The Commission anticipates that an important economic benefit of
the proposal would be to protect the fair, orderly, and efficient
operations of the U.S. securities markets and the soundness of Market
Entities better by requiring all Market Entities to establish,
maintain, and enforce written policies and procedures cybersecurity
policies and procedures. As noted earlier, the average loss in the
financial services industry was $18.3 million, per company per
cybersecurity incident. Adopting and enforcing cybersecurity policies
and procedures could assist Market Entities from incurring such losses.
Furthermore, the requirement to implement cybersecurity policies and
procedures could protect potential negative downstream effects that
could be incurred by other participants in the U.S. securities markets,
such as the Market Entity's customers, counterparties, members,
registrants, and users, in the event of a cybersecurity attack. By
requiring each Market Entity to implement policies and procedures to
address cybersecurity risk, the proposed rule would reduce the
likelihood that one Market Entity's cybersecurity incident can
adversely affect other Market Entities and market participants, as well
as the U.S. securities markets at large.
    In addition, FSOC has stated that ``[m]aintaining and improving
cybersecurity resilience of the financial sector requires continuous
assessment of cyber vulnerabilities and close cooperation across firms
and governments within the U.S. and internationally.'' \776\ The
information provided to the Commission under the proposed reporting
requirements could help in assessing potential cybersecurity risks that
affect the U.S. securities markets. The reporting of significant
cybersecurity incidents also could be used to address future
cyberattacks. For example, these reports could assist the Commission in
identifying patterns and trends across Covered Entities, including
widespread cybersecurity incidents affecting multiple Covered Entities
at the same time. Further, the reports could be used to evaluate the
effectiveness of various approaches that are used to respond to and
recover from significant cybersecurity incidents. Therefore, requiring
Covered Entities to report significant cybersecurity incidents to the
Commission could help assist the Commission in carrying out its mission
of maintaining fair, orderly, and efficient operations of the U.S.
securities markets.
---------------------------------------------------------------------------

    \776\ FSOC, Annual Report (2022), at 70, available at https://home.treasury.gov/system/files/261/FSOC2022AnnualReport.pdf (``FSOC
2022 Annual Report'') (``By exchanging cyber threat information
within a sharing community, organizations can leverage the
collective knowledge, experience, and capabilities of that sharing
community to gain a more complete understanding of the threats the
organization may face.'') See also NIST, Special Pub. 800-150, Guide
to Cyber Threat Information Sharing iii (2016), available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-150.pdf.
The NIST Special Publication also notes that the use of structured
data can facilitate information sharing. Id. at 7 (``Structured data
that is expressed using open, machine-readable, standard formats can
generally be more readily accessed, searched, and analyzed by a
wider range of tools. Thus, the format of the information plays a
significant role in determining the ease and efficiency of
information use, analysis, and exchange.'').
---------------------------------------------------------------------------

    Similarly, requiring Covered Entities to publicly disclose summary
descriptions of their cybersecurity risks and significant cybersecurity
incidents would provide enhanced transparency about cybersecurity
threats that could impact the U.S. securities markets. Participants in
these markets could use this additional information to enhance the
management of their own cybersecurity risks, which also could serve to
strengthen the resilience of the U.S. securities markets to future
cybersecurity threats.
b. Costs
    In general, the costs associated with the proposals include the
costs of developing, implementing, documenting, and reviewing
cybersecurity policies and procedures. For example, a Market Entity
that has only the minimal cybersecurity protection needed to meet the
current regulatory requirements may incur substantial costs when
implementing the policies and procedures required by proposed Rule 10.
These costs could be significantly lower for a Market Entity that
currently has a well-developed and documented cybersecurity program. A
Market Entity that incurs costs under the proposal may attempt to pass
them on to other market participants and even other Market Entities to
the extent that they are able to do that. This could increase costs for
the Market Entity's customers, counterparties, members, registrants, or
users participate in the U.S. securities markets.
    In general, compliance costs with proposed Rule 10 would vary
across the various types of Market Entities. As discussed above, one
factor determining costs would be the extent to which a Market Entity's
existing measures to address cybersecurity risk would comply with the
proposal. Other factors would be the Market Entity's particular
business model, size, and unique cybersecurity risks. While the
compliance costs for smaller entities, such as Non-Covered Broker-
Dealers, may be relatively smaller, those costs may not be
inconsequential relative to their size. Further, Covered Entities may
incur substantial compliance costs given their relatively large size.

2. Policies and Procedures and Annual Review Requirements for Covered
Entities
    The definition of a ``covered entity'' includes a wide range of
Commission registrants. The different Covered Entities that would be
subject to proposed Rule 10 vary based on the types of businesses they
are involved in, their relative sizes, and the number of competitors
they face. As a result, the benefits and costs associated with the
requirements to establish, maintain, and enforce written cybersecurity
policies and procedures and to review them at least annually likely
will vary among the different types of Covered Entities. Because the
benefits and costs are heterogeneous across the different types of
Covered Entities, the costs and benefits that are common to all Covered
Entities are discussed first. Next, the benefits and costs associated
with each type of Covered Entity are examined separately to account for
the different operations and functions they perform and the differences
in how existing or proposed regulations apply to them. The estimated
cost of compliance for a given Covered Entity and for all Covered
Entities combined is provided in the common costs discussion.
a. Common Benefits and Costs for Covered Entities
i. Benefits
    As discussed above, due to the interconnected nature of the U.S.
securities market, strong policies and procedures to address
cybersecurity risks are needed by Covered Entities to protect not only
themselves, but also the Market Entities with whom they do business, as
well as other market participants, such as the Covered Entity's
customers, counterparties, members, or users. The Commission
anticipates that an important economic benefit of the cybersecurity
policies and procedures and annual review requirements of proposed Rule
10 would be to reduce the cybersecurity vulnerabilities of each Market
Entity and enhance the preparedness of each Market Entity against
cybersecurity threats to its operations. This would reduce the
likelihood that the Market Entity experiences the adverse consequences
of a cybersecurity incident. With written cybersecurity policies and
procedures that are maintained and enforced, as well as periodically
reviewed and assessed, Market Entities can better protect themselves
against cybersecurity threats; harden the security surrounding their
information systems and the data, which includes the prevention of
unauthorized access; minimize the damage from successful cyberattacks;
and recover more quickly from significant cybersecurity incidents when
they do occur. For example, the Covered Entity's risk assessment
policies and procedures would need to require written documentation of
these risk assessments.\777\
---------------------------------------------------------------------------

    \777\ See paragraph (b)(1)(i)(B) of proposed Rule 10.
---------------------------------------------------------------------------

    Relatedly, proposed Rule 10 would require that the incident
response and recovery policies and procedures include written
documentation of a cybersecurity incident, including the Covered
Entity's response to and recovery from the incident.\778\ These records
could be used by the Covered Entity to assess the efficacy of, and
adherence to, its incident response and recovery policies and
procedures. The record of the cybersecurity incidents further could be
used as a ``lessons-learned'' document to help the Covered Entity
respond more effectively the next time it experiences a cybersecurity
incident. The Commission staff also could use the records to review
compliance with this aspect of proposed Rule 10.
---------------------------------------------------------------------------

    \778\ See paragraph (b)(1)(v)(B) of proposed Rule 10.
---------------------------------------------------------------------------

    The records discussed above generally could be used by the Covered
Entity when it performs its review to analyze whether its current
policies and procedures need to be updated, to inform the Covered
Entity of the risks specific to it, and to support responses to
cybersecurity risks by identifying cybersecurity threats to information
systems that, if compromised, could result in significant cybersecurity
incidents.\779\ The documentation also could be used by Commission
staff and internal auditors of the Covered Entity to examine for
adherence to the risk assessment policies and procedures.
---------------------------------------------------------------------------

    \779\ See paragraph (b)(2) of proposed Rule 10 (which would
require a Covered Entity to review and assess the design and
effectiveness of the cybersecurity policies and procedures,
including whether the policies and procedures reflect changes in
cybersecurity risk over the time period covered by the review). See
also section II.B.1.f. of this release (discussing the proposed
requirements in more detail).
---------------------------------------------------------------------------

    Moreover, the annual review requirement is designed to require the
Covered Entity to evaluate whether its cybersecurity policies and
procedures continue to work as designed and whether changes are needed
to ensure their continued effectiveness, including oversight of any
delegated responsibilities. As discussed earlier, the sophistication of
the tactics, techniques, and procedures employed by threat actors is
increasing.\780\
---------------------------------------------------------------------------

    \780\ See section I.A.1. of this release (discussing, for
example, how cybersecurity threats are evolving); see also Bank of
England CBEST Report (stating that ``[t]he threat actor community,
once dominated by amateur hackers, has expanded to include a broad
range of professional threat actors, all of whom are strongly
motivated, organised and funded'').
---------------------------------------------------------------------------

    As discussed above, it is unlikely that Covered Entities do not
currently have some minimum level of cybersecurity policies and
procedures in place due to their own business decisions and certain
existing regulations and oversight. However, as discussed above,
current Commission regulations regarding cybersecurity policies and
procedures are narrower in scope. Proposed Rule 10 aims to be
comprehensive in terms of mandating that Covered Entities have
cybersecurity policies and procedures that address all cybersecurity
incidents that may affect their information systems and the funds and
securities as well as personal, confidential, and proprietary
information that may be stored on those systems. The benefits of the
proposed Rule 10 would be lessened to the extent that a Covered Entity
already has implemented cybersecurity policies and procedures that are
generally consistent with the written policies and procedures and
annual review requirements under proposed Rule 10.
    If a Covered Entity has to supplement its existing cybersecurity
policies and procedures, amend them, or institute annual reviews and
document their assessments in a report, the benefit of proposed Rule 10
for that Covered Entity would be greater. The proposal will help ensure
the Covered Entity has robust procedures in place to prevent
cybersecurity incidents, may enable Covered Entities to detect
cybersecurity incidents earlier, and help ensure that Covered Entities
have a plan in place to remediate cybersecurity incidents quickly.
Lastly, as a second-order effect, it could reduce the Covered Entities'
risk of exposure to other Covered Entities' cybersecurity incidents
stemming--for example--from the interconnectedness of Covered Entities'
information systems.
    The Commission currently does not have reliable data on the extent
to which each Covered Entity's existing policies and procedures are
consistent with the proposed Rule 10. Therefore, it is not possible to
quantify the scale of the benefits arising from the proposed policies
and procedures and annual review requirements. However, given the
importance of the U.S. securities markets, the value of the funds and
assets that are traded and held, and the current state of transactions
where much of them are electronic, it seems likely that the Covered
Entities that

transact business digitally have a strong incentive to implement
cybersecurity policies and procedures in order to protect and maintain
their operations. The proposed rule will require Covered Entities to
implement stronger protections that go beyond what they do based on
those market incentives.
    To the extent that Covered Entities engage in business activities
involving crypto assets (which depend almost exclusively on the
operations of information systems), developing strong cybersecurity
policies and procedures would result in large benefits for them and
potentially for their customers, counterparties, members, registrants
or users. For example, robust cybersecurity policies and procedures
would help to ensure that Covered Entities are better shielded from the
theft of crypto assets by threat actors, which may be difficult or
impossible to recover, given the nature of the distributed ledger
technology.\781\ In addition, Covered Entities would avoid negative
reputational damage associated with a successful cyberattack.
---------------------------------------------------------------------------

    \781\ See section II.G. of this release (noting that there is no
centralized IT infrastructure that can dynamically detect and
prevent cyberattacks on wallets or prevent the transfer of
illegitimately obtained crypto assets by bad actors).
---------------------------------------------------------------------------

ii. Costs
    The costs associated with the policies and procedures and annual
review requirements of proposed Rule 10 would primarily result from
compliance costs borne by Covered Entities in the design,
implementation, review, written assessment, and updates of the
cybersecurity policies and procedures. The proposed requirement will
likely change a Covered Entity's behavior toward cybersecurity risk and
necessitates a certain amount of investment in cybersecurity
protection.\782\ In addition to the aforementioned direct compliance
costs faced by Covered Entities, those Covered Entities that utilize
service providers would need to take steps to oversee them under
proposed Rule 10.\783\ The costs of this oversight, including direct
compliance costs, ultimately would likely be passed on to the Covered
Entities' customers, counterparties, members, participants, or users to
the extent Covered Entities are able to do so. As indicated above, the
compliance costs generally may be lessened to the extent that Covered
Entities' existing policies and procedures would be consistent with the
requirements of proposed Rule 10. Therefore, the marginal increase in
compliance costs that arise likely would be due to the extent to which
a Covered Entity needs to make modifications to its existing
cybersecurity policies and procedures, implement annual reviews of
those policies and procedures, and/or write assessments reports.
---------------------------------------------------------------------------

    \782\ While the existing policies and procedures of Covered
Entities largely could be consistent with the requirements of
proposed Rule 10, without a requirement to do so, they may not
conduct annual reviews and draft assessment reports. The annual
review and report costs are estimated be around $1,500 and $20,000
based on the costs of obtaining a cybersecurity audit. See How Much
Does a Security Audit Cost?, Cyber Security Advisor (Jan. 29, 2019),
available at https://cybersecadvisor.org/blog/how-much-does-a-security-audit-cost (``Cost of Security Audit'').
    \783\ See paragraphs (b)(1)(i)(A)(2), (b)(1)(iii)(B), and (b)(2)
of proposed Rule 10.
---------------------------------------------------------------------------

    The compliance costs associated with developing, implementing,
documenting, and reviewing the cybersecurity policies and procedures
for Covered Entities' activities that involve crypto assets likely
would be higher than those connected with traditional services and
technologies offered and used, respectively, by Covered Entities. The
cost difference primarily would be due to technological features of
distributed ledger technologies as well as with the costs increasing as
a Covered Entity engages in activities with additional crypto assets
and blockchains.
iii. Service Providers
    As indicated above, Covered Entities may use service providers to
supply them with some or all of their necessary cybersecurity
protection. In general, the cost of contracted cybersecurity services
depends on the size of the entity, where larger firms may offer a wider
range of services and thus needing more cybersecurity protection.
According to a data security provider blog, ``[a]mong mid-market
organizations (250-999 employees), 46% spend under $250,000 on security
each year and 43% spend $250,000 to $999,999. Among enterprise
organizations (1,000-9,999 employees), 57% spend between $250,000 and
$999,999, 23% spend less than $250,000, and 20% spend at least $1
million. Half of large enterprises (more than 10,000 employees) spend
$1 million or more on security each year and 43% spend between $250,000
and $999,999.'' \784\
---------------------------------------------------------------------------

    \784\ See Desdemona Bandini, New Security Report: The Security
Bottom Line, How Much Security Is Enough?, (Nov. 19, 2019),
available at https://duo.com/blog/new-security-report-the-security-bottom-line-how-much-security-is-enough.
---------------------------------------------------------------------------

    Under the proposal, Covered Entities need to identify their service
providers that receive, maintain, or process information, or are
otherwise permitted to access its information systems and the
information residing on those systems, and then assess the
cybersecurity risks associated with their use by those service
providers.\785\ The policies and procedures for protecting information
would require oversight of the service providers that receive,
maintain, or process the Covered Entities' information, or are
otherwise permitted to access the Covered Entities' information systems
and the data residing on those systems, through a written contractual
agreement, as specified in paragraph (b)(iii)(B) of proposed Rule
10.\786\ Service providers would be required to implement and maintain,
pursuant to a written contract with the Covered Entities, appropriate
measures, including the practices described in paragraph (b) of
proposed Rule 10.
---------------------------------------------------------------------------

    \785\ See paragraph (b)(1)(i)(A)(2) of proposed Rule 10.
    \786\ See paragraph (b)(1)(iii)(B) of proposed Rule 10.
---------------------------------------------------------------------------

    The proposed requirements will likely impose additional costs, at
least initially, on service providers catering to Covered Entities, as
they would be asked to provide services not included in existing
contracts. The Commission believes that most service providers
providing business-critical services would likely face pressure to
enhance their cybersecurity practices to satisfy demand from Covered
Entities due to new regulatory requirements placed on those Covered
Entities.\787\ Service providers may be willing to bear additional
costs in order to continue their business relationships with the
Covered Entities, particularly if the parties are operating under an
ongoing contract.\788\ Such situations are more likely to arise with
services that are considered general information technology, such as
email, relationship management, website hosting, cloud applications,
and other common technologies, given that the service provider does not
have market power because it has many competitors offering these
services. In contrast, providers of more specialized services--such as
payment service providers, regulatory service providers, data
providers, custodians, and providers of valuation services--may have
significant market power and may be able to charge a Covered Entity
separately for the additional services that would be required under
proposed Rule 10. Whether passed on to Covered Entities immediately or
reflected in

subsequent contract renewals, the costs associated the additional
services--including the associated negotiation process--would likely be
passed on to the Covered Entities' customers, counterparties, members,
participants, or users to the extent that they are able to do so.
---------------------------------------------------------------------------

    \787\ A service provider involved in any business-critical
function would likely need to receive, maintain, or process
information from the Covered Entities as well as the Covered
Entities' customers, counterparties, members, registrants, or users.
    \788\ See, e.g., Cost of Security Audit.
---------------------------------------------------------------------------

    In terms of the cost of additional services received from service
providers, those providers that offer a specialized service and have
market power may not be willing to give any price concessions in the
negotiation process. The same may be true for service providers where
Covered Entities make up a small proportion of their overall business.
Other service providers in a more competitive environment--such as
those that offer general information technology services--may be more
willing to provide a discount to keep the Covered Entity as a
customer.\789\ Moreover, the compliance costs for service providers of
common technologies may be generally larger than those realized by
firms that offer specialized services because they cater to a wider
variety of customers, which makes contracts with different parties more
idiosyncratic.
---------------------------------------------------------------------------

    \789\ See Jon Brodkin, IT Shops Renegotiate Contracts to Get
Savings Out of Vendors, Computer World (Nov. 6, 2008), available at
https://www.computerworld.com/article/2781173/it-shops-renegotiate-contracts-to-get-savings-out-of-vendors.html.
---------------------------------------------------------------------------

    Some Covered Entities may find that one or several of their
existing service providers may not be technically able to--or may not
wish to make the investment to--support the Covered Entities'
compliance with the proposed rule. Similarly, some Covered Entities may
find that one or several of their existing service providers may not be
able to--or wish to because of significant market power--enter into
written contracts where the costs are not mutually agreeable. Also,
some service providers may not want to amend their contracts and take
on the particular obligations even if they already have the technical
abilities. In those cases, the Covered Entities would need to change
service providers and bear the associated switching costs, while the
service providers would suffer loss of their customer base.\790\
---------------------------------------------------------------------------

    \790\ For example, the Covered Entity has insufficient market
power to affect changes in the service provider's business practices
and the suite of cybersecurity technologies it currently offers to
that Covered Entity.
---------------------------------------------------------------------------

    For service providers that do business with Covered Entities, the
proposed rule may impose additional costs related to revising the
service provider's cybersecurity practices to satisfy the requirements
that would be imposed on the Covered Entities. Moreover, if a service
provider is already providing services to a Covered Entity that are
largely compliant with proposed Rule 10, then the resulting increase in
compliance costs likely would be minor.
    Even if satisfying additional client requirements would not
represent a significant expense for service providers, the processes
and procedures that are necessary to implement an infrequently utilized
service may prevent some service providers from continuing to work with
the Covered Entity.\791\ That is, the provision of the service may be
viewed as more burdensome than the revenue received from the Covered
Entity. This consequence would serve as a disincentive to the service
provider. In such cases, Covered Entities would bear costs related to
finding alternative service providers while existing service providers
would suffer lost revenue once the Covered Entities switch service
providers.\792\
---------------------------------------------------------------------------

    \791\ For example, the costs associated with legal review of
alterations to standard contracts may not be worth bearing by the
service provider if Covered Entities represent a small segment of
the service provider's business.
    \792\ At the same time, these frictions would benefit service
providers that cater to customers in regulated industries.
---------------------------------------------------------------------------

    To estimate the costs associated with the proposed policies and
procedures requirements and annual review requirements, the Commission
considered the initial and ongoing compliance costs.\793\ The internal
annual costs for these requirements (which include an initial burden
estimate annualized over a three year period) are estimated to be
$14,631.54 per Covered Entity, and $29,102,133.06 in total. These costs
include a blended rate of $462 for a compliance attorney and assistant
general counsel for a total of 31.67 hours. The annual external costs
for adopting and implementing the policies and procedures, as well as
the annual review of the policies and procedures are estimated to be
$3,472 per Covered Entity, and $6,905,808 in total. This includes the
cost of using outside legal counsel at a rate of $496 per hour for a
total of seven hours.
---------------------------------------------------------------------------

    \793\ See section V of this release (discussing these costs in
more detail).
---------------------------------------------------------------------------

b. Broker-Dealers
i. Benefits
    The benefits of the policies and procedures requirements of
proposed Rule 10 for Covered Broker-Dealers likely will not be
consistent across these entities, as their services vary. Covered
Broker-Dealers that are larger, more interconnected with other market
participants, and offer more services have a higher potential for
greater losses for themselves and others in the event of a
cybersecurity incident. Thus, the benefits arising from robust
cybersecurity practices increases with the size and number of services
offered by Covered Broker-Dealers. For example, a cybersecurity
incident at a large Covered Broker-Dealer that facilitates trade
executions and/or provides carrying and clearing services carries
greater risk due to the larger number of services it provides as well
as its interconnections with other Market Entities. For example,
carrying broker-dealers may provide services to multiple introducing
brokers-dealers and their customers. Commission staff determined that,
as of September 2022, carrying broker-dealers have an average of 44
introducing broker-dealers on behalf of which they carry funds and
securities,\794\ with a median number of five broker-dealers.
Furthermore, a carrying broker-dealer may intermediate the connection
between one introducing broker-dealer and the final carrying broker-
dealer.\795\ As a result, there are potentially many avenues for
infiltration, from the introducing broker-dealers to the carrying
broker-dealers. Such Covered Broker-Dealers will not only hold
customers' personally identifiable information and records, but also
typically have control over customers' funds and assets. This makes
them attractive targets for threat actors. In addition, even a brief
disruption of the services offered by a carrying broker-dealer (e.g.,
from a ransomware attack) could have large, negative downstream
repercussions on the broker-dealer's customers and other Covered
Entities (e.g., inability to submit orders during volatile market
conditions or to access funds and securities). The persons negatively
impacted could include not only individuals but also institutional
customers, such as introducing broker-dealers, hedge funds, and family
offices. In this scenario, the Covered Broker-Dealer could incur major
losses if it experienced a significant cybersecurity incident. Thus,
compliance with written cybersecurity policies and procedures, along
with annual reviews and a written assessment report, likely would have
substantial benefits for those Covered Broker-Dealers that hold
customer information, funds, and assets.
---------------------------------------------------------------------------

    \794\ Based on Form Custody, Item 4, as of 2021.
    \795\ Id.
---------------------------------------------------------------------------

    Because Covered Broker-Dealers perform a number of functions in the
U.S. securities markets and those functions are increasingly performed
through the use of information systems,

it is important that those information systems be secure against
cyberattacks. Covered Broker-Dealers use networks to connect their
information systems to those of national securities exchanges, clearing
agencies, and to communicate and transact with other Covered Broker-
Dealers. Written policies and procedures would strengthen a Covered
Broker-Dealer's cybersecurity protocols so that it would be more
difficult for threat actors to disrupt market-making activities in
securities or otherwise compromise the liquidity of the securities
markets, an occurrence that could negatively impact the ability of
investors to liquidate or purchase certain securities at favorable or
predictable prices or in a timely manner.
    ATSs are trading systems that meet the definition of ``exchange''
under federal securities laws but are not required to register as
national securities exchanges if they comply with the conditions of the
Regulation ATS exemption, which includes registering as a broker-
dealer. ATSs have become significant venues for orders and non-firm
trading interest in securities.\796\ ATSs use data feeds, algorithms,
and connectivity to perform their functions. ATSs rely heavily on
information systems to perform these functions, including to connect to
other Market Entities, such as other Covered Broker-Dealers and
national securities exchanges.
---------------------------------------------------------------------------

    \796\ Exchange Act Rule 3a1-1(a)(2) exempts an ATS from the
definition of exchange under section 3(a)(1) of the Exchange Act on
the condition that the ATS complies with Regulation ATS. See
generally Regulation of NMS Stock Alternative Trading Systems
Release, 83 FR 38768; Amendments Regarding the Definition of
``Exchange'' and ATSs Release, 87 FR 15496.
---------------------------------------------------------------------------

    A significant cybersecurity incident that disrupts an ATS could
negatively impact the ability of investors to liquidate or purchase
certain securities at favorable or predictable prices or in a timely
manner to the extent it provides liquidity to the market for those
securities. Furthermore, the records stored by ATSs on their
information systems consist of proprietary information about Market
Entities that use their services, including confidential business
information (e.g., information about their trading activities). A
significant cybersecurity incident at an ATS could lead to the improper
use of this information to harm the Market Entities (e.g., public
exposure of confidential trading information) or provide the
unauthorized user with an unfair advantage over other market
participants (e.g., trading based on confidential business
information). Comprehensive cybersecurity policies and procedures,
along with periodic assessments, would fortify broker-dealer ATS
operations in their efforts to thwart cybersecurity attacks.
    On the other hand, a small Covered Broker-Dealer could experience a
cybersecurity incident that has significant negative impacts on the
entity and its customers, such as a disruption to its services or the
theft of a customer's personal information. These types of incidents
would have profound negative effects for the small Covered Broker-
Dealer and its customers, but the negative effects would likely be
insignificant relative to the size of the entire U.S. securities
markets. In this case, strong cybersecurity policies and procedures
generally could provide substantial benefits to small Covered Broker-
Dealers themselves and their customers, but likely not to other market
participants.
    As discussed in the baseline, Covered Broker-Dealers currently are
subject to Regulations S-P, Regulation S-ID, FINRA rules, and SRO and
Commission oversight, as well as Regulation ATS applying to broker-
dealer operated ATSs.\797\ In addition, Covered Broker-Dealers that
operate an ATS and trade certain stocks exceeding specific volume
thresholds are subject to Regulation SCI.\798\ As discussed above,
Regulation S-P, Regulation ATS, and Regulation S-ID have requirements
to establish policies and procedures that address certain cybersecurity
risks.\799\ Therefore, Covered Broker-Dealers subject to these other
regulations have existing cybersecurity policies and procedures that
address certain cybersecurity risks. However, proposed Rule 10 would
require all Covered Broker-Dealers to establish, maintain, and enforce
a set of cybersecurity policies and procedures that is broader and more
comprehensive than is required under the existing requirements of
Regulation S-P, Regulation S-ID, and Regulation ATS that pertain to
cybersecurity risk. This could substantially benefit these Covered
Broker-Dealers and their customers and counterparties as well as other
Market Entities that provide services to them or transact with them. In
particular, the failure to protect a particular information system from
cybersecurity risk can create a vulnerability that a threat actor could
exploit to access other information systems of the Covered Broker-
Dealer. Therefore, proposed Rule 10--because it would require all
information systems to be protected by policies and procedures--would
result in benefits to Covered Broker-Dealers (i.e., enhanced
cybersecurity resiliency).
---------------------------------------------------------------------------

    \797\ See section IV.C.1.b.i. of this release (discussing as
part of the baseline the current relevant regulations applicable to
broker-dealers); see also section II.F. of this release (discussing
other relevant regulations applicable to Covered Broker-Dealers).
    \798\ Id.
    \799\ See section II.F.1.c. of this release (discussing in more
detail the existing requirements of Regulation S-P, Regulation ATS,
and Regulation S-ID to have policies and procedures to address
certain cybersecurity risks).
---------------------------------------------------------------------------

    Covered Broker-Dealers that are registered as FCMs or swap dealers
are subject to NFA requirements that relate to proposed Rule 10.\800\
These additional requirements may bring those dually-registered Covered
Broker-Dealers more in line with the requirements of the proposed
rule.\801\ As a result, the marginal benefit of compliance for them may
be smaller than those that are only registered with the Commission.
---------------------------------------------------------------------------

    \800\ See section IV.C.1.d.iii. of this release (discussing as
part of the baseline current CFTC-related requirements applicable to
FCMs and swap dealers).
    \801\ See section I.B. of this release (discussing the proposed
requirements for Covered Entities, including Covered Broker-Dealers,
with respect to cybersecurity policies and procedures).
---------------------------------------------------------------------------

ii. Costs
    The compliance costs of the policies and procedures requirements of
proposed Rule 10 for Covered Broker-Dealers may generally be lower, to
the extent their current policies and procedures are designed to comply
with Regulation SCI, Regulation S-P, Regulation ATS (if they operate an
ATS), Regulation S-ID, and FINRA rules and are consistent with certain
of the requirements of the proposed Rule 10.\802\ However, the
requirements of proposed Rule 10 are designed to address all of the
Covered Broker-Dealer's cybersecurity risks; whereas the requirements
of these other regulations that relate to cybersecurity are more
narrowly focused. Consequently, the marginal costs associated with
implementing the cybersecurity policies and procedures required under
the proposed Rule 10 would depend on the extent to which broker-
dealers' existing cybersecurity protections address cybersecurity risks
beyond those that are required to be addressed by these other
regulations.
---------------------------------------------------------------------------

    \802\ See section II.F.1.c. of this release (discussing the
requirements of proposed Rule 10 and how they relate to Regulation
S-P, Regulation ATS, and Regulation S-ID).
---------------------------------------------------------------------------

    Covered Broker-Dealers that are dually registered with the CFTC as
FCMs or swap dealers are subject to

NFA requirements, as noted above.\803\ These additional requirements
may make compliance with the proposed rule less burdensome and thus
less costly, as those NFA requirements are already in place.
---------------------------------------------------------------------------

    \803\ See section IV.C.1.d.iii. of this release (discussing as
part of the baseline current CFTC-related requirements applicable to
FCMs and swap dealers).
---------------------------------------------------------------------------

c. Clearing Agencies and National Securities Exchanges
i. Benefits
    Strong cybersecurity protocols at national securities exchanges
would help maintain their critical function of matching orders of
buyers and sellers. A cybersecurity incident could prevent an exchange
from executing trades, therefore preventing members and their customers
from buying or selling securities at the exchange. Interruptions in
order flow and execution timing could lead to inefficiencies in order
matching, possibly resulting in a less desirable execution price.
Moreover, customer information could be stolen and trading strategies
could be revealed. Lastly, a cybersecurity breach could be problematic
for market surveillance staff that monitors the market for illegal
trading activity. Thus, the policies and procedures requirements of
proposed Rule 10 could offer significant benefits to national
securities exchanges and market participants that depend on their
processing of order flow and the ability of regulators to surveil the
market.
    Clearing agencies serve an important role in the securities markets
by ensuring that executed trades are cleared and that the funds and
securities are transferred to and from the appropriate accounts. A
cybersecurity incident at a clearing agency could result in delays in
clearing as well as in the movement of funds and assets. Such an
incident also could lead to the loss or misappropriation of customer
information, funds, and assets. Threat actors could also gain access to
and misappropriate the clearing agency's default fund by, for example,
obtaining access to the clearing agency's account in which the fund is
held. Strong cybersecurity policies and procedures would assist
clearing agencies in protecting the funds and securities in their
control. This would benefit the clearing agency, its members, and
market participants that rely on the services of its members.
    As discussed in the baseline, national securities exchanges,
registered clearing agencies, and certain exempt clearing agencies are
subject to Regulation SCI.\804\ Regulation SCI has requirements for SCI
entities to establish policies and procedures that address certain
cybersecurity risks The proposed requirements of proposed Rule 10, in
contrast, apply to all of the Covered Entity's information systems. The
benefits of the policies and procedures requirements of proposed Rule
10 would depend on the extent to which the national securities
exchanges' and clearing agencies' current cybersecurity policies and
procedures (which include those required by Regulation SCI) are
consistent with those required under the proposed rule. Major changes
in cybersecurity policies and procedures could yield large benefits.
However, the marginal benefit of the proposed rule likely would decline
the more closely a national securities exchange's or clearing agency's
cybersecurity policies and procedures are consistent with the
requirements of proposed Rule 10.
---------------------------------------------------------------------------

    \804\ See section IV.C.1.b.ii. of this release (discussing as
part of the baseline the relevant regulations applicable to national
securities exchanges and clearing agencies).
---------------------------------------------------------------------------

    Clearing agencies that are registered as DCOs are subject to
additional CFTC requirements that may be related to those of proposed
Rule 10.\805\ As a result, the marginal benefit of proposed Rule 10 may
be smaller than those that are only registered with the Commission.
---------------------------------------------------------------------------

    \805\ See section IV.C.1.d.i. of this release (discussing as
part of the baseline the current relevant CFTC regulations
applicable to DCOs).
---------------------------------------------------------------------------

ii. Costs
    The incremental cost of compliance with the policies and procedures
requirements of proposed Rule 10 for national exchanges and clearing
agencies depends on how much their current cybersecurity policies and
procedures go beyond what is required by Regulation SCI. This is
because the requirements of proposed Rule 10 are designed to address
all of the cybersecurity risks faced by a national securities exchange
or clearing agency; in contrast, the requirements of Regulation SCI
that relate to cybersecurity are more narrowly focused.\806\ Therefore,
national securities exchanges and clearing agencies that have policies
and procedures in place that only address the requirements of
Regulation SCI will need to make potentially significant changes to
their cybersecurity policies and procedures in order to comply with the
requirements of proposed Rule 10. Alternatively, national securities
exchanges and clearing agencies that currently have comprehensive
cybersecurity policies and procedures may incur fewer costs to comply
with proposed Rule 10. Nevertheless, assuming that they do not do so
already, ensuring that those cybersecurity policies and procedures are
documented and reviewed on an annual basis as required by the proposal,
with an accompanying written assessment, would assist national
securities exchanges and clearing agencies to withstand cybersecurity
incidents and address them more effectively, thus minimizing the
negative effects of such occurrences.
---------------------------------------------------------------------------

    \806\ See section II.F.1.c. of this release (discussing the
requirements of proposed Rule 10 and how they relate to the
requirements of Regulation SCI).
---------------------------------------------------------------------------

    Clearing agencies that are dually registered with the CFTC as DCOs
are subject to that agency's systems safeguards rule, as noted
above.\807\ Complying with the CFTC requirements may make compliance
with the proposed rule less burdensome and thus less costly, to the
extent that the registered DCO implements the CFTC requirements on the
registered clearing agency side of its operations.
---------------------------------------------------------------------------

    \807\ See section IV.C.1.c.i. of this release (discussing as
part of the baseline the current relevant CFTC regulations
applicable to DCOs).
---------------------------------------------------------------------------

    Finally, national securities exchanges and clearing agencies that
are registered with the Commission but currently are not active would
incur substantially higher costs relative to their active peers if they
needed to come into compliance with proposed Rule 10. If they resume
clearing activities and operations, they may incur significant costs to
develop, document, implement, maintain, and enforce policies and
procedures, including cybersecurity policies and procedures, as well as
establish protocols for written annual reviews with necessary
modifications and updates.
d. FINRA and the MSRB
i. Benefits
    FINRA is the only national securities association currently
registered with the Commission. Similarly, the MSRB is the only entity
(other than the Commission) established by Congress to, among other
activities, propose and adopt rules with respect to transactions in
municipal securities.
    FINRA issues cybersecurity-related statements to members that
discuss best practices for achieving adequate cybersecurity
protection.\808\ FINRA and MSRB members are also subject to internal
oversight and external audits. Nevertheless, both FINRA and the

MSRB store proprietary information about their members, including
confidential business information, on their respective information
systems. FINRA stores information about broker-dealers and trades. Some
information and systems under FINRA's control may belong to other
organizations where FINRA is simply contracted to perform data
processing duties. There also may be sensitive information related to
FINRA's oversight practices that is not made public, such as regulatory
assessments of various broker-dealers or internal analyses regarding
its examinations and examination programs. Furthermore, FINRA may keep
information on cyberattacks on itself and on broker-dealers that, if
made public, could compromise existing cybersecurity systems.
Therefore, FINRA and the MSRB themselves require their own
cybersecurity policies and procedures.
---------------------------------------------------------------------------

    \808\ See FINRA, Cybersecurity, available at https://www.finra.org/rules-guidance/key-topics/cybersecurity#overview.
---------------------------------------------------------------------------

    As discussed in the baseline, FINRA and the MSRB are subject to
Regulation SCI.\809\ Regulation SCI has requirements to establish
policies and procedures that address certain cybersecurity risks.\810\
Therefore, the benefits of the policies and procedures requirements of
proposed Rule 10 would depend on the extent to which the FINRA's and
the MSRB's current cybersecurity policies and procedures (which include
those required by Regulation SCI) are consistent with those required
under the proposed rule. This means the marginal benefit of the
proposed rule may be limited depending on how closely FINRA's and the
MSRB's cybersecurity policies and procedures are consistent with
proposed Rule 10. Nevertheless, ensuring that those cybersecurity
policies and procedures are documented and reviewed on an annual basis,
with an accompanying written assessment, could assist the two entities
in avoiding cybersecurity incidents and addressing them more
effectively, thus minimizing the negative effects of such occurrences.
---------------------------------------------------------------------------

    \809\ See section IV.C.1.b.ii. of this release (discussing as
part of the baseline the current relevant regulations applicable to
national securities associations and FINRA).
    \810\ See section II.F.1.c. of this release (discussing in more
detail the requirements of Regulation SCI).
---------------------------------------------------------------------------

ii. Costs
    As with national securities exchanges and clearing agencies, the
Commission does not expect that FINRA and the MSRB will incur
significant costs as a result of complying with the policies and
procedures requirements of proposed Rule 10 because they are already
subject to Regulation SCI and, due to their importance in the oversight
and oversight of their members or registrants, as well as the storage
of trade information and data owned by other parties, there are strong
incentives for FINRA and the MSRB to invest in comprehensive
cybersecurity programs.
e. SBS Entities
i. Benefits
    As discussed in the baseline, SBS Entities must comply with section
15F(j)(2) of the Exchange Act and various Commission rules. SBS
Entities that are dually registered with the CFTC are subject to that
agency's rules as well as the rules of the NFA.\811\ The benefits that
would accrue to SBS Entities depend on the level of cybersecurity
protection they currently have in place. Policies and procedures that
are consistent with the policies and procedures requirements of
proposed Rule 10 may only need moderate updating and adjustment. As a
result the marginal benefits likely are small. There would be much
greater benefits for SBS Entities that must significantly revise their
current policies and procedures. Further, proposed Rule 10 would
require that SBS Entities have policies and procedures to respond to
and recover from cybersecurity incidents, which would assist the SBS
Entities in minimizing the harm caused by the incident and enhancing
their ability to recover from it. Annual reviews also would help them
update their policies and procedures to address emerging threats.
---------------------------------------------------------------------------

    \811\ See section IV.C.1.c.iii. of this release (discussing as
part of the baseline current relevant regulations applicable to SBS
Entities).
---------------------------------------------------------------------------

    SBS Entities that are registered as swap dealers are subject to
additional requirements of the CFTC and NFA that may be related to
those of proposed Rule 10.\812\ As a result, the marginal benefit of
compliance for them may be smaller than those that are only registered
with the Commission.
---------------------------------------------------------------------------

    \812\ See section IV.C.1.c.iii. of this release (discussing as
part of the baseline the current relevant CFTC regulations
applicable to swap dealers).
---------------------------------------------------------------------------

ii. Costs
    Complying with the policies and procedures requirements of proposed
Rule 10 may not be costly for SBS Entities. SBS Entities must comply
with section 15F(j)(2) of the Exchange Act and various Commission
rules. The costs that arise from compliance with proposed Rule 10
depend on how closely their current documented policies and procedures,
as well as annual reviews and summary reports, are consistent with the
proposed rule. SBS Entities that have very similar cybersecurity
policies and procedures to those that would be required under proposed
Rule 10 would have small associated costs to come into compliance with
the rule. SBS Entities that need to make more substantial changes to
their cybersecurity policies and procedures to comply with the proposed
rule would incur higher attendant costs. Ultimately, the ability of SBS
Entities to bear those additional costs depends on the competitive
landscape of the security-based swap market.
    SBS Entities that are dually registered with the CFTC as swap
dealers are subject to that agency's requirements, as noted above.\813\
These additional requirements may make compliance with the proposed
rule less burdensome and thus less costly, as the CFTC requirements are
already in effect and dually registered SBS Entities must comply with
those regulations.
---------------------------------------------------------------------------

    \813\ See section IV.C.1.c.iii. of this release (discussing as
part of the baseline the current relevant CFTC regulations
applicable to swap dealers).
---------------------------------------------------------------------------

f. SBSDRs
i. Benefits
    SBSDRs collect and maintain security-based swap transaction data so
that relevant authorities can access and analyze the data from secure,
central locations, thereby allowing regulators to monitor for potential
market abuse and risks to financial stability.\814\ SBSDRs also reduce
operational risk and enhance operational efficiency in the security-
based swap market, such as by maintaining transaction records that help
counterparties ensure that their records reconcile.\815\
---------------------------------------------------------------------------

    \814\ See SBSDR Adopting Release, 80 FR at 14440 (``[SBSDRs] are
required to collect and maintain accurate SBS transaction data so
that relevant authorities can access and analyze the data from
secure, central locations, thereby putting them in a better position
to monitor for potential market abuse and risks to financial
stability.'').
    \815\ See SBSDR Proposing Release at 77307 (stating that ``[t]he
enhanced transparency provided by an [SBSDR is important to help
regulators and others monitor the build-up and concentration of risk
exposures in the [security-based swap] market . . . . In addition,
[SBSDRs] have the potential to reduce operational risk and enhance
operational efficiency in the [security-based swap] market'').
---------------------------------------------------------------------------

    The Commission requires SBSDRs to have written documentation
regarding how they keep such transaction information secure.\816\ If
the policies and procedures requirements of proposed Rule 10 requires
an SBSDR to do additional development, documentation, implementation,
and review of its cybersecurity policies and procedures, then the
benefits that accrue

from doing so will be large. In this circumstance, compliance with the
policies and procedures requirements of proposed Rule 10 would bolster
SBSDRs' cybersecurity resiliency. As a result, SBSDRs would be better
prepared to identify cybersecurity vulnerabilities and prevent
significant cybersecurity incidents, thereby safeguarding the security-
based swap trade data that they receive and maintain. Further, proposed
Rule 10 would require that SBSDRs have policies and procedures to
respond to and recover from a significant cybersecurity incident, which
would assist SBSDRs in minimizing the harm caused by the incident and
enhancing their ability to recover from it. Annual reviews also would
help them update their policies and procedures to address emerging
threats.
---------------------------------------------------------------------------

    \816\ See section IV.C.1.b.iv. of this release (discussing as
part of the baseline the current relevant regulations applicable to
SBSDRs).
---------------------------------------------------------------------------

    SBSDRs that are dually registered with the CFTC as SDRs must comply
with that agency's systems safeguards rule, applicable to information
systems for data under the CFTC's jurisdiction.\817\ These additional
requirements may bring those dually-registered SBSDRs more in line with
the requirements of the proposed rule, to the extent that the
registered entity applies the CFTC's systems safeguard requirements to
the SBSDR operations. As a result, the marginal benefit of compliance
for them may be smaller than those that are only registered with the
Commission.
---------------------------------------------------------------------------

    \817\ See section IV.C.1.d.ii. of this release (discussing as
part of the baseline the current relevant CFTC regulations
applicable to SDRs).
---------------------------------------------------------------------------

ii. Costs
    The costs that arise from compliance with the policies and
procedures requirements of proposed Rule 10 depend on how closely the
current documented policies and procedures of SBSDRs are consistent
with the proposed rule. SBSDRs that have very similar cybersecurity
policies and procedures to those that would be required under proposed
Rule 10 would face small costs to amend their cybersecurity policies
and procedures. SBSDRs that need to make more substantial changes to
their cybersecurity policies and procedures to comply with the proposed
rule would realize greater marginal benefits from attaining compliance,
while incurring higher attendant costs.
    SBSDRs that are dually registered with the CFTC as SDRs are subject
to that agency's system safeguards rule, as noted above.\818\ These
additional requirements may make compliance with the proposed rule less
burdensome and thus less costly, to the extent the registered entity
applies the CFTC's system safeguard requirements to its SBSDR
operations.
---------------------------------------------------------------------------

    \818\ See section IV.C.1.d.iii. of this release (discussing as
part of the baseline the current relevant CFTC regulations
applicable to swap dealers).
---------------------------------------------------------------------------

g. Transfer Agents
i. Benefits
    The benefits of the policies and procedures requirements of
proposed Rule 10 likely will differ across transfer agents, as their
size and the level of their services may vary. Transfer agents, among
other functions, may: (1) track, record, and maintain on behalf of
issuers the official record of ownership of each issuer's securities;
(2) cancel old certificates, issue new ones, and perform other
processing and recordkeeping functions that facilitate the issuance,
cancellation, and transfer of those securities; (3) facilitate
communications between issuers and registered securityholders; and (4)
make dividend, principal, interest, and other distributions to
securityholders.\819\ A cybersecurity incident at a transfer agent
would have varying negative impacts depending on the range of services
offered by the transfer agent. Nonetheless, for the issuer who depends
on the transfer agent to maintain the official record of ownership, or
for securityholders who depend on the transfer agent for distributions,
an incident at even a small transfer agent with limited services could
have profound negative implications.
---------------------------------------------------------------------------

    \819\ See section I.A.2.i. of this release (discussing critical
operations and functions of transfer agents).
---------------------------------------------------------------------------

    In addition, some transfer agents may maintain records and
information related to securityholders that could include names,
addresses, phone numbers, email addresses, employers, employment
history, bank and specific account information, credit card
information, transaction histories, securities holdings, and other
detailed and individualized information related to the transfer agents'
recordkeeping and transaction processing on behalf of issuers. This
information may make a transfer agent particularly attractive to threat
actors. Compliance with written cybersecurity policies and procedures
under proposed Rule 10, along with annual reviews and a written
assessment report, would likely produce a large benefit for clients and
investors of transfer agents.
    Preventing successful cyberattacks would keep securities from being
stolen by threat actors and would ensure that dividends are paid when
promised. In addition, because transfer agents have information on the
securityholders' personal information, policies and procedures to
protect that information from unauthorized access or use would benefit
the transfer agent and the securityholders. Moreover, if a significant
cybersecurity incident materializes, transfer agents would have a plan
to resolve the issue, thus potentially reducing the timeframe and
damage associated with the incident.
    As discussed in the baseline, transfer agents registered with the
Commission (but not transfer agents registered with another appropriate
regulatory agency) are subject to the Regulation S-P Disposal Rule and
may be subject to Regulation S-ID.\820\ The Regulation S-P Disposal
Rule and Regulation S-ID require measures that implicate a certain
cybersecurity risk.\821\ Nonetheless, the policies and procedures
requirements of proposed Rule 10 would still provide substantial
benefits to transfer agents. This is because, as discussed above,
proposed Rule 10 would require all transfer agents to establish,
maintain, and enforce policies and procedures to address cybersecurity
risks that are broader and more comprehensive than those policies and
procedures required by the existing requirements of Regulation S-P or
Regulation S-ID.
---------------------------------------------------------------------------

    \820\ See section IV.C.1.b.v. of this release (discussing as
part of the baseline the current relevant regulations applicable to
transfer agents). Transfer agents that are subsidiaries of bank
holding companies would incur minimal cost since they are already
subject to federal banking cybersecurity regulations.
    \821\ See section II.F.1.c. of this release (discussing in more
detail the existing requirements of the Regulation S-P Disposal Rule
and Regulation S-ID).
---------------------------------------------------------------------------

ii. Costs
    Transfer agents likely would incur moderate costs in complying with
the policies and procedures requirements of proposed Rule 10 if their
current policies and procedures--including those to comply with the
Regulation S-P Disposal Rule and Regulation S-ID (if either or both
apply)--would need to be augmented to meet the requirements of proposed
Rule 10. Transfer agents also would have to do annual reviews and write
assessment reports. Such costs likely would be passed on to the
entities that use transfer agent's services. Transfer agents that have
made the business decision to implement robust cybersecurity policies,
procedures, and practices would incur lower marginal compliance costs,
to the degree those policies, procedures, and practices are consistent
with the requirements of proposed Rule 10.

h. Request for Comment
    The Commission requests comment on all aspects of the foregoing
analysis of the benefits and costs of the policies and procedures,
review and assessment, and report requirements of proposed Rule 10.
Commenters are requested to provide empirical data in support of any
arguments or analyses. In addition, the Commission is requesting
comment on the following matters:
    1. Please discuss which types of Covered Entities have some level
of cybersecurity in place and which may not? If not, explain why.
Please describe the level of cybersecurity policies and procedures that
have been implemented by Covered Entities and compare them to the
requirements of proposed Rule 10.
    2. Do the benefits and costs associated with Covered Entities
having written cybersecurity policies and procedures, including
provisions for written annual reviews and assessments, reports, and
updates (if necessary) vary by the type of Covered Entity? If so,
explain how. Are there benefits and costs of the proposals not
described above? If so, please describe them.
    3. Are the estimated compliance costs (both initially and on an
ongoing basis) for Covered Entities to adopt cybersecurity policies and
procedures, along with reviewing them annually and drafting a summary
report, reasonable? If not, explain why and provide estimates of the
compliance costs.
    4. How costly would it be for a given type of Covered Entity to
become compliant with proposed Rule 10? Please explain and provide
estimates of the costs.
    5. Do Covered Entities typically document their cybersecurity
policies and procedures? If not, how costly would it be for them to be
documented?
    6. Please describe practices of Covered Entities with regard to the
use of service providers in connection with their information systems
and the information residing on those systems. How many Market Entities
contract with service providers? What functions are contracted out
versus completed in house? Are the cybersecurity policies and
procedures implemented by these service providers comparable to the
requirements of proposed Rule 10? Please explain. Would it be costly
contractually to request that a service provider provide compliant
services, including documented policies and procedures? What are the
costs of finding a new service provider if one or more could not
provide services that are compliant with the proposed rule?
    7. How costly would it be to review and update, if necessary,
cybersecurity policies and procedures at least annually? Would it be
preferable to conduct the reviews on either a more or less frequent
basis? Explain why. Would it be less costly to have a third party
conduct the review and update of a Covered Entities' cybersecurity
policies and procedures? Please explain.
3. Regulatory Reporting of Cybersecurity Incidents by Covered Entities
    Under proposed Rule 10, Covered Entities would need to provide the
Commission with immediate written electronic notice of a significant
cybersecurity incident affecting the Covered Entity and, thereafter,
report and update information about the significant cybersecurity
incident by filing Part I of proposed Form SCIR with the Commission
through the EDGAR system.\822\ The form would elicit information about
the significant cybersecurity incident and the Covered Entity's efforts
to respond to, and recover from, the incident. In the case of certain
Covered Entities, the notice and subsequent reports would need to be
provided to other regulators.
---------------------------------------------------------------------------

    \822\ See sections II.B.2. and II.B.4. of this release
(discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

a. Benefits
    The requirements of proposed Rule 10 that Covered Entities provide
immediate written electronic notice and subsequent reporting about
significant cybersecurity incidents to the Commission and would improve
the Commission's ability to assess these incidents. These requirements
also would allow the Commission to understand better the causes and
impacts of significant cybersecurity incidents and how Covered Entities
respond to and recover from them. Thus, the notification and reporting
requirements--through the information they would provide the
Commission--could be used to understand better how significant
cybersecurity incidents materialize and, therefore, how Covered
Entities can better protect themselves from them and, when they occur,
how Covered Entities can better mitigate their impacts and recover more
quickly from them. Over time, this database of information could
provide useful insights into how to minimize the harm more broadly that
is caused by significant cybersecurity incidents, which have the
potential to cause broader disruptions to the U.S. securities markets
and undermine financial stability.
    A Covered Entity would be required to provide immediate written
electronic notice to the Commission of a significant cybersecurity
incident upon having a reasonable basis to conclude that the incident
has occurred or is occurring.\823\ This timeframe allows for quick
notification to the Commission and, in some cases, other regulators
about the significant cybersecurity incident, which--in turn--would
allow for more timely assessment of the incidents. These incidents, if
not addressed quickly, could have harmful spillover impacts to other
Market Entities and participants in the U.S. securities markets.
---------------------------------------------------------------------------

    \823\ See paragraph (c)(1) of proposed Rule 10.
---------------------------------------------------------------------------

    The immediate written electronic notice would need to identify the
Covered Entity, state that the notice is being given to alert the
Commission of a significant cybersecurity incident impacting the
Covered Entity, and provide the name and contact information of an
employee of the Covered Entity who can provide further details about
the significant cybersecurity incident.\824\ By not requiring detailed
information about the significant cybersecurity incident, the Covered
Entity would be able to provide the notice quickly while it continues
to assess which information systems have been subject to the
significant cybersecurity incident and the impact that the incident has
had on those systems. This would facilitate the Covered Entity's
ability to alert the Commission and other regulators (if applicable) at
a very early stage after it has a reasonable basis to conclude that a
significant cybersecurity incident has occurred or is occurring. This,
in turn, would allow the Commission and other regulators (if
applicable) to begin taking steps to assess the significant
cybersecurity incident at that early stage.
---------------------------------------------------------------------------

    \824\ Id.
---------------------------------------------------------------------------

    This proposed immediate written electronic notification requirement
is modelled on other notification requirements that apply to broker-
dealers and SBSDs pursuant to other Exchange Act rules. Under these
existing requirements, broker-dealers and certain SBSDs must provide
the Commission with same-day written notification if they undergo
certain adverse events, including falling below their minimum net
capital requirements or failing to make and keep current required books
and records.\825\ The objective of these requirements is to provide the
Commission staff with the opportunity to respond when a broker-

dealer or SBSD is in financial or operational difficulty.\826\
Similarly, the immediate written electronic notification requirement of
proposed Rule 10 would provide the Commission staff with the
opportunity to promptly begin to assess the situation when a Covered
Entity is experiencing a significant cybersecurity incident.
---------------------------------------------------------------------------

    \825\ See 17 CFR 240.17a-11 (notification rule for broker-
dealers); 17 CFR 240.18a-8 (notification rule for SBS Entities).
    \826\ See SBS Entity Recordkeeping and Reporting Proposing
Release, 79 FR at 25247.
---------------------------------------------------------------------------

    Promptly thereafter (but no later than 48 hours), a Covered Entity
would be required to report separately more detailed information about
the significant cybersecurity incident by filing initial, amended and
final versions of Part I of proposed Form SCIR with the Commission
through the EDGAR.\827\ The Covered Entity also would be required to
file updated reports and a final report.
---------------------------------------------------------------------------

    \827\ See paragraphs (c)(2) of proposed Rule 10. As discussed
below, Part II of proposed Form SCIR would be used by Covered
Entities to make public disclosures about the cybersecurity risks
they face and the significant cybersecurity incidents they
experienced during the current or previous calendar year. See
sections II.B.2. and II.B.4. of this release (discussing these
proposed requirements).
---------------------------------------------------------------------------

    The reporting requirements under proposed Rule 10 would provide the
Commission and its staff with information to understand better the
nature and extent of a particular significant cybersecurity incident
and the efficacy of the Covered Entity's response to mitigate the
disruption and harm caused by the incident.\828\ It also strengthens
and expands the Commission's knowledge regarding cybersecurity
incidents beyond what is already required by current Commission
regulations. In addition, the reporting would provide the staff with a
view into the Covered Entity's understanding of the scope and impact of
the significant cybersecurity incident. All of this information would
assist the Commission and its staff in assessing the significant
cybersecurity incident impacting the Covered Entity. It also could
benefit other Market Entities to the extent the confidential
information provided by the impacted Covered Entity could be used to
assist them (without divulging the identity of the impacted Covered
Entity) in avoiding a similar significant cybersecurity incident or
succumbing to an attack by the same threat actor that caused the
significant cybersecurity incident.
---------------------------------------------------------------------------

    \828\ See Line Items 2 through 14 of Part I of proposed Form
SCIR (eliciting information about the significant cybersecurity
incident and the Covered Entity's response to the incident).
---------------------------------------------------------------------------

    The information provided to the Commission under the proposed
reporting requirements also would be used to assess the potential
cybersecurity risks affecting U.S. securities markets more broadly.
This information could be used to address future significant
cybersecurity incidents or address cybersecurity vulnerabilities that
may be present at other similar Covered Entities. For example, these
reports could assist the Commission in identifying patterns and trends
across Covered Entities, including widespread cybersecurity incidents
affecting multiple Covered Entities at the same time. Further, the
reports could be used to evaluate the effectiveness of various
approaches to respond to and recover from a different types of
significant cybersecurity incidents. This could benefit all Market
Entities, other participants in the U.S. securities markets, and
ultimately promote the fair, orderly, and efficient operation of the
U.S. securities markets.
    Requiring Covered Entities to file Part I of proposed Form SCIR in
EDGAR in a custom XML would allow for more efficient processing of
information about significant cybersecurity incidents. It would create
a comprehensive set of data of all significant cybersecurity incidents
impacting Covered Entities that is based on these entities responding
to the same check boxes and questions on the form. This would
facilitate analysis of the data, including analysis across different
Covered Entities and significant cybersecurity incidents. Eventually,
this set of data and the analysis of it by searching and sorting based
on how different Covered Entities responded to the same questions on
the form could be used to spot common trending risks and
vulnerabilities as well as best practices employed by Covered Entities
to respond to and recover from significant cybersecurity incidents.
    As discussed above, Covered Entities have incentives to not
disclose information about significant cybersecurity incidents. Such
incentives constrain the information available about cybersecurity
threats and thereby inhibit the efficacy of collective (i.e., an
industry's or a society's) cybersecurity measures.\829\ At the same
time, complete transparency in this area likely runs the risk of
facilitating future attacks.\830\ As discussed above, the challenge of
effective information sharing has long been recognized, and government
efforts at encouraging such sharing on a voluntary basis have had only
limited success.\831\ The Commission would not publicly disclose and
would keep them confidential to the extent permitted by law Part I of
proposed Form SCIR. This would limit the risks associated with public
disclosure of vulnerabilities as a result of successful cybersecurity
incidents. The Commission also may share information with relevant law
enforcement or national security agencies.
---------------------------------------------------------------------------

    \829\ See section IV.B. of this release (discussing broad
economic considerations); see, e.g., Lewis and Zheng, Cyber Threat
Information Sharing (recommending that regulators encourage
information sharing).
    \830\ Although ``security through obscurity'' as a cybersecurity
philosophy has long been derided, ``obscurity,'' or more generally
``deception,'' has been recognized as an important cyber resilience
technique. See Ron Ross, Victoria Pillitteri, Richard Graubart,
Deborah Bodeau, and Rosalie McQuaid, Developing Cyber Resilient
Systems: A Systems Security Engineering Approach, 2 Nat. Inst. of
Standards and Tech. (Dec. 2021), available at https://doi.org/10.6028/NIST.SP.800-160v2r1. See also Section IV.D.2.b (discussion
of costs associated with disclosure).
    \831\ See section IV.C.1.e. of this release (discussing
information sharing).
---------------------------------------------------------------------------

    The aforementioned benefits arise from improved information sharing
between the affected Covered Entity and the Commission. Delays in
incident reporting may hinder the utility of Part I of proposed Form
SCIR because the Commission would not be able to assess the situation
close to the time of its occurrence or discovery. Thus, the utility of
such reports, at least initially, may be more limited if they are not
filed as quickly as proposed.
    Requiring Covered Entities to identify themselves on Part I of
proposed Form SCIR with a UIC \832\ if they already have a UIC would be
beneficial because the LEI--which is a Commission-approved UIC--is a
globally-recognized standard identifier \833\ with reference data that
is

available free of charge.\834\ Unlike many identifiers that are
specific to a particular regulatory authority or jurisdiction, the LEI
is a permanent, unique global identifier that also contains ``Level 2''
parent and (direct/indirect) child entity information. Entity parent-
child relationships are particularly relevant to assessing the risks of
entities operating in the securities markets, where financial entities'
interconnectedness and complex group structures could otherwise make
understanding the scope of potential widespread risks challenging.\835\
Additionally, unlike most company registries, all LEI data elements are
validated annually and subject to a ``quality program [that] scans the
full [data] repository daily and publishes the results monthly in
quality reports[,]'' which helps to ensure the accuracy--and
usefulness--of LEI data as compared to other types of entity
identifiers that lack such features.\836\
---------------------------------------------------------------------------

    \832\ As mentioned in section II.B.2.b. of this release, the
instructions of proposed Form SCIR would define UIC to mean an
identifier that has been issued by an IRSS that has been recognized
by the Commission pursuant to Rule 903(a) of Regulation SBSR (17 CFR
242.903(a)).
    \833\ ``The [LEI] is a reference code--like a bar code--used
across markets and jurisdictions to uniquely identify a legally
distinct entity[.]'' Office of Financial Research, U.S. Treasury
Dep't, Legal Entity Identifier--Frequently Asked Questions,
available at https://www.financialresearch.gov/data/legal-entity-identifier-faqs/. ``The financial crisis underscored the need for a
global system to identify financial connections, so regulators and
private sector firms could understand better the true nature of risk
exposures across the financial system.'' Id. Using the LEI as a UIC
to facilitate tracking financial entity cybersecurity incidents and
risks is feasible because ``[t]he Global LEI System was established
for a large range of potential uses.'' The Legal Entity Identifier
Regulatory Oversight Committee (``LEIROC''), LEI Uses, available at
https://www.leiroc.org/lei/uses.htm. The functionality of the LEI is
such that it could be used to identify and track entities for
various purposes. For example, the LEI is one of three identifiers
that firms can use under a December 2022 U.S. Customs & Border
Protection Pilot for automation program for enhanced tracing in
international supply chains. See U.S. Customs and Border Protection,
Announcement of the National Customs Automation Program Test
Concerning the Submission Through the Automated Commercial
Environment of Certain Unique Entity Identifiers for the Global
Business Identifier Evaluative Proof of Concept, 87 FR 74157 (Dec.
2, 2022), available at https://www.federalregister.gov/documents/2022/12/02/2022-26213/announcement-of-the-national-customs-automation-program-test-concerning-the-submission-through-the.
    \834\ Bank for Int'l Settlements, David Leung, et al., Corporate
Digital Identity: No Silver Bullet, but a Silver Lining, BIS Paper
No. 126, at 20 (June 2022), available at https://www.bis.org/publ/bppdf/bispap126.pdf. (``BIS Papers 126'') (stating that ``LEI data
[is] available free of charge to users in both the public and
private sector''). The FSOC has stated the LEI ``enables unique and
transparent identification of legal entities.'' FSOC, 2021 Annual
Report, at 171 (stating that ``[b]roader adoption of the LEI by
financial market participants continues to be a Council priority'').
The FSOC also has stated that the LEI ``facilitate[s] many financial
stability objectives, including improved risk management in firms
[and] better assessment of microprudential and macroprudential
risks[.]'' FSOC, 2022 Annual Report 99 (2022), available at https://home.treasury.gov/system/files/261/FSOC2022AnnualReport.pdf. The
same principles that make the LEI well-suited for allowing
regulators to track entity exposures to financial market risks
across jurisdictions and entities should apply in other contexts,
such as cross-border payments. See FSB, FSB Options to Improve
Adoption of the LEI, in Particular for Use in Cross-border Payments
(July 7, 2022), available at https://www.fsb.org/wp-content/uploads/P070722.pdf.
    \835\ FSB Peer Review Report; see also European Systemic Risk
Board, Francois Laurent, et al., The Benefits of the Legal Entity
Identifier for Monitoring Systemic Risk, Occasional Paper Series No.
18, (Sept. 2021) (``The fact that the LEI enables full reporting of
the group structure in the LEI database is also crucial for risk
analysis. Indeed, the risk usually stems from the group and not from
individual entities, and conducting a relevant risk analysis implies
aggregating exposures at the level of the group.''). For a
discussion of the cybersecurity implications of the
interconnectedness of Market Entities' information systems, see
section I.A.1 of this release.
    \836\ See BIS Papers 126, at 16 (noting that ``[h]istorically,
corporate identification has mainly come from company registries in
individual jurisdictions[,]'' with the registries connected to the
filing of certain documents and the paying of required fees
necessary to create legal entities). Under company registry regimes,
each company typically is identified by name and ``a company
registration number'' that is not standardized across jurisdictions
and is not part of a harmonized system of corporate identification.
See id. (stating that ``[w]ith greater globalization of business and
finance, [the existing company registry system] has become a source
of inefficiency and risks from the standpoint of financial
stability, market integrity, and investor protection''). Further,
``company registries typically do not offer similar types of quality
programs for the corporate data they provide'' and that such data
generally is ``declarative--provided by the registrant'' without
independent verification or validation. See id. at 20.
---------------------------------------------------------------------------

b. Costs
    Covered Entities would incur costs complying with the requirements
of proposed Rule 10 to provide immediate written electronic notice and
subsequent reporting about significant cybersecurity incidents to the
Commission and, in the case of certain Covered Entities, other
regulators, on Part I of proposed Form SCIR. The immediate notification
requirement would impose minimal costs given the limited nature of the
information that would need to be included in the written notice and
the fact that it would be filed electronically.
    The costs of complying with the requirements to file Part I of
proposed Form SCIR to report a significant cybersecurity incident would
be significantly greater than the initial notice, given the amount of
information that would need to be included in the filing. In addition,
because Part I of proposed Form SCIR is a regulatory filing, Covered
Entities likely would incur costs associated with a legal and
compliance review prior to the form being filed on EDGAR.
    In terms of the costs of filing Part I of Form SCIR on EDGAR,
several categories of Covered Entities already file forms in EDGAR.
Specifically, all transfer agents, SBSDs, MSBSPs, and SBSDRs must file
registration or reporting forms in EDGAR,\837\ and some broker-dealers
choose to file certain reports on EDGAR rather than filing them in
paper form. The applicable EDGAR forms for these entities are filed, at
least in part, in a custom XML. Covered Entities that do not currently
file registration or reporting forms on EDGAR would have to file a
notarized Form ID to receive a CIK number and access codes to file on
EDGAR.\838\ Consequently, the requirement to file Part I of proposed
Form SCIR in EDGAR using a form-specific XML may impose some compliance
costs on certain Covered Entities. These Covered Entities would need to
complete Form ID to obtain the EDGAR-system access codes that enable
entities to file documents through the EDGAR system. They would have to
pay a notary to notarize Form ID. The inclusion of a UIC on proposed
Form SCIR would not impose any marginal costs because a Covered Entity
would only be required to provide a UIC if they have already obtained
one.
---------------------------------------------------------------------------

    \837\ SBSDRs received temporary relief from filing through
EDGAR. See Cross-Border Application of Certain Security-Based Swap
Requirements, Exchange Act Release No. 87780 (Dec. 18, 2019) [85 FR
6270, 6348 (Feb. 2, 2020)].
    \838\ See section V of this release (discussing of the number of
Covered Entities who do not currently file forms in EDGAR and the
costs that would be associated with an EDGAR-filing requirement in
more detail).
---------------------------------------------------------------------------

    To estimate the costs for Market Entities to research the validity
of a suspected significant cybersecurity incident and to provide
immediate written electronic notification to the Commission regarding
the significant cybersecurity incident that are real or reasonably
determined to be true, the Commission considered the initial and
ongoing compliance costs.\839\ The internal annual costs for these
requirements (which include an initial burden estimate annualized over
a three year period) are estimated to be $1,648.51 per Market Entity,
and $6,524,802.58 in total. These costs include a blended rate of $353
for an assistant general counsel, compliance manager, and systems
analyst for a total of 4.67 hours. The annual external costs for these
requirements are estimated to be $1,488 per Market Entity, and
$5,889,504 in total. This includes the cost of using outside legal
counsel at a rate of $496 per hour for a total of three hours.
---------------------------------------------------------------------------

    \839\ See section V of this release (discussing these costs in
more detail).
---------------------------------------------------------------------------

    To estimate the costs for Covered Entities to fill out an initial
Part I of proposed Form SCIR, and file an amended Part I of Form SCIR,
the Commission considered the initial and ongoing compliance
costs.\840\ The internal annual costs for these requirements (which
include an initial burden estimate annualized over a three year period)
are estimated to be $1,077.50 per Covered Entity, and $2,143,147.50 in
total. These costs include a blended rate of $431 for an assistant
general counsel and compliance manager for a total of 2.5 hours. The
annual external costs for these requirements are estimated to be $992
per Covered Entity, and $1,973,088 in total. This includes the cost of
using outside legal counsel at a rate of $496 per hour for a total of
two hours.
---------------------------------------------------------------------------

    \840\ See section V of this release (discussing these costs in
more detail).

---------------------------------------------------------------------------

c. Request for Comment
    The Commission requests comment on all aspects of the foregoing
analysis of the benefits and costs of the requirements to provide
immediate notification and subsequent reporting of significant
cybersecurity incidents. Commenters are requested to provide empirical
data in support of any arguments or analyses. In addition, the
Commission is requesting comment on the following matters:
    8. Are the estimated compliance costs (both initially and on an
ongoing basis) for Covered Entities to provide the notification and
subsequent reports reasonable? If not, explain why and provide
estimates of the compliance costs.
    9. Are there any other benefits and costs that the confidential
reporting would provide the Commission? If so, please describe them.
Please provide views on the costs of reporting significant
cybersecurity incidents to the Commission relative to the Commission's
cost estimates.
    10. What are the costs and benefits associated with requiring
Covered Entities to file Part I of proposed Form SCIR using a
structured data language? Should the Commission require Covered
Entities to file Part I of proposed Form SCIR using a structured data
language, such as a custom XML? Should the Commission require Covered
Entities to file Part I of proposed Form SCIR using a different
structured data language than a custom XML, such as Inline XBRL? Why or
why not?
    11. Are there any Covered Entities that should be exempted from the
proposed structured data requirements for filing Part I of proposed
Form SCIR? If so, what particular exemption threshold should the
Commission use for the structured data requirements and why?
    12. Should Covered Entities be required to file proposed Form SCIR
with a CIK number? What are the costs and benefits associated with
requiring Covered Entities to identify themselves on Part I of proposed
Form SCIR with a CIK number?
    13. Should Covered Entities be required to file Part I of proposed
Form SCIR with a UIC (i.e., such as an LEI), particularly when some
Covered Entities do not have a UIC and would have to obtain one? What
are the benefits associated with requiring Covered Entities with a UIC
to identify themselves with that UIC?
    14. Would requiring a UIC on Part I of proposed Form SCIR allow the
Commission to better evaluate cybersecurity threats to Covered Entities
using data from other regulators and from law enforcement agencies?
Please explain how.
    15. Are there any Covered Entities for which the proposed
structured data requirements for Part I of proposed Form SCIR should be
exempted? If so, what particular exemption threshold or thresholds
should the Commission use for the structured data requirements under
the proposed rule amendments, and why?
4. Public Disclosure of Cybersecurity Risks and Significant
Cybersecurity Incidents
    Under proposed Rule 10, Covered Entities would need to publicly
disclose summary descriptions of their cybersecurity risks and the
significant cybersecurity incidents they experienced during the current
or previous calendar year on Part II of proposed Form SCIR.\841\ The
form would need to be filed with the Commission through the EDGAR
system and posted on the Covered Entity's business internet website
and, in the case of Covered Entities that are carrying or introducing
broker-dealers, provided to customers at account opening and at least
annually thereafter.
---------------------------------------------------------------------------

    \841\ See sections II.B.3. and II.B.4. of this release
(discussing these proposed requirements in more detail).
---------------------------------------------------------------------------

a. Benefits
    As discussed above, there exists an information asymmetry between
Covered Entities and their customers, counterparties, members,
registrants, or users.\842\ This information asymmetry, together with
limitations to private contracting, inhibits the ability of customers,
counterparties, members, registrants, and users to screen and
discipline the Covered Entities with whom they do business or obtain
services from based on the effectiveness of the Covered Entity's
cybersecurity policies. The public disclosure requirements of proposed
Rule 10 would help alleviate this information asymmetry, and in so
doing would enable customers, counterparties, members, registrants, or
users to better assess the effectiveness of Covered Entities'
cybersecurity preparations and the cybersecurity risks of doing
business with any one of them. For example, customers, counterparties,
members, registrants, or users could use the frequency or nature of
significant cybersecurity incidents--as disclosed under the proposed
public disclosure requirement--to infer a Covered Entity's effort
toward preventing cybersecurity incidents. Likewise customers,
counterparties, members, registrants, or users could use the
descriptions of cybersecurity risks to avoid certain Covered Entities
with less well-developed cybersecurity procedures.
---------------------------------------------------------------------------

    \842\ See section IV.B. of this release (discussing broad
economic considerations).
---------------------------------------------------------------------------

    Public disclosures mitigate the information asymmetry. Customers,
counterparties, members, registrants, or users can use the information
to understand better the risks of doing business with certain Covered
Entities. A Covered Entity disclosing that it addresses cybersecurity
risks in a robust manner and that it has not experienced a significant
cybersecurity incident or few such incidents could signal to customers,
counterparties, members, registrants, or users that customer
information, funds, and assets are safeguarded properly. In contrast,
disclosures of sub-par cybersecurity practices or a history of
significant cybersecurity incidents may convince customers,
counterparties, members, registrants, or users to not do business with
that Covered Entity.
    In addition to mitigating information asymmetries with stakeholders
in general, public disclosure would also mitigate a source of
principal-agent problems in the customer-Covered Entity relationship.
As discussed above, Covered Entities may have different incentives than
customers in the area of cybersecurity prevention.\843\ Insofar as
principals (customers) prefer a higher level of cybersecurity focus by
agents (Covered Entities), public disclosure would act as an incentive
for Covered Entities to increase their focus in this area and signal
their commitment to protecting customers' funds and data.
---------------------------------------------------------------------------

    \843\ See section IV.B. of this release (discussing broad
economic considerations).
---------------------------------------------------------------------------

    The proposed requirement for Covered Entities to post the required
disclosures on their websites would help inform, for example, retail
customers about Covered Broker-Dealers because they are likely to look
for information about their broker-dealers on the firm's websites. In
addition, requiring the submission of Part II of proposed Form SCIR in
a custom XML data language would likely facilitate more effective and
thorough review, analysis, and comparison of cybersecurity risks and
significant cybersecurity incidents by the Commission and by Covered
Entities' existing and prospective customers, counterparties, members,
registrants, or users.\844\ The public disclosure

requirement of proposed Rule 10 expands Market Entities', other market
participants', the public's, the Commission's, and other regulatory
bodies' knowledge about the cybersecurity risks faced by Covered
Entities as well as their past experiences regarding significant
cybersecurity incidents that is beyond what is provided by current
Commission regulations.
---------------------------------------------------------------------------

    \844\ While the Commission would separately receive the
information significant cybersecurity incidents impacting Covered
Entities thought the filings of Part I of proposed Form SCIR, those
filings would not include the Covered Entity's summary description
of the cybersecurity risks that could materially affect the Covered
Entity's business and operations and how it assesses, prioritizes,
and addresses those cybersecurity risks that would be disclosed on
Part II of proposed Form SCIR.
---------------------------------------------------------------------------

    Requiring Covered Entities to file Part II of proposed Form SCIR
through the EDGAR system would allow the Commission--as well as
customers, counterparties, members, and users of Covered Entity
services--to download the Part II disclosures directly from a central
location, thus facilitating efficient access, organization, and
evaluation of the reported disclosures about significant cybersecurity
incidents. Likewise, because Part II of proposed Form SCIR would be
structured in SCIR-specific XML, the public disclosures would be
machine-readable and, therefore, more readily accessible to the public
and the Commission for comparisons across Covered Entities and time
periods. With centralized filing in EDGAR in a custom XML, Commission
staff as well as Covered Entities' customers, counterparties, members,
registrants, or users (and the Covered Entities themselves) would be
better able to assemble, analyze, review, and compare a large
collection of data about reported cybersecurity risks and significant
cybersecurity incidents, which could facilitate the efficient
identification of trends in cybersecurity risks and significant
cybersecurity incidents in the U.S. securities markets.
    Centralized filing of the summary descriptions of the Covered
Entity's cybersecurity risks and significant cybersecurity incidents on
Part II of proposed Form SCIR in a structured format on EDGAR would
enable investors and others--such as other government agencies,
standard-setting groups, analysts, market data aggregators, and
financial firms--to more easily and efficiently compare how one Covered
Entity compares with others in terms of cybersecurity risks and
incidents. For example, banks assessing potential security-based swap
counterparties could efficiently aggregate and compare disclosures of
multiple security-based swap dealers. Similarly, public companies
deciding which transfer agent to use could efficiently aggregate and
compare the disclosures of many transfer agents.
    These market participants would also be able to discern broad
trends in cybersecurity risks and incidents more efficiently due to the
central filing location and machine-readability of the disclosures. The
more efficient dissemination of information about trends regarding
cybersecurity risks and significant cybersecurity incidents could, for
example, enable Covered Entities to better and more efficiently
determine if they need to modify, change, or upgrade their
cybersecurity defense measures in light of those trends. Likewise, more
efficient assimilation of information about trends in significant
cybersecurity incidents could enable Covered Entities customers,
counterparties, members, or users and their services to more
efficiently understand and manage their cybersecurity risks.
Accordingly, centralized EDGAR filing of public cybersecurity
disclosures in a machine-readable data language could help reduce the
number of Covered Entities or their customers, counterparties, members,
or users that suffer harm from cybersecurity breaches, or reduce the
extent of such harm in the market, thus helping prevent or mitigate
cybersecurity-related disruptions to the orderly operations of the U.S.
securities markets.
    Lastly, Covered Entities rely on electronic information,
communication, and computer systems to perform their functions.\845\
Because many Covered Entities play critical global financial system, a
cyberattack against Covered Entities without strong cybersecurity
protocols could lead to more widespread breaches. Therefore, the
centralized, public, structured filing of cybersecurity disclosures
with Part II of proposed Form SCIR, which would be updated promptly
upon the occurrence of a new significant cybersecurity incident, would
increase the efficiency with which new cybersecurity information would
be assimilated into the market, thereby also likely increasing the
speed with which Covered Entities could react to potential contagion.
This increased agility on the part of Covered Entities could reduce
potential contagion in the U.S. securities markets. Additionally,
Covered Entities would know that the centralized, public filing of
information about significant cybersecurity incidents would make
comparison with their competitors easier, and this could motivate
Covered Entities to take cybersecurity preparedness and risk management
more seriously than they might otherwise, either by devoting more
resources to cybersecurity or by addressing cybersecurity risks in a
more effective manner. Such an effect could help reduce the number and
extent of cybersecurity incidents, particularly those that negatively
impact the U.S. securities markets.
---------------------------------------------------------------------------

    \845\ See section I.A.2. of this release (discussing how Covered
Entities use information systems).
---------------------------------------------------------------------------

    As with Part I of proposed Form SCIR, the Commission also is
proposing to require Covered Entities to identify themselves on Part II
of proposed Form SCIR with a UIC, such as an LEI, if they have obtained
one, to help facilitate efficient collection and analysis of
cybersecurity incidents in the financial markets. The addition of UICs
could facilitate coordinated inter-governmental responses to
cybersecurity incidents that affect U.S. firms.\846\ Existing
identifiers that are not UICs are more limited in scope, such as CIK
numbers, which are Commission-specific identifiers for companies and
individuals that have filed reports with the Commission. This limits
their utility in analyzing and comparing significant cybersecurity
incidents among Covered Entities and non-Commission-regulated financial
institutions.
---------------------------------------------------------------------------

    \846\ The Commission has recognized the benefits of LEIs in
other contexts. See Joint Industry Plan; Order Approving the
National Market System Plan Governing the Consolidated Audit Trail,
Release No. 34-79318; File No. 4-698 (Nov. 15, 2016), 81 FR 84696,
84745 (Nov. 23, 2016) (``The Commission believes use of the LEI
enhances the quality of identifying information for Customers by
incorporating a global standard identifier increasingly used
throughout the financial markets.''); Investment Company Reporting
Modernization, Release Nos. 33-10231; 34-79095; IC-32314; File No.
S7-08-15 (Oct. 13, 2016), 81 FR 81870, 81877 (Nov. 18, 2016)
(``Uniform reporting of LEIs by funds [] will help provide a
consistent means of identification that will facilitate the linkage
of data reported on Form N-PORT with data from other filings and
sources that is or will be reported elsewhere as LEIs become more
widely used by regulators and the financial industry.'').
---------------------------------------------------------------------------

    The markets for different Covered Entities present customers,
counterparties, members, registrants, or users with a complex, multi-
dimensional, choice problem. In choosing a Covered Entity to work with,
customers, counterparties, members, registrants, or users may consider
cybersecurity risk exposure (i.e., financial, operational, legal,
etc.), past significant cybersecurity incidents, reputation, etc. While
the Commission is not aware of any studies that examine the role
perceptions of cybersecurity play in this choice problem, the extant
academic literature suggests that investors focus on salient, headline-
grabbing information, such as large losses of customer information,
when

making such choices.\847\ Details regarding significant cybersecurity
incidents may allow customers, counterparties, members, registrants, or
users to assess the severity of one incident compared to that of
another. However, the public disclosures will be generalized (i.e.,
summary descriptions) to a degree such that threat actors cannot take
advantage of known vulnerabilities. Therefore, to the extent that
cybersecurity disclosures from Covered Entities are ``boilerplate,''
they may be less informative.\848\ Thus, it may be difficult to choose
among Covered Entities that have experienced similar significant
cybersecurity incidents.
---------------------------------------------------------------------------

    \847\ See, e.g., Brad M. Barber, Terrance Odean, and Lu Zheng,
Out of Sight, Out of Mind: The Effects of Expenses on Mutual Fund
Flows, 78 J. Bus. 2095 (2005) (``Out of Sight, Out of Mind'').
    \848\ However, as discussed above, the process of adopting
``boilerplate'' language by Covered Entities may itself affect
improvements in policies and procedures.
---------------------------------------------------------------------------

    Significant cybersecurity incidents--especially those that involve
loss of data or assets of customers, counterparties, members,
registrants, or users--are likely to garner attention. Thus, the
Commission expects that the proposed requirement to disclose
significant cybersecurity incidents would have a direct effect on the
choices of customers, counterparties, members, registrants, or users.
In addition, third parties such as industry analysts--who may be more
capable of extracting useful information across Covered Entities'
disclosures--may incorporate it in assessment reports that are
ultimately provided to customers, counterparties, members, registrants,
or users. Whether directly or indirectly, Covered Entities with subpar
cybersecurity policies and procedures--as revealed by a relatively
large number of significant cybersecurity incidents--could face
pressure to improve their policies procedures to reduce such
incidents.\849\
---------------------------------------------------------------------------

    \849\ This assumes that customers, counterparties, members,
registrants, or users evaluating the Covered Entities would favor
those Covered Entities that include language that cites strong
cybersecurity procedures in their disclosures. Further, the
Commission assumes that customers, counterparties, members,
registrants, and users would prefer to do business with Covered
Entities that have ``superior'' cybersecurity procedures.
---------------------------------------------------------------------------

    The disclosures of significant cybersecurity incidents also should
benefit a Covered Entity's current customers, counterparties, members,
registrants, or users if the Covered Entity experiences a significant
cybersecurity incident by providing notice that, for example, personal
information, transaction data, securities, or funds may have been
compromised. While the customers, counterparties, members, registrants,
or users that are directly impacted may be individually notified of
significant cybersecurity incidents based on individual state laws and
Commission rules, thus initiating timely remedial actions, other
parties may benefit from the disclosures. Specifically, customers,
counterparties, members, registrants, or users that are not affected by
a significant cybersecurity incident may take the time to change and
strengthen passwords, monitor account activity on a more consistent
basis, and audit their financial statements for discrepancies.
b. Costs
    The requirements to have reasonably designed policies and
procedures to address cybersecurity risk and to report significant
cybersecurity incidents to the Commission by filing Part I of proposed
Form SCIR on EDGAR would--in practice--require the collection of the
information that also would be used in the proposed public disclosures
required to be made on Part II of proposed Form SCIR. Therefore, the
disclosure requirement itself would not impose significant compliance
costs beyond those already discussed with respect to the requirements
to have reasonably designed policies and procedures to address
cybersecurity risk and to report significant cybersecurity incidents to
the Commission by filing Part I of proposed Form SCIR on EDGAR.\850\
Generally, it is expected that a compliance analysis would be needed to
summarize the cybersecurity risks faced by the Covered Entity and a
summary of previous significant cybersecurity incidents. In addition,
there may be internal legal review of the public disclosure and
administrative costs would be incurred associated with posting the
disclosure on the Covered Entity's website.
---------------------------------------------------------------------------

    \850\ See sections IV.D.2. and IV.D.3. of this release
(discussing the costs of those requirements).
---------------------------------------------------------------------------

    However, if the action of disclosing summary descriptions of a
Covered Entity's cybersecurity risks and significant cybersecurity
incidents encourages the Covered Entity and/or other Covered Entities
to review their policies and procedures and potentially direct more
resources to cybersecurity protection, that would be an additional
cost. Moreover, the disclosures may impose costs due to market
reactions and exploitable information they may reveal to adverse
parties.
    Depending on the Covered Entity, reports of many significant
cybersecurity incidents and, to a lesser extent, reports of greater
cybersecurity risks and exposure to financial, operational, legal,
reputational, or other consequences that could materially affect its
business and operations as a result of a cybersecurity incident
adversely impacting its information systems may bear costs arising from
reactions in the marketplace. That is, a Covered Entity may lose
business or suffer harm to its reputation and brand value.\851\ These
costs would be borne by the affected Covered Entity even if it made
reasonable efforts to prevent them. If customers, counterparties,
members, registrants, or users ``overreact'' \852\ to disclosures of
significant cybersecurity incidents, Covered Entities may pursue a
strategy of overinvesting in cybersecurity precautions (to avoid such
overreactions), resulting in reduced efficiency. The extent of such
costs likely depends on a number of factors, including the size of a
Covered Entity relative to others in the same category (e.g., Covered
Broker-Dealers, national securities exchanges, and clearing agencies),
the severity and scope of the cybersecurity incident, and the
availability of substitutes for a given Covered Entity.\853\
---------------------------------------------------------------------------

    \851\ Customers, counterparties, members, registrants, and users
would be more likely to act in response to realized significant
cybersecurity incidents than in response to Covered Entities'
descriptions of their cybersecurity risks and how they address those
risks.
    \852\ Such overreactions can be the result of overconfidence
about the precision of the signal. See, e.g., Kent Daniel, David
Hirshleifer and Avanidhar Subrahmanyam, Investor Psychology and
Security Market Under- and Overreactions, 53 J. Fin. 1839 (1998);
see also Out of Sight, Out of Mind.
    \853\ One can differentiate between the smallest and largest
Covered Broker-Dealer. A large broker-dealer may be more able to
absorb more costs associated with a cybersecurity incident and
continue to stay in business than a small broker-dealer. In
addition, a large broker-dealer could have a more prestigious
reputation that may persuade customers to continue using it despite
the cybersecurity event. Or a large broker-dealer could have more
news about it in the public domain that dilutes bad news about
cybersecurity incidents, whereas a smaller firm's name may become
inextricably associated with one significant cybersecurity incident.
In addition, significant cybersecurity incidents that are crippling
and affect all of a Covered Entity's customers, counterparties,
members, registrants, and users would be more costly its reputation
than ones that are more localized. Lastly, the cost of lost business
for a Covered Entity may be muted if there are fewer competitors to
choose from. For example, there is only one national securities
association (i.e., FINRA) relative to 353 transfer agents. It
therefore could be costly in terms of lost business for a transfer
agent as its customers can transfer their business to one of the
many others that perform the same services.
---------------------------------------------------------------------------

    The national securities exchanges and clearing agencies that are
currently registered with the Commission but are not active would not
incur any costs related to the proposed public disclosure requirement
if they remain inactive. However, if their operations restart, they
likely would incur

moderate costs associated with the disclosure because they may need to
restart their websites and provide summary descriptions of their
cybersecurity risks. No significant cybersecurity incidents would need
to be disclosed initially since they have been dormant for so long. In
addition, many transfer agents do not have websites. Therefore, those
transfer agents that do not have websites would incur the cost of
obtaining a domain name as well as establishing and maintaining a
website (either by themselves or using a third party) before being able
to post their public disclosures. Small, independent broker-dealers
also may not have websites. In a 2015 survey of 13 broker-dealers, 80%
of respondents stated that they have a web policy or program; however,
7.6% do not have a web policy or program and 13.3% of the respondents
were not sure. Furthermore, 47% of respondents reported that less than
half of their firm's advisors (i.e., registered representatives)
currently have a website. Interestingly, the survey participants noted
the value of having a website to establish credibility (80%), generate
leads (53%), get referrals (40%), qualify and engage prospects (40%)
and maintain existing client relationships (47%).\854\ The remaining
Market Entities likely have websites.
---------------------------------------------------------------------------

    \854\ See Broker Dealers and Web Marketing: What You Should Know
(Dec. 9, 2015), available at https://www.advisorwebsites.com/blog/
blog/general/broker-dealers-and-web-marketing-what-you-should-
know#:~:text=While%2080%25%20of%20Broker-
Dealers%20reps%20we%20polled%20say,to%20build%20and%20maintain%20a%20
strong%20web%20presence.
---------------------------------------------------------------------------

    Website costs can be broken into several categories: (1) obtaining
a domain name ($12 to $15 per year); (2) web hosting ($100 per month
for premium service); (3) website theme or template (one-time fee of
$20 to $200 or more); and SSL certificate ($10 to $200 per year).\855\
Ongoing website costs could be as high as $1,215 per year to maintain.
---------------------------------------------------------------------------

    \855\ See Jennifer Simonson, website Hosting Cost Guide 2023,
Forbes, available at https://www.forbes.com/advisor/business/website-hosting-cost/.
---------------------------------------------------------------------------

    Mandating the disclosure of significant cybersecurity incidents
entails a tradeoff. While disclosure can inform customers,
counterparties, members, registrants, and users, disclosure can also
inform cyber attackers that they have been detected. Also, disclosing
too much (e.g., the types of systems that were affected and how they
were compromised) could be used by threat actors to better attack their
targets, imposing subsequent potential losses on Covered Entities. For
example, announcing a significant cybersecurity incident naming a
specific piece of malware and the degree of compromise can provide
details about the structure of the target's computer systems, the
security measures employed (or not employed), and potentially suggest
promising attack vectors for future targets by other would-be
attackers.
    Under proposed Rule 10, to mitigate these costs and to promote
compliance with the disclosure requirements, each Covered Entity would
be required to disclose summary descriptions of their cybersecurity
risks and significant cybersecurity incidents on Part II of proposed
Form SCIR.\856\ In the summary description of the significant
cybersecurity incident, the Covered Entity would need to identify: (1)
the person or persons affected; (2) the date the incident was
discovered and whether it is still ongoing; (3) whether any data were
stolen, altered, or accessed or used for any other unauthorized
purpose; (4) the effect of the incident on the Covered Entity's
operations; and (5) whether the Covered Entity, or service provider,
has remediated or is currently remediating the incident.\857\ Thus,
Covered Entities generally would not be required to disclose technical
details about significant cybersecurity incidents that could compromise
their cybersecurity protections going forward. As before, the costs
associated with conveying this information to attackers is
impracticable to estimate.\858\
---------------------------------------------------------------------------

    \856\ See paragraph (d)(1) of proposed Rule 10.
    \857\ See paragraph (d)(1)(ii) of proposed Rule 10.
    \858\ As noted in section IV.B. of this release, firms are
generally hesitant to provide information about cyberattacks.
Similarly, cybercriminals are not generally forthcoming with data on
attacks, their success, or factors that made the attacks possible.
Consequently, data from which plausible estimates could be made is
not available.
---------------------------------------------------------------------------

    While registering with the EDGAR system is free, the requirement to
centrally file Part II of proposed Form SCIR in EDGAR would impose
incremental costs on Covered Entities that have not previously filed
documents in EDGAR. More specifically, Covered Entities that have never
made a filing with the Commission via EDGAR would need to file a
notarized Form ID, which is used to request the assignment of access
codes to file on EDGAR. Thus, first-time EDGAR filers would incur
modest costs associated with filing Form ID.\859\ That said, Covered
Entities that already file documents in EDGAR would not incur the cost
of having to register with EDGAR. As discussed earlier, the extent to
which different categories of Covered Entities are already required to
file documents in EDGAR varies. For example, SBSDs, MSBSPs, SBSDRs, and
transfer agents are already required to file some forms in EDGAR.
---------------------------------------------------------------------------

    \859\ Any Covered Entity that has made at least one filing with
the Commission via EDGAR since 2002 has been entered into the EDGAR
system by the Commission and will not need to file Form ID to file
electronically on EDGAR.
---------------------------------------------------------------------------

    Likewise, as mentioned earlier, the Commission approved a UIC--
namely, the LEI--in a previous rulemaking. The Commission could approve
another standard identifier as a UIC in the future, but currently the
LEI is the only approved UIC. Covered Entities that already have an LEI
would not bear any cost to including it on proposed Form SCIR, as they
would have already paid to obtain and maintain an LEI for some other
purpose. Covered Entities that do not already have an LEI are not
required to obtain an LEI in order to file proposed Form SCIR, thus,
there is no additional cost to those Covered Entities that do not have
an LEI.
    In addition, a Covered Broker-Dealer would be required to provide
the written disclosure form to a customer as part of the account
opening process. Thereafter, the Covered Broker-Dealer would need to
provide the customer with the written disclosure form annually and when
it is updated using the same means that the customer elects to receive
account statements (e.g., by email or through some type of postal
service). The Commission anticipates that the cost of initial and
annual reporting will be negligible because the report text can be
incorporated into other initial disclosures and periodic statements.
The cost of furnishing updated reports in response to significant
cybersecurity incidents depends on the degree to which such incidents
occur and are detected, which cannot reliably be predicted. The
Commission assumes that the delivery costs are the same regardless of
the delivery method.
    To estimate the costs associated for a Covered Entity to file a
Part II of proposed Form SCIR with the Commission through EDGAR, as
well as post a copy of the form on its website, the Commission
considered the initial and ongoing compliance costs.\860\ The internal
annual costs for these requirements (which include an initial burden
estimate annualized over a three year period) are estimated to be
$1,377.46 per Covered Entity, and $2,739,767.94 in total. These costs
include a blended rate of $375.33 for an

assistant general counsel, senior compliance examiner, and compliance
manager for a total of 3.67 hours. The annual external costs for these
requirements are estimated to be $1,488 per Covered Entity, and
$2,959,632 in total. This includes the cost of using outside legal
counsel at a rate of $496 per hour for a total of three hours.
---------------------------------------------------------------------------

    \860\ See section V of this release (discussing these costs in
more detail).
---------------------------------------------------------------------------

    To estimate the costs associated for a Covered Broker-Dealer to
deliver its disclosures to new customers, as well as deliver
disclosures to existing customers on an annual basis, the Commission
considered the initial and ongoing compliance costs.\861\ The internal
annual costs for these requirements (which include an initial burden
estimate annualized over a three year period) are estimated to be
$3,536.94 per Covered Broker-Dealer, and $5,450,424.54 in total. These
costs include a rate of $69 per hour for a general clerk for a total of
51.26 hours. It is estimated that there will be $0 annual external cost
for this additional disclosure requirement for Covered Broker-Dealers.
With respect to the additional disclosure fees for broker dealers, the
cost covers the clerks employed by the broker-dealers for stuffing
envelopes and mailing them out. The legal fees associated with drafting
the disclosure is already tied to the burden of filing the disclosure
in Part II of EDGAR and putting the disclosure on its website.
---------------------------------------------------------------------------

    \861\ See section V of this release (discussing these costs in
more detail).
---------------------------------------------------------------------------

c. Request for Comment