed Rule 10.
    \135\ See paragraph (c)(1) of proposed Rule 10 (setting forth
the requirement for Market Entities that meet the definition of
``covered entity''); paragraph (e)(2) of proposed Rule 10 (setting
forth the requirement for Market Entities that do not meet the
definition of ``covered entity'').
---------------------------------------------------------------------------

    Market Entities that are Covered Entities would be subject to
certain additional requirements under proposed Rule 10.\136\ In
particular, they would be required to: (1) include certain elements in
their cybersecurity risk management policies and procedures; \137\ (2)
file Part I of proposed Form SCIR with the Commission and, for some
Covered Entities, other regulators to report information about a
significant cybersecurity incident; \138\ and (3) make public
disclosures on Part II of proposed Form SCIR about their cybersecurity
risks and the significant cybersecurity incidents they experienced
during the current or previous calendar year.\139\
---------------------------------------------------------------------------

    \136\ See paragraphs (b) through (d) of proposed Rule 10
(setting forth the requirements for Covered Entities); paragraph (e)
of proposed Rule 10 (setting forth the requirements for Non-Covered
Entities). As discussed above, Covered Entities would need to
prepare a report with respect to their review and assessment of the
policies and procedures. See paragraph (b)(2) of proposed Rule 10.
Non-Covered Entities would need to make a record with the respect to
the annual review and assessment of their policies and procedures.
See paragraph (e) of proposed Rule 10.
    \137\ See paragraphs (b)(1)(i) through (v) of proposed Rule 10.
    \138\ See paragraph (c)(2) of proposed Rule 10. See also
paragraph (a)(10) of proposed Rule 10 (defining the term
``significant cybersecurity risk'').
    \139\ See paragraph (d) of proposed Rule 10.
---------------------------------------------------------------------------

    In determining which Market Entities would be Covered Entities
subject to the additional requirements, the Commission considered: (1)
how the type of Market Entity supports the fair, orderly, and efficient
operation of the U.S. securities markets and the consequences if that
type of Market Entity's critical functions were disrupted or degraded
by a significant cybersecurity incident; (2) the harm that could befall
investors, including retail investors, if that type of Market Entity's
functions were disrupted or degraded by a significant cybersecurity
incident; (3) the extent to which that type of Market Entity poses
cybersecurity risk to other Market Entities through information system
connections, including the number of connections; (4) the extent to
which the that type of Market Entity would be an attractive target for
threat actors; and (5) the personal, confidential, and proprietary
business information about the type of Market Entity and other persons
(e.g., investors) stored on the Market Entity's information systems and
the harm that could be caused if that information was accessed or used
by threat actors.
b. Broker-Dealers
    The following broker-dealers registered with the Commission would
be Covered Entities: (1) broker-dealers that maintain custody of
securities and cash for customers or other broker-dealers (i.e.,
carrying broker-dealers); (2) broker-dealers that introduce their
customers' accounts to a carrying broker-dealer on a fully disclosed
basis (i.e., introducing broker-dealers); \140\ (3) broker-dealers with
regulatory capital equal to or exceeding $50 million; (4) broker-
dealers with total assets equal to or exceeding $1 billion; (5) broker-
dealers that operate as market makers; and (6) broker-dealers that
operate an ATS. Thus, under proposed Rule 10, these six categories of
broker-dealers would be subject to the additional requirements.\141\
All other types of

broker-dealers would not meet the definition of Covered Entity.\142\
---------------------------------------------------------------------------

    \140\ When a broker-dealer introduces a customer to a carrying
broker-dealer on a fully disclosed basis, the carrying broker-dealer
knows the identity of the customer and holds cash and securities in
an account for the customer that identifies the customer as the
accountholder. This is distinguishable from a broker-dealer that
introduces its customers to another carrying broker-dealer on an
omnibus basis. In this scenario, the carrying broker-dealer does not
know the identities of the customers and holds their cash and
securities in an account that identifies the broker-dealer
introducing the customers on an omnibus basis as the accountholder.
A broker-dealer that introduces customers to another broker-dealer
on an omnibus basis is, itself, a carrying broker-dealer for
purposes of the Commission's financial responsibility rules,
including, the broker-dealer net capital and customer protection
rules. See, e.g., 17 CFR 240.15c3-1 and 17 CFR 240.15c3-3. This
category of broker-dealer would be a carrying broker-dealer for
purposes of proposed Rule 10 and therefore subject to the rule's
requirements for Covered Entities.
    \141\ See paragraphs (a)(1)(i)(A) through (F) of proposed Rule
10. Certain of the definitions in proposed Rule 10 would be used for
the purposes of the requirements in the rule for broker-dealers that
are not Covered Entities. Specifically, paragraph (e)(1) of proposed
Rule 10 would require broker-dealers that are not Covered Entities
to establish, maintain, and enforce written policies and procedures
that are reasonably designed to address the cybersecurity risks of
the broker-dealer taking into account the size, business, and
operations of the broker-dealer. The term ``cybersecurity risk'' is
defined in paragraph (a)(3) of proposed Rule 10 and that definition
incorporates the terms ``cybersecurity incident,'' ``cybersecurity
threat,'' and ``cybersecurity vulnerability,'' which are defined,
respectively, in paragraphs (a)(2), (a)(4), and (a)(5) of proposed
Rule 10. In addition, paragraph (e)(2) of proposed Rule 10 would
require broker-dealers that are not Covered Entities to provide
immediate written electronic notice to the Commission and their
examining authority if they experience a ``significant cybersecurity
incident'' as that term is defined in the rule. Therefore, paragraph
(a)(8) of proposed Rule 10 would define the term ``market entity''
to mean a Covered Entity and a broker-dealer registered with the
Commission that is not a Covered Entity. Further, the definitions in
proposed Rule 10 would refer to ``market entities'' (rather than
``covered entities'') in order to not limit the application of these
definitions to paragraphs (b) through (d) of proposed Rule 10, which
set forth the requirements for Covered Entities (but not for Non-
Covered Entities).
    \142\ As discussed below in section IV.C.2. of this release, of
the 3,510 broker-dealers registered with the Commission as of the
third quarter of 2022, 1,541 would meet the definition of ``covered
entity'' under proposed Rule 10, leaving 1,969 broker-dealers as
Non-Covered Entities.
---------------------------------------------------------------------------

    The first category of broker-dealers included as Covered Entities
would be carrying broker-dealers. Specifically, proposed Rule 10 would
define ``covered entity'' to include any broker-dealer that maintains
custody of cash and securities for customers or other broker-dealers
and is not exempt from the requirements of Exchange Act Rule 15c3-3
(i.e., a carrying broker-dealer).\143\ Some carrying broker-dealers are
large in terms of their assets and dealing activities or the number of
their accountholders. For example, they may engage in a variety of
order handling, trading, and/or clearing activities, and thereby play a
significant role in U.S. securities markets, often through multiple
business lines and/or in multiple asset classes. Consequently, if their
critical functions were disrupted or degraded by a significant
cybersecurity incident it could have a potential negative impact on the
U.S. securities markets by, for example, reducing liquidity in the
markets or sectors of the markets due to the firm's inability to
continue dealing and trading activities. A broker-dealer in this
situation could lose its ability to provide liquidity to other market
participants for an indeterminate length of time, which could lead to
unfavorable market conditions for investors, such as higher buy prices
and lower sell prices or even the inability to execute a trade within a
reasonable amount of time. Further, some carrying broker-dealers hold
millions of accounts for investors. If a significant cybersecurity
incident prevented this investor-base from accessing the securities
markets, it could impact liquidity as well.
---------------------------------------------------------------------------

    \143\ See paragraph (a)(1)(i)(A) of proposed Rule 10. See also
17 CFR 240.15c3-3 (``Rule 15c3-3''). Rule 15c3-3 sets forth
requirements for broker-dealers that maintain custody of customer
securities and cash that are designed to protect those assets and
ensure their prompt return to the customers.
---------------------------------------------------------------------------

    Also, the dealing activities of carrying broker-dealers may make
them attractive targets for threat actors seeking to access proprietary
and confidential information about the broker-dealer's trading
positions and strategies to use for financial advantage. In addition,
the size and financial resources of carrying broker-dealers may make
them attractive targets for threat actors employing ransomware schemes.
    Because carrying broker-dealers hold cash and securities for
customers and other broker-dealers, a significant cybersecurity
incident could put these assets in peril or make them unavailable. For
example, a significant cybersecurity incident could cause harm to the
investors that own these assets--including retail investors--if it
causes the investors to lose access to their securities accounts (and,
therefore, the ability to purchase or sell securities), causes the
failure of the carrying broker-dealer (which could tie up the assets in
a liquidation proceeding under the Securities Investor Protection Act),
or, in the worst case, results in the assets being stolen. The fact
that carrying broker-dealers hold cash and securities for investors
also may make them attractive targets for threat actors seeking to
steal those assets through hacking the accounts or using stolen
credentials and log-in information. In addition, carrying broker-
dealers with large numbers of customers might be attractive targets for
threat actors because of the volume of personal information they
maintain. Threat actors may seek to access and download this
information in order to sell it to other threat actors. If this
information is accessed or stolen by threat actors, it could result in
harm (e.g., identity theft or conversion of financial assets) to many
individuals, including retail investors. Carrying broker-dealers
typically are connected to a number of different Market Entities
through information systems, including national securities exchanges,
clearing agencies, and other broker-dealers (including introducing
broker-dealers).
    The second category of broker-dealers included as Covered Entities
would be introducing broker-dealers.\144\ These broker-dealers
introduce customer accounts on a fully disclosed basis to a carrying
broker-dealer. In this arrangement, the carrying broker-dealer knows
the identities of the fully disclosed customers and maintains custody
of their securities and cash. The introducing broker-dealer typically
interacts directly with the customers by, for example, making
securities recommendations and accepting their orders to purchase or
sell securities. An introducing broker-dealer must enter into an
agreement with a carrying broker-dealer to which it introduces customer
accounts on a fully disclosed basis.\145\
---------------------------------------------------------------------------

    \144\ See paragraph (a)(1)(i)(B) of proposed Rule 10.
    \145\ See FINRA Rule 4311. Pursuant to FINRA requirements, the
carrying agreement must specify the responsibilities of the carrying
broker-dealer and the introducing broker-dealer, including, at a
minimum, the responsibilities for: (1) opening and approving
accounts; (2) accepting of orders; (3) transmitting of orders for
execution; (4) executing of orders; (5) extending credit; (6)
receiving and delivering of funds and securities; (7) preparing and
transmitting confirmations; (8) maintaining books and records; and
(9) monitoring of accounts. See FINRA Rule 4311(c)(1).
---------------------------------------------------------------------------

    These broker-dealers would be included as Covered Entities because
they are a conduit to their customers' accounts at the carrying broker-
dealer and have access to information and trading systems of the
carrying broker-dealer. Consequently, a significant cybersecurity
incident could harm their customers to the extent it causes the
customers to lose access to their securities accounts at the carrying
broker-dealer. Further, a significant cybersecurity incident at an
introducing broker-dealer could spread to the carrying broker-dealer
given the information systems that connect the two firms. These
connections also may make introducing broker-dealers attractive targets
for threat actors seeking to access the information systems of the
carrying broker-dealer to which the introducing broker-dealer is
connected.
    In addition, introducing broker-dealers may store personal
information about their customers on their information systems or be
able to access this information on the carrying broker-dealer's
information systems. The fact that they store this information also may
make them attractive targets for threat actors seeking to use the
information to steal identities or assets, or to sell the personal
information to other bad actors who will seek to use it for these
purposes.
    The third category of broker-dealers included as Covered Entities
would be broker-dealers that have regulatory capital equal to or
exceeding $50 million.\146\ Regulatory capital is the total capital of
the broker-dealer plus allowable subordinated liabilities of the
broker-dealer and is reported on the FOCUS reports broker-dealers file

pursuant to Rule 17a-5.\147\ The fourth category would be a broker-
dealer with total assets equal to or exceeding $1 billion.\148\ The $50
million and $1 billion thresholds are modeled on the thresholds that
trigger enhanced recordkeeping and reporting requirements for certain
broker-dealers pursuant to Exchange Act Rules 17h-1T and 17h-2T.\149\
---------------------------------------------------------------------------

    \146\ See paragraph (a)(1)(i)(C) of proposed Rule 10.
    \147\ See 17 CFR 240.17a-5; Form X-17A-5, Line Item 3550.
    \148\ See paragraph (a)(1)(i)(D) of proposed Rule 10.
    \149\ See 17 CFR 240.17h-1T and 17h-1T. See also Order Under
Section 17(h)(4) of the Securities Exchange Act of 1934 Granting
Exemption from Rule 17h-1T and Rule 17h-2T for Certain Broker-
Dealers Maintaining Capital, Including Subordinated Debt of Greater
Than $20 Million But Less Than $50 Million, Exchange Act Release No.
89184 (June 29, 2020) [85 FR 40356 (July 6, 2020)] (``17h Release'')
(setting forth the $50 million and $1 billion thresholds).
---------------------------------------------------------------------------

    These thresholds are designed to include as Covered Entities
broker-dealers that are large in terms of their assets and dealing
activities (and that would not otherwise be Covered Broker-Dealers
under the definitions in proposed Rule 10).\150\ For example, larger
broker-dealers that exceed these thresholds often engage in proprietary
trading (including high frequency trading) and are sources of liquidity
in certain securities. Consequently, if their critical functions were
disrupted or degraded by a significant cybersecurity incident it could
have a potential negative impact on those securities markets if it
reduces liquidity in the markets through the inability to continue
dealing and trading activities. For example, a broker-dealer in this
situation could lose its ability to provide liquidity to other market
participants for an indeterminate length of time, which could lead to
unfavorable market conditions for investors, such as higher buy prices
and lower sell prices or even the ability to execute a trade within a
reasonable amount of time.
---------------------------------------------------------------------------

    \150\ Size has been recognized as a proxy for substantial market
activity relative to other registrants of the same type and
therefore a firm's relative risk to the financial markets. See 17h
Release (noting that broker-dealers that have less than $50 million
in regulatory capital and less than $1 billion in total assets are
``relatively small in size,'' and ``because of their relative size''
and to the extent they are not carrying firms, these entities
``present less risk to the financial markets,'' while stating that
with respect to broker-dealers with at least $50 million in
regulatory capital or at least $1 billion in total assets ``the
Commission believes . . . those broker-dealers . . . pose greater
risk to the financial markets, investors, and other market
participants'').
---------------------------------------------------------------------------

    In addition, the size and dealing activities of these broker-
dealers could make them attractive targets for threat actors seeking to
access proprietary and confidential information about the broker-
dealer's trading positions and strategies to use for financial
advantage. This also may make them attractive targets for threat actors
employing ransomware schemes. Further, given their size and trading
activities, these broker-dealers may be connected to a number of
different Market Entities through information systems, including
national securities exchanges, clearing agencies, other broker-dealers,
and ATSs.
    The fifth category of broker-dealers included as Covered Entities
would be broker-dealers that operate as market makers. Specifically,
proposed Rule 10 would define ``covered entity'' to include a broker-
dealer that operates as a market maker under the Exchange Act or the
rules thereunder (which includes a broker-dealer that operates pursuant
to Exchange Act Rule 15c3-1(a)(6)) or is a market maker under the rules
of an SRO of which the broker-dealer is a member.\151\ The proposed
rule's definition of ``market maker'' is tied to securities laws that
confer benefits or impose requirements on market makers and,
consequently, covers broker-dealers that take advantage of those
benefits or are subject to those requirements. The objective is to rely
on these other securities laws to define a market maker rather than set
forth a new definition of ``market maker'' in proposed Rule 10, which
could conflict with these other laws.
---------------------------------------------------------------------------

    \151\ See paragraph (a)(1)(i)(E) of proposed Rule 10. See also
17 CFR 240.15c3-1 (``Rule 15c3-1''). Paragraph (a)(6) of Rule 15c3-1
permits a market maker to avoid taking capital charges for its
proprietary positions provided, among other things, its carrying
firm takes the capital charges instead. See also, e.g., Rule 103 of
the New York Stock Exchange (setting forth requirements for
Designated Market Makers and Designated Market Maker Units).
---------------------------------------------------------------------------

    Market makers would be included as Covered Entities because
disruptions to their operations caused by a significant cybersecurity
incident could have a material impact on the fair, orderly, and
efficient functioning of the U.S. securities markets. For example, a
significant cybersecurity incident could imperil a market maker's
operations and ability to facilitate transactions in particular
securities between buyers and sellers. In addition, market makers
typically are connected to a number of different Market Entities
through information systems, including national securities exchanges
and other broker-dealers.
    The sixth category of broker-dealers included as Covered Entities
would be broker-dealers that operate an ATS.\152\ Since Regulation ATS
was adopted in 1998, ATSs have become increasingly important venues for
trading securities in a fast and automated manner. ATSs perform
exchange-like functions such as offering limit order books and other
order types. These developments have made ATSs significant sources of
orders and trading interest for securities. ATSs use data feeds,
algorithms, and connectivity to perform these functions. ATSs rely
heavily on information systems to perform these functions, including to
connect to other Market Entities such as broker-dealers and principal
trading firms.
---------------------------------------------------------------------------

    \152\ See paragraph (a)(1)(i)(F) of proposed Rule 10.
---------------------------------------------------------------------------

    A significant cybersecurity incident that disrupts an ATS could
negatively impact the ability of investors to liquidate or purchase
certain securities at favorable or predictable prices or in a timely
manner to the extent it provides liquidity to the market for those
securities. Further, a significant cybersecurity incident at an ATS
could provide a gateway for threat actors to attack other Market
Entities that connect to it through information systems and networks of
interconnected information systems. In addition, ATSs are connected to
a number of different Market Entities through information systems,
including national securities exchanges and other broker-dealers.
Finally, the records stored by ATSs on their information systems
include proprietary information about the Market Entities that use
their services, including confidential business information (e.g.,
information about their trading activities).
    For the foregoing reasons, the categories of broker-dealers
discussed above would be Covered Entities under proposed Rule 10. All
other categories of broker-dealers would be Non-Covered Entities.
    Generally, the types of broker-dealers that would be Non-Covered
Entities under proposed Rule 10 are smaller firms whose functions do
not play as significant a role in promoting the fair, orderly, and
efficient operation of the U.S. securities markets, as compared to
broker-dealers that would be Covered Entities.\153\ For example, they
tend to offer a more focused and limited set of services such as
facilitating private placements of securities, selling mutual funds and
variable contracts, underwriting securities, and participating in
direct investment

offerings.\154\ Further, they do not act as custodians for customer
securities and cash or serve as a conduit (i.e., an introducing broker-
dealer) for customers to access their accounts at a carrying broker-
dealer that does maintain custody of securities and cash. Therefore,
they do not pose the risk that a significant cybersecurity incident
could lead to investors losing access to their securities or cash or
having those assets stolen. In addition, Non-Covered Broker-Dealers
likely are less connected to other Market Participants through
information systems than Covered Broker-Dealers. For these reasons, the
additional policies and procedures, reporting, and disclosure
requirements would not apply to Non-Covered Broker-Dealers.
---------------------------------------------------------------------------

    \153\ For example, as discussed below in section IV.C.2. of this
release, the 1,541 broker-dealers that would be Covered Entities had
average total assets of $3.5 billion and average regulatory equity
of $325 million; whereas the 1,969 that would be Non-Covered
Entities had average total assets of $4.7 million and average
regulatory equity of $3 million. This means that Non-Covered Broker-
Dealers under proposed Rule 10 accounted for about 0.2% of the total
assets of all broker-dealers and 0.1% of total capital for all
broker-dealers.
    \154\ See section IV.C.2. of this release (discussing the
activities of broker-dealers that would not meet the definition of
``covered entity'' in proposed Rule 10).
---------------------------------------------------------------------------

    At the same time, Non-Covered Broker-Dealers are part of the
financial sector and exposed to cybersecurity risk. Further, certain
Non-Covered Broker-Dealers maintain personal information about their
customers that if accessed by threat actors or mistakenly exposed to
unauthorized users could result in harm to the customers. For these
reasons, Non-Covered Broker-Dealers--among other things--would be
required under proposed Rule 10 to: (1) establish, maintain, and
enforce written policies and procedures that are reasonably designed to
address their cybersecurity risks taking into account their size,
business, and operations; (2) review and assess the design and
effectiveness of their cybersecurity policies and procedures annually,
including whether the policies and procedures reflect changes in
cybersecurity risk over the time period covered by the review; (3) make
a written record that documents the steps taken in performing the
annual review and the conclusions of the annual review; and (4) give
the Commission and their examining authority immediate written
electronic notice of a significant cybersecurity incident upon having a
reasonable basis to conclude that the significant cybersecurity
incident has occurred or is occurring.\155\ The Commission's objective
in proposing Rule 10 is to address the cybersecurity risks faced by all
Market Entities but apply a more limited set of requirements to Non-
Covered Broker-Dealers commensurate with the level of risk they pose to
investors, the U.S. securities markets, and the U.S. financial sector
more generally.
---------------------------------------------------------------------------

    \155\ See section II.C. of this release (discussing the
requirements for these broker-dealers in more detail).
---------------------------------------------------------------------------

c. Market Entities Other Than Broker-Dealers
    The MSRB and all clearing agencies, national securities
associations, national securities exchanges, SBSDRs, SBS Entities,\156\
and transfer agents would be Covered Entities and, therefore, subject
to the additional requirements regarding the minimum elements that must
be included in their cybersecurity risk management policies and
procedures, reporting, and public disclosure.\157\ In particular,
proposed Rule 10 would define Covered Entity to include: (1) a clearing
agency (registered or exempt) under section 3(a)(23)(A) of the Exchange
Act; \158\ (2) an MSBSP that is registered pursuant to section 15F(b)
of the Exchange Act; \159\ (3) the Municipal Securities Rulemaking
Board; \160\ (4) a national securities association under section 15A of
the Exchange Act; \161\ (5) a national securities exchange under
section 6 of the Exchange Act; \162\ (6) a security-based swap data
repository under section 3(a)(75) of the Exchange Act; \163\ (7) a
security-based swap dealer that is registered pursuant to section
15F(b) of the Exchange Act; \164\ and (8) a transfer agent as defined
in section 3(a)(25) of the Exchange Act that is registered or required
to be registered with an appropriate regulatory agency (``ARA'') as
defined in section 3(a)(34)(B) of the Exchange Act.\165\
---------------------------------------------------------------------------

    \156\ In addition to the requirements proposed in Rule 10
itself, the scope of certain existing regulations applicable to SBS
Entities would include proposed Rule 10 if adopted; see, e.g., 17
CFR 240.15Fk-1(b)(2)(i) (which establishes the scope of specified
chief compliance officer duties by reference to Section 15F of the
Exchange Act (15 U.S.C. 78o-10) and the rules and regulations
thereunder); 17 CFR 240.15Fh-3(h)(2)(iii)(I) (which establishes the
scope of specified supervisory requirements by reference to Section
15F(j) of the Exchange Act (15 U.S.C. 78o-10(j)).
    \157\ See paragraphs (a)(1)(ii) through (ix) of proposed Rule 10
(defining these Market Entities as ``covered entities'').
    \158\ See paragraph (a)(1)(ii) of proposed Rule 10. See also 15
U.S.C. 78c(a)(23)(A) (defining the term ``clearing agency'').
    \159\ See paragraph (a)(1)(iii) of proposed Rule 10. See also 15
U.S.C. 78o-10(b). Registered MSBSPs include both MSBSPs that are
conditionally registered pursuant to paragraph (d) of Exchange Act
Rule 15Fb2-1 (``Rule 15Fb2-1'') (17 CFR 240.15Fb2-1) and MSBSPs that
have been granted ongoing registration pursuant to paragraph (e) of
Rule 15Fb2-1.
    \160\ See paragraph (a)(1)(iv) of proposed Rule 10.
    \161\ See paragraph (a)(1)(v) of proposed Rule 10. See also 15
U.S.C. 78o-3.
    \162\ See paragraph (a)(1)(vi) of proposed Rule 10. See also 15
U.S.C. 78f.
    \163\ See paragraph (a)(1)(vii) of proposed Rule 10.
    \164\ See paragraph (a)(1)(viii) of proposed Rule 10. See also
15 U.S.C. 78o-10(b). Registered SBSDs include both SBSDs that are
conditionally registered pursuant to paragraph (d) of Rule 15Fb2-1
and SBSDs that have been granted ongoing registration pursuant to
paragraph (e) of Rule 15Fb2-1.
    \165\ See paragraph (a)(1)(ix) of proposed Rule 10. See also 15
U.S.C. 78q-1(c)(1) (registration requirements for transfer agents);
15 U.S.C. 78c(a)(25) (definition of transfer agent) and (a)(34)(B)
(definition of appropriate regulatory agency).
---------------------------------------------------------------------------

    SROs play a critical role in setting and enforcing rules for their
members or registrants that govern trading, fair access, transparency,
operations, and business conduct, among other things. SROs and SBSDRs
also play a critical role in ensuring fairness in the securities
markets through the transparency they provide about securities
transactions and pricing, and the information about securities
transactions they can provide to regulators. National securities
exchanges play a critical role in ensuring the orderly and efficient
operation of the U.S. securities markets through the marketplaces they
operate. Clearing agencies are critical to the orderly and efficient
operation of the U.S. securities markets through the centralized
clearing and settlement services they provide as well as their role as
securities depositories, with exempt clearing agencies serving an
important role as part of this process. Market liquidity is critical to
the orderly and efficient operation of the U.S. securities markets. In
this regard, SBS Entities play a critical role in providing liquidity
to the security-based swap market.
    The disruption or degradation of the functions of an SRO (including
functions that support securities marketplaces and the oversight of
market participants) could cause harm to investors to the extent it
negatively impacted the fair, orderly, and efficient operations of the
U.S. securities markets. For example, it could prevent investors from
purchasing or selling securities or doing so at fair or reasonable
prices. Investors also would face harm if a transfer agent's functions
were disrupted or degraded by a significant cybersecurity incident.
Transfer agents provide services such as stockholder recordkeeping,
processing of securities transactions and corporate actions, and paying
agent activities. Their core recordkeeping systems provide a direct
conduit to their issuer clients' master records that document and, in
many instances provide the legal underpinning for, registered
securityholders' ownership of the issuer's securities. If these
functions were disrupted, investors might not be able to transfer
ownership of their securities or receive dividends and

interest due on their securities positions.
    SROs, exempt clearing agencies, and SBSDRs connect to multiple
members, registrants, users, or others though networks of information
systems. The interconnectedness of these Market Entities with other
Market Entities through information systems creates the potential that
a significant cybersecurity incident at one Market Entity (e.g., one
caused by malware) could spread to other Market Entities in a cascading
process that could cause widespread disruptions threatening the fair,
orderly, and efficient operation of the U.S. securities markets.\166\
Additionally, the disruption of a Market Entity that provides critical
services to other Market Entities through information system
connections could disrupt the activities of these other Market Entities
if they cannot obtain the services from another source.
---------------------------------------------------------------------------

    \166\ See, e.g., Implications of Cyber Risk for Financial
Stability (``[T]he interconnectedness of the financial system means
that an event at one or more firms may spread to others (the domino
effect).'').
---------------------------------------------------------------------------

    SROs, exempt clearing agencies, SBSDRs, SBS Entities, and transfer
agents could be prime targets of threat actors because of the central
roles they play in the securities markets. For example, threat actors
could seek to disrupt their functions for geopolitical purposes. Threat
actors also could seek to gain unauthorized access to their information
systems to conduct espionage operations on their internal non-public
activities. Moreover, because they hold financial assets (e.g.,
clearing deposits in the case of clearing agencies) and/or store
substantial confidential and proprietary information about other Market
Entities or financial transactions, they may be choice targets for
threat actors seeking to steal the assets or use the financial
information to their advantage.
    SROs, exempt clearing agencies, and SBSDRs store confidential and
proprietary information about their members, registrants, and users,
including confidential business information, and personal information.
A significant cybersecurity incident at any of these types of Market
Entities could lead to the improper use of this information to harm the
members, registrants, and users or provide the unauthorized user with
an unfair advantage over other market participants and, in the case of
personal information, to steal identities. Moreover, given the volume
of information stored by these Market Entities about different persons,
the harm caused by a cybersecurity incident could be widespread,
negatively impacting many victims.
    SBS Entities also store proprietary and confidential information
about their counterparties on their information systems, including
financial information they use to perform credit analysis. A
significant cybersecurity incident at an SBS Entity could lead to the
improper use of this information to harm the counterparties or provide
the unauthorized user with an unfair advantage over other market
participants. Transfer agents store proprietary information about
securities ownership and corporate actions. A significant cybersecurity
incident at a transfer agent could lead to the improper use of this
information to harm securities holders. Transfer agents also may store
personal information including names, addresses, phone numbers, email
addresses, employers, employment history, bank and specific account
information, credit card information, transaction histories, securities
holdings, and other detailed and individualized information related to
the transfer agents' recordkeeping and transaction processing on behalf
of issuers. Threat actors breaching the transfer agent's information
systems could use this information to steal identities or financial
assets of the persons to whom this information pertains. They also
could sell it to other threat actors.
    In light of these considerations, the MSRB and all clearing
agencies, national securities associations, national securities
exchanges, SBSDRs, SBS Entities, and transfer agents would be Covered
Entities under proposed Rule 10 and, therefore, subject to the
additional requirements regarding the minimum elements that must be
included in their cybersecurity risk management policies and
procedures, reporting, and public disclosure.\167\
---------------------------------------------------------------------------

    \167\ See paragraphs (a)(1)(ii) through (ix) of proposed Rule 10
(defining these Market Entities as ``covered entities'').
---------------------------------------------------------------------------

2. ``Cybersecurity Incident''
    Proposed Rule 10 would define the term ``cybersecurity incident''
to mean an unauthorized occurrence on or conducted through a Market
Entity's information systems that jeopardizes the confidentiality,
integrity, or availability of the information systems or any
information residing on those systems.\168\ The objective is to use a
term that is broad enough to encompass within the definition of
``cybersecurity incident'' the various categories of unauthorized
occurrences that can impact an information system (e.g., unauthorized
access, use, disclosure, downloading, disruption, modification, or
destruction). As discussed earlier, the sources of cybersecurity risk
are myriad as are the tactics, techniques, and procedures employed by
threat actors.\169\
---------------------------------------------------------------------------

    \168\ See paragraph (a)(2) of proposed Rule 10. See generally,
NIST Glossary (defining ``cybersecurity risk'' as ``an effect of
uncertainty on or within information and technology'' and defining
``incident'' as ``an occurrence that actually or potentially
jeopardizes the confidentiality, integrity, or availability of an
information system or the information the system processes, stores,
or transmits or that constitutes a violation or imminent threat of
violation of security policies, security procedures, or acceptable
use policies''); FISMA (defining ``incident'' as an ``occurrence''
that: (1) actually or imminently jeopardizes, without lawful
authority, the integrity, confidentiality, or availability of
information or an information system; or (2) constitutes a violation
or imminent threat of violation of law, security policies, security
procedures, or acceptable use policies. 44 U.S.C. 3552(b)(2).
    \169\ See section I.A.1. of this release (discussing the sources
of the cybersecurity risk).
---------------------------------------------------------------------------

    The definition of ``cybersecurity incident'' in proposed Rule 10 is
designed to include any unauthorized incident impacting an information
system or the information residing on the system. An information system
can experience an unauthorized occurrence without a threat actor itself
directly obtaining unauthorized access to the system. For example, a
social engineering tactic could cause an employee to upload ransomware
unintentionally that encrypts the information residing on the system or
a DoS attack could cause the information system to shut down. In either
case, the threat actor did not need to access the information system to
cause harm.
    While the definition is intended to be broad, the occurrence must
be one that jeopardizes (i.e., places at risk) the confidentiality,
integrity, or availability of the information systems or any
information residing on those systems. Confidentiality would be
jeopardized if the unauthorized occurrence resulted in or could result
in persons accessing an information system or the information residing
on the system who are not permitted or entitled to do so or resulted in
or could result in the disclosure of the information residing on the
information system to the public or to any person not permitted or
entitled to view it.\170\ Integrity would be jeopardized if the
unauthorized occurrence resulted in or could result in: (1) an
unpermitted or unintended modification or destruction of the

information system or the information residing on the system; or (2)
otherwise resulted in or could result in a compromise of the
authenticity of the information system (including its operations and
output) and the information residing on the system.\171\ Availability
would be jeopardized if the unauthorized occurrence resulted in or
could result in the Market Entity or other authorized users being
unable to access or use the information system or information residing
on the system or being unable access or use the information system or
information residing on the system in a timely or reliable manner.\172\
---------------------------------------------------------------------------

    \170\ See generally NIST Glossary (defining ``confidentiality''
as ``preserving authorized restrictions on information access and
disclosure, including means for protecting personal privacy and
proprietary information'').
    \171\ See generally NIST Glossary (defining ``integrity'' as
``guarding against improper information modification or destruction,
and includes ensuring information non-repudiation and
authenticity'').
    \172\ See generally NIST Glossary (defining ``availability'' as
``ensuring timely and reliable access to and use of information'').
---------------------------------------------------------------------------

3. ``Significant Cybersecurity Incident''
    Proposed Rule 10 would have a two-pronged definition of
``significant cybersecurity incident.'' \173\ The first prong of the
definition would be a cybersecurity incident, or a group of related
cybersecurity incidents, that significantly disrupts or degrades the
ability of the Market Entity to maintain critical operations.\174\ As
discussed earlier, significant cybersecurity incidents can negatively
impact information systems and the information residing on information
systems in two fundamental ways. First, they can disrupt or degrade the
information system or the information residing on the information
system in a manner that prevents the Market Entity from performing
functions that rely on the system operating as designed (e.g., an order
routing system of an national securities exchange or a margin
calculation and collection system of a clearing agency) or that rely on
the Market Entity being able to process or access information on the
system (e.g., a general ledger of a broker-dealer or SBS Entity that
tracks and records securities transactions).\175\ This type of harm can
be caused by, for example, a ransomware attack that encrypts the
information stored on the system, a DoS attack that overwhelms the
information system, or hackers taking control of a the system or
shutting it down. Generally, critical operations would be activities,
processes, and services that if disrupted could prevent the Market
Entity from continuing to operate or prevent it from performing a
service that supports the fair, orderly, and efficient functioning of
the U.S. securities markets.\176\
---------------------------------------------------------------------------

    \173\ See paragraphs (a)(10)(i) and (ii) of proposed Rule 10.
    \174\ See paragraph (a)(10)(i) of proposed Rule 10.
    \175\ See sections I.A.1. and I.A.2. of this release (discussing
the consequences of these types of information system degradations
and disruptions). This type of impact would compromise the integrity
or availability of the information system. See generally NIST
Glossary (defining ``integrity'' as ``guarding against improper
information modification or destruction, and includes ensuring
information non-repudiation and authenticity'' and ``availability''
as ``ensuring timely and reliable access to and use of
information'').
    \176\ See, e.g., Basel Committee on Banking Supervision,
Principles for Operational Resilience (Mar. 2021) (``The term
critical operations is based on the Joint Forum's 2006 high-level
principles for business continuity. It encompasses critical
functions as defined by the FSB and is expanded to include
activities, processes, services and their relevant supporting assets
the disruption of which would be material to the continued operation
of the bank or its role in the financial system.'') (footnotes
omitted).
---------------------------------------------------------------------------

    The second fundamental way that a significant cybersecurity
incident can negatively impact an information system or the information
residing on the information system is when unauthorized persons are
able to access and use the information stored on the information system
(e.g., proprietary business information or personal information).\177\
Therefore, the second prong of the definition would be a cybersecurity
incident, or a group of related cybersecurity incidents, that leads to
the unauthorized access or use of the information or information
systems of the Market Entity, where the unauthorized access or use of
such information or information systems results in or is reasonably
likely to result in: (1) substantial harm to the Market Entity; or (2)
substantial harm to a customer, counterparty, member, registrant, or
user of the Market Entity, or to any other person that interacts with
the Market Entity.\178\ As discussed earlier, this kind of significant
cybersecurity incident could lead to the improper use of this
information to harm persons to whom it pertains (e.g., public exposure
of their confidential financial information or the use of that
information to steal their identities) or provide the unauthorized user
with an unfair advantage over other market participants (e.g., trading
based on confidential business information).\179\
---------------------------------------------------------------------------

    \177\ See sections I.A.1. and I.A.2. of this release (discussing
the consequences of this type of compromise of an information
system). This type of impact would compromise the confidentiality of
the information system. See generally NIST Glossary (defining
``confidentiality'' as ``preserving authorized restrictions on
information access and disclosure, including means for protecting
personal privacy and proprietary information'').
    \178\ See paragraph (a)(10)(ii) of proposed Rule 10. There could
be instances where a significant cybersecurity incident meets both
prongs. For example, an unauthorized user that is able to access the
Market Entity's internal computer systems could shut down critical
operations of the Market Entity and use information on the systems
to steal assets of the Market Entity or assets or identities of the
Market Entity's customers.
    \179\ See sections I.A.1. and I.A.2. of this release (discussing
the consequences of this type of compromise of an information
system).
---------------------------------------------------------------------------

4. ``Cybersecurity Threat''
    Proposed Rule 10 would define the term ``cybersecurity threat'' to
mean any potential occurrence that may result in an unauthorized effort
to affect adversely the confidentiality, integrity, or availability of
a Market Entity's information systems or any information residing on
those systems.\180\ As discussed earlier, threat actors use a number of
different tactics, techniques, and procedures (e.g., malware, social
engineering, hacking, DoS attacks) to commit cyber-related crime.\181\
These threat actors may be nation states, individuals (acting alone or
as part of organized syndicates) seeking financial gain, or individuals
seeking to cause harm for a variety of reasons. Further, the threat
actors may be external or internal actors. Also, as discussed earlier,
errors can pose a cybersecurity threat (e.g., accidentally providing
access to confidential information to individuals that are not
authorized to view or use it). The definition of ``cybersecurity
threat'' in proposed Rule 10 is designed to include the potential
actions of threat actors (e.g., seeking to install malware on or hack
into an information system or engaging in social engineering tactics)
and potential errors (e.g., an employee failing to secure confidential,
proprietary, and personal information) that may result in an
unauthorized effort to affect adversely the confidentiality, integrity,
or availability of a Market Entity's information systems or any
information residing on those systems.
---------------------------------------------------------------------------

    \180\ See paragraph (a)(4) of proposed Rule 10. See generally
NIST Glossary (defining ``threat'' as any circumstance or event with
the potential to adversely impact organizational operations
(including mission, functions, image, or reputation), organizational
assets, or individuals through an information system via
unauthorized access, destruction, disclosure, modification of
information, and/or denial of service and also the potential for a
threat-source to successfully exploit a particular information
system vulnerability).
    \181\ See section I.A.1. of this release (discussing the various
tactics, techniques, and procedures used by threat actors).
---------------------------------------------------------------------------

5. ``Cybersecurity Vulnerability''
    Proposed Rule 10 would define the term ``cybersecurity
vulnerability'' to mean a vulnerability in a Market Entity's
information systems, information system security procedures, or
internal controls, including, for example, vulnerabilities in their
design,

configuration, maintenance, or implementation that, if exploited, could
result in a cybersecurity incident.\182\ Cybersecurity vulnerabilities
are weaknesses in the Covered Entity's information systems that threat
actors could exploit, for example, to hack into the system or install
malware.\183\ One example would be an information system that uses
outdated software that is no longer updated to address known flaws that
could be exploited by threat actors to access the system. Cybersecurity
vulnerabilities also are weaknesses in the procedures and controls the
Market Entity uses to protect its information systems and the
information residing on them such as procedures and controls that do
not require outdated software to be replaced or that do not adequately
restrict access to the system. Cybersecurity vulnerabilities can also
include lack of training opportunities for employees to increase their
cybersecurity awareness, such as how to properly secure sensitive data
and recognize harmful files. The definition of ``cybersecurity
vulnerability'' in proposed Rule 10 is designed to include weaknesses
in the information systems themselves and weaknesses in the measures
the Covered Entity takes to protect the systems and the information
residing on the systems.
---------------------------------------------------------------------------

    \182\ See paragraph (a)(5) of proposed Rule 10. See generally
NIST Glossary (defining ``vulnerability'' as a weakness in an
information system, system security procedures, internal controls,
or implementation that could be exploited or triggered by a threat
source'').
    \183\ See section I.A.1. of this release (discussing information
system vulnerabilities). See generally CISA 2021 Vulnerability
Report (``Globally, in 2021, malicious cyber actors targeted
internet-facing systems, such as email servers and virtual private
network (VPN) servers, with exploits of newly disclosed
vulnerabilities.'').
---------------------------------------------------------------------------

6. ``Cybersecurity Risk''
    Proposed Rule 10 would define the term ``cybersecurity risk'' to
mean financial, operational, legal, reputational, and other adverse
consequences that could stem from cybersecurity incidents,
cybersecurity threats, and cybersecurity vulnerabilities.\184\ As
discussed earlier, cybersecurity incidents have the potential to cause
harm to Market Entities and others who use their services or are
connected to them through information systems and, if severe enough,
negatively impact the fair, orderly, and efficient operations of the
U.S. securities markets.\185\ The definition of ``cybersecurity risk''
in proposed Rule 10 is designed to encompass the types of harm and
damage that can befall a Market Entity that experiences a cybersecurity
incident.
---------------------------------------------------------------------------

    \184\ See paragraph (a)(3) of proposed Rule 10. See also
paragraphs (a)(4) and (5) of proposed Rule 10 (defining,
respectively, ``cybersecurity threat'' to mean ``any potential
occurrence that may result in an unauthorized effort to affect
adversely the confidentiality, integrity, or availability of a
Market Entity's information systems or any information residing on
those systems'' and ``cybersecurity vulnerability'' to mean ``a
vulnerability in a Market Entity's information systems, information
system security procedures, or internal controls, including, for
example, vulnerabilities in their design, configuration,
maintenance, or implementation that, if exploited, could result in a
cybersecurity incident'').
    \185\ See sections I.A.1. and I.A.2. of this release
(discussing, respectively, the harms that can be caused by
significant cybersecurity incidents generally and with respect to
each category of Market Entity).
---------------------------------------------------------------------------

7. ``Information''
    As discussed in more detail below, a Market Entity would be
required under proposed Rule 10 to establish, maintain, and enforce
written policies and procedures that are reasonably designed to address
the Market Entity's cybersecurity risks.\186\ Cybersecurity risks--as
discussed above--would be financial, operational, legal, reputational,
and other adverse consequences that could result from cybersecurity
incidents, cybersecurity threats, and cybersecurity
vulnerabilities.\187\ Cybersecurity incidents would be unauthorized
occurrences on or conducted through a market entity's information
systems that jeopardize the confidentiality, integrity, or availability
of the information systems or any information residing on those
systems.\188\ Cybersecurity threats would be any potential occurrences
that may result in an unauthorized effort to affect adversely the
confidentiality, integrity, or availability of a market entity's
information systems or any information residing on those systems.\189\
Finally, cybersecurity vulnerabilities would be a vulnerability in a
Market Entity's information systems, information system security
procedures, or internal controls, including, for example,
vulnerabilities in their design, configuration, maintenance, or
implementation that, if exploited, could result in a cybersecurity
incident.\190\ Consequently, the policies and procedures required under
proposed Rule 10 would need to cover all of the Market Entity's
information systems and information residing on those systems in order
to address the Market Entity's cybersecurity risks.
---------------------------------------------------------------------------

    \186\ See paragraphs (b)(1) and (e) of proposed Rule 10
(requiring Covered Entities and Non-Covered Entities, respectively,
to have policies and procedures to address their cybersecurity
risks); sections II.B.1. and II.C. of this release (discussing the
requirements of paragraphs (b)(1) and (e) of proposed Rule 10,
respectively, in more detail).
    \187\ See paragraph (a)(3) of proposed Rule 10 (defining
``cybersecurity risk'').
    \188\ See paragraph (a)(2) of proposed Rule 10 (defining
``cybersecurity incident'').
    \189\ See paragraph (a)(4) of proposed Rule 10 (defining
``cybersecurity threat'').
    \190\ See paragraph (a)(5) of proposed Rule 10 (defining
``cybersecurity vulnerability'').
---------------------------------------------------------------------------

    Proposed Rule 10 would define the term ``information'' to mean any
records or data related to the Market Entity's business residing on the
Market Entity's information systems, including, for example, personal
information received, maintained, created, or processed by the Market
Entity.\191\ The definition is designed to cover the full range of
information stored by Market Entities on their information systems
regardless of the digital format in which the information is
stored.\192\ As discussed earlier, Market Entities create and maintain
a wide range of information on their information systems.\193\ This
includes information used to manage and conduct their operations,
manage and mitigate their risks, monitor the progress of their
business, track their financial condition, prepare financial
statements, prepare regulatory filings, and prepare tax returns. They
also store personal, confidential, and proprietary business information
about their customers, counterparties, members, registrants or users.
This includes information maintained by clearing agencies, the MSRB,
the national securities exchanges, and SBSDRs about market activity and
about their members, registrants, and users.
---------------------------------------------------------------------------

    \191\ See paragraph (a)(6) of proposed Rule 10.
    \192\ See generally NIST Glossary (defining ``information'' as
any communication or representation of knowledge such as facts,
data, or opinions in any medium or form, including textual,
numerical, graphic, cartographic, narrative, or audiovisual. Id.
(defining ``data'' (among other things) as: (1) pieces of
information from which ``understandable information'' is derived;
(2) distinct pieces of digital information that have been formatted
in a specific way; and (3) a subset of information in an electronic
format that allows it to be retrieved or transmitted. Id. (defining
``records'' (among other things) as units of related data fields
(i.e., groups of data fields that can be accessed by a program and
that contain the complete set of information on particular items).
    \193\ See section I.A.2. of this release.
---------------------------------------------------------------------------

    The information maintained by Market Entities on their information
systems is an attractive target for threat actors, particularly
confidential, proprietary, and personal information.\194\ Also, it also
can be

critical to performing their various functions, and the inability to
access and use their information could disrupt or degrade their ability
to operate in support of the fair, orderly, and efficient operation of
the U.S. securities markets.\195\ Consequently, protecting the
confidentiality, integrity, and availability of information residing on
a Market Entity's information systems is critical to avoiding the harms
that can be caused by cybersecurity risk. The definition of
``information'' in proposed Rule 10 is designed to encompass this
information and, therefore, to extend the proposed protections of the
rule to it.
---------------------------------------------------------------------------

    \194\ See sections I.A.1. and I.A.2 of this release (discussing
how threat actors seek unauthorized access to and use of
confidential, proprietary, and personal information to, among other
reasons, conduct espionage operations, steal identities, use it for
business advantage, hold it hostage (in effect) through a ransomware
attack, or sell it to other threat actors).
    \195\ Id.
---------------------------------------------------------------------------

8. ``Information Systems''
    The policies and procedures required under proposed Rule 10 also
would need to cover the Market Entity's information systems in order to
address the Market Entity's cybersecurity risks. Proposed Rule 10 would
define the term ``information systems'' to mean the information
resources owned or used by the Market Entity, including, for example,
physical or virtual infrastructure controlled by the information
resources, or components thereof, organized for the collection,
processing, maintenance, use, sharing, dissemination, or disposition of
the Market Entity's information to maintain or support the Market
Entity's operations.\196\
---------------------------------------------------------------------------

    \196\ See paragraph (a)(7) of proposed Rule 10.
---------------------------------------------------------------------------

    As discussed earlier, Market Entities use information systems to
perform a wide range of functions.\197\ For example, they use
information systems to maintain books and records to manage and conduct
their operations, manage and mitigate their risks, monitor the progress
of their business, track their financial condition, prepare financial
statements, prepare regulatory filings, and prepare tax returns. Market
Entities also use information systems so that their employees can
communicate with each other and with external persons. These include
email, text messaging, and virtual meeting applications. They also use
internet websites to communicate information to their customers,
counterparties, members, registrants, or users. They use information
systems to perform the functions associated with their status and
obligations as a broker-dealer, registered or exempt clearing agency,
national securities association, national securities exchange, SBSDR,
SBS Entity, SRO, or transfer agent.
---------------------------------------------------------------------------

    \197\ See section I.A.2. of this release.
---------------------------------------------------------------------------

    Information systems are targets that threat actors attack to access
and use information maintained by Market Entities related to their
business (particularly confidential, proprietary, and personal
information).\198\ In addition, the interconnectedness of Market
Entities through information systems creates channels through which
malware, viruses, and other destructive cybersecurity threats can
spread throughout the financial system. Moreover, the disruption or
degradation of a Market Entity's information systems could negatively
impact the entity's ability to operate in support of the U.S.
securities markets.\199\ Consequently, protecting the confidentiality,
integrity, and availability of a Market Entity's information systems is
critical to avoiding the harms that can be caused by cybersecurity
risk. The definition of the term ``information systems'' in proposed
Rule 10 is designed to be broad enough to encompass all the electronic
information resources owned or used by a Market Entity to carry out its
various operations. Accordingly, the definition of ``information
systems'' would require a Market Entity's policies and procedures to
address cybersecurity risks to cover all of its information systems.
---------------------------------------------------------------------------

    \198\ See sections I.A.1. and I.A.2. of this release.
    \199\ Id.
---------------------------------------------------------------------------

9. ``Personal Information''
    Proposed Rule 10 would define the term ``personal information'' to
mean any information that can be used, alone or in conjunction with any
other information, to identify a person, including, but not limited to,
name, date of birth, place of birth, telephone number, street address,
mother's maiden name, Social Security number, government passport
number, driver's license number, electronic mail address, account
number, account password, biometric records, or other non-public
authentication information.\200\ The definition of ``personal
information'' was guided by a number of established sources and aims to
capture a broad array of information that can reside on a Market
Entity's information systems that may be used alone, or with other
information, to identify an individual. The definition is designed to
encompass information that if compromised could cause harm to the
individuals to whom the information pertains (e.g., identity theft or
theft of assets).
---------------------------------------------------------------------------

    \200\ See paragraph (a)(9) of proposed Rule 10. See generally
NIST Glossary (defining ``personal information'' as information that
can be used to distinguish or trace an individual's identity, either
alone or when combined with other information that is linked or
linkable to a specific individual and defining ``personally
identifying information'' (among other things) as information that
can be used to distinguish or trace an individual's identity--such
as name, social security number, biometric data records--either
alone or when combined with other personal or identifying
information that is linked or linkable to a specific individual
(e.g., date and place of birth, mother's maiden name, etc.)); 17 CFR
248.201(b)(8) ((defining ``identifying information'' as any name or
number that may be used, alone or in conjunction with any other
information, to identify a specific person, including any: (1) name,
Social Security number, date of birth, official State or government
issued driver's license or identification number, alien registration
number, government passport number, employer or taxpayer
identification number; (2) unique biometric data, such as
fingerprint, voice print, retina or iris image, or other unique
physical representation; (3) unique electronic identification
number, address, or routing code; or (4) telecommunication
identifying information or access device (as defined in 18 U.S.C.
1029(e))).
---------------------------------------------------------------------------

    Personal information is an attractive target for threat actors
because they can use it to steal a person's identity and then use the
stolen identity to appropriate the person's assets through unauthorized
transactions or to make unlawful purchases on credit or to effect other
unlawful transactions in the name of the person.\201\ They also can
sell personal information they obtain through unauthorized access to an
information system to criminals who will seek to use the information
for these purposes. Moreover, the victims of identity theft can be the
more vulnerable members of society (e.g., individuals on fixed-incomes,
including retirees). Consequently, proposed Rule 10 would have a
provision that specifically addresses protecting personal
information.\202\
---------------------------------------------------------------------------

    \201\ See sections I.A.1. and I.A.2. of this release.
    \202\ See paragraph (b)(1)(iii)(A)(2) of proposed Rule 10. See
also proposed Form SCIR, which would elicit information about
whether personal information was compromised in a significant
cybersecurity incident.
---------------------------------------------------------------------------

10. Request for Comment
    The Commission requests comment on all aspects of the proposed
definitions. In addition, the Commission is requesting comment on the
following specific aspects of the proposals:
    1. In designing the definitions of proposed Rule 10, the Commission
considered a number of sources cited in the sections above, including,
in particular, the NIST Glossary and certain Federal statutes and
regulations. Are these appropriate sources to consider? If so, explain
why. If not, explain why not. Are there other sources the Commission
should use? If so, identify them and explain why they should be
considered and how they

could inform potential modifications to the definitions.
    2. In determining which categories of Market Entities would be
Covered Entities subject to the additional requirements of proposed
Rule 10, the Commission considered: (1) how the category of Market
Entity supports the fair, orderly, and efficient operation of the U.S.
securities markets and the consequences if that type of broker-dealer's
critical functions were disrupted or degraded by a significant
cybersecurity incident; (2) the harm that could befall investors,
including retail investors, if that category of Market Entity's
functions were disrupted or degraded by a significant cybersecurity
incident; (3) the extent to which the category of Market Entity poses
cybersecurity risk to other Market Entities though information system
connections, including the number of connections; (4) the extent to
which the category of Market Entity would be an attractive target for
threat actors; and (5) the personal, confidential, and proprietary
business information about the category of Market Entity and other
persons (e.g., investors) stored on the Market Entity's information
systems and the harm that could be caused if that information was
accessed or used by threat actors through a cybersecurity breach. Are
these appropriate factors to consider? If so, explain why. If not,
explain why not. Are there other factors the Commission should take
into account? If so, identify them and explain why they should be
considered.
    3. Should proposed Rule 10 be modified to include other categories
of broker-dealers as Covered Entities? If so, identify the category of
broker-dealers and explain how to define broker-dealers within that
category and why it would be appropriate to apply the additional
policies and procedures, reporting, and disclosure requirements of the
proposed rule to that category of broker-dealers. For example, should
the $50 million regulatory capital threshold be lowered (e.g., to $25
million or some other amount) or should the $1 billion total assets
threshold be lowered (e.g., to $500 million or some other amount) to
include more broker-dealers as Covered Entities? If so, identify the
threshold and explain why it would be appropriate to apply the
additional requirements to broker-dealers that fall within that
threshold.
    4. Should proposed Rule 10 be modified to include as a Covered
Entity any broker-dealer that is an SCI entity for the purposes of
Regulation SCI? Currently, under Regulation SCI, an ATS that trades
certain stocks exceeding specific volume thresholds is an SCI entity?
\203\ As discussed above, a broker-dealer that operates an ATS would be
a Covered Entity under proposed Rule 10 and, therefore, subject to the
additional policies and procedures, reporting, and disclosure
requirements of the proposed rule. However, the Commission is proposing
to amend Regulation SCI to broaden the definition of ``SCI entity'' to
include, among other Commission registrants, a broker-dealer that
exceeds an asset-based size threshold or a volume-based trading
threshold in NMS stocks, exchange-listed options, agency securities, or
U.S. treasury securities.\204\ A broker-dealer that exceeds the asset-
based size threshold under the proposed amendments to Regulation SCI
(which would be several hundred billion dollars) would be subject to
the requirements of proposed Rule 10 applicable to Covered Entities, as
it would exceed the $1 billion total assets threshold in the broker-
dealer definition of ``covered entity.'' \205\ Further, a broker-dealer
that exceeds one or more of the volume-based trading thresholds under
the proposed amendments to Regulation SCI likely would meet one of the
broker-dealer definitions of ``covered entity'' in proposed Rule 10
given its size and activities. For example, it may be carrying broker-
dealer, have regulatory capital equal to or exceeding $50 million, have
total assets equal to or exceeding $1 billion, or operate as a market
maker.\206\ Nonetheless, should the definition of ``covered entity'' in
proposed Rule 10 be modified to include any broker-dealer that is an
SCI entity under Regulation SCI? If so, explain why. If not, explain
why not.
---------------------------------------------------------------------------

    \203\ See 17 CFR 242.1000 (defining the term ``SCI alternative
trading system'' and including that defined term in the definition
of ``SCI Entity'').
    \204\ Regulation SCI 2023 Proposing Release.
    \205\ See paragraph (a)(1)(i)(D) of proposed Rule 10. See also
section II.F.1.c. of this release (discussing why this type of
broker-dealer would be a Covered Entity).
    \206\ See paragraphs (a)(1)(i)(A), (C), (D), and (E) of proposed
Rule 10 (defining these categories of broker-dealers as ``covered
entities''). See also section II.F.1.c. of this release (discussing
why this type of broker-dealer likely would be a Covered Entity).
---------------------------------------------------------------------------

    5. Should proposed Rule 10 be modified to narrow the categories of
broker-dealers that would be Covered Entities? If so, explain how the
category should be narrowed and why it would be appropriate not to
apply the additional requirements to broker-dealers that would no
longer be included as Covered Entities. For example, are there certain
types of carrying broker-dealers, introducing broker-dealers, market
makers, or ATSs that should not be included as Covered Entities? If so,
identify the type of broker-dealer and explain why it would be
appropriate not to impose the additional policies and procedures,
reporting, and disclosure requirements of the proposed rule on that
type of broker-dealer. Similarly, should the proposed $50 million
regulatory capital threshold be increased (e.g., to $100 million or
some other amount) or should the $1 billion total assets threshold be
increased (e.g., to $5 billion or some other amount) to exclude more
broker-dealers from the definition of ``covered entity''? If so,
identify the threshold and explain why it would be appropriate not to
apply the additional requirements on the broker-dealers that would not
be Covered Entities under the narrower definition.
    6. Should proposed Rule 10 be modified to divide other categories
of Market Entities into Covered Entities and Non-Covered Entities? If
so, identify the category of Market Entity and explain how to define
Covered Entity and Non-Covered Entity within that category and explain
why it would be appropriate not to impose the additional policies and
procedures, reporting, and disclosure requirements on the Market
Entities that would be Non-Covered Entities. For example, are there
types of clearing agencies (registered or exempt), MSBSPs, national
securities exchanges, SBSDRs, SBSDs, or transfer agents that pose a
level of cybersecurity risk to the U.S. securities markets and the
participants in those markets that is no greater than the cybersecurity
risk posed by the categories of broker-dealers that would be Non-
Covered Entities? If so, explain why it would be appropriate not to
apply the additional requirements of proposed Rule 10 to these types of
Market Entities.
    7. Should proposed Rule 10 be modified so that it applies to other
participants in the U.S. securities markets that are registered with
the Commission? If so, identify the registrant type and explain why it
should be subject to the requirements of proposed Rule 10. For example,
should competing consolidators or plan processors be subject to the
requirements of proposed Rule 10? \207\ If so, explain why. If not,
explain why not. If competing consolidators or plan processors should
be subject to proposed Rule 10, should they be treated as Covered
Entities or Non-Covered Entities? If Covered Entities,

explain why. If Non-Covered Entities, explain why. Should certain
competing consolidators or plan processors be treated as Covered
Entities and others be treated as Non-Covered Entities? If so, explain
how to define Covered Entity and Non-Covered Entity within that
category and explain why it would be appropriate not to apply the
additional policies and procedures, reporting, and disclosure
requirements of the proposed rule to the competing consolidators or
plan processors in that category that would not be Covered Entities.
---------------------------------------------------------------------------

    \207\ See 17 CFR 242.600(16) and (67) (defining the terms
``competing consolidator'' and ``plan processor,'' respectively).
See also 17 CFR 242.1000 (defining ``SCI competing consolidator''
and defining ``SCI entity'' to include SCI competing consolidator).
---------------------------------------------------------------------------

    8. Should proposed Rule 10 be modified to revise the broker-dealer
definitions of ``covered entity''? For example, in order to include
carrying broker-dealers as Covered Entities, paragraph (a)(1)(i)(A) of
proposed Rule 10 would define the term ``covered entity'' to include a
broker-dealer that maintains custody of cash and securities for
customers or other brokers-dealers and is not exempt from the
requirements of Rule 15c3-3. In addition, in order to include
introducing broker-dealers as Covered Entities, paragraph (a)(1)(i)(B)
of proposed Rule 10 would define the term ``covered entity'' to include
a broker-dealer that introduces customer accounts on a fully disclosed
basis to another broker-dealer that is a carrying broker-dealer under
paragraph (a)(1)(i)(A) of the proposed rule. Would these broker-dealer
definitions of ``covered entity'' work as designed? If not, explain why
and suggest modifications to improve their design.
    9. In order to include market makers as Covered Entities, paragraph
(a)(1)(i)(E) of proposed Rule 10 would define the term ``covered
entity'' to include a broker-dealer that is a market maker under the
Exchange Act or the rules thereunder (which includes a broker-dealer
that operates pursuant to paragraph (a)(6) of Rule 15c3-1) or is a
market maker under the rules of an SRO of which the broker-dealer is a
member. Would the definition work as designed? If not, explain why and
suggest modifications to improve its design. For example, should the
definition be based on a list of the functions and activities of a
market maker as distinct from the functions and activities of other
categories of broker-dealers? If so, identify the relevant functions
and activities and explain how they could be incorporated into a
definition.
    10. Should paragraph (a)(2) of proposed Rule 10 be modified to
revise the definition of ``cybersecurity incident''? For example, as
discussed above, the definition is designed to include any unauthorized
occurrence that impacts an information system or the information
residing on the system. Would the definition work as designed? If not,
explain why and suggest modifications to improve its design. Is this
design objective appropriate? If not, explain why and suggest an
alternative design objective for the definition. Is the definition of
``cybersecurity incident'' overly broad in that it refers to an
incident that jeopardizes the confidentiality, integrity, or
availability of the information systems or any information residing on
those systems? If so, explain why and suggest modifications to
appropriately narrow its scope without undermining the objective of the
rule to address cybersecurity risks facing Market Entities. Is the
definition of ``cybersecurity incident'' too narrow? If so, how should
it be broadened?
    11. Should paragraph (a)(3) of proposed Rule 10 be modified to
revise definition of ``cybersecurity risk''? For example, the NIST
definition of ``cybersecurity risk'' focuses on how this risk can cause
harm: it can adversely impact organizational operations (i.e., mission,
functions, image, or reputation) and assets, individuals, other
organizations, and the Nation. The definition of ``cybersecurity risk''
in proposed Rule 10 was guided by this aspect of cybersecurity risk.
Does the definition appropriately incorporate this aspect of
cybersecurity risk? If not, explain why and suggest modifications to
improve its design. Is this design objective appropriate? If not,
explain why and suggest an alternative design objective for the
definition.
    12. Should paragraph (a)(4) of proposed Rule 10 be modified to
revise the definition of ``cybersecurity threat''? For example, as
discussed above, the definition is designed to include the potential
actions of threat actors and errors that may result in an unauthorized
effort to affect adversely the confidentiality, integrity, or
availability of a Market Entity's information systems or any
information residing on those systems. Would the definition work as
designed? If not, explain why and suggest modifications to improve its
design. Is the definition of ``cybersecurity threat'' overly broad in
that it includes any ``potential occurrence''? If so, explain why and
suggest modifications to appropriately narrow its scope without
undermining the objective of the rule to address cybersecurity risks
facing Market Entities. Is the definition of ``cybersecurity threat''
too narrow? If so, how should it be broadened?
    13. Should paragraph (a)(5) of proposed Rule 10 be modified to
revise the definition of ``cybersecurity vulnerability''? For example,
as discussed above, the definition is designed to include weaknesses in
the information systems themselves and weaknesses in the measures the
Covered Entity takes to protect the systems and the information
residing on the systems. Would the definition work as designed? If not,
explain why and suggest modifications to improve its design. Is this
design objective appropriate? If not, explain why and suggest an
alternative design objective for the definition. Is the definition of
``cybersecurity vulnerability'' overly broad? If so, explain why and
suggest modifications to appropriately narrow its scope without
undermining the objective of the rule to address cybersecurity risks
facing Market Entities. Is the definition of ``cybersecurity
vulnerability'' too narrow? If so, how should it be broadened?
    14. Should paragraph (a)(6) of proposed Rule 10 be modified to
revise the definition of ``information''? For example, as discussed
above, the definition is designed to be broad enough to encompass the
wide range of information that resides on the information systems of
Market Entities. Would the definition work as designed? If not, explain
why and suggest modifications to improve its design. Is this design
objective appropriate? If not, explain why and suggest an alternative
design objective for the definition. For example, should the definition
focus on information that, if compromised, could cause harm to the
Market Entity or others and exclude information that, if compromised,
would not cause harm? If so, explain why and suggest rule text to
implement this modification.
    15. Should paragraph (a)(7) of proposed Rule 10 be modified to
revise the definition of ``information systems''? For example, as
discussed above, the definition is designed to be broad enough to
encompass all the electronic information resources owned or used by a
Market Entity to carry out its various operations. Would the definition
work as designed? If not, explain why and suggest modifications to
improve its design. Is this design objective appropriate? If not,
explain why and suggest an alternative design objective for the
definition. Is the definition of ``information systems'' overly broad
in that it includes any information resource ``used by'' the Market
Entity, which may include information resources developed and
maintained by a third party (other than a service provider that that
receives, maintains, or processes information, or is otherwise
permitted to access the Market Entity's information systems and any of
the

Market Entity's information residing on those systems)? If so, explain
why and suggest modifications to improve its design. Is this design
objective appropriate? If not, explain why and suggest an alternative
design objective for the definition. Is the definition of ``information
system'' overly narrow? If so, how should it be broadened?
    16. Should paragraph (a)(9) of proposed Rule 10 be modified to
revise the definition of ``personal information''? For example, as
discussed above, the definition is designed to encompass information
that if compromised could cause harm to the individuals to whom the
information pertains (e.g., identity theft or theft of assets). Would
the definition work as designed? If not, explain why and suggest
modifications to improve its design. Is this design objective
appropriate? If not, explain why and suggest an alternative design
objective for the definition.
    17. Should paragraph (a)(10) of proposed Rule 10 be modified to
revise the definition of ``significant cybersecurity incident''? For
example, as discussed above, the definition would have two prongs: the
first relating to incidents that significantly disrupt or degrade the
ability of the Market Entity to maintain critical operations and the
second relating to the unauthorized access or use of the information or
information systems of the Market Entity. Are these the fundamental
ways that significant cybersecurity incidents can negatively impact
information systems and the information residing on information
systems? If not, explain why and identify other fundamental ways that
information and information systems can be negatively impacted by
significant cybersecurity incidents that should be incorporated into
the definition of ``significant cybersecurity incident.'' Should the
term ``significant'' be defined separately? If so, explain why and
suggest potential definitions for this term. Instead, of
``significant'' should the definition use the word ``material.'' If so,
explain why and how that would change the meaning of the definition.
    18. Should paragraph (a)(10)(i) of proposed Rule 10 be modified to
revise the first prong of the definition of ``significant cybersecurity
incident''? For example, as explained above, the first prong is
designed to address how a ``significant cybersecurity incident'' can
disrupt or degrade the information system or the information residing
on the system in a manner that prevents the Market Entity from
performing functions that rely on the system operating as designed or
that rely on the Market Entity being able to process or access
information on the system. Would the first prong of the definition work
as designed? If not, explain why and suggest modifications to improve
its design. Is this design objective appropriate? If not, explain why
and suggest an alternative design objective for the first prong of the
definition. For example, should the first prong of the definition be
limited to cybersecurity incidents that ``disrupt'' the ability of the
Market Entity to maintain critical operations (i.e., not include
incidents that ``degrade'' that ability)? If so, explain why and also
explain how to distinguish between an incident that degrades the
ability of the Market Entity to maintain critical operations and an
incident that disrupts that ability. Also, explain why reporting to the
Commission and other regulators (as applicable) and publicly disclosing
incidents that degrade the ability of the Market Entity to maintain
critical operations would not be necessary because they would no longer
be significant cybersecurity incidents.\208\
---------------------------------------------------------------------------

    \208\ See paragraphs (c) and (d) of proposed Rule 10 (requiring,
respectively, immediate notification and subsequent reporting of
significant cybersecurity incidents and public disclosure of
significant cybersecurity incidents).
---------------------------------------------------------------------------

    19. Should paragraph (a)(10)(ii) of proposed Rule 10 be modified be
to revise the second prong of the definition of ``significant
cybersecurity incident''? For example, as explained above, the second
prong is designed to address how a ``significant cybersecurity
incident'' can cause harm if unauthorized persons are able to access
and use the information system or the information residing on the
system. Would the definition work as designed? If not, explain why and
suggest modifications to improve its design. Is this design objective
appropriate? If not, explain why and suggest an alternative design
objective for the second prong of the definition. For example, should
the second prong of the definition be limited to cybersecurity
incidents that ``result'' in substantial harm to the Market Entity or
substantial harm to a customer, counterparty, member, registrant, or
user of the Market entity, or to any other person that interacts with
the Market Entity (i.e., not include incidents that are ``reasonably
likely'' to result in these consequences)? If so, explain why and also
explain why reporting to the Commission and other regulators (as
applicable) and publicly disclosing incidents that are reasonably
likely to result in these consequences would not be necessary because
they would no longer be significant cybersecurity incidents.\209\
Alternatively, should the second prong of the definition be limited to
an incident of unauthorized access or use that leads to ``substantial
harm'' to a customer, counterparty, member, registrant or user of the
Covered Entity, or should ``inconvenience'' to a customer,
counterparty, member, registrant or user be enough? If yes, explain
why. Should the second prong of the definition be modified so that it
is limited to cybersecurity incidents that result in or are reasonably
likely to result in substantial harm to more than one customer,
counterparty, member, registrant, or user of the Market Entity, or to
any other market participant that interacts with the Market Entity? If
so, explain why.
---------------------------------------------------------------------------

    \209\ See paragraphs (c) and (d) of proposed Rule 10 (requiring,
respectively, immediate notification and subsequent reporting of
significant cybersecurity incidents and public disclosure of
significant cybersecurity incidents).
---------------------------------------------------------------------------

    20. Should proposed Rule 10 be modified to define additional terms
for the purposes of the rule and Parts I and II of proposed Form SCIR?
If so, identify the term, suggest a definition, and explain why
including the definition would be appropriate. For example, would
including additional defined terms improve the clarity of the
requirements of proposed Rule 10 and Parts I and II of proposed Form
SCIR? If so, explain why. Should proposed Rule 10 be modified to define
the terms ``confidentiality,'' ``integrity'', and ``availability''? If
so, explain why and suggest definitions.

B. Proposed Requirements for Covered Entities

1. Cybersecurity Risk Management Policies and Procedures
    Risk management is the ongoing process of identifying, assessing,
and responding to risk.\210\ To manage risk generally, Market Entities
should understand the likelihood that an event will occur and the
potential resulting impacts.\211\ Cybersecurity risk--like other
business risks (e.g., market, credit, or liquidity risk)--can be
addressed through policies and procedures that are reasonably designed
to manage the risk.\212\
---------------------------------------------------------------------------

    \210\ See generally NIST Framework.
    \211\ Id.
    \212\ See generally CISA Cyber Essentials Starter Kit (stating
that organizations should ``approach cyber as business risk'').
---------------------------------------------------------------------------

    Accordingly, proposed Rule 10 would require Covered Entities to
establish, maintain, and enforce written policies and procedures that
are reasonably designed to address the Covered Entity's

cybersecurity risks.\213\ Further, proposed Rule 10 would set forth
minimum elements that would need to be included in the policies and
procedures.\214\ In particular, the policies and procedures would need
to address: (1) risk assessment; (2) user security and access; (3)
information protection; (4) cybersecurity threat and vulnerability
management; and (5) cybersecurity incident response and recovery. As
discussed in more detail below, the inclusion of these elements is
designed to enumerate the core areas that Covered Entities would need
to address when designing, implementing, and assessing their policies
and procedures. Proposed Rule 10 also would require Covered Entities to
review annually and assess their policies and procedures and prepare a
written report describing the review and other related matters. Taken
together, these requirements are designed to position Covered Entities
to be better prepared to protect themselves against cybersecurity
risks, to mitigate cybersecurity threats and vulnerabilities, and to
recover from cybersecurity incidents. They are also designed to help
ensure that Covered Entities focus their efforts and resources on the
cybersecurity risks associated with their operations and business
practices.
---------------------------------------------------------------------------

    \213\ See paragraph (b)(1) of proposed Rule 10.
    \214\ See paragraphs (b)(1)(i) through (v) of proposed Rule 10.
Covered Entities may wish to consult a number of resources in
connection with these elements. See generally NIST Framework; CISA
Cyber Essentials Starter Kit.
---------------------------------------------------------------------------

    The policies and procedures that would be required by proposed Rule
10--because they would need to address the Covered Entity's
cybersecurity risks--generally should be tailored to the nature and
scope of the Covered Entity's business and address the Covered Entity's
specific cybersecurity risks. Thus, proposed Rule 10 is not intended to
impose a one-size-fits-all approach to addressing cybersecurity risks.
In addition, cybersecurity threats are constantly evolving and measures
to address those threats continue to evolve. Therefore, proposed Rule
10 is designed to provide Covered Entities with the flexibility to
update and modify their policies and procedures as needed so that that
they continue to be reasonably designed to address the Covered Entity's
cybersecurity risks over time.
a. Risk Assessment
    Proposed Rule 10 would specify that the Covered Entity's
cybersecurity risk management policies and procedures must include
policies and procedures that require periodic assessments of
cybersecurity risks associated with the Covered Entity's information
systems and information residing on those systems.\215\ Further, with
respect to the periodic assessments, the policies and procedures would
need to include two components.
---------------------------------------------------------------------------

    \215\ See paragraph (b)(1)(i)(A) of proposed Rule 10. See
generally NIST Framework (providing that the first core element of
the framework is ``identify''--meaning develop an organizational
understanding to manage cybersecurity risk to systems, people,
assets, data, and capabilities); IOSCO Cybersecurity Report (``A key
component of the risk management program is the identification of
critical assets, information and systems, including order routing
systems, risk management systems, execution systems, data
dissemination systems, and surveillance systems. Practices
supporting the identification function include the establishment and
maintenance of an inventory of all hardware and software. This risk
management program should also typically include third-party and
technology providers' security assessments. Finally, accessing
information about the evolving threat landscape is important in
identifying the changing nature of cyber risk.'').
---------------------------------------------------------------------------

    First, the policies and procedures would need to provide that the
Covered Entity will categorize and prioritize cybersecurity risks based
on an inventory of the components of the Covered Entity's information
systems and information residing on those systems and the potential
effect of a cybersecurity incident on the Covered Entity.\216\ As
discussed earlier, proposed Rule 10 would define the term
``cybersecurity risk'' to mean financial, operational, legal,
reputational, and other adverse consequences that could result from
cybersecurity incidents, cybersecurity threats, and cybersecurity
vulnerabilities.\217\ For example, Covered Entities may be subject to
different cybersecurity risks as a result of, among other things: (1)
the functions they perform and the extent to which they use information
systems to perform those functions; (2) the criticality of the
functions they perform that rely on information systems; (3) the
interconnectedness of their information systems with third-party
information systems; (4) the software that operates on their