Cybersecurity Risk Management Rule for Broker-Dealers, Clearing Agencies, and Other Market Entities

SECURITIES AND EXCHANGE
COMMISSION
17 CFR Parts 232, 240, 242 and 249 [Release No. 34–97142; File No. S7–06–23] RIN 3235–AN15 Cybersecurity Risk Management Rule for Broker-Dealers, Clearing Agencies, Major Security-Based Swap Participants, the Municipal Securities Rulemaking Board, National Securities Associations, National Securities Exchanges, Security-Based Swap Data Repositories, Security-Based Swap Dealers, and Transfer Agents AGENCY: Securities and Exchange Commission. ACTION: Proposed rule. SUMMARY: The Securities and Exchange Commission (‘‘Commission’’) is proposing a new rule and form and amendments to existing recordkeeping rules to require broker-dealers, clearing agencies, major security-based swap participants, the Municipal Securities Rulemaking Board, national securities associations, national securities exchanges, security-based swap data repositories, security-based swap dealers, and transfer agents to address cybersecurity risks through policies and procedures, immediate notification to the Commission of the occurrence of a significant cybersecurity incident and, as applicable, reporting detailed information to the Commission about a significant cybersecurity incident, and public disclosures that would improve transparency with respect to cybersecurity risks and significant cybersecurity incidents. In addition, the Commission is proposing amendments to existing clearing agency exemption orders to require the retention of records that would need to be made under the proposed cybersecurity requirements. Finally, the Commission is proposing amendments to address the potential availability to security-based swap dealers and major security-based swap participants of substituted compliance in connection with those requirements. DATES: Comments should be received on or before June 5, 2023. ADDRESSES: Comments may be submitted by any of the following methods:
Electronic Comments

• Use the Commission’s internet
  comment form (https://www.sec.gov/ rules/submitcomments.htm); or
• Send an email to rule-comments@
  sec.gov. Please include File Number S7– 06–23 on the subject line. Paper Comments
• Send paper comments to Secretary,
  Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549–1090. All submissions should refer to File Number S7–06–23. The file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method of submission. The Commission will post all comments on the Commission’s website (https:// www.sec.gov/rules/proposed.shtml). Comments are also available for website viewing and printing in the Commission’s Public Reference Room, 100 F Street NE, Washington, DC 20549, on official business days between the hours of 10 a.m. and 3 p.m. Operating conditions may limit access to the Commission’s Public Reference Room. All comments received will be posted without change; the Commission does not edit personal identifying information from submissions. You should submit only information that you wish to make available publicly. Studies, memoranda, or other substantive items may be added by the Commission or staff to the comment file during this rulemaking. A notification of the inclusion in the comment file of any such materials will be made available on the Commission’s website. To ensure direct electronic receipt of such notifications, sign up through the ‘‘Stay Connected’’ option at www.sec.gov to receive notifications by email. FOR FURTHER INFORMATION CONTACT:
  Randall W. Roy, Deputy Associate Director and Nina Kostyukovsky, Special Counsel, Office of Broker-Dealer Finances (with respect to the proposed cybersecurity rule and form and the aspects of the proposal unique to broker-dealers); Matthew Lee, Assistant Director and Stephanie Park, Senior Special Counsel, Office of Clearance and Settlement (with respect to aspects of the proposal unique to clearing agencies and security-based swap data repositories); John Guidroz, Assistant Director and Russell Mancuso, Special Counsel, Office of Derivatives Policy (with respect to aspects of the proposal unique to major security-based swap participants and security-based swap dealers); Michael E. Coe, Assistant Director and Leah Mesfin, Special Counsel, Office of Market Supervision (with respect to aspects of the proposal unique to national securities associations and national securities exchanges); Moshe Rothman, Assistant Director, Office of Clearance and Settlement (with respect to aspects of the proposal unique to transfer agents) at (202) 551–5500, Division of Trading and Markets; and Dave Sanchez, Director, Adam Wendell, Deputy Director, and Adam Allogramento, Special Counsel, Office of Municipal Securities (with respect to aspects of the proposal unique to the Municipal Securities Rulemaking Board) at (202) 551–5680, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549–7010. SUPPLEMENTARY INFORMATION: The Commission is proposing to add the following new rule and form under the Securities Exchange Act of 1934 (‘‘Exchange Act’’): (1) 17 CFR 242.10 (‘‘Rule 10’’); and (2) 17 CFR 249.642 (‘‘Form SCIR’’). The Commission also is proposing related amendments to the following rules: (1) 17 CFR 232.101; (2) 17 CFR 240.3a71–6; (3) 17 CFR 240.17a– 4; (4) 17 CFR 240.17Ad–7; (5) 17 CFR 240.18a–6; and (6) 17 CFR 240.18a–10. Further, the Commission is proposing to amend certain orders that exempt clearing agencies from registration. Commission reference CFR citation (17 CFR) Regulation S–T .......... § 232.101 Rule 3a71–6 .............. § 240.3a71–6 Rule 17a–4 ................ § 240.17a–4 Rule 17Ad–7 .............. § 240.17Ad–7 Rule 18a–6 ................ § 240.18a–6 Rule 18a–10 .............. § 240.18a–10 Rule 10 ...................... § 242.10 Form SCIR ................ § 249.624
  Table of Contents
  I. Introduction
  A. Cybersecurity Risk Poses a Threat the U.S. Securities Markets

1. In General
2. Critical Operations of Market Entities
   Are Exposed to Cybersecurity Risk B. Overview of the Proposed Cybersecurity Requirements
   II. Discussion of Proposed Cybersecurity Rule
   A. Definitions
3. ‘‘Covered Entity’’
4. ‘‘Cybersecurity Incident’’
5. ‘‘Significant Cybersecurity Incident’’
6. ‘‘Cybersecurity Threat’’
7. ‘‘Cybersecurity Vulnerability’’
8. ‘‘Cybersecurity Risk’’
9. ‘‘Information’’
10. ‘‘Information Systems’’
11. ‘‘Personal Information’’
12. Request for Comment
    B. Proposed Requirements for Covered Entities
13. Cybersecurity Risk Management Policies
    and Procedures
14. Notification and Reporting of Significant
    Cybersecurity Incidents
15. Disclosure of Cybersecurity Risks and
    Incidents
16. Filing Parts I and II of Proposed Form
    SCIR in EDGAR Using a Structured Data Language

1See the National Institute of Standards and Technology (‘‘NIST’’), U.S. Department of Commerce, Computer Security Resource Center Glossary, available at https://csrc.nist.gov/glossary (‘‘NIST Glossary’’) (definition of ‘‘cybersecurity risk’’). The NIST Glossary consists of terms and definitions extracted verbatim from NIST’s cybersecurity and privacy-related publications (i.e., Federal Information Processing Standards (FIPS), NIST Special Publications (SPs), and NIST Internal/ Interagency Reports (IRs)) and from the Committee on National Security Systems (CNSS) Instruction CNSSI–4009. The NIST Glossary may be expanded to include relevant terms in external or supplemental sources, such as applicable laws and regulations. The Cybersecurity Enhancement Act of 2014 (‘‘CEA’’) updated the role of NIST to include identifying and developing cybersecurity risk frameworks for voluntary use by critical infrastructure owners and operators. The CEA required NIST to identify ‘‘a prioritized, flexible, repeatable, performance based, and cost-effective approach, including information security measures and controls that may be voluntarily adopted by owners and operators of critical infrastructure to help them identify, assess, and manage cyber risks.’’ See 15 U.S.C. 272(e)(1)(A)(iii). In response, NIST has published the Framework for Improving Critical Infrastructure Cybersecurity (‘‘NIST Framework’’). See also NIST, Integrating Cybersecurity and Enterprise Risk Management (ERM) (Oct. 2020), available at https://nvlpubs.nist.gov/nistpubs/ir/ 2020/NIST.IR.8286.pdf (‘‘All types of organizations, from corporations to federal agencies, face a broad array of risks. For federal agencies, the Office of Management and Budget (OMB) Circular A–11 defines risk as ‘the effect of uncertainty on objectives’. The effect of uncertainty on enterprise mission and business objectives may then be considered an ‘enterprise risk’ that must be similarly managed . . . Cybersecurity risk is an important type of risk for any enterprise.’’) (footnotes omitted). 2See NIST Glossary (definition of ‘‘cybersecurity risk’’). See also The Board of the International Organization of Securities Commissions (‘‘IOSCO’’), Cyber Security in Securities Markets—An International Perspective (Apr. 2016), available at https://www.iosco.org/library/pubdocs/pdf/ IOSCOPD528.pdf (‘‘IOSCO Cybersecurity Report’’) (‘‘In essence, cyber risk refers to the potential negative outcomes associated with cyber attacks. In turn, cyber attacks can be defined as attempts to compromise the confidentiality, integrity and availability of computer data or systems.’’) (footnote omitted).
5. Recordkeeping
C. Proposed Requirements for Non-Covered
Broker-Dealers

1. Cybersecurity Policies and Procedures,
   Annual Review, Notification, and Recordkeeping
2. Request for Comment
   D. Cross-Border Application of the Proposed Cybersecurity Requirements to SBS Entities
3. Background on the Cross-Border
   Application of Title VII Requirements
4. Proposed Entity-Level Treatment
5. Availability of Substituted Compliance
   E. Amendments to Rule 18a–10
6. Proposal
7. Request for Comment
   F. Market Entities Subject to Regulation SCI, Regulation S–P, Regulation ATS, and Regulation S–ID
8. Discussion
9. Request for Comment
   G. Cybersecurity Risk Related to Crypto Assets
   III. General Request for Comment
   IV. Economic Analysis
   A. Introduction
   B. Broad Economic Considerations
   C. Baseline
10. Cybersecurity Risks and Current
    Relevant Regulations
11. Market Structure
    D. Benefits and Costs of Proposed Rule 10, Form SCIR, and Rule Amendments
12. Benefits and Costs of the Proposals to
    the U.S. Securities Markets
13. Policies and Procedures and Annual
    Review Requirements for Covered Entities
14. Regulatory Reporting of Cybersecurity
    Incidents by Covered Entities
15. Public Disclosure of Cybersecurity Risks
    and Significant Cybersecurity Incidents
16. Record Preservation and Maintenance by
    Covered Entities
17. Policies and Procedures, Annual
    Review, Immediate Notification of Significant Cybersecurity Incidents, and Record Preservation Requirements for Non-Covered Broker-Dealers
18. Substituted Compliance for Non-U.S.
    SBS Entities
    E. Effects on Efficiency, Competition, and Capital Formation F. Reasonable Alternatives
19. Alternatives to the Policies and
    Procedures Requirements of Proposed Rule 10
20. Alternatives to the Requirements of
    Proposed Form SCIR and Related Notification and Disclosure Requirements of Proposed Rule 10
21. General Request for Comment
    V. Paperwork Reduction Act Analysis
    A. Summary of Collections of Information
22. Proposed Rule 10
23. Form SCIR
24. Rules 17a–4, 17ad–7, 18a–6 and Clearing
    Agency Exemption Orders
25. Substituted Compliance (Rule 3a71–6)
    B. Proposed Use of Information
    C. Respondents
26. Broker-Dealers
27. Clearing Agencies
28. The MSRB
29. National Securities Exchanges and
    National Securities Associations
30. SBS Entities
31. SBSDRs
32. Transfer Agents
    D. Total Initial and Annual Reporting Burdens
33. Proposed Rule 10
34. Form SCIR
35. Rules 17a–4, 17ad–7, 18a–6, and
    Clearing Agency Exemption Orders (and Existing Rules 13n–7 and 17a–1)
36. Substituted Compliance (Rule 3a71–6)
    E. Collection of Information is Mandatory F. Confidentiality of Responses to Collection of Information G. Retention Period for Recordkeeping Requirements H. Request for Comment
    VI. Initial Regulatory Flexibility Act Analysis
    A. Reasons for, and Objectives of, Proposed Action
37. Proposed Rule 10 and Parts I and II of
    Proposed Form SCIR
38. Rules 17a–4, 17ad–7, 18a–6 and Clearing
    Agency Exemption Orders
    B. Legal Basis
    C. Small Entities Subject to Proposed Rule,
    Form SCIR, and Recordkeeping Rule Amendments
39. Broker-Dealers
40. Clearing Agencies
41. The MSRB
42. National Securities Exchanges and
    National Securities Associations
43. SBS Entities
44. SBSDRs
45. Transfer Agents
    D. Reporting, Recordkeeping, and Other Compliance Requirements
46. Proposed Rule 10 and Parts I and II of
    Proposed Form SCIR
47. Rules 17a–4, 17ad–7, and 18a–6
    E. Duplicative, Overlapping, or Conflicting Federal Rules
48. Proposed Rule 10 and Parts I and II of
    Proposed Form SCIR
49. Rules 17a–4, 17ad–7, 18a–6 and Clearing
    Agency Exemption Orders
    F. Significant Alternatives
50. Broker-Dealers
51. Clearing Agencies
52. The MSRB
53. National Securities Exchanges and
    National Securities Associations
54. SBS Entities
55. SBSDRs
56. Transfer Agents
    G. Request for Comment
    VII. Small Business Regulatory Enforcement
    Fairness Act
    VIII. Statutory Authority
    I. Introduction
    A. Cybersecurity Risk Poses a Threat the U.S. Securities Markets
57. In General
    Cybersecurity risk has been described as ‘‘an effect of uncertainty on or within information and technology.’’ 1 This risk can lead to ‘‘the loss of confidentiality, integrity, or availability of information, data, or information (or control) systems and [thereby to] potential adverse impacts to organizational operations (i.e., mission, functions, image, or reputation) and assets, individuals, other organizations, and the Nation.’’ 2 The U.S. Financial Stability Oversight Counsel (‘‘FSOC’’) in its 2021 annual report stated that a destabilizing cybersecurity incident could potentially threaten the stability of the U.S. financial system through at least three channels:

• First, the incident could disrupt a
  key financial service or utility for which there is little or no substitute. This could include attacks on central banks; exchanges; sovereign and subsovereign creditors, including U.S. state and local governments; custodian banks; payment clearing and settlement systems; or other firms or services that lack substitutes or are sole service providers.
• Second, the incident could
  compromise the integrity of critical

3FSOC, Annual Report (2021), at 168, available at https://home.treasury.gov/system/files/261/ FSOC2021AnnualReport.pdf (‘‘FSOC 2021 Annual Report’’). 4Cybersecurity and Infrastructure Security Agency (‘‘CISA’’), U.S. Department of Homeland Security, Critical Infrastructure Sectors, available at https://www.cisa.gov/critical-infrastructure-sectors. See also Presidential Policy Directive—Critical Infrastructure Security and Resilience, Presidential Policy Directive, PPD–21 (Feb. 12 2013). 5See Securities Industry and Financial Markets Association (‘‘SIFMA’’), Research Quarterly:
Equities (Apr. 27, 2022), available at https:// www.sifma.org/resources/research/research￾quarterly-equities/. 6See SIFMA, US Equity and Related Statistics (June 1, 2022), available at https://www.sifma.org/ resources/research/us-equity-and-related-securities￾statistics/. 7See SIFMA, Research Quarterly: Fixed Income— Outstanding (Mar. 14, 2022), available at https:// www.sifma.org/resources/research/research￾quarterly-fixed-income-outstanding/. 8See SIFMA, US Fixed Income Securities Statistics (June 9, 2022), available at https:// www.sifma.org/resources/research/us-fixed-income￾securities-statistics/. 9The Commission’s tripartite mission is to: (1) protect investors; (2) maintain, fair, orderly, and efficient markets; and (3) facilitate capital formation. See, e.g., Commission, Our Goals, available at https://www.sec.gov/our-goals. 10Currently, there are no MSBSPs registered with the Commission. 11See, e.g., Bank of International Settlements, Erik Feyen, Jon Frost, Leonardo Gambacorta, Harish Natarajan, and Mathew Saal, Fintech and the digital transformation of financial services: implications for market structure and public policy, BIS Papers No. 117 (July 2021), available at https:// www.bis.org/publ/bppdf/bispap117.pdf (‘‘BIS Papers 117’’) (‘‘Significant technology advances have taken place in two key areas that have contributed to the current wave of technology-based finance:’’ Increased connectivity . . . [and] Low￾cost computing and data storage . . .’’). 12 Id. (‘‘Technology has reduced the costs of, and need for, much of the traditional physical infrastructure that drove fixed costs for the direct financial services provider . . . Financial intermediaries can reduce marginal costs through technology-enabled automation and ‘straight through’ processing, which are accelerating with the expanded use of data and [artificial intelligence]-based processes. Digital innovation can also help to overcome spatial (geographical) barriers, and even to bridge differences across legal jurisdictions . . .’’). See also United Nations, Office for Disaster Risk Reduction, Constantine Toregas and Joost Santos, Cybersecurity and its cascading effect on societal systems (2019), available at https://www.undrr.org/publication/cybersecurity￾and-its-cascading-effect-societal-systems (‘‘Cybersecurity and its Cascading Effect on Societal Systems’’) (‘‘Modern society has benefited from the additional efficiency achieved by improving the coordination across interdependent systems using information technology (IT) solutions. IT systems have significantly contributed to enhancing the speed of communication and reducing geographic barriers across consumers and producers, leading to a more efficient and cost-effective exchange of products and services across an economy.’’). 13BIS Papers 117 (‘‘Internet and mobile technology have rapidly increased the ability to transfer information and interact remotely, both between businesses and directly to the consumer. Through
mobile and smartphones, which are near￾ubiquitous, technology has increased access to, and the efficiency of, direct delivery channels and promises lower-cost, tailored financial services . . . Incumbents large and small are embracing digital transformation across the value chain to compete with fintechs and big techs. Competitive pressure on traditional financial institutions may force even those that are lagging to transform or risk erosion of their customer base, income, and margins.’’). 14 Id. (‘‘The COVID–19 pandemic has accelerated the digital transformation. In particular, the need for digital connectivity to replace physical interactions between consumers and providers, and in the processes that produce financial services, will be even more important as economies, financial services providers, businesses and individuals navigate the pandemic and the eventual post-COVID–19 world.’’). See also McKinsey & Company, How Covid–19 has pushed companies data. Accurate and usable information is critical to the stable functioning of financial firms and the system; if such data is corrupted on a sufficiently large scale, it could disrupt the functioning of the system. The loss of such data also has privacy implications for consumers and could lead to identity theft and fraud, which in turn could result in a loss of confidence.

• Third, a cybersecurity incident that
  causes a loss of confidence among a broad set of customers or market participants could cause customers or participants to question the safety or liquidity of their assets or transactions, and lead to significant withdrawal of assets or activity.3 The U.S. securities markets are part of the Financial Services Sector, one of the sixteen critical infrastructure sectors ‘‘whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.’’ 4 These markets are over $100 trillion in total size, and more than a trillion dollars’ worth of transactions flow through them each day. For example, the market capitalization of the U.S. equities market was valued at $49 trillion as of the first quarter of 2022,5 and as of May 2022, the average daily trading dollar volume in the U.S. equities market was $659 billion.6 The market capitalization of the U.S. fixed income market was valued at $52.9 trillion as of the fourth quarter of 2021,7 and as of May 2022, the average daily trading dollar volume in the U.S. fixed income market was $897.8 billion.8 The sizes of these markets are indicative of the central role they play in the U.S. economy in terms of the flow of capital, including the savings of individual investors who are increasingly relying on them to, for example, build wealth to fund their retirement, purchase a home, or pay for college for themselves or their family. Therefore, it is critically important to the U.S. economy, investors, and capital formation that the U.S. securities markets function in a fair, orderly, and efficient manner.9 The fair, orderly, and efficient operation of the U.S. securities markets depends on different types of entities performing various functions to support, among other things, disseminating market information, underwriting securities issuances, making markets in securities, trading securities, providing liquidity to the securities markets, executing securities transactions, clearing and settling securities transactions, financing securities transactions, recording and transferring securities ownership, maintaining custody of securities, paying dividends and interest on securities, repaying principal on securities investments, supervising regulated market participants, and monitoring market activities. Collectively, these functions are performed by entities regulated by the Commission: broker-dealers, broker￾dealers that operate an alternative trading system (‘‘ATS’’), clearing agencies, major security-based swap participants (‘‘MSBSPs’’), the Municipal Securities Rulemaking Board (‘‘MSRB’’), national securities associations, national securities exchanges, security-based swap data repositories (‘‘SBSDRs’’), security-based swap dealers (‘‘SBSDs’’ or collectively with MSBSPs, ‘‘SBS Entities’’), and transfer
  agents (collectively, ‘‘Market Entities’’).10 To perform their functions, Market Entities rely on an array of electronic information, communication, and computer systems (or similar systems) (‘‘information systems’’) and networks of interconnected information systems. While Market Entities have long relied on information systems to perform their various functions, the acceleration of technical innovation in recent years has exponentially expanded the role these systems play in the U.S. securities markets.11 This expansion has been driven by the greater efficiencies and lower costs that can be achieved through the use of information systems.12 It also has been driven by newer entrants (financial technology (Fintech) firms) that have developed business models that rely heavily on information systems (e.g., applications on mobile devices) to provide services to investors and other participants in the securities markets and more established Market Entities adopting the use of similar technologies.13 The COVID–19 pandemic also has contributed to the greater reliance on information systems.14

over the technology tipping point—and transformed business forever (Oct. 5, 2020), available at https:// www.mckinsey.com/capabilities/strategy-and￾corporate-finance/our-insights/how-covid-19-has￾pushed-companies-over-the-technology-tipping￾point-and-transformed-business-forever#/ (noting that due to the COVID–19 pandemic, ‘‘companies have accelerated the digitization of their customer and supply-chain interactions and of their internal operations by three to four years [and] the share of digital or digitally enhanced products in their portfolios has accelerated by a shocking seven years’’). 15See, e.g., Financial Services Information Sharing and Analysis Center (‘‘FS–ISAC’’), Navigating Cyber 2022 (Mar. 2022), available at:
www.fsisac.com/navigatingcyber2022-report (detailing cyber threats that emerged in 2021 and predictions for 2022); Danny Brando, Antonis Kotidis, Anna Kovner, Michael Lee, and Stacey L. Schreft, Implications of Cyber Risk for Financial Stability, FEDS Notes, Washington: Board of Governors of the Federal Reserve System (May 12, 2022), available at https://doi.org/10.17016/2380-
7172.3077 (‘‘Implications of Cyber Risk for
Financial Stability’’) (‘‘Cyber risk in the financial system has grown over time as the system has become more digitized, as evidenced by the increase in cyber incidents. That growth has brought to light unique features of cyber risk and the potentially greater scope for cyber events to affect financial stability.’’); United States Government Accountability Office (‘‘GAO’’), Critical Infrastructure Protection: Treasury Needs to Improve Tracking of Financial Sector Cybersecurity Risk Mitigation Efforts, GAO–20–631 (Sept. 2020), available at https://www.gao.gov/assets/gao-20- 631.pdf (‘‘GAO Cybersecurity Report’’) (‘‘The federal government has long identified the financial services sector as a critical component of the nation’s infrastructure. The sector includes commercial banks, securities brokers and dealers, and providers of the key financial systems and services that support these functions. Altogether, the sector holds about $108 trillion in assets and faces a variety of cybersecurity-related risks. Key risks include (1) an increase in access to financial data through information technology service providers and supply chain partners; (2) a growth in sophistication of malware—software meant to do harm—and (3) an increase in interconnectivity via networks, the cloud, and mobile applications.’’); Cybersecurity and its Cascading Effect on Societal Systems (‘‘Nonetheless, IT dependence has also exposed critical infrastructure and industry systems to a myriad of cyber security risks, ranging from accidental causes, technological glitches, to malevolent willful attacks.’’). 16See, e.g., Verizon, Data Breach Investigations Report (2022) available at https:// www.verizon.com/business/resources/Tba/reports/ dbir/2022-data-breach-investigations-report￾dbir.pdf (‘‘Verizon DBIR’’) (finding that 73% of the data breaches analyzed in the report were caused by external actors). The Verizon DBIR is an annual report that analyzes cyber security incidents (defined as a security event that compromises the integrity, confidentiality or availability of an information asset) and breaches (defined as an incident that results in the confirmed disclosure— not just potential exposure—of data to an unauthorized party). To perform the analysis, data about the cybersecurity incidents included in the report are catalogued using the Vocabulary for Event Recording and Incident Sharing (VERIS). VERIS is a set of metrics designed to provide a common language for describing security incidents in a structured and repeatable manner. More information about VERIS is available at: http:// veriscommunity.net/index.html. See also Microsoft, Microsoft Digital Defense Report (Oct. 2021), available at https://query.prod.cms. rt.microsoft.com/cms/api/am/binary/RWMFIi (‘‘Microsoft Report’’) (‘‘The last year has been marked by significant historic geopolitical events and unforeseen challenges that have changed the way organizations approach daily operations. During this time, nation state
actors have largely maintained their operations at a consistent pace while creating new tactics and techniques to evade detection and increase the scale of their attacks’’). 17See, e.g., Verizon DBIR (finding that 18% of the data breaches analyzed in the report were caused by internal actors). But see id. (‘‘Internal sources accounted for the fewest number of incidents (18 percent), trailing those of external origin by a ratio of four to one. The relative infrequency of data breaches attributed to insiders may be surprising to some. It is widely believed and commonly reported that insider incidents outnumber those caused by other sources. While certainly true for the broad range of security incidents, our caseload showed otherwise for incidents resulting in data compromise. This finding, of course, should be considered in light of the fact that insiders are adept at keeping their activities secret.’’). 18See, e.g., GAO Cybersecurity Report (‘‘The financial services sector faces significant risks due to its reliance on sophisticated technologies and information systems, as well as the potential monetary gain and economic disruption that can occur by attacking the sector’’); IOSCO Cybersecurity Report (‘‘[T]he financial sector is one of the prime targets of cyber attacks. It is easy to understand why: the sector is ‘where the money is’ and it can represent a nation or be a symbol of capitalism for some politically motivated activists.’’). 19See Verizon DBIR (finding that error (defined as anything done (or left undone) incorrectly or inadvertently) as one of action types leading to cybersecurity incidents and breaches). 20See, e.g., Bank of England, CBEST Intelligence￾Led Testing: Understanding Cyber Threat Intelligence Operations (Version 2.0), available at https://www.bankofengland.co.uk/-/media/boe/ files/financial-stability/financial-sector-continuity/ understanding-cyber-threat-intelligence￾operations.pdf (‘‘Bank of England CBEST Report’’) (‘‘The threat actor community, once dominated by amateur hackers, has expanded to include a broad range of professional threat actors, all of whom are strongly motivated, organised and funded. They include: state-sponsored organisations stealing military, government and commercial intellectual property; organised criminal gangs committing theft, fraud and money laundering which they perceive as low risk and high return; non-profit hacktivists and for-profit mercenary organisations attempting to disrupt or destroy their own or their client’s perceived enemies.’’); Microsoft Report (‘‘Sophisticated cybercriminals are also still working for governments conducting espionage and training in the new battlefield’’). 21See, e.g., Microsoft Report (‘‘Through our investigations of online organized crime networks, frontline investigations of customer attacks, security and attack research, nation state threat tracking, and security tool development, we continue to see the cybercrime supply chain consolidate and mature.
It used to be that cybercriminals had to develop all the technology for their attacks. Today they rely on a mature supply chain, where specialists create cybercrime kits and services that other actors buy and incorporate into their campaigns. With the increased demand for these services, an economy of specialized services has surfaced, and threat actors are increasing automation to drive down their costs and increase scale.’’). 22See, e.g., Financial Industry Regulatory Authority (‘‘FINRA’’), Common Cybersecurity Threats, available at: www.finra.org/rules-guidance/ guidance/common-cybersecurity-threats (‘‘FINRA Common Cybersecurity Threats’’) (summarizing common cybersecurity threats faced by broker￾dealers to include phishing, imposter websites, malware, ransomware, distributed denial-of-service attacks, and vendor breaches, among others). 23See CISA, Malware Tip Card, available at https://www.cisa.gov/sites/default/files/ publications/Malware_1.pdf (‘‘CISA Malware Tip Card’’) (‘‘Malware, short for ‘‘malicious software,’’ includes any software (such as a virus, Trojan, or spyware) that is installed on your computer or mobile device. The software is then used, usually covertly, to compromise the integrity of your device. Most commonly, malware is designed to give attackers access to your infected computer. That access may allow others to monitor and control your online activity or steal your personal information or other sensitive data.’’). 24See, e.g., CISA Malware Tip Card (‘‘Adware [is] a type of software that downloads or displays unwanted ads when a user is online or redirects search requests to certain advertising websites. Botnets [are] networks of computers infected by Continued This increased reliance on information systems by Market Entities has caused a corresponding increase in their cybersecurity risk.15 This risk can be caused by the actions of external threat actors, including organized or individual threat actors seeking financial gain, nation states conducting espionage operations, or individuals engaging in protest, acting on grudges or personal offenses, or seeking thrills.16 Internal threat actors (e.g., disgruntled employees or employees seeking financial gain) also can be sources of cybersecurity risk.17 Threat actors may target Market Entities because they handle financial assets or proprietary information about financial assets and transactions.18 In addition to threat actors, errors of employees, service providers, or business partners can create cybersecurity risk (e.g., mistakenly exposing confidential or personal information by, for example, sending it through an unencrypted email to unintended recipients).19 Another factor increasing the cybersecurity risk to Market Entities is the growing sophistication of the tactics, techniques, and procedures employed by threat actors.20 This trend is further exacerbated by the ability of threat actors to purchase tools to engage in cyber-crime.21 Threat actors employ a number of
tactics to cause harmful cybersecurity incidents.22 One tactic is the use of malicious software (‘‘malware’’) that is uploaded into a computer system and used by threat actors to compromise the confidentiality of information stored or operations performed (e.g., monitoring key strokes) on the system or the integrity or availability of the system (e.g., command and control attacks where a threat actor is able to infiltrate a system to install malware to enable it to remotely send commands to infected devices).23 There are a number of different forms of malware, including adware, botnets, rootkit, spyware, Trojans, viruses, and worms.24

malware and controlled remotely by cybercriminals, usually for financial gain or to launch attacks on websites or networks. Many botnets are designed to harvest data, such as passwords, Social Security numbers, credit card numbers, and other personal information . . . Rootkit [is] a type of malware that opens a permanent ‘‘back door’’ into a computer system. Once installed, a rootkit will allow additional viruses to infect a computer as various hackers find the vulnerable computer exposed and compromise it. Spyware [is] a type of malware that quietly gathers a user’s sensitive information (including browsing and computing habits) and reports it to unauthorized third parties. Trojan [is] a type of malware that disguises itself as a normal file to trick a user into downloading it in order to gain unauthorized access to a computer. Virus [is] a program that spreads by first infecting files or the system areas of a computer or network router’s hard drive and then making copies of itself. Some viruses are harmless, others may damage data files, and some may destroy files entirely. Worm [is] a type of malware that replicates itself over and over within a computer.’’). 25See CISA, Ransomware 101, available at https://www.cisa.gov/stopransomware/ransomware￾101 (‘‘Ransomware is an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. In recent years, ransomware incidents have become increasingly prevalent among the Nation’s state, local, tribal, and territorial (SLTT) government entities and critical infrastructure organizations.’’). 26See, e.g., Federal Bureau of Investigation (‘‘FBI’’), internet Crime Report (2021), available at https://www.ic3.gov/Media/PDF/AnnualReport/ 2021_IC3Report.pdf (‘‘FBI internet Crime Report’’) (‘‘Ransomware is a type of malicious software, or malware, that encrypts data on a computer, making it unusable. A malicious cyber criminal holds the data hostage until the ransom is paid. If the ransom is not paid, the victim’s data remains unavailable. Cyber criminals may also pressure victims to pay the ransom by threatening to destroy the victim’s data or to release it to the public.’’). 27See, e.g., Institute for Security and Technology, Combating Ransomware: A Comprehensive Framework For Action: Key Recommendations from the Ransomware Task Force (Apr. 2021), available at https://securityandtechnology.org/ransomware taskforce/report (‘‘The explosion of ransomware as a lucrative criminal enterprise has been closely tied to the rise of Bitcoin and other cryptocurrencies, which use distributed ledgers, such as blockchain, to track transactions.’’). 28See, e.g., FBI internet Crime Report (stating that it received 649 complaints that indicated organizations in the
sixteen U.S. critical infrastructure sectors were victims of a ransomware attack, with the financial sector being the source of the second largest number of complaints). 29See, Office of Compliance, Inspections and Examinations (now the Division of Examinations (‘‘EXAMS’’)), Commission, Risk Alert, Cybersecurity: Ransomware Alert (July 10, 2020), available at https://www.sec.gov/files/ Risk%20Alert%20-%20Ransomware.pdf (‘‘EXAMS Ransomware Risk Alert’’) (observing an apparent increase in sophistication of ransomware attacks on Commission registrants, including broker-dealers). Any staff statements represent the views of the staff. They are not a rule, regulation, or statement of the Commission. Furthermore, the Commission has neither approved nor disapproved their content. These staff statements, like all staff statements, have no legal force or effect: they do not alter or amend applicable law; and they create no new or additional obligations for any person. 30See, e.g., CISA, Security Tip (ST04–014)— Avoiding Social Engineering and Phishing Attacks, available at https://www.cisa.gov/uscert/ncas/tips/ ST04-014 (‘‘CISA Security Tip (ST04–014)’’). 31See, e.g., CISA Security Tip (ST04–014); Microsoft Report (‘‘Phishing is the most common type of malicious email observed in our threat signals. These emails are designed to trick an individual into sharing sensitive information, such as usernames and passwords, with an attacker. To do this, attackers will craft emails using a variety of themes, such as productivity tools, password resets, or other notifications with a sense of urgency to lure a user to click on a link.’’). 32See, e.g., Microsoft Report (‘‘The phishing web pages used in these attacks may utilize malicious domains, such as those purchased and operated by the attacker, or compromised domains, where the attacker abuses a vulnerability in a legitimate website to host malicious content. The phishing sites frequently copy well-known, legitimate login pages, such as Office 365 or Google, to trick users into inputting their credentials. Once the user inputs their credentials, they will often be redirected to a legitimate final site—such as the real Office 365 login page—leaving the user unaware that actors have obtained their credentials. Meanwhile, the entered credentials are stored or sent to the attacker for later abuse or sale.’’). 33See, e.g., U.S. Office of the Director of National Intelligence, Spear Phishing and Common Cyber Attacks, available at https://www.dni.gov/files/ NCSC/documents/campaign/Counterintelligence_ Tips_Spearphishing.pdf (‘‘ODNI Spear Phishing Alert’’) (‘‘A spear phishing attack is an attempt to acquire sensitive information or access to a computer system by sending counterfeit messages that appear to be legitimate. ‘Spear phishing’ is a type of phishing campaign that targets a specific person or group and often will include information known to be of interest to the target, such as current events or financial
documents. Like other social engineering attacks, spear phishing takes advantage of our most basic human traits, such as a desire to be helpful, provide a positive response to those in authority, a desire to respond positively to someone who shares similar tastes or views, or simple curiosity about contemporary news and events.’’). 34See, e.g., CISA Security Tip (ST04–014). 35See, e.g., ODNI Spear Phishing Alert (‘‘The goal of spear phishing is to acquire sensitive information such as usernames, passwords, and other personal information. When a link in a phishing email is opened, it may open a malicious site, which could download unwanted information onto a user’s computer. When the user opens an attachment, malicious software may run which could compromise the security posture of the host. Once a connection is established, the attacker is able to initiate actions that could compromise the integrity of your computer, the network it resides on, and data.’’). 36See Verizon DBIR (definition of ‘‘hacking’’); see also NIST Glossary (defining a ‘‘hacker’’ as an ‘‘unauthorized user who attempts to or gains access to an information system’’). 37See, e.g., Web Application Security Consortium, WASC Threat Classification: Version
2.00 (1/1/2010), available at https://
projects.webappsec.org/f/WASC-TC-v2_0.pdf (‘‘WASC Classification Report’’). 38See, e.g., WASC Classification Report (‘‘The most common type of a brute force attack in web applications is an attack against log-in credentials. Since users need to remember passwords, they often select easy to memorize words or phrases as passwords, making a brute force attack using a dictionary useful. Such an attack attempting to log￾in to a system using a large list of words and phrases as potential passwords is often called a ‘word list attack’ or a ‘dictionary attack.’ ’’). 39See EXAMS, Commission, Risk Alert, Cybersecurity: Safeguarding Client Accounts against Credential Compromise (Sept. 15, 2020), available at https://www.sec.gov/files/ Risk%20Alert%20-%20Credential%20Compromise. pdf (‘‘EXAMS Safeguarding Client Accounts Risk Alert’’) (‘‘The Office of Compliance Inspections and Examinations (‘OCIE’) has observed in recent examinations an increase in the number of cyber￾attacks against SEC-registered investment advisers (‘advisers’) and brokers and dealers (‘broker￾A second tactic is a variation of malware known as ‘‘ransomware.’’ 25 In this scheme, the threat actor encrypts the victim’s data making it unusable and then demands payment to decrypt it.26 Ransomware schemes have become more prevalent with the widespread adoption and use of crypto assets.27 It is a common tactic used against the financial sector.28 Commission staff has observed that this tactic has increasingly been employed against certain Market Entities.29 Another group of tactics are various social engineering schemes. In a social engineering attack, the threat actor uses social skills to convince an individual to provide access or information that can be used to access an information system.30 ‘‘Phishing’’ is a variation of a social engineering attack in which an email is used to convince an individual to provide information (e.g., personal or account information or log-in credentials) that can be used to gain unauthorized access to an information system.31 Threat actors also use websites to perform phishing attacks.32 ‘‘Spear phishing’’ is a variation of phishing that targets a specific individual or group.33 ‘‘Vishing’’ and ‘‘smishing’’ are variations of social engineering that use phone communications or text messages, respectively, for this purpose.34 These social engineering tactics also are used to deceive the recipient of an electronic communication (e.g., an email or text message) to open a link or attachment in the communication that uploads malware on to the recipient’s information systems.35 In addition to malware and social engineering, threat actors may try to circumvent or thwart the information system’s logical security mechanisms (i.e., to ‘‘hack’’ the system).36 There are many variations of hacking.37 One tactic is a ‘‘brute force’’ attack in which the threat actor attempts to determine an unknown value (e.g., log-in credentials) using an automated process that tries a large
number of possible values.38 The Commission staff has observed that a variation of this tactic has increasingly been employed by threat actors against certain Market Entities to access their customers’ accounts.39 The ability of

dealers,’ and together with advisers, ‘registrants’ or ‘firms’) using credential stuffing. Credential stuffing is an automated attack on web-based user accounts as well as direct network login account credentials. Cyber attackers obtain lists of usernames, email addresses, and corresponding passwords from the dark web and then use automated scripts to try the compromised user names and passwords on other websites, such as a registrant’s website, in an attempt to log in and gain unauthorized access to customer accounts.’’). 40See, e.g., CISA, Alert (AA22–117A): 2021 Top Routinely Exploited Vulnerabilities, available at https://www.cisa.gov/uscert/ncas/alerts/aa22-117a (‘‘CISA 2021 Vulnerability Report’’) (‘‘Globally, in 2021, malicious cyber actors targeted internet-facing systems, such as email servers and virtual private network (VPN) servers, with exploits of newly disclosed vulnerabilities. For most of the top exploited vulnerabilities, researchers or other actors released proof of concept (POC) code within two weeks of the vulnerability’s disclosure, likely facilitating exploitation by a broader range of malicious actors. To a lesser extent, malicious cyber actors continued to exploit publicly known, dated software vulnerabilities—some of which were also routinely exploited in 2020 or earlier. The exploitation of older vulnerabilities demonstrates the continued risk to organizations that fail to patch software in a timely manner or are using software that is no longer supported by a vendor.’’). To address this risk, CISA maintains a Known Exploited Vulnerability (KEV) catalogue that identifies known vulnerabilities. See, e.g., CISA, Reducing The Significant Risk of Known Exploited Vulnerabilities, available at https://www.cisa.gov/ known-exploited-vulnerabilities (‘‘CISA strongly recommends all organizations review and monitor the KEV catalog and prioritize remediation of the listed vulnerabilities to reduce the likelihood of compromise by known threat actors.’’). 41See CISA, Security Tip (ST04–015)— Understanding Denial-of-Service Attacks, available at https://www.cisa.gov/uscert/ncas/tips/ST04-015 (‘‘A denial-of-service (DoS) attack occurs when legitimate users are unable to access information systems, devices, or other network resources due to the actions of a malicious threat actor. Services affected may include email, websites, online accounts (e.g., banking), or other services that rely on the affected computer or network. A denial-of￾service condition is accomplished by flooding the targeted host or network with traffic until the target cannot respond or simply crashes, preventing access for legitimate users. DoS attacks can cost an organization both time and money while their resources and services are inaccessible.’’). 42See Verizon DBIR (finding that DoS attacks represented 46% of the total cybersecurity incidents analyzed). 43See, e.g., Verizon DBIR (finding that the top assets breached in cyber security incidents are servers
hosting web applications and emails, and stating that because they are ‘‘internet-facing’’ they ‘‘provide a useful venue for attackers to slip through the organization’s ‘perimeter’ ’’). 44See, e.g., Ponemon Institute LLC, The Cost of Third-Party Cybersecurity Risk Management (Mar. 2019), available at https://info.cybergrx.com/ ponemon-report (‘‘Third-party breaches remain a dominant security challenge for organizations, with over 63% of breaches linked to a third party.’’). 45See, e.g., Financial Markets Authority, New Zealand, Market Operator Obligations Targeted Review—NZX (January 2021), available at https:// www.fma.govt.nz/assets/Reports/Market-Operator￾Obligations-Targeted-Review-NZX.pdf (‘‘New Zealand FMA Report’’) (describing an August 2020 cybersecurity incident at New Zealand’s only regulated financial product market that caused a trading halt of approximately four days). 46See, e.g., Implications of Cyber Risk for Financial Stability (‘‘Cyber shocks can lead to losses hitting many firms at the same time because of correlated risk exposures (sometimes called the popcorn effect), such as when firms load the same malware-infected third-party software update.’’); The Bank for International Settlements, Committee on Payments and Market Infrastructures (‘‘CPMI’’) and IOSCO, Guidance on cyber resilience for financial market infrastructures (June 2016), available at https://www.bis.org/cpmi/publ/ d146.pdf (‘‘[T]here is a broad range of entry points through which a [financial market intermediary (‘‘FMI’’)] could be compromised. As a result of their interconnectedness, cyber attacks could come through an FMI’s participants, linked FMIs, service providers, vendors and vendor products . . . . Because an FMI’s systems and processes are often interconnected with the systems and processes of other entities within its ecosystem, in the event of a large-scale cyber incident it is possible for an FMI to pose contagion risk (i.e., propagation of malware or corrupted data) to, or be exposed to contagion risk from, its ecosystem.’’). 47See, e.g., Implications of Cyber Risk for Financial Stability (‘‘And the interconnectedness of the financial system means that an event at one or more firms may spread to others (the domino effect). For example, a cyber event at a single bank can disrupt the bank’s ability to send payments and have cascading effects on other banks’ liquidity and operations.’’). 48See, e.g., Bank of England CBEST Report (‘‘One class of targeted attack is Computer Network Exploitation (CNE) where the goal is to steal (or exfiltrate) confidential information from the target. This is effectively espionage in cyberspace or, in information security terms, compromising confidentiality.’’). 49The NIST Glossary defines ‘‘identity fraud or theft’’ as ‘‘all types of crime in which someone wrongfully obtains and uses another person’s personal data in some way that involves fraud or deception, typically for economic gain.’’ 50CISA, Cyber Essentials
Starter Kit—The Basics for Building a Culture of Cyber Readiness (Spring 2021), available at https://www.cisa.gov/sites/ default/files/publications/Cyber%20Essentials%20 Starter%20Kit_03.12.2021_508_0.pdf (‘‘CISA Cyber Essentials Starter Kit’’) (‘‘Malware is designed to spread quickly. A lack of defense against it can completely corrupt, destroy or render your data inaccessible.’’). threat actors to hack into information systems can be facilitated by vulnerabilities in information systems, including for example the software run on the systems.40 Threat actors also cause harmful cybersecurity incidents through denial￾of-service (‘‘DoS’’) attacks.41 This type of attack may involve botnets or compromised servers sending ‘‘junk’’ data or messages to an information system that a Market Entity uses to provide services to investors, market participants, or other Market Entities causing the system to fail or be unable to process operations in a timely manner. DoS attacks are a commonly used tactic.42 The tactics, techniques, and procedures employed by threat actors can impact the information systems a Market Entity operates directly (e.g., a web application or email system).43 They also can adversely impact the Market Entity and its information systems through its connection to information systems operated by third￾parties such as service providers (e.g., cloud service providers), business partners, customers, counterparties, members, registrants, or users.44 Further, the tactics, techniques, and procedures employed by threat actors can adversely impact the Market Entity and its information systems through its connection to information systems operated by utilities or central platforms to which the Market Entity is connected (e.g., a securities exchange, securities trading platform, securities clearing agency, or a payment processor).45 If cybersecurity risk materializes into a significant cybersecurity incident, a Market Entity may lose its ability to perform a key function causing harm to the Market Entity, investors, or other market participants. Moreover, given the interconnectedness of Market Entities’ information systems, a significant cybersecurity incident at one Market Entity has the potential to spread to other Market Entities in a cascading process that could cause widespread disruptions threatening the fair, orderly, and efficient operation of the U.S. securities markets.46 Further, the disruption of a Market Entity that provides critical services to other Market Entities through connected information systems could cause cascading disruptions to those other Market Entities to the extent they cannot obtain those critical services from another source.47 A significant cybersecurity incident also can result in unauthorized access to and use of personal, confidential, or proprietary information.48 In the case of personal information, this can cause harm to investors and others whose personal information was accessed or used (e.g., identity
theft).49 This could lead to theft of investor assets. In the case of confidential or proprietary information, this can cause harm to the business of the person whose proprietary information was accessed or used (e.g., public exposure of trading positions or business strategies) or provide the unauthorized user with an unfair advantage over other market participants (e.g., trading based on confidential business information). Unauthorized access to proprietary information also can lead to theft of a Market Entity’s valuable intellectual property. Cybersecurity incidents affecting Market Entities can cause substantial harm to other market participants, including investors. For example, significant cybersecurity incidents caused by malware can cause the loss of the Market Entity’s data, or the data of other market participants.50 These

51See, e.g., IBM Security, Cost of Data Breach Report 2022, available at https://www.ibm.com/ security/data-breach (noting the average cost of a data breach in the financial industry is $5.97 million); FBI internet Crime Report (noting that cybercrime victims lost approximately $6.9 billion in 2021). 52The Commission has pending proposals to address cybersecurity risk with respect to investment advisers, investment companies, and public companies. See Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies, Release Nos. 33–11028, 34–94917, IA– 5956, IC–34497 (Feb. 9, 2022) [87 FR 13524, (Mar. 9, 2022)] (‘‘Investment Management Cybersecurity Release’’); Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Release Nos. 33–11038, 34–94382, IC–34529 (Mar. 9, 2022) [87 FR 16590 (Mar. 23, 2022)]. In addition, as discussed in more detail below in section II.F. of this release, the Commission is proposing to amend Regulation SCI (17 CFR 242.1000 through
1007) and Regulation S–P (17 CFR 248.1 through
248.30) concurrent with this release. See Regulation Systems Compliance and Integrity, Release No. 34– 97143 (Mar. 15, 2023) (File No. S7–07–23) (‘‘Regulation SCI 2023 Proposing Release’’); Regulation S–P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Release Nos. 34–97141, IA–6262, IC– 34854 (Mar. 15, 2023) (File No. S7–05–23) (‘‘Regulation S–P 2023 Proposing Release’’). The Commission encourages commenters to review the proposals with respect to Regulation SCI and Regulation S–P to determine whether they might affect their comments on this proposing release. See also section II.F. of this release (seeking specific comment on how the proposals in this release would interact with Regulation SCI and Regulation S–P as they currently exist and would be amended). Further, the Commission has reopened the comment period for the Investment Management Cybersecurity Release to allow interested persons additional time to analyze the issues and prepare their comments in light of other regulatory developments, including the proposed rules and amendments regarding this proposal, the Regulation SCI 2023 Proposing Release and the Regulation S– P 2023 Proposing Release that the Commission should consider in connection with the Investment Management Cybersecurity Release. See Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies; Reopening of Comment Period, Release Nos. 33–11167, 34– 97144, IA–6263, IC–34855 (Mar. 15, 2023), [88 FR 16921 (Mar. 31, 2023)]. The Commission encourages commenters to review the Investment Management Cybersecurity Release and the comments on that proposal to determine whether they might affect their comments on this proposing release. The comments on the Investment Management Cybersecurity Release are available at:
https://www.sec.gov/comments/s7-04-22/ s70422.htm. Lastly, the Commission also proposed rules and amendments regarding an investment adviser’s obligations with respect to outsourcing certain categories of ‘‘covered functions,’’ including cybersecurity. See Outsourcing by Investment Advisers, Release No. IA–6176 (Oct. 26, 2022), [87 FR 68816 (Nov. 16, 2022)]. The Commission encourages commenters to review that proposal to determine whether it might affect comments on this proposing release. 53See GAO Cybersecurity Report (‘‘Risks due to insider threats involve careless, poorly trained, or disgruntled employees or contractors hired by an organization who may intentionally or inadvertently introduce vulnerabilities or malware into information systems. Insiders may not need a great deal of knowledge about computer intrusions because their knowledge of a target system often allows them to gain unrestricted access to cause damage to the system or to steal system data. Results of insider threats can include data destruction and account compromise.’’). 54 Id. (‘‘The risk of malware exploits impacting the [financial] sector has increased as malware exploits have grown in sophistication’’). 55 Id. (‘‘The financial services sector is at risk due to social engineering attacks, which include a broad range of malicious activities accomplished through human interaction that enable attackers to gain access to sensitive data by convincing a legitimate, authorized user to give them their credentials and/ or other personal information’’). 56 Id. (‘‘Interconnectivity involves interdependencies throughout the financial services sector and the sharing of data and information via networks, the cloud, and mobile applications. Organizations in the financial services sector utilize data aggregation hubs and cloud service providers, and new financial technologies such as algorithms based on consumers’ data and risk preferences to provide digital services for investment and financial advice.’’). 57Some Market Entities may store certain or all of their records in paper format. This discussion pertains to recordkeeping systems that store records electronically on information systems. incidents also can lead to business disruptions that are not just costly to the Market Entity but also the other market participants that rely on the Market Entity’s services. A Market Entity also may incur substantial remediation costs due to a significant cybersecurity incident.51 For example, the incident may result in reimbursement to other market participants for cybersecurity-related losses and payment for their use of identity protection services. A Market Entity’s failure to protect itself adequately against a significant cybersecurity incident also may increase its insurance premiums. In addition, a significant cybersecurity incident may expose a Market Entity to litigation costs (e.g., to defend lawsuits brought by individuals whose personal information was stolen), regulatory scrutiny,
reputational damage, and, if a result of a compliance failure, penalties. Finally, a sufficiently severe significant cybersecurity incident could cause the failure of a Market Entity. Given the interconnectedness of Market Entities, a significant cybersecurity incident that degrades or disrupts the critical functions of one Market Entity could cause harm to other Market Entities (e.g., by cutting off their access to a critical service such as securities clearance or by exposing them to the same malware that degraded or disrupted the critical functions of the first Market Entity). This could lead to market-wide outages that compromise the fair, orderly, and efficient functioning of the U.S. securities markets. For these reasons, the Commission is proposing new rule requirements that are designed to protect the U.S. securities markets and investors in these markets from the threat posed by cybersecurity risks.52
2. Critical Operations of Market Entities
Are Exposed to Cybersecurity Risk The fair, orderly, and efficient operation of the U.S. securities markets depends on Market Entities performing various functions without disruption. Market Entities rely on information systems and networks of interconnected information systems to perform their functions. This exposes them to the harms that can be caused by threat actors using the tactics, techniques, and procedures discussed above (among others) and by errors of employees or third-party service providers (among others). The GAO has stated that the primary cybersecurity risks identified by financial sector firms are: (1) internal actors; 53 (2) malware; 54 (3) social engineering; 55 and (4) interconnectivity.56 As discussed below, a significant cybersecurity incident can cause serious harm to Market Entities and others who use their services or are connected to them through information systems and, if severe enough, negatively impact the fair, orderly, and efficient operations of the U.S. securities markets. a. Common Uses of Information Systems by Market Entities Market Entities need accurate and accessible books and records, among other things, to manage and conduct their operations, manage and mitigate their risks, monitor the progress of their business, track their financial condition, prepare financial statements, prepare regulatory filings, and prepare tax returns. Increasingly, these records are made and preserved on information systems.57 These recordkeeping information systems also store personal, confidential, and proprietary business information about the Market Entity and its customers, counterparties, members, registrants, or users. The complexity and scope of these books and records systems ranges from ones used by large Market Entities that comprise networks of systems that track thousands of different types of daily transactions (e.g., securities trades and movements of assets) to ones used by

58See, e.g., 17 CFR 240.17a–3(a)(17) (requiring broker-dealers to make account records of the customer’s or owner’s name, tax identification number, address, telephone number, date of birth, employment status, annual income, net worth, and the account’s investment objectives). Broker-dealers also must comply with relevant anti-money laundering (AML) laws, rules, orders, and guidance. See, e.g., Commission, Anti-Money Laundering (AML) Source Tool for Broker-Dealers, (May 16, 2022), available at https://www.sec.gov/about/ offices/ocie/amlsourcetool. 59Section 3(a)(26) of the Exchange Act defines a self-regulatory organization as any national securities exchange, registered securities association, registered clearing agency, or (with limitations) the MSRB. See 15 U.S.C. 78c(a)(26). 60 17 CFR 242.300 through 242.304. Exchange Act Rule 3a1–1(a)(2) exempts from the definition of ‘‘exchange’’ under Section 3(a)(1) of the Exchange Act an organization, association, or group of persons that complies with Regulation ATS. See 17 CFR 240.3a1–1(a)(2). Regulation ATS requires an ATS to, among other things, register as a broker￾dealer, file a Form ATS with the Commission to notice its operations, and establish written safeguards and procedures to protect subscribers’ confidential trading information. See 17 CFR 242.301(b)(1), (2), and (10), respectively. The broker-dealer operator of the ATS controls all aspects of the ATS’s operations and is legally responsible for its operations and for ensuring that the ATS complies with applicable federal securities laws and the rules and regulations thereunder, including Regulation ATS. See Regulation of NMS Stock Alternative Trading Systems, Exchange Act Release No. 83663 (July 18, 2018) [83 FR 38768, 38819–20 (Aug. 7, 2018)] (‘‘Regulation of NMS Stock Alternative Trading Systems Release’’). 61See 17 CFR 242.300(k) (defining the term ‘‘NMS Stock ATS’’). the-shelf accounting software and computer files on a desktop computer. In either case, the impact on the confidentiality, integrity, or availability of the information system being compromised as a consequence of a significant cybersecurity incident can be devastating to the Market Entity and its customers, counterparties, members, registrants or users. For example, it could cause the Market Entity to cease operations or allow threat actors to use personal information about the customers of the Market Entity to steal their identities. Market Entities also use information systems so that their employees can communicate with each other and with external persons. These include email, text messaging, and virtual meeting applications. The failure of these information systems as a result of a significant cybersecurity incident can seriously disrupt the Market Entity’s ability to carry out its functions. Moreover, these outward facing information systems are vectors that threat actors use to cause harmful cybersecurity incidents by, for example, tricking an employee through
social engineering into downloading malware in an attachment to an email. b. Broker-Dealers Broker-dealers perform a number of functions in the U.S. securities markets, including underwriting the issuance of securities for publicly and privately held companies, making markets in securities, brokering securities transactions, dealing securities, operating an ATS, executing securities transactions, clearing and settling securities transactions, and maintaining custody of securities for investors. Some broker-dealers may perform multiple functions; whereas others may perform a single function. Increasingly, these functions are performed through the use of information systems. For example, broker-dealers use information systems to connect to securities exchanges, ATSs, and other securities markets in order to transmit purchase and sell orders. Broker-dealers also use information systems to connect to clearing agencies or clearing broker￾dealers to transmit securities settlement instructions and transfer funds. They use information systems to communicate and transact with other broker-dealers. In addition, they use information systems to provide securities services to investors, including information systems that investors use to access their securities accounts and transmit orders to purchase or sell securities. Depending on the functions undertaken by a broker-dealer, a significant cybersecurity incident could affect customers, including retail investors. For example, a significant cybersecurity incident could result in the broker-dealer experiencing a systems outage, which in turn could leave customers unable to purchase or sell securities held in their account and the broker-dealer unable to trade for itself. In addition, broker-dealers maintain records and information related to their customers that include personal information, such as names, addresses, phone numbers, employer information, tax identification information, bank information, and other detailed and individualized information related to broker-dealer obligations under applicable statutory and regulatory provisions.58 If personal information held by a broker-dealer is accessed or stolen by unauthorized users, it could result in harm (e.g., identity theft or conversion of financial assets) to many individuals, including retail investors. Further, a significant cybersecurity incident at a broker-dealer could provide a gateway for threat actors to attack the self-regulatory organizations (‘‘SROs’’)—such as national securities exchanges and registered clearing agencies—ATSs, and other broker￾dealers to which the firm is connected through information systems and networks of interconnected information systems.59 This could cause a cascading effect where a significant cybersecurity incident initially impacting one broker￾dealer spreads to other Market Entities. Moreover, the information systems that link a broker-dealer to other Market Entities, its customers, and other service providers are
vectors that expose the broker-dealer to cybersecurity risk arising from threats that originate in information systems outside the broker￾dealer’s control. In addition, some broker-dealers operate ATSs. An ATS is a trading system for securities that meets the definition of ‘‘exchange’’ under federal securities laws but is not required to register with the Commission as a national securities exchange if it complies with the conditions to an exemption provided under Regulation ATS, which includes registering as a broker-dealer.60 Registering as a broker￾dealer requires becoming a member of an SRO, such as FINRA, and membership in FINRA subjects an ATS to FINRA’s rules and oversight. Since Regulation ATS was adopted in 1998, ATSs’ operations have increasingly relied on complex automated systems to bring together buyers and sellers for various securities, which include—for example—electronic limit order books and auction mechanisms. These developments have made ATSs significant sources of orders and trading interest for securities. ATSs employ information systems to accept, store, and match orders pursuant to pre￾programmed methods and to communicate the execution of these orders for trade reporting purposes and for clearance and settlement of the transactions. ATSs, in particular ATSs that are ‘‘NMS Stock ATSs,’’ 61 use information systems to connect to various trading centers in order to receive market data that ATSs use to price and execute orders that are entered on the ATS. A significant cyber security incident could disrupt the ATS’s critical infrastructure and significantly impede the ability of the ATS to (among other things): (1) receive market data; (2) accept, price, and match orders; or (3) report transactions. This, in turn, could negatively impact the ability of ATS subscribers to trade and execute the orders of their investors or purchase certain securities at favorable or predictable prices or in a timely manner to the extent the ATS provides

62See 15 U.S.C. 78c(a)(23)(A).
63See 15 U.S.C. 78q–1(b); 17 CFR 240.17Ab2–1. 64See 17 CFR 240.17Ad–22. See also Standards for Covered Clearing Agencies, Exchange Act Release No. 78961 (Sept. 28, 2016) [81 FR 70786, 70793 (Oct. 13, 2016)] (‘‘CCA Standards Adopting Release’’). As discussed below, some clearing agencies operate pursuant to Commission exemptions from registration. 65See 17 CFR 240.17Ad–22 (‘‘Rule 17Ad–22’’); Definition of ‘‘Covered Clearing Agency’’, Exchange Act Release No. 88616 (Apr. 9, 2020) [85 FR 28853, 28855–56 (May 14, 2020)] (‘‘CCA Definition Adopting Release’’). 66See 15 U.S.C. 78c(a)(23)(A); 17 CFR 240.17Ad– 22; CCA Definition Adopting Release, 81 FR at 28856. 67The active covered clearing agencies are: (1) The Depository Trust Company (‘‘DTC’’); (2) Fixed Income Clearing Corporation (‘‘FICC’’); (3) National Securities Clearing Corporation (‘‘NSCC’’); (4) Intercontinental Exchange, Inc. (‘‘ICE’’) Clear Credit LLC (‘‘ICC’’); (5) ICE Clear Europe Limited (‘‘ICEEU’’); (6) The Options Clearing Corporation (‘‘Options Clearing Corp.’’); and (7) LCH SA. Certain clearing agencies are registered with the Commission but are not covered clearing agencies. See CCA Standards Adopting Release, 81 FR at
70793. In particular, although subject to paragraph
(d) of Rule 17Ad–22, the Boston Stock Exchange Clearing Corporation (‘‘BSECC’’) and Stock Clearing Corporation of Philadelphia (‘‘SCCP’’) are currently registered with the Commission as clearing agencies but conduct no clearance or settlement operations. See Self-Regulatory Organizations; The Boston Stock Clearing Corporation; Notice of Filing and Immediate Effectiveness of Proposed Rule Change To Amend the Articles of Organization and By￾Laws, Exchange Act Release No. 63629 (Jan. 3,
2011) [76 FR 1473, 1474 (Jan. 10, 2011)] (‘‘BSECC
Notice’’); Self-Regulatory Organizations; Stock Clearing Corporation of Philadelphia; Notice of Filing and Immediate Effectiveness of Proposed Rule Change Relating to the Suspension of Certain Provisions Due to Inactivity, Exchange Act Release No. 63268 (Nov. 8, 2010) [75 FR 69730, 69731 (Nov. 15, 2010)] (‘‘SCCP Notice’’). 68 15 U.S.C. 78q–1(b)(1). See also 15 U.S.C. 78mm (providing the Commission with general exemptive authority). 69See 15 U.S.C. 78q–1(b)(1). The Commission’s exercise of authority to grant exemptive relief must be consistent with the public interest, the protection of investors, and the purposes of Section 17A of the Exchange Act, including the prompt and accurate clearance and settlement of securities transactions and the safeguarding of securities and funds. 70See Global Joint Venture Matching Services— US, LLC; Order Granting Exemption from Registration as a Clearing Agency, Exchange Act Release No. 44188 (Apr. 17, 2001) [66 FR 20494 (Apr. 23, 2001)] (granting an exemption to provide matching services to Global Joint Venture Matching Services US LLC, now known as DTCC ITP Matching U.S. LLC) (‘‘DTCC ITP Matching Order’’); Bloomberg STP LLC; SS&C Technologies, Inc.; Order of the Commission Approving Applications for an Exemption From Registration as a Clearing Agency, Exchange Act Release No. 76514 (Nov. 25,
2015) [80 FR 75388 (Dec. 1, 2015)] (granting an
exemption to provide matching services to each of Bloomberg STP LLC and SS&C Technologies, Inc.) (‘‘BSTP SS&C Order’’). In addition, on July 1, 2011, the Commission published a conditional, temporary exemption from clearing agency registration for entities that perform certain post-trade processing services for security-based swap transactions. See Order Pursuant to Section 36 of the Securities Exchange Act of 1934 Granting Temporary Exemptions From Clearing Agency Registration Requirements Under Section 17A(b) of the Exchange Act for Entities Providing Certain Clearing Services for Security-Based Swaps, Exchange Act Release No. 34–64796 (July 1, 2011) [76 FR 39963 (July 7, 2011)]. The order facilitated the Commission’s identification of entities that operate in that area and that accordingly may fall within the clearing agency definition. Recently, the Commission indicated that the 2011 Temporary Exemption may no longer be necessary. See Rules Relating to Security-Based Swap Execution and Registration and Regulation of Security-Based Swap Execution Facilities, Release No. 34–94615 (Apr. 6,
2022) [87 FR 28872, 28934 (May 11, 2022)] (stating
that the ‘‘Commission preliminarily believes that, if it adopts a framework for the registration of [security-based swap execution facilities (‘‘SBSEFs’’)], the 2011 Temporary Exemption would no longer be necessary because entities carrying out the functions of SBSEFs would be able to register with the Commission as such, thereby falling within the exemption from the definition of ‘clearing agency’ in existing Rule 17Ad–24.’’). 71See Euroclear Bank SA/NV; Order of the Commission Approving an Application To Modify an Existing Exemption From Clearing Agency Registration, Exchange Act Release No. 79577 (Dec. 16, 2016) [81 FR 93994 (Dec. 22, 2016)] (providing an exemption to Euroclear Bank SA/NV (successor in name to Morgan Guaranty Trust Company of NY)) (‘‘Euroclear Bank Order’’); Self-Regulatory Organizations; Cedel Bank; Order Approving Application for Exemption From Registration as a Clearing Agency, Exchange Act Release No. Release No. 38328 (Feb. 24, 1997) [62 FR 9225 (Feb. 28, 1997)] (providing an exemption to Clearstream Banking, S.A. (successor in name to Cedel Bank, societe anonyme, Luxembourg)) (‘‘Clearstream Banking Order’’). Furthermore, pursuant to the Commission’s statement on CCPs in the European Union (‘‘EU’’) authorized under the European Markets Infrastructure Regulation (‘‘EMIR’’), an EU CCP may request an exemption from the Commission where it has determined that the application of Commission requirements would impose unnecessary, duplicative, or inconsistent requirements in light of EMIR requirements to which it is subject. See Statement on Central Counterparties Authorized under the European Markets Infrastructure Regulation Seeking to Register as a Clearing Agency or to Request Exemptions from Certain Requirements Under the Securities Exchange Act of 1934, Exchange Act Release No. 34–90492 (Nov. 23, 2020) [85 FR 76635, 76639 (Nov. 30, 2020)], https://www.govinfo.gov/ content/pkg/FR-2020-11-30/pdf/FR-2020-11-30.pdf (stating that in seeking an exemption, an EU CCP could provide ‘‘a self-assessment . . . [to] explain how the EU CCP’s compliance with EMIR corresponds to the requirements in the Exchange Act and applicable SEC rules thereunder, such as Rule 17Ad–22 and Regulation SCI.’’). liquidity to the market for those securities.
c. Clearing Agencies
Clearing agencies are broadly defined in the Exchange Act and undertake a variety of functions.62 An entity that meets the definition of a ‘‘clearing agency’’ is required to register with the Commission or obtain from the Commission an exemption from registration prior to performing the functions of a clearing agency.63 Two common functions of registered clearing agencies are operating as a central counterparty (‘‘CCP’’) or a central securities depository (‘‘CSD’’). Registered clearing agencies that provide these services are ‘‘covered clearing agencies’’ under Commission regulations.64 A CCP acts as the buyer to every seller and the seller to every buyer, providing a trade guaranty with respect to transactions submitted for clearing by the clearing agency’s participants.65 A CSD acts as a depository for handling securities, whereby all securities of a particular class or series of any issuer deposited within the system are treated as fungible. Market Entities may use a CSD to transfer, loan, or pledge securities by bookkeeping entry without the physical delivery of certificates. A CSD also may permit or facilitate the settlement of securities transactions more generally.66 Currently, all clearing agencies registered with the Commission that are actively providing clearance and settlement services are covered clearing agencies.67 Registered clearing agencies also are SROs under section 19 of the Exchange Act, and their proposed rules are subject to Commission review and published for notice and comment. While certain types of proposed rules are effective upon filing, others are subject to Commission approval before they can go into effect. Additionally, section 17A(b)(1) of the Exchange Act provides the Commission with authority to exempt a clearing agency or any class of clearing agencies (‘‘exempt clearing agencies’’) from any provision of section 17A or the rules or regulations thereunder.68 An exemption may be effected by rule or order, upon the Commission’s own motion or upon application, and conditionally or unconditionally.69 The Commission has provided exemptions from registration as a clearing agency for clearing agencies that provide matching services.70 Matching services centrally match trade information between a broker-dealer and its institutional customer. The Commission also has provided exemptions for non-U.S. clearing agencies to perform the functions of a clearing agency with respect to transactions of U.S. participants involving U.S. government and agency securities.71 Registered and exempt clearing agencies rely on information systems to perform the functions described above. Given their central role, the information systems operated by clearing agencies are critical to the operations of the U.S. securities markets. For registered clearing agencies, in particular, these information systems include those that set and calculate margin obligations and other charges, perform netting and calculate payment obligations, facilitate
the movement of funds and securities, or effectuate end-of-day settlement.

72See generally Board of Governors of the Federal Reserve System (‘‘Federal Reserve Board’’), Commission, Commodity Futures Trading Commission (‘‘CFTC’’), Risk Management of Designated Clearing Entities (July 2011), available at https://www.federalreserve.gov/publications/ other-reports/files/risk-management-supervision￾report-201107.pdf (report to the Senate Committees on Banking, Housing, and Urban Affairs and Agriculture, Nutrition, and Forestry and the House Committees on Financial Services and Agriculture stating that a designated clearing entity (‘‘DCE’’) ‘‘faces two types of non-financial risks—operational and legal—that may disrupt the functioning of the DCE. . . . DCEs face operational risk from both internal and external sources, including human error, system failures, security breaches, and natural or man-made disasters.’’). 73See also EXAMS, Commission, Staff Report on the Regulation of Clearing Agencies (Oct. 1, 2020), available at https://www.sec.gov/files/regulation￾clearing-agencies-100120.pdf (staff stating that ‘‘consolidation among providers of clearance and settlement services concentrates clearing activity in fewer providers and has increased the potential for providers to become single points of failure.’’). 74See 15 U.S.C. 78o–4. Information about the MSRB and its functions is available at:
www.msrb.org.
75See 15.U.S.C. 78o–4(b)(2).
76See 15.U.S.C. 78o–4(b)(2)(C).
77Broker-dealers, and municipal securities dealers that trade municipal securities are subject to transaction reporting obligations under MSRB Rule G–14. EMMA, established by the MSRB in 2009, is currently designated by the Commission as the official repository of municipal securities disclosure providing the public with free access to relevant municipal securities data, and is the central database for information about municipal securities offerings, issuers, and obligors. Additionally, the MSRB’s Real-Time Transaction Reporting System (‘‘RTRS’’), with limited exceptions, requires broker-dealers and municipal securities dealers to submit transaction data to the MSRB within 15 minutes of trade execution, and such near real-time post-trade transaction data can be accessed through the MSRB’s EMMA website. Certain exempt clearing agencies (e.g., Euroclear and Clearstream) may provide CSD functions like covered clearing agencies while other exempt clearing agencies (e.g., DTCC ITP) may not provide such functions. Nonetheless, any entity that falls within the definition of a clearing agency centralizes technology functions in a manner that increases its potential to become a single point of failure in the case of a significant cybersecurity incident.72 The technology behind clearing agency information systems is subject to growing innovation and interconnectedness, with multiple clearing agencies sharing links among their systems and with the systems of other Market Entities. This growing interconnectivity means that a significant cybersecurity incident at a registered clearing agency could, for example, prevent it from acting timely to carry out its functions, which, in turn, could negatively impact other Market Entities that utilize the clearing agency’s services.73 Further, a significant cybersecurity incident at a registered or exempt clearing agency could provide a gateway for threat actors to attack the members of the clearing agency and other financial institutions that connect to it through information systems. Moreover, the information systems that link the clearing agency to its members are vectors that expose the clearing agency to cybersecurity risk. The records stored by clearing agencies on their information systems include proprietary information about their members, including confidential business information (e.g., information about the financial condition of the members used by the clearing agency to manage credit risk). Each clearing agency also is required to keep all records made or received by it in the course of its business and in the conduct of its self-regulatory activity. A significant cybersecurity incident at a clearing agency could lead to the improper use of this information to harm the members (e.g., public exposure of confidential financial information) or provide the unauthorized user with an unfair advantage over other market participants (e.g., trading based on confidential business information). Moreover, a
disruption to a registered clearing agency’s operations as a result of a significant cybersecurity incident could interfere with its ability to perform its responsibilities as an SRO (e.g., interrupting its oversight of clearing member activities for compliance with its rules and the federal securities laws), and, therefore, materially impact the fair, orderly, and efficient functioning of the U.S. securities markets. d. The Municipal Securities Rulemaking Board The MSRB is an SRO that serves as a regulator of the U.S. municipal securities market with a mandate to protect municipal securities investors, municipal entities, obligated persons, and the public interest.74 Pursuant to the Exchange Act, the MSRB shall propose and adopt rules with respect to transactions in municipal securities effected by broker-dealers and municipal securities dealers and with respect to advice provided to or on behalf of municipal entities or obligated persons by broker-dealers, municipal securities dealers, and municipal advisors with respect to municipal financial products, the issuance of municipal securities, and solicitations of municipal entities or obligated persons undertaken by broker-dealers, municipal securities dealers, and municipal advisors.75 Pursuant to the Exchange Act, the MSRB’s rules shall be designed to prevent fraudulent and manipulative acts and practices, to promote just and equitable principles of trade, to foster cooperation and coordination with persons engaged in regulating, clearing, settling, processing, information with respect to, and facilitating transactions in municipal securities and municipal financial products, to remove impediments to and perfect the mechanism of a free and open market in municipal securities and municipal products, and in general, to protect investors, municipal entities, obligated persons, and the public interest.76 As an SRO, the MSRB’s proposed rules are subject to Commission review and published for notice and comment. While certain types of proposed rules are effective upon filing, others are subject to Commission approval before they can go into effect. The MSRB relies on information systems to carry out its mission regulating broker-dealers, municipal securities dealers, and municipal advisors. For example, the MSRB operates the Electronic Municipal Market Access website (‘‘EMMA’’). EMMA provides transparency to the U.S. municipal bond market by disclosing free information on virtually all municipal bond offerings, including real-time trade prices, bond disclosure documents, and certain market statistics.77 The MSRB also provides data to the Commission, broker-dealer examining authorities, and banking supervisors to assist in their examination and enforcement efforts involving participants in the municipal securities markets. The MSRB also maintains other data on the U.S. municipal securities markets. This data can be used by the public and others to understand better these markets. The MSRB is also
required to keep all records made or received by it in the course of its business and in the conduct of its self-regulatory activity. A significant cybersecurity incident could disrupt the operation of EMMA and could negatively impact the fair, orderly, and efficient operation of the U.S. municipal securities market. For example, the loss or corruption of transparent price information could cause investors to stop purchasing or selling municipal securities or negatively impact the ability of investors to liquidate or purchase municipal securities at favorable or predictable prices or in a timely manner. In addition, the unauthorized access or use of personal or proprietary

78See 15 U.S.C. 78o–3(a); Exemption for Certain Exchange Members, Exchange Act Release No. 95388 (July 29, 2022) [87 FR 49930 (Aug. 12, 2022)] (proposing amendments to national securities association membership exemption for certain exchange members). 79See 15 U.S.C. 78o–3(b)(6). 80See 15 U.S.C. 78o–3(b)(7). 81FINRA members are subject to transaction reporting obligations under FINRA Rule 6730. This rule requires FINRA members to report transactions in TRACE-Eligible Securities, which the rule defines to include a range of fixed-income securities. 82 In addition, FINRA operates the Alternative Display Facility (‘‘ADF’’), which allows members to display quotations and report trades in NMS stocks. Although there are currently no users of the ADF, FINRA has issued a pre-quotation notice advising that a new participant intends to begin using the ADF, subject to regulatory approval. See Self￾Regulatory Organizations; Financial Industry Regulatory Authority, Inc.; Notice of Filing of a Proposed Rule Change Relating to Alternative Display Facility New Entrant, Exchange Act Release No. 96550 (Dec. 20, 2022) [87 FR 79401 (Dec. 27, 2022)]. 83 17 CFR 240.17d–2. Pursuant to a plan declared effective by the Commission under Rule 17d–2, the Commission relieves an SRO of those regulatory responsibilities allocated by the plan to another SRO. 84See, e.g., Program for Allocation of Regulatory Responsibilities Pursuant to Rule 17d–2; Notice of Filing and Order Approving and Declaring Effective an Amended Plan for the Allocation of Regulatory Responsibilities Between the Financial Industry Regulatory Authority, Inc. and MEMX LLC, Exchange Act Release No. 96101 (Oct. 18, 2022) [87 FR 64280 (Oct. 24, 2022)]. 85See, e.g., Program for Allocation of Regulatory Responsibilities Pursuant to Rule 17d–2; Notice of Filing and Order Approving and Declaring Effective an Amendment to the Plan for the Allocation of Regulatory Responsibilities Among Cboe BZX Exchange, Inc., Cboe BYX Exchange, Inc., NYSE Chicago, Inc., Cboe EDGA Exchange, Inc., Cboe EDGX Exchange, Inc., Financial Industry Regulatory Authority, Inc., MEMX LLC, MIAX PEARL, LLC, Nasdaq BX, Inc., Nasdaq PHLX LLC, The Nasdaq Stock Market LLC, NYSE National, Inc., New York Stock Exchange LLC, NYSE American LLC, NYSE Arca, Inc., Investors’ Exchange LLC, and Long-Term Stock Exchange, Inc. Relating to the Surveillance, Investigation, and Enforcement of Insider Trading Rules, Exchange Act Release No. 89972 (Sept. 23, 2020) [85 FR 61062 (Sept. 29, 2020)]. 86Further information about these filing systems is available at: https://www.finra.org/filing￾reporting/regulatory-filing-systems. 87The eFOCUS system provides firms with the capability to electronically submit their Financial and Operational Combined Uniform Single (FOCUS) Reports to FINRA. FINRA member broker￾dealers are required to prepare and submit FOCUS reports pursuant to Exchange Rule 17a–5 (17 CFR 240.17a–5) (‘‘Rule 17a–5’’) and FINRA’s FOCUS Report filing plan.
See, e.g., Self-Regulatory Organizations; Notice of Filing and Order Granting Accelerated Approval of Proposed Rule Change by the National Association of Securities Dealers, Inc. Relating to the Association’s FOCUS Filing Plan, Exchange Act Release No. 36780, (Jan. 26, 1996) [61 FR 3743 (Feb. 1, 1996)]. information of the persons who are registered with the MSRB could cause them harm through identity theft or the disclosure of confidential business information. Further, a significant cybersecurity incident impacting the MSRB could provide a gateway for threat actors to attack registrants that connect to the MRSB through information systems and networks of interconnected information systems. Moreover, the information systems that link the MSRB to its registrants are vectors that expose the MSRB to cybersecurity risk. e. National Securities Associations A national securities association is an SRO created to regulate broker-dealers and the off-exchange broker-dealer market.78 Currently, FINRA is the only national securities association registered under section 15A of the Exchange Act. As a national securities association, FINRA must have rules for its members that, among other things, are designed to prevent fraudulent and manipulative acts and practices, to promote just and equitable principles of trade, to foster cooperation and coordination with persons engaged in regulating, clearing, settling, or processing information with respect to (and facilitating transactions in) securities, to remove impediments to and perfect the mechanism of a free and open market and a national market system, and, in general, to protect investors and the public interest.79 FINRA’s rules also must provide for discipline of its members for violations of any provision of the Exchange Act, Exchange Act rules, the rules of the MSRB, or its own rules.80 A national securities association is an SRO under
section 19 of the Exchange Act, and its
proposed rules are subject to Commission review and are published for notice and comment. While certain types of proposed FINRA rules are effective upon filing, others are subject to Commission approval before they can go into effect. FINRA also performs other functions of vital importance to the U.S. securities markets. It developed and operates the Trade Reporting and Compliance Engine (‘‘TRACE’’), which facilitates the mandatory reporting of over-the-counter transactions in eligible fixed-income securities.81 In addition, FINRA operates the Trade Reporting Facility (‘‘TRF’’). FINRA members report over￾the-counter transactions in national market system (‘‘NMS’’) stocks to the TRF, which are then included in publicly disseminated consolidated equity market data pursuant to an NMS plan.82 Further, pursuant to plans declared effective by the Commission under Exchange Act Rule 17d–2 (‘‘Rule 17d–2’’),83 FINRA frequently acts as the sole SRO with regulatory responsibility with respect to certain applicable laws, rules, and regulations for its members that are also members of other SROs (e.g., national securities exchanges).84 Some of these Rule 17d–2 plans facilitate the conduct of market-wide surveillance, including for insider trading.85 The disruption of these FINRA activities by a significant cybersecurity incident could interfere with its ability to carry out its regulatory responsibilities (e.g., disclosing confidential information pertaining to its surveillance of trading activity), and, therefore, materially impact the fair, orderly, and efficient functioning of the U.S. securities markets. FINRA uses other information systems to perform its responsibilities as an SRO. For example, it operates a number of information systems that its members use to make regulatory filings.86 These systems include the FINRA’s eFOCUS system through which its broker-dealer members file periodic (monthly or quarterly) confidential financial and operational reports.87 FINRA Gateway is another information system that it uses as a compliance portal for its members to file and access information. A disruption of FINRA’s business operations caused by a significant cybersecurity incident could disrupt its ability to carry out its responsibilities as an SRO (e.g., by disrupting its oversight of broker-dealer activities for compliance with its rules and the federal securities laws or its review of broker-dealers’ financial condition), and could therefore materially impact the fair, orderly, and efficient functioning of the U.S. securities markets. Further, a significant cybersecurity incident at FINRA could provide a gateway for threat actors to attack members that connect to it through information systems and networks of interconnected information systems. Moreover, the information systems that link FINRA to its members are vectors that expose FINRA to cybersecurity risk. Additionally, the records stored by FINRA on its information systems include proprietary
information about its members, including confidential business information (e.g., information about the operational and financial condition of its broker-dealer members) and confidential personal information about registered persons affiliated with member firms. FINRA also is required to keep all records made or received by it in the course of its business and in the conduct of its self-regulatory activity. A significant cybersecurity incident at FINRA could lead to the improper use of this information to harm the members

88See 15 U.S.C. 78c(a)(1). Exchange Act Rule 3b– 16 (‘‘Rule 3b–16’’) defines terms used in the statutory definition of ‘‘exchange’’ under section 3(a)(1) of the Exchange Act. Under paragraph (a) of Rule 3b–16, an organization, association, or group of persons is considered to constitute, maintain, or provide such a marketplace or facilities if they ‘‘[b]ring[ ] together the orders for securities of multiple buyers and sellers’’ and use ‘‘established non-discretionary methods (whether by providing a trading facility or by setting rules) under which such orders interact with each other, and the buyers and sellers entering such orders agree to the terms of a trade.’’ See 17 CFR 240.3b–16(a). In January 2022, the Commission: (1) proposed amendments to Rule 3b–16 to include systems that offer the use of non-firm trading interest and provide communication protocols to bring together buyers and sellers of securities; (2) re-proposed amendments to Regulation ATS for ATSs that trade government securities or repurchase and reverse repurchase agreements on government securities; (3) re-proposed amendments to Regulation SCI to apply to ATSs that meet certain volume thresholds in U.S. Treasury securities or in a debt security issued or guaranteed by a U.S. executive agency or government-sponsored enterprise; and (4) proposed amendments to, among other things, Form ATS–N, Form ATS–R, Form ATS, and the fair access rule under Regulation ATS. See Amendments Regarding the Definition of ‘‘Exchange’’ and Alternative Trading Systems (ATSs) That Trade U.S. Treasury and Agency Securities, National Market System (NMS) Stocks, and Other Securities, Exchange Act Release No. 94062 (Jan. 26, 2022) [87 FR 15496 (Mar. 18, 2022)] (‘‘Amendments Regarding the Definition of ‘Exchange’ and ATSs Release’’). The Commission encourages commenters to review that proposal with respect to ATSs and the comments on that proposal to determine whether they might affect comments on this proposing release. 89 15 U.S.C. 78e. 90See, e.g., 15 U.S.C. 78f and 78s. 91See 15 U.S.C. 78f(b)(5). 92See 15 U.S.C. 78s. 93The national securities exchanges will provide quotation, trade reporting, and regulatory information to competing consolidators and self￾aggregators after the market data infrastructure rules have been implemented. See Market Data Infrastructure, Exchange Act Release No. 90610 (Dec. 9, 2020) [86 FR 18596 (Apr. 9, 2021)] (‘‘MDI Adopting Release’’). In July 2012, the Commission adopted Rule 613 of Regulation NMS, which required national securities exchanges and national securities associations (the ‘‘Participants’’) to jointly develop and submit to the Commission a national market system plan to create, implement, and maintain a consolidated audit trail (the ‘‘CAT’’). See Consolidated Audit Trail, Exchange Act Release No. 67457 (July 18, 2012) [77 FR 45722 (Aug. 1, 2012)]; 17 CFR 242.613. In November 2016, the Commission approved the national market system plan required by Rule 613 (the
‘‘CAT NMS Plan’’). See Joint Industry Plan; Order Approving the National Market System Plan Governing the Consolidated Audit Trail, Exchange Act Release No. 78318 (Nov. 15, 2016) [81 FR 84696 (Nov. 23, 2016)] (the ‘‘CAT NMS Plan Approval Order’’). The Participants conduct the activities related to the CAT in a Delaware limited liability company, Consolidated Audit Trail, LLC (the ‘‘Company’’). The Participants jointly own on an equal basis the Company. As such, the CAT’s Central Repository is a facility of each of the Participants. See CAT NMS Plan Approval Order, 81 FR at 84758. It would also qualify as an ‘‘information system’’ of each national securities exchange and each national securities association under proposed Rule 10. FINRA CAT, LLC—a wholly-owned subsidiary of FINRA—has entered into an agreement with the Company to act as the plan processor for the CAT. However, because the CAT System is operated by FINRA CAT, LLC on behalf of the national securities exchanges and FINRA, the Participants remain ultimately responsible for the performance of the CAT and its compliance with any statutes, rules, and regulations. The goal of the CAT NMS Plan is to create a modernized audit trail system that provides regulators with more timely access to a more comprehensive set of trading data, thus enabling regulators to more efficiently and effectively analyze and reconstruct broad-based market events, conduct market analysis in support of regulatory decisions, and to conduct market surveillance, investigations, and other enforcement activities. The CAT accepts data that are submitted by the Participants and broker-dealers, as well as data from certain market data feeds like SIP and OPRA. 94See, e.g., New Zealand FMA Report (describing an August 2020 cybersecurity incident at New Zealand’s only regulated financial product market that caused a trading halt of approximately four days). (e.g., public exposure of confidential financial information) or their registered persons (e.g., public exposure of personal information). Further, it could provide the unauthorized user with an unfair advantage over other market participants (e.g., trading based on confidential financial information about its members). f. National Securities Exchanges Under the Exchange Act, an ‘‘exchange’’ is any organization, association, or group of persons, whether incorporated or unincorporated, that constitutes, maintains, or provides a market place or facilities for bringing together purchasers and sellers of securities or for otherwise performing with respect to securities the functions commonly performed by a stock exchange (as that term is generally understood), and includes the market place and the market facilities maintained by that exchange.88 Section 5 of the Exchange Act 89 requires an organization, association, or group of persons that meets the definition of ‘‘exchange’’ under section 3(a)(1) of the Exchange Act, unless otherwise exempt, to register with the Commission as
a national securities exchange pursuant to section 6 of the Exchange Act. Registered national securities exchanges also are SROs, and must comply with regulatory requirements applicable to both national securities exchanges and SROs.90
Section 6 of the Exchange Act requires,
among other things, that the rules of a national securities exchange be designed to prevent fraudulent and manipulative acts and practices; to promote just and equitable principles of trade; to foster cooperation and coordination with persons engaged in facilitating transactions in securities; to remove impediments to, and perfect the mechanism of, a free and open market and a national market system; and, in general, to protect investors and the public interest; and that the rules of a national securities exchange not be designed to permit unfair discrimination between customers, issuers, brokers, or dealers.91 As SROs under section 19 of the Exchange Act, the proposed rules of national securities exchanges are subject to Commission review and are published for notice and comment.92 While certain types of proposed exchange rules are effective upon filing, others are subject to Commission approval before they can go into effect. National securities exchanges use information systems to operate their marketplaces and facilities for bringing together purchasers and sellers of securities. In particular, national securities exchanges rely on automated, complex, and interconnected information systems for trading, routing, market data, regulatory, and surveillance purposes. They also use information systems to connect to members, other national securities exchanges, plan processors, and clearing agencies to facilitate order routing, trading, trade reporting, and the clearing of securities transactions. They also provide quotation, trade reporting, and regulatory information to the securities information processors to ensure that current market data information is available to market participants.93 A significant cyber security incident at a national securities exchange could disrupt or disable its ability to provide these market functions, causing broader disruptions to the securities markets.94 For example, a significant cyber security incident could severely impede the ability to trade securities, or could disrupt the public dissemination of consolidated market data, impacting investors and the maintenance of fair, orderly, and efficient markets. In addition, the information systems that link national securities exchanges to their members are vectors that expose the exchange to cybersecurity risk. Similarly, proprietary market data systems of exchanges are widely used and relied upon by a wide swath of market participants for detailed information about quoting and trading activity on an exchange. A significant cybersecurity incident that disrupts the availability or integrity of these feeds could have a significant impact on the trading of securities because market participants may withdraw from trading without access to current quotation and trade information. This could interfere with the maintenance of fair, orderly, and efficient markets. National securities exchanges also use information systems to perform their

95For example, as discussed above, the national securities exchanges and FINRA jointly operate the CAT System, which collects and stores information relating market participants, and their order and trading activities. 96Public Law 111–203, 124 Stat. 1376 (2010),
section 761(a) (adding Exchange Act section
3(a)(75) (defining SBSDR)) and section 763(i) (adding Exchange Act section 13(n) (establishing a regulatory regime for SBSDRs)). 97See Security-Based Swap Data Repository Registration, Duties, and Core Principles, Exchange Act Release No. 74246 (Feb. 11, 2015) [80 FR 14438 (Mar. 19, 2015)] (‘‘SBSDR Adopting Release’’); Regulation SBSR—Reporting and Dissemination of Security-Based Swap Information, Exchange Act Release No. 74244 (Feb. 11, 2015) [80 FR 14563 (Mar. 19, 2015)] (‘‘SBSR Adopting Release’’). 98See 17 CFR 242.909 (‘‘A registered security￾based swap data repository shall also register with the Commission as a securities information processor on Form SDR’’); see also Form SDR (‘‘With respect to an applicant for registration as a security-based swap data repository, Form SDR also constitutes an application for registration as a securities information processor.’’). 99See, e.g., SBSDR Adopting Release, 80 FR at 14604. 100See Security-Based Swap Data Repository Registration, Duties, and Core Principles, Exchange Act Release No. 63347 (Nov. 19, 2010) [75 FR 77306, 77307 (Dec. 10, 2010)], corrected at 75 FR 79320 (Dec. 20, 2010) and 76 FR 2287 (Jan. 13,
2011) (‘‘SBSDR Proposing Release’’) (‘‘The data
maintained by an [SBSDR] may also assist regulators in (i) preventing market manipulation, fraud, and other market abuses; (ii) performing market surveillance, prudential supervision, and macroprudential (systemic risk) supervision; and (iii) resolving issues and positions after an institution fails.’’). 101See SBSDR Proposing Release at 77307. 102See SBSDR Adopting Release, 80 FR at 14440 (stating that ‘‘[SBSDRs] are required to collect and maintain accurate [security-based swap] transaction data so that relevant authorities can access and analyze the data from secure, central locations, thereby putting them in a better position to monitor for potential market abuse and risks to financial stability.’’). 103See Committee on Payments and Settlement Systems (‘‘CPSS’’), Technical Committee of IOSCO, Principles for financial markets intermediaries (Apr. 2012), available at https://www.bis.org/cpmi/ publ/d101a.pdf (‘‘FMI Principles’’) (Principle for financial markets intermediaries (‘‘PFMI’’) 1.14 stating that ‘‘[b]y centralising the collection, storage, and dissemination of data, a well-designed [trade repository (‘‘TR’’)] that operates with effective risk controls can serve an important role in enhancing the transparency of transaction information to relevant authorities and the public, promoting financial stability, and supporting the detection and prevention of market abuse.’’). In 2014, the CPSS became the Committee on Payments and Market Infrastructures (‘‘CPMI’’). 104See SBSDR Adopting Release, 80 FR at 14450 (‘‘[SBSDRs] themselves are subject to certain operational risks that may impede the ability of [SBSDRs] to meet these goals, and the Title VII regulatory framework is intended to address these risks.’’). 105See FMI Principles (PFMI 1.14, Box 1 stating that ‘‘[t]he primary public policy benefits of a TR, which stem from the centralisation and quality of the data that a TR maintains, are improved market transparency and the provision of this data to relevant authorities and the public in line with their respective information needs. Timely and reliable access to data stored in a TR has the potential to improve significantly the ability of relevant authorities and the public to identify and evaluate the potential risks posed to the broader financial system.’’). responsibilities as SROs. In particular, exchanges employ market-regulation systems to assist with obligations such as enforcing their rules and the federal securities laws with respect to their members. A disruption of a national securities exchange’s business operations caused by a significant cybersecurity incident could disrupt its ability to carry out its regulatory responsibilities as an SRO and, therefore, materially impact the fair, orderly, and efficient functioning of the U.S. securities markets. Each exchange also is required to keep all records made or received by it in the course of its business and in the conduct of its self-regulatory activity. The records stored by
national securities exchanges on their information systems include proprietary information about their members, including confidential business information (e.g., information about the financial condition of their members). The records also include information relating to trading, routing, market data, and market surveillance, among other areas.95 A significant cybersecurity incident at a national securities exchange could lead to the improper use of this information to harm exchange members (e.g., public exposure of confidential financial information) or provide the unauthorized user with an unfair advantage over other market participants (e.g., trading based on confidential business information). g. Security-Based Swap Data Repositories Title VII of the Dodd-Frank Wall Street Reform and Consumer Protection Act (‘‘Title VII of the Dodd-Frank Act’’), enacted in 2010, provided for a comprehensive, new regulatory framework for swaps and security-based swaps, including regulatory reporting and public dissemination of transactions in security-based swaps.96 In 2015, the Commission established a regulatory framework for SBSDRs to provide improved transparency to regulators and help facilitate price discovery and efficiency in the SBS market.97 Under this framework, SBSDRs are registered securities information processors and disseminators of market data in the security-based swap market,98 thereby supporting the Dodd-Frank Act’s goal of public dissemination for all security￾based swaps to enhance price discovery to market participants.99 The collection and dissemination of security-based swap data by SBSDRs provide transparency in the security-based swap market for regulators and market participants. In addition, as centralized repositories for security-based swap transaction data that is used by regulators, SBSDRs provide an important infrastructure assisting relevant authorities in performing their market oversight.100 Data maintained by SBSDRs can assist regulators in addressing market abuses, performing supervision, and resolving issues and positions if an institution fails.101 SBSDRs are required to collect and maintain accurate security-based swap transaction data so that relevant authorities can access and analyze the data from secure, central locations, thereby putting the regulators in a better position to monitor for potential market abuse and risks to financial stability.102 SBSDRs also have the potential to reduce operational risk and enhance operational efficiency, such as by maintaining transaction records that would help counterparties to ensure that their records reconcile on all of the key economic details. SBSDRs use information systems to perform these functions, including to disseminate market data and provide price transparency in the security-based swap market. They also use information systems to operate centralized repositories for security-based swap data for use by regulators. These information systems provide an important
market infrastructure that assists relevant authorities in performing their market oversight.103 As discussed above, data maintained by SBSDRs may, for example, assist regulators in addressing market abuses, performing supervision, and resolving issues and positions if an institution fails. SBSDRs are subject to certain cybersecurity risks that if realized could impede their ability to meet the goals set out in Title VII of the Dodd-Frank Act and the Commission’s rules.104 For example, SBSDRs process and disseminate trade data using information systems. If these information systems suffer from a significant cybersecurity incident, public access to timely and reliable trade data for the derivatives markets could potentially be compromised.105 Also, if the data stored at an SBSDR is corrupted by a threat actor through a cybersecurity attack, the SBSDR would not be able to provide accurate data to relevant regulatory authorities, which could hinder the oversight of the derivatives markets. Moreover, SBSDRs

106See FMI Principles (PFMI at 3.20.20 stating that ‘‘[a] TR should carefully assess the additional operational risks related to its links to ensure the scalability and reliability of IT and related resources. A TR can establish links with another TR or with another type of FMI. Such links may expose the linked [financial market infrastructures (‘‘FMIs’’)] to additional risks if not properly designed. Besides legal risks, a link to either another TR or to another type of FMI may involve the potential spillover of operational risk. The mitigation of operational risk is particularly important because the information maintained by a TR can support bilateral netting and be used to provide services directly to market participants, service providers (for example, portfolio compression service providers), and other linked FMIs.’’). The CPMI and IOSCO issued guidance for cyber resilience for FMIs, including CSDs, securities settlement systems (‘‘SSSs’’), CCPs, and trade repositories. See CPMI–IOSCO, Guidance on cyber resilience for financial market infrastructures (June 2016), available at https://www.iosco.org/ library/pubdocs/pdf/IOSCOPD535.pdf; see also CPMI–IOSCO, Implementation monitoring of the PFMI: Level 3 assessment on Financial Market Infrastructures’ Cyber Resilience (Nov. 2022), available at https://www.iosco.org/library/pubdocs/ pdf/IOSCOPD723.pdf (presenting the results of an assessment of the state of cyber resilience (as of February 2021) of FMIs from 29 jurisdictions that participated in the exercise in 2020 to 2022). 107See 15 U.S.C. 78c(a)(71); 17 CFR 240.3a71–1 et seq. 108See 15 U.S.C. 78c(a)(71)(C); 17 CFR 240.3a71– 1(b). 109See 15 U.S.C. 78c(a)(67); 17 CFR 240.3a67–1 et seq. 110Currently, this role is fulfilled by SBSDs, given there are no MSBSPs registered with the Commission. 111See Further Definition of ‘‘Swap Dealer,’’ ‘‘Security-Based Swap Dealer,’’ ‘‘Major Swap Participant,’’ ‘‘Major Security-Based Swap Participant’’ and ‘‘Eligible Contract Participant’’, Exchange Act Release No. 66868 (Apr. 27, 2012) [77 FR 30596, 30616–17 (May 23, 2012)] (‘‘Further Definition Release’’) (noting that ‘‘[i]n contrast to a secondary market transaction involving equity or debt securities, in which the completion of a purchase or sale transaction can be expected to terminate the mutual obligations of the parties to the transaction, the parties to a security-based swap often will have an ongoing obligation to exchange cash flows over the life of the agreement’’). 112See Cross-Border Security-Based Swap Activities; Re-Proposal of Regulation SBSR and Certain Rules and Forms Relating to the Registration of Security-Based Swap Dealers and Major Security-Based Swap Participants, Exchange Act Release No. 69490 (May 1, 2013) [78 FR 30967, 30980–81 (May 23, 2013)] (‘‘Cross-Border Proposing Release’’). 113See, e.g., Commission, Report on Security￾Based Swaps Pursuant to Section 13(m)(2) of the Securities Exchange Act of 1934 (July 15, 2022) available at
https://www.sec.gov/files/report-on￾security-based-swaps-071522.pdf. 114See Cross-Border Proposing Release, 78 FR at 30972 (‘‘The Dodd-Frank Act was enacted, among other reasons, to promote the financial stability of the United States by improving accountability and transparency in the financial system. The 2008 financial crisis highlighted significant issues in the over-the-counter (‘OTC’) derivatives markets, which . . . are capable of affecting significant sectors of the U.S. economy.’’) (footnotes omitted). use information systems to receive and maintain personal, confidential, and proprietary information and data. The unauthorized use or access of this information could be used to create unfair business or trading advantages and, in the case of personal information, to steal identities. Further, a significant cybersecurity incident at an SBSDR could provide a gateway for threat actors to attack Market Entities and others that connect to it through information systems. Moreover, the links established between an SBSDR and other entities, including unaffiliated clearing agencies and other SBSDRs, are vectors that expose the SBSDR to cybersecurity risk arising from threats that originate in information systems outside the SBSDR’s control.106 h. SBS Entities The SBS Entities covered by the proposed rulemaking are SBSDs and MSBSPs. An SBSD generally refers to any person who: (1) holds itself out as a dealer in security-based swaps; (2) makes a market in security-based swaps; (3) regularly enters into security-based swaps with counterparties as an ordinary course of business for its own account; or (4) engages in any activity causing it to be commonly known in the trade as a dealer or market maker in security-based swaps.107 An SBSD does not, however, include a person that enters into security-based swaps for such person’s own account, either individually or in a fiduciary capacity, but not as a part of regular business.108 An MSBSP generally includes any person that is not a security-based swap dealer and that satisfies one of the following three alternative statutory tests: (1) it maintains a ‘‘substantial position’’ in security-based swaps, excluding positions held for hedging or mitigating commercial risk and positions maintained by any employee benefit plan (or any contract held by such a plan) for the primary purpose of hedging or mitigating any risk directly associated with the operation of the plan, for any of the major security-based swap categories determined by the Commission; (2) its outstanding security-based swaps create substantial counterparty exposure that could have serious adverse effects on the financial stability of the U.S. banking system or financial markets; or (3) it is a ‘‘financial entity’’ that is ‘‘highly leveraged’’ relative to the amount of capital it holds (and that is not subject to capital requirements by an appropriate federal banking agency) and maintains a ‘‘substantial position’’ in outstanding security-based
swaps in any major category as determined by the Commission.109 Currently, there are no MSBSPs registered with the Commission. SBS Entities play (or, in the case of MSBSPs, could play) a critical role in the U.S. security-based swap market.110 SBS Entities rely on information systems to transact in security-based swaps with other market participants, to receive and deliver collateral, to create and maintain books and records, and to obtain market information to update books and records, and manage risk. A disruption to an SBS Entity’s operations caused by a significant cybersecurity incident could have a large negative impact on the U.S. security-based swap market given the concentration of dealers in this market. Further, a disruption in the security￾based swap market could negatively impact the broader securities markets by, for example, causing participants to liquidate positions related to, or referenced by, the impacted security￾based swaps to mitigate losses to participants’ positions or portfolios or due to loss of trading confidence. A disruption in the security-based swap market also could negatively impact the broader securities markets by causing participants to liquidate the collateral margining the security-based swaps for similar reasons or to cover margin calls. The consequences of a business disruption to an SBS Entity’s functions—such as those that may be caused by a significant cybersecurity incident—may be amplified because, unlike many other securities transactions, securities-based swap transactions give rise to an ongoing obligation between transaction counterparties during the life of the transaction.111 This means that each counterparty bears the risk of its counterparty’s ability to perform under the terms of a security-based swap until the transaction is terminated. A disruption of an SBS Entity’s normal business activities because of a significant cybersecurity incident could produce spillover or contagion by negatively affecting the willingness or the ability of market participants to extend credit to each other, and could substantially reduce liquidity and valuations for particular types of financial instruments.112 The security￾based swap market is large 113 and thus a disruption of an SBS Entity’s operations due to a significant cybersecurity incident could negatively impact sectors of the U.S. economy.114 Further, a significant cybersecurity incident at an SBS Entity could provide a gateway for threat actors to attack the exchanges, SBSDRs, clearing agencies, counterparties, and other SBS Entities to

115See Transfer Agent Regulations, Exchange Act Release No. 76743 (Dec. 22, 2015) [80 FR 81948, 81949 (Dec. 31, 2015)]. 116See section I.A. of this release (discussing cybersecurity risk and how critical operations of Market Entities are exposed to cybersecurity risk). 117 In designing the requirements of proposed Rule 10, the Commission considered several cybersecurity sources (which are cited in the relevant sections below), including the NIST Framework, the NIST Glossary, and CISA’s Cyber Essentials Starter Kit (information about CISA’s Cyber Essentials Starter Kit is available at: https:// www.cisa.gov/publication/cisa-cyber-essentials). The Commission also considered definitions in relevant federal statutes including the Federal Information Security Modernization Act of 2014, Public Law 113–283 (Dec. 18, 2014); 44 U.S.C. 3551 et seq. (‘‘FISMA’’) and the Cyber Incident Reporting for Critical Infrastructure Act of 2022, H.R. 2471, 117th Cong. (2021–2022); 6 U.S.C. 681 et seq. (‘‘CIRCIA’’). 118The following broker-dealers would be Covered Entities: (1) broker-dealers that maintain custody of securities and cash for customers or other broker-dealers (‘‘carrying broker-dealers’’); (2) broker-dealers that introduce their customer accounts to a carrying broker-dealer on a fully disclosed basis (‘‘introducing broker-dealers’’); (3) broker-dealers with regulatory capital equal to or which the firm is connected through information systems and networks of interconnected information systems. Moreover, the information systems that link SBS Entities to other Market Entities are vectors that expose the SBS Entity to cybersecurity risk arising from threats that originate in information systems outside the SBS Entity’s control. SBS Entities also store proprietary and confidential information about their counterparties on their information systems, including financial information they use to perform credit analysis. A significant cybersecurity incident at an SBS Entity could lead to the improper use of this information to harm the counterparties (e.g., public exposure of confidential financial information) or provide the unauthorized user with an unfair advantage over other market participants (e.g., trading based on confidential business information).
i. Transfer Agents
A transfer agent is any person who engages on behalf of an issuer of securities or on behalf of itself as an issuer of securities in (among other functions): (1) tracking, recording, and maintaining the official record of ownership of each issuer’s securities; (2) canceling old certificates, issuing new ones, and performing other processing and recordkeeping functions that facilitate the issuance, cancellation, and transfer of those securities; (3) facilitating communications between issuers and registered securityholders; and (4) making dividend, principal, interest, and other distributions to securityholders.115 To perform these functions, transfer agents maintain records and information related to securityholders that may include names, addresses, phone numbers, email addresses, employers, employment history, bank and specific account information, credit card information, transaction histories, securities holdings, and other detailed and individualized information related to the transfer agents’ recordkeeping and transaction processing on behalf of issuers. With advances in technology and the expansion of book-entry ownership of securities, transfer agents today increasingly rely on technology and automation to perform the core recordkeeping, processing, and transfer services described above, including the use of computer systems to store, access, and process the information related to securityholders they maintain on behalf of issuers. A significant cybersecurity incident that impacts these systems could cause harm to investors by, for example, preventing the transfer agent from transferring ownership of securities or preventing investors from receiving dividend, interest, or principal payments. Further, a significant cybersecurity incident at a transfer agent could provide a gateway for threat actors to attack other Market Entities that connect to it through information systems and networks of interconnected information systems. Moreover, the information systems that link transfer agents to other Market Entities expose the transfer agent to cybersecurity risk arising from threats that originate in information systems outside the transfer agent’s control. The records stored by transfer agents on their information systems include proprietary information about securities ownership and corporate actions. A significant cybersecurity incident at a transfer agent could lead to the improper use of this information to harm securities holders (e.g., public exposure of their confidential financial information or the use of that information to steal their identities) or provide the unauthorized user with an unfair advantage over other market participants (e.g., trading based on confidential business information). B. Overview of the Proposed Cybersecurity Requirements As discussed above, the U.S. securities markets are part of the critical infrastructure of the United States.116 In this regard, they play a central role in the U.S. economy in terms of
facilitating the flow of capital, including the savings of individual investors. The fair, orderly, and efficient operation of the U.S. securities markets depends on Market Entities being able to perform their critical functions, and Market Entities are increasingly relying on information systems and interconnected networks of information systems to perform these functions. These information systems are targets of threat actors. Moreover, Market Entities—as financial institutions—are choice targets for threat actors seeking financial gain or to inflict economic harm. Further, threat actors are using increasingly sophisticated and constantly evolving tactics, techniques, and procedures to attack information systems. In addition to threat actors, cybersecurity risk also can be caused by the errors of employees, service providers, or business partners. The interconnectedness of Market Entities increases the risk that a significant cybersecurity incident can simultaneously impact multiple Market Entities causing harm to the U.S. securities markets. For these reasons, it is critically important that Market Entities take steps to protect their information systems and the information residing on those systems from cybersecurity risk. A Market Entity that fails to do so is more vulnerable to succumbing to a significant cybersecurity incident. As discussed above, a significant cybersecurity incident can cause serious harm not only to the Market Entity but also to its customers, counterparties, members, registrants, or users, or to any other market participants (including other Market Entities) that interact with the Market Entity. Therefore, it is vital to the U.S. securities markets and the participants in those markets that all Market Entities address cybersecurity risk, which, as discussed above, is increasingly threatening the financial sector. Consequently, the Commission is proposing new Rule 10 and new Form SCIR to require that Market Entities address cybersecurity risks, to improve the Commission’s ability to obtain information about significant cybersecurity incidents impacting Market Entities, and to improve transparency about the cybersecurity risks that can cause adverse impacts to the U.S. securities markets.117 Under proposed Rule 10, certain broker￾dealers, the MSRB, and all clearing agencies, national securities associations, national securities exchanges, SBSDRs, SBS Entities, and transfer agents would be defined as a ‘‘covered entity’’ (collectively, ‘‘Covered Entities’’).118

exceeding $50 million; (4) broker-dealers with total assets equal to or exceeding $1 billion; (5) broker￾dealers that operate as market makers; and (6) broker-dealers that operate an ATS (sometimes collectively referred to as ‘‘Covered Broker￾Dealers’’). Broker-dealers that do not fall into one of these six categories (sometimes collectively referred to as ‘‘Non-Covered Entities’’ or ‘‘Non￾Covered Broker-Dealers’’) would not be Covered Entities for the purposes of proposed Rule 10. See also section II.A.1.b. of this release (discussing the categories of broker-dealers that would be ‘‘Covered Entities’’ in greater detail). 119See paragraphs (b) through (d) of proposed Rule 10 (setting forth the requirements for Market Entities that meet the definition of ‘‘covered entity’’); paragraph (e)(1) of proposed Rule 10 (setting forth the requirements for Market Entities that are not Covered Entities (i.e., Non-Covered Broker-Dealers)). See also sections II.B.1. and II.C. of this release (discussing these proposed requirements in more detail). As discussed in sections II.F. and IV.C.1.b. of this release, certain categories of Market Entities are subject to existing requirements to address aspects of cybersecurity risk or that may relate to cybersecurity. These other requirements, however, do not address cybersecurity risk as directly, broadly, or comprehensively as the requirements of proposed Rule 10. 120See paragraph (b)(2) of proposed Rule 10; paragraph (e)(1) of proposed Rule 10. See also sections II.B.1.f. and II.C. of this release (discussing these proposed requirements in more detail). 121See CISA Cyber Essentials Starter Kit (‘‘Ask yourself what type of impact would be catastrophic to your operations? What information if compromised or breached would cause damage to employees, customers, or business partners? What is your level of risk appetite and risk tolerance? Raising the level of awareness helps reinforce the culture of making informed decisions and understanding the level of risk to the organization.’’). 122See paragraph (c)(1) of proposed Rule 10; paragraph (e)(2) of proposed Rule 10. See also sections II.B.2.a. and II.C. of this release (discussing these proposed requirements in more detail). 123Compare paragraphs (b) through (d) of proposed Rule 10 (setting forth the requirements for Covered Entities), with paragraph (e) of proposed Rule 10 (setting forth the requirements for Non￾Covered Entities). 124See sections II.B.1.a. through II.B.1.e. of this release (discussing these proposed requirements in more detail). In the case of Non-Covered Entities, as discussed in more detail below in section II.C. of this release, the design of the cybersecurity risk management policies and procedures would need to take into account the size, business, and operations of the broker-dealer. See paragraph (e) of proposed Rule 10. 125See sections II.B.2. and II.B.4. of this release (discussing these proposed requirements in more detail). 126See sections
II.B.3. and II.B.4.of this release (discussing these proposed requirements in more detail). 127See sections II.B.5. and II.C. of this release (discussing these proposed requirements in more detail). 128See sections II.D. of this release (discussing these proposed amendments in more detail). 129See paragraph (a) of proposed Rule 10. Proposed Rule 10 would require all Market Entities (Covered Entities and Non-Covered Entities) to establish, maintain, and enforce written policies and procedures that are reasonably designed to address their cybersecurity risks.119 All Market Entities also, at least annually, would be required to review and assess the design and effectiveness of their cybersecurity policies and procedures, including whether the policies and procedures reflect changes in cybersecurity risk over the time period covered by the review.120 They also would be required to prepare a report (in the case of Covered Entities) and a record (in the case of Non￾Covered Entities) with respect to the annual review. CISA states that organizations should ‘‘approach cyber as business risk.’’ 121 Like other business risks (e.g., market, credit, or liquidity risk), cybersecurity risk can be addressed through policies and procedures that are reasonably designed to manage the risk. Finally, all Market Entities would need to give the Commission immediate written electronic notice of a significant cybersecurity incident upon having a reasonable basis to conclude that the significant cybersecurity incident has occurred or is occurring.122 Market Entities that meet the definition of ‘‘covered entity’’ would be subject to certain additional requirements under proposed Rule
10.123 First, as discussed in more detail
below, the written policies and procedures that Covered Entities would need to establish, maintain, and enforce would need to include the following elements:

• Periodic assessments of
  cybersecurity risks associated with the Covered Entity’s information systems and written documentation of the risk assessments;
• Controls designed to minimize user￾related risks and prevent unauthorized
  access to the Covered Entity’s information systems;
• Measures designed to monitor the
  Covered Entity’s information systems and protect the Covered Entity’s information from unauthorized access or use, and oversee service providers that receive, maintain, or process information, or are otherwise permitted to access the Covered Entity’s information systems;
• Measures to detect, mitigate, and
  remediate any cybersecurity threats and vulnerabilities with respect to the Covered Entity’s information systems; and
• Measures to detect, respond to, and
  recover from a cybersecurity incident and written documentation of any cybersecurity incident and the response to and recovery from the incident.124 Second, Covered Entities—in addition to providing the Commission with immediate written electronic notice of a significant cybersecurity incident— would need to report and update information about the significant cybersecurity incident by filing Part I of proposed Form SCIR with the Commission.125 The form would elicit information about the significant cybersecurity incident and the Covered Entity’s efforts to respond to, and recover from, the incident. Third, Covered Entities would need to disclose publicly summary descriptions of their cybersecurity risks and the significant cybersecurity incidents they experienced during the current or previous calendar year on Part II of proposed Form SCIR.126 The form would need to be filed with the Commission and posted on the Covered Entity’s business internet website. Covered Entities that are carrying or introducing broker-dealers also would need to provide the form to customers at account opening, when information on the form is updated, and annually. Covered Entities and Non-Covered Entities would need to preserve certain records relating to the requirements of proposed Rule 10 in accordance with amended or existing recordkeeping requirements applicable to them or, in the case of exempt clearing agencies, pursuant to conditions in relevant exemption orders.127 Finally, the Commission is proposing amendments to address the potential availability of substituted compliance to non-U.S. SBS Entities with respect to the proposed cybersecurity requirements.128 In developing the proposed requirements summarized above with regard to SBSDRs and SBS Entities, the Commission consulted and coordinated with the CFTC and the prudential regulators in accordance with section 712(a)(2) of Title VII of the Dodd-Frank Act. In accordance with section 752 of Title VII of the Dodd-Frank Act, the Commission has consulted and coordinated with foreign regulatory authorities through Commission staff participation in numerous bilateral and multilateral discussions with foreign regulatory authorities addressing the regulation of OTC derivatives markets.
  II. Discussion of Proposed
  Cybersecurity Rule
  A. Definitions
  Proposed Rule 10 would define a number of terms for the purposes of its requirements.129 These definitions also would be used for the purposes of Parts

130See sections II.B.2. and II.B.3. of this release (discussing Parts I and II of proposed Form SCIR in more detail). 131See paragraphs (a)(2) through (9) of proposed Rule 10 (defining, respectively, the terms ‘‘cybersecurity incident,’’ ‘‘cybersecurity risk,’’ ‘‘cybersecurity threat,’’ ‘‘cybersecurity vulnerability,’’ ‘‘information,’’ ‘‘information systems,’’ ‘‘personal information,’’ and ‘‘significant cybersecurity incident’’). 132See paragraphs (a)(1)(i) through (ix) of proposed Rule 10 (defining these Market Entities as ‘‘covered entities’’). A Market Entity that falls within the definition of ‘‘covered entity’’ for purposes of proposed Rule 10 may not necessarily meet the definition of a ‘‘covered entity’’ for purposes of certain federal statutes, such as, but not limited to, CIRCIA and any regulations promulgated thereunder. CIRCIA, among other things, requires the Director of CISA to issue and implement regulations defining the term ‘‘covered entity’’ and requiring covered entities to report covered cyber incidents and ransom payments as the result of ransomware attacks to CISA in certain instances. 133See paragraph (b)(1) of proposed Rule 10 (setting forth the requirement for Market Entities that meet the definition of ‘‘covered entity’’); paragraph (e)(1) of proposed Rule 10 (setting forth the requirement for Market Entities that do not meet the definition of ‘‘covered entity,’’ which, as discussed above, would be certain smaller broker￾dealers). 134See paragraph (b)(2) of proposed Rule 10; paragraph (e)(1) of proposed Rule 10. 135See paragraph (c)(1) of proposed Rule 10 (setting forth the requirement for Market Entities that meet the definition of ‘‘covered entity’’); paragraph (e)(2) of proposed Rule 10 (setting forth the requirement for Market Entities that do not meet the definition of ‘‘covered entity’’). 136See paragraphs (b) through (d) of proposed Rule 10 (setting forth the requirements for Covered Entities); paragraph (e) of proposed Rule 10 (setting forth the requirements for Non-Covered Entities). As discussed above, Covered Entities would need to prepare a report with respect to their review and assessment of the policies and procedures. See paragraph (b)(2) of proposed Rule 10. Non-Covered Entities would need to make a record with the respect to the annual review and assessment of their policies and procedures. See paragraph (e) of proposed Rule 10. 137See paragraphs (b)(1)(i) through (v) of proposed Rule 10. 138See paragraph (c)(2) of proposed Rule 10. See also paragraph (a)(10) of proposed Rule 10 (defining the term ‘‘significant cybersecurity risk’’). 139See paragraph (d) of proposed Rule 10. 140When a broker-dealer introduces a customer to a carrying broker-dealer on a fully disclosed basis, the carrying broker-dealer knows the identity of the customer and holds cash and securities in an account for the customer that identifies the customer as the accountholder. This is distinguishable from a broker-dealer that
introduces its customers to another carrying broker-dealer on an omnibus basis. In this scenario, the carrying broker-dealer does not know the identities of the customers and holds their cash and securities in an account that identifies the broker-dealer introducing the customers on an omnibus basis as the accountholder. A broker-dealer that introduces customers to another broker-dealer on an omnibus basis is, itself, a carrying broker-dealer for purposes of the Commission’s financial responsibility rules, including, the broker-dealer net capital and customer protection rules. See, e.g., 17 CFR 240.15c3–1 and 17 CFR 240.15c3–3. This category of broker-dealer would be a carrying broker-dealer for purposes of proposed Rule 10 and therefore subject to the rule’s requirements for Covered Entities. 141See paragraphs (a)(1)(i)(A) through (F) of proposed Rule 10. Certain of the definitions in proposed Rule 10 would be used for the purposes of the requirements in the rule for broker-dealers that are not Covered Entities. Specifically, paragraph (e)(1) of proposed Rule 10 would require broker-dealers that are not Covered Entities to establish, maintain, and enforce written policies and procedures that are reasonably designed to address the cybersecurity risks of the broker-dealer taking into account the size, business, and operations of the broker-dealer. The term ‘‘cybersecurity risk’’ is defined in paragraph (a)(3) of proposed Rule 10 and that definition I and II of proposed Form SCIR.130 The defined terms are intended to tailor the risk management, notification, reporting, and disclosure requirements of proposed Rule 10 to the distinctive aspects of cybersecurity risk as compared with other risks Market Entities face (e.g., market, credit, or liquidity risk).131

1. ‘‘Covered Entity’’
   a. Market Entities That Meet the Definition of ‘‘Covered Entity’’ Would Be Subject to Additional Requirements Proposed Rule 10 would define the term ‘‘covered entity’’ to identify the types of Market Entities that would be subject to certain additional requirements under the rule.132 As discussed above, proposed Rule 10 would require all Market Entities to establish, maintain, and enforce written policies and procedures that are reasonably designed to address their cybersecurity risks.133 All Market Entities also, at least annually, would be required to review and assess the design and effectiveness of their cybersecurity risk management policies and procedures, including whether the policies and procedures reflect changes in cybersecurity risk over the time period covered by the review.134 They also would be required to prepare a report (in the case of Covered Entities) or a record (in the case of Non-Covered Entities) with respect to the annual review. Further, all Market Entities would need to give the Commission immediate written electronic notice of a significant cybersecurity incident upon having a reasonable basis to conclude that the significant cybersecurity incident has occurred or is occurring.135 As discussed above, Market Entities use information systems that expose them to cybersecurity risk and that risk is increasing due to the interconnectedness of the information systems and the sophistication of the tactics used by threat actors. Therefore, regardless of their function, interconnectedness, or size, all Market Entities would be subject to these requirements designed to address cybersecurity risks. Market Entities that are Covered Entities would be subject to certain additional requirements under proposed Rule 10.136 In particular, they would be required to: (1) include certain elements in their cybersecurity risk management policies and procedures; 137 (2) file Part I of proposed Form SCIR with the Commission and, for some Covered Entities, other regulators to report information about a significant cybersecurity incident; 138 and (3) make public disclosures on Part II of proposed Form SCIR about their cybersecurity risks and the significant cybersecurity incidents they experienced during the current or previous calendar year.139 In determining which Market Entities would be Covered Entities subject to the additional requirements, the Commission considered: (1) how the type of Market Entity supports the fair, orderly, and efficient operation of the U.S. securities markets and the consequences if that type of Market Entity’s critical functions were disrupted or degraded by a significant cybersecurity incident; (2) the harm that could befall investors, including retail investors, if that type of Market Entity’s functions were disrupted or degraded by a significant cybersecurity incident; (3) the extent to which that type of Market Entity poses cybersecurity risk to other Market Entities through information system connections,
   including the number of connections; (4) the extent to which the that type of Market Entity would be an attractive target for threat actors; and (5) the personal, confidential, and proprietary business information about the type of Market Entity and other persons (e.g., investors) stored on the Market Entity’s information systems and the harm that could be caused if that information was accessed or used by threat actors. b. Broker-Dealers The following broker-dealers registered with the Commission would be Covered Entities: (1) broker-dealers that maintain custody of securities and cash for customers or other broker￾dealers (i.e., carrying broker-dealers); (2) broker-dealers that introduce their customers’ accounts to a carrying broker-dealer on a fully disclosed basis (i.e., introducing broker-dealers); 140 (3) broker-dealers with regulatory capital equal to or exceeding $50 million; (4) broker-dealers with total assets equal to or exceeding $1 billion; (5) broker￾dealers that operate as market makers; and (6) broker-dealers that operate an ATS. Thus, under proposed Rule 10, these six categories of broker-dealers would be subject to the additional requirements.141 All other types of

incorporates the terms ‘‘cybersecurity incident,’’ ‘‘cybersecurity threat,’’ and ‘‘cybersecurity vulnerability,’’ which are defined, respectively, in paragraphs (a)(2), (a)(4), and (a)(5) of proposed Rule
10. In addition, paragraph (e)(2) of proposed Rule
10 would require broker-dealers that are not Covered Entities to provide immediate written electronic notice to the Commission and their examining authority if they experience a ‘‘significant cybersecurity incident’’ as that term is defined in the rule. Therefore, paragraph (a)(8) of proposed Rule 10 would define the term ‘‘market entity’’ to mean a Covered Entity and a broker￾dealer registered with the Commission that is not a Covered Entity. Further, the definitions in proposed Rule 10 would refer to ‘‘market entities’’ (rather than ‘‘covered entities’’) in order to not limit the application of these definitions to paragraphs (b) through (d) of proposed Rule 10, which set forth the requirements for Covered Entities (but not for Non-Covered Entities). 142As discussed below in section IV.C.2. of this release, of the 3,510 broker-dealers registered with the Commission as of the third quarter of 2022, 1,541 would meet the definition of ‘‘covered entity’’ under proposed Rule 10, leaving 1,969 broker￾dealers as Non-Covered Entities. 143See paragraph (a)(1)(i)(A) of proposed Rule 10. See also 17 CFR 240.15c3–3 (‘‘Rule 15c3–3’’). Rule 15c3–3 sets forth requirements for broker-dealers that maintain custody of customer securities and cash that are designed to protect those assets and ensure their prompt return to the customers. 144See paragraph (a)(1)(i)(B) of proposed Rule 10. 145See FINRA Rule 4311. Pursuant to FINRA requirements, the carrying agreement must specify the responsibilities of the carrying broker-dealer and the introducing broker-dealer, including, at a minimum, the responsibilities for: (1) opening and approving accounts; (2) accepting of orders; (3) transmitting of orders for execution; (4) executing of orders; (5) extending credit; (6) receiving and delivering of funds and securities; (7) preparing and transmitting confirmations; (8) maintaining books and records; and (9) monitoring of accounts. See FINRA Rule 4311(c)(1). 146See paragraph (a)(1)(i)(C) of proposed Rule 10. broker-dealers would not meet the definition of Covered Entity.142 The first category of broker-dealers included as Covered Entities would be carrying broker-dealers. Specifically, proposed Rule 10 would define ‘‘covered entity’’ to include any broker￾dealer that maintains custody of cash and securities for customers or other broker-dealers and is not exempt from the requirements of Exchange Act Rule 15c3–3 (i.e., a carrying broker-dealer).143 Some carrying broker-dealers are large in terms of their assets and dealing activities or the number of their accountholders. For example, they may engage in a variety of order handling, trading, and/or clearing activities, and thereby play a significant role in U.S. securities markets, often through multiple business lines and/or in multiple asset classes. Consequently, if their critical functions were disrupted or degraded by a significant cybersecurity incident it could have a potential negative impact on the U.S. securities
markets by, for example, reducing liquidity in the markets or sectors of the markets due to the firm’s inability to continue dealing and trading activities. A broker-dealer in this situation could lose its ability to provide liquidity to other market participants for an indeterminate length of time, which could lead to unfavorable market conditions for investors, such as higher buy prices and lower sell prices or even the inability to execute a trade within a reasonable amount of time. Further, some carrying broker-dealers hold millions of accounts for investors. If a significant cybersecurity incident prevented this investor-base from accessing the securities markets, it could impact liquidity as well. Also, the dealing activities of carrying broker-dealers may make them attractive targets for threat actors seeking to access proprietary and confidential information about the broker-dealer’s trading positions and strategies to use for financial advantage. In addition, the size and financial resources of carrying broker-dealers may make them attractive targets for threat actors employing ransomware schemes. Because carrying broker-dealers hold cash and securities for customers and other broker-dealers, a significant cybersecurity incident could put these assets in peril or make them unavailable. For example, a significant cybersecurity incident could cause harm to the investors that own these assets— including retail investors—if it causes the investors to lose access to their securities accounts (and, therefore, the ability to purchase or sell securities), causes the failure of the carrying broker￾dealer (which could tie up the assets in a liquidation proceeding under the Securities Investor Protection Act), or, in the worst case, results in the assets being stolen. The fact that carrying broker-dealers hold cash and securities for investors also may make them attractive targets for threat actors seeking to steal those assets through hacking the accounts or using stolen credentials and log-in information. In addition, carrying broker-dealers with large numbers of customers might be attractive targets for threat actors because of the volume of personal information they maintain. Threat actors may seek to access and download this information in order to sell it to other threat actors. If this information is accessed or stolen by threat actors, it could result in harm (e.g., identity theft or conversion of financial assets) to many individuals, including retail investors. Carrying broker-dealers typically are connected to a number of different Market Entities through information systems, including national securities exchanges, clearing agencies, and other broker-dealers (including introducing broker-dealers). The second category of broker-dealers included as Covered Entities would be introducing broker-dealers.144 These broker-dealers introduce customer accounts on a fully disclosed basis to a carrying broker-dealer. In this arrangement, the
carrying broker-dealer knows the identities of the fully disclosed customers and maintains custody of their securities and cash. The introducing broker-dealer typically interacts directly with the customers by, for example, making securities recommendations and accepting their orders to purchase or sell securities. An introducing broker-dealer must enter into an agreement with a carrying broker-dealer to which it introduces customer accounts on a fully disclosed basis.145 These broker-dealers would be included as Covered Entities because they are a conduit to their customers’ accounts at the carrying broker-dealer and have access to information and trading systems of the carrying broker￾dealer. Consequently, a significant cybersecurity incident could harm their customers to the extent it causes the customers to lose access to their securities accounts at the carrying broker-dealer. Further, a significant cybersecurity incident at an introducing broker-dealer could spread to the carrying broker-dealer given the information systems that connect the two firms. These connections also may make introducing broker-dealers attractive targets for threat actors seeking to access the information systems of the carrying broker-dealer to which the introducing broker-dealer is connected. In addition, introducing broker￾dealers may store personal information about their customers on their information systems or be able to access this information on the carrying broker￾dealer’s information systems. The fact that they store this information also may make them attractive targets for threat actors seeking to use the information to steal identities or assets, or to sell the personal information to other bad actors who will seek to use it for these purposes. The third category of broker-dealers included as Covered Entities would be broker-dealers that have regulatory capital equal to or exceeding $50 million.146 Regulatory capital is the total capital of the broker-dealer plus allowable subordinated liabilities of the broker-dealer and is reported on the FOCUS reports broker-dealers file

147See 17 CFR 240.17a–5; Form X–17A–5, Line Item 3550. 148See paragraph (a)(1)(i)(D) of proposed Rule 10. 149See 17 CFR 240.17h–1T and 17h–1T. See also Order Under Section 17(h)(4) of the Securities Exchange Act of 1934 Granting Exemption from Rule 17h–1T and Rule 17h–2T for Certain Broker￾Dealers Maintaining Capital, Including Subordinated Debt of Greater Than $20 Million But Less Than $50 Million, Exchange Act Release No. 89184 (June 29, 2020) [85 FR 40356 (July 6, 2020)] (‘‘17h Release’’) (setting forth the $50 million and $1 billion thresholds). 150Size has been recognized as a proxy for substantial market activity relative to other registrants of the same type and therefore a firm’s relative risk to the financial markets. See 17h Release (noting that broker-dealers that have less than $50 million in regulatory capital and less than $1 billion in total assets are ‘‘relatively small in size,’’ and ‘‘because of their relative size’’ and to the extent they are not carrying firms, these entities ‘‘present less risk to the financial markets,’’ while stating that with respect to broker-dealers with at least $50 million in regulatory capital or at least $1 billion in total assets ‘‘the Commission believes . . . those broker-dealers . . . pose greater risk to the financial markets, investors, and other market participants’’). 151See paragraph (a)(1)(i)(E) of proposed Rule 10. See also 17 CFR 240.15c3–1 (‘‘Rule 15c3–1’’). Paragraph (a)(6) of Rule 15c3–1 permits a market maker to avoid taking capital charges for its proprietary positions provided, among other things, its carrying firm takes the capital charges instead. See also, e.g., Rule 103 of the New York Stock Exchange (setting forth requirements for Designated Market Makers and Designated Market Maker Units). 152See paragraph (a)(1)(i)(F) of proposed Rule 10. 153For example, as discussed below in section IV.C.2. of this release, the 1,541 broker-dealers that would be Covered Entities had average total assets of $3.5 billion and average regulatory equity of $325 million; whereas the 1,969 that would be Non￾Covered Entities had average total assets of $4.7 million and average regulatory equity of $3 million. This means that Non-Covered Broker-Dealers under proposed Rule 10 accounted for about 0.2% of the total assets of all broker-dealers and 0.1% of total capital for all broker-dealers. pursuant to Rule 17a–5.147 The fourth category would be a broker-dealer with total assets equal to or exceeding $1 billion.148 The $50 million and $1 billion thresholds are modeled on the thresholds that trigger enhanced recordkeeping and reporting requirements for certain broker-dealers pursuant to Exchange Act Rules 17h–1T and 17h–2T.149 These thresholds are designed to include as Covered Entities broker￾dealers that are large in terms of their assets and dealing activities (and that would not otherwise be Covered Broker￾Dealers under the definitions in proposed Rule 10).150 For example, larger broker-dealers
that exceed these thresholds often engage in proprietary trading (including high frequency trading) and are sources of liquidity in certain securities. Consequently, if their critical functions were disrupted or degraded by a significant cybersecurity incident it could have a potential negative impact on those securities markets if it reduces liquidity in the markets through the inability to continue dealing and trading activities. For example, a broker-dealer in this situation could lose its ability to provide liquidity to other market participants for an indeterminate length of time, which could lead to unfavorable market conditions for investors, such as higher buy prices and lower sell prices or even the ability to execute a trade within a reasonable amount of time. In addition, the size and dealing activities of these broker-dealers could make them attractive targets for threat actors seeking to access proprietary and confidential information about the broker-dealer’s trading positions and strategies to use for financial advantage. This also may make them attractive targets for threat actors employing ransomware schemes. Further, given their size and trading activities, these broker-dealers may be connected to a number of different Market Entities through information systems, including national securities exchanges, clearing agencies, other broker-dealers, and ATSs. The fifth category of broker-dealers included as Covered Entities would be broker-dealers that operate as market makers. Specifically, proposed Rule 10 would define ‘‘covered entity’’ to include a broker-dealer that operates as a market maker under the Exchange Act or the rules thereunder (which includes a broker-dealer that operates pursuant to Exchange Act Rule 15c3–1(a)(6)) or is a market maker under the rules of an SRO of which the broker-dealer is a member.151 The proposed rule’s definition of ‘‘market maker’’ is tied to securities laws that confer benefits or impose requirements on market makers and, consequently, covers broker￾dealers that take advantage of those benefits or are subject to those requirements. The objective is to rely on these other securities laws to define a market maker rather than set forth a new definition of ‘‘market maker’’ in proposed Rule 10, which could conflict with these other laws. Market makers would be included as Covered Entities because disruptions to their operations caused by a significant cybersecurity incident could have a material impact on the fair, orderly, and efficient functioning of the U.S. securities markets. For example, a significant cybersecurity incident could imperil a market maker’s operations and ability to facilitate transactions in particular securities between buyers and sellers. In addition, market makers typically are connected to a number of different Market Entities through information systems, including national securities exchanges and other broker￾dealers. The sixth category of broker-dealers included as Covered
Entities would be broker-dealers that operate an ATS.152 Since Regulation ATS was adopted in 1998, ATSs have become increasingly important venues for trading securities in a fast and automated manner. ATSs perform exchange-like functions such as offering limit order books and other order types. These developments have made ATSs significant sources of orders and trading interest for securities. ATSs use data feeds, algorithms, and connectivity to perform these functions. ATSs rely heavily on information systems to perform these functions, including to connect to other Market Entities such as broker-dealers and principal trading firms. A significant cybersecurity incident that disrupts an ATS could negatively impact the ability of investors to liquidate or purchase certain securities at favorable or predictable prices or in a timely manner to the extent it provides liquidity to the market for those securities. Further, a significant cybersecurity incident at an ATS could provide a gateway for threat actors to attack other Market Entities that connect to it through information systems and networks of interconnected information systems. In addition, ATSs are connected to a number of different Market Entities through information systems, including national securities exchanges and other broker-dealers. Finally, the records stored by ATSs on their information systems include proprietary information about the Market Entities that use their services, including confidential business information (e.g., information about their trading activities). For the foregoing reasons, the categories of broker-dealers discussed above would be Covered Entities under proposed Rule 10. All other categories of broker-dealers would be Non-Covered Entities. Generally, the types of broker-dealers that would be Non-Covered Entities under proposed Rule 10 are smaller firms whose functions do not play as significant a role in promoting the fair, orderly, and efficient operation of the U.S. securities markets, as compared to broker-dealers that would be Covered Entities.153 For example, they tend to offer a more focused and limited set of services such as facilitating private placements of securities, selling mutual funds and variable contracts, underwriting securities, and participating in direct investment

154See section IV.C.2. of this release (discussing the activities of broker-dealers that would not meet the definition of ‘‘covered entity’’ in proposed Rule 10). 155See section II.C. of this release (discussing the requirements for these broker-dealers in more detail). 156 In addition to the requirements proposed in Rule 10 itself, the scope of certain existing regulations applicable to SBS Entities would include proposed Rule 10 if adopted; see, e.g., 17 CFR 240.15Fk–1(b)(2)(i) (which establishes the scope of specified chief compliance officer duties by reference to Section 15F of the Exchange Act (15 U.S.C. 78o–10) and the rules and regulations thereunder); 17 CFR 240.15Fh–3(h)(2)(iii)(I) (which establishes the scope of specified supervisory requirements by reference to Section 15F(j) of the Exchange Act (15 U.S.C. 78o–10(j)). 157See paragraphs (a)(1)(ii) through (ix) of proposed Rule 10 (defining these Market Entities as ‘‘covered entities’’). 158See paragraph (a)(1)(ii) of proposed Rule 10. See also 15 U.S.C. 78c(a)(23)(A) (defining the term ‘‘clearing agency’’). 159See paragraph (a)(1)(iii) of proposed Rule 10. See also 15 U.S.C. 78o–10(b). Registered MSBSPs include both MSBSPs that are conditionally registered pursuant to paragraph (d) of Exchange Act Rule 15Fb2–1 (‘‘Rule 15Fb2–1’’) (17 CFR 240.15Fb2–1) and MSBSPs that have been granted ongoing registration pursuant to paragraph (e) of Rule 15Fb2–1. 160See paragraph (a)(1)(iv) of proposed Rule 10. 161See paragraph (a)(1)(v) of proposed Rule 10. See also 15 U.S.C. 78o–3. 162See paragraph (a)(1)(vi) of proposed Rule 10. See also 15 U.S.C. 78f. 163See paragraph (a)(1)(vii) of proposed Rule 10. 164See paragraph (a)(1)(viii) of proposed Rule 10. See also 15 U.S.C. 78o–10(b). Registered SBSDs include both SBSDs that are conditionally registered pursuant to paragraph (d) of Rule 15Fb2– 1 and SBSDs that have been granted ongoing registration pursuant to paragraph (e) of Rule 15Fb2–1. 165See paragraph (a)(1)(ix) of proposed Rule 10. See also 15 U.S.C. 78q–1(c)(1) (registration requirements for transfer agents); 15 U.S.C. 78c(a)(25) (definition of transfer agent) and (a)(34)(B) (definition of appropriate regulatory agency). offerings.154 Further, they do not act as custodians for customer securities and cash or serve as a conduit (i.e., an introducing broker-dealer) for customers to access their accounts at a carrying broker-dealer that does maintain custody of securities and cash. Therefore, they do not pose the risk that a significant cybersecurity incident could lead to investors losing access to their securities or cash or having those assets stolen. In addition, Non-Covered Broker-Dealers likely are less connected to other Market Participants through information systems than Covered Broker-Dealers. For these reasons, the additional policies and procedures, reporting, and disclosure requirements would not apply to Non-Covered Broker-Dealers. At the same time, Non-Covered Broker-Dealers are part
of the financial sector and exposed to cybersecurity risk. Further, certain Non-Covered Broker￾Dealers maintain personal information about their customers that if accessed by threat actors or mistakenly exposed to unauthorized users could result in harm to the customers. For these reasons, Non-Covered Broker-Dealers—among other things—would be required under proposed Rule 10 to: (1) establish, maintain, and enforce written policies and procedures that are reasonably designed to address their cybersecurity risks taking into account their size, business, and operations; (2) review and assess the design and effectiveness of their cybersecurity policies and procedures annually, including whether the policies and procedures reflect changes in cybersecurity risk over the time period covered by the review; (3) make a written record that documents the steps taken in performing the annual review and the conclusions of the annual review; and (4) give the Commission and their examining authority immediate written electronic notice of a significant cybersecurity incident upon having a reasonable basis to conclude that the significant cybersecurity incident has occurred or is occurring.155 The Commission’s objective in proposing Rule 10 is to address the cybersecurity risks faced by all Market Entities but apply a more limited set of requirements to Non￾Covered Broker-Dealers commensurate with the level of risk they pose to investors, the U.S. securities markets, and the U.S. financial sector more generally.
c. Market Entities Other Than Broker￾Dealers
The MSRB and all clearing agencies, national securities associations, national securities exchanges, SBSDRs, SBS Entities,156 and transfer agents would be Covered Entities and, therefore, subject to the additional requirements regarding the minimum elements that must be included in their cybersecurity risk management policies and procedures, reporting, and public disclosure.157 In particular, proposed Rule 10 would define Covered Entity to include: (1) a clearing agency (registered or exempt) under section 3(a)(23)(A) of the Exchange Act; 158 (2) an MSBSP that is registered pursuant to section 15F(b) of the Exchange Act; 159 (3) the Municipal Securities Rulemaking Board; 160 (4) a national securities association under
section 15A of the Exchange Act; 161 (5)
a national securities exchange under
section 6 of the Exchange Act; 162 (6) a
security-based swap data repository under section 3(a)(75) of the Exchange Act; 163 (7) a security-based swap dealer that is registered pursuant to section 15F(b) of the Exchange Act; 164 and (8) a transfer agent as defined in section 3(a)(25) of the Exchange Act that is registered or required to be registered with an appropriate regulatory agency (‘‘ARA’’) as defined in section 3(a)(34)(B) of the Exchange Act.165 SROs play a critical role in setting and enforcing rules for their members or registrants that govern trading, fair access, transparency, operations, and business conduct, among other things. SROs and SBSDRs also play a critical role in ensuring fairness in the securities markets through the transparency they provide about securities transactions and pricing, and the information about securities transactions they can provide to regulators. National securities exchanges play a critical role in ensuring the orderly and efficient operation of the U.S. securities markets through the marketplaces they operate. Clearing agencies are critical to the orderly and efficient operation of the U.S. securities markets through the centralized clearing and settlement services they provide as well as their role as securities depositories, with exempt clearing agencies serving an important role as part of this process. Market liquidity is critical to the orderly and efficient operation of the U.S. securities markets. In this regard, SBS Entities play a critical role in providing liquidity to the security-based swap market. The disruption or degradation of the functions of an SRO (including functions that support securities marketplaces and the oversight of market participants) could cause harm to investors to the extent it negatively impacted the fair, orderly, and efficient operations of the U.S. securities markets. For example, it could prevent investors from purchasing or selling securities or doing so at fair or reasonable prices. Investors also would face harm if a transfer agent’s functions were disrupted or degraded by a significant cybersecurity incident. Transfer agents provide services such as stockholder recordkeeping, processing of securities transactions and corporate actions, and paying agent activities. Their core recordkeeping systems provide a direct conduit to their issuer clients’ master records that document and, in many instances provide the legal underpinning for, registered securityholders’ ownership of the issuer’s securities. If these functions were disrupted, investors might not be able to transfer ownership of their securities or receive dividends and

166See, e.g., Implications of Cyber Risk for Financial Stability (‘‘[T]he interconnectedness of the financial system means that an event at one or more firms may spread to others (the domino effect).’’). 167See paragraphs (a)(1)(ii) through (ix) of proposed Rule 10 (defining these Market Entities as ‘‘covered entities’’). 168See paragraph (a)(2) of proposed Rule 10. See generally, NIST Glossary (defining ‘‘cybersecurity risk’’ as ‘‘an effect of uncertainty on or within information and technology’’ and defining ‘‘incident’’ as ‘‘an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies’’); FISMA (defining ‘‘incident’’ as an ‘‘occurrence’’ that: (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. 44 U.S.C. 3552(b)(2). 169See section I.A.1. of this release (discussing the sources of the cybersecurity risk). 170See generally NIST Glossary (defining ‘‘confidentiality’’ as ‘‘preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information’’). interest due on their securities positions. SROs, exempt clearing agencies, and SBSDRs connect to multiple members, registrants, users, or others though networks of information systems. The interconnectedness of these Market Entities with other Market Entities through information systems creates the potential that a significant cybersecurity incident at one Market Entity (e.g., one caused by malware) could spread to other Market Entities in a cascading process that could cause widespread disruptions threatening the fair, orderly, and efficient operation of the U.S. securities markets.166 Additionally, the disruption of a Market Entity that provides critical services to other Market Entities through information system connections could disrupt the activities of these other Market Entities if they cannot obtain the services from another source. SROs, exempt clearing agencies, SBSDRs, SBS Entities, and transfer agents could be prime targets of threat actors because of the central roles they play in the securities markets. For example, threat actors could seek to disrupt their functions for geopolitical purposes. Threat actors also could seek to gain unauthorized access to their information systems to conduct espionage operations on their internal non-public activities. Moreover, because they hold financial assets (e.g., clearing deposits in the case of clearing agencies) and/or store substantial confidential and proprietary information
about other Market Entities or financial transactions, they may be choice targets for threat actors seeking to steal the assets or use the financial information to their advantage. SROs, exempt clearing agencies, and SBSDRs store confidential and proprietary information about their members, registrants, and users, including confidential business information, and personal information. A significant cybersecurity incident at any of these types of Market Entities could lead to the improper use of this information to harm the members, registrants, and users or provide the unauthorized user with an unfair advantage over other market participants and, in the case of personal information, to steal identities. Moreover, given the volume of information stored by these Market Entities about different persons, the harm caused by a cybersecurity incident could be widespread, negatively impacting many victims. SBS Entities also store proprietary and confidential information about their counterparties on their information systems, including financial information they use to perform credit analysis. A significant cybersecurity incident at an SBS Entity could lead to the improper use of this information to harm the counterparties or provide the unauthorized user with an unfair advantage over other market participants. Transfer agents store proprietary information about securities ownership and corporate actions. A significant cybersecurity incident at a transfer agent could lead to the improper use of this information to harm securities holders. Transfer agents also may store personal information including names, addresses, phone numbers, email addresses, employers, employment history, bank and specific account information, credit card information, transaction histories, securities holdings, and other detailed and individualized information related to the transfer agents’ recordkeeping and transaction processing on behalf of issuers. Threat actors breaching the transfer agent’s information systems could use this information to steal identities or financial assets of the persons to whom this information pertains. They also could sell it to other threat actors. In light of these considerations, the MSRB and all clearing agencies, national securities associations, national securities exchanges, SBSDRs, SBS Entities, and transfer agents would be Covered Entities under proposed Rule 10 and, therefore, subject to the additional requirements regarding the minimum elements that must be included in their cybersecurity risk management policies and procedures, reporting, and public disclosure.167
2. ‘‘Cybersecurity Incident’’
Proposed Rule 10 would define the term ‘‘cybersecurity incident’’ to mean an unauthorized occurrence on or conducted through a Market Entity’s information systems that jeopardizes the confidentiality, integrity, or availability of the information systems or any information residing on those systems.168 The objective is to use a term that is broad enough to encompass within the definition of ‘‘cybersecurity incident’’ the various categories of unauthorized occurrences that can impact an information system (e.g., unauthorized access, use, disclosure, downloading, disruption, modification, or destruction). As discussed earlier, the sources of cybersecurity risk are myriad as are the tactics, techniques, and procedures employed by threat actors.169 The definition of ‘‘cybersecurity incident’’ in proposed Rule 10 is designed to include any unauthorized incident impacting an information system or the information residing on the system. An information system can experience an unauthorized occurrence without a threat actor itself directly obtaining unauthorized access to the system. For example, a social engineering tactic could cause an employee to upload ransomware unintentionally that encrypts the information residing on the system or a DoS attack could cause the information system to shut down. In either case, the threat actor did not need to access the information system to cause harm. While the definition is intended to be broad, the occurrence must be one that jeopardizes (i.e., places at risk) the confidentiality, integrity, or availability of the information systems or any information residing on those systems. Confidentiality would be jeopardized if the unauthorized occurrence resulted in or could result in persons accessing an information system or the information residing on the system who are not permitted or entitled to do so or resulted in or could result in the disclosure of the information residing on the information system to the public or to any person not permitted or entitled to view it.170 Integrity would be jeopardized if the unauthorized occurrence resulted in or could result in: (1) an unpermitted or unintended modification or destruction of the

171See generally NIST Glossary (defining ‘‘integrity’’ as ‘‘guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity’’). 172See generally NIST Glossary (defining ‘‘availability’’ as ‘‘ensuring timely and reliable access to and use of information’’). 173See paragraphs (a)(10)(i) and (ii) of proposed Rule 10. 174See paragraph (a)(10)(i) of proposed Rule 10. 175See sections I.A.1. and I.A.2. of this release (discussing the consequences of these types of information system degradations and disruptions). This type of impact would compromise the integrity or availability of the information system. See generally NIST Glossary (defining ‘‘integrity’’ as ‘‘guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity’’ and ‘‘availability’’ as ‘‘ensuring timely and reliable access to and use of information’’). 176See, e.g., Basel Committee on Banking Supervision, Principles for Operational Resilience (Mar. 2021) (‘‘The term critical operations is based on the Joint Forum’s 2006 high-level principles for business continuity. It encompasses critical functions as defined by the FSB and is expanded to include activities, processes, services and their relevant supporting assets the disruption of which would be material to the continued operation of the bank or its role in the financial system.’’) (footnotes omitted). 177See sections I.A.1. and I.A.2. of this release (discussing the consequences of this type of compromise of an information system). This type of impact would compromise the confidentiality of the information system. See generally NIST Glossary (defining ‘‘confidentiality’’ as ‘‘preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information’’). 178See paragraph (a)(10)(ii) of proposed Rule 10. There could be instances where a significant cybersecurity incident meets both prongs. For example, an unauthorized user that is able to access the Market Entity’s internal computer systems could shut down critical operations of the Market Entity and use information on the systems to steal assets of the Market Entity or assets or identities of the Market Entity’s customers. 179See sections I.A.1. and I.A.2. of this release (discussing the consequences of this type of compromise of an information system). 180See paragraph (a)(4) of proposed Rule 10. See generally NIST Glossary (defining ‘‘threat’’ as any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service and also the potential for a threat-source to successfully exploit a particular information system vulnerability).
181See section I.A.1. of this release (discussing the various tactics, techniques, and procedures used by threat actors). information system or the information residing on the system; or (2) otherwise resulted in or could result in a compromise of the authenticity of the information system (including its operations and output) and the information residing on the system.171 Availability would be jeopardized if the unauthorized occurrence resulted in or could result in the Market Entity or other authorized users being unable to access or use the information system or information residing on the system or being unable access or use the information system or information residing on the system in a timely or reliable manner.172
3. ‘‘Significant Cybersecurity Incident’’
Proposed Rule 10 would have a two￾pronged definition of ‘‘significant cybersecurity incident.’’ 173 The first prong of the definition would be a cybersecurity incident, or a group of related cybersecurity incidents, that significantly disrupts or degrades the ability of the Market Entity to maintain critical operations.174 As discussed earlier, significant cybersecurity incidents can negatively impact information systems and the information residing on information systems in two fundamental ways. First, they can disrupt or degrade the information system or the information residing on the information system in a manner that prevents the Market Entity from performing functions that rely on the system operating as designed (e.g., an order routing system of an national securities exchange or a margin calculation and collection system of a clearing agency) or that rely on the Market Entity being able to process or access information on the system (e.g., a general ledger of a broker-dealer or SBS Entity that tracks and records securities transactions).175 This type of harm can be caused by, for example, a ransomware attack that encrypts the information stored on the system, a DoS attack that overwhelms the information system, or hackers taking control of a the system or shutting it down. Generally, critical operations would be activities, processes, and services that if disrupted could prevent the Market Entity from continuing to operate or prevent it from performing a service that supports the fair, orderly, and efficient functioning of the U.S. securities markets.176 The second fundamental way that a significant cybersecurity incident can negatively impact an information system or the information residing on the information system is when unauthorized persons are able to access and use the information stored on the information system (e.g., proprietary business information or personal information).177 Therefore, the second prong of the definition would be a cybersecurity incident, or a group of related cybersecurity incidents, that leads to the unauthorized access or use of the information or information systems of the Market Entity, where the unauthorized access or use of such information or information systems results in or is reasonably likely to result in: (1) substantial harm to the Market Entity; or (2) substantial harm to a customer, counterparty, member, registrant, or user of the Market Entity, or to any other person that interacts with the Market Entity.178 As discussed earlier, this kind of significant cybersecurity incident could lead to the improper use of this information to harm persons to whom it pertains (e.g., public exposure of their confidential financial information or the use of that information to steal their identities) or provide the unauthorized user with an unfair advantage over other market participants (e.g., trading based on confidential business information).179
4. ‘‘Cybersecurity Threat’’
Proposed Rule 10 would define the term ‘‘cybersecurity threat’’ to mean any potential occurrence that may result in an unauthorized effort to affect adversely the confidentiality, integrity, or availability of a Market Entity’s information systems or any information residing on those systems.180 As discussed earlier, threat actors use a number of different tactics, techniques, and procedures (e.g., malware, social engineering, hacking, DoS attacks) to commit cyber-related crime.181 These threat actors may be nation states, individuals (acting alone or as part of organized syndicates) seeking financial gain, or individuals seeking to cause harm for a variety of reasons. Further, the threat actors may be external or internal actors. Also, as discussed earlier, errors can pose a cybersecurity threat (e.g., accidentally providing access to confidential information to individuals that are not authorized to view or use it). The definition of ‘‘cybersecurity threat’’ in proposed Rule 10 is designed to include the potential actions of threat actors (e.g., seeking to install malware on or hack into an information system or engaging in social engineering tactics) and potential errors (e.g., an employee failing to secure confidential, proprietary, and personal information) that may result in an unauthorized effort to affect adversely the confidentiality, integrity, or availability of a Market Entity’s information systems or any information residing on those systems.
5. ‘‘Cybersecurity Vulnerability’’
Proposed Rule 10 would define the term ‘‘cybersecurity vulnerability’’ to mean a vulnerability in a Market Entity’s information systems, information system security procedures, or internal controls, including, for example, vulnerabilities in their design,

182See paragraph (a)(5) of proposed Rule 10. See generally NIST Glossary (defining ‘‘vulnerability’’ as a weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source’’). 183See section I.A.1. of this release (discussing information system vulnerabilities). See generally CISA 2021 Vulnerability Report (‘‘Globally, in 2021, malicious cyber actors targeted internet-facing systems, such as email servers and virtual private network (VPN) servers, with exploits of newly disclosed vulnerabilities.’’). 184See paragraph (a)(3) of proposed Rule 10. See also paragraphs (a)(4) and (5) of proposed Rule 10 (defining, respectively, ‘‘cybersecurity threat’’ to mean ‘‘any potential occurrence that may result in an unauthorized effort to affect adversely the confidentiality, integrity, or availability of a Market Entity’s information systems or any information residing on those systems’’ and ‘‘cybersecurity vulnerability’’ to mean ‘‘a vulnerability in a Market Entity’s information systems, information system security procedures, or internal controls, including, for example, vulnerabilities in their design, configuration, maintenance, or implementation that, if exploited, could result in a cybersecurity incident’’). 185See sections I.A.1. and I.A.2. of this release (discussing, respectively, the harms that can be caused by significant cybersecurity incidents generally and with respect to each category of Market Entity). 186See paragraphs (b)(1) and (e) of proposed Rule 10 (requiring Covered Entities and Non-Covered Entities, respectively, to have policies and procedures to address their cybersecurity risks); sections II.B.1. and II.C. of this release (discussing the requirements of paragraphs (b)(1) and (e) of proposed Rule 10, respectively, in more detail). 187See paragraph (a)(3) of proposed Rule 10 (defining ‘‘cybersecurity risk’’). 188See paragraph (a)(2) of proposed Rule 10 (defining ‘‘cybersecurity incident’’). 189See paragraph (a)(4) of proposed Rule 10 (defining ‘‘cybersecurity threat’’). 190See paragraph (a)(5) of proposed Rule 10 (defining ‘‘cybersecurity vulnerability’’). 191See paragraph (a)(6) of proposed Rule 10. 192See generally NIST Glossary (defining ‘‘information’’ as any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual. Id. (defining ‘‘data’’ (among other things) as: (1) pieces of information from which ‘‘understandable information’’ is derived; (2) distinct pieces of digital information that have been formatted in a specific way; and (3) a subset of information in an electronic format that allows it to be retrieved or transmitted. Id. (defining ‘‘records’’ (among other things) as units of related data fields (i.e., groups of data fields that can be accessed by a program and that contain the complete set of information on
particular items). 193See section I.A.2. of this release. 194See sections I.A.1. and I.A.2 of this release (discussing how threat actors seek unauthorized access to and use of confidential, proprietary, and personal information to, among other reasons, conduct espionage operations, steal identities, use it for business advantage, hold it hostage (in effect) configuration, maintenance, or implementation that, if exploited, could result in a cybersecurity incident.182 Cybersecurity vulnerabilities are weaknesses in the Covered Entity’s information systems that threat actors could exploit, for example, to hack into the system or install malware.183 One example would be an information system that uses outdated software that is no longer updated to address known flaws that could be exploited by threat actors to access the system. Cybersecurity vulnerabilities also are weaknesses in the procedures and controls the Market Entity uses to protect its information systems and the information residing on them such as procedures and controls that do not require outdated software to be replaced or that do not adequately restrict access to the system. Cybersecurity vulnerabilities can also include lack of training opportunities for employees to increase their cybersecurity awareness, such as how to properly secure sensitive data and recognize harmful files. The definition of ‘‘cybersecurity vulnerability’’ in proposed Rule 10 is designed to include weaknesses in the information systems themselves and weaknesses in the measures the Covered Entity takes to protect the systems and the information residing on the systems.
6. ‘‘Cybersecurity Risk’’
Proposed Rule 10 would define the term ‘‘cybersecurity risk’’ to mean financial, operational, legal, reputational, and other adverse consequences that could stem from cybersecurity incidents, cybersecurity threats, and cybersecurity vulnerabilities.184 As discussed earlier, cybersecurity incidents have the potential to cause harm to Market Entities and others who use their services or are connected to them through information systems and, if severe enough, negatively impact the fair, orderly, and efficient operations of the U.S. securities markets.185 The definition of ‘‘cybersecurity risk’’ in proposed Rule 10 is designed to encompass the types of harm and damage that can befall a Market Entity that experiences a cybersecurity incident.
7. ‘‘Information’’
As discussed in more detail below, a Market Entity would be required under proposed Rule 10 to establish, maintain, and enforce written policies and procedures that are reasonably designed to address the Market Entity’s cybersecurity risks.186 Cybersecurity risks—as discussed above—would be financial, operational, legal, reputational, and other adverse consequences that could result from cybersecurity incidents, cybersecurity threats, and cybersecurity vulnerabilities.187 Cybersecurity incidents would be unauthorized occurrences on or conducted through a market entity’s information systems that jeopardize the confidentiality, integrity, or availability of the information systems or any information residing on those systems.188 Cybersecurity threats would be any potential occurrences that may result in an unauthorized effort to affect adversely the confidentiality, integrity, or availability of a market entity’s information systems or any information residing on those systems.189 Finally, cybersecurity vulnerabilities would be a vulnerability in a Market Entity’s information systems, information system security procedures, or internal controls, including, for example, vulnerabilities in their design, configuration, maintenance, or implementation that, if exploited, could result in a cybersecurity incident.190 Consequently, the policies and procedures required under proposed Rule 10 would need to cover all of the Market Entity’s information systems and information residing on those systems in order to address the Market Entity’s cybersecurity risks. Proposed Rule 10 would define the term ‘‘information’’ to mean any records or data related to the Market Entity’s business residing on the Market Entity’s information systems, including, for example, personal information received, maintained, created, or processed by the Market Entity.191 The definition is designed to cover the full range of information stored by Market Entities on their information systems regardless of the digital format in which the information is stored.192 As discussed earlier, Market Entities create and maintain a wide range of information on their information systems.193 This includes information used to manage and conduct their operations, manage and mitigate their risks, monitor the progress of their business, track their financial condition, prepare financial statements, prepare regulatory filings, and prepare tax returns. They also store personal, confidential, and proprietary business information about their customers, counterparties, members, registrants or users. This includes information maintained by clearing agencies, the MSRB, the national securities exchanges, and SBSDRs about market activity and about their members, registrants, and users. The information maintained by Market Entities on their information systems is an attractive target for threat actors, particularly confidential, proprietary, and personal information.194 Also, it also can be

through a ransomware attack, or sell it to other threat actors). 195 Id. 196See paragraph (a)(7) of proposed Rule 10. 197See section I.A.2. of this release. 198See sections I.A.1. and I.A.2. of this release. 199 Id. 200See paragraph (a)(9) of proposed Rule 10. See generally NIST Glossary (defining ‘‘personal information’’ as information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual and defining ‘‘personally identifying information’’ (among other things) as information that can be used to distinguish or trace an individual’s identity—such as name, social security number, biometric data records—either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual (e.g., date and place of birth, mother’s maiden name, etc.)); 17 CFR 248.201(b)(8) ((defining ‘‘identifying information’’ as any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including any: (1) name, Social Security number, date of birth, official State or government issued driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number; (2) unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation; (3) unique electronic identification number, address, or routing code; or (4) telecommunication identifying information or access device (as defined in 18 U.S.C. 1029(e))). 201See sections I.A.1. and I.A.2. of this release. 202See paragraph (b)(1)(iii)(A)(2) of proposed Rule 10. See also proposed Form SCIR, which would elicit information about whether personal information was compromised in a significant cybersecurity incident. critical to performing their various functions, and the inability to access and use their information could disrupt or degrade their ability to operate in support of the fair, orderly, and efficient operation of the U.S. securities markets.195 Consequently, protecting the confidentiality, integrity, and availability of information residing on a Market Entity’s information systems is critical to avoiding the harms that can be caused by cybersecurity risk. The definition of ‘‘information’’ in proposed Rule 10 is designed to encompass this information and, therefore, to extend the proposed protections of the rule to it.
8. ‘‘Information Systems’’
The policies and procedures required under proposed Rule 10 also would need to cover the Market Entity’s information systems in order to address the Market Entity’s cybersecurity risks. Proposed Rule 10 would define the term ‘‘information systems’’ to mean the information resources owned or used by the Market Entity, including, for example, physical or virtual infrastructure controlled by the information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the Market Entity’s information to maintain or support the Market Entity’s operations.196 As discussed earlier, Market Entities use information systems to perform a wide range of functions.197 For example, they use information systems to maintain books and records to manage and conduct their operations, manage and mitigate their risks, monitor the progress of their business, track their financial condition, prepare financial statements, prepare regulatory filings, and prepare tax returns. Market Entities also use information systems so that their employees can communicate with each other and with external persons. These include email, text messaging, and virtual meeting applications. They also use internet websites to communicate information to their customers, counterparties, members, registrants, or users. They use information systems to perform the functions associated with their status and obligations as a broker-dealer, registered or exempt clearing agency, national securities association, national securities exchange, SBSDR, SBS Entity, SRO, or transfer agent. Information systems are targets that threat actors attack to access and use information maintained by Market Entities related to their business (particularly confidential, proprietary, and personal information).198 In addition, the interconnectedness of Market Entities through information systems creates channels through which malware, viruses, and other destructive cybersecurity threats can spread throughout the financial system. Moreover, the disruption or degradation of a Market Entity’s information systems could negatively impact the entity’s ability to operate in support of the U.S. securities markets.199 Consequently, protecting the confidentiality, integrity, and availability of a Market Entity’s information systems is critical to avoiding the harms that can be caused by cybersecurity risk. The definition of the term ‘‘information systems’’ in proposed Rule 10 is designed to be broad enough to encompass all the electronic information resources owned or used by a Market Entity to carry out its various operations. Accordingly, the definition of ‘‘information systems’’ would require a Market Entity’s policies and procedures to address cybersecurity risks to cover all of its information systems.
9. ‘‘Personal Information’’
Proposed Rule 10 would define the term ‘‘personal information’’ to mean any information that can be used, alone or in conjunction with any other information, to identify a person, including, but not limited to, name, date of birth, place of birth, telephone number, street address, mother’s maiden name, Social Security number, government passport number, driver’s license number, electronic mail address, account number, account password, biometric records, or other non-public authentication information.200 The definition of ‘‘personal information’’ was guided by a number of established sources and aims to capture a broad array of information that can reside on a Market Entity’s information systems that may be used alone, or with other information, to identify an individual. The definition is designed to encompass information that if compromised could cause harm to the individuals to whom the information pertains (e.g., identity theft or theft of assets). Personal information is an attractive target for threat actors because they can use it to steal a person’s identity and then use the stolen identity to appropriate the person’s assets through unauthorized transactions or to make unlawful purchases on credit or to effect other unlawful transactions in the name of the person.201 They also can sell personal information they obtain through unauthorized access to an information system to criminals who will seek to use the information for these purposes. Moreover, the victims of identity theft can be the more vulnerable members of society (e.g., individuals on fixed-incomes, including retirees). Consequently, proposed Rule 10 would have a provision that specifically addresses protecting personal information.202
10. Request for Comment
The Commission requests comment on all aspects of the proposed definitions. In addition, the Commission is requesting comment on the following specific aspects of the proposals:

1. In designing the definitions of
   proposed Rule 10, the Commission considered a number of sources cited in the sections above, including, in particular, the NIST Glossary and certain Federal statutes and regulations. Are these appropriate sources to consider? If so, explain why. If not, explain why not. Are there other sources the Commission should use? If so, identify them and explain why they should be considered and how they

203See 17 CFR 242.1000 (defining the term ‘‘SCI alternative trading system’’ and including that defined term in the definition of ‘‘SCI Entity’’). 204Regulation SCI 2023 Proposing Release. 205See paragraph (a)(1)(i)(D) of proposed Rule 10. See also section II.F.1.c. of this release (discussing why this type of broker-dealer would be a Covered Entity). 206See paragraphs (a)(1)(i)(A), (C), (D), and (E) of proposed Rule 10 (defining these categories of broker-dealers as ‘‘covered entities’’). See also
section II.F.1.c. of this release (discussing why this
type of broker-dealer likely would be a Covered Entity). 207See 17 CFR 242.600(16) and (67) (defining the terms ‘‘competing consolidator’’ and ‘‘plan processor,’’ respectively). See also 17 CFR 242.1000 (defining ‘‘SCI competing consolidator’’ and defining ‘‘SCI entity’’ to include SCI competing consolidator). could inform potential modifications to the definitions.
2. In determining which categories of
Market Entities would be Covered Entities subject to the additional requirements of proposed Rule 10, the Commission considered: (1) how the category of Market Entity supports the fair, orderly, and efficient operation of the U.S. securities markets and the consequences if that type of broker￾dealer’s critical functions were disrupted or degraded by a significant cybersecurity incident; (2) the harm that could befall investors, including retail investors, if that category of Market Entity’s functions were disrupted or degraded by a significant cybersecurity incident; (3) the extent to which the category of Market Entity poses cybersecurity risk to other Market Entities though information system connections, including the number of connections; (4) the extent to which the category of Market Entity would be an attractive target for threat actors; and (5) the personal, confidential, and proprietary business information about the category of Market Entity and other persons (e.g., investors) stored on the Market Entity’s information systems and the harm that could be caused if that information was accessed or used by threat actors through a cybersecurity breach. Are these appropriate factors to consider? If so, explain why. If not, explain why not. Are there other factors the Commission should take into account? If so, identify them and explain why they should be considered.
3. Should proposed Rule 10 be
modified to include other categories of broker-dealers as Covered Entities? If so, identify the category of broker-dealers and explain how to define broker￾dealers within that category and why it would be appropriate to apply the additional policies and procedures, reporting, and disclosure requirements of the proposed rule to that category of broker-dealers. For example, should the $50 million regulatory capital threshold be lowered (e.g., to $25 million or some other amount) or should the $1 billion total assets threshold be lowered (e.g., to $500 million or some other amount) to include more broker-dealers as Covered Entities? If so, identify the threshold and explain why it would be appropriate to apply the additional requirements to broker-dealers that fall within that threshold.
4. Should proposed Rule 10 be
modified to include as a Covered Entity any broker-dealer that is an SCI entity for the purposes of Regulation SCI? Currently, under Regulation SCI, an ATS that trades certain stocks exceeding specific volume thresholds is an SCI entity? 203 As discussed above, a broker￾dealer that operates an ATS would be a Covered Entity under proposed Rule 10 and, therefore, subject to the additional policies and procedures, reporting, and disclosure requirements of the proposed rule. However, the Commission is proposing to amend Regulation SCI to broaden the definition of ‘‘SCI entity’’ to include, among other Commission registrants, a broker-dealer that exceeds an asset-based size threshold or a volume-based trading threshold in NMS stocks, exchange-listed options, agency securities, or U.S. treasury securities.204 A broker-dealer that exceeds the asset￾based size threshold under the proposed amendments to Regulation SCI (which would be several hundred billion dollars) would be subject to the requirements of proposed Rule 10 applicable to Covered Entities, as it would exceed the $1 billion total assets threshold in the broker-dealer definition of ‘‘covered entity.’’ 205 Further, a broker-dealer that exceeds one or more of the volume-based trading thresholds under the proposed amendments to Regulation SCI likely would meet one of the broker-dealer definitions of ‘‘covered entity’’ in proposed Rule 10 given its size and activities. For example, it may be carrying broker￾dealer, have regulatory capital equal to or exceeding $50 million, have total assets equal to or exceeding $1 billion, or operate as a market maker.206 Nonetheless, should the definition of ‘‘covered entity’’ in proposed Rule 10 be modified to include any broker-dealer that is an SCI entity under Regulation SCI? If so, explain why. If not, explain why not.
5. Should proposed Rule 10 be
modified to narrow the categories of broker-dealers that would be Covered Entities? If so, explain how the category should be narrowed and why it would be appropriate not to apply the additional requirements to broker￾dealers that would no longer be included as Covered Entities. For example, are there certain types of carrying broker-dealers, introducing broker-dealers, market makers, or ATSs that should not be included as Covered Entities? If so, identify the type of broker-dealer and explain why it would be appropriate not to impose the additional policies and procedures, reporting, and disclosure requirements of the proposed rule on that type of broker-dealer. Similarly, should the proposed $50 million regulatory capital threshold be increased (e.g., to $100 million or some other amount) or should the $1 billion total assets threshold be increased (e.g., to $5 billion or some other amount) to exclude more broker-dealers from the definition of ‘‘covered entity’’? If so, identify the threshold and explain why it would be appropriate not to apply the additional requirements on the broker￾dealers that would not be Covered Entities under the narrower definition.
6. Should proposed Rule 10 be
modified to divide other categories of Market Entities into Covered Entities and Non-Covered Entities? If so, identify the category of Market Entity and explain how to define Covered Entity and Non-Covered Entity within that category and explain why it would be appropriate not to impose the additional policies and procedures, reporting, and disclosure requirements on the Market Entities that would be Non-Covered Entities. For example, are there types of clearing agencies (registered or exempt), MSBSPs, national securities exchanges, SBSDRs, SBSDs, or transfer agents that pose a level of cybersecurity risk to the U.S. securities markets and the participants in those markets that is no greater than the cybersecurity risk posed by the categories of broker-dealers that would be Non-Covered Entities? If so, explain why it would be appropriate not to apply the additional requirements of proposed Rule 10 to these types of Market Entities.
7. Should proposed Rule 10 be
modified so that it applies to other participants in the U.S. securities markets that are registered with the Commission? If so, identify the registrant type and explain why it should be subject to the requirements of proposed Rule 10. For example, should competing consolidators or plan processors be subject to the requirements of proposed Rule 10? 207 If so, explain why. If not, explain why not. If competing consolidators or plan processors should be subject to proposed Rule 10, should they be treated as Covered Entities or Non￾Covered Entities? If Covered Entities,

explain why. If Non-Covered Entities, explain why. Should certain competing consolidators or plan processors be treated as Covered Entities and others be treated as Non-Covered Entities? If so, explain how to define Covered Entity and Non-Covered Entity within that category and explain why it would be appropriate not to apply the additional policies and procedures, reporting, and disclosure requirements of the proposed rule to the competing consolidators or plan processors in that category that would not be Covered Entities.
8. Should proposed Rule 10 be
modified to revise the broker-dealer definitions of ‘‘covered entity’’? For example, in order to include carrying broker-dealers as Covered Entities, paragraph (a)(1)(i)(A) of proposed Rule 10 would define the term ‘‘covered entity’’ to include a broker-dealer that maintains custody of cash and securities for customers or other brokers-dealers and is not exempt from the requirements of Rule 15c3–3. In addition, in order to include introducing broker-dealers as Covered Entities, paragraph (a)(1)(i)(B) of proposed Rule 10 would define the term ‘‘covered entity’’ to include a broker￾dealer that introduces customer accounts on a fully disclosed basis to another broker-dealer that is a carrying broker-dealer under paragraph (a)(1)(i)(A) of the proposed rule. Would these broker-dealer definitions of ‘‘covered entity’’ work as designed? If not, explain why and suggest modifications to improve their design.
9. In order to include market makers
as Covered Entities, paragraph (a)(1)(i)(E) of proposed Rule 10 would define the term ‘‘covered entity’’ to include a broker-dealer that is a market maker under the Exchange Act or the rules thereunder (which includes a broker-dealer that operates pursuant to paragraph (a)(6) of Rule 15c3–1) or is a market maker under the rules of an SRO of which the broker-dealer is a member. Would the definition work as designed? If not, explain why and suggest modifications to improve its design. For example, should the definition be based on a list of the functions and activities of a market maker as distinct from the functions and activities of other categories of broker-dealers? If so, identify the relevant functions and activities and explain how they could be incorporated into a definition.
10. Should paragraph (a)(2) of
proposed Rule 10 be modified to revise the definition of ‘‘cybersecurity incident’’? For example, as discussed above, the definition is designed to include any unauthorized occurrence that impacts an information system or the information residing on the system. Would the definition work as designed? If not, explain why and suggest modifications to improve its design. Is this design objective appropriate? If not, explain why and suggest an alternative design objective for the definition. Is the definition of ‘‘cybersecurity incident’’ overly broad in that it refers to an incident that jeopardizes the confidentiality, integrity, or availability of the information systems or any information residing on those systems? If so, explain why and suggest modifications to appropriately narrow its scope without undermining the objective of the rule to address cybersecurity risks facing Market Entities. Is the definition of ‘‘cybersecurity incident’’ too narrow? If so, how should it be broadened?
11. Should paragraph (a)(3) of
proposed Rule 10 be modified to revise definition of ‘‘cybersecurity risk’’? For example, the NIST definition of ‘‘cybersecurity risk’’ focuses on how this risk can cause harm: it can adversely impact organizational operations (i.e., mission, functions, image, or reputation) and assets, individuals, other organizations, and the Nation. The definition of ‘‘cybersecurity risk’’ in proposed Rule 10 was guided by this aspect of cybersecurity risk. Does the definition appropriately incorporate this aspect of cybersecurity risk? If not, explain why and suggest modifications to improve its design. Is this design objective appropriate? If not, explain why and suggest an alternative design objective for the definition.
12. Should paragraph (a)(4) of
proposed Rule 10 be modified to revise the definition of ‘‘cybersecurity threat’’? For example, as discussed above, the definition is designed to include the potential actions of threat actors and errors that may result in an unauthorized effort to affect adversely the confidentiality, integrity, or availability of a Market Entity’s information systems or any information residing on those systems. Would the definition work as designed? If not, explain why and suggest modifications to improve its design. Is the definition of ‘‘cybersecurity threat’’ overly broad in that it includes any ‘‘potential occurrence’’? If so, explain why and suggest modifications to appropriately narrow its scope without undermining the objective of the rule to address cybersecurity risks facing Market Entities. Is the definition of ‘‘cybersecurity threat’’ too narrow? If so, how should it be broadened?
13. Should paragraph (a)(5) of
proposed Rule 10 be modified to revise the definition of ‘‘cybersecurity vulnerability’’? For example, as discussed above, the definition is designed to include weaknesses in the information systems themselves and weaknesses in the measures the Covered Entity takes to protect the systems and the information residing on the systems. Would the definition work as designed? If not, explain why and suggest modifications to improve its design. Is this design objective appropriate? If not, explain why and suggest an alternative design objective for the definition. Is the definition of ‘‘cybersecurity vulnerability’’ overly broad? If so, explain why and suggest modifications to appropriately narrow its scope without undermining the objective of the rule to address cybersecurity risks facing Market Entities. Is the definition of ‘‘cybersecurity vulnerability’’ too narrow? If so, how should it be broadened?
14. Should paragraph (a)(6) of
proposed Rule 10 be modified to revise the definition of ‘‘information’’? For example, as discussed above, the definition is designed to be broad enough to encompass the wide range of information that resides on the information systems of Market Entities. Would the definition work as designed? If not, explain why and suggest modifications to improve its design. Is this design objective appropriate? If not, explain why and suggest an alternative design objective for the definition. For example, should the definition focus on information that, if compromised, could cause harm to the Market Entity or others and exclude information that, if compromised, would not cause harm? If so, explain why and suggest rule text to implement this modification.
15. Should paragraph (a)(7) of
proposed Rule 10 be modified to revise the definition of ‘‘information systems’’? For example, as discussed above, the definition is designed to be broad enough to encompass all the electronic information resources owned or used by a Market Entity to carry out its various operations. Would the definition work as designed? If not, explain why and suggest modifications to improve its design. Is this design objective appropriate? If not, explain why and suggest an alternative design objective for the definition. Is the definition of ‘‘information systems’’ overly broad in that it includes any information resource ‘‘used by’’ the Market Entity, which may include information resources developed and maintained by a third party (other than a service provider that that receives, maintains, or processes information, or is otherwise permitted to access the Market Entity’s information systems and any of the

208See paragraphs (c) and (d) of proposed Rule 10 (requiring, respectively, immediate notification and subsequent reporting of significant cybersecurity incidents and public disclosure of significant cybersecurity incidents). 209See paragraphs (c) and (d) of proposed Rule 10 (requiring, respectively, immediate notification and subsequent reporting of significant cybersecurity incidents and public disclosure of significant cybersecurity incidents). 210See generally NIST Framework. 211 Id. 212See generally CISA Cyber Essentials Starter Kit (stating that organizations should ‘‘approach cyber as business risk’’). Market Entity’s information residing on those systems)? If so, explain why and suggest modifications to improve its design. Is this design objective appropriate? If not, explain why and suggest an alternative design objective for the definition. Is the definition of ‘‘information system’’ overly narrow? If so, how should it be broadened?
16. Should paragraph (a)(9) of
proposed Rule 10 be modified to revise the definition of ‘‘personal information’’? For example, as discussed above, the definition is designed to encompass information that if compromised could cause harm to the individuals to whom the information pertains (e.g., identity theft or theft of assets). Would the definition work as designed? If not, explain why and suggest modifications to improve its design. Is this design objective appropriate? If not, explain why and suggest an alternative design objective for the definition.
17. Should paragraph (a)(10) of
proposed Rule 10 be modified to revise the definition of ‘‘significant cybersecurity incident’’? For example, as discussed above, the definition would have two prongs: the first relating to incidents that significantly disrupt or degrade the ability of the Market Entity to maintain critical operations and the second relating to the unauthorized access or use of the information or information systems of the Market Entity. Are these the fundamental ways that significant cybersecurity incidents can negatively impact information systems and the information residing on information systems? If not, explain why and identify other fundamental ways that information and information systems can be negatively impacted by significant cybersecurity incidents that should be incorporated into the definition of ‘‘significant cybersecurity incident.’’ Should the term ‘‘significant’’ be defined separately? If so, explain why and suggest potential definitions for this term. Instead, of ‘‘significant’’ should the definition use the word ‘‘material.’’ If so, explain why and how that would change the meaning of the definition.
18. Should paragraph (a)(10)(i) of
proposed Rule 10 be modified to revise the first prong of the definition of ‘‘significant cybersecurity incident’’? For example, as explained above, the first prong is designed to address how a ‘‘significant cybersecurity incident’’ can disrupt or degrade the information system or the information residing on the system in a manner that prevents the Market Entity from performing functions that rely on the system operating as designed or that rely on the Market Entity being able to process or access information on the system. Would the first prong of the definition work as designed? If not, explain why and suggest modifications to improve its design. Is this design objective appropriate? If not, explain why and suggest an alternative design objective for the first prong of the definition. For example, should the first prong of the definition be limited to cybersecurity incidents that ‘‘disrupt’’ the ability of the Market Entity to maintain critical operations (i.e., not include incidents that ‘‘degrade’’ that ability)? If so, explain why and also explain how to distinguish between an incident that degrades the ability of the Market Entity to maintain critical operations and an incident that disrupts that ability. Also, explain why reporting to the Commission and other regulators (as applicable) and publicly disclosing incidents that degrade the ability of the Market Entity to maintain critical operations would not be necessary because they would no longer be significant cybersecurity incidents.208
19. Should paragraph (a)(10)(ii) of
proposed Rule 10 be modified be to revise the second prong of the definition of ‘‘significant cybersecurity incident’’? For example, as explained above, the second prong is designed to address how a ‘‘significant cybersecurity incident’’ can cause harm if unauthorized persons are able to access and use the information system or the information residing on the system. Would the definition work as designed? If not, explain why and suggest modifications to improve its design. Is this design objective appropriate? If not, explain why and suggest an alternative design objective for the second prong of the definition. For example, should the second prong of the definition be limited to cybersecurity incidents that ‘‘result’’ in substantial harm to the Market Entity or substantial harm to a customer, counterparty, member, registrant, or user of the Market entity, or to any other person that interacts with the Market Entity (i.e., not include incidents that are ‘‘reasonably likely’’ to result in these consequences)? If so, explain why and also explain why reporting to the Commission and other regulators (as applicable) and publicly disclosing incidents that are reasonably likely to result in these consequences would not be necessary because they would no longer be significant cybersecurity incidents.209 Alternatively, should the second prong of the definition be limited to an incident of unauthorized access or use that leads to ‘‘substantial harm’’ to a customer, counterparty, member, registrant or user of the Covered Entity, or should ‘‘inconvenience’’ to a customer, counterparty, member, registrant or user be enough? If yes, explain why. Should the second prong of the definition be modified so that it is limited to cybersecurity incidents that result in or are reasonably likely to result in substantial harm to more than one customer, counterparty, member, registrant, or user of the Market Entity, or to any other market participant that interacts with the Market Entity? If so, explain why.
20. Should proposed Rule 10 be
modified to define additional terms for the purposes of the rule and Parts I and II of proposed Form SCIR? If so, identify the term, suggest a definition, and explain why including the definition would be appropriate. For example, would including additional defined terms improve the clarity of the requirements of proposed Rule 10 and Parts I and II of proposed Form SCIR? If so, explain why. Should proposed Rule 10 be modified to define the terms ‘‘confidentiality,’’ ‘‘integrity’’, and ‘‘availability’’? If so, explain why and suggest definitions. B. Proposed Requirements for Covered Entities

1. Cybersecurity Risk Management
   Policies and Procedures
   Risk management is the ongoing process of identifying, assessing, and responding to risk.210 To manage risk generally, Market Entities should understand the likelihood that an event will occur and the potential resulting impacts.211 Cybersecurity risk—like other business risks (e.g., market, credit, or liquidity risk)—can be addressed through policies and procedures that are reasonably designed to manage the risk.212 Accordingly, proposed Rule 10 would require Covered Entities to establish, maintain, and enforce written policies and procedures that are reasonably designed to address the Covered Entity’s

213See paragraph (b)(1) of proposed Rule 10. 214See paragraphs (b)(1)(i) through (v) of proposed Rule 10. Covered Entities may wish to consult a number of resources in connection with these elements. See generally NIST Framework; CISA Cyber Essentials Starter Kit. 215See paragraph (b)(1)(i)(A) of proposed Rule 10. See generally NIST Framework (providing that the first core element of the framework is ‘‘identify’’— meaning develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities); IOSCO Cybersecurity Report (‘‘A key component of the risk management program is the identification of critical assets, information and systems, including order routing systems, risk management systems, execution systems, data dissemination systems, and surveillance systems. Practices supporting the identification function include the establishment and maintenance of an inventory of all hardware and software. This risk management program should also typically include third-party and technology providers’ security assessments. Finally, accessing information about the evolving threat landscape is important in identifying the changing nature of cyber risk.’’). 216See paragraph (b)(1)(i)(A)(1) of proposed Rule
10. See generally CISA Cyber Essentials Starter Kit
(‘‘Consider how much your organization relies on information technology to conduct business and make it a part of your culture to plan for contingencies in the event of a cyber incident. Identify and prioritize your organization’s critical assets and the associated impacts to operations if an incident were to occur. Ask the questions that are necessary to understanding your security planning, operations, and security-related goals. Develop an understanding of how long it would take to restore normal operations. Resist the ‘‘it can’t happen here’’ pattern of thinking. Instead, focus cyber risk discussions on ‘‘what-if’’ scenarios and develop an incident response plan to prepare for various cyber events and scenarios.’’). 217See paragraph (a)(3) of proposed Rule 10; see also paragraphs (a)(2), (a)(4), and (a)(5) of proposed Rule 10 (defining, respectively, the terms ‘‘cybersecurity incident,’’ cybersecurity threat,’’ and ‘‘cybersecurity vulnerability,’’ which are used in the definition of ‘‘cybersecurity risk’’). 218See generally CISA Cyber Essentials Starter Kit (‘‘[H]ave conversations with your staff, business partners, vendors, managed service providers, and others within your supply chain. . . . Maintain situational awareness of cybersecurity threats and explore available communities of interest. These may include sector-specific Information Sharing and Analysis Centers, government agencies, law enforcement, associations, vendors, etc.’’). 219See generally id. (stating that organizational leaders drive cybersecurity strategy, investment, and culture, and that leaders should, among other things: (1) use risk assessments to identify and prioritize allocation of resources and cyber investments; (2) perform a review of all current cybersecurity and risk policies and identify gaps or weaknesses; and (3) develop a policy roadmap, prioritize policy creation and updates based on the risk to the organization as determined by business leaders and technical staff). cybersecurity risks.213 Further, proposed Rule 10 would set forth minimum elements that would need to be included in the policies and procedures.214 In particular, the policies and procedures would need to address:
(1) risk assessment; (2) user security and access; (3) information protection; (4) cybersecurity threat and vulnerability management; and (5) cybersecurity incident response and recovery. As discussed in more detail below, the inclusion of these elements is designed to enumerate the core areas that Covered Entities would need to address when designing, implementing, and assessing their policies and procedures. Proposed Rule 10 also would require Covered Entities to review annually and assess their policies and procedures and prepare a written report describing the review and other related matters. Taken together, these requirements are designed to position Covered Entities to be better prepared to protect themselves against cybersecurity risks, to mitigate cybersecurity threats and vulnerabilities, and to recover from cybersecurity incidents. They are also designed to help ensure that Covered Entities focus their efforts and resources on the cybersecurity risks associated with their operations and business practices. The policies and procedures that would be required by proposed Rule 10—because they would need to address the Covered Entity’s cybersecurity risks—generally should be tailored to the nature and scope of the Covered Entity’s business and address the Covered Entity’s specific cybersecurity risks. Thus, proposed Rule 10 is not intended to impose a one-size-fits-all approach to addressing cybersecurity risks. In addition, cybersecurity threats are constantly evolving and measures to address those threats continue to evolve. Therefore, proposed Rule 10 is designed to provide Covered Entities with the flexibility to update and modify their policies and procedures as needed so that that they continue to be reasonably designed to address the Covered Entity’s cybersecurity risks over time. a. Risk Assessment Proposed Rule 10 would specify that the Covered Entity’s cybersecurity risk management policies and procedures must include policies and procedures that require periodic assessments of cybersecurity risks associated with the Covered Entity’s information systems and information residing on those systems.215 Further, with respect to the periodic assessments, the policies and procedures would need to include two components. First, the policies and procedures would need to provide that the Covered Entity will categorize and prioritize cybersecurity risks based on an inventory of the components of the Covered Entity’s information systems and information residing on those systems and the potential effect of a cybersecurity incident on the Covered Entity.216 As discussed earlier, proposed Rule 10 would define the term ‘‘cybersecurity risk’’ to mean financial, operational, legal, reputational, and other adverse consequences that could result from cybersecurity incidents, cybersecurity threats, and cybersecurity vulnerabilities.217 For example, Covered Entities may be subject to different cybersecurity risks as a result of, among other things: (1)
the functions they perform and the extent to which they use information systems to perform those functions; (2) the criticality of the functions they perform that rely on information systems; (3) the interconnectedness of their information systems with third-party information systems; (4) the software that operates on their information systems, including whether it is proprietary or vender￾supplied software; (5) the nature and volume of the information they store on information systems (e.g., personal, confidential, and/or proprietary information); (6) the complexity and scale of their information systems (i.e., the size of their IT footprint); (7) the location of their information systems; (8) the number of users authorized to access their information systems; (9) the types of devices permitted to access their information systems (e.g., company-owned or personal desktop computers, laptop computers, or smart phones); (10) the extent to which they conduct international operations and allow access to their information systems from international locations; and (11) the extent to which employees access their information systems from remote locations, including international locations. In categorizing and prioritizing cybersecurity risks, the Covered Entity generally should consider consulting with, among others, personnel familiar with the Covered Entity’s operations, its business partners, and third-party cybersecurity experts.218 In addition, a Covered Entity could consider an escalation protocol in its risk assessment plan to ensure that its senior officers, including appropriate legal and compliance personnel, receive necessary information regarding cybersecurity risks on a timely basis.219 Only after assessing, categorizing, and prioritizing its cybersecurity risks can a Covered Entity establish, maintain, and enforce reasonably designed cybersecurity policies and procedures under proposed Rule 10 to address those risks. A Covered Entity also would need to reassess and re-prioritize its cybersecurity risks periodically. The Covered Entity would need to determine the frequency of these assessments and the types of developments in

220See generally id. (‘‘Maintain awareness of current events related to cybersecurity. Be proactive; alert staff to hazards that the organization may encounter. Maintain vigilance by asking yourself: what types of cyber attack[s] are hitting my peers or others in my industry? What tactics were successful in helping my peers limit damage? What does my staff need to know to help protect the organization and each other? On a national￾level, are there any urgent cyber threats my staff need to know about?’’). 221The FS–ISAC is a global private industry cyber intelligence sharing community solely focused on financial services. Additional information about FS–ISAC is available at https://www.fsisac.com. Often, private industry groups maintain relationships and information sharing agreements with government cybersecurity organizations, such as CISA. Private sector companies, such as information technology and cybersecurity consulting companies, may have insights on cybersecurity (given the access their contractual status gives them to customer networks) that the government initially does not. See, e.g., Verizon DBIR; Microsoft Report. For example, private-sector cybersecurity firms may often be in the position to spot new malicious cybersecurity trends before they become more widespread and common. 222See paragraph (b)(1)(i)(A)(2) of proposed Rule 10; paragraphs (a)(6) and (7) of proposed Rule 10 (defining, respectively, the terms ‘‘information’’ and ‘‘information systems’’). Oversight of third-party service provider or vendor risk is a component of many cybersecurity frameworks. See, e.g., NIST Framework (discussing supply chain risks associated with products and services an organization uses). 223See GAO Cyber Security Report (‘‘Increased connectivity with third-party providers and the potential for increased cyber risk is a concern in the financial industry as core systems and critical data are moved offsite to third parties.’’). For purposes of proposed Rule 10, the Covered Entity’s assessment of service providers should not be limited to only certain service providers, such as those that provide core functions or services for the Covered Entity. Rather, the cybersecurity risk of any service provider that receives, maintains, or processes information, or is otherwise permitted to access the information systems of the Covered Entity and the information residing on those systems should be evaluated. Furthermore, it is possible that a service provider for a Covered Entity may itself be a Covered Entity under proposed Rule
10. For example, a carrying broker-dealer may be a
service provider for a number of introducing broker￾dealers. 224See paragraph (b)(1)(i)(B) of proposed Rule 10. 225See paragraph (b)(2) of proposed Rule 10 (which would require a Covered Entity to review and assess the design and effectiveness of the cybersecurity policies and procedures, including whether the policies and procedures reflect changes in cybersecurity risk over the time period covered by the review). See also section II.B.1.f. of this release (discussing the review proposal in more detail). 226See paragraph (b)(1)(ii) of proposed Rule 10; paragraphs (a)(6) and (7) of proposed Rule 10 (defining, respectively, the terms ‘‘information’’ and ‘‘information systems’’). See generally NIST Framework (providing that the second core element of the framework is ‘‘protect’’—meaning develop and implement appropriate safeguards to ensure delivery of critical services); CISA Cyber Essentials Starter Kit (stating with respect to user security and access that (among other things): (1) the authority and access granted employees, managers, and customers into an organization’s digital environment needs limits; (2) setting approved access privileges requires knowing who operates on an organization’s systems and with what level of authorization and accountability; and (3) organizations should ensure only those who belong on their ‘‘digital workplace have access’’); IOSCO Cybersecurity Report (stating that network access controls are one of the types of controls trading venues use as the protection function). 227See paragraph (b)(1)(ii)(A) of proposed Rule 10. 228See paragraph (b)(1)(ii)(B) of proposed Rule 10. cybersecurity risk that would trigger an assessment based on its particular circumstances. Consequently, the Covered Entity generally should consider whether to reassess its cybersecurity risks to reflect internal changes as they arise, such as changes to its business, online presence, or customer website access, or external changes, such as changes in the evolving technology and cybersecurity threat landscape.220 The Covered Entity generally should also consider raising any material changes in its risk assessment plan to senior officers, as appropriate. In assessing ongoing and emerging cybersecurity threats, a Covered Entity could monitor and consider updates and guidance from private sector and governmental resources, such as the FS–ISAC and CISA.221 Second, the policies and procedures would need to require the Covered Entity to identify its service providers that receive, maintain, or process information, or are otherwise permitted to access its information systems and the information residing on those systems, and assess the cybersecurity risks associated with its use of these service providers.222 Covered Entities are exposed to cybersecurity risks through the technology of their service providers.223 Having identified the relevant service providers, the Covered Entity would need to assess how they expose it to cybersecurity risks. In
identifying these cybersecurity risks, the service provider’s cybersecurity practices would be relevant, including:
(1) how the service provider protects itself against cybersecurity risk; and (2) its ability to respond to and recover from cybersecurity incidents. A Covered Entity generally should take into account whether a cybersecurity incident at a service provider could lead to process failures or the unauthorized access to or use of information or information systems. For example, a Covered Entity may use a cloud service provider to maintain required books and records. If all of the Covered Entity’s books and records were concentrated at this cloud service provider and a cybersecurity incident disrupts or degrades the cloud service provider’s information systems, there could potentially be detrimental data loss affecting the ability of the Covered Entity to provide services and comply with regulatory obligations. Accordingly, as part of identifying the cybersecurity risks associated with using a cloud service provider, a Covered Entity should consider how the service provider will secure and maintain data and whether the service provider has response and recovery procedures in place such that any compromised or lost data in the event of a cybersecurity incident can be recovered and restored. Finally, the Covered Entity’s risk assessment policies and procedures would need to require written documentation of these risk assessments.224 This documentation would be relevant to the reviews performed by the Covered Entity to analyze whether the policies and procedures need to be updated, to inform the Covered Entity of risks specific to it, and to support responses to cybersecurity risks by identifying cybersecurity threats to information systems that, if compromised, could result in significant cybersecurity incidents.225 It also could be used by Commission and SRO staff and possibly internal auditors of the Covered Entity to examine for adherence to the risk assessment policies and procedures. b. User Security and Access Proposed Rule 10 would specify that the Covered Entity’s cybersecurity risk management policies and procedures must include controls designed to minimize user-related risks and prevent unauthorized access to the Covered Entity’s information systems and the information residing on those systems.226 Further, the rule would require that these policies and procedures include controls addressing five specific aspects relating to user security and access. First, there would need to be controls requiring standards of behavior for individuals authorized to access the Covered Entity’s information systems and the information residing on those systems, such as an acceptable use policy.227 Second, there would need to be controls for identifying and authenticating individual users, including but not limited to implementing authentication measures that require users to present a combination of two or more credentials for access verification.228 Third, there would need to be controls for establishing procedures for the timely distribution, replacement, and
revocation of passwords or methods of

229See paragraph (b)(1)(ii)(C) of proposed Rule 10. 230See paragraph (b)(1)(ii)(D) of proposed Rule 10. 231See paragraph (b)(1)(ii)(E) of proposed Rule 10; paragraphs (a)(6) and (7) of proposed Rule 10 (defining, respectively, the terms ‘‘information’’ and ‘‘information systems’’). 232See generally CISA Cyber Essentials Starter Kit (stating that organizations should (among other things): (1) learn who is on their networks and maintain inventories of network connections (e.g., user accounts, vendors, and business partners); (2) leverage multi-factor authentication for all users, starting with privileged, administrative and remote access users; (3) grant access and administrative permissions based on need-to-know basis; (4) leverage unique passwords for all user accounts; and (5) develop IT policies and procedures addressing changes in user status (e.g., transfers and terminations). 233See generally CISA Cyber Essentials Starter Kit (stating that organizations should (among other things) leverage basic cybersecurity training to improve exposure to cybersecurity concepts, terminology, and activates associated with implementing cybersecurity best practices). 234See generally NIST Framework (‘‘The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event. Examples of outcome Categories within this Function include:
Identity Management and Access Control; Awareness and Training; Data Security; Information Protection Processes and Procedures; Maintenance; and Protective Technology.’’); IOSCO Cybersecurity Report (‘‘There are numerous controls and protection measures that regulated entities may wish to consider in enhancing their cyber security. Such measures can be organizational (like the establishment of security operations centers) or technical (like anti-virus and intrusion prevention systems). Risk assessments help determine the minimum level of controls to be implemented within a project, an application or a database. In addition, employee training and awareness initiatives are critical parts of any cyber security program, including induction programs for newcomers, general training, as well as more specific training (for instance, social engineering awareness). Proficiency tests could be conducted to demonstrate staff understanding and third party training could also be organized. Other initiatives which contribute to raising employees’ awareness of cyber security threats include monthly security bulletins emailed to all employees, regular communications regarding new issues and discovered vulnerabilities, use of posters and screen savers, and regular reminders sent to employees. Mock tests can also be conducted to assess employees’ preparedness. Employees are also often encouraged to report possible attacks.’’). 235See paragraph (b)(1)(iii) of proposed Rule 10. authentication.229 Fourth, there would need to be controls for restricting access to specific information systems of the Covered Entity or components thereof and the information residing on those systems solely to individuals requiring access to the systems and information as is necessary for them to perform their responsibilities and functions on behalf of the Covered Entity.230 Fifth, there would need to be controls for securing remote access technologies.231 The objective of these policies, procedures, and controls would be to protect the Covered Entity’s information systems from unauthorized access and improper use. There are a variety of controls that a Covered Entity, based on its particular circumstances, could include in these policies and procedures to make them reasonably designed to achieve this objective. For example, access to information systems could be controlled through the issuance of user credentials, digital rights management with respect to proprietary hardware and copyrighted software, authentication and authorization methods (e.g., multi-factor authentication and geolocation), and tiered access to personal, confidential, and proprietary information and data and network resources.232 Covered Entities may wish to consider multi￾factor authentication methods that are not based solely on SMS-delivery (e.g., text message delivery) of authentication codes, because SMS-delivery methods may provide less security than other non-SMS based multi-factor authentication methods.
Furthermore, Covered Entities could require employees to attend cybersecurity training on how to secure sensitive data and recognize harmful files prior to obtaining access to certain information systems. The training generally could address best practices in creating new passwords, filtering through suspicious emails, or browsing the internet.233 Further, a Covered Entity could use controls to monitor user access regularly in order to remove users that are no longer authorized. These controls generally should address the Covered Entity’s employees (e.g., removing access for employees that leave the firm) and external users of the Covered Entity’s information systems (e.g., customers that no longer use the firm’s services or external service providers that no longer are under contract with the firm to provide it with any services). In addition, controls to monitor for unauthorized login attempts and account lockouts, and the handling of customer requests, including for user name and password changes, could be a part of reasonably designed policies and procedures. Similarly, controls to assess the need to authenticate or investigate any unusual customer, member, or user requests (e.g., wire transfer or withdrawal requests) could be a part of reasonably designed policies and procedures. A Covered Entity also generally should take into account the types of technology through which its users access the Covered Entity’s information systems. For example, mobile devices (whether firm-issued or personal devices) that allow employees to access information systems and personal, confidential, or proprietary information residing on these systems may create additional and unique vulnerabilities, including when such devices are used internationally. Consequently, controls limiting mobile or other devices approved for remote access to those issued by the firm or enrolled through a mobile device manager could be part of reasonably designed policies and procedures. In addition, a Covered Entity could consider controls with respect to its network perimeter such as securing remote network access used by teleworking and traveling employees. This could include controls to identify threats on a network’s endpoints. For example, Covered Entities could consider using software that monitors and inspects all files on an endpoint, such as a mobile phone or remote laptop, and identifies and blocks incoming unauthorized communications. Covered Entities generally would need to consider potential user-related and access risks relating to the remote access technologies used at their remote work and telework locations to include controls designed to secure such technologies. For example, a Covered Entity’s personnel working remotely from home or a co-working space may create unique cybersecurity risks—such as unsecured or less secure Wi-Fi—that threat actors could exploit to access the Covered Entity’s information systems and the information residing on those systems.
Accordingly, a Covered Entity could consider whether its user security and access policies, procedures, and controls should have controls requiring approval of mobile or other devices for remote access, and whether training on device policies would be appropriate. The training for remote workers in particular could focus on phishing, social engineering, compromised passwords, and the consequences of weak network security.
c. Information Protection
Information protection is a key aspect of managing cybersecurity risk.234 Therefore, proposed Rule 10 would specify that the Covered Entity’s cybersecurity risk management policies and procedures would need to address information protection in two ways.235 First, the policies and procedures would need to include measures designed to protect the Covered Entity’s information systems and protect the information residing on those systems from unauthorized access or use, based on a periodic assessment of the Covered

236See paragraph (b)(1)(iii)(A) of proposed Rule 10; paragraphs (a)(6) and (7) of proposed Rule 10 (defining, respectively, the terms ‘‘information’’ and ‘‘information systems’’). See generally CISA Cyber Essentials Starter Kit (‘‘Learn what information resides on your network. Inventory critical or sensitive information. An inventory of information assets provides an understanding of what you are protecting, where that information resides, and who has access. The inventory can be tracked in a spreadsheet, updated quickly and frequently’’). 237See paragraph (a)(9) of proposed Rule 10 (defining the term ‘‘personal information’’). 238See generally CISA Cyber Essentials Starter Kit (‘‘Leverage malware protection capabilities. Malware is designed to spread quickly. A lack of defense against it can completely corrupt, destroy or render your data inaccessible.’’). 239See paragraphs (b)(1)(iii)(A)(1) through (5) of proposed Rule 10. See generally CISA Cyber Essentials Starter Kit (‘‘Learn how your data is protected. Data should be handled based on its importance to maintaining critical operations in order to understand what your business needs to operate at a basic level. For example, proprietary research, financial information, or development data need protection from exposure in order to maintain operations. Understand the means by which your data is currently protected; focus on where the protection might be insufficient. Guidance from the Cyber Essentials Toolkits, including authentication, encryption, and data protection help identify methods and resources for how to best secure your business information and devices.’’). 240See paragraph (b)(1)(iii)(B) of proposed Rule 10; paragraphs (a)(6) and (7) of proposed Rule 10 (defining, respectively, the terms ‘‘information’’ and ‘‘information systems’’). 241See paragraph (b)(1)(iv) of proposed Rule 10; paragraphs (a)(4) through (7) of proposed Rule 10 (defining, respectively, the terms ‘‘cybersecurity threat,’’ ‘‘cybersecurity vulnerability,’’ ‘‘information,’’ and ‘‘information systems’’). See generally NIST Framework (providing that the third core element of the framework is ‘‘detect’’— meaning develop and implement appropriate activities to identify the occurrence of a cybersecurity event); CISA Cyber Essentials Starter Kit (stating regarding detection that organizations should (among other things): (1) learn what is happening on their networks; (2) manage network and perimeter components, host and device components, data at rest and in transit, and user behavior and activities: and (3) actively maintain information as it will provide a baseline for security testing, continuous monitoring, and making security-based decisions); IOSCO Cybersecurity Report (‘‘External and internal monitoring of traffic and logs generally should be used to detect abnormal patterns of access (e.g., abnormal user activity, odd connection durations, and unexpected connection sources) and other anomalies. Such detection is
crucial as attackers can use the period of presence in the target’s systems to expand their footprint and their access gaining elevated privileges and control over critical systems. Many regulated entities have dedicated cyber threat teams and engage in file servers integrity and database activity monitoring to prevent unauthorized modification of critical servers within their organization’s enterprise network. Different alarm categories and severity may be defined.’’). 242See section I.A.2. of this release (discussing how Covered Entities use information systems). Entity’s information systems and the information that resides on the systems.236 The periodic assessment would need to take into account: (1) the sensitivity level and importance of the information to the Covered Entity’s business operations; (2) whether any of the information is personal information; 237 (3) where and how the information is accessed, stored and transmitted, including the monitoring of information in transmission; (4) the information systems’ access controls and malware protection; 238 and (5) the potential effect a cybersecurity incident involving the information could have on the Covered Entity and its customers, counterparties, members, registrants, or users, including the potential to cause a significant cybersecurity incident.239 By performing these assessments, a Covered Entity should be able to determine the measures it would need to implement to prevent the unauthorized access or use of information residing on its information systems. Measures that could be used for this purpose include encryption, network segmentation, and access controls to ensure that only authorized users have access to personal, confidential, and proprietary information and data or critical systems. Measures to identify suspicious behavior also could be used for this purpose. These measures could include consistent monitoring of systems and personnel, such as the generation and review of activity logs, identification of potential anomalous activity, and escalation of issues to senior officers, as appropriate. Further data loss prevention measures could include processes to identify personal, confidential, or proprietary information and data (e.g., account numbers, Social Security numbers, trade information, and source code) and block its transmission to external parties. Additional measures could include testing of systems, including penetration tests. A Covered Entity also could consider measures to track the actions taken in response to findings from testing and monitoring, material changes to business operations or technology, or any other significant events. Appropriate measures for preventing the unauthorized use of information may differ depending on the circumstances of a Covered Entity, such as the systems used by the Covered Entity, the Covered Entity’s relationship with service providers, or the level of access granted by the Covered Entity to employees or contractors.
Appropriate measures generally should evolve with changes in technology and the increased sophistication of cybersecurity attacks. Second, the policies and procedures for protecting information would need to require oversight of service providers that receive, maintain, or process the Covered Entity’s information, or are otherwise permitted to access the Covered Entity’s information systems and the information residing on those systems, pursuant to a written contract between the covered entity and the service provider.240 Further, pursuant to that written contract, the service provider would be required to implement and maintain appropriate measures, including the practices described in paragraphs (b)(1)(i) through (v) of proposed Rule 10, that are designed to protect the Covered Entity’s information systems and information residing on those systems. These policies and procedures could include measures to perform due diligence on a service provider’s cybersecurity risk management prior to using the service provider and periodically thereafter during the relationship with the service provider. Covered Entities also could consider including periodic contract review processes that allow them to assess whether, and help to ensure that, their agreements with service providers contain provisions that require service providers to implement and maintain appropriate measures designed to protect the Covered Entity’s information systems and information residing on those systems. d. Cybersecurity Threat and Vulnerability Management Rule 10 would specify that the Covered Entity’s cybersecurity risk management policies and procedures must include measures designed to detect, mitigate, and remediate any cybersecurity threats and vulnerabilities with respect to the Covered Entity’s information systems and information residing on those systems.241 Because Covered Entities depend on information systems to process, store, and transmit personal, confidential, and proprietary information and data and to conduct critical business functions, it is essential that they manage cybersecurity threats and vulnerabilities effectively.242 Moreover, detecting, mitigating, and remediating threats and vulnerabilities is essential to preventing significant cybersecurity incidents. Measures to detect cybersecurity threats and vulnerabilities could include ongoing monitoring (e.g., comprehensive examinations and risk management processes), including, for example, conducting network, system, and application vulnerability assessments. This could include scans or reviews of internal systems, externally facing systems, new systems, and systems used by service providers. Further, measures could include monitoring industry and government

243See generally CISA, National Cyber Awareness System—Alerts, available at https://us￾cert.cisa.gov/ncas/alerts (providing information about current security issues, vulnerabilities, and exploits). 244See generally CISA Cyber Essentials Starter Kit (stating that organizations should: (1) enable automatic updates whenever possible; (2) replace unsupported operating systems, applications and hardware; and (3) test and deploy patches quickly). 245See generally CISA Cyber Essentials Starter Kit (‘‘Leverage basic cybersecurity training. Your staff needs a basic understanding of the threats they encounter online in order to effectively protect your organization. Regular training helps employees understand their role in cybersecurity, regardless of technical expertise, and the actions they take help keep your organization and customers secure. Training should focus on threats employees encounter, like phishing emails, suspicious events to watch for, and simple best practices individual employees can adopt to reduce risk. Each aware employee strengthens your network against attack, and is another ‘sensor’ to identify an attack.’’). 246See paragraph (b)(1)(v) of proposed Rule 10; paragraph (c)(2) of proposed Rule 10 (defining the term ‘‘cybersecurity incident’’). See generally NIST Framework (providing that the fourth core element of the framework is ‘‘respond’’—meaning develop and implement appropriate activities to take action regarding a detected cybersecurity incident; and providing that the fifth core element of the framework is ‘‘recover’’—meaning develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident). 247See paragraphs (a)(6) and (7) of proposed Rule 10 (defining, respectively, the terms ‘‘information’’ and ‘‘information systems’’). 248See section II.B.2. of this release (discussing the requirements to report significant cybersecurity incidents); paragraph (a)(10) of proposed Rule 10 (defining the term ‘‘significant cybersecurity incident’’). See generally CISA Cyber Essentials Starter Kit (stating regarding response and recovery that the objective is to limit damage and accelerate restoration of normal operations and, to this end, organizations (among other things) can: (1) leverage business impact assessments to prioritize resources and identify which systems must be recovered first; (2) ‘‘learn who to call for help (e.g., outside partners, vendors, government/industry responders, technical advisors and law enforcement);’’ (3) develop an internal reporting structure to detect, communicate and contain attacks; and (4) develop in-house containment measures to limit the impact of cyber incidents when they occur); IOSCO Cybersecurity Report (‘‘Regulated entities generally should consider developing response plans for those types of incidents to which the organization is most likely to be subject. Elements associated with response
plans may include: preparing communication/notification plans to inform relevant stakeholders; conducting forensic analysis to understand the anatomy of a breach or an attack; maintaining a database recording cyber attacks; and conducting cyber drills, firm specific simulation exercises as well as industry-wide scenario exercises.’’). 249See sections I.A.1. and I.A.2. of this release (discussing these consequences). 250 Id. 251See generally CISA Cyber Essentials Starter Kit (‘‘Plan, prepare, and conduct drills for cyber-attacks and incidents as you would a fire or robbery. Make your reaction to cyber incidents or system outages an extension of your other business contingency plans. This involves having incident response plans and procedures, trained staff, assigned roles and responsibilities, and incident communications plans.’’). sources for new threat and vulnerability information that may assist in detecting cybersecurity threats and vulnerabilities.243 Measures to mitigate and remediate an identified threat or vulnerability are more effective if they minimize the window of opportunity for attackers to exploit vulnerable hardware and software. These measures could include, for example, implementing a patch management program to ensure timely patching of hardware and software vulnerabilities and maintaining a process to track and address reports of vulnerabilities.244 Covered Entities also generally should consider the vulnerabilities associated with ‘‘end of life systems’’ (i.e., systems in which software is no longer supported by the particular vendor and for which security patches are no longer issued). These measures also could establish accountability for handling vulnerability reports by, for example, establishing processes for their intake, assignment, escalation, remediation, and remediation testing. For example, a Covered Entity could use a vulnerability tracking system that includes severity ratings, and metrics for measuring the time it takes to identify, analyze, and remediate vulnerabilities. Covered Entities also could consider role-specific cybersecurity threat and vulnerability response training.245 For example, training could include secure system administration courses for IT professionals, vulnerability awareness and prevention training for web application developers, and social engineering awareness training for employees and executives. Covered Entities that do not proactively address threats and discovered vulnerabilities face an increased likelihood of having their information systems—including the Covered Entity’s information residing on those systems—accessed or disrupted by threat actors or otherwise compromised. The requirement for Covered Entities to include cybersecurity threats and vulnerabilities measures in their cybersecurity policies and procedures is designed to address this risk and help ensure threats and vulnerabilities are adequately and proactively addressed by Covered Entities. e. Cybersecurity Incident
Response and Recovery Proposed Rule 10 would specify that the Covered Entity’s cybersecurity risk management policies and procedures must include measures designed to detect, respond to, and recover from a cybersecurity incident.246 Further, the rule would require that these measures include policies and procedures that are reasonably designed to ensure: (1) the continued operations of the Covered Entity; (2) the protection of the Covered Entity’s information systems and the information residing on those systems; 247 (3) external and internal cybersecurity incident information sharing and communications; and (4) the reporting of significant cybersecurity incidents pursuant to the requirements of paragraph (c) of proposed Rule 10 discussed below.248 Cybersecurity incidents can lead to significant business disruptions, including losing the ability to send internal or external communications, transmit information, or connect to internal or external systems necessary to carry out the Covered Entity’s critical functions and provide services to customers, counterparties, members, registrants, or users.249 They also can lead to the inability to access accounts holding cash or other financial assets of the Covered Entity or its customers, counterparties, members, registrants, or users.250 Therefore, the proposed incident response and recovery policies and procedures are designed to place the Covered Entity in a position to respond to a cybersecurity incident, which should help to reduce business disruptions and other harms the incident may cause the Covered Entity or its customers, counterparties, members, registrants, or users. A cybersecurity program with a clear incident response plan designed to ensure continued operational capability, and the protection of, and access to, personal, confidential, or proprietary information and data, even if a Covered Entity loses access to its systems, would assist in mitigating the effects of a cybersecurity incident.251 A Covered Entity, therefore, may wish to consider maintaining physical copies of its incident response plan—and other cybersecurity policies and procedures— to help ensure they can be accessed and implemented during a cybersecurity incident. Covered Entities generally should focus on operational capability in creating reasonably designed policies and procedures to ensure their continued operations in the event of a cybersecurity incident (e.g., the ability to withstand a DoS attack). The objective is to place Covered Entities in a position to be able to continue providing services to other Market Entities and other participants in the U.S. securities markets (including investors) and, thereby, continue to support the fair, orderly, and efficient

252See generally CISA Cyber Essentials Starter Kit (‘‘Leverage protections for backups, including physical security, encryption and offline copies. Ensure the backed-up data is stored securely offsite or in the cloud and allows for at least seven days of incremental rollback. Backups should be stored in a secure location, especially if you are prone to natural disasters. Periodically test your ability to recover data from backups. Online and cloud storage backup services can help protect against data loss and provide encryption as an added level of security. Identify key files you need access to if online backups are unavailable to access your files when you do not have an internet connection.’’). 253See generally CISA Cyber Essentials Starter Kit (stating that: (1) organizations should develop an internal reporting structure to detect, communicate, and contain attacks and that effective communication plans focus on issues unique to security breaches; (2) a standard reporting procedure will reduce confusion and conflicting information between leadership, the workforce, and stakeholders; and (3) communication should be continuous, since most data breaches occur over a long period of time and not instantly and that it should come from top leadership to show commitment to action and knowledge of the situation). 254See paragraph (c)(1) of proposed Rule 10. See also section II.B.2. of this release (discussing this proposed notification requirement in more detail). 255See paragraph (c)(2) of proposed Rule 10. See also section II.B.2. of this release (discussing this proposed reporting requirement in more detail). 256The circumstances under which an amended
Part I of proposed Form SCIR would need to be
filed are discussed below in section II.B.2. of this release. 257See paragraph (b)(1)(v)(A)(4) of proposed Rule 10. 258For example, the FBI has instructed individuals and organizations to contact their nearest FBI field office to report cybersecurity incidents or to report them online at https:// www.ic3.gov/Home/FileComplaint. See FBI, What We Investigate, Cyber Crime, available at https:// www.fbi.gov/investigate/cyber. See also CISA Cyber Essentials Starter Kit (‘‘As part of your incident response, disaster recovery, and business continuity planning efforts, identify and document partners you will call on to help. Consider building these relationships in advance and understand what is required to obtain support. CISA and the Federal Bureau of Investigation (FBI) provide dedicated hubs for helping respond to cyber and critical infrastructure attacks. Both have resources and guidelines on when, how, and to whom an incident is to be reported in order to receive assistance. You should also file a report with local law enforcement, so they have an official record of the incident.’’). 259See generally CISA Cyber Essentials Starter Kit (‘‘Lead development of an incident response and disaster recovery plan outlining roles and responsibilities. Test it often. Incident response plans and disaster recovery plans are crucial to information security, but they are separate plans. Incident response mainly focuses on information asset protection, while disaster recovery plans focus on business continuity. Once you develop a plan, test the plan using realistic simulations (known as ‘‘war-gaming’’), where roles and responsibilities are assigned to the people who manage cyber incident responses. This ensures that your plan is effective and that you have the appropriate people involved in the plan. Disaster recovery plans minimize recovery time by efficiently recovering critical systems.’’). 260See paragraph (b)(1)(v)(B) of proposed Rule 10. 261See paragraph (b)(2) of proposed Rule 10. operation of the U.S. securities markets. For example, this requirement is designed to place Covered Entities in a position to be able to continue to perform market and member surveillance and oversight in the case of SROs, clearance and settlement in the case of clearing agencies, and brokerage or dealing activities in the case of broker-dealers and SBSDs. The ability of Covered Entities to recover from a cybersecurity incident in a timeframe that minimizes disruptions to their business or regulatory activities is critically important to the fair, orderly, and efficient operations of the U.S. securities markets and, therefore, to the U.S. economy, investors, and capital formation. A Covered Entity generally should consider implementing safeguards, such as backing up data, which can help facilitate a prompt recovery that allows the Covered Entity to resume operations following a cybersecurity incident.252 A Covered Entity also generally should consider whether to designate
personnel to perform specific roles in the case of a cybersecurity incident. This could entail identifying and/or hiring personnel or third parties who have the requisite cybersecurity and recovery expertise (or are able to coordinate effectively with outside experts) as well as identifying personnel who should be kept informed throughout the response and recovery process. In addition, a Covered Entity could consider an escalation protocol in its incident response plan to ensure that its senior officers, including appropriate legal and compliance personnel, receive necessary information regarding cybersecurity incidents on a timely basis.253 Moreover, as discussed in further detail below, under proposed Rule 10, a Covered Entity would need to give the Commission immediate written electronic notice of a significant cybersecurity incident after having a reasonable basis to conclude that the incident has occurred or is occurring.254 Further, the Covered Entity would need to report information about the significant cybersecurity incident promptly, but no later than 48 hours, after having a reasonable basis to conclude that the incident has occurred or is occurring by filing Part I of proposed Form SCIR with the Commission.255 Thereafter, the Covered Entity would need to file an amended
Part I of proposed Form SCIR with the
Commission under certain circumstances.256 Accordingly, proposed Rule 10 would require the Covered Entity to include in its incident response and recovery policies and procedures measures designed to ensure compliance with these notification and reporting requirements.257 The Covered Entity also may wish to implement a process to determine promptly whether and how to contact local and Federal law enforcement authorities, such as the FBI, about an incident.258 A Covered Entity also could consider including periodic testing requirements in its incident response and recovery policies and procedures.259 These tests could assess the efficacy of the policies and procedures to determine whether any changes are necessary, for example, through tabletop or full-scale exercises. Relatedly, proposed Rule 10 would require that the incident response and recovery policies and procedures include written documentation of a cybersecurity incident, including the Covered Entity’s response to and recovery from the incident.260 This record could be used by the Covered Entity to assess the efficacy of, and adherence to, its incident response and recovery policies and procedures. It further could be used as a ‘‘lessons￾learned’’ document to help the Covered Entity respond more effectively the next time it experiences a cybersecurity incident. The Commission staff and SRO staff also would use the records to review compliance with this aspect of proposed Rule 10. f. Annual Review and Required Written Reports In addition to requiring a Covered Entity to establish, maintain, and enforce written policies and procedures to address cybersecurity risk, proposed Rule 10 would require the Covered Entity, at least annually, to: (1) review and assess the design and effectiveness of the cybersecurity policies and procedures, including whether the policies and procedures reflect changes in cybersecurity risk over the time period covered by the review; and (2) prepare a written report that describes the review, the assessment, and any control tests performed, explains their results, documents any cybersecurity incident that occurred since the date of the last report, and discusses any material changes to the policies and procedures since the date of the last report.261 The annual review requirement is designed to require the Covered Entity to evaluate whether its cybersecurity policies and procedures continue to work as designed. In making this assessment, Covered Entities generally should consider whether changes are needed to ensure their continued effectiveness, including oversight of any delegated responsibilities. As discussed earlier, the sophistication of the tactics,

262See section I.A.1. of this release (discussing, for example, how cybersecurity threats are evolving); see also Bank of England CBEST Report (stating that ‘‘[t]he threat actor community, once dominated by amateur hackers, has expanded to include a broad range of professional threat actors, all of whom are strongly motivated, organised and funded’’). 263See paragraph (b)(1)(i) of proposed Rule 10. See also section II.B.1.a. of this release (discussing the assessment proposal in more detail). 264See paragraph (b)(2)(ii) of proposed Rule 10. techniques, and procedures employed by threat actors is increasing.262 The review requirement is designed to impose a discipline on Covered Entities to be vigilant in assessing whether their cybersecurity risk management policies and procedures continue to be reasonably designed to address this risk. The review would need to be conducted no less frequently than annually. As discussed above, one of the required elements that would need to be included in the policies and procedures is the requirement to perform periodic assessments of cybersecurity risks associated with the covered entity’s information systems and information residing on those systems.263 Based on the findings of those risk assessments, a Covered Entity could consider whether to perform a review prior to the one-year anniversary of the last review. In addition, the occurrence of a cybersecurity incident or significant cybersecurity incident impacting the Covered Entity or other entities could cause the Covered Entity to consider performing a review before the next annual review is required. The Covered Entity would need to document the review in a written report.264 The required written report generally should be prepared or overseen by the persons who administer the Covered Entity’s cybersecurity program. This report requirement is designed to assist the Covered Entity in evaluating the efficacy of organization’s cybersecurity risk management policies and procedures. Additionally, the requirement to review and assess the design and effectiveness of the cybersecurity policies and procedures includes whether they reflect changes in cybersecurity risk over the time period covered by the review. Therefore, the Covered Entity generally would need to take into account the periodic assessments of cybersecurity risks performed pursuant to the requirements of paragraphs (b)(1)(i)(A) and (b)(1)(iii)(A) of proposed Rule. This could provide Covered Entities with valuable insights into potential enhancements to the policies and procedures to keep them up-to-date (i.e., reasonably designed to address emerging cybersecurity threats). For example, incorporating the cybersecurity risk assessments into the required written report could provide senior officers who review the report with information on the specific risks identified in the assessments. This could lead them to ask questions and seek relevant information regarding the effectiveness of the Covered
Entity’s cybersecurity risk management policies and procedures and its implementation in light of those risks. This could include questions as to whether the Covered Entity has adequate resources with respect to cybersecurity matters, including access to cybersecurity expertise. g. Request for Comment The Commission requests comment on all aspects of the requirements that Covered Entities establish, maintain, and enforce written policies and procedures to address their cybersecurity risks, the elements that would need to be included in the cybersecurity risk management policies and procedures, and the required (at least) annual review of the cybersecurity risk management policies and procedure under paragraph (b) of proposed Rule
10. In addition, the Commission is
requesting comment on the following specific aspects of the proposals:
21. In designing the cybersecurity risk
management policies and procedures requirements of proposed Rule 10, the Commission considered a number of sources cited in the sections above, including, in particular, the NIST Framework and the CISA Cyber Essentials Starter Kit. Are there other sources the Commission should use? If so, identify them and explain why they should be considered and how they could inform potential modifications to the cybersecurity risk management policies and procedures requirements.
22. Should the policies and
procedures requirements of paragraph (b)(1) of proposed Rule 10 be modified? For example, are there other elements that should be included in cybersecurity risk management policies and procedures? If so, identify them and explain why they should be included. Should any of the minimum required elements be eliminated? If so, identify them and explain why it would be appropriate to eliminate them from the rule.
23. Should the policies and
procedures requirements of paragraph (b)(1) of proposed Rule 10 be modified to provide more flexibility in how a Covered Entity implements them? If so, identify the requirements that are too prescriptive and explain why and suggest ways to make them more flexible without undermining the objective of having Covered Entities adequately address cybersecurity risks.
24. Should the policies and
procedures requirements of paragraph (b)(1) of proposed Rule 10 be modified to provide less flexibility in how a Covered Entity had to implement them? If so, identify the requirements that should be more prescriptive and explain why and suggest ways to make them more prescriptive without undermining the objective of having Covered Entities implement cybersecurity risk management policies and procedures that address their particular circumstances.
25. Should the policies and
procedures requirements of paragraph (b)(1) of proposed Rule 10 be deemed to be reasonably designed if they are consistent with industry standards comprised of cybersecurity risk management practices that are widely available to cybersecurity professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization? If so, identify the standard or standards and explain why it would be appropriate to deem the policies and procedures requirements of paragraph (b)(1) of proposed Rule 10 reasonably designed if they are consistent with the standard or standards.
26. The policies and procedures
requirements of paragraph (b)(1) of proposed Rule 10 would require Covered Entities to cover ‘‘information’’ and ‘‘information systems’’ as defined, respectively, in paragraphs (a)(6) and (7) of proposed Rule 10 without limitation. Should the proposed policies and procedures requirements of paragraph (b)(1) of proposed Rule 10 be modified to address a narrower set of information and information systems? If so, describe how the narrower set of information and information systems should be defined and why it would be appropriate to limit the policies and procedures requirements to this set of information and information systems. For example, should the policies and procedures requirements of paragraph (b)(1) of proposed Rule 10 be limited to information and information systems that, if compromised, would result in, or would be reasonably likely to result in, harm to the Covered Entity or others? If so, explain why. If not, explain why not. Is there another way to limit the application of the policies and procedures requirements to certain information and information systems that would not undermine the objective

265See CISA, Bad Practices, available at https:// www.cisa.gov/BadPractices. 266See FFIEC, Authentication and Access to Financial Institution Services and Systems (Aug. 2021), available at https://www.ffiec.gov/guidance/ Authentication-and-Access-to-Financial-Institution￾Services-and-Systems.pdf. See also FDIC and the Office of the Comptroller of the Currency (‘‘OCC’’), Joint Statement on Heightened Cybersecurity Risk (Jan. 16, 2020), available at https://www.occ.gov/ news-issuances/bulletins/2020/bulletin-2020-5a.pdf (noting that identity and access management controls include multifactor authentication to segment and safeguard access to critical systems and data on an organization’s network). that Covered Entities implement policies and procedures that adequately address their cybersecurity risks? If so, explain how.
27. Should the requirements of
paragraph (b)(1)(i) of proposed Rule 10 relating to periodic assessments of the cybersecurity risks associated with the Covered Entity’s information systems and information residing on those systems be modified? If so, explain why. If not, explain why not.
28. Should the requirements of
paragraph (b)(1)(i)(A)(1) of proposed Rule 10 relating to categorizing and prioritizing cybersecurity risks based on an inventory of the components of the Covered Entity’s information systems and information residing on those systems and the potential effect of a cybersecurity incident on the Covered Entity be modified? If so, explain why. If not, explain why not.
29. Should the requirements of
paragraph (b)(1)(i)(A)(2) of proposed Rule 10 relating to identifying the Covered Entity’s service providers that receive, maintain, or process information, or are otherwise permitted to access the Covered Entity’s information systems and any of the Covered Entity’s information residing on those systems, and assess the cybersecurity risks associated with the Covered Entity’s use of these service providers be modified? If so, explain why. If not, explain why not. Certain Covered Entities may use data feeds from third-party providers that do not receive, maintain, or process information for the Covered Entity but that could nonetheless cause significant disruption for the Covered Entity if they were the subject of a cybersecurity incident. For example, broker-dealers may subscribe to third-party data feeds to satisfy their obligations for best execution under the federal securities laws. If a third-party provider of data feeds experienced a cybersecurity breach, it could lead to faulty market information being shared with the broker-dealer, which could in turn impact the broker-dealer’s ability to operate and execute trades for its customers. Likewise, SBS Entities might rely on data from counterparties. Should the Commission require the risk assessment to include service providers that provide data feeds to Covered Entities but do not otherwise have access to the Covered Entities’ information systems? If so, should the risk assessment be limited to only those third parties who provide data critical to the Covered Entity’s business operations? Are there other cybersecurity risks associated with utilizing a third party who provides data feeds that should be addressed? If so, identify the risks and explain how they could be addressed.
30. Should the requirements of
paragraph (b)(1)(i)(B) of proposed Rule 10 relating to requiring written documentation of the risk assessments required by paragraph (b)(1)(i)(A) of proposed Rule 10 be modified? If so, explain why. If not, explain why not.
31. Should the requirements of
paragraph (b)(1)(ii) of proposed Rule 10 relating to controls designed to minimize user-related risks and prevent unauthorized access to the Covered Entity’s information systems and the information residing on those systems? If so, explain why. If not, explain why not. Should requirements of paragraph (b)(1)(ii) of proposed Rule 10 be modified to revise the requirement to include the following identified controls: (1) controls requiring standards of behavior for individuals authorized to access the Covered Entity’s information systems and the information residing on those systems, such as an acceptable use policy; (2) controls identifying and authenticating individual users, including but not limited to implementing authentication measures that require users to present a combination of two or more credentials for access verification; (3) controls establishing procedures for the timely distribution, replacement, and revocation of passwords or methods of authentication; (4) controls restricting access to specific information systems of the Covered Entity or components thereof and the information residing on those systems solely to individuals requiring access to the systems and information as is necessary for them to perform their responsibilities and functions on behalf of the Covered Entity; and (5) securing remote access technologies? If so, explain why. If not, explain why not. For example, should this paragraph of the proposed rule be modified to include any additional type of controls? If so, identify the controls and explain why they should be included. Should the text of the proposed controls be modified? For example, should the control pertaining to the timely distribution, replacement, and revocation of passwords or methods of authentication use a word other than ‘‘distribution’’? If so, explain why and suggest an alternative word that would be more appropriate. Would ‘‘establishment’’ or ‘‘setting up’’ be more appropriate in this context? Should this paragraph of the proposed rule be modified to eliminate any of the identified controls? If so, identify the control and explain why it should be eliminated. For example, could the control pertaining to implementing authentication measures requiring users to present a combination of two or more credentials for access verification potentially become obsolete? If so, explain why and suggest an alternative control that could incorporate this requirement as well as other authentication controls that may develop in the future.
32. CISA has developed a catalog of
cyber ‘‘bad practices’’ that are exceptionally risky and can increase risk to an organization’s critical infrastructure.265 These bad practices include the use of unsupported (or end￾of-life) software, use of known or default passwords and credentials, and the use of single-factor authentication. In addition, the Federal Financial Institutions Examination Council (‘‘FFIEC’’) has issued guidance on authentication and access to financial institution services and systems, and suggests that the use of single-factor authentication as a control mechanism has shown to be inadequate against certain cyber threats and adverse impacts from ransomware, customer account fraud, and identity theft.266 Instead, the FFIEC guidance suggests the use of multi-factor authentication and other measures, such as specific authentication solutions, password controls, and access and transaction controls. Should paragraph (b)(1)(ii) of proposed Rule 10 be modified to specifically require controls that users provide multi-factor authentication before they can access an information system of the Covered Entity? If so, explain why. If not, explain why not. Would it be appropriate to require multi-factor authentication for all of the Covered Entity’s information systems or for a more limited set of information systems? For example, should multi￾factor authentication be required for public-facing information systems such as applications that provide users access to their accounts at the Covered Entity and not required for internal information systems used by the Covered Entity’s employees? If so, explain why. If not, explain why not.

Should multi-factor authentication be required regardless of whether the information system is public facing if personal, confidential, or proprietary information resides on the information system? If so, explain why. If not, explain why not. Should the rule require phishing-resistant multi-factor authentication? If so, explain why. If not, explain why not.
33. Should the requirements of
paragraph (b)(1)(iii)(A) of proposed Rule 10 relating to measures designed to monitor the Covered Entity’s information systems and protect the information residing on those systems from unauthorized access or use be modified? For example, should the requirements of paragraph (b)(1)(iii)(A) of proposed Rule 10 specifically require encryption of certain information residing on the Covered Entity’s information systems? If so, explain why. If not, explain why not.
34. The measures discussed in
paragraph (b)(1)(iii)(A) of proposed Rule 10 designed to monitor the Covered Entity’s information systems and protect the information residing on those systems from unauthorized access or use would need to be based on a periodic assessment of the Covered Entity’s information systems and the information that resides on the systems that takes into account: (1) the sensitivity level and importance of the information to Covered Entity’s business operations; (2) whether any of the information is personal information; (3) where and how the information is accessed, stored and transmitted, including the monitoring of information in transmission; (4) the information systems’ access controls and malware protection; and (5) the potential effect a cybersecurity incident involving the information could have on the Covered Entity and its customers, counterparties, members, or users, including the potential to cause a significant cybersecurity incident. Should this paragraph of the proposed rule be modified to include any additional factors that would need to be taken into account? If so, identify the factors and explain why they should be taken into account. Should this paragraph of the proposed rule be modified to eliminate any of the identified factors that should be taken into account? If so, identify the factors and explain why they should be eliminated.
35. Should the requirements of
paragraph (b)(1)(iii)(A) of proposed Rule 10 relating periodic assessments of the Covered Entity’s information systems and information residing of the systems be modified to specifically require periodic (e.g., semi-annual or annual) penetration tests? If so, explain why. If not, explain why not. If proposed Rule 10 should be modified to require periodic penetration tests, should the rule specify the information systems and information to be tested? If so, explain why. If not, explain why not. For example, should the penetration tests be performed on all information systems and information of the Covered Entity? Alternatively, should the penetration tests be performed: (1) on a random selection of information systems and information; (2) on a prioritized selection of the information systems and information residing on them that are most critical to the Covered Entity’s functions or that maintain information that if accessed by or disclosed to persons not authorized to view it could cause the most harm to the Covered Entity or others; and/or (3) on information systems for which the Covered Entity has identified vulnerabilities pursuant to the requirements of paragraph (b)(1)(iv) of proposed Rule 10? Please explain the advantages and disadvantages of each potential approach to requiring penetration tests.
36. Should the requirements of
paragraph (b)(1)(iii)(B) of proposed Rule 10 relating to the oversight of service providers that receive, maintain, or process the Covered Entity’s information, or are otherwise permitted to access the Covered Entity’s information systems and the information residing on those systems, pursuant to a written contract between the covered entity and the service provider, through which the service providers are required to implement and maintain appropriate measures, including the practices described in paragraphs (b)(1)(i) through (v) of proposed Rule 10, that are designed to protect the Covered Entity’s information systems and information residing on those systems be modified? If so, explain why. If not, explain why not. For example, would there be practical difficulties with implementing the requirement to oversee the service providers through a written contract? If so, explain why. If not, explain why not. Are there alternative approaches to addressing the cybersecurity risk that arises when Covered Entities use service providers? If so, describe them and explain why they would be appropriate in terms of addressing this risk. For example, rather than addressing this risk through written contract, could it be addressed through policies and procedures to obtain written assurances or certifications from service providers that the service provider manages cybersecurity risk in a manner that would be consistent with how the Covered Entity would need to manage this risk under paragraph (b) of proposed Rule 10? If so, explain why and describe the type of assurances or certifications Covered Entities could reasonably obtain to ensure that their service providers are taking appropriate measures to manage cybersecurity risk? In responding, please explain how assurances or certifications would be an appropriate alternative to written contracts in terms of addressing the cybersecurity risk caused by the use of service providers.
37. Should the requirements of
paragraph (b)(1)(iv) of proposed Rule 10 relating to measures designed to detect, mitigate, and remediate any cybersecurity threats and vulnerabilities with respect to the Covered Entity’s information systems and the information residing on those systems be modified? If so, explain why. If not, explain why not.
38. Should the requirements of
paragraph (b)(1)(v)(A) of proposed Rule 10 relating to measures designed to detect, respond to, and recover from a cybersecurity incident be modified? If so, explain why. If not, explain why not. For example, these measures would need to include policies and procedures that are reasonably designed to ensure:
(1) the continued operations of the covered entity; (2) the protection of the Covered Entity’s information systems and the information residing on those systems; (3) external and internal cybersecurity incident information sharing and communications; and (4) the reporting of significant cybersecurity incidents pursuant to paragraph (c) of proposed Rule 10. Would these four specific design objectives required of the policies and procedures place the Covered Entity in a position to effectively detect, respond to, and recover from a cybersecurity incident? If so, explain why. If not, explain why not. Should this paragraph of the proposed rule be modified to include any additional design objectives for these policies and procedures? If so, identify the design objectives and explain why they should be included. For example, should the rule require policies and procedures that are designed to recover from a cybersecurity incident within a specific timeframe such as 24, 48, or 72 hours or some other period? If so, identify the recovery period and explain why it would be appropriate. Should this paragraph of the proposed rule be modified to eliminate any of the specified design objectives? If so, identify the design objectives and explain why they should be eliminated.

267FSOC 2021 Annual Report.
268See paragraph (c)(1) of proposed Rule 10. See also paragraph (a)(10) of proposed Rule 10 (defining the term ‘‘significant cybersecurity incident’’). As discussed below in section II.C. of this release, Non￾Covered Broker-Dealers would be subject to an identical immediate written electronic notice requirement. See paragraph (e)(2) of proposed Rule
10. If proposed Rule 10 is adopted, it is anticipated
that a dedicated email address would be set up to receive the notices from Covered Entities and Non￾Covered Broker-Dealers. See, e.g., Staff Guidance for Filing Broker-Dealer Notices, Statements and Reports, available at https://www.sec.gov/divisions/ marketreg/bdnotices; Staff Statement on Submitting Notices, Statements, Applications, and Reports for Security-Based Swap Dealers and Major Security￾Based Swap Participants Pursuant to the Financial Responsibility Rules (Exchange Act Rules 18a–1 through 18a–10), available at https://www.sec.gov/ tm/staff-statement-on-submissions. 269See paragraph (c)(1) of proposed Rule 10. But see 17 CFR 242.1002(b)(1) (requiring an SCI entity to provide the Commission with immediate notice after having a reasonable basis to conclude that an SCI event has occurred without specifying that the notice be written); OCC, Federal Reserve Board, FDIC, Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers, 86 FR 66424 (Nov. 23,
2021) (requiring a banking organization to provide
notice to a designated point of contact of a computer-security incident through telephone, email, or similar methods). 270Non-Covered Broker-Dealers also would be subject to an immediate written electronic notice requirement under paragraph (e)(2) of proposed Rule 10 and, therefore, the Commission potentially could receive notices from all types of Market Entities. As discussed in section V.C. of this release, it is estimated that 1,989 Market Entities would be Covered Entities and 1,969 broker-dealers would be Non-Covered Entities resulting in a 3,958 total Market Entities. This is a far larger number of entities than the 47 entities that currently are SCI entities. 271The notice requirement for Non-Covered Broker-Dealers also would be triggered when the broker-dealer has a reasonable basis to conclude that a significant cybersecurity incident has occurred or is occurring. See paragraph (e)(2) of proposed Rule 10.
39. Should the requirements of
paragraph (b)(1)(v)(B) of proposed Rule 10 relating to written documentation of any cybersecurity incidents be modified? If so, explain why. If not, explain why not. For example, should the written documentation requirements apply to a narrower set of incidents than those that would meet the definition of ‘‘cybersecurity incident’’ under proposed Rule 10? If so, describe the narrower set of incidents and explain why it would be appropriate to limit the written documentation requirements to them.
40. Should the requirements of
paragraph (b)(2) of proposed Rule 10 relating to the review and assessment of the policies and procedures and a written report of the review by modified? If so, explain why. If not, explain why not. For example, this paragraph would require: (1) a review and assessment of the design and effectiveness of the cybersecurity risk management policies and procedures, including whether the policies and procedures reflect changes in cybersecurity risk over the time period covered by the review; and (2) the preparation of a written report that describes the review, the assessment, and any control tests performed, explains their results, documents any cybersecurity incident that occurred since the date of the last report, and discusses any material changes to the policies and procedures since the date of the last report. Should the review requirement be modified to provide greater flexibility based on the Covered Entity’s assessment of what it believes would be most effective in light of its cybersecurity risks? If so, explain why. If not, explain why not. Should the review, assessment, and report be required on a more frequent basis such as quarterly? If so, explain why. If not, explain why not. Should the review, assessment, and report requirement be triggered after certain events regardless of when the previous review was conducted? If so, explain why. If not, explain why not. For example, should the requirement be triggered if the Covered Entity experiences a significant cybersecurity incident or undergoes a significant business event such as a merger, acquisition, or the commencement of a new business line that relies on information systems? If so, explain why and suggest how a ‘‘significant business event’’ should be defined for the purposes of the review and assessment requirement. If not, explain why not. Should the rule require that persons with a minimum level of cybersecurity expertise or experience must perform the review and assessment or that the review and assessment must be performed by a senior officer of the Covered Entity? If so, explain why. If not, explain why not. Should the rule require that the review and assessment be performed by personnel who are not involved in designing and implementing the cybersecurity policies and procedures? If so, explain why. If not, explain why not. Should the rule require that the annual report be subject to periodic third-party audits or reviews? If so, explain why. If not, explain why not. Should the Commission provide guidance to clarify how the review and report requirements of paragraph (b)(2) proposed Rule 10 interact with the requirements that SBS Entities perform assessments under 17 CFR 240.15Fk–1 or reviews under 17 CFR 250.15c3– 4(c)(3)? If so, explain why. If not, explain why not.
2. Notification and Reporting of
Significant Cybersecurity Incidents a. Timing and Manner of Notification and Reporting FSOC observed that ‘‘[s]haring timely and actionable cybersecurity information can reduce the risk that cybersecurity incidents occur and can mitigate the impacts of those that do occur.’’ 267 The Commission is proposing to require that Covered Entities provide immediate notice and subsequent reports about significant cybersecurity incidents to the Commission and, in the case of certain Covered Entities, other regulators. The objective is to improve the Commission’s ability to monitor and evaluate the effects of a significant cybersecurity incident on Covered Entities and their customers, counterparties, members, registrants, or users, as well as assess the potential risks affecting financial markets more broadly. For these reasons, proposed Rule 10 would require a Covered Entity to provide immediate written electronic notice to the Commission of a significant cybersecurity incident upon having a reasonable basis to conclude that the incident has occurred or is occurring.268 The Commission would keep the notices nonpublic to the extent permitted by law. The notice would need to identify the Covered Entity, state that the notice is being given to alert the Commission of a significant cybersecurity incident impacting the Covered Entity, and provide the name and contact information of an employee of the Covered Entity who can provide further details about the nature and scope of the significant cybersecurity incident. The immediate notice would need to be submitted by the Covered Entity electronically in written form (as opposed to permitting the notice to made telephonically).269 The Commission is proposing a written notification requirement because of the number of Market Entities that would be subject to the requirement and because of the different types of Market Entities.270 A written notification would also facilitate the Commission in identifying patterns and trends across Market Entities experiencing significant cybersecurity incidents. The notice requirement would be triggered when the Covered Entity has a reasonable basis to conclude that a significant cybersecurity incident has occurred or is occurring.271 This does not mean that the Covered Entity can wait until it definitively concludes that

272See paragraph (a)(2) of proposed Rule 10 (defining ‘‘cybersecurity incident’’ to mean an unauthorized occurrence on or conducted through a Market Entity’s information systems that jeopardizes the confidentiality, integrity, or availability of the information systems or any information residing on those systems). 273See 17 CFR 240.17a–11 (notification rule for broker-dealers); 17 CFR 240.18a–8 (notification rule for SBS Entities). 274See Recordkeeping and Reporting Requirements for Security-Based Swap Dealers, Major Security-Based Swap Participants, and Broker-Dealers; Capital Rule for Certain Security￾Based Swap Dealers, Exchange Act Release No. 71958 (Apr. 17, 2014) [79 FR 25194, 25247 (May 2, 2014)] (‘‘SBS Entity Recordkeeping and Reporting Proposing Release’’). 275See paragraphs (c)(1)(i) and (ii) of proposed Rule 10. Non-Covered Broker-Dealers also would be required to provide the written notice to their examining authority. See paragraph (e)(2) of proposed Rule 10. 276See paragraph (c)(2) of proposed Rule 10. As discussed below, Part II of proposed Form SCIR would be used by Covered Entities to make public disclosures about the cybersecurity risks they face and the significant cybersecurity incidents they experienced during the current or previous calendar year. See sections II.B.2. and II.B.4. of this release (discussing these proposed requirements). Non￾Covered Broker-Dealers would not be subject to the requirements to file Part I and Part II of proposed Form SCIR. 277See paragraphs (c)(2)(ii)(A) through (D) of proposed Rule 10. 278See paragraph (c)(2)(ii)(A) of proposed Rule 10. 279See paragraph (c)(2)(ii)(B) of proposed Rule 10. 280See paragraph (c)(2)(ii)(C) of proposed Rule 10. 281See paragraph (a)(10) of proposed Rule 10 (defining the term ‘‘significant cybersecurity incident’’). a significant cybersecurity incident has occurred or is occurring. In the early stages of discovering the existence of a cybersecurity incident, it may not be possible for the Covered Entity to conclude definitively that it is a significant cybersecurity incident. For example, the Covered Entity may need to assess which information systems have been subject to the cybersecurity incident and the impact that the incident has had on those systems before definitively concluding that it is a significant cybersecurity incident.272 The objective of the notification requirement is to alert the Commission staff as soon as the Covered Entity detects the existence of a cybersecurity incident that it has a reasonable basis to conclude is a significant cybersecurity incident and not to wait until the Covered Entity definitively concludes it is a significant cybersecurity incident. This would provide the Commission staff with the ability to begin to assess the situation at an earlier stage of the cybersecurity incident. This proposed immediate written notification requirement is modelled on other notification requirements that apply to broker-dealers and SBSDs pursuant
to other Exchange Act rules. Under these existing requirements, broker-dealers and certain SBSDs must provide the Commission with same-day written notification if they undergo certain adverse events, including falling below their minimum net capital requirements or failing to make and keep current required books and records.273 The objective of these requirements is to provide the Commission staff with the opportunity to respond when a broker-dealer or SBSD is in financial or operational difficulty.274 Similarly, the written notification requirements of proposed Rule 10 are designed to provide the Commission staff with the opportunity to begin assessing the situation promptly when a Covered Entity is experiencing a significant cybersecurity incident by, for example, assessing the Covered Entity’s operating status and engaging in discussions with the Covered Entity to understand better what steps it is taking to protect its customers, counterparties, members, registrants, or users. In addition, a Covered Entity that is a broker-dealer would need to provide the written notice to its examining authority, and a transfer agent would need to provide the written notice to its ARA.275 The objective is to notify other supervisory authorities to allow them the opportunity to respond to the significant cybersecurity incident impacting the Covered Entity. As discussed above, the immediate written electronic notice is designed to alert the Commission on a confidential basis to the existence of a significant cybersecurity incident impacting a Covered Entity so the Commission staff can begin to assess the event. It is not intended as a means to report written information about the significant cybersecurity incident. Therefore, in addition to the immediate written electronic notice, a Covered Entity would be required to report detailed information about the significant cybersecurity incident by filing, on a confidential basis, Part I of proposed Form SCIR with the Commission through the Electronic Data Gathering, Analysis, and Retrieval System (‘‘EDGAR’’ or ‘‘EDGAR system’’).276 Because of the sensitive nature of the information and the fact that threat actors could potentially use it to cause more harm, the Commission would not make the filings available to the public to the extent permitted by law. As with the notice, the requirement to file Part I of proposed Form SCIR would be triggered when the Covered Entity has a reasonable basis to conclude that a significant cybersecurity incident has occurred or is occurring. Therefore, the notification and reporting requirements would be triggered at the same time. However, in order to provide the Covered Entity time to gather the information that would be elicited by
Part I of proposed Form SCIR, the
Covered Entity would need to file the form promptly, but no later than 48 hours, upon having a reasonable basis to conclude that a significant cybersecurity incident has occurred or is occurring. Proposed Rule 10 also would require the Covered Entity to file an amended
Part I of proposed Form SCIR with
updated information about the significant cybersecurity incident in four circumstances.277 In each case, the amended Part I of proposed Form SCIR would need to be filed promptly, but no later than 48 hours, after the update requirement is triggered. First, the Covered Entity would need to file an amended Part I of proposed Form SCIR if any information previously reported to the Commission on the form pertaining to the significant cybersecurity incident becomes materially inaccurate.278 Second, the Covered Entity would need to file an amended Part I of proposed Form SCIR if any new material information pertaining to the significant cybersecurity incident previously reported to the Commission on the form is discovered.279 The Commission staff generally would use the information reported on Part I of proposed Form SCIR to assess the operating status of the Covered Entity and assess the impact that the significant cybersecurity incident could have on other participants in the U.S. securities markets. The requirement to file an amended Part I of proposed Form SCIR under the first and second circumstances is designed to ensure the Commission and Commission staff have reasonably accurate and complete information when undertaking these activities. Third, the Covered Entity would need to file an amended Part I of proposed Form SCIR after the significant cybersecurity incident is resolved.280 A significant cybersecurity incident impacting a Covered Entity would be resolved when the situation no longer meets the definition of ‘‘significant cybersecurity incident.’’ 281 The resolution of a significant cybersecurity incident would be a material development in the situation and, therefore, would be a reporting trigger under proposed Rule 10.

282See paragraph (c)(2)(ii)(D) of proposed Rule 10. 283See paragraphs (c)(2)(iii)(A) and (B) of proposed Rule 10. 284See paragraph (c)(2) of proposed Rule 10. 285See 17 CFR 232.11. 286See paragraphs (c)(2)(i) and (ii) of proposed Rule 10. As discussed below in section II.B.4. of this release, the Covered Entity would need to file
Part I of proposed Form SCIR using a structured
data language.
287See paragraph (c)(2)(i) of proposed Rule 10. See also section II.B.2.a. of this release (discussing the proposed filing requirements in more detail). 288See Instruction B.1. of proposed Form SCIR. 289See paragraphs (c)(2)(ii)(A) through (D) of proposed Rule 10. 290See Line Items 1.A. through 1.E. of Part I of proposed Form SCIR. 291A CIK number is used on the Commission’s computer systems to identify persons who have filed disclosures with the Commission. 292See Line Items 1.A. through 1.C. of Part I of proposed Form SCIR. 293See Instruction A.5.g. of proposed Form SCIR. See also, e.g., Form SBSE available at https:// www.sec.gov/files/form-sbse.pdf (providing a similar definition of UIC). 294See Regulation SBSR—Reporting and Dissemination of Security-Based Swap Information, Exchange Act Release No. 74244 (Feb. 11, 2015), 80 FR 14563, 14632 (Mar. 19, 2015) (‘‘Regulation SBSR Release’’). LEIs are unique alphanumeric codes that Finally, if the Covered Entity conducted an internal investigation pertaining to the significant cybersecurity incident, it would need to file an amended Part I of proposed Form SCIR after the investigation is closed.282 This would be an investigation of the significant cybersecurity incident that seeks to determine the cause of the incident or to examine whether there was a failure to adhere to the Covered Entity’s policies and procedures to address cybersecurity risk or whether those policies and procedures are effective. An internal investigation could be conducted by the Covered Entity’s own personnel (e.g., internal auditors) or by external consultants hired by the Covered Entity. The closure of an internal investigation would be a reporting trigger under proposed Rule 10 because it could yield material new information about the incident that had not been reported in a previously filed
Part I of proposed Form SCIR.
As with the immediate written electronic notice, a Covered Broker￾Dealer would need to promptly transmit a copy of each Part I of proposed Form SCIR it files with the Commission to its examining authority, and a transfer agent would need to promptly transmit a copy of each Part I of proposed Form SCIR it files with the Commission to its ARA.283 The objective is to provide these other supervisory authorities with the same information about the significant cybersecurity incident that the Commission receives. In this regard, the reporting requirements under proposed Rule 10 would provide the Commission and its staff with information to understand better the nature and extent of a particular significant cybersecurity incident and the efficacy of the Covered Entity’s response to mitigate the disruption and harm caused by the incident. The Commission staff could use the reports to focus on the Covered Entity’s operating status and to facilitate their outreach to, and discussions with, personnel at the Covered Entity who are addressing the significant cybersecurity incident. For example, certain information provided in a report may be sufficient to address any questions the staff has about the incident; and in other instances staff may want to ask follow￾up questions to get a better understanding of the matter. In addition, the reporting would provide the staff with a view into the Covered Entity’s understanding of the scope and impact of the significant cybersecurity incident. All of this information would be used by the Commission and its staff in assessing the impact of the significant cybersecurity incident on the Covered Entity. The information provided to the Commission under the proposed reporting requirements also would be used to assess the potential cybersecurity risks affecting U.S. securities markets more broadly. This information could be useful in assessing other and future significant cybersecurity incidents. For example, these reports could assist the Commission in identifying patterns and trends across Covered Entities, including widespread cybersecurity incidents affecting multiple Covered Entities at the same time. Further, the reports could be used to evaluate the effectiveness of various approaches to respond to and recover from a significant cybersecurity incident. b. Part I of Proposed Form SCIR Proposed Rule 10 would require a Covered Entity to report information about a significant cybersecurity incident confidentially on Part I of proposed Form SCIR.284 The form would elicit certain information about the significant cybersecurity incident through check boxes, date fields, and narrative fields. Covered Entities would file Part I of proposed Form SCIR electronically with the Commission using the EDGAR system in accordance with the EDGAR Filer Manual, as defined in Rule 11 of Regulation S–T,285 and in accordance with the requirements of Regulation S–T.286 A Covered Entity would need to indicate on Part I of proposed Form SCIR
whether the form is being filed with respect to a significant cybersecurity incident as an initial report, amended report, or final amended report by checking the appropriate box. As discussed above, proposed Rule 10 would require a Covered Entity to file Part I of proposed Form SCIR upon having a reasonable basis to conclude that a significant cybersecurity incident has occurred or is occurring.287 This would be the initial
Part I of proposed Form SCIR with
respect to the significant cybersecurity incident.288 Thereafter, a Covered Entity would be required to file an amended
Part I of proposed Form SCIR with
respect to the significant cybersecurity incident after: (1) any information previously reported to the Commission on Part I of proposed Form SCIR pertaining to the significant cybersecurity incident becomes materially inaccurate; (2) any new material information pertaining to the significant cybersecurity incident previously reported to the Commission on Part I of proposed Form SCIR is discovered; (3) the significant cybersecurity incident is resolved; or (4) an internal investigation pertaining to a significant cybersecurity incident is closed.289 If a Covered Entity checks the box indicating that the filing is a final
Part I of proposed Form SCIR, the firm
also would need to check the appropriate box to indicate why a final form was being filed: either the significant cybersecurity incident was resolved or an internal investigation pertaining to the incident was closed.
Part I of proposed Form SCIR would
elicit information about the Covered Entity that would be used to identify the filer.290 In particular, the Covered Entity would need to provide its full legal name and business name (if different from its legal name), tax identification number, unique identification code (‘‘UIC’’) (if the filer has a UIC), central index key (‘‘CIK number’’),291 and main address.292 The instructions to proposed Form SCIR (which would be applicable to Parts I and II) would provide that a UIC is an identification number that has been issued by an internationally recognized standards-setting system (‘‘IRSS’’) that has been recognized by the Commission pursuant to Rule 903(a) of Regulation SBSR.293 Currently, the Commission has recognized only the Global Legal Entity Identifier Foundation (‘‘GLEIF’’)—which is responsible for overseeing the Global Legal Entity Identifier System (‘‘GLEIS’’)—as an IRSS.294 Part I of

identify legal entities in financial transactions in international markets. See Financial Stability Board (‘‘FSB’’), Options to Improve Adoption of the LEI, in Particular for Use in Cross-Border Payments (July 7, 2022). Information associated with the LEI, which is a globally-recognized digital identifier that is not specific to the Commission, includes the ‘‘official name of the legal entity as recorded in the official registers[,]’’ the entity’s address, country of incorporation, and the ‘‘legal form of the entity.’’ Id. Accordingly, in proposing to require each Covered Entity to provide its UIC if it has a UIC, the Commission is proposing to require each Covered Entity identify itself with an LEI if it has an LEI. 295See Line Item 1.D. of Part I of proposed Form SCIR. 296See Instruction B.4. of proposed Form SCIR. 297See Line Item 1.E. of Part I of proposed Form SCIR (setting forth check boxes to indicate whether the Covered Entity is a broker-dealer, clearing agency, MSBSP, the MRSB, a national securities association, a national securities exchange, SBSD, SBSDR, or transfer agent). 298See paragraph (c)(2)(ii)(B) of proposed Rule 10. 299See paragraph (b)(1)(v)(A)(4) of proposed Rule
10. See also section II.B.1.e. of this release
(discussing these proposed required policies and procedures in more detail). 300See paragraph (b)(1) of proposed Rule 10 (requiring that the Covered Entity establish, maintain, and enforce written policies and procedures that are reasonably designed to address the covered entity’s cybersecurity risks). 301See paragraph (b)(1)(v)(A) of proposed Rule
10. See also section II.B.1.e. of this release
(discussing these proposed required policies and procedures in more detail). proposed Form SCIR also would elicit the name, phone number, and email address of the contact employee of the Covered Entity.295 The contact employee would need to be an individual authorized by the Covered Entity to provide the Commission with information about the significant cybersecurity incident (i.e., information the individual can provide directly) and make information about the incident available to the Commission (e.g., information the individual can provide by, for example, making other employees of the Covered Entity available to answer questions of the Commission staff).296 The Covered Entity also would need to indicate the type of Market Entity it is by checking the appropriate box or boxes.297 For example, if the Covered Entity is dually registered as a broker-dealer and SBSD, it would need to check the box for each of those entity types.
Page 1 of Part I of proposed Form
SCIR also would contain fields for the individual executing the form to sign and date the form. By signing the form, the individual would: (1) certify that the form was executed on behalf of, and with the authority of, the Covered Entity; (2) represent individually, and on behalf of the Covered Entity, that the information and statements contained in the form are current, true and complete; and (3) represent individually, and on behalf of the Covered Entity, that to the extent any information previously submitted is not amended such information is current, true, and complete. The form of the certification is designed to ensure that the Covered Entity, through the individual executing the form, provides information that the Commission and Commission staff can rely on to evaluate the operating status of the Covered Entity, assess the impact the significant cybersecurity incident may have on other participants in the U.S. securities markets, and formulate an appropriate response to the incident. Line Items 2 through 14 of Part I of proposed Form SCIR would elicit information about the significant cybersecurity incident and the Covered Entity’s response to the incident. After discovering the existence of a significant cybersecurity incident, a Covered Entity may need time to determine the scope and impact of the incident in order to provide meaningful responses to these questions. For example, the Covered Entity may be working diligently to investigate and resolve the significant cybersecurity incident at the same time it would be required to complete and file Part I of proposed Form SCIR. The Covered Entity’s priorities in the early stages after detecting the significant cybersecurity incident may be to devote its staff resources to mitigating the harms caused by the incident or that could be caused by the incident if necessary corrective actions are not promptly implemented. Moreover, during this period, the Covered Entity may not have a complete understanding of the cause of the significant cybersecurity incident, all the information systems impacted by the incident, the harm caused by the incident, or how to best resolve and recover from the incident (among other relevant information). Therefore, the first form filed with respect to a given significant cybersecurity incident should include information that is known to the Covered Entity at the time of filing and not include speculative information. If information is unknown at the time of filing, the Covered Entity should indicate that on the form. Understanding the aspects of the significant cybersecurity incident that are not yet known would inform the Commission’s assessment. The process of filing an amended Part I of proposed Form SCIR is designed to update earlier filings as information becomes known to the Covered Entity. In particular, proposed Rule 10 would require the Covered Entity to file an amended Part I of proposed Form SCIR if information reported on a previously filed form
pertaining to the significant cybersecurity incident becomes materially incomplete because new information is discovered.298 Therefore, as the Covered Entity reasonably concludes that additional information about the significant cybersecurity incident is necessary to make its filing not materially inaccurate, it would need to file amended forms. In this way, the reporting requirements of proposed Rule 10 are designed to provide the Commission and Commission staff with current known information and provide a means for the Covered Entity to report information as it becomes known. This does not mean that the Covered Entity can refrain from providing known information in Part I of proposed Form SCIR. As discussed above, the Covered Entity must certify through the individual executing the form that the information and statements in the form are current, true, and complete, among other things. A failure to provide current, true, and complete information that is known to the Covered Entity would be inconsistent with this required certification. In addition, failing to investigate the significant cybersecurity incident would be inconsistent with the policies and procedures required by proposed Rule
10. As discussed above, the
cybersecurity incident response and recovery policies and procedures that would be required by proposed Rule 10 would need to include policies and procedures that are reasonably designed to ensure the reporting of significant cybersecurity incidents as required by the rule.299 The failure to diligently investigate the significant cybersecurity incident could indicate that the Covered Entity’s incident response and recovery policies and procedures are not reasonably designed or are not being enforced by the Covered Entity as required by proposed Rule 10.300 Moreover, reasonably designed policies and procedures to detect, respond to, and recover from a cybersecurity incident, as required by proposed Rule 10 generally should require diligent investigation of the significant cybersecurity incident.301 Further, diligently investigating the significant cybersecurity incident would be in the interest of the Covered Entity as it could lead to a quicker resolution of the incident by revealing—for example—its cause and impact. In terms of the information about the significant cybersecurity incident elicited in Part I of proposed Form SCIR, the Covered Entity first would be required to provide the approximate

302See Line Item 2 of Part I of proposed Form SCIR. 303See paragraph (c)(1) of proposed Rule 10. See also section II.B.2.a. of this release (discussing the proposed notification requirement in more detail). 304See paragraph (c)(2)(i) of proposed Rule 10. See also section II.B.2.a. of this release (discussing the proposed reporting trigger in more detail). 305See Instruction B.5.a. of proposed Form SCIR. 306See Line Items 3.A. through 3.C. of Part I of proposed Form SCIR. 307See Line Item 3.A. of Part I of proposed Form SCIR. 308See Line Item 3.B. of Part I of proposed Form SCIR. 309See Line Item 3.C. of Part I of proposed Form SCIR. 310See Instruction B.5.b. of proposed Form SCIR. See also paragraph (a)(10) of proposed Rule 10 (defining the term ‘‘significant cybersecurity incident’’). 311See paragraph (c)(2)(ii)(C) of proposed Rule
10. See section II.B.2.a. of this release (discussing
the notification requirements in more detail). 312See Instruction A.5.d. of proposed Form SCIR. 313See paragraph (c)(2)(ii)(D) of proposed Rule
10. See also section II.B.2.a. of this release
(discussing the notification requirement in more detail). 314See Line Item 5 of Part I of proposed Form SCIR. 315See Line Item 6 of Part I of proposed Form SCIR. 316See Line Item 7.A. of Part I of proposed Form SCIR. 317See Line Item 7.B. of Part I of proposed Form SCIR. 318See Line Item 8 of Part I of proposed Form SCIR. date that it discovered the significant cybersecurity incident.302 As discussed above, a Covered Entity would be required to provide the Commission with immediate written electronic notice of a significant cybersecurity incident upon having a reasonable basis to conclude that the incident has occurred or is occurring.303 This can be based on, for example, the Covered Entity reviewing or receiving a record, alert, log, or notice about the incident. In addition, reaching this conclusion would trigger the requirement to file promptly (but within 48 hours) an initial Part I of proposed Form SCIR with the Commission to first report the significant cybersecurity incident using the form.304 The date that would need to be reported on proposed Part I of Form SCIR is the date the Covered Entity has a reasonable basis to conclude that the incident has occurred or is occurring.305 Line Item 3 of Part I of proposed Form SCIR would elicit information about the approximate duration of the significant cybersecurity incident.306 First, the Covered Entity would need to indicate whether the significant cybersecurity incident is ongoing.307 The form would provide the option of answering yes, no, or unknown. Second, the Covered Entity would need to provide the approximate start date of the cybersecurity incident or indicate that it does not know the start date.308 The start date may be well before the date the Covered Entity discovered the significant cybersecurity incident. Therefore, the start date of the incident reported on Line Item 3 may be different than the discovery date reported on Line Item 2. Third, the Covered Entity would need to provide the approximate date the significant cybersecurity incident is resolved.309 This would be the date the Covered Entity was no longer undergoing a significant cybersecurity incident.310 As discussed above, the resolution of the significant cybersecurity incident triggers the requirement to file an amended Part I of proposed Form SCIR under proposed Rule 10.311 Line Item 4 of Part I of proposed Form SCIR would require the Covered Entity to indicate whether an internal investigation pertaining to the significant cybersecurity incident was being conducted. An ‘‘internal investigation’’ would be defined as a formal investigation of the significant cybersecurity incident by internal personnel of the Covered Entity or external personnel hired by the Covered Entity that seeks to determine any of the following: the cause of the significant cybersecurity incident; whether there was a failure to adhere to the Covered Entity’s policies and procedures to address cybersecurity risk; or whether the Covered Entity’s
policies and procedures to address cybersecurity are effective.312 If an internal investigation is conducted, the Covered Entity also would need to provide the date the investigation was closed. As discussed above, the closure of an internal investigation pertaining to the significant cybersecurity incident triggers the requirement to file an amended Part I of Form SCIR under proposed Rule 10.313 Line Item 5 of Part I of proposed Form SCIR would require the Covered Entity to indicate whether a law enforcement or government agency (other than the Commission) had been notified of the significant cybersecurity incident.314 If so, the Covered Entity would need to identify each law enforcement or government agency. The Commission and Commission staff could use this information to coordinate with other law enforcement and government agencies if needed both to assess the incident and to share information as appropriate to understand the impact of the incident better. Line Item 6 of Part I of proposed Form SCIR would require the Covered Entity to describe the nature and scope of the significant cybersecurity incident, including the information systems affected by the incident and any effect on the Covered Entity’s critical operations.315 This item would enable the Commission to obtain information about the incident to understand better how it is impacting the Covered Entity’s operating status and whether the Covered Entity can continue to provide services to its customers, counterparties, members, registrants, or users. This would include understanding which services and systems have been impacted and whether the incident was the result of a cybersecurity incident that occurred at a service provider. Line Item 7 of Part I of proposed Form SCIR would require the Covered Entity to indicate whether the threat actor(s) causing the significant cybersecurity incident has been identified.316 If so, the Covered Entity would be required to identify the threat actor(s). In addition, the Covered Entity would need to indicate in Line Item 7 whether there has been communication(s) from or with the threat actor(s) that caused or claims to have caused the significant cyber security incident.317 The Covered Entity would need to answer the question even if the threat actor(s) has not been identified. If there had been communications, the Covered Entity would need to describe them. This information would help the Commission staff to assess whether the same threat actor(s) had sought to access information systems of other Commission registrants and to warn other registrants (as appropriate) about the threat posed by the actor(s). It also could help in developing measures to protect against the risk to Commission registrants posed by the threat actor. In addition, the information would help the Commission assess the impact on the Covered Entity experiencing the significant cybersecurity incident to the extent other Commission registrants has been attacked by the same threat
actor(s) using similar tactics, techniques, and procedures. Line Item 8 of Part I of proposed Form SCIR would require the Covered Entity to describe the actions taken or planned to respond to and recover from the significant cybersecurity incident.318 The objective is to obtain information to assess the Covered Entity’s operating status, including its critical operations. This information also could assist the Commission and Commission staff in considering if the response measures are effective or ineffective in addressing the Covered Entity’s significant cybersecurity incident. Line Item 9 of Part I of proposed Form SCIR would require the Covered Entity

319See Line Item 9 of Part I of proposed Form SCIR. 320See Line Item 10.A. of Part I of proposed Form SCIR. 321See Line Item 10.B.i. of Part I of proposed Form SCIR. 322See Line Item 10.B.ii. of Part I of proposed Form SCIR. 323See Instruction A.5.e. of proposed Form SCIR. See also paragraph (a)(9) of proposed Rule 10 (defining ‘‘personal information’’ to mean any information that can be used, alone or in conjunction with any other information, to identify a person, such as name, date of birth, place of birth, telephone number, street address, mother’s maiden name, government passport number, Social Security number, driver’s license number, electronic mail address, account number, account password, biometric records, or other non-public authentication information). 324See Line Item 11 of Part I of proposed Form SCIR. 325See Line Item 12.A. Part I of proposed Form SCIR. 326See Line Item 11.B.i. of Part I of proposed Form SCIR. 327See Line Item 12.B.ii. of Part I of proposed Form SCIR. 328See Section I.A.2. of this release (discussing the functions of Market Entities). 329See paragraph (d)(1)(ii) of proposed Rule 10. See also sections II.B.3. and II.B.4. of this release (discussing these proposed disclosure requirements in more detail). 330See paragraphs (d)(2)(i) and (ii) of proposed Rule 10. 331See paragraph (d)(3) of proposed Rule 10. See
section II.B.3.b. of this release (discussing the
broker-dealer disclosure requirement in more detail). 332See Line Items 13.A. through C. of proposed Form SCIR. 333See Line Items 13.A. through B. of proposed
Part I of Form SCIR.
to indicate whether any data was stolen, altered, or accessed or used for any other unauthorized purpose.319 The Covered Entity would have the option of checking yes, no, or unknown. If yes, the Covered Entity would need to describe the nature and scope of the data. This information would help the Commission and its staff understand the potential harm to the Covered Entity and its customers, counterparties, members, registrants, or users that could result from the compromise of the data. It also would provide insight into how the significant cybersecurity incident could impact other Market Entities. Line Item 10 of Part I of proposed Form SCIR would require the Covered Entity to indicate whether any personal information was lost, stolen, modified, deleted, destroyed, or accessed without authorization as a result of the significant cybersecurity incident.320 The Covered Entity would have the option of checking yes, no, or unknown. If yes, the Covered Entity would need to describe the nature and scope of the information. Additionally, if the Covered Entity answered yes, it would need to indicate whether notification has been provided to persons whose personal information was lost, stolen, damaged, or accessed without authorization.321 If the answer is no, the Covered Entity would need to indicate whether this notification is planned.322 For the purposes of proposed Form SCIR, the term ‘‘personal information’’ would have the same meaning as that term is defined in proposed Rule 10.323 The compromise of personal information can have severe consequences on the persons to whom the information relates. For example, it potentially can be used to steal their identities or access their accounts at financial institutions to steal assets held in those accounts. Consequently, this information would help the Commission assess the extent to which the significant cybersecurity incident has created this risk and the potential harm that could result from the compromise of personal data. Line Item 11 of Part I of proposed Form SCIR would require the Covered Entity to indicate whether any of its assets were lost or stolen as a result of the significant cybersecurity incident.324 The Covered Entity would have the option of checking yes, no, or unknown. If yes, the Covered Entity would need to describe the types of assets that were lost or stolen and include an approximate estimate of their value, if known. This question is not limited to particular types of assets and, therefore, the Covered Entity would need to respond affirmatively if, among other types of assets, financial assets such as cash and securities were lost or stolen or intellectual property was lost or stolen. The loss or theft of the Covered Entity’s assets could potentially cause the entity to fail financially or put a strain on its liquidity. Further, to the extent counterparties become aware of the loss or theft, it could cause them to withdraw assets from the entity or stop transacting with the
entity further straining its financial condition. Consequently, the objective is to understand whether the significant cybersecurity incident has created this risk and whether there may be other spillover effects or consequences to the U.S. securities markets. Line Item 12 of Part I of proposed Form SCIR would require the Covered Entity to indicate whether any assets of the Covered Entity’s customers, counterparties, clients, members, registrants, or users were lost or stolen as a result of the significant cybersecurity incident.325 The Covered Entity would have the option of checking yes, no, or unknown. If yes, the Covered Entity would need to describe the types of assets that were lost or stolen and include an approximate estimate of their value, if known. Additionally, if the Covered Entity answered yes, it would need to indicate whether notification has been provided to persons whose assets were lost or stolen.326 If the answer is no, the Covered Entity would need to indicate whether this notification is planned.327 Certain types of Covered Entities hold assets belonging to other persons or maintain ownership records of the assets of other persons.328 For example, certain broker-dealers maintain custody of securities and cash for other persons and clearing agencies hold clearing deposits of their members. A significant cybersecurity incident impacting a Covered Entity that results in the loss or theft of assets can cause severe financial hardship to the owners of those assets. It also can impact the financial condition of the Covered Entity if it is liable for the loss or theft. Consequently, the objective is to understand whether the significant cybersecurity incident has created this risk. As discussed in more detail below, proposed Rule 10 would require a Covered Entity to make a public disclosure that generally describes each significant cybersecurity incident that has occurred during the current or previous calendar year and promptly update this disclosure after the occurrence of a new significant cybersecurity incident or when information about a previously disclosed significant cybersecurity incident materially changes.329 The Covered Entity would be required to make the disclosure on the Covered Entity’s business internet website and by filing Part II of proposed Form SCIR through the EDGAR system.330 In addition, if the Covered Entity is a carrying or introducing broker-dealer, it would need to make the disclosure to its customers using the same means that a customer elects to receive account statements.331 Line Item 13 of Part I of proposed Form SCIR would require the Covered Entity to indicate whether the significant cybersecurity incident has been disclosed pursuant to the requirements of proposed Rule 10.332 The Covered Entity also would need to indicate whether it made the required disclosures of Part II of proposed Form SCIR on its website and through EDGAR and, if it had made the disclosure, it would need to indicate the date
of the disclosure.333 A Covered Entity that is a carrying or introducing broker-dealer would need to indicate separately

334See Line Item 13.C. of Part I of proposed Form SCIR. 335See Line Items 14.A. and B. of Part I of proposed Form SCIR. 336See Line Item 14.A. of Part I of proposed Form SCIR. 337See Line Item 15 of proposed Part I of Form SCIR. 338See CIRCIA. whether it made the required disclosure of Part II of proposed Form SCIR to its customers.334 The Covered Entity would not need to indicate a date for the customer disclosure because it could be made in a number of ways (e.g., by email or mail) and that process could span a number of days. If the Covered Entity has not disclosed the significant cybersecurity incident as required by proposed Rule 10, it would need to explain why. The requirement to report this information is designed to promote compliance with the disclosure requirements of proposed Rule 10. Line Item 14 of Part I of proposed Form SCIR would elicit information about any insurance coverage the Covered Entity may have with respect to the significant cybersecurity incident.335 First, the Covered Entity would need to indicate whether the significant cybersecurity incident is covered by an insurance policy of the Covered Entity.336 The Covered Entity would have the option of checking yes, no, or unknown. If yes, the Covered Entity would need to indicate whether the insurance company has been contacted. The existence of insurance coverage to cover losses could be relevant to Commission staff in assessing the potential magnitude of harm to the Covered Entity’s customers, counterparties, members, registrants, or users and to the Covered Entity’s financial condition. For example, the existence of insurance coverage, to the extent the significant cybersecurity incident is covered by the policy, could indicate a greater possibility that the Covered Entity and/or any of its customers, counterparties, members, registrants, or users affected by the incident are made whole. Finally, Line Item 15 of Part I of proposed Form SCIR would permit the Covered Entity to include in the form any additional information the entity would want the Commission and Commission staff to know as well as provide any comments about the information included in the report.337
c. Request for Comment
The Commission requests comment on all aspects of the proposed requirements to report significant cybersecurity incidents on Part I of proposed Form SCIR. In addition, the Commission is requesting comment on the following specific aspects of the proposals:
41. Should paragraph (c)(1) of
proposed Rule 10 be modified to revise the immediate notification requirement? For example, should the requirement permit the notice to be made by telephone or email? If so, explain why. If not, explain why not. If telephone or email notice is permitted, should the rule specify the Commission staff, Division, or Office to phone or email?
42. Should paragraph (c)(1) of
proposed Rule 10 be modified to revise the requirement to provide immediate written electronic notice to specify how the notice must be transmitted to the Commission? For example, should the rule specify an email address or other type of electronic portal to be used to transmit the notice? If so, explain why. If not, explain why not. Should the rule be modified to require that the notice be transmitted to the Commission through the EDGAR system? If so, explain why. If not, explain why not. Should the rule be modified to require that the notice be transmitted to the Commission through the EDGAR system using a structured data language other than custom XML format?
43. Should paragraph (c)(1) of
proposed Rule 10 be modified to revise the requirement to provide immediate written electronic notice to require the notice to be provided within a specific timeframe such as on the same day the requirement was triggered or within 24 hours? If so, explain why. If not, explain why not.
44. Should paragraph (c)(1) of
proposed Rule 10 be modified to revise the trigger for the immediate notification and reporting requirements? If so, explain why. If not, explain why not. For example, should the trigger be when the Covered Entity ‘‘detects’’ a significant cybersecurity incident (rather than when it has a reasonable basis to conclude that the significant cybersecurity incident has occurred or is occurring)? If so, explain why. If not, explain why not. For example, would a detection standard be a less subjective standard? If so, explain why. If not, explain why not. Is there another trigger standard that would be more appropriate? If so, identify it and explain why it would be more appropriate.
45. If the immediate notification
requirement of paragraph (c)(1) is adopted as proposed, it is anticipated that a dedicated email address would be established to receive these notices. Are there other methods the Commission should use for receiving these notices? If so, identity them and explain why they would be more appropriate than email. For example, should the notices be received through the EDGAR system? If so, explain why. If not, explain why not.
46. Should paragraph (c)(2) of
proposed Rule 10 be modified to revise the reporting requirements to incorporate the cybersecurity reporting program that CISA will implement under recently adopted legislation (‘‘CISA Reporting Program’’) to the extent it will be applicable to Covered Entities? 338 If so, explain why and suggest modifications to the proposed reporting requirements for Covered Entities to incorporate the CISA Reporting Program. For example, if a Covered Entity would be required to file a report under the CISA Reporting Program, should that report satisfy the obligations to report to the Commission a significant cybersecurity incident under paragraph (c) of proposed Rule 10? If so, explain why. If not, explain why not.
47. Should paragraph (c)(2) of
proposed Rule 10 be modified to revise the timeframe for filing an initial Part I of proposed Form SCIR? If so, explain why. If not, explain why not. For example, should the reporting requirements be revised to permit Covered Entities more than 48 hours to file an initial Part I of proposed Form SCIR with the Commission? If yes, explain how long they should have to file the initial Part I of proposed Form SCIR and why that timeframe would be appropriate. For example, should Covered Entities have 72 or 96 hours to file the initial Part I of proposed Form SCIR? If so, explain why. If not, explain why not. Would providing more time to file the initial Part I of proposed Form SCIR make the filing more useful insomuch as the Covered Entity would have more time to investigate the significant cybersecurity incident? If so, explain why and how to balance that benefit against the delay in providing this information to the Commission within 48 hours. Would the immediate notification requirement of paragraph (c) of proposed Rule 10 make it appropriate to lengthen the timeframe for when the Covered Entity would need to file the initial Part I of proposed Form SCIR? If so, explain why. If not, explain why not. For example, could the immediate notification requirement and the ability of the Commission staff to follow-up with the contact person identified on the notification serve as an appropriate alternative to receiving the initial Part I of proposed Form SCIR within 48 hours. If so, explain why. If not, explain why not. Conversely,

339The Commission accepts electronic submissions through the EDGAR system Monday through Friday, except federal holidays, from 6:00 a.m. to 10:00 p.m. Eastern Time. See Chapter 2 of the EDGAR Filer Manual (Volume I), version 41 (Dec. 2022). Further, filings submitted by direct transmission commencing on or before 5:30 p.m. Eastern Standard Time or Eastern Daylight Saving Time, whichever is currently in effect, shall be deemed filed on the same business day, and all filings submitted by direct transmission commencing after 5:30 p.m. Eastern Standard Time or Eastern Daylight Saving Time, whichever is currently in effect, shall be deemed filed as of the next business day. 17 CFR 232.13. 340The Commission approved a UIC (namely, the LEI) in a previous rulemaking. See section II.B.2.b. of this release; see also Regulation SBSR Release, 80 FR at 14632. The Commission is aware that additional identifiers could be recognized as UICs in the future, but for the purposes of this release, the Commission is equating the UIC with the LEI. 341See paragraph (d)(1) of proposed Rule 10. 342See paragraph (d)(1)(i) of proposed Rule 10; Line Item 2 of Part II proposed of Form SCIR. 343See, e.g., SEC. v. Steadman, 967 F.2d 636, 643 (D.C. Cir. 1992); cf. Basic Inc. v. Levinson, 485 U.S. 224, 231–232 (1988); TSC Industries v. Northway, Inc., 426 U.S. 438, 445, 449 (1976). should the timeframe for filing an initial
Part I of proposed Form SCIR be
shortened to 24 hours or some other period of time that is less than 48 hours? If so, explain why. If not, explain why not.
48. Should paragraph (c)(2) of
proposed Rule 10 be modified to revise the timeframe for filing an initial or amended Part I of proposed Form SCIR so the timeframes are expressed in business days or calendar days instead of hours? If so, explain why. If not, explain why not. For example, should Covered Entities have two, five, or some other number business or calendar days to file an initial or amended Part I of proposed Form SCIR? Would business or calendar days be more appropriate given that Part I of proposed Form SCIR would be filed through the EDGAR system? 339 If so, explain why. If not, explain why not.
49. Should paragraph (c)(2) of
proposed Rule 10 be modified to revise the timeframe for filing an initial or amended Part I of proposed Form SCIR so that it must be filed promptly after the filing requirement is triggered without specifying the 48 hour limit? If so, explain why and describe how ‘‘promptly’’ should be interpreted for purposes of the reporting requirements of paragraph (c) of proposed Rule 10. If not, explain why not.
50. Should paragraph (c)(2) of
proposed Rule 10 be modified to revise the reporting requirements to include the filing of an initial Part I of proposed Form SCIR and a final Part I of proposed Form SCIR but not require the filing of interim amended forms? If so, explain why. If not, explain why not. For example, could informal communications between the Commission staff and the Covered Entity facilitated by the contact employee identified in the immediate notice that would be required under paragraph (c)(1) of proposed Rule 10 be an appropriate alternative to requiring the filing of interim amended forms? If so, explain why. If not, explain why not.
51. Should paragraph (c)(2) of
proposed Rule 10 be modified to revise the reporting requirements to include the filing of interim amended forms on a pre-set schedule? If so, explain why. If not, explain why not. For example, should Covered Entities be required to file an initial Part I of proposed Form SCIR and a final Part I of proposed Form SCIR pursuant to the requirements of paragraph (c) of proposed Rule 10 but file interim amended forms on a pre-set
schedule? If so, explain why this would
be appropriate, including why a pre-set reporting requirement would not undermine the objectives of the proposed reporting requirements, and how often the interim reporting should be required (e.g., weekly, bi-weekly, monthly, quarterly). Would a pre-set reporting cadence (e.g., weekly, bi￾weekly, monthly, quarterly) undermine the objectives of the proposed reporting requirements by inappropriately delaying the Commission’s receipt of important information about a significant cybersecurity incident? If so, explain why. If not, explain why not. Would the immediate notification requirement and the ability of the Commission staff to follow-up with the contact person identified on the notification mitigate this potential consequence? If so, explain why. If not, explain why not.
52. Should paragraph (c)(2)(ii)(D) of
proposed Rule 10 and Part I of proposed Form SCIR be modified to revise the reporting requirements relating to internal investigations? If so, explain why. If not, explain why not. For example, would these reporting requirements create a disincentive for Covered Entities to perform internal investigations in response to significant cybersecurity incidents? If so, explain why. If not, explain why not.
53. Should Part I of proposed Form
SCIR be modified? If so, explain why. If not, explain why not. For example, does the form strike an appropriate balance of providing enough detail to the Commission to be helpful while also not being unduly burdensome to Covered Entities? If so, explain why. If not, explain why not. Is certain information that would be elicited in Part I of Form SCIR unnecessary? If so, identify the information and explain why it would be unnecessary. Is there additional information that should be required to be included in Part I of proposed Form SCIR? If so, identify the information and explain why it would be appropriate to require a Covered Entity to report it in the form.
54. Should Part I of proposed Form
SCIR be modified to require that Covered Entities provide a UIC—such as an LEI 340 (which would require each Covered Entity without a UIC (such as an LEI) to obtain one to comply with the rule)? If so, explain why. If not, explain why not. For example, would a requirement to provide a UIC allow the Commission staff to better evaluate cyber-threats to Covered Entities? If so, explain why. If not, explain why not. Should the form be modified to require Covered Entities to provide another type of standard identifier other than a CIK number and UIC (if they have a UIC)? If so, explain why. If not, explain why not.
3. Disclosure of Cybersecurity Risks and
Incidents a. Cybersecurity Risks and Incidents Disclosure Proposed Rule 10 would require a Covered Entity to make two types of public disclosures relating to cybersecurity on Part II of proposed Form SCIR.341 First, the Covered Entity would need to, in plain English, provide a summary description of the cybersecurity risks that could materially affect its business and operations and how the Covered Entity assesses, prioritizes, and addresses those cybersecurity risks.342 A cybersecurity risk would be material to a Covered Entity if there is a substantial likelihood that a reasonable person would consider the information important based on the total mix of facts and information.343 The facts and circumstances relevant to determining materiality in this context may include, among other things, the likelihood and extent to which the cybersecurity risk or resulting incident:
(1) could disrupt or degrade the Covered Entity’s ability to maintain critical operations; (2) could adversely affect the confidentiality, integrity, or availability of information residing on the Covered Entity’s information systems, including whether the information is personal, confidential, or proprietary information; and/or (3) could harm the Covered Entity or its customers, counterparties, members, registrants, users, or other persons. The second element of the disclosure would be a summary description of each

344See paragraph (d)(1)(ii) of proposed Rule 10; Line Item 3 of Part II proposed of Form SCIR. See also paragraph (a)(10) of proposed Rule 10 (defining the term ‘‘significant cybersecurity incident’’). 345This element of the disclosure would not need to include the identities of the persons affected or personal information about those persons. Instead, the disclosure could use generic terms to identify the person or persons affected. For example, the disclosure could state that ‘‘customers of the broker￾dealer,’’ ‘‘counterparties of the SBSD,’’ or ‘‘members of the SRO’’ are affected (as applicable). 346See paragraphs (d)(1)(ii)(A) through (E) of proposed Rule 10; Line Item 3 of Part II proposed of Form SCIR. 347See Peter W. Singer and Allan Friedman. Cybersecurity and Cyberwar: What Everyone Needs to Know. Oxford University Press 222 (2014). 348See, e.g., Federal Trade Commission v. Equifax, Inc., FTC Matter/File Number: 172 3203, Civil Action Number: 1:19–cv–03297–TWT (2019), available at https://www.ftc.gov/enforcement/cases￾proceedings/172-3203/equifax-inc (‘‘FTC Equifax Civil Action’’). 349See paragraphs (d)(1)(i) and (ii) of proposed Rule 10. 350See paragraph (d) of proposed Rule 10. 351See Line Items 1.A. through 1.D. of Part II of proposed Form SCIR. 352As mentioned previously, the Commission approved a UIC—namely, the LEI—in a prior rulemaking. See section II.B.2.b. of this release. Therefore, for the purposes of this release, the Commission is proposing to require those Covered Entities that already have LEIs to identify themselves with LEIs on Part II of Form SCIR. 353See Line Items 1.A. through 1.C. of Part I of proposed Form SCIR. See also section II.B.2.b. of this release (discussing UIC and CIK numbers in more detail with respect to Part I of proposed Form SCIR). 354See Line Item 1.D. of Part II of proposed Form SCIR (setting forth check boxes to indicate whether the Covered Entity is a broker-dealer, clearing agency, MSBSP, the MRSB, a national securities association, a national securities exchange, SBSD, SBSDR, or transfer agent). 355See paragraph (d)(1)(i) of proposed Rule 10. 356See Line Item 2 of Part II of proposed Form SCIR. significant cybersecurity incident that occurred during the current or previous calendar year, if applicable.344 The look￾back period of the current and previous calendar years is designed to make the disclosure period consistent across all Covered Entities. The look-back period also is designed to provide a short history of significant cybersecurity incidents affecting the Covered Entity while not overburdening the firm with a longer disclosure period. The summary description of each significant cybersecurity incident would need to include: (1) the person or persons affected; 345 (2) the date the incident was discovered and whether it is ongoing; (3) whether any data was stolen, altered, or accessed or used for any other unauthorized purpose; (4) the effect of the incident on the Covered Entity’s
operations; and (5) whether the Covered Entity, or service provider, has remediated or is currently remediating the incident.346 This disclosure— because it addresses actual significant cybersecurity incidents—would serve as another way for market participants to evaluate the Covered Entity’s cybersecurity risks and vulnerabilities apart from the general disclosure of its cybersecurity risk. For example, a Covered Entity’s disclosure of multiple significant cybersecurity incidents during the current or previous calendar year (particularly, if they did not impact other Covered Entities) would be useful in assessing whether the Covered Entity is adequately addressing cybersecurity risk or is more vulnerable to that risk as compared with other Covered Entities. The objective of these disclosures is to provide greater transparency to customers, counterparties, registrants, or members of the Covered Entity, or to users of its services, about the Covered Entity’s exposure to material harm as a result of a cybersecurity incident, which, in turn, could cause harm to customers, counterparties, members, registrants, or users. This information could be used by these persons to manage their own cybersecurity risk and, to the extent they have choice, select a Covered Entity with which to transact or otherwise conduct business. Information about prior attacks and their degree of success is immensely valuable in mounting effective countermeasures.347 However, the intent of the disclosure on Part II of proposed Form SCIR is to avoid overly detailed disclosures that could increase cybersecurity risk for the Covered Entity and other persons. Revealing too much information could assist future attackers as well as lead to loss of customers, reputational harm, litigation, or regulatory scrutiny, which would be a cost associated with public disclosure.348 Therefore, under proposed Rule 10, the Covered Entity would be required to provide only a summary description of its cybersecurity risk and significant cybersecurity incidents.349 The requirement that the disclosures contain summary descriptions only is designed to produce meaningful disclosures but not disclosures that would reveal information (e.g., proprietary or confidential methods of addressing cybersecurity risk or known cybersecurity vulnerabilities) that could be used by threat actors to cause harm to the Covered Entity or its customers, counterparties, members, users, or other persons. This requirement is also designed to produce high-level disclosures about the Covered Entity’s cybersecurity risks and significant cybersecurity incidents that can be easily reviewed by interested parties in order to give them a general understanding of the Covered Entity’s risk profile. b. Disclosure Methods and Updates Proposed Rule 10 would require a Covered Entity to make the public disclosures discussed above (i.e., the information about cybersecurity risks and significant cybersecurity incidents) on Part II of proposed
Form SCIR.350
Part II of proposed Form SCIR would
elicit information about the Covered Entity that would be used to identify the filer.351 In particular, the Covered Entity would need to provide its full legal name and business name (if different from its legal name), UIC (if the filer has a UIC),352 CIK number, and main address.353 The Covered Entity also would need to indicate the type of Market Entity it is by checking the appropriate box or boxes.354 For example, if the Covered Entity is dually registered as a broker-dealer and SBSD, it would need to check the box for each of those entity types.
Page 1 of Part II of proposed Form
SCIR also would contain fields for the individual executing the form to sign and date the form. By signing the form, the individual would: (1) certify that the form was executed on behalf of, and with the authority of, the Covered Entity; and (2) represent individually, and on behalf of the Covered Entity, that the information and statements contained in the form are current, true and complete. The form of the certification is designed to ensure that the Covered Entity, through the individual executing the form, discloses information that can be used by the Covered Entity’s customers, counterparties, members, registrants, or users, or by other interested persons to assess the Covered Entity’s cybersecurity risk profile and compare it with the risk profiles of other Covered Entities. As discussed above, proposed Rule 10 would require the Covered Entity to publicly disclose a summary description of the cybersecurity risks that could materially affect the Covered Entity’s business and operations and how the Covered Entity assesses, prioritizes, and addresses those cybersecurity risks.355 Line Item 2 of Part II of proposed Form SCIR would contain a narrative field in which the Covered Entity would provide this summary description.356 In order to provide context to the meaning of the disclosure, the beginning of Line Item 2 would set forth the definition of ‘‘cybersecurity risk’’ in proposed Rule 10 as well as the definitions of ‘‘cybersecurity incident,’’ ‘‘cybersecurity

357 Id. See also paragraphs (a)(2) through (5) of proposed Rule 10 (defining, respectively, ‘‘cybersecurity incident,’’ ‘‘cybersecurity risk,’’ ‘‘cybersecurity threat,’’ and ‘‘cybersecurity vulnerability’’). 358See Line Item 3 of Part II of proposed Form SCIR. 359See paragraph (d)(1)(ii) of proposed Rule 10. 360See 17 CFR 232.11. 361See paragraph (d)(2)(i) of proposed Rule 10. 362See paragraph (d)(2)(ii) of proposed Rule 10. In addition to the disclosure to be made available to security-based swap counterparties as required by paragraph (d)(2)(ii) of proposed Rule 10, current Commission rules require that SBS Entities’ trading relationship documentation between certain counterparties address cybersecurity. Specifically, an SBS Entity’s trading relationship documentation must include valuation methodologies for purposes of complying with specified risk management requirements, which would include the risk management requirements of proposed Rule 10 (if it is adopted). See 17 CFR 250.15Fi–5(b)(4). This documentation would include a dispute resolution process or alternative methods for determining value in the event of a relevant cybersecurity incident. See also section IV.C.1.b.iii. of this release (discussing disclosure requirements of Rule 15Fh￾3(b)). 363See paragraph (d)(3) of proposed Rule 10. 364 If the disclosure requirements of proposed Rule 10 are adopted, the Commission would establish a compliance date by which a Covered Entity would need to make its first public disclosure on Part II of proposed Form SCIR. At a minimum, the initial disclosure would need to include a summary description of the cybersecurity risks that could materially affect the Covered Entity’s business and operations and how the Covered Entity assesses, prioritizes, and addresses those cybersecurity risks. In setting an initial compliance date, the Commission could take a bifurcated approach in which each method of disclosure has a different compliance date. For example, the compliance date for making the website disclosure could come before the compliance date for making the EDGAR disclosure and the additional disclosure required of carrying and introducing broker-dealers. The Commission seeks comment below on a potential compliance date or compliance dates for the disclosure requirements. threat,’’ and ‘‘cybersecurity vulnerability’’ because these three terms are used in the definition of ‘‘cybersecurity risk.’’357 Line Item 3 of Part II of proposed Form SCIR would be used to make the disclosure about each significant cybersecurity incident that occurred during the current and previous calendar year.358 The definition of ‘‘significant cybersecurity incident’’ would be set forth at beginning of Line Item 3 in order to provide context to the meaning of the disclosure. To complete the line item, the Covered Entity first would need to indicate by checking ‘‘yes’’ or ‘‘no’’ whether it had experienced one or more significant cybersecurity incidents during the current or
previous calendar year. If the answer is yes, the Covered Entity would need to provide in a narrative field on Line Item 3 the summary description of each significant cybersecurity incident.359 As discussed next, there would be two methods of making the disclosure, which would be required of all Covered Entities under proposed Rule 10, and an additional third method that would be required of Covered Entities that are carrying or introducing broker-dealers. First, Covered Entities would be required to file Part II of Form SCIR with the Commission electronically through the EDGAR system in accordance with the EDGAR Filer Manual, as defined in Rule 11 of Regulation S–T,360 and in accordance with the requirements of Regulation S– T.361 The Commission would make these filings available to the public. The objective of requiring centralized EDGAR-filing of Part II of proposed Form SCIR is to facilitate the ability to compare disclosures across different Covered Entities or categories of Covered Entities in the same manner that EDGAR filing facilitates comparison of financial statements, annual reports, and other disclosures across Commission registrants. By creating a single location for all of the disclosures, Commission staff, investors, market participants, and analysts as well as Covered Entities’ customers, counterparties, members, registrants, or users would be able to run search queries to compare the disclosures of multiple Covered Entities. Centralized EDGAR filing could make it easier for Commission staff and others to assess the cybersecurity risk profiles of different types of Covered Entities and could facilitate trend analysis of significant cybersecurity incidents. Thus, by providing a central location for the cybersecurity disclosures, filing Part II of proposed Form SCIR through EDGAR could lead to greater transparency of the cybersecurity risks in the U.S. securities markets. Second, proposed Rule 10 would require the Covered Entity to post a copy of the Part II of proposed Form SCIR most recently filed on EDGAR on an easily accessible portion of its business internet website that can be viewed by the public without the need of entering a password or making any type of payment or providing any other consideration.362 Consequently, the disclosures could not be located behind a ‘‘paywall’’ or otherwise require a person to pay a registration fee or provide any other consideration to access them. The purpose of requiring the form to be posted on the Covered Entity’s business internet website is that individuals naturally may visit a company’s business internet website when seeking timely and updated information about the company, particularly if the company is experiencing an incident that disrupts or degrades the services it provides. Therefore, requiring the form to be posted on the website is designed to make it available through this commonly used method of obtaining information. Additionally, individuals may naturally visit a
company’s business internet website as part of their due diligence process in determining whether to use its services. Therefore, posting the form on the Covered Entity’s business internet website could provide individuals with information about the Covered Entity’s cybersecurity risks before they elect to enter into an arrangement with the firm. It could serve a similar purpose for individuals considering whether to maintain an ongoing business relationship with the Covered Entity. In addition to those two disclosure methods, a Covered Entity that is either a carrying or introducing broker-dealer would be required to provide a copy of the Part II of proposed Form SCIR most recently filed on EDGAR to a customer as part of the account opening process.363 Thereafter, the Covered Entity would need to provide the customer with the most recently posted form annually and when it is updated. The broker-dealer would need to deliver the form using the same means that the customer elects to receive account statements (e.g., by email or through the postal service).364 This additional method of disclosure is designed to make the information readily available to the broker-dealer’s customers (many of whom may be retail investors) through the same processes that other important information (i.e., information about their securities accounts) is communicated to them. Requiring a broker-dealer to deliver copies of the form is designed to enhance investor protection by enabling customers to take protective or remedial measures to the extent appropriate. It would also assist customers in determining whether their engagement of that particular broker￾dealer remains appropriate and consistent with their investment objectives. Finally, a Covered Entity would be required to file on EDGAR an updated
Part II of proposed Form SCIR promptly
if the information required to be disclosed about cybersecurity risks or significant cybersecurity incidents materially changes, including, in the case of the disclosure about significant cybersecurity incidents, after the occurrence of a new significant cybersecurity incident or when

365See paragraph (d)(4) of proposed Rule 10. See also Instruction C.2. of proposed Form SCIR. As discussed earlier, a Covered Entity would be required to file Part I of proposed Form SCIR with the Commission promptly, but no later than 48 hours, upon having a reasonable basis to conclude that a significant cybersecurity incident has occurred or is occurring. See paragraph (c)(2)(i) of proposed Rule 10; see also section II.B.2.a. of this release (discussing this requirement in more detail). Therefore, the Covered Entity would need to file a
Part I and an updated Part II of proposed Form SCIR
with the Commission relatively contemporaneously. Depending on the facts and circumstances, the Part I and updated Part II could be filed at the same time or one could proceed the other if the Covered Entity, for example, has the information to complete Part II first but needs more time to gather the information to complete Part I (which elicits substantially more information than
Part II). However, as discussed above, Part I must
be filed no later than 48 hours after the Covered Entity has a reasonable basis to conclude that a significant cybersecurity incident has occurred or is occurring and the Covered Entity must include in the initial filing the information that is known at that time and file an updated Part I as more information becomes known to the Covered Entity. information about a previously disclosed significant cybersecurity incident materially changes.365 The Covered Entity also would need to post a copy of the updated Part II of proposed Form SCIR promptly on its business internet website and, if it is a carrying broker-dealer or introducing broker-dealer, deliver copies of the form to its customers. Given the potential effect that significant cybersecurity incidents could have on a Covered Entity’s customers, counterparties, members, registrants, or users—such as exposing their personal or other confidential information or resulting in a loss of cash or securities from their accounts—time is of the essence, and requiring a Covered Entity to update the disclosures promptly would enhance investor protection by enabling customers, counterparties, members, registrants, or users to take proactive or remedial measures to the extent appropriate. Accordingly, the timing of the filing of an updated disclosure should take into account the exigent nature of significant cybersecurity incidents which would generally militate toward swiftly filing the update. Furthermore, requiring Covered Entities to update their disclosures following the occurrence of a new significant cybersecurity incident would assist market participants in determining whether their business relationship with that particular Covered Entity remains appropriate and consistent with their goals. A Covered Entity also would need to file an updated Part II of proposed Form SCIR if the information in the summary description of a significant cybersecurity incident included on the form is no longer within the look-back period (i.e., the current or previous calendar year). For example, the information that would need to be included in the summary description includes whether the significant cybersecurity incident is ongoing and whether the Covered Entity had remediated it. The Covered Entity would need to file an updated Part II of proposed Form SCIR if the significant cybersecurity incident was remediated and ended on a date that was beyond the look-back period. The updated Part II of proposed Form SCIR would no longer include a summary description of that specific significant cybersecurity incident. The objective is to focus the most recently filed disclosure on events within the relative near term. The history of the Covered Entity’s significant cybersecurity incidents would be available in previous filings.
c. Request for Comment
The Commission requests comment on all aspects of the proposed disclosure requirements. In addition, the Commission is requesting comment on the following specific aspects of the proposals:
55. Should paragraph (d)(1)(i) of
proposed Rule 10 be modified to revise the requirements that Covered Entities publicly disclose the cybersecurity risks that could materially affect their business and operations and to publicly disclose a description of how the Covered Entity assesses, prioritizes, and addresses those cybersecurity risks? If so, explain why. If not, explain why not. For example, would the public disclosures required by paragraph (d)(1)(i) of proposed Rule 10 be useful or provide meaningful information to a Covered Entity’s customers, counterparties, members, registrants, or users? If so, explain why. If not, explain why not. Could the proposed disclosure requirement be modified to make it more useful? If so, explain how. Could the public disclosures required by paragraph (d)(1)(i) of proposed Rule 10 assist threat actors in engaging in cyber crime? If so, explain why. If not, explain why not. Could the proposed disclosure requirements be modified to eliminate this risk without negatively impacting the usefulness of the disclosures? If so, explain how.
56. Should paragraph (d)(1)(ii) of
proposed Rule 10 be modified to revise the requirements that Covered Entities publicly disclose information about each significant cybersecurity incident that has occurred during the current or previous calendar year? If so, explain why. If not, explain why not. For example, would the public disclosures required by paragraph (d)(1)(ii) of proposed Rule 10 be useful or provide meaningful information to a Covered Entity’s customers, counterparties, members, registrants, or users? If so, explain why. If not, explain why not. Could the proposed disclosure requirement be modified to make it more useful? If so, explain how. Could the public disclosures required by paragraph (d)(1)(ii) of proposed Rule 10 assist threat actors in engaging in cyber crime? If so, explain why. If not, explain why not. Could the proposed disclosure requirements be modified to eliminate this risk without negatively impacting the usefulness of the disclosures? If so, explain how.
57. Should paragraph (d)(1)(ii) of
proposed Rule 10 be modified to revise the required current and previous year look-back period for the disclosure of significant cybersecurity incidents? If so, explain why. If not, explain why not. For example, should the look-back period be a shorter period of time (e.g., only the current calendar year)? If so, explain why. If not, explain why not. Alternatively, should the look-back period be longer (e.g., the current calendar year and previous two calendar years)? If so, explain why. If not, explain why not. Should the look-back period be expressed in months rather than calendar years? For example, should the look-back period be 12, 18, 24, 30, or 36 months? If so, explain why. If not, explain why not.
58. Should paragraph (d)(1)(ii) of
proposed Rule 10 be modified to provide that the requirement to include a summary description of each significant cybersecurity incident that occurred during the current or previous calendar year in Part II of proposed Form SCIR be prospective and, therefore, limited to significant cybersecurity incidents that occur on or after the compliance date of the disclosure requirement? If so, explain why. If not, explain why not.
59. Should the public disclosure
requirements of paragraphs (d)(1)(i) and (ii) of proposed Rule 10 be modified to require the disclosure of additional or different information? If so, identify the additional or different information and explain why it would be appropriate to require its public disclosure by Covered Entities.
60. Should 17 CFR 240.15Fh-3(b) be
amended to specify that required counterparty disclosure includes the information that would be required by paragraph (d)(1) of proposed Rule 10 and publicly disclosed on Part II of proposed Form SCIR? If so, explain why. If not explain why not.
61. Should paragraph (d)(2) of
proposed Rule 10 be modified to revise

366See Form CRS Instructions, available at https://www.sec.gov/files/formcrs.pdf. 367As mentioned previously in section II.B.2.b. of this release, the Commission approved a UIC (namely, the LEI) in a previous rulemaking. The Commission is aware that additional identifiers could be recognized as UICs in the future, but for the purposes of this release, the Commission is equating the UIC with the LEI. the methods of making the public disclosures? If so, explain why. If not, explain why not. For example, should Covered Entities be required to file Part II of proposed Form SCIR on EDGAR but not be required to post a copy of the form on their business internet websites? If so, explain why. If not, explain why not. Would requiring the public cybersecurity disclosures to be filed in a centralized electronic system, such as EDGAR, make it easier for investors, analysts, and others to access and gather information from the cybersecurity disclosures than if those disclosures were only posted on Covered Entity websites? Alternatively, should Covered Entities be required to post an executed copy of Part II of proposed Form SCIR on their business internet websites but not be required to file the form on EDGAR? If so, explain why. If not, explain why not. Why or why not?
62. Should paragraph (d)(2) of
proposed Rule 10 be modified to revise the requirement to post a copy of Part II of proposed Form SCIR on business internet website of the Covered Entity to permit the Covered Entity to post a link to the EDGAR filing? If so, explain why. If not, explain why not.
63. Should paragraph (d)(3) of
proposed Rule 10 be modified to revise the additional methods of making the public disclosures required of carrying and introducing broker-dealers? If so, explain why. If not, explain why not. For example, would filing Part II of proposed Form SCIR on EDGAR and posting a copy of the form on the Covered Entity’s business internet website be sufficient to meet the objectives of the disclosure requirements discussed above and, therefore, obviate the need for a carrying broker-dealer or introducing broker￾dealer to additionally send copies of the form to customers? If so, explain why. If not, explain why not. Rather than requiring the broker-dealer or introducing broker-dealer to send a copy of the Part II of proposed Form SCIR most recently filed on EDGAR to each customer, would it be sufficient that the most recently filed form as of the end of each quarter or the calendar year be sent to the customers? If so, explain why. If not, explain why not.
64. Should paragraph (d)(3) of
proposed Rule 10 be modified to permit the Covered Entity to send a website link to the EDGAR filing to customers instead of a copy of the EDGAR filing? If so, explain why. If not, explain why not.
65. Should paragraph (d)(3) of
proposed Rule 10 be modified to require other types of Covered Entities to send a copy of the most recently filed Part II of proposed Form SCIR to their customers, counterparties, members, registrants, or users? If so, explain why. If not, explain why not. For example, should transfer agents be required to send the most recently filed Part II of proposed Form SCIR to their securityholders? If so, explain why. If not, explain why not.
66. Should paragraph (d)(4) of
proposed Rule 10 be modified to revise the requirement that a Covered Entity must ‘‘promptly’’ provide an updated disclosure on Part II of proposed Form SCIR if the information on the previous disclosure materially changes to provide that the Commission shall allow registrants to delay publicly disclosing a significant cybersecurity incident where the Attorney General requests such a delay from the Commission based on the Attorney General’s written determination that the delay is in the interest of national security?
67. Should paragraph (d)(4) of
proposed Rule 10 be modified to revise the requirement that a Covered Entity must ‘‘promptly’’ provide an updated disclosure on Part II of proposed Form SCIR if the information on the previous disclosure materially changes to specify a timeframe within which the updated filing must be promptly made? If so, explain why. If not, explain why not. For example, should the rule be modified to require that the updated disclosure must be made within 24, 36, 48, or 60 hours of the information on the previous disclosure materially changing? If so, explain why. If not, explain why not. Should the timeframe for making the updated disclosure be expressed in business days? If so, explain why. If not, explain why not. For example, should the updated disclosure be required to be made within two, three, four, or five business days (or some other number of days) of the information on the previous disclosure materially changing? If so, explain why. If not, explain why not.
68. Should paragraph (d)(4) of
proposed Rule 10 be modified to revise the requirement that a Covered Entity must ‘‘promptly’’ provide an updated disclosure on Part II of proposed Form SCIR if the information on the previous disclosure materially changes to require the update to be made within 30 days (similar to the requirement for updating Form CRS)? 366 If so, explain why. If not, explain why not. For example, would this approach appropriately balance the objective of requiring timely disclosure with the objective of providing accurate and complete disclosure? If so, explain why. If not, explain why not.
69. Should paragraph (d)(4) of
proposed Rule 10 be modified to revise the requirements that trigger when an updated Part II of proposed Form SCIR must be filed on EDGAR, posted on the Covered Entity’s business internet website, and, if applicable, sent to customers? If so, explain why. If not, explain why not. For example, should the rule require that an updated form must be publically disclosed through these methods on a quarterly, semi￾annual, or annual basis if the information on the previously filed form has materially changed? If so, explain why. If not, explain why not.
70. Should Part II of proposed Form
SCIR be modified to require that Covered Entities provide a UIC—such as an LEI (which would require Covered Entities without a UIC (such as an LEI) to obtain one to comply with the rule)? 367 If so, explain why. If not, explain why not. For example, would requiring Covered Entities to provide a UIC better allow investors, analysts, and third-party data aggregators to evaluate the cyber security risk profiles of Covered Entities? If so, explain why. If not, explain why not. Should the form be modified to require Covered Entities to provide another type of standard identifier other than a CIK number and UIC (if they have a UIC)? If so, explain why. If not, explain why not.
71. If the disclosure requirements of
proposed Rule 10 are adopted, what would be an appropriate compliance date for the disclosure requirements? For example, should the compliance date be three, six, nine, or twelve months after the effective date of the rule (or some other period of months)? Please suggest a compliance period and explain why it would be appropriate. Should the compliance date for the website disclosure be sooner than the compliance date for the EDGAR disclosure or vice versa? If so, explain why. If not, explain why not. Should the compliance date for the additional disclosure methods that would be required of carrying and introducing broker-dealers be different than the compliance dates for the website disclosure and the EDGAR disclosure? If so, explain why. If not, explain why not. If the requirement to provide a summary description of each significant cybersecurity incident that occurred

368See 17 CFR 232.11. 369See paragraphs (c) and (d) of proposed Rule 10. 370Requirements related to custom-XML filings are generally covered in the EDGAR Filer Manual, which is incorporated in Commission regulations by reference via Regulation S–T. See 17 CFR 232.11; 17 CFR 232.101. 371See Commission, Current EDGAR Technical Specifications (Dec. 5, 2022), available at https:// www.sec.gov/edgar/filer-information/current-edgar￾technical-specifications. 372See Chapters 8 and 9 of the EDGAR Filer Manual (Volume II), version 64 (Dec. 2022). 373See section IV.F. of this release. 374See paragraph (b)(1) of proposed Rule 10. See also sections II.B.1.a. through II.B.1.e. of this release (discussing this proposed requirement in more detail). 375See paragraph (b)(1)(i)(B) of proposed Rule 10. See also section II.B.1.a. of this release (discussing this proposed requirement in more detail). 376See paragraph (b)(1)(v)(B) of proposed Rule 10. See also section II.B.1.e. of this release (discussing this proposed requirement in more detail). 377See paragraph (b)(2)(ii) of proposed Rule 10. See also section II.B.1.f. of this release (discussing this proposed requirement in more detail). 378See paragraph (c)(1) of proposed Rule 10. See also section II.B.2.a. of this release (discussing this proposed requirement in more detail). 379See paragraph (c)(2) of proposed Rule 10. See also Section II.B.2.b. of this release (discussing this proposed requirement in more detail). 380See paragraph (d) of proposed Rule 10. See also Section II.B.3. of this release (discussing this proposed requirement in more detail). during the current and previous calendar year is prospective (i.e., does not apply to incidents that occurred before the compliance date), should the compliance period be shorter than if the requirement was retrospective, given that the initial disclosure, in most cases, would limited to a summary description of the cybersecurity risks that could materially affect the Covered Entity’s business and operations and how the Covered Entity assesses, prioritizes, and addresses those cybersecurity risks? If so, explain why. If not, explain why not.
4. Filing Parts I and II of Proposed Form
SCIR in EDGAR Using a Structured Data Language a. Discussion Proposed Rule 10 would require Covered Entities would file Parts I and II of proposed Form SCIR electronically with the Commission using the EDGAR system in accordance with the EDGAR Filer Manual, as defined in Rule 11 of Regulation S–T,368 and in accordance with the requirements of Regulation S– T.369 In addition, under the proposed requirements, Covered Entities would file Parts I and II of Form SCIR in a structured (i.e., machine-readable) data language.370 Specifically, Covered Entities would file Parts I and II of proposed Form SCIR in an eXtensible Markup Language (‘‘XML’’)-based data language specific to the form (‘‘custom XML,’’ and in this release ‘‘SCIR￾specific XML’’). While the majority of filings through the EDGAR system are submitted in unstructured HTML or ASCII formats, certain EDGAR-system filings are submitted using custom XML languages that are each specific to the particular form being submitted.371 For such filings, filers are typically provided the option to either submit the filing directly to the EDGAR system in the relevant custom XML data language, or to manually input the information into a fillable web-based form developed by the Commission that converts the completed form into a custom XML document.372 Requiring Covered Entities to file Parts I and II of proposed Form SCIR through the EDGAR system would allow the Commission to download Form SCIR information directly from a central location, thus facilitating efficient access, organization, and evaluation of the information contained in the forms. Use of the EDGAR system also would enable technical validation of the information reported on Form SCIR, which could potentially reduce the incidence of non-discretionary errors (e.g., leaving required fields blank). Thus, the proposed requirement to file Parts I and II of proposed Form SCIR through the EDGAR system would allow the Commission and, in the case of Part II, the public to more effectively examine and analyze the reported information. In this regard, the proposed requirement to file Parts I and II of proposed Form SCIR through the EDGAR system using SCIR-specific XML, a machine-readable data language, is designed to facilitate more thorough review and analysis of the reported information. b. Request for Comment The Commission requests comment on all aspects of the proposed requirements to file Parts I and II of Form SCIR in EDGAR using a structured data language. In addition, the Commission is requesting comment on the following specific aspects of the proposals:
72. Should the Commission modify
the structured data language requirement for both Parts I and II of Form SCIR in accordance with the alternatives discussed in Section IV.F. below? 373 Should Covered Entities be required to file the cybersecurity risk and incident disclosures on Part II of Form SCIR in the EDGAR system in a structured data language? Why or why not? Would custom XML or Inline eXtensible Business Reporting Language (‘‘iXBRL’’) be the most suitable data language for this information? Or would another data language be more appropriate?
5. Recordkeeping
a. Amendments to Covered Entity Recordkeeping Rules As discussed above, proposed Rule 10 would require a Covered Entity to: (1) establish, maintain, and enforce reasonably designed policies and procedures to address cybersecurity risks; 374 (2) create written documentation of risk assessments; 375 (3) create written documentation of any cybersecurity incident, including its response to and recovery from the incident; 376 (4) prepare a written report each year describing its annual review of its policies and procedures to address cybersecurity risks; 377 (5) provide immediate electronic written notice to the Commission of a significant cybersecurity incident upon having a reasonable basis to conclude that the significant cybersecurity incident has occurred or is occurring; 378 (6) report, not later than 48 hours, upon having a reasonable basis to conclude that a significant cybersecurity incident has occurred or is occurring on Part I of proposed Form SCIR; 379 and (7) provide a written summary disclosure about its cybersecurity risks that could materially affect its business and operations, and how the Covered Entity assesses, prioritizes, and addresses those risks, and significant cybersecurity incidents that occurred during the current or previous calendar year on Part II of proposed Form SCIR.380 Consequently, proposed Rule 10 would require a Covered Entity to make several different types of records (collectively, the ‘‘Rule 10 Records’’). The proposed cybersecurity rule would not include requirements specifying how long these records would need to be preserved and the manner in which they would need to be maintained. Instead, as discussed below, preservation and maintenance requirements applicable to Rule 10 Records would be imposed through amendments, as necessary, to the existing record preservation and maintenance rules applicable to the Covered Entities. In particular, broker-dealers, transfer agents, and SBS Entities are subject to existing requirements that specify how long the records they are required to make must be preserved (e.g., three or six years) and how the records must be maintained (e.g., maintenance

381See 17 CFR 240.17a-4 (‘‘Rule 17a–4’’) (setting forth record preservation and maintenance requirements for broker-dealers); 17 CFR 240.17Ad– 7 (‘‘Rule 17ad-7’’) (setting forth record preservation and maintenance requirements for transfer agents); 17 CFR 240.18a–6 (‘‘Rule 18a–6’’) (setting forth record preservation and maintenance requirements for SBS Entities). The Commission’s proposal includes an amendment to a CFR designation in order to ensure regulatory text conforms more consistently with section 2.13 of the Document Drafting Handbook. See Office of the Federal Register, Document Drafting Handbook (Aug. 2018 Edition, Revision 1.4, dated January 7, 2022), available at https://www.archives.gov/files/federal￾register/write/handbook/ddh.pdf. In particular, the proposal is to amend the CFR section designation for Rule 17Ad–7 (17 CFR 240.17Ad–7) to replace the uppercase letter with the corresponding lowercase letter, such that the rule would be redesignated as Rule 17ad–7 (17 CFR 240.17ad–7). 382This amendment would add a new paragraph (e)(13) to Rule 17a–4. 383This amendment would add a new paragraph (j) to Rule 17ad–7. 384This amendment would add a new paragraph (d)(6) to Rule 18a–6 . 385See paragraphs (f) of Rule 17a–4, (f) of Rule 17ad–7, and (e) of Rule 18a-6 (setting forth requirements for electronic records applicable to broker-dealers, transfer agents, and SBS Entities, respectively). 386See 17 CFR 240.17a–1. 387See paragraph (a) of Rule 17a–1. 388See paragraph (b) of Rule 17a–1; 17 CFR 240.17a–6 (‘‘Rule 17a–6’’). Rule 17a–6 of the Exchange Act provides that an SRO may destroy such records at the end of the five year period or at an earlier date as is specified in a plan for the destruction or disposition of any such documents if such plan has been filed with the Commission by SRO and has been declared effective by the Commission. 389See, e.g., Nationally Recognized Statistical Rating Organizations, Exchange Act Release No. 72936 (Aug. 27, 2014) [79 FR 55078, 55099–100 (Sept. 15, 2014)] (explaining why preservation periods for written policies and procedures are based on when a version of the policies and procedures is updated or replaced). 390See 17 CFR 240.13n–7. 391See paragraph (b)(1) of Rule 13n–7. 392See paragraph (b)(2) of Rule 13n–7. 393See paragraph (a)(1)(ii) of proposed Rule 10 (defining as a ‘‘covered entity’’ a clearing agency (registered or exempt) under section 3(a)(23)(A) of the Exchange Act). See also section I.A.2.c. of this release (discussing the clearing agency exemptions provided by the Commission). 394See Confirmation and Affirmation of Securities Trades; Matching, Exchange Act Release No. 39829 (Apr. 6, 1998) [63 FR 17943 (Apr. 13, 1998)] (providing interpretive guidance and requesting comment on the confirmation and affirmation of securities trades and matching). 395See, e.g., BSTP SS&C Order, 80 FR at 75411 (conditioning BSTP’s exemption by requiring BSTP to, among other things, preserve a copy or record of all
trade details, allocation instructions, central trade matching results, reports and notices sent to customers, service agreements, reports regarding affirmation rates that are sent to the Commission or its designee, and any complaint received from a customer, all of which pertain to the operation of its matching service and ETC service. BSTP shall retain these records for a period of not less than five years, the first two years in an easily accessible place.). 396See DTCC ITP Matching Order, 66 FR 20494; BSTP SS&C Order, 80 FR 75388; Euroclear Bank Order, 81 FR 93994. requirements for electronic records).381 The Commission is proposing to amend these record preservation and maintenance requirements to identify Rule 10 Records specifically as records that would need to be preserved and maintained pursuant to these existing requirements. In particular, the Commission is proposing to amend the record preservation and maintenance rules for: (1) broker-dealers; 382 (2) transfer agents; 383 and (3) SBS entities.384 The proposed amendments would specify that the Rule 10 Records must be retained for three years. In the case of the written policies and procedures to address cybersecurity risks, the record would need to be maintained until three years after the termination of the use of the policies and procedures. These amendments would subject the Rule 10 Records to the record maintenance requirements of Rules 17a–4, 17ad–7, and 18a–6, including the requirements governing electronic records.385 Exchange Act Rule 17a–1 (‘‘Rule 17a– 1’’)—the record maintenance and preservation rule applicable to registered clearing agencies, the MSRB, national securities associations, and national securities exchanges—as it exists today would require the preservation of the Rule 10 Records.386 In particular, Rule 17a–1 requires these types of Covered Entities to keep and preserve at least one copy of all documents, including all correspondence, memoranda, papers, books, notices, accounts, and other such records as shall be made or received by the Covered Entity in the course of its business as such and in the conduct of its self-regulatory activity.387 Furthermore, Rule 17a–1 provides that the Covered Entity must keep the documents for a period of not less than five years, the first two years in an easily accessible place, subject to the destruction and disposition provisions of Exchange Act Rule 17a–6.388 Consequently, under the existing provisions of Rule 17a–1, registered clearing agencies, the MSRB, national securities associations, and national securities exchanges would be required to preserve at least one copy of the Rule 10 Records for at least five years, the first two years in an easily accessible place. In the case of the written policies and procedures to address cybersecurity risks, pursuant to Rule 17a–1 the record would need to be maintained until five years after the termination of the use of the policies and procedures.389 Similarly, Exchange Act Rule
13n–7 (‘‘Rule 13n–7’’)—the record maintenance and preservation rule applicable to SBSDRs—as it exists today would require the preservation of the Rule 10 Records.390 In particular, Rule 13n–7 requires SBSDRs to, among other things, keep and preserve at least one copy of all documents, including all documents and policies and procedures required by the Exchange Act and the rules and regulations thereunder, correspondence, memoranda, papers, books, notices, accounts, and other such records as shall be made or received by it in the course of its business as such.391 Furthermore, Rule 13n–7 provides that the SBSDR must keep the documents for a period of not less than five years, the first two years in a place that is immediately available to representatives of the Commission for inspection and examination.392 Consequently, under the existing provisions of Rule 13n–7, SBSDRs would be required to preserve at least one copy of the Rule 10 Records for at least five years, the first two years in a place that is immediately available to representatives of the Commission for inspection and examination. In the case of the written policies and procedures to address cybersecurity risks, the Commission interprets this provision of Rule 13n–7 to require that the record would need to be maintained until five years after the termination of the use of the policies and procedures. Clearing agencies that are exempt from registration would be Covered Entities under proposed Rule 10.393 Exempt clearing agencies are not subject to Rule 17a–1. However, while exempt clearing agencies—as entities that have limited their clearing agency functions—might not be subject to the full range of clearing agency regulation, the Commission has stated that, for example, an entity seeking an exemption from clearing agency registration for matching services would be required to, among other things, allow the Commission to inspect its facilities and records.394 In this regard, exempt clearing agencies are subject to conditions that mirror certain of the recordkeeping requirements in Rule 17a–1,395 as set forth in the respective Commission orders exempting each exempt clearing agency from the requirement to register as a clearing agency (the ‘‘clearing agency exemption orders’’).396 Pursuant to the terms and conditions of the clearing agency exemption orders, the Commission may modify by order the terms, scope, or conditions if the Commission determines that such modification is necessary or appropriate in the public interest, for the protection of investors, or otherwise in furtherance of the

397See Clearstream Banking Order, 62 FR 9225. 398See section II.A.1. of this release (discussing the definition of ‘‘covered entity’’ and why certain broker-dealers would not be included within the definition). 399See paragraphs (b)(1)(i) through (v) of proposed Rule 10. 400See paragraph (c)(2) of proposed Rule 10. See also paragraph (a)(10) of proposed Rule 10 (defining the term ‘‘significant cybersecurity risk’’). 401See paragraph (d) of proposed Rule 10. 402See paragraph (e)(1) of proposed Rule 10. 403See paragraph (e)(2) of proposed Rule 10. 404See paragraph (a)(1)(i)(A) of proposed Rule 10 (defining ‘‘covered entity’’ to include a broker￾dealer that maintains custody of cash and securities for customers or other broker-dealers and is not exempt from the requirements of Rule 15c3–3). 405See paragraph (a)(1)(i)(B) of proposed Rule 10 (defining ‘‘covered entity’’ to include a broker￾dealer that introduces customer accounts on a fully disclosed basis to another broker-dealer that maintains custody of cash and securities for customers or other broker-dealers and is not exempt from the requirements of Rule 15c3–3). 406See paragraphs (a)(1)(i)(C) and (D) of proposed Rule 10 (defining ‘‘covered entity’’ to include a broker-dealer with regulatory capital equal to or exceeding $50 million or total assets equal to or exceeding $1 billion). 407See paragraph (a)(1)(i)(E) of proposed Rule 10 (defining ‘‘covered entity’’ to include a broker￾dealer that is a market maker under the Exchange Act or the rules thereunder (which includes a broker-dealer that operates pursuant to Rule 15c3– 1(a)(6)) or is a market maker under the rules of an SRO of which the broker-dealer is a member). 408See paragraph (a)(1)(i)(F) of proposed Rule 10 (defining ‘‘covered entity’’ to include a broker￾dealer that is an ATS). purposes of the Exchange Act.397 In support of the public interest and the protection of investors, the Commission is proposing to amend the clearing agency exemption orders to add a condition that each exempt clearing agency must retain the Rule 10 Records for a period of at least five years after the record is made or, in the case of the written policies and procedures to address cybersecurity risks, for at least five years after the termination of the use of the policies and procedures. b. Request for Comment The Commission requests comment on all aspects of the proposed recordkeeping requirements. In addition, the Commission is requesting comment on the following specific aspects of the proposals:
73. Should the proposed amendments
to Rules 17a–4, 18a–6, and/or 17ad–7 be modified? If so, describe how they should be modified and explain why the modification would be appropriate. For example, should the retention periods for the records be five years (consistent with Rule 17a–1) or some other period of years as opposed to three years? If so, explain why. If not, explain why not.
74. As discussed above, the
Commission is proposing to amend the clearing agency exemption orders to specifically require the exempt clearing agencies to retain the Rule 10 Records. Should the ordering language be consistent with the proposed amendments to Rules 17a–4, 17ad–7, and18a–6? For example, should the ordering language provide that the exempt clearing agency must maintain and preserve: (1) the written policies and procedures required to be adopted and implemented pursuant to paragraph (b)(1) of proposed Rule 10 until five years after the termination of the use of the policies and procedures; (2) the written documentation of any risk assessment pursuant to paragraph (b)(1)(i)(B) of proposed Rule 10 for five years; (3) the written documentation of the occurrence of a cybersecurity incident pursuant to paragraph (b)(1)(v)(B) of proposed Rule 10, including any documentation related to any response and recovery from such an incident, for five years; (4) the written report of the annual review required to be prepared pursuant to paragraph (b)(2)(ii) of proposed Rule 10 for five years; (5) a copy of any notice transmitted to the Commission pursuant to paragraph (c)(1) of proposed Rule 10 or any Part I of proposed Form SCIR filed with the Commission pursuant to paragraph (c)(2) of proposed Rule 10 for five years; and (6) a copy of any Part II of proposed Form SCIR filed with the Commission pursuant to paragraph (d) of proposed Rule 10 for five years? Additionally, should the ordering language provide that the exempt clearing agency must allow the Commission to inspect its facilities and records? If so, explain why. If not, explain why not.
C. Proposed Requirements for Non￾Covered Broker-Dealers

1. Cybersecurity Policies and
   Procedures, Annual Review, Notification, and Recordkeeping As discussed earlier, not all broker￾dealers would be Covered Entities under proposed Rule 10.398 Consequently, these Non-Covered Broker-Dealers would not be subject to the requirements of proposed Rule 10 to: (1) include certain elements in their cybersecurity risk management policies and procedures; 399 (2) file confidential reports that provide information about the significant cybersecurity incident with the Commission and, for some Covered Entities, other regulators; 400 and (3) make public disclosures about their cybersecurity risks and the significant cybersecurity incidents they experienced during the current or previous calendar year.401 In light of their limited business activities, Non-Covered Broker-Dealers would not be subject to the same requirements as would Covered Entities. Instead, Non-Covered Broker-Dealers would be required to establish, maintain, and enforce written policies and procedures that are reasonably designed to address their cybersecurity risks taking into account the size, business, and operations of the firm.402 They also would be required to review and assess the design and effectiveness of their cybersecurity policies and procedures, including whether the policies and procedures reflect changes in cybersecurity risk over the time period covered by the review. They also would be required to make a record with respect to the annual review. In addition, they would be required to provide the Commission and their examining authority with immediate written electronic notice of a significant cybersecurity incident affecting them.403 Finally, they would be required to maintain and preserve versions of their policies and procedures and the record of the annual review. A Non-Covered Broker-Dealer could be a firm that limits its business to selling mutual funds on a subscription￾way basis or a broker-dealer that limits its business to engaging in private placements for clients. Alternatively, it could be a broker-dealer that limits its business to effecting securities transactions in order to facilitate mergers, acquisitions, business sales, and business combinations or a broker￾dealer that limits its business to engaging in underwritings for issuers. Moreover, a Non-Covered Broker￾Dealer—because it does not meet the definition of ‘‘covered entity’’—would not a be a broker-dealer that: maintains custody of customer securities and cash; 404 connects to a broker-dealer that maintains custody of customer securities through an introducing relationship; 405 is a large proprietary trading firm; 406 operates as a market maker; 407 or operates an ATS.408 A broker-dealer that limits its business to one of the activities described above and that does not engage in functions that would make it a Covered Entity under proposed Rule 10 generally does not use information systems to carry out its operations to the same degree as a broker-dealer that is a Covered Entity. For
   example, the information systems used by a Non￾Covered Broker-Dealer could be limited to smart phones and personal computers with internet and email access. Moreover, this type of firm may have a small staff of employees using these information systems. Therefore, the

409See paragraph (b)(1) of proposed Rule 10 (setting forth the elements that would need to be included in a Covered Entity’s policies and procedures). 410As discussed earlier, the elements are consistent with industry standards for addressing cybersecurity risk. See section II.B.1. of this release (discussing the policies and procedures requirements for Covered Entities). 411See paragraph (e)(1) of proposed Rule 10. 412See section II.B.1.f. of this release (discussing in more detail the annual report that would be required of Covered Entities). 413See paragraph (c)(1) of proposed Rule 10. See also section II.B.2.a. of this release (discussing the immediate notification requirement for Covered Entities in more detail). 414See paragraph (e)(2) of proposed Rule 10. See also paragraph (a)(10) of proposed Rule 10 (defining the term ‘‘significant cybersecurity incident’’). 415See paragraph (e)(2) of proposed Rule 10. See also paragraph (c)(1)(i) of proposed Rule 10 (requiring Covered Broker-Dealers to provide the notice to their examining authority). 416See paragraph (e) of proposed Rule 10. 417This amendment would add a new paragraph (e)(13) to Rule 17a–4. overall footprint of the information systems used by a Non-Covered Broker￾Dealer may be materially smaller in scale and complexity than the footprint of the information systems used by a broker-dealer that is a Covered Entity. In addition, the amount of data stored on these information systems relating to the Non-Covered Broker-Dealer’s business may be substantially less than the amount of data stored on a Covered Entity’s information systems. This means the information system perimeter of these firms that needs to be protected from cybersecurity threats and vulnerabilities is significantly smaller than that of a Covered Broker-Dealer. For these reasons, proposed Rule 10 would provide that the written policies and procedures required of a Non￾Covered Broker-Dealer must be reasonably designed to address the cybersecurity risks of the firm taking into account the size, business, and operations of the firm. Therefore, unlike the requirements for a Covered Entity, proposed Rule 10 does not specify minimum elements that would need to be included in a Non￾Covered Broker-Dealer’s policies and procedures.409 Nonetheless, a Non￾Covered Broker-Dealer may want to consider whether any of those required elements would be appropriate components of it policies and procedures for addressing cybersecurity risk.410 Proposed Rule 10 also would require that the Non-Covered Broker-Dealer annually review and assess the design and effectiveness of its cybersecurity policies and procedures, including whether the policies and procedures reflect changes in cybersecurity risk over the time period covered by the review.411 The annual review and assessment requirement is designed to require Non-Covered Broker-Dealers to evaluate whether their cybersecurity policies and procedures continue to work as designed. Non-Covered
Broker￾Dealers could consider using this information to determine whether changes are needed to assure their continued effectiveness (i.e., to make sure their policies and procedures continue to be reasonably designed to address their cybersecurity risks as required by the rule). The rule also would require the Non￾Covered Broker-Dealer to make a written record that documents the steps taken in performing the annual review and the conclusions of the annual review. Therefore, Non-Covered Broker-Dealers would need to make a record of the review rather than documenting the review in a written report, as would be required of Covered Entities.412 A report is a means to communicate information within an organization. The personnel that prepare the report for the Covered Entity would be able to use it to communicate their assessment of the firm’s policies and procedures to others within the organization such as senior managers. For purposes of proposed Rule 10, a record, among other things, is a means to document that an activity took place, for example, to demonstrate compliance with a requirement. As discussed above, Non-Covered Broker￾Dealers generally would be smaller and less complex organizations than Covered Entities. A record of the annual review could be used by Commission examination staff to review the Non￾Covered Broker-Dealer’s compliance with the annual review requirement without imposing the additional process involved in creating an internal report. As discussed earlier, Covered Entities would be subject to a requirement to give the Commission immediate written electronic notice of a significant cybersecurity incident upon having a reasonable basis to conclude that the significant cybersecurity incident has occurred or is occurring.413 Non￾Covered Broker-Dealers would be subject to the same immediate written electronic notice requirement. In particular, they would be required to give immediate written electronic notice to the Commission of a significant cybersecurity incident upon having a reasonable basis to conclude that the incident has occurred or is occurring.414 The Commission would keep the notices nonpublic to the extent permitted by law. The notice would need to identify the Non-Covered Broker-Dealer, state that the notice is being given to alert the Commission of a significant cybersecurity incident impacting the Non-Covered Broker￾Dealer, and provide the name and contact information of an employee of the Non-Covered Broker-Dealer who can provide further details about the nature and scope of the significant cybersecurity incident. In addition, Non-Covered Broker-Dealers—like Covered Broker-Dealers—would need to give the notice to their examining authority.415 The immediate written electronic notice is designed to alert the Commission on a confidential basis to the existence of a significant cybersecurity incident impacting a Non￾Covered Broker-Dealer so the Commission staff can quickly begin to assess the event. Finally, as
discussed above, proposed Rule 10 would require the Non-Covered Broker-Dealer to: (1) establish, maintain, and enforce written policies and procedures that are reasonably designed to address the cybersecurity risks of the firm; (2) make a written record that documents its annual review; and (3) provide immediate electronic written notice to the Commission of a significant cybersecurity incident upon having a reasonable basis to conclude that the significant cybersecurity incident has occurred or is occurring.416 The Commission is proposing to amend the broker-dealer record preservation and maintenance rule to identify these records specifically as being subject to the rule’s requirements.417 Under the amendments, the written policies and procedures would need to be maintained until three years after the termination of the use of the policies and procedures and all other records would need to be maintained for three years.
2. Request for Comment
The Commission requests comment on all aspects of the proposed requirements for non-covered broker￾dealers. In addition, the Commission is requesting comment on the following specific aspects of the proposals:
75. Should paragraph (e)(1) of
proposed Rule 10 be modified to specify certain minimum elements that would need to be included in the policies and procedures of Non-Covered Broker￾Dealers? If so, identify the elements and explain why they should be included. For example, should paragraph (e) of proposed Rule 10 specify that the policies and procedures must include policies and procedures to address any

418See Cross-Border Proposing Release, 78 FR at 30976, n. 48. 419Unless otherwise indicated, references to ‘‘Title VII’’ in this section of this release are to Subtitle B of Title VII of the Dodd-Frank Act. 420See Cross-Border Proposing Release, 78 FR at 30975. 421See id. at 31008–25. See also Business Conduct Standards for Security-Based Swap Dealers and Major Security-Based Swap Participants, Exchange Act Release No. 77617 (Apr. 14, 2016) [81 FR 29959, 30061–69 (May 13, 2016)] (‘‘Business Conduct Standards Adopting Release’’). 422Cross-Border Proposing Release, 78 FR at 31010. 423See id. at 31011, 31035. 424See id. at 31011–16 (addressing the classification of capital and margin requirements, as well as of the risk management requirements of
section 15F(j) of the Exchange Act and other entity￾level requirements applicable to SBSDs).
425See id. at 31011, 31024–25. See also id. at 31035 (applying the analysis to MSBSPs). In reaching this conclusion, the Commission explained that it ‘‘preliminarily believes that entity￾level requirements are core requirements of the Commission’s responsibility to ensure the safety and soundness of registered security based swap dealers,’’ and that ‘‘it would not be consistent with this mandate to provide a blanket exclusion to foreign security-based swap dealers from entity￾level requirements applicable to such entities.’’ Id. at 31024 (footnotes omitted). The Commission further expressed the preliminary view that concerns regarding the application of entity-level requirements to foreign SBSDs would largely be addressed through the proposed approach to substituted compliance. See id. 426See Business Conduct Standards Adopting Release, 81 FR at 30064–65. or all of the following: (1) risk assessment; (2) user security and access; (3) information protection; (4) cybersecurity threat and vulnerability management; and (5) cybersecurity incident response and recovery? If so, explain why. If not, explain why not.
76. Should paragraph (e)(2) of
proposed Rule 10 be modified to require the notice to be given within a specific timeframe such as on the same day the requirement was triggered or within 24 hours? If so, explain why. If not, explain why not.
77. Should paragraph (e)(2) of
proposed Rule 10 be modified to revise the trigger for the immediate notification requirement? If so, explain why. If not, explain why not. For example, should the trigger be when the Non-Covered Broker-Dealer ‘‘detects’’ a significant cybersecurity incident (rather than when it has a reasonable basis to conclude that the significant cybersecurity incident has occurred or is occurring)? If so, explain why. If not, explain why not. For example, would a detection standard be a less subjective standard? If so, explain why. If not, explain why not. Is there another trigger standard that would be more appropriate? If so, identify it and explain why it would be more appropriate.
78. Should paragraph (e)(2) of
proposed Rule 10 be modified to eliminate the requirement that a Non￾Covered Broker-Dealer give the Commission immediate written electronic notice of a significant cybersecurity incident upon having a reasonable basis to conclude that the significant cybersecurity incident has occurred or is occurring? If so, explain why. If not, explain why not. For example, would this requirement be unduly burdensome on Non-Covered Broker-Dealers? Please explain.
79. If the immediate notification
requirement of paragraph (e)(2) is adopted as proposed, it is anticipated that a dedicated email address would be established to receive these notices. Are there other methods the Commission should use for receiving these notices? If so, identity them and explain why they would be more appropriate than email. For example, should the notices be received through the EDGAR system? If so, explain why. If not, explain why not.
80. Should paragraph (e) of proposed
Rule 10 be modified to include any other requirements that would be applicable to Covered Entities under proposed Rule 10 that also should be required of Non-Covered Broker￾Dealers? If so, identify them and explain why they should apply to Non-Covered Broker-Dealers. For example, should the paragraph be modified to require Non￾Covered Broker-Dealers to report information about a significant cybersecurity incident confidentially on
Part I of proposed Form SCIR? If so,
explain why. If not, explain why not. Should the timeframe for filing Part I of Proposed Form SCIR be longer for Non￾Covered Broker-Dealers? For example, should the reporting timeframe be within 72 or 96 hours instead of 48 hours? Please explain. If Non-Covered Broker-Dealers were required to file Part I of Form SCIR, should they be permitted to provide more limited information about the significant cybersecurity incident than Covered Entities? If so, identify the more limited set of information and explain why it would be appropriate to permit Non￾Covered Broker-Dealers omit the additional information that Covered Entities would need to report.
81. Should Non-Covered Broker￾Dealers be required to make and
preserve for three years in accordance with Rule 17a–4 a record of any significant cybersecurity incident that impacts them containing some or all of the information that would be reported by Covered Entities on Part I of proposed Form SCIR? If so, explain why. If not, explain why not.
82. Should paragraph (e) of proposed
Rule 10 be modified to require a Non￾Covered Broker-Dealer to prepare a written report of the annual review (rather than a record, as proposed)? If so, explain why. If not, explain why not. D. Cross-Border Application of the Proposed Cybersecurity Requirements to SBS Entities

1. Background on the Cross-Border
   Application of Title VII Requirements Security-based swap transactions take place across national borders, with agreements negotiated and executed between counterparties in different jurisdictions (which might then be booked and risk-managed in still other jurisdictions).418 Mindful that this global market developed prior to the enactment of the Dodd-Frank Act and the fact that the application of Title VII 419 to cross-border activities raises issues of potential conflict or overlap with foreign regulatory regimes,420 the Commission has adopted a taxonomy to classify requirements under section 15F of the Exchange Act as applying at either the transaction-level or at the entity-level.421 Transaction-level requirements under section 15F of the Exchange Act are those that primarily focus on protecting counterparties to security-based swap transactions by requiring SBSDs to, among other things, provide certain disclosures to counterparties, adhere to certain standards of business conduct, and segregate customer funds, securities, and other assets.422 In contrast to transaction-level requirements, entity￾level requirements under section 15F of the Exchange Act are those that are expected to play a role in ensuring the safety and soundness of the SBS Entity and thus relate to the entity as a whole.423 Entity-level requirements include capital and margin requirements, as well as other requirements relating to a firm’s identification and management of its risk exposure, including the risk management procedures required under
   section 15F(j) of the Exchange Act, a
   statutory basis for rules applicable to SBS Entities that the Commission is proposing in this release.424 Because these requirements relate to the entire entity, they apply to SBS Entities on a firm-wide basis, without exception.425 The Commission applied this taxonomy in 2016 when it adopted rules to implement business conduct standards for SBS Entities. At that time, the Commission also stated that the rules and regulations prescribed under
   section 15F(j) should be treated as
   entity-level requirements.426 The

427The Commission has previously stated that recordkeeping and reporting requirements are entity-level requirements. See Recordkeeping and Reporting Requirements for Security-Based Swap Dealers, Major Security-Based Swap Participants, and Broker-Dealers, Exchange Act Release No. 87005 (Sept. 19, 2019), 84 FR 68550, 68596–97 (Dec. 16, 2019) (‘‘SBS Entity Recordkeeping and Reporting Adopting Release’’). 428See Capital, Margin, and Segregation Requirements for Security-Based Swap Dealers and Major Security-Based Swap Participants and Capital and Segregation Requirements for Broker-Dealers. Exchange Act Release No. 86175 (Jun. 21, 2019), 84 FR 43872, 43879 (Aug, 22, 2019) (‘‘Capital, Margin, and Segregation Requirements Adopting Release’’). 429 Id. 430See Risk Mitigation Techniques for Uncleared Security-Based Swaps, Exchange Act Release No. 87782 (Dec. 18, 2019) [85 FR 6359, 6378 (Feb. 4, 2020)] (‘‘SBS Entity Risk Mitigation Adopting Release’’). 431See SBS Entity Recordkeeping and Reporting Adopting Release, 84 FR at 68596–97. 432As entity-level requirements, transaction-level exceptions such as in 17 CFR 3a71–3(c) and 17 CFR 3a67–10(d), would not be available for the proposed cybersecurity requirements. 433See sections I.A. and II.B.1. of this release (discussing, respectively, cybersecurity risks and how those risks can be managed by certain policies, procedures, and controls). See also sections II.B.2– 5 of this release. 434The Commission has expressed the view that an entity that has registered with the Commission subjects itself to the entire regulatory system governing such registered entities. Cross-Border Proposing Release, 78 FR at 30986. See also Business Conduct Standards Adopting Release, 81 FR at n.1306 (determining that the requirements described in section 15F(j) of the Exchange Act should be treated as entity-level requirements, and stating that such treatment would not be tantamount to applying Title VII to persons that are ‘‘transact[ing] a business in security-based swaps without the jurisdiction of the United States,’’ within the meaning of section 30(c) of the Exchange Act). That treatment of section 15F(j) of the Exchange Act was also deemed necessary or appropriate as a prophylactic measure to help prevent the evasion of the provisions of the Exchange Act that were added by the Dodd-Frank Act, and thus help prevent the relevant purposes of the Dodd-Frank Act from being undermined. Id. (citing Application of ‘‘Security-Based Swap Dealer’’ and ‘‘Major Security-Based Swap Participant’’ Definitions to Cross-Border Security￾Based Swap Activities; Republication, Exchange Act Release No. 72472 (June 25, 2014) [79 FR 47277, 47291–92 (Aug. 12, 2014)] (‘‘SBS Entity Definitions Adopting Release’’) (interpreting anti-evasion provisions of the Exchange Act, section 30(c)). A different approach in connection with proposed Rule 10 would not be consistent with the purposes of Title VII of the Dodd-Frank Act and could allow SBS Entities to
avoid compliance with these proposed rules for portions of their business in a manner that could increase the risk to the registered entity. 435See Business Conduct Standards Adopting Release, 81 FR at 30070–81. Separately, in 2015, the Commission adopted a rule making substituted compliance potentially available in connection with certain regulatory reporting and public dissemination requirements related to security￾based swaps. See Regulation SBSR-Reporting and Dissemination of Security-Based Swap Information, Exchange Act Release No. 74244 (Feb. 11, 2015) [80 FR 14563 (Mar. 19, 2015)] (adopting 17 CFR
242.908 (‘‘Rule 908’’)). Paragraph (c) of Rule 908
does not contemplate substituted compliance for the rules being proposing today. 436See 17 CFR 240.3a71–6. 437 If the Commission makes a substituted compliance determination under paragraph (a)(1) of Rule 3a71–6, SBS Entities that are not U.S. persons (as defined in 17 CFR 240.3a71–3(a)(4) (‘‘Rule 3a71–3(a)(4)’’)), but not SBS Entities that are U.S. persons, may satisfy specified requirements by complying with comparable foreign requirements and any conditions set forth in the substituted compliance determination made by the Commission. See paragraphs (b) and (d) of Rule 3a71–6. Commission has not, however, expressly addressed the entity-level treatment of the cybersecurity requirements under proposed Rule 10, except with regard to recordkeeping and reporting.427
2. Proposed Entity-Level Treatment
a. Proposal
Consistent with its approach to the obligations described in Section 15F(j) and to capital,428 margin,429 risk mitigation,430 and recordkeeping,431 the Commission is proposing to apply the requirements of proposed Rule 10 to an SBS Entity’s entire security-based swap business without exception, including in connection with any security-based swap business it conducts with foreign counterparties.432 Cybersecurity policies and procedures and the related requirements of proposed Rule 10 serve as an important mechanism for allowing SBS Entities and their counterparties to manage risks associated with their operations, including risks related to the entity’s safety and soundness.433 An alternative approach that does not require an SBS Entity to take steps to manage cybersecurity risk throughout the firm’s entire business could contribute to operational risk affecting the entity’s security-based swap business as a whole, and not merely specific security￾based swap transactions. Moreover, to the extent that these risks affect the safety and soundness of the SBS Entity, they also may affect the firm’s counterparties and the functioning of the broader security-based swap market. Accordingly, the Commission proposes to apply the requirements to the entirety of an SBS Entity’s business.434 However, as described below, the Commission is proposing that foreign SBS Entities have the potential to avail themselves of substituted compliance to satisfy the cybersecurity requirements under proposed Rule 10. b. Request for Comment The Commission generally requests comments on the proposed entity-level application of proposed Rule 10. In addition, the Commission requests comments on the following specific issues:
83. Does the proposed approach
appropriately treat the proposed requirements as entity-level requirements applicable to the entire business conducted by foreign SBS Entities? If not, please identify any particular aspects of proposed Rule 10 that should not be applied to a foreign SBS Entity, or applied only to specific transactions, and explain how such an approach would be consistent with the goals of Title VII of the Dodd-Frank Act.
84. Should the Commission apply the
same cross-border approach to the application of proposed Rule 10 for both SBSDs and MSBSPs? If not, please describe how the cross-border approach for SBSDs should differ from the cross￾border approach for MSBSPs, and explain the reason(s) for any potential differences in approach.
85. What types of conflicts might a
foreign SBS Entity face if it had to comply with proposed Rule 10 in more than one jurisdiction? In what situations would compliance with more than one of these requirements be difficult or impossible? For Market Entities that are U.S. persons, could compliance with the proposed rules create compliance challenges with requirements in a foreign jurisdiction?
86. As an alternative to treating the
proposed requirements as entity-level requirements, should the Commission instead treat the proposed requirements as transaction-level requirements? If so, to which cross-border security-based swap transactions should these requirements apply and why? Please describe how these requirements would apply differently if classified as transaction-level requirements instead of as entity-level requirements.
3. Availability of Substituted
Compliance a. Existing Substituted Compliance Rule In 2016,435 the Commission adopted Exchange Act Rule 3a71–6 (‘‘Rule 3a71– 6’’) 436 to provide that the Commission may, by order, make a determination that compliance with specified requirements under a foreign financial regulatory system by non-U.S. SBS Entities 437 may satisfy certain business conduct requirements under Exchange Act section 15F, subject to certain conditions. The rule in part provides that the Commission shall not make a determination providing for substituted compliance unless the Commission determines, among other things, that the foreign regulatory requirements are

438See paragraph (a)(2) of 3a71–6. See also Business Conduct Standards Adopting Release, 81 FR at 30074. 439Business Conduct Standards Adopting Release, 81 FR at n. 1438. 440 Id. 441See Business Conduct Standards Adopting Release, 81 FR at 30074. 442See Trade Acknowledgment and Verification of Security-Based Swap Transactions, Exchange Act Release No. 78011 (Jun. 8, 2016) [81 FR 39807, 39827–28 (Jun. 17, 2016)] (‘‘SBS Entity Trade Acknowledgment and Verification Adopting Release’’). 443See Capital, Margin, and Segregation Requirements Adopting Release, 84 FR at 43948–50. 444See SBS Entity Recordkeeping and Reporting Adopting Release, 84 FR at 68597–99. 445See SBS Entity Risk Mitigation Adopting Release, 85 FR at 6379–80. 446Substituted compliance would only be available to eligible SBS Entities. For example, substituted compliance would not be available to a Market Entity registered as both an SBS Entity and a broker-dealer with respect to the broker-dealer’s obligations under the proposed rules. 447Business Conduct Standards Adopting Release, 81 FR at 30079. 448Business Conduct Standards Adopting Release, 81 FR at 30079–80. 449Business Conduct Standards Adopting Release, 81 FR at 30080–81. 450See generally Business Conduct Standards Adopting Release, 81 FR at 30073–74 (addressing the basis for making substituted compliance available in the context of the business conduct requirements). 451Paragraph (a)(1) of Rule 3a71–6 provides that the Commission may, conditionally or unconditionally, by order, make a determination with respect to a foreign financial regulatory system that compliance with specified requirements under the foreign financial system by an SBS Entity, or class thereof, may satisfy the corresponding requirements identified in paragraph (d) of the rule that would otherwise apply. See section II.D.3.c. of this release. 452See paragraph (d)(6) of Rule 3a71–6. 453See paragraph (c) of Rule 3a71–6. comparable to otherwise applicable requirements.438 When the Commission adopted this substituted compliance rule that addressed the specified business conduct requirements, the Commission also noted that Exchange Act section 15F(j)(7) authorizes the Commission to prescribe rules governing the duties of SBS Entities.439 The Commission stated that it was not excluding that provision from the potential availability of substituted compliance, and that it expected to separately consider whether substituted compliance may be available in connection with any future rules promulgated pursuant to that provision.440 Further, the Commission stated that it expected to assess the potential availability of substituted compliance in connection with other requirements when the Commission considers final rules to implement those requirements.441 Consistent with these statements, the Commission subsequently amended Rule 3a71–6 to provide SBS Entities that are non U.S. persons with the potential to avail themselves of substituted compliance with respect to the
following Title VII requirements: (1) trade acknowledgment and verification,442 (2) capital and margin requirements,443 (3) recordkeeping and reporting,444 and (4) portfolio reconciliation, portfolio compression, and trading relationship documentation.445 b. Proposed Amendment to Rule 3a71– 6 The Commission is proposing to further amend Rule 3a71–6 to provide SBS Entities that are not U.S. persons (as defined in Rule 3a71–3(a)(4) of the Exchange Act) with the potential to avail themselves of substituted compliance to satisfy the cybersecurity requirements of proposed Rule 10 and Form SCIR as applicable to SBS Entities.446 In proposing to amend the rule, the Commission preliminarily believes that the principles associated with substituted compliance, as previously adopted in connection with both the business conduct requirements and the recordkeeping and reporting requirements, in large part should similarly apply to the cyber security risk management requirements being proposing today. The discussions in the Business Conduct Standards Adopting Release, including for example those regarding consideration of supervisory and enforcement practices,447 certain multi-jurisdictional issues,448 and application procedures 449 are applicable to the proposed cybersecurity requirements. Accordingly, the proposed substituted compliance rule would apply to the cybersecurity risk management requirements in the same manner as it already applies to existing business conduct requirements and the recordkeeping and reporting requirements. Making substituted compliance available for the cybersecurity risk management requirements would be consistent with the approach the Commission has taken with other rules applicable to SBS Entities. This approach takes into consideration the global nature of the security-based swap market and the prevalence of cross￾border transactions within that market.450 The application of the cybersecurity risk management requirements may lead to requirements that are duplicative of, or in conflict with, applicable foreign requirements, even when the two sets of requirements implement similar goals and lead to similar results. Those results have the potential to disrupt existing business relationships and, more generally, to reduce competition and market efficiency. To address those effects, under certain circumstances it may be appropriate to allow the possibility of substituted compliance, whereby non￾U.S. market participants may satisfy the cybersecurity risk management requirements by complying with comparable foreign requirements. Allowing for the possibility of substituted compliance in this manner would help achieve the benefits of those particular requirements in a way that helps avoid regulatory conflict and minimizes duplication, thereby promoting market efficiency, enhancing competition, and contributing to the overall functioning of the global security-based swap market. Accordingly, the Commission is proposing to amend paragraph
(d)(1) of Rule 3a71–6 to make substituted compliance available for proposed Rule 10 and Form SCIR if the Commission determines with respect to a foreign financial regulatory system that compliance with specified requirements under such foreign financial regulatory system by a registered SBS Entity, or class thereof, satisfies the corresponding requirements of proposed Rule 10 and Form SCIR.451 However, the proposal would not amend Rule 3a71–6 in connection with the proposed amendments to Rule 18a–6 regarding records to be preserved by certain SBS Entities. Rule 3a71–6 currently permits eligible applicants to seek a substituted compliance determination from the Commission with regard to the requirements of Rule 18a–6.452
c. Comparability Criteria, and
Consideration of Related Requirements If adopted, the proposed amendment to paragraph (d)(1) of Rule 3a71–6 would provide that eligible applicants may request that the Commission make a substituted compliance determination with respect to one or more of the requirements Rule 10 and Form SCIR.453 Further, existing paragraph (d)(6) of Rule 3a71–6 would permit eligible applicants to request that the Commission make a substituted compliance determination with respect to one or more of the requirements of the proposed amendments to Rule 18a– 6, if adopted. A positive substituted compliance determination with respect to requirements existing before adoption of the proposed Rule 10, Form SCIR, and the related record preservation requirements would not automatically result in a positive substituted compliance determination with respect

454See 17 CFR 3a71–6(c).
455Existing Commission substituted compliance determinations do not address the requirements of the proposed new rules or the proposed amendments. If the Commission adopts the requirements in the proposed new or amended rules, SBS Entities (or the relevant foreign financial regulatory authority or authorities) seeking a substituted compliance determination with respect to those requirements would be required to file an application requesting that the Commission make the determination. Applicants may not request that the Commission make a substituted compliance determination related to the new requirements by amending a previously filed application that requested a substituted compliance determination related to other Commission requirements. However, new applications may incorporate relevant information from the applicant’s previously filed requests for substituted compliance determinations if the information remains accurate. 456See Business Conduct Standards Adopting Release, 81 FR at 30078–79. See also SBS Entity Trade Acknowledgment and Verification Adopting Release, 81 FR at 39828; SBS Entity Recordkeeping and Reporting Adopting Release, 84 FR at 68598– 99. 457See 17 CFR 240.3a71–6(a)(2)(i). 458This category of applicants would include those who previously filed requests for the Commission to make substituted compliance determinations related to other requirements eligible for substituted compliance determinations under Rule 3a71–6. to proposed Rule 10, Form SCIR or the proposed amendments to Rule 18a–6. Before making a substituted compliance determination, the substance of each foreign regulatory system to which substituted compliance would apply should be evaluated for comparability to such newly adopted requirements. As such, if the Commission adopts the proposed amendment to Rule 3a71–6, eligible applicants 454 seeking a Commission determination permitting SBS Entities that are not U.S. persons to satisfy the requirements of proposed Rule 10, Form SCIR, or the proposed amendments to Rule 18a–6 by complying with comparable foreign requirements would be required to file an application, pursuant to the procedures set forth in 17 CFR 240.0– 13, requesting that the Commission make a such a determination pursuant to 17 CFR 3a71–6(a)(1).455 The Commission has taken a holistic approach in determining the comparability of foreign requirements for substituted compliance purposes, focusing on regulatory outcomes as a whole, rather than on a requirement-by￾requirement comparison.456 The Commission preliminarily believes that such a holistic approach would be appropriate for determining comparability for substituted compliance purposes in connection with the requirements of proposed Rule 10, Form SCIR, and the proposed amendments to Rule 18a–6. Under the proposed amendment to Rule 3a71–6, the Commission’s comparability assessments associated with the proposed cybersecurity risk management requirements accordingly would consider whether, in the
Commission’s view, the foreign regulatory system achieves regulatory outcomes that are comparable to the regulatory outcomes associated with those requirements. Rule 3a71–6 provides that the Commission’s substituted compliance determination will take into account factors that the Commission determines appropriate, such as, for example, the scope and objectives of the relevant foreign regulatory requirements (taking into account the applicable criteria set forth in paragraph (d) of the rule), as well as the effectiveness of the supervisory compliance program administered, and the enforcement authority exercised, by a foreign financial regulatory authority or authorities in such foreign financial regulatory system to support its oversight of the SBS Entity (or class thereof) or of the activities of such SBS Entity (or class thereof).457 The Commission may determine to conduct its comparability analyses regarding Rule 10, Form SCIR, and the related record preservation requirements in conjunction with comparability analyses regarding other Exchange Act requirements that, like the requirements being proposed today, relate to risk management, recordkeeping, reporting, and notification requirements of SBS Entities. If the Commission adopts the proposed amendment to Rule 3a71–6, substituted compliance requests related to Rule 10, Form SCIR, and the related record preservation requirements may be filed by (i) applicants filing a request for a substituted compliance determination solely in connection with Rule 10, Form SCIR, and the related record preservation requirements,458 and (ii) applicants filing a request for a substituted compliance determination in connection with Rule 10, Form SCIR, and the related record preservation requirements combined with a request for a substituted compliance determination related to other eligible requirements. In either event, depending on the applicable facts and circumstances, the Commission’s comparability assessment associated with the Rule 10, Form SCIR, or the related record preservation requirements may constitute part of a broader assessment of Exchange Act risk management, recordkeeping, reporting, and notification requirements for SBS Entities, and the applicable comparability decisions may be made at the level of those risk management, recordkeeping, reporting, and notification requirements for SBS Entities as a whole. d. Request for Comment The Commission generally requests comments on all aspects of the proposed amendment to Rule 3a71–6 and proposed availability of substituted compliance. In addition, the Commission requests comments on the following specific issues:
87. Should the Commission make
substituted compliance available with respect to proposed Rule 10, Form SCIR, and the related record preservation requirements? Why or why not? If you believe that substituted compliance should not be available with respect to these requirements, how would you distinguish this policy decision from the Commission’s previous determination to make substituted compliance potentially available with respect to other Title VII requirements (i.e., the business conduct, trade acknowledgment and verification, capital and margin, recordkeeping and reporting, and portfolio reconciliation, portfolio compression, and trading relationship documentation rules)?
88. Are there other aspects of the
scope of the substituted compliance rule for which the Commission should amend or provide additional guidance in light of proposed Rule 10, Form SCIR, and the proposed amendment to Rule 18a–6? If so, what other amendments or additional guidance would be appropriate and why?
89. Are the items identified in Rule
3a71–6 as factors the Commission will consider prior to making a substituted compliance determination in connection with proposed Rule 10, Form SCIR, and the related record preservation requirements appropriate? If so, explain why. If not, explain why not. Should any of those items be modified or deleted? Should additional considerations be added? If so, please explain. E. Amendments to Rule 18a–10

1. Proposal
   Exchange Act Rule 18a–10 (‘‘Rule 18a–10’’) permits an SBSD that is registered as a swap dealer and predominantly engages in a swaps business to elect to comply with the capital, margin, segregation, recordkeeping, and reporting requirements of the Commodity Exchange Act and the CFTC’s rules in lieu of complying with the capital, margin, segregation, recordkeeping, and reporting requirements of Exchange Act Rules 18a–1, 18a–3, 18a–4, 18a–5, 18a–

459See 17 CFR 240.18a–10.
460See Capital, Margin, and Segregation Requirements Adopting Release, 84 at 43944–46 (discussing the conditions and the reasons for them). See also SBS Entity Recordkeeping and Reporting Adopting Release, 84 FR at 68549. 461The gross notional amount is based on the notional amounts of the firm’s security-based swaps and swaps that are outstanding as of the quarter end. It is not based on transaction volume during the quarter. 462The maximum fixed-dollar threshold of $250 billion is set for a transition period of 3 years from the compliance date of the rule. Three years after that date it will drop to $50 billion (unless the Commission issues an order retaining the $250 billion threshold or lesser amount that is greater than $50 billion). 463See section II.B.5. of this release (discussing these proposals in more detail). 464See proposed paragraph (g) of Rule 18a–10. 465See 17 CFR 242.1000 through 1007 (Regulation SCI); 17 CFR 248.1 through 248.30 (Regulation S–P). See also section II.F.1.b. of this release (discussing the types of Market Entities that are or would be subject to Regulation SCI and/or Regulation S–P). 466See Regulation SCI 2023 Proposing Release; Regulation S–P 2023 Proposing Release. 467See section II.F.1.c. of this release (discussing the existing and proposed requirements of Regulation SCI and Regulation S–P to have policies and procedures that address certain cybersecurity risks). 468See section II.F.1.d. of this release (discussing the existing and proposed immediate notification and subsequent reporting requirements of Regulation SCI). 469See paragraph (a)(10) of proposed Rule 10 (defining the term ‘‘significant cybersecurity incident’’). 470See section II.F.1.e. of this release (discussing the existing and proposed disclosure requirements of Regulation SCI and Regulation S–P). 471See paragraph (a)(10) of proposed Rule 10 (defining the term ‘‘significant cybersecurity incident’’). 6, 18a–7, 18a–8, and 18a–9.459 An SBSD may elect to operate pursuant to Rule 18a–10 if it meets certain conditions.460 First, the firm must be registered with the Commission as a stand-alone SBSD (i.e., not also registered as a broker￾dealer or an OTC derivatives dealer) and registered with the CFTC as a swap dealer. Second, the firm must be exempt from the segregation requirements of Rule 18a–4. Third, the aggregate gross notional amount of the firm’s outstanding security-based swap positions must not exceed the lesser of two thresholds as of the most recently ended quarter of the firm’s fiscal year.461 The thresholds are: (1) a maximum fixed-dollar gross notional amount of open security-based swaps of $250 billion; 462 and (2) 10% of the combined aggregate gross notional amount of the firm’s open security￾based swap and swap positions. As discussed above, Rule 18a–6 is proposed to be amended to require SBSDs to maintain and preserve the records required to be made pursuant to proposed Rule 10.463 However, because Rule 18a–6 is within the scope of
Rule 18a–10, an SBSD operating pursuant to Rule 18a–10 would not be subject to the maintenance and preservation requirements of Rule 18a–6 with respect to the records required to be made pursuant to proposed Rule 10. Therefore, while an SBSD would be subject to proposed Rule 10 and need to make these records, the firm would not need to maintain or preserve them in accordance with Rule 18a–6. For these reasons, the Commission is proposing to amend Rule 18a–10 to exclude from its scope the record maintenance and preservation requirements of Rule 18a– 6 as they pertain to the records required to be made pursuant to proposed Rule
10.464 Therefore, the records required to
be made pursuant to proposed Rule 10 would need to be preserved and maintained in accordance with Rule 18a–6, as it is proposed to be amended.
2. Request for Comment
The Commission requests comment on all aspects of the proposed amendments relating to Rule 18a–10. In addition, the Commission is requesting comment on the following specific aspects of the proposals:
90. Should the proposed amendments
to Rule 18a–10 be modified? If so, describe how and explain why the modification would be appropriate. For example, would the records required to be made pursuant to proposed Rule 10 be subject to CFTC record preservation and maintenance rules? If so, identify the rules and explain the preservation and maintenance requirements they would impose on the records required to be made pursuant to proposed Rule
10. In addition, explain whether it
would be appropriate to permit an SBSD operating pursuant to Rule 18a–10 to comply with these CFTC rules in terms of preserving and maintaining the records required to be made pursuant to proposed Rule 10 in lieu of the complying with the preservation and maintenance requirements that would apply to the records under the proposed amendments to Rule 18a–6. F. Market Entities Subject to Regulation SCI, Regulation S–P, Regulation ATS, and Regulation S–ID

1. Discussion
   a. Introduction
   As discussed in more detail below, certain types of Market Entities are subject to Regulation SCI and Regulation S–P.465 The Commission separately is proposing to amend Regulation SCI and Regulation S–P.466 Regulation SCI and Regulation S–P (currently and as they would be amended) have or would have provisions requiring policies and procedures that address certain types of cybersecurity risks.467 Regulation SCI (currently and as it would be amended) also requires immediate written or telephonic notice and subsequent reporting to the Commission on Form SCI of certain types of incidents.468 These notification and subsequent reporting requirements of Regulation SCI could be triggered by a ‘‘significant cybersecurity incident’’ as that term would be defined in proposed Rule
   10.469 Finally, Regulation SCI and
   Regulation S–P (currently and as they would be amended) have or would have provisions requiring disclosures to persons affected by certain incidents.470 These current or proposed disclosure requirements of Regulation SCI and Regulation S–P could be triggered by a cybersecurity-related event that also would be a ‘‘significant cybersecurity incident’’ as that term would be defined in proposed Rule 10.471 Consequently, if proposed Rule 10 is adopted (as proposed), Market Entities could be subject to requirements in that rule and in Regulation SCI and Regulation S–P that pertain to cybersecurity. While the Commission preliminarily believes that these requirements are nonetheless appropriate, it is seeking comment on the proposed amendments, given the following: (1) each proposal has a different scope and purpose; (2) the policies and procedures related to cybersecurity that would be required under each of the proposed rules would be consistent; (3) the public disclosures or notifications required by the proposed rules would require different types of information to be disclosed, largely to different audiences at different times; and (4) it should be appropriate for entities to comply with the proposed requirements. The Commission encourages interested persons to provide comments on the discussion below, as well as on the potential related application of proposed Rule 10, Regulation SCI, and Regulation S–P. More specifically, the Commission encourages commenters:
   (1) to identify any areas where they believe the requirements of proposed Rule 10 and the existing or proposed requirements of Regulation SCI and Regulation S–P would be particularly costly or create practical implementation difficulties; (2) to provide details on what in particular about implementation would be difficult; and (3) to make

472See section II.F.2. of this release. 473See 17 CFR 242.1000 (defining the terms ‘‘SCI alternative trading system,’’ ‘‘SCI self-regulatory system,’’ and ‘‘Exempt clearing agency subject to ARP,’’ and including all of those defined terms in the definition of ‘‘SCI Entity’’). The definition of ‘‘SCI entities’’ includes additional Commission registrants that would not be subject to the requirements of proposed Rule 10: plan processors and SCI competing consolidators. However, the Commission is seeking comment on whether these registrants should be subject to the requirements of proposed Rule 10. 474All exempt clearing agencies and SBSDRs would be subject to the requirements of proposed Rule 10 applicable to Covered Entities. See paragraphs (a)(1)(ii) and (vii) of proposed Rule 10 (defining these registrants as ‘‘covered entities’’). Broker-dealers that exceed the asset-based size threshold under the proposed amendments to Regulation SCI (which would be several hundred billion dollars) also would be subject to the requirements of proposed Rule 10 applicable to Covered Entities, as they would exceed the $1 billion total assets threshold in the broker-dealer definition of ‘‘covered entity.’’ See paragraph (a)(1)(i)(D) of proposed Rule 10. A broker-dealer that exceeds one or more of the volume-based trading thresholds under the proposed amendments to Regulation SCI likely would meet one of the broker-dealer definitions of ‘‘covered entity’’ in proposed Rule 10 given their size and activities. For example, it would either be a carrying broker￾dealer, have regulatory capital equal to or exceeding $50 million, have total assets equal to or exceeding $1 billion, or operate as a market maker. See paragraphs (a)(1)(i)(A), (C), (D), and (E) of proposed Rule 10. The Commission is seeking comment above on whether a broker-dealer that is an SCI entity should be defined specifically as a ‘‘covered entity’’ under proposed Rule 10. 475Broadly, Regulation S–P’s requirements apply to all broker-dealers, except for ‘‘notice-registered broker-dealers’’ (as defined in 17 CFR 248.30), who in most cases will be deemed to be in compliance with Regulation S–P if they instead comply with the financial privacy rules of the CFTC, and are otherwise explicitly excluded from certain of Regulation S–P’s obligations. See 17 CFR 248.2(c). For the purposes of this section II.F. of this release, the term ‘‘broker-dealer’’ when used to refer to broker-dealers that are subject to Regulation S–P (currently and as it would be amended) excludes notice-registered broker-dealers. Currently, transfer agents registered with the Commission (‘‘SEC￾registered transfer agents’’) (but not transfer agents registered with another appropriate regulatory agency) are subject to Regulation S–P’s ‘‘disposal rule’’ (‘‘Regulation S–P Disposal Rule’’). See 17 CFR 248.30(b). However, no transfer agent is currently subject to any other portion of Regulation S–P, including the ‘‘safeguards rule’’ under
Regulation S–P (‘‘Regulation S–P Safeguards Rule’’). See 17 CFR 248.30(a). Under the proposed amendments to Regulation S–P, SEC-registered transfer agents and transfer agents registered with another appropriate regulatory agency (as defined in 15 U.S.C. 78c(34)(B)) would be subject to the Regulation S– P Safeguards Rule and the Regulation S–P Disposal Rule. Regulation S–P also applies to additional financial institutions that would not be subject to proposed Rule 10. See 17 CFR 248.3. 476See 17 CFR 242.1001(a)(1). ‘‘SCI systems’’ are defined as electronic or similar systems of, or operated by or on behalf of, an SCI entity that directly support at least one of six market functions:
(1) trading; (2) clearance and settlement; (3) order routing; (4) market data; (5) market regulation; or (6) market surveillance. 17 CFR 242.1000. ‘‘Indirect SCI systems’’ are defined as those of, or operated by or on behalf of, an SCI entity that, if breached, would be reasonably likely to pose a security threat to SCI systems. 17 CFR 242.1000. The distinction between SCI systems and indirect SCI systems seeks to encourage SCI Entities that their SCI systems, which are core market-facing systems, should be physically or logically separated from systems that perform other functions (e.g., corporate email and general office systems for member regulation and recordkeeping). See Regulation Systems Compliance and Integrity, Release No. 34–73639 79 FR 72251 (Dec. 5, 2014), at 79 FR at 72279–81 (‘‘Regulation SCI 2014 Adopting Release’’). Indirect SCI systems are subject to Regulation SCI’s requirements with respect to security standards. Further, ‘‘critical SCI systems’’ (a subset of SCI systems) are defined as those that directly support functionality relating to: (1) clearance and settlement systems of clearing agencies; (2) openings, reopenings, and closings on the primary listing market; (3) trading halts; (4) initial public offerings; (5) the provision of market data by a plan processor; or (6) exclusively-listed securities; and as a catchall, systems that provide functionality to the securities markets for which the availability of alternatives is significantly limited or nonexistent and without which there would be a material impact on fair and orderly markets. 17 CFR 242.1000. 477See 17 CFR 242.1000 (defining ‘‘indirect SCI systems’’). The distinction between SCI systems and indirect SCI systems seeks to encourage SCI Entities that their SCI systems, which are core market-facing systems, should be physically or logically separated from systems that perform other functions (e.g., corporate email and general office systems for member regulation and recordkeeping). See Regulation SCI 2014 Adopting Release, 79 FR at 72279–81. Indirect SCI systems are subject to Regulation SCI’s requirements with respect to security standards. 478Or as proposed herein, ‘‘customer information’’ and ‘‘consumer information.’’ See proposed rules 248.30(e)(5) and (e)(1), respectively. recommendations on how to minimize these potential impacts. To assist this effort, the Commission is seeking specific comment below on these topics.472 b. Market Entities That Are or Would Be Subject to Regulation SCI and Regulation S–P Certain Market Entities that would be subject to the requirements of proposed Rule 10 applicable to Covered Entities are subject to the existing requirements of Regulation SCI. In particular, SCI entities include the following Covered Entities that also would be subject to the requirements of proposed Rule 10: (1) ATSs that trade certain stocks exceeding specific volume thresholds; (2) registered clearing agencies; (3) certain exempt clearing agencies; (4)
the MSRB; (5) FINRA; and (6) national securities exchanges.473 Therefore, if proposed Rule 10 is adopted (as proposed), these Covered Entities would be subject to its requirements and the requirements of Regulation SCI (currently and as it would be amended). The Commission is separately proposing to revise Regulation SCI to expand the definition of ‘‘SCI entity’’ to include the following Covered Entities that also would be subject to the requirements of proposed Rule 10: (1) broker-dealers that exceed an asset-based size threshold or a volume-based trading threshold in NMS stocks, exchange-listed options, agency securities, or U.S. treasury securities; (2) all exempt clearing agencies; and (3) SBSDRs.474 Therefore, if these amendments to Regulation SCI are adopted and proposed Rule 10 is adopted (as proposed), these additional Covered Entities would be subject to the requirements of proposed Rule 10 and also to the requirements of Regulation SCI. Additionally, broker-dealers and transfer agents that would be subject to proposed Rule 10 also would be subject to some or all of the existing or proposed requirements of Regulation S–
c. Policies and Procedures to Address
Cybersecurity Risks
i. Different Scope and Purpose of the
Policies and Procedures Requirements Each of the policies and procedures requirements has a different scope and purpose. Regulation SCI (currently and as it would be amended) limits the scope of its requirements to certain systems of the SCI Entity that support securities market related functions. Specifically, it does and would require an SCI Entity to have reasonably designed policies and procedures applicable to its SCI systems and, for purposes of security standards, its indirect SCI systems.476 While certain aspects of the policies and procedures required by Regulation SCI (as it exists today and as proposed to be amended) are designed to address certain cybersecurity risks (among other things),477 the policies and procedures required by Regulation SCI focus on the SCI entities’ operational capability and the maintenance of fair and orderly markets. Similarly, Regulation S–P (currently and as it would be amended) also has a distinct focus. The policies and procedures required under Regulation S–P, both currently and as proposed to be amended, are limited to protecting a certain type of information—customer records or information and consumer report information 478—and they apply to such information even when stored outside of SCI systems or indirect SCI systems. Furthermore, these policies and procedures need not address other types of information stored on the systems of the broker-dealer or transfer agent. Proposed Rule 10 would have a broader scope than Regulation SCI and Regulation S–P (currently and as they would be amended) because it would require Market Entities to establish, maintain, and enforce written policies

479See paragraphs (b) and (e) of proposed Rule 10 (setting forth the requirements of Covered Entities and Non-Covered Entities, respectively, to have policies and procedures to address their cybersecurity risks). 480As discussed above, SEC-registered transfer agents are subject to the Regulation S–P Disposal Rule but not to the Regulation S–P Safeguards Rule. The proposed amendments to Regulation S–P would apply the Regulation S–P Safeguards Rule and the Regulation S–P Disposal Rule to all transfer agents. 481See paragraph (b)(1) of proposed Rule 10 (setting forth the policies and procedures requirements for Covered Entities). 482See paragraphs (a)(1)(i)(A) and (B) of proposed Rule 10 (defining, respectively, carrying broker￾dealers and introducing broker-dealers as Covered Entities). 483See 17 CFR 242.1001(a)(1). 484See 17 CFR 248.30(a). 485See 17 CFR 248.30(a)(1) through (3). 486See 17 CFR 248.30(b)(2). Regulation S–P currently defines the term ‘‘disposal’’ to mean: (1) the discarding or abandonment of consumer report information; or (2) the sale, donation, or transfer of any medium, including computer equipment, on which consumer report information is stored. See 17 CFR 248.30(b)(1)(iii). 487See sections II.B.1.a. through II.B.1.e. of this release (discussing these proposed requirements in more detail). 488See section II.B.1. of this release. and procedures that are reasonably designed to address their cybersecurity risks.479 Unlike Regulation SCI, these requirements would therefore cover SCI systems, indirect SCI systems, and information systems that are not SCI systems or indirect SCI systems. And, unlike Regulation S–P, the proposed requirements would also encompass information beyond customer information and consumer information. To illustrate, a Market Entity could use one comprehensive set of policies and procedures to satisfy the requirements of proposed Rule 10 and the existing and proposed cybersecurity￾related requirements of Regulation SCI and Regulation S–P, so long as: (1) the cybersecurity-related policies and procedures required under Regulation S–P and Regulation SCI fit within and are consistent with the scope of the policies and procedures required under proposed Rule 10; and (2) and the policies and procedures requirements of proposed Rule 10 also address the more narrowly-focused existing and proposed cybersecurity-related policies and procedures requirements under Regulation SCI and Regulation S–P.
ii. Consistency of the Policies and
Procedures Requirements
Covered Entities
As discussed above, the Market Entities that would be SCI Entities under the existing and proposed requirements of Regulation SCI would be subject the policies and procedures requirements of proposed Rule 10 applicable to Covered Entities. In addition, broker-dealers and transfer agents are subject to the requirements of Regulation S–P (currently and as it would be amended).480 Transfer agents would be Covered Entities under proposed Rule 10 and, therefore, subject to the policies and procedures requirements of that rule applicable to Covered Entities.481 Further, the two categories of broker-dealers that likely would have the largest volume of customer information and consumer information subject to the existing or proposed requirements of Regulation S– P would be Covered Entities under proposed Rule 10: carrying broker￾dealers and introducing broker￾dealers.482 For these reasons, the Commission first analyzes the potential overlap between proposed Rule 10 and the current and proposed requirements of Regulation SCI and Regulation S–P by taking into account the policies and procedures requirements of proposed Rule 10 that would apply to Covered Entities. Regulation SCI and Regulation S–P General Policies and Procedures Requirements Regulation SCI, Regulation S–P, and proposed Rule 10 all include requirements that address certain cybersecurity-related risks. Regulation SCI requires an SCI Entity to have reasonably designed policies and procedures to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity’s operational capability and promote the maintenance of fair and orderly markets.483 The Regulation S–P Safeguards Rule requires broker-dealers (but not transfer agents) to adopt written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information.484 The Regulation S–P Safeguards Rule further provides that these policies and procedures must: (1) insure the security and confidentiality of customer records and information; (2) protect against any anticipated threats or hazards to the security or integrity of customer records and information; and (3) protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer.485 Additionally, the Regulation S–P Disposal Rule requires broker-dealers and SEC-registered transfer agents that maintain or otherwise possess consumer report information for a business purpose to properly dispose of the information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.486 Proposed Rule 10 would require a Covered Entity to establish, maintain, and enforce written policies and procedures that are reasonably designed to address the
Covered Entity’s cybersecurity risks. In addition, Covered Entities would be required to include the following elements in their policies and procedures: (1) periodic assessments of cybersecurity risks associated with the Covered Entity’s information systems and written documentation of the risk assessments; (2) controls designed to minimize user￾related risks and prevent unauthorized access to the Covered Entity’s information systems; (3) measures designed to monitor the Covered Entity’s information systems and protect the Covered Entity’s information from unauthorized access or use, and oversight of service providers that receive, maintain, or process information, or are otherwise permitted to access the Covered Entity’s information systems; (4) measures to detect, mitigate, and remediate any cybersecurity threats and vulnerabilities with respect to the Covered Entity’s information systems; and (5) measures to detect, respond to, and recover from a cybersecurity incident and written documentation of any cybersecurity incident and the response to and recovery from the incident.487 As discussed earlier, the inclusion of these elements in proposed Rule 10 is designed to enumerate the core areas that Covered Entities would need to address when designing, implementing, and assessing their policies and procedures.488 Taken together, these requirements are designed to position Covered Entities to be better prepared to protect themselves against cybersecurity risks, to mitigate cybersecurity threats and vulnerabilities, and to recover from cybersecurity incidents. They are also designed to help ensure that Covered Entities focus their efforts and resources on the cybersecurity risks associated with their operations and business practices. A Covered Entity that implements reasonably designed policies and procedures in compliance with the requirements of proposed Rule 10 described above that cover its SCI systems and indirect SCI systems should generally satisfy the existing general policies and procedures

489As noted above, the CAT System is a facility of each of the Participants and an SCI system. See also CAT NMS Plan Approval Order, 81 FR at
84758. It would also qualify as an ‘‘information
system’’ of each national securities exchange and each national securities association under proposed Rule 10. The CAT NMS Plan requires the CAT’s Plan Processor to follow certain security protocols and industry standards, including the NIST Cyber Security Framework, subject to Participant oversight. See, e.g., CAT NMS Plan at appendix D,
section 4.2. For the reasons discussed above and
below with respect to SCI systems, the policies and procedures requirements of proposed Rule 10 are not intended to be inconsistent with the security protocols set forth in the CAT NMS Plan. Moreover, to the extent the CAT NMS Plan requires security protocols beyond those that would be required under proposed Rule 10, those additional security protocols should generally fit within and be consistent with the policies and procedures required under proposed Rule 10 to address all cybersecurity risks. 490See Regulation SCI 2023 Proposing Release. These policies and procedures would need to include initial and periodic review of contracts with such vendors for consistency with the SCI entity’s obligations under Regulation SCI; and a risk-based assessment of each third party provider’s criticality to the SCI entity, including analyses of third party provider concentration, of key dependencies if the third party provider’s functionality, support, or service were to become unavailable or materially impaired, and of any potential security, including cybersecurity, risks posed. Id. 491See Regulation S–P 2023 Proposing Release. 492See paragraph (b)(1)(i)(A) of proposed Rule 10; see also section II.B.1.a. of this release (discussing this requirement in more detail). 493See paragraph (b)(1)(i)(A)(2) of proposed Rule 10. 494See paragraphs (b)(1)(iii)(B) of proposed Rule 10; see also section II.B.1.c. of this release (discussing this requirement in more detail). 495See Regulation SCI 2023 Proposing Release. 496See Regulation S–P 2023 Proposing Release. As discussed above, the general policies and procedures requirements of the Regulation S–P Safeguards Rule require the policies and procedures—among other things—to protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer. See 17 CFR 248.30(a)(3). 497See Regulation S–P 2023 Proposing Release. requirements of Regulation SCI that pertain to cybersecurity.489 Similarly, policies and procedures implemented by a Covered Broker-Dealer that are reasonably designed in compliance with the requirements of proposed Rule 10 should generally satisfy the existing general policies and procedures requirements of the Regulation S–P Safeguards Rule discussed above that pertain to cybersecurity, to the extent that such information is stored electronically and, therefore, falls within the scope of proposed Rule 10. In addition, reasonably designed policies and procedures implemented by a Covered Broker-Dealer or SEC￾registered transfer agent in compliance with the requirements of proposed Rule 10 should generally satisfy the existing requirements of the Regulation S–P Disposal Rule discussed above. Regulation SCI and Regulation S–P Requirements to Oversee Service Providers. Under the amendments to Regulation SCI, the policies and procedures required of SCI entities would need to include a program to manage and oversee third party providers
that provide functionality, support or service, directly or indirectly, for SCI systems and indirect SCI systems.490 In addition, proposed amendments to the Regulation S–P Safeguards Rule would require broker￾dealers and transfer agents to include written policies and procedures within their response programs that require their service providers, pursuant to a written contract, to take appropriate measures that are designed to protect against unauthorized access to or use of customer information, including notification to the broker-dealer or transfer agent as soon as possible, but no later than 48 hours after becoming aware of a breach, in the event of any breach in security resulting in unauthorized access to customer information maintained by the service provider to enable the broker-dealer or transfer agent to implement its response program expeditiously.491 Proposed Rule 10 would have several policies and procedures requirements that are designed to address similar cybersecurity risks as these proposed amendments to Regulation SCI and Regulation S–P. First, a Covered Entity’s policies and procedures under proposed Rule 10 would need to require periodic assessments of cybersecurity risks associated with the Covered Entity’s information systems and information residing on those systems.492 This element of the policies and procedures would need to include requirements that the Covered Entity identify its service providers that receive, maintain, or process information, or are otherwise permitted to access its information systems and any of its information residing on those systems, and assess the cybersecurity risks associated with its use of these service providers.493 Second, under proposed Rule 10, a Covered Entity’s policies and procedures would need to require oversight of service providers that receive, maintain, or process its information, or are otherwise permitted to access its information systems and the information residing on those systems, pursuant to a written contract between the Covered Entity and the service provider, through which the service providers would need to be required to implement and maintain appropriate measures that are designed to protect the Covered Entity’s information systems and information residing on those systems.494 A Covered Entity that implements these requirements of proposed Rule 10 with respect to its SCI systems and indirect SCI systems generally should satisfy the proposed requirements of Regulation SCI that the SCI entity’s policies and procedures include a program to manage and oversee third party providers that provide functionality, support or service, directly or indirectly, for SCI systems and indirect SCI systems. Similarly, a broker-dealer or transfer agent that implements these requirements of proposed Rule 10 generally would comply with the proposed requirements of the Regulation S–P Safeguards Rule relating to the oversight of service providers. Regulation SCI and Regulation S–P
Unauthorized Access Requirements. Under the proposed amendments to Regulation SCI, SCI entities would be required to have a program to prevent the unauthorized access to their SCI systems and indirect SCI systems, and information residing therein.495 The proposed amendments to the Regulation S–P Disposal Rule would require broker-dealers and transfer agents that maintain or otherwise possess consumer information or customer information for a business purpose to properly dispose of this information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.496 The broker-dealer or transfer agent would be required to adopt and implement written policies and procedures that address the proper disposal of consumer information and customer information in accordance with this standard.497 Proposed Rule 10 would have several policies and procedures requirements that are designed to address similar cybersecurity-related risks as these proposed requirements of Regulation SCI and the Regulation S–P Disposal Rule. First, a Covered Entity’s policies and procedures under proposed Rule 10 would need to require controls: (1) requiring standards of behavior for individuals authorized to access the Covered Entity’s information systems and the information residing on those systems, such as an acceptable use policy; (2) identifying and authenticating individual users, including but not limited to implementing authentication measures that require users to present a combination of two or more credentials for access verification; (3) establishing procedures for the timely distribution,

498See paragraphs (b)(1)(ii)(A) through (E) of proposed Rule 10; see also section II.B.1.b. of this release (discussing these requirements in more detail). 499See paragraph (b)(1)(iii)(A) of proposed Rule 10; see also section II.B.1.c. of this release (discussing these requirements in more detail). 500See paragraphs (b)(1)(iii)(A)(1) through (5) of proposed Rule 10. 501See 17 CFR 242.1001(a)(2)(vii) and (c)(1), respectively. 502Regulation SCI’s obligation to take corrective action may include a variety of actions, such as determining the scope of the SCI event and its causes, among others. See Regulation SCI 2014 Adopting Release, 79 FR at 72251, 72317. See also 17 CFR 242.1002(a). 503See Regulation S–P 2023 Proposing Release. The response program also would need to have procedures to notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization unless the covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. See id. 504See Regulation S–P 2023 Proposing Release. As discussed below, the response program also would need to have procedures to notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization unless the covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. See id. 505See paragraph (b)(1)(iv) of proposed Rule 10; see also section II.B.1.d. of this release (discussing this requirement in more detail). 506See paragraph (b)(1)(v) of proposed Rule 10; see also section II.B.1.e. of this release (discussing this requirement in more detail). 507See 17 CFR 242.1001(a)(2). replacement, and revocation of passwords or methods of authentication; (4) restricting access to specific information systems of the Covered Entity or components thereof and the information residing on those systems solely to individuals requiring access to the systems and information as is necessary for them to perform their responsibilities and functions on behalf of the Covered Entity; and (5) securing remote access technologies.498 Second, under proposed Rule 10, a Covered Entity’s policies and procedures would need to include measures designed to protect the Covered Entity’s information systems and protect the information residing on those systems from unauthorized access or use, based on a periodic assessment of the Covered Entity’s
information systems and the information that resides on the systems.499 The periodic assessment would need to take into account: (1) the sensitivity level and importance of the information to the Covered Entity’s business operations; (2) whether any of the information is personal information; (3) where and how the information is accessed, stored and transmitted, including the monitoring of information in transmission; (4) the information systems’ access controls and malware protection; and (5) the potential effect a cybersecurity incident involving the information could have on the Covered Entity and its customers, counterparties, members, registrants, or users, including the potential to cause a significant cybersecurity incident.500 A Covered Entity that implements these requirements of proposed Rule 10 with respect to its SCI systems and indirect SCI systems generally should satisfy the proposed requirements of Regulation SCI that the SCI entity’s policies and procedures include a program to prevent the unauthorized access to their SCI systems and indirect SCI systems, and information residing therein. Similarly, a broker-dealer or transfer agent that implements these requirements of proposed Rule 10 should generally satisfy the proposed requirements of the Regulation S–P Disposal Rule to adopt and implement written policies and procedures that address the proper disposal of consumer information and customer information. Regulation SCI and Regulation S–P Response Programs. Regulation SCI requires SCI entities to have policies and procedures to monitor its SCI systems and indirect SCI systems for SCI events, which include systems intrusions for unauthorized access, and also requires them to have policies and procedures that include escalation procedures to quickly inform responsible SCI personnel of potential SCI events.501 The amendments to Regulation S–P’s safeguards provisions would require the policies and procedures to include a response program for unauthorized access to or use of customer information. Further, the response program would need to be reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including procedures, among others: (1) to assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the customer information systems and types of customer information that may have been accessed or used without authorization; 502 and (2) to take appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information.503 The amendments to the Regulation S– P Safeguards Rule would require the policies and procedures to include a response program for unauthorized access to or use of customer information. Further, the response program would need to be reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information,
including procedures, among others: (1) to assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the customer information systems and types of customer information that may have been accessed or used without authorization; and (2) to take appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information.504 Proposed Rule 10 would have several policies and procedures requirements that are designed to address similar cybersecurity-related risks as these proposed requirements of the Regulation S–P Safeguards Rule. First, under proposed Rule 10, a Covered Entity’s policies and procedures would need to require measures designed to detect, mitigate, and remediate any cybersecurity threats and vulnerabilities with respect to the Covered Entity’s information systems and the information residing on those systems.505 Second, under proposed Rule 10, a Covered Entity’s policies and procedures would need to have measures designed to detect, respond to, and recover from a cybersecurity incident, including policies and procedures that are reasonably designed to ensure (among other things): (1) the continued operations of the Covered Entity; (2) the protection of the Covered Entity’s information systems and the information residing on those systems; and (3) external and internal cybersecurity incident information sharing and communications.506 A Covered Entity that implements reasonably designed policies and procedures in compliance with these requirements of proposed Rule 10 generally should satisfy the proposed requirements of the Regulation SCI and Regulation S–P Safeguards Rule to have a response program relating to response programs for unauthorized access. Regulation SCI Review Requirements. Regulation SCI currently prescribes certain elements that must be included in each SCI entity’s policies and procedures.507 These required elements include policies and procedures that must provide for regular reviews and

508 17 CFR 242.1001(a)(2)(iv).
509See 17 CFR 242.1003(b)(1)(i).
510 Id.
511See Regulation SCI 2023 Proposing Release. 512See Regulation SCI 2023 Proposing Release; 17 CFR 242.1001(a)(2)(iv). 513See paragraph (b)(1)(i)(A) of proposed Rule 10; see also section II.B.1.a. of this release (discussing this requirement in more detail). 514See paragraph (b)(1)(i)(A)(1) of proposed Rule 10. 515See paragraph (b)(1)(iv) of proposed Rule 10; see also section II.B.1.d. of this release (discussing this requirement in more detail). 516See paragraph (b)(1)(iii)(A) of proposed Rule 10. 517See also section II.B.1.c. of this release. The Commission also is requesting comment above on whether proposed Rule 10 should be modified to specifically require penetration testing. 518See section IV.C.2. of this release (discussing the activities of broker-dealers that would not meet the definition of ‘‘covered entity’’ in proposed Rule 10). As discussed below in section IV.C.2. of this release, the 1,541 broker-dealers that would meet the definition of ‘‘covered entity’’ in proposed Rule 10 had average total assets of $3.5 billion and average regulatory equity of $325 million; whereas the 1,969 that would not meet the definition of ‘‘covered entity’’ had average total assets of $4.7 million and regulatory equity of $3 million. This means that broker-dealers that would not meet the definition of ‘‘covered entity’’ in proposed Rule 10 accounted for about 0.2% of the total assets of all broker-dealers and 0.1% of total capital for all broker-dealers. 519See section IV.C.2. of this release (discussing the activities of broker-dealers that would not meet the definition of ‘‘covered entity’’ in proposed Rule 10). 520See paragraph (e) of proposed Rule 10 (setting forth the policies and procedures requirements for Market Entities that are not broker-dealers). See also
section II.C. of this release (discussing these
proposed requirements in more detail). testing of SCI systems and indirect SCI systems, including backup systems, to identify vulnerabilities from internal and external threats.508 In addition, Regulation SCI requires SCI entities to conduct penetration tests as part of a review of their compliance with Regulation SCI.509 While these reviews must be conducted not less than once each calendar year, the penetration tests currently need to be conducted not less than once every three years.510 The amendments to Regulation SCI would increase the required frequency of the penetration tests to not less than once each calendar year.511 The amendments to Regulation SCI also would require that the penetration tests include tests of any vulnerabilities of the SCI entity’s SCI systems and indirect SCI systems identified under the existing requirement to perform regular reviews and testing of SCI systems and indirect SCI systems, including backup systems, to identify vulnerabilities from internal and external threats.512 Proposed Rule 10 would have several policies and procedures requirements that are designed to address similar cybersecurity-related risks as these existing and proposed requirements of Regulation SCI. First, a Covered Entity’s policies and procedures under proposed Rule 10 would need to require periodic assessments of cybersecurity risks associated with the Covered Entity’s information systems and information residing on those systems.513 Moreover, this element of the policies and procedures would need to include requirements that the Covered Entity categorize and prioritize cybersecurity risks based on an inventory of the components of the Covered Entity’s information systems and information residing on those systems and the potential effect of a cybersecurity incident on the Covered Entity.514 Second, under proposed Rule 10, a Covered Entity’s policies and procedures would need to require measures designed to detect, mitigate, and remediate any cybersecurity threats and vulnerabilities with respect to the Covered Entity’s information systems and the information residing on those systems.515 A Covered Entity that implements these requirements of proposed Rule 10 with respect to its SCI systems and indirect SCI systems generally should satisfy the current requirements of Regulation SCI that the SCI entity’s policies and procedures require regular reviews and testing of SCI systems and indirect SCI systems, including backup systems, to identify vulnerabilities from internal and external threats. Further, while proposed Rule 10 does not require penetration testing, the proposed rule—as discussed above— requires measures designed to protect the Covered Entity’s information systems and protect the information residing on those systems from unauthorized access or use, based on a periodic assessment of the Covered Entity’s information systems and the information that resides on the systems.516 As discussed earlier, penetration testing could be part
of these measures.517 Therefore, the existing and proposed requirements of Regulation SCI requiring penetration testing could be incorporated into and should fit within a Covered Entity’s policies and procedures to address cybersecurity risks under proposed Rule 10. Non-Covered Broker-Dealers Non-Covered Broker-Dealers—which would be subject to Regulation S–P but not Regulation SCI—are smaller firms whose functions do not play as significant a role in the U.S. securities markets, as compared to Covered Broker-Dealers.518 For example, Non￾Covered Broker-Dealers tend to offer a more focused and limited set of services such as facilitating private placements of securities, selling mutual funds and variable contracts, underwriting securities, and participating in direct investment offerings.519 Further, they do not hold customer securities and cash or serve as a conduit (i.e., an introducing broker-dealer) for customers to access their accounts at a carrying broker￾dealer that holds the customers’ securities and cash. If these Non￾Covered Broker-Dealers do not possess or maintain any customer information or consumer information for a business purpose in connection with the services they provide, they would not be subject to either the current or proposed requirements of Regulation S–P, including those that pertain to cybersecurity. However, Non-Covered Broker￾Dealers under proposed Rule 10 that do possess or maintain customer information or consumer information for a business purpose would be subject to the current and proposed requirements of Regulation S–P. Given their smaller size, some of these Non￾Covered Broker-Dealers may store and dispose of the information in paper form and, therefore, under the existing and proposed requirements of Regulation S– P would need to address the physical security aspects of storing and disposing of this information. These paper records would not be subject to proposed Rule 10. Some Non-Covered Broker-Dealers likely would store customer information and consumer information for a business purpose electronically on an information system. Under the existing and proposed requirements of Regulation S–P, these Non-Covered Broker-Dealers would need to address the cybersecurity risks of storing this information on an information system. These Non-Covered Broker-Dealers would be subject the requirements of proposed Rule 10 to establish, maintain, and enforce written policies and procedures that are reasonably designed to address their cybersecurity risks taking into account the size, business, and operations of the firm.520 Under proposed Rule 10, they also would be required to review and assess the design and effectiveness of their cybersecurity policies and procedures, including whether the policies and procedures reflect changes in cybersecurity risk over the time period covered by the

521See section II.B.1. of this release (discussing the policies and procedures requirements for Covered Entities). 522See 17 CFR 242.301 through 304 (conditions to the Regulation ATS exemption); 17 CFR 248.201 and 202 (Regulation S–ID identity theft program requirements). 523See 17 CFR 248.201 and 202. The scope of Regulation S–ID includes any financial institution or creditor, as defined in the Fair Credit Reporting Act (15 U.S.C. 1681) that is required to be ‘‘registered under the Securities Exchange Act of 1934.’’ See 17 CFR 248.201(a). 524See 17 CFR 242.301(b)(6). Currently, no ATS has crossed the either of the volume-based thresholds and, therefore, no ATS is subject to the requirements pertaining, in part, to cybersecurity. See also Amendments Regarding the Definition of ‘‘Exchange’’ and ATSs Release, 87 FR 15496. 525See Regulation of Exchanges and Alternative Trading Systems, Exchange Act Release No. 40760 (Dec. 8, 1998) [63 FR 70844, 70876 (Dec. 22, 1998)]. 526See 17 CFR 242.301(b)(10). 527See 17 CFR 242.301(b)(10)(i)(A). review. This means the Non-Covered Broker-Dealer would need to comprehensively address all of its cybersecurity risks. The policies and procedures to address cybersecurity risks required under proposed Rule 10 would need to address cybersecurity risks involving information systems on which customer information and consumer information is stored. Therefore, complying with this requirement of proposed Rule 10 would be consistent with complying with the existing and proposed requirements of Regulation S–P that relate to cybersecurity. As discussed above, Regulation S–P (currently and as it would be amended) sets forth certain specific requirements that pertain to cybersecurity risk; whereas the requirements of proposed Rule 10 applicable to Non-Covered Broker-Dealers more generally require the firm to establish, maintain, and enforce written policies and procedures that are reasonably designed to address its cybersecurity risks taking into account the size, business, and operations of the firm. As explained above, those more specific existing and proposed requirements of Regulation S– P are consistent with certain of the elements—which are based on industry standards for addressing cybersecurity risk—that Covered Entities would be required to include in their policies and procedures under proposed Rule 10.521 Further, proposed Rule 10 would require a Non-Covered Broker-Dealer to take into account its size, business, and operations when designing its policies and procedures to address its cybersecurity risks. Storing customer information and consumer information on an information system is the type of operation a Non-Covered Broker-Dealer would need to take into account. Consequently, the specific existing and proposed requirements of Regulation S– P should fit within and be consistent with a Non-Covered Broker-Dealer’s reasonably designed policies and procedures to address its cybersecurity risks under proposed Rule 10,
including the risks associated with storing customer information and consumer information on an information system.
iii. Regulation ATS and Regulation S–ID
Certain broker-dealers that operate an ATS are subject to Regulation ATS and certain broker-dealers that offer and maintain certain types of accounts for customers are subject to requirements of Regulation S–ID to establish an identity theft program.522 Additionally, SBS Entities and transfer agents could be subject to Regulation S–ID if they are ‘‘financial institutions’’ or ‘‘creditors.’’ 523 As discussed below, Regulation ATS and Regulation S–ID are more narrowly focused on certain cybersecurity risks as compared to proposed Rule 10, which focuses on all cybersecurity risks of a Market Entity. In addition, the current requirements of Regulation ATS and Regulation S–ID should fit within and be consistent with the broader policies and procedures required under proposed Rule 10 to address all cybersecurity risks. Regulation ATS requires certain broker-dealers that operate an ATS to review the vulnerability of its systems and data center computer operations to internal and external threats, physical hazards, and natural disasters if during at least four of the preceding six calendar months, such ATS had: (1) with respect to municipal securities, 20 percent or more of the average daily volume traded in the United States; or (2) with respect to corporate debt securities, 20 percent or more of the average daily volume traded in the United States.524 Therefore, in addition to other potential systems issues, the broker-dealer would need to address cybersecurity risk of relating to its ATS system. Further, this requirement applies to systems that support order entry, order handling, execution, order routing, transaction reporting, and trade comparison in the particular security.525 Therefore, it has a narrower focus than proposed Rule 10. Regulation ATS also requires all broker-dealers that operate an ATS to establish adequate written safeguards and written procedures to protect subscribers’ confidential trading information.526 The written safeguards and procedures must include, among other things, limiting access to the confidential trading information of subscribers to those employees of the alternative trading system who are operating the system or responsible for its compliance with these or any other applicable rules.527 These requirements apply to all broker-dealers that operate an ATS and, as indicated, apply to a narrow set of information stored on their information systems: the confidential trading information of the subscribers to the ATS. As discussed above, Covered Entities under proposed Rule 10—which would include broker-dealers that operate as an ATS—would be required to establish, maintain, and enforce written policies and procedures that are reasonably designed to address the Covered Entity’s cybersecurity risks. In addition, Covered Entities would be required to include the following elements in their policies and procedures: (1) periodic assessments of cybersecurity risks associated with the Covered Entity’s information systems and
written documentation of the risk assessments; (2) controls designed to minimize user￾related risks and prevent unauthorized access to the Covered Entity’s information systems; (3) measures designed to monitor the Covered Entity’s information systems and protect the Covered Entity’s information from unauthorized access or use, and oversight of service providers that receive, maintain, or process information, or are otherwise permitted to access the Covered Entity’s information systems; (4) measures to detect, mitigate, and remediate any cybersecurity threats and vulnerabilities with respect to the Covered Entity’s information systems; and (5) measures to detect, respond to, and recover from a cybersecurity incident and written documentation. Consequently, a broker￾dealer operates an ATS and that implements reasonably designed policies and procedures in compliance with the requirements of proposed Rule 10 should generally satisfy the current requirements of Regulation ATS to review the vulnerability of its systems and data center computer operations to internal and external threats and to protect subscribers’ confidential trading information to the extent these requirements pertain to cybersecurity. Regulation S–ID requires—among other things—a financial institution or creditor within the scope of the regulation that offers or maintains one or more covered accounts to develop and implement a written identity theft prevention program that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing

528See 17 CFR 248.201(d)(1).
529See 17 CFR 248.201(b)(3).
530See section I.A. of this release.
531See 17 CFR 242.1002(b). An ‘‘SCI event’’ is an event at an SCI entity that is: (1) a ‘‘systems disruption,’’ which is an event in an SCI entity’s SCI systems that disrupts, or significantly degrades, the normal operation of an SCI system; (2) a ‘‘systems intrusion,’’ which is any unauthorized entry into the SCI systems or indirect SCI systems of an SCI entity; or (3) a ‘‘systems compliance issue,’’ which is an event at an SCI entity that has caused any SCI system of such entity to operate in a manner that does not comply with the Exchange Act and the rules and regulations thereunder or the entity’s rules or governing documents, as applicable. See 17 CFR 242.1000 (defining the terms ‘‘systems disruption,’’ ‘‘system intrusion,’’ and ‘‘system compliance issue’’ and including those terms in the definition of ‘‘SCI event’’). The amendments to Regulation SCI would broaden the definition of ‘‘system intrusion’’ to include a cybersecurity event that disrupts, or significantly degrades, the normal operation of an SCI system, as well as a material attempted unauthorized entry into the SCI systems or indirect SCI systems of an SCI entity. Regulation SCI 2023 Proposing Release. 532See paragraphs (c)(1) and (2) of proposed Rule 10 (requiring Covered Entities to provide immediate written notice and subsequent reporting on Part I of proposed Form SCIR of significant cybersecurity incidents); sections II.B.2. and II.B.4. of this release (discussing the requirements of paragraphs (c)(1) and (2) of proposed Rule 10 and Part I of Form SCIR in more detail). Non-Covered Broker-Dealers also would be subject to an immediate written electronic notice requirement under paragraph (e)(2) of proposed Rule 10. However, as discussed above, a Non-Covered Broker-Dealer likely would not be an SCI Entity. 533See section II.F.1.b. of this release. Currently, broker-dealers that operate as ATSs and trade certain stocks exceeding specific volume thresholds are SCI entities. The proposed amendments to Regulation SCI would expand the definition of ‘‘SCI entity’’ to include broker-dealers that exceed an asset-based size threshold or a volume-based trading threshold in NMS stocks, exchange-listed options, agency securities, or U.S. treasury securities. See Regulation SCI 2023 Proposing Release. 534See paragraphs (a)(1)(i)(A) and (F) proposed Rule 10 (defining the categories of broker-dealers that would be Covered Entities); paragraph (a)(1)(ix) proposed Rule 10 (defining transfer agents as ‘‘covered entities’’). 535See section II.B.2.a. of this release. 536See section II.B.2.b. of this release. covered account.528 Regulation S–ID defines the term ‘‘covered account’’—in pertinent part—as an account that the financial institution or creditor maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, such as a brokerage account with a broker￾dealer, and any other account that the financial institution or
creditor offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the financial institution or creditor from identity theft, including financial, operational, compliance, reputation, or litigation risks.529 Therefore, Regulation S–ID is narrowly focused on one cybersecurity risk—identity theft. Identity theft—as discussed earlier—is one of the tactics threat actors use to cause harm after obtaining unauthorized access to personal information.530 As a cybersecurity risk, Market Entities would need to address it as part of their policies and procedures under proposed Rule 10. Consequently, the requirement of Regulation S–ID should fit within and be consistent with a Market Entity’s reasonably designed policies and procedures to address its cybersecurity risks under proposed Rule 10, including the risks associated with identity theft. d. Notification and Reporting to the Commission Regulation SCI (currently and as it would be amended) provides the framework for notifying the Commission of SCI events including, among other things, to: immediately notify the Commission of the event; provide a written notification on Form SCI within 24 hours that includes a description of the SCI event and the system(s) affected, with other information required to the extent available at the time; provide regular updates regarding the SCI event until the event is resolved; and submit a final detailed written report regarding the SCI event.531 If proposed Rule 10 is adopted as proposed, it would require Market Entities that are Covered Entities to provide the Commission (and other regulators, if applicable) with immediate written electronic notice of a significant cybersecurity incident affecting the Covered Entity and, thereafter, report and update information about the significant cybersecurity incident by filing Part I of proposed Form SCIR with the Commission (and other regulators, if applicable).532 Part I of proposed of Form SCIR would elicit information about the significant cybersecurity incident and the Covered Entity’s efforts to respond to, and recover from, the incident. Consequently, a Covered Entity that is also an SCI entity that experiences a significant cybersecurity incident under proposed Rule 10 that also is an SCI event would be required to make two filings for the single incident: one on
Part I of proposed Form SCIR and the
other on Form SCI. The Covered Entity also would be required to make additional filings on Forms SCIR and SCI pertaining to the significant cybersecurity incident (i.e., to provide updates and final reports). The approach of having two separate notification and reporting programs— one under proposed Rule 10 and the other under Regulation SCI—would be appropriate for the following reasons. As discussed earlier, certain broker￾dealers and all transfer agents would not be SCI entities under the current and proposed requirements of Regulation SCI.533 Certain of the broker-dealers that are not SCI entities (currently and as it would be amended) would be Covered Entities and all transfer agents would be Covered Entities.534 In addition, the current and proposed reporting requirements of Regulation SCI are or would be triggered by events impacting SCI systems and indirect SCI systems. The Covered Entities that are or would be SCI entities use and rely on information systems that are not SCI systems or indirect SCI systems under the current and proposed amendments to Regulation SCI. For these reasons, Covered Entities could be impacted by significant cybersecurity incidents that do not trigger the current and proposed notification requirements of Regulation SCI either because they do not meet the current or proposed definitions of ‘‘SCI entity’’ or the significant cybersecurity incident does not meet the current or proposed definitions of ‘‘SCI event.’’ As discussed earlier, the objective of the notification and reporting requirements of proposed Rule 10 is to improve the Commission’s ability to monitor and evaluate the effects of a significant cybersecurity incident on Covered Entities and their customers, counterparties, members, registrants, or users, as well as assess the potential risks affecting financial markets more broadly.535 For this reason, Part I of proposed Form SCIR is tailored to elicit information relating specifically to cybersecurity, such as information relating to the threat actor, and the impact of the incident on any data or personal information that may have been accessed.536 The Commission and its staff could use the information reported on Part I of Form SCIR to monitor the U.S. securities markets and the Covered Entities that support those markets broadly from a cybersecurity perspective, including identifying cybersecurity threats and trends from a market-wide view. By requiring all Covered Entities to report information about a significant cybersecurity incident on a common form, the information obtained from these filings over time would create a comprehensive set of data of all significant cybersecurity incidents impacting Covered Entities that is based on these entities responding to the same check boxes and questions on the form. This would facilitate analysis of the data, including analysis across different Covered Entities and significant cybersecurity incidents. Eventually, this

537See 17 CFR 242.1000 (defining the term ‘‘SCI event’’); Regulation SCI 2023 Proposing Release. 538See 17 CFR 242.1000 (defining the term ‘‘system disruption’’ and including that term in the definition of ‘‘SCI event’’); Regulation SCI 2023 Proposing Release. 539See 17 CFR 242.1002(c). 540See Regulation S–P 2023 Proposing Release. The proposed amendments to Regulation S–P would define ‘‘sensitive customer information’’ to mean any component of customer information alone or in conjunction with any other information, the compromise of which could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information. Id. The proposed amendments would provide example of sensitive customer information. Id. 541See paragraph (d)(1) of proposed Rule 10. 542See section II.B.3.b. of this release (discussing these proposed requirements in more detail). 543A carrying broker-dealer would be required to make the disclosures to its customers as well through the means by which they receive account statements. 544 Information regarding major SCI events is and would be required to be disseminated by an SCI entity to all of its members, participants, or customers (as applicable) under the existing and proposed requirements of Regulation SCI. See Regulation SCI 2023 Proposing Release. set of data and the ability to analyze it by searching and sorting how different Covered Entities responded to the same questions on the form could be used to spot common trending risks and vulnerabilities as well as best practices employed by Covered Entities to respond to and recover from significant cybersecurity incidents. The current and proposed definitions of ‘‘SCI event’’ include events that are not related to significant cybersecurity incidents.537 For example, under the current and proposed requirements of Regulation SCI, the definition of ‘‘SCI event’’ includes an event in an SCI entity’s SCI systems that disrupts, or significantly degrades, the normal operation of an SCI system.538 Therefore, the definitions are not limited to events in an SCI entity’s SCI systems that disrupt, or significantly degrade, the normal operation of an SCI system caused by a significant cybersecurity incident. The information elicited in Form SCI reflects the broader scope of the reporting requirements of Regulation SCI (as compared to the narrower focus of proposed Rule 10 on reporting about significant cybersecurity incidents). For example, the form requires the SCI entity to identify the type of SCI event: systems compliance issue, systems disruption, and/or systems intrusion. In addition, Form SCI is tailored to elicit information specifically about SCI systems. For example, the form requires the SCI entity to indicate whether the type of SCI system impacted by the SCI event directly supports: (1) trading; (2) clearance and settlement; (3) order routing; (4) market data; (5) market regulation; and/or (6) market surveillance. If the impacted
system is a critical SCI system, the SCI entity must indicate whether it directly supports functionality relating to: (1) clearance and settlement systems of clearing agencies; (2) openings, reopenings, and closings on the primary listing market; (3) trading halts; (4) initial public offerings; (5) the provision of consolidated market data; and/or (6) exclusively-listed securities. The form also requires the SCI entity to indicate if the systems that provide functionality to the securities markets for which the availability of alternatives is significantly limited or nonexistent and without which there would be a material impact on fair and orderly markets. e. Disclosure Proposed Rule 10 and the existing and proposed requirements of Regulation SCI and the proposed requirements of Regulation S–P also have similar, but distinct, requirements related to notification about certain cybersecurity incidents. Regulation SCI requires that SCI entities disseminate information to their members, participants, or customers (as applicable) regarding SCI events.539 The proposed amendments to Regulation S–P would require broker￾dealers and transfer agents to notify affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.540 Proposed Rule 10 would require a Covered Entity to make two types of public disclosures relating to cybersecurity on Part II of proposed Form SCIR.541 Covered Entities would be required to make the disclosures by filing Part II of proposed Form SCIR on EDGAR and posting a copy of the filing on their business internet websites.542 In addition, a Covered Entity that is either a carrying or introducing broker￾dealer would be required to provide a copy of the most recently filed Part II of Form SCIR to a customer as part of the account opening process. Thereafter, the carrying or introducing broker-dealer would need to provide the customer with the most recently filed form annually. The copies of the form would need to be provided to the customer using the same means that the customer elects to receive account statements (e.g., by email or through the postal service). Finally, a Covered Entity would be required to promptly make updated disclosures through each of the methods described above (as applicable) if the information required to be disclosed about cybersecurity risk or significant cybersecurity incidents materially changes, including, in the case of the disclosure about significant cybersecurity incidents, after the occurrence of a new significant cybersecurity incident or when information about a previously disclosed significant cybersecurity incident materially changes. Consequently, a Covered Entity would—if it experiences a ‘‘significant cybersecurity incident’’—be required to make updated disclosures under proposed Rule 10 by filing Part II of proposed Form SCIR on EDGAR, posting a copy of the form on its business internet website, and, in the case of
a carrying or introducing broker￾dealer, by sending the disclosure to its customers using the same means that the customer elects to receive account statements. Moreover, if Covered Entity is an SCI entity and the significant cybersecurity incident is or would be an SCI event under the current or proposed requirements of Regulation SCI, the Covered Entity also could be required to disseminate certain information about the SCI event to certain of its members, participants, or customers (as applicable). Further, if the Covered Entity is a broker-dealer or transfer agent and, therefore, subject to Regulation S–P (as it is proposed to be amended), the broker-dealer or transfer agent also could be required to notify individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. However, despite these similarities, there are distinct differences. First, proposed Rule 10, Regulation SCI, and Regulation S–P (as proposed to be amended) require different types of information to be disclosed. Second, the disclosures, for the most part, would be made to different persons: (1) the public at large in the case of proposed Rule 10; 543 (2) affected members, participants, or customers (as applicable) of the SCI entity in the case of Regulation SCI; 544 and (3) affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization or, in some cases, all individuals whose information resides in the customer information system that was accessed or used without authorization in the case of Regulation S–P (as proposed to be amended). Additionally, the disclosure or notification provided about certain cybersecurity incidents is different

under proposed Rule 10 and the existing and/or proposed requirements of Regulation SCI and Regulation S–P, given their distinct goals. For example, the requirement to disclose summary descriptions of certain cybersecurity incidents from the current or previous calendar year publicly on EDGAR, among other methods, under proposed Rule 10 serves a different purpose than:
(1) the member, participant, or customer (as applicable) dissemination of information regarding SCI events under Regulation SCI; and (2) the customer notification obligation under the proposed amendments to Regulation S– P, which would provide more specific information to individuals affected by a security compromise involving their sensitive customer information, so that those individuals may take remedial actions if they so choose.
2. Request for Comment
The Commission requests comment on the potential duplication or overlap between the requirements of proposed Rule 10, Regulation SCI (as it currently exists and as it is proposed to be amended), and Regulation S–P (as it currently exists and as it is proposed to be amended). In addition, the Commission is requesting comment on the following matters:
91. Should the policies and
procedures requirements of proposed Rule 10 be modified to address Market Entities that also would be subject to the existing and proposed requirements of Regulation SCI and/or Regulation S–P? For example, would it be particularly costly or create practical implementation difficulties to apply the requirements of proposed Rule 10 (if it is adopted) to have policies and procedures to address cybersecurity risks to Market Entities even if they also would be subject to requirements to have policies and procedures under Regulation SCI and/or Regulation S P that address certain cybersecurity risks (currently and as they would be amended)? If so, explain why. If not, explain why not. Are there ways the policies and procedures requirements of proposed Rule 10 could be modified to minimize these potential impacts while achieving the separate goals of this proposal to protect participants in the U.S. securities markets and the markets themselves from cybersecurity risks? If so, explain how and suggest specific modifications.
92. Would it be appropriate to modify
proposed Rule 10 to exempt SCI systems or indirect SCI systems from its policies and procedures requirements and instead rely on the policies and procedures requirements of Regulation SCI to address cybersecurity risks to these information systems of Covered Entities? If so, explain why. If not, explain why not. What would be the costs and benefits of this approach? For example, if one set of policies and procedures generally would satisfy the requirements of both rules, would this approach result in incremental costs or benefits? Please explain. Would this approach achieve the objectives of this rulemaking to address cybersecurity risks to Covered Entities, given that Rule 10 is specifically designed to address cybersecurity risks and Regulation SCI is designed to address a broader range of risks to certain information systems? Please explain. Would this approach create practical implementation and compliance complexities insomuch as one set of the Covered Entity’s systems would be subject to Regulation SCI (i.e., SCI systems and indirect SCI systems) and the other set would be subject to Rule 10? Please explain. If it would create practical implementation and compliance difficulties, would Covered Entities nonetheless apply separate policies and procedures requirements to their information systems based on whether they are or are not SCI systems and indirect SCI Systems or would they develop a single set of policies and procedures that comprehensively addresses the requirements of Regulation SCI and Rule 10? Please explain. Would a comprehensive set of policies and procedures result in stronger measures to protect SCI systems and indirect SCI systems from cybersecurity risks? Please explain. If so, would this be appropriate given the nature of SCI systems and indirect SCI systems and the roles these systems play in the U.S. securities markets? Please explain.
93. Should the policies and
procedures requirements of proposed Rule 10 be modified to address Market Entities that also would be subject to the requirements of Regulation ATS? If so, explain why. If not, explain why not.
94. Should the immediate notification
and reporting requirements of proposed Rule 10 be modified to address Covered Entities that also would be subject to the existing and proposed requirements of Regulation SCI? For example, would it be particularly costly or create practical implementation difficulties to apply the immediate notification and subsequent reporting requirements of proposed Rule 10 and Part I of proposed Form SCIR (if they are adopted) to Covered Entities even if they also would be subject to immediate notification and subsequent reporting requirements under Regulation SCI (as it currently exists and would be amended)? If so, explain why. If not, explain why not. Are there ways the notification and reporting requirements of proposed Rule 10 and
Part I of proposed Form SCIR could be
modified to minimize these potential impacts while achieving the separate goals of this proposal to protect participants in the U.S. securities markets and the markets themselves from cybersecurity risks? If so, explain how and suggest specific modifications. For example, should Part I of proposed Form SCIR be modified to include a
section that incorporates the check
boxes and questions of Form SCI so that a single form could be filed to meet the reporting requirements of proposed Rule 10 and Regulation SCI? If so, explain why. If not, explain why not. Are there other ways Part I of proposed Form SCIR could be modified to combine the elements of Form SCI? If so, explain how. Should Rule 10 be modified to require that the initial Part I of Form SCIR must be filed within 24 hours (instead of promptly but not later than 48 hours) to align the filing timeframe with Regulation SCI? If so, explain why. If not, explain why not.
95. Should the public disclosure
requirements of proposed Rule 10 be modified to address Covered Entities that also would be subject to the existing and proposed requirements of Regulation SCI and/or Regulation S–P? For example, would it be particularly costly or create practical implementation difficulties to apply the public disclosure requirements of proposed Rule 10 and Part II of proposed form SCIR (if they are adopted) to Covered Entities even if they also would be subject to the current and proposed disclosure requirements of Regulation SCI and Regulation S–P? If so, explain why. If not, explain why not. Are there ways the public disclosure requirements of proposed Rule 10 could be modified to minimize these potential impacts while achieving the separate goals of this proposal to protect participants in the U.S. securities markets and the markets themselves from cybersecurity risks? If so, explain how and suggest specific modifications. For example, should proposed Rule 10 be modified to permit the customer notification that would be required under the amendments to Regulation S–P to satisfy the requirement of proposed Rule 10 that a Covered Entity that is a carrying broker￾dealer or introducing broker-dealer send a copy of an updated Part II of proposed Form SCIR to its customers? If so, explain why. If not, explain why not. Would sending the notification required by proposed Rule 10 and the

545The term ‘‘digital asset’’ or ‘‘crypto asset’’ refers to an asset that is issued and/or transferred using distributed ledger or blockchain technology (‘‘distributed ledger technology’’), including, but not limited to, so-called ‘‘virtual currencies,’’ ‘‘coins,’’ and ‘‘tokens.’’ See Custody of Digital Asset Securities by Special Purpose Broker-Dealers, Exchange Act Release No. 90788 (Dec. 23, 2020) [86 FR 11627, 11627, n.1 (Feb. 26, 2021)]. To the extent digital assets rely on cryptographic protocols, these types of assets are commonly referred to as ‘‘crypto assets.’’ A crypto asset may or may not meet the definition of a ‘‘security’’ under the federal securities laws. See, e.g., Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934: The DAO, Securities Exchange Act Release No. 81207 (July 25, 2017), available at https://www.sec.gov/litigation/ investreport/34-81207.pdf. See also SEC v. W.J. Howey Co., 328 U.S. 293 (1946). ‘‘Digital asset securities’’ can be referred to as ‘‘crypto asset securities’’ and for purposes of this release, the Commission does not distinguish between the terms ‘‘digital asset securities’’ and ‘‘crypto asset securities.’’ 546See KPMG, Assessing crypto and digital asset risks (May 2022), available at https:// advisory.kpmg.us/content/dam/advisory/en/pdfs/ 2022/assessing-crypto-and-digital-asset-risks.pdf (‘‘Properly securing digital assets[] is typically viewed as the biggest risk that companies must address.’’). 547See U.S. Department of Treasury, Crypto￾Assets: Implications for Consumers, Investors, and Businesses (Sept. 2022), available at https:// home.treasury.gov/system/files/136/CryptoAsset_ EO5.pdf (‘‘Treasury Crypto Report’’) (‘‘Moreover, the crypto-asset ecosystem has unique features that make it an increasingly attractive target for unlawful activity, including the ongoing evolution of the underlying technology, pseudonymity, irreversibility of transactions, and the current asymmetry of information between issuers of crypto-assets and consumers and investors.’’). 548Moreover, if the Market Entity’s activities involving crypto asset securities involve its information systems, the requirements being proposed in this release would be implicated. 549See, e.g., NIST Glossary (defining ‘‘private key’’). 550See, e.g., Treasury Crypto Report (‘‘Compared to registered financial market intermediaries— which are subject to rules and laws that promote market integrity and govern risks and business conduct, including identifying, disclosing, and mitigating conflicts of interest and adhering to AML/CFT requirements—many crypto-asset platforms may either not yet be in compliance with, or may actively claim not to be subject to, existing applicable U.S. laws and regulations, including registration requirements. . . . When the onboarding process used by platforms is limited or opaque, the risk that the platform may be used for illegal activities increases.’’). 551See CipherTrace,
Cryptocurrency crime and anti-money laundering report (June 2022), available at https://4345106.fs1.hubspotusercontent-na1.net/ hubfs/4345106/CAML%20Reports/CipherTrace %20Cryptocurrency%20Crime%20and%20Anti￾Money%20Laundering%20Report %2c%20June%202022.pdf?_hstc=56248308. 2ea6daf13b00f00afe4d9acf0886eddf .1667865330143.1667865330143.1667917991763. 2&hssc=56248308.1.1667917991763& hsfp=247897319 (‘‘CipherTrace 2022 Report’’). 552For example, this is the case with Bitcoin and Ether, the two crypto assets with the largest market values. See CoinMarketCap, Today’s Cryptocurrency Prices by Market Cap, available at https://coinmarketcap.com/ (‘‘Crypto Asset Market Value Chart’’). See also, e.g., Kaili Wang, Qinchen Wang, and Dan Boneh, ERC–20R and ERC–721R:
Reversible Transactions on Ethereum (Oct. 11, 2022), available at https://arxiv.org/pdf/2208. 00543.pdf#page=16&zoom=100,96,233 (Stanford University proposal discussing the immutability of Ethereum-based tokens, and proposing that reversible Ethereum transactions may facilitate more wide-spread adoption of these crypto assets). With respect to securities, the clearance and settlement of securities that are not crypto assets are characterized by infrastructure whereby intermediaries such as clearing agencies and securities depositories serve as key participants in the process. The clearance and settlement of crypto asset securities, on the other hand, may rely on fewer, if any, intermediaries and remain evolving areas of practices and procedures. 553See Treasury Crypto Report (‘‘Smart contracts, which are widely used by many permissionless blockchains, also present risks as they combine the features of generally being immutable and publicly viewable. Taken together, these attributes pose several vulnerabilities that may be exploited by illicit actors to steal customer funds: once an attacker finds a bug in a smart contract and exploits it, immutable smart contract protocols limit developers’ ability to patch the exploited vulnerability, giving attackers more time to exploit the vulnerability and steal assets.’’). 554See Treasury Crypto Report (noting that of the total amount of crypto asset based crime in 2021, theft rose by over 500% year-over-year to $3.2 billion in total); Chainalysis, The 2022 Crypto Crime Report (Feb. 2022), available at https:// go.chainalysis.com/2022-Crypto-Crime-Report.html (‘‘Chainalysis 2022 Report’’) (predicting that illicit transaction activity will reach an all-time high in terms of value in 2022, and noting that crypto asset based crime hit a new all-time high in 2021, with illicit addresses receiving $14 billion over the course of the year, up from $7.8 billion in 2020). notification required by the proposed amendments to Regulation S–P to the same customer be confusing to the customer? If so, explain why. If not, explain why not. G. Cybersecurity Risk Related to Crypto Assets The creation, distribution, custody, and transfer of crypto assets depends almost exclusively on the operations of information systems.545 Crypto assets, therefore, are exposed to cybersecurity risks.546 Further, crypto assets are attractive targets for threat actors.547 Therefore, information systems that involve crypto assets may be subject to heightened cybersecurity risks. If Market Entities engage in business activities involving crypto assets, they could be exposed to these heighted cybersecurity risks.548 Crypto assets are an attractive target for unlawful activity due, in large part, to the unique nature of distributed ledger technology. Possession or control of crypto assets on a distributed ledger is based on ownership or knowledge of public and private cryptographic key pairings. These key pairings are somewhat analogous to user
names and passwords and consist of strings of letters and numbers used to sign transactions on a distributed ledger and to prove ownership of a blockchain address, which is commonly known as a ‘‘digital wallet.’’ 549 Digital wallets, in turn, generally require the use of internet-connected hardware and software to receive and transmit information about crypto asset holdings. A digital wallet can be obtained by anyone, including a potential threat actor. If a victim’s digital wallet is connected to the internet, and a threat actor obtains access to the victim’s private key, the threat actor can transfer the contents of the wallet to another blockchain address (such as the threat actor’s own digital wallet) without authorization from the true owner. It may be difficult to subsequently track down the identity of the threat actor because the owner of a digital wallet can remain anonymous (absent additional attribution information) and because intermediaries involved in the transfer of crypto assets, such as trading platforms, may not comply with or may actively claim not to be subject to applicable ‘‘know your customer’’ or related diligence requirements.550 The current state of distributed ledger technology may present other challenges to defending against cybercriminal activity. First, there is no centralized information technology (‘‘IT’’) infrastructure that can dynamically detect and prevent cyberattacks on wallets or prevent the transfer of illegitimately obtained crypto assets by threat actors.551 This is unlike traditional infrastructures, such as those used by banks and broker-dealers, where behavioral and historic transaction patterns can be used to detect and prevent account takeovers in real-time. Furthermore, distributed ledger technology often makes it difficult or impossible to reverse erroneous or fraudulent crypto asset transactions, whereas processes and protocols exist to reverse erroneous or fraudulent transactions when trading more traditional assets.552 In addition, certain code that governs the operation of a blockchain and that governs so￾called ‘‘smart contracts’’ are often transparent to the public. This provides threat actors with visibility into potential vulnerabilities associated with the code, though developers may have limited ability to patch those vulnerabilities.553 These characteristics of distributed ledger technology, and others, present cybersecurity vulnerabilities that, if taken advantage of by a threat actor, could lead to financial harm without meaningful recourse to reverse fraudulent transactions, recover or replace lost crypto assets, or correct errors. The amount of crypto assets stolen by threat actors annually continues to increase.554 Threat actors looking to

555See Microsoft 365 Defender Research Team, ‘Ice Phishing’ on the Blockchain (Feb. 16, 2022), available at https://www.microsoft.com/security/ blog/2022/02/16/ice-phishing-on-the-blockchain/. 556See CipherTrace June 2022 Report. Delegating authority to another user reportedly is a common transaction on decentralized finance (‘‘DeFi’’) platforms, as the user may need to provide the DeFi platform with approval to conduct transactions with the user’s tokens. In an ‘‘ice phishing’’ attack, the attacker modifies the spender address to the attacker’s address. Once the approval transaction has been signed, submitted, and mined, the spender can access the funds. The attacker can accumulate approvals over a period of time and then drain the victim’s wallets quickly. 557 Key logging can involve a threat actor deploying a software program designed to record which keys are pressed on a computer keyboard to obtain passwords or other encryption keys, therefore bypassing certain security measures. See NIST Glossary (defining ‘‘key logger’’). Key logging software can be installed, for example, when the victim clicks a link or downloads an attachment in a phishing email, downloads a Trojan virus that is disguised as a legitimate file or application, or is directed to a phony website. 558See Treasury Crypto Report (‘‘In an innovation unique to DeFi lending, some protocols may support ‘flash loans,’ which enable users to borrow, use, and repay crypto assets in a single transaction that is recorded on the blockchain in the same data block. Because there is no default risk associated with flash loans, users can borrow without posting collateral and without risk of being liquidated. A ‘flash loan attack’ can occur when the temporary surge of funds obtained in a flash loan is used to manipulate prices of crypto-assets, often through the interaction of multiple DeFi services, enabling attackers to take over the governance of a protocol, change the code, and drain the treasury.’’). In 2021, code exploits and flash loan attacks accounted for 49.8% of all crypto asset value stolen across all crypto asset services. See Chainalysis 2022 Report. 559Specifically, ‘‘info stealers’’ collect saved credentials, files, autocomplete history, and crypto asset wallets from compromised computers. ‘‘Clippers’’ can insert new text into the victim’s clipboard, replacing text the user has copied. Hackers can use clippers to replace crypto asset addresses copied into the clipboard with their own, allowing them to reroute planned transactions to their own wallets. ‘‘Cryptojackers’’ make unauthorized use of the computing power of a victim’s device to mine crypto assets. See Chainalysis 2022 Report. 560See CipherTrace June 2022 Report. The amount of total activity in the crypto asset markets has increased as well. According to the CipherTrace June 2022 Report, while the total activity in 2020 was around $4.3 trillion, there was approximately $16 trillion of total activity in the first half of
2021 alone. See id. 561See id. 562See Crypto Asset Market Value Chart; see also Treasury Crypto Report. 563See 15 U.S.C. 78c(f). 564See 15 U.S.C. 78w(a)(2). exploit the vulnerabilities associated with crypto assets often employ social engineering techniques, such as phishing to acquire a user’s cryptographic key pairing information. Phishing tactics that have been employed to reach and trick crypto asset users into disclosing their private keys include: (1) monitoring social media for users reaching out to wallet software support, intervening with direct messages, and impersonating legitimate support staff who need the user’s private key to fix the problem; (2) distributing new crypto assets at no cost to a set of wallets in an ‘‘airdrop,’’ and then failing transactions on those assets with an error message to redirect the owner to a phishing website or a website that installs plug-in software and steals the user’s credentials from a local device; and (3) impersonating a wallet software provider and stealing private keys directly from the user.555 To the extent that the activities of Market Entities involve crypto assets, these types of phishing tactics could be used against their employees. Another related variation of a social engineering attack that is similar to phishing, but does not involve stealing private keys directly, is called ‘‘ice phishing.’’ In this scheme, the threat actor tricks the user into signing a digital transaction that delegates approval and control of the user’s wallet to the attacker, allowing the threat actor to become the so-called ‘‘spender’’ of the wallet. Once the threat actor obtains control over the user’s wallet, the threat actor can transfer all of the crypto assets to a new wallet controlled by the threat actor.556 Threat actors also target private keys and crypto assets through other means, such as installing key logging software,557 exploiting vulnerabilities in code used in connection with crypto assets (such as smart contracts), and deploying flash loan attacks.558 Installing key logging software, in particular, is an example of malware that threat actors looking to exploit the vulnerabilities associated with crypto assets often employ. Other common types of crypto asset-focused malware techniques include info stealers, clippers, and cryptojackers.559 The size and growth of the crypto asset markets, along with the fact that many participants in these markets (such as issuers, intermediaries, trading platforms, and service providers) may be acting in noncompliance with applicable law, continue to make them an attractive target for threat actors looking for quick financial gain. The crypto asset ecosystem has exhibited rapid growth in the past few years. For example, industry reports have suggested that the total crypto asset market value increased from approximately $135 billion on January 1, 2019 to just under $2.1 trillion on March 31, 2022.560 According to these reports, the crypto asset market value
peaked at almost $3 trillion in November 2021.561 Various sources also report that the market value remains over $1 trillion today.562
III. General Request for Comment
In addition to the specific requests for comment above, the Commission is requesting comments from all members of the public on all aspects of the proposed rule and amendments. Commenters are requested to provide empirical data in support of any arguments or analyses. With respect to any comments, the Commission notes that they are of the greatest assistance to this rulemaking initiative if accompanied by supporting data and analysis of the issues addressed in those comments and by alternatives to the Commission’s proposals where appropriate.
IV. Economic Analysis
A. Introduction
The Commission is mindful of the economic effects, including the costs and benefits, of: (1) proposed Rule 10; (2) Parts I and II of proposed Form SCIR; (3) the proposed amendments to Rules 17a–4, 17ad–7, and 18a–6; (4) the proposed amendments to existing orders that exempt certain clearing agencies from registering with the Commission; and (5) the proposed amendments to paragraph (d)(1) of Rule 3a71–6 to add proposed Rule 10 and Form SCIR to the list of Commission requirements eligible for a substituted compliance determination. Section 3(f) of the Exchange Act provides that when engaging in rulemaking that requires the Commission to consider or determine whether an action is necessary or appropriate in the public interest, to also consider, in addition to the protection of investors, whether the action will promote efficiency, competition, and capital formation.563
Section 23(a)(2) of the Exchange Act
also requires the Commission to consider the effect that the rules and rule amendments would have on competition, and it prohibits the Commission from adopting any rule that would impose a burden on competition not necessary or appropriate in furtherance of the Exchange Act.564 The analysis below addresses the likely economic effects of the proposed rule and form, the proposed rule amendments, and the proposed amendments to the exemptive orders, including the anticipated and estimated benefits and costs of these proposals and their likely effects on efficiency, competition, and capital formation. The Commission also discusses the potential economic effects of certain alternatives

565See section I.A. of this release (discussing cybersecurity risks and the use of information systems by Market Entities). 566 Id. The health sector is ranked first in term of the cyberattacks. 567 ‘‘The Council recommends that regulators and market participants continue to work together to improve the coverage, quality, and accessibility of financial data, as well as improve data sharing among relevant agencies.’’ FSOC 2021 Annual Report, at 16. 568See section IV.D. of this release (discussing these benefits and costs). 569 Jennifer Rose Hale, The Soaring Risks of Financial Services Cybercrime: By the Numbers, Diligent (Apr. 9, 2021), available at https:// www.diligent.com/insights/financial-services/ cybersecurity/#. 570See section II.F.1.b. of this release (discussing the Covered Entities that are subject to Regulation SCI). 571See section II.F.1.d. of this release (discussing the reporting requirements of Regulation SCI). 572See, e.g., Fergus Shiel and Ben Hallman, International Consortium of Investigative Journalists, Suspicious Activity Reports, Explained (Sept. 20, 2020), available at https://www.icij.org/ investigations/fincen-files/suspicious-activity￾reports-explained/ (stating that approximately 85% of SARs are filed by a few large banks to report money laundering). 573See 31 CFR 1023.320(b)(3). 574See 31 CFR 1023.320(a)(1), (b)(3). 575See 31 CFR 1023.320(d). to the approaches taken with respect to these proposals. As discussed above, Market Entities rely on information systems to perform functions that support the fair, orderly, and efficient operation of the U.S. securities markets.565 This exposes them and the U.S. securities markets to cybersecurity risk. According to the Bank for International Settlements, the financial sector has the second-largest share of COVID–19-related cybersecurity events between the end of February and June 2020.566 As is the case with other risks (e.g., market, credit, or liquidity risk), cybersecurity risk can be addressed through policies and procedures that are reasonably designed to manage the risk. A second means to address cybersecurity risk to the U.S. securities markets is through the Commission gathering and sharing information about significant cybersecurity incidents. This risk also can be addressed through greater transparency.567 For these reasons (and the reasons discussed throughout the release), the Commission is proposing Rule 10 and Form SCIR to require that Market Entities address cybersecurity risks, to improve the Commission’s ability to obtain information about significant cybersecurity incidents impacting Covered Entities and to require Covered Entities to disclose publicly summary descriptions of their cybersecurity risks and significant cybersecurity incidents (if applicable). It is important to note that the Market Entities serve different functions in the U.S. securities markets and are subject to different regulatory regimes. As a result, Market Entities today have varying
approaches to cybersecurity protections and would have different costs and benefits associated with complying with proposed Rule 10 and for Covered Entities to file Parts I and II of proposed Form SCIR. In addition, Market Entities may have different costs and benefits depending on the size and complexity of their businesses. For example, because Non-Covered Broker￾Dealers likely are materially smaller in size than Covered Entities, use fewer and less complex information systems, and have less data stored on information systems, the obligations of Non-Covered Broker-Dealers under proposed Rule 10 are more limited, and likely would have lower compliance costs. This could be the case even though Non-Covered Broker-Dealers may still need to invest in hardware and software, employ legal and compliance personnel, or contract with a third party. Furthermore, in addition to the direct benefits and costs realized by Market Entities, other market participants, such as investors and third-party service providers would realize indirect benefits and costs from the adoption of the proposed rule. The direct and indirect benefits and costs realized by each type of Market Entity and market participants are discussed below.568 Many of the benefits and costs discussed below are difficult to quantify. For example, the effectiveness of cybersecurity strengthening measures taken as a result of proposed Rule 10 depends on the extent to which they reduce the likelihood of a cybersecurity incident and on the expected cost of such an incident, including remediation costs in the event that a cybersecurity incident causes harm. As a result, the effectiveness of cybersecurity strengthening is subject to numerous assumptions and unknowns, and thus is difficult to quantify. Effectively, because cybersecurity infrastructure as well as policies and procedures help to prevent successful cybersecurity intrusions, the benefit of cybersecurity protection can be measured as the expected loss from a cybersecurity incident. In 2020, the average loss in the financial services industry was $18.3 million, per company per incident. The average cost of a financial services data breach was $5.85 million.569 Thus, those values would represent the benefit of avoiding a cybersecurity incident. The Commission has limited information on cybersecurity incidents impacting Market Entities. For example, as discussed above, certain Market Entities are SCI entities subject to the requirements of Regulation SCI. 570 SCI entities must report SCI events to the Commission on Form SCI, which could include cybersecurity incidents.571 However, only certain Market Entities are SCI entities and the reporting requirements of Regulation SCI are limited to SCI systems and indirect SCI systems, which are a subset of the information systems used by SCI entities. To the extent that a cybersecurity incident at a Market Entity that is also a SCI entity is an SCI event, the Market Entity would be required to file Form
SCI. However, only certain SCI events are also considered to be cybersecurity incidents. Consequently, the Commission currently has only partial knowledge of the cybersecurity incidents that occur at Market Entities. The Commission believes using the benefit and cost values related to SCI Entities as a basis to estimate the benefits and costs of the proposed rule for Covered Entities would be instructive but may be under inclusive. Similarly, the Commission has access to information contained in confidential anti-money laundering (AML) suspicious activity reports (‘‘SARs’’) that broker-dealers file with the Department of the Treasury’s Financial Crime Enforcement Network (‘‘FinCEN’’), which includes known or suspected cybersecurity incidents.572 However, the SARs filed by broker￾dealers with FinCEN do not necessarily include all of the details associated with an incident, such as whether the incident was confirmed, the extent of the impact, and how the breach was remediated. Furthermore, the SAR filing may not be timely, as a broker-dealer has up to 30 days to file the SAR if a suspect is identified, or up to 60 days if a suspect is not identified. Issues that require immediate attention—such as terrorist financing or ongoing money laundering schemes—must be reported to law enforcement.573 If reporting is not otherwise required by the Commission or an SRO, a broker-dealer ‘‘may also, but is not required to’’ contact the Commission.574 Broker-dealers must make the supporting documentation available to the Commission and registered SROs (as well as to FinCEN, law enforcement agencies, and Federal regulatory authorities that examine for Bank Secrecy Act compliance) upon request.575 The benefits and costs of filing SARs with FinCEN can serve as a basis to approximate the cost of filing
Part I of proposed Form SCIR. However,
the proposed rule would require a

576See Marc Dupuis and Karen Renaud, Scoping the Ethical Principles of Cybersecurity Fear Appeals, 23 Ethics and Info. Tech. 265 (2021), available at https://doi.org/10.1007/s10676-020- 09560-0. 577See National Law Review, Target Data Breach Price Tag: $252 Million and Counting (Feb. 26, 2015), available at https://www.natlawreview.com/
article/target-data-breach-price-tag-252-million￾and-counting.
578Timothy Guim, Cost of Cyber Attacks vs. Cost of Cyber Security in 2021, PCH Technologies (July 7, 2021), available at https://pchtechnologies.com/ cost-of-cyber-attacks-vs-cost-of-cyber-security-in￾2021/#:∼:text=1%20Large%20businesses %3A%20Between%20%242%20million%20 and%20%245,%24500%2C000%20or %20less%20spent%20on%20cybersecurity %20per%20year. 579RSI Security, What is the Average Cost of Penetration Testing?, RSI Security Blog (posted Mar. 5,2020), available at https:// blog.rsisecurity.com/what-is-the-average-cost-of￾penetration-testing/#:∼:text=Penetration%20 testing%20can%20cost%20anywhere,that%20of %20a%20large%20company. 580See RSI Security, What is the Average Cost of Penetration Testing?, RSI Security Blog (posted Mar. 5, 2020), available at https:// blog.rsisecurity.com/what-is-the-average-cost-of￾penetration-testing/ #:∼:text=Penetration%20testing%20can%20cost% 20anywhere,that%20of%20a%20 large%20company. 581See id. 582See IBM, Cost of a Data Breach Report (2019), available at https://www.ibm.com/downloads/cas/ RDEQK07R (‘‘2019 Cost of Data Breach Report’’). 583See RSI Security, What is the Average Cost of Penetration Testing?, RSI Security Blog (posted Mar. 5, 2020), available at https:// blog.rsisecurity.com/what-is-the-average-cost-of￾penetration-testing/#:∼:text=Penetration %20testing%20can%20cost%20anywhere,that %20of%20a%20large%20company. 584 Gary Glover, How Much Does a Pentest Cost?, Securitymetrics Blog (Nov. 15, 2022, 8:36 a.m.), available at https://www.securitymetrics.com/blog/ how-much-does-pentest-cost. 585Mitnick Security, What Should You Budget for a Penetration Test? The True Cost, Mitnick Security Blog, (posted Jan. 29, 2021, 5:13 a.m.), available at https://www.mitnicksecurity.com/blog/what￾should-you-budget-for-a-penetration-test-the-true￾cost. 586For example, security breach possibilities could increase because of the interconnection of Market Entities through their multi cloud providers. 587See Martijn Wessels, Puck van den Brink, Thijmen Verburgh, Beatrice Cadet, and Theo van Ruijven, Understanding Incentives for Cybersecurity Investments: Development and Application of a Typology, 1 Digit. Bus. 1–7 (Oct. 2021), available at https://doi.org/10.1016/j.digbus.2021.100014; Scott Dynes, Eric Goetz, and Michael Freeman, Cyber Continued quicker reporting timeline, more information to be provided, and multiple updates with regard to a given significant cybersecurity event. Thus, the costs related to complying with SAR filings serves as a floor for Covered Entities complying with the proposed rule. While the Commission has attempted to quantify economic effects where possible, some of the discussion of economic effects is qualitative in nature. The Commission seeks comment on all aspects of the economic analysis, especially any data or information that would enable the Commission to quantify the proposal’s economic effects more accurately. B. Broad Economic Considerations Market Entities generally have financial
incentives to maintain some level of cybersecurity protection because failure to safeguard their operations from attacks on their information systems and protect information about their customers, counterparties, members, registrants, or users as well as their funds and assets could lead to losses of funds, assets, and customer information, as well as damage the Market Entity’s reputation. As a result, Market Entities generally have an incentive to invest some amount of money to address cybersecurity risk. Market Entities’ reputational motives generally should encourage them to invest in measures to protect their information systems from cybersecurity risk.576 Moreover, the damage caused by a significant cybersecurity incident, including the associated remediation costs, may exceed that of implementing cybersecurity policies and procedures that may have prevented the incident and its harmful impacts. As a result, significant losses arising from a potential significant cybersecurity incident can encourage Market Entities to invest in cybersecurity protections today. However, such investments in cybersecurity protections may not be sufficient. The Investment Company Institute notes that the remediation costs of $252 million associated with the 2013 data breach experienced by Target Brands, Inc. (‘‘Target’’) far exceeded the cost of the cybersecurity insurance the company purchased ($90 million), resulting in an out-of-pocket loss for Target of $162 million.577 PCH Technologies states that in 2020, small companies (1–49 employees) lost an average of $24,000 per cybersecurity incident. That loss increased to $50,000 per incident for medium-sized companies (50–249 employees). Large companies (250–999 employees) and enterprise-level firms (1,000 employees or more) lost an average of $133,000 and $504,000 per cybersecurity incident, respectively.578 Having an annual penetration testing requirement can help Market Entities reduce the likelihood of costly data breaches. For instance, according to one industry source, RSI Security, a penetration test ‘‘can measure [the entity’s] system’s strengths and weaknesses in a controlled environment before [the entity has] to pay the cost of an extremely damaging data breach.’’ 579 For example, RSI Security explains that penetration testing ‘‘can cost anywhere from $4,000–$100,000,’’ and ‘‘[o]n average, a high quality, professional [penetration testing] can cost from $10,000–$30,000.’’ 580 RSI Security, however, was clear that the magnitudes of these costs can vary with size, complexity, scope, methodology, types, experience, and remediation measures.581 On the other hand, the same article cited IBM’s 2019 Cost of a Data Breach Study, which reported that the average cost of a data breach is $3.92 million with an average loss of 25,575 records,582 which would more than justify ‘‘the average $10,000–$30,000 bill from a professional, rigorous [penetration testing].’’ 583 Another source estimates a ‘‘high-quality,
professional [penetration testing to cost] between $15,000–$30,000,’’ while emphasizing that ‘‘cost varies quite a bit based on a set of variables.’’ 584 This is in line with a third source, which states that ‘‘[a] true penetration test will likely cost a minimum of $25,000.’’ 585 It is the Commission’s understanding that multi￾cloud architecture could introduce more complexity and accordingly, cybersecurity risks into Market Entities back-up systems, to the extent they have them.586 Large Market Entities that have economies of scale are able to implement cybersecurity policies and procedures in a more cost-effective manner. Smaller Market Entities, on the other hand, generally do not enjoy the same economies of scale or scope. The marginal cost for smaller Market Entities when implementing cybersecurity policies and procedures that are just as robust as those that would be needed by large Market Entities likely would be relatively high for smaller Market Entities. As a result, investment costs in cybersecurity protection at small broker￾dealers, for example, (most of which would be Non-Covered Broker-Dealers under proposed Rule 10) likely will account for a larger proportion of their revenue than at relatively large broker￾dealers (which likely would be Covered Entities that realize economies of scale). Having policies and procedures in place to address cybersecurity risk would benefit the customers, counterparties, members, registrants, or users with whom Market Entities interact. However, a cybersecurity budget likely is tempered, in part, such that the total sum spent to address cybersecurity risk provides some, but possibly not complete, protection against cyberattacks.587 Ultimately,

Security: Are Economic Incentives Adequate? (Intern. Conf. on Critical Infrastructure Protection, Conference Paper, 2007), available at https:// doi.org/10.1007/978-0-387-75462-8_2; Brent R. Rowe and Michael P. Gallaher, Private Sector Cyber Security Investment Strategies: An Empirical Analysis, The Fifth Workshop on the Economics of Information Security (Mar. 2006), available at http://www.infosecon.net/workshop/downloads/ 2006/pdf/18.pdf (‘‘Private Sector Cyber Security Investment Strategies Analysis’’); Nicole van der Meulen, RAND Europe, Investing in Cybersecurity (Aug. 2015), available at https://repository.wodc.nl/ bitstream/handle/20.500.12832/2173/2551-full￾text_tcm28-73946.pdf?sequence=4&isAllowed=y. 588See Derek Mohammed, Cybersecurity Compliance in the Financial Sector, J. Internet Banking and Com. (2015), available at https:// www.icommercecentral.com/open-access/ cybersecurity-compliance-in-the-financial￾sector.php?aid=50498. 589Low levels of investment in cybersecurity protection, which are different from underinvestment in cybersecurity protection, can be a function of a number of issues, such as firm budget, available solutions, knowledge of the threat actors’ capabilities, and the performance of in￾house or contracted information technology teams. 590See, e.g., Chuck Brooks, Alarming Cyber Statistics For Mid-Year 2022 That You Need To Know (June 3, 2022), available at https:// www.forbes.com/sites/chuckbrooks/2022/06/03/ alarming-cyber-statistics-for-mid-year-2022-that￾you-need-to-know/?sh=2429c57e7864. 591See Private Sector Cyber Security Investment Strategies Analysis. 592See Anil K. Kashyap and Anne Wetherilt, Some Principles for Regulating Cyber Risk, 109 Amer. Econ. Assoc. Papers and Proc. 482 (May 2019). 593See Scott Borg, Economically Complex Cyberattacks, IEEE Computer Society (2005), available at https://ieeexplore.ieee.org/stamp/ stamp.jsp?tp=&arnumber=1556539. 594National securities exchanges currently are subject to certain obligations under Regulation SCI. 595National securities exchanges may be required to meet certain regulatory obligations in such circumstances. 596See Electra Ferriello, Prof. Robert Shiller’s U.S. Crash Confidence Index, Yale School of Management, Intern. Ctr. for Fin. (Nov. 3, 2020), available at https://som.yale.edu/blog/prof-robert￾shillers-us-crash-confidence-index; Gregg E. Berman, Senior Advisor to the Director, Division of Trading and Markets, Commission, Speech by SEC Staff: Market Participants and the May 6 Flash Crash (Oct. 2010), available at https://www.sec.gov/ news/speech/2010/spch101310geb.htm. 597See Marsh, Underinvestment in Cyber Insurance Can Leave Organizations Vulnerable (2022), available at https://www.marsh.com/pr/en/ services/cyber-risk/insights/underinvestment-in￾cyber-insurance.html. 598 It has long been noted that it is difficult for governments to commit credibly to not providing support to entities that are seen as critical to the functioning of the financial system,
resulting in problems of moral hazard. See, e.g., Walter Bagehot, Lombard Street: A Description of the Money Market (Henry S. King & Co., 1873). Historically, banking entities seen as ‘‘too big to fail’’ or ‘‘too interconnected to fail’’ have been the principal recipients of such government support. Since the financial crisis of 2007–2009, non-bank financial institutions (such as investment banks), money market funds, and insurance companies, as well as specific markets such as the repurchase market have also benefited. See, e.g., Gary B. Gorton, Slapped by the Invisible Hand: The Panic of 2007, Oxford Univ. Press (2010); see also Viral V. Acharya, Deniz Anginer, and A. Joseph Warburton, The End of Market Discipline? Investor Expectations of Implicit Government Guarantees, those costs to address cybersecurity risks will be passed on, to the extent possible, to the persons with whom the Market Entities do business.588 The level of cybersecurity protection instituted by Market Entities may be inadequate from the perspective of overall economic efficiency.589 In other words, the chosen level of cybersecurity protection may, in fact, represent an underinvestment relative to the optimal level of cybersecurity protection that should be maintained by Market Entities from an overall economic perspective. Levels of cybersecurity protection that are not optimal may exacerbate the occurrence of harmful cybersecurity incidents. Cybersecurity events have grown in both number and sophistication.590 These developments in the market have significantly increased the negative externalities that may flow from systems failures. Underinvestment in cybersecurity may occur because a Market Entity is aware that it would not bear the full cost of a cybersecurity incident (i.e., some negative externalities may be borne by its customers, counterparties, members, registrants, or users). As a result, the Market Entity does not have to internalize the complete cost of cybersecurity protection when deciding upon its level of investment. This underinvestment by the Market Entity is considered to be a moral hazard problem, because other market participants are harmed by a significant cybersecurity incident and are forced to bear those costs that spill over to them. At the same time, even though Market Entities may not bear the full cost of a cybersecurity failure (e.g., loss of the personal information or the assets of their customers, members, registrants, or users), they likely would incur some costs themselves and therefore have incentives to avoid cybersecurity failures. These incentives could cause them to implement policies and procedures to address cybersecurity risk, which would likely result in benefits that accrue in large part to their customers, counterparties, members, registrants, or users. Market Entities could do this in order to avoid the harms that could be caused by a significant cybersecurity incident (e.g., loss of funds, assets, or personal, confidential,
or proprietary information; damage to or the holding hostage of their information systems; or reputational damage). As a result, Market Entities have a potential incentive to rely overly on reactive solutions to cybersecurity threats and attacks instead of proactive ones.591

1. In the context of cybersecurity,
   negative externalities arising from the moral hazard problem can have significant negative repercussions on the financial system more broadly, particularly due to the interconnectedness of Market Entities.592 Borg notes that the level of interconnectedness and complexity can have an influence on the degree of damage that cybersecurity incidents impose on Market Entities as well as their customers, counterparties, members, registrants, and users.593 As for the availability of substitutes the negative effect of a cybersecurity incident could be lessened to the extent that there is one or more competing firms that can complete the task, such as another broker-dealer or national securities exchange. On the flip side, significant cybersecurity incidents may be the most damaging when there are no substitutes available to execute the required task. In addition to other firms being negatively affected by a cybersecurity incident, investors can be negatively affected. For example, a significant cybersecurity incident at a national securities exchange could affect its ability to execute trades, causing orders to go unfilled. Depending on how long it takes the national securities exchange to resolve the issue, the prices of securities traded on the exchange may be different from when the orders were originally placed.594 A loss of confidence in an exchange due to a cybersecurity incident could result in a longer-term reallocation of trading volume to competing exchanges or other trading venues.595 A significant cybersecurity incident could produce negative effects that spill over and affect market participants outside of the national securities exchange itself. It also may adversely affect market confidence, and curtail economic activity through a reduction in securities trading among market participants.596 While the negative externalities that arise from the moral hazard problem are usually depicted as being absorbed by other market participants, the losses to other parties may be potentially covered in part or in full by insurance policies.597 An even stronger incentive to underinvest is the possibility that an outside party can make whole or at least mitigate some of the losses incurred by the various market participants. Market Entities may underinvest in their cybersecurity measures due to the moral hazard that results from expectations of government support.598 Most threat

SSRN Scholarly Paper, Rochester, NY: Social Science Research Network (May 1, 2016). 599 ‘‘Advanced persistent threat’’ refers to sophisticated cyberattacks by hostile organizations with the goal of: gaining access to defense, financial, and other targeted information from governments, corporations and individuals; maintaining a foothold in these environments to enable future use and control; and modifying data to disrupt performance in their targets. See Michael K. Daly, The Advanced Persistent Threat (or Informationized Force Operations), Raytheon (Nov. 4, 2009), available at https://www.usenix.org/ legacy/event/lisa09/tech/slides/daly.pdf. 600See Nikos Virvilis and Dimitris Gritzalis, The Big Four—What We Did Wrong in Advanced Persistent Threat Detection?, 2013 Int’l Conf. on Availability, Reliability and Security 248 (2013). 601See Lawrence A. Gordon, Martin P. Loeb, and William Lucyshyn, Cybersecurity Investments in the Private Sector: The Role of Governments, 15 Geo. J. Int’l Aff. 79 (2014). 602See Sanford J. Grossman, The Informational Role of Warranties and Private Disclosure about Product Quality, 24 J. L. Econ. 461 (Dec. 1981); see also Michael Spence, Competitive and Optimal Responses to Signals: An Analysis of Efficiency and Distribution, 7 J. Econ. Theory 296 (Mar. 1, 1974); George. A. Akerlof, The Market for ‘‘Lemons’’:
Quality Uncertainty and the Market Mechanism, 84 Q. J. Econ. 488 (Aug. 1970). 603See Michael C. Jensen and William H. Meckling, Theory of the Firm: Managerial Behavior, Agency Costs and Ownership Structure, 3 J. Fin. Econ. 305 (1976). 604 Id. 605Such limitations can arise from un￾observability or un-verifiability of actions, transactions costs associated with including numerous contingencies in contracts, or bounded rationality in the design of contracts. See, e.g., Jean Tirole, Cognition and Incomplete Contracts, 99 a.m. Econ. Rev. 265 (Mar. 2009) (discussing a relatively modern treatment of these issues). 606For example, according to an IBM report, in the context of system issues arising from cybersecurity events, having an incident response plan and ‘‘testing that plan regularly can help [each firm] proactively identify weaknesses in [its] cybersecurity and shore up [its] defenses’’ and ‘‘save millions in data breach costs.’’ See 2019 Cost of Data Breach Report; see also Alex Asen et al., Are You Spending Enough on Cybersecurity (Feb. 19, 2020), available at https://www.bcg.com/ publications/2019/are-you-spending-enough￾cybersecurity (noting ‘‘[a]s the world becomes ever more reliant on technology, and as cybercriminals refine and intensify their attacks, organizations will need to spend more on cybersecurity’’). 607See sections I.A.1. and I.A.2. of this release (discussing how the interconnectedness of Market Entities creates cybersecurity risk). 608See Peter W. Singer and Allan Friedman, Cybersecurity: What Everyone Needs to Know 222 (Oxford Univ. Press, 2014). 609See, e.g., FTC Equifax Civil Action. actors primarily have a monetary incentive, and there is a large monetary incentive to breach cybersecurity protections in the financial sector. As a result, Covered Entities—such as clearing agencies, large national securities exchanges, and large carrying broker-dealers—may be attractive targets to sophisticated threat actors aiming to compromise or disrupt the U.S. financial system because of the services they perform to support the functioning of the U.S. securities markets; the protection of confidential, proprietary, or personal information they store; or the financial assets they hold. Protection against ‘‘advanced persistent threats’’ 599 from sophisticated threat actors, whatever their motives, is costly.600 The belief—no matter how misplaced—that a widespread and crippling cybersecurity attack would be met with government support, such as direct payments for recovery and immediate cybersecurity investments, could lead to moral hazard where certain Covered Entities underinvest in defenses aimed at countering that threat.601 Suboptimal spending on cybersecurity also can be the result of asymmetric information among Market Entities and market participants. A Market Entity may not know what its optimal cybersecurity expenditures should be because the nature and scope of future attacks are unknown. In addition, a Market Entity may not know
what its competitors do in terms of cybersecurity planning, whether they have been subject to unsuccessful cyberattacks, or have been a victim of one or more significant cybersecurity incidents. Market Entities also may not be able to signal credibly to their customers, counterparties, members, registrants, or users that they are better at addressing cybersecurity risks than their peers, thus reducing their incentive to bear such cybersecurity investment costs.602 Lastly, Market Entities’ customers, counterparties, members, registrants, or users typically do not have information about the Market Entities’ cybersecurity spending, the efficacy of the cybersecurity investments made, or their policies and procedures. Therefore, those market participants cannot make judgments about Market Entities’ cybersecurity preparedness. Because of this information asymmetry, Market Entities may not have as strong of an incentive to have robust cybersecurity measures compared to a scenario in which customers, counterparties, members, registrants, or users had perfect information about the Market Entities’ cybersecurity practices and the risks that they face. Underinvestment in cybersecurity also may stem from the principal-agent problem of divergent goals in economic theory. The relationship between a Market Entity (i.e., the agent) and the principals (i.e., its customers, counterparties, members, registrants, or users) can be affected if the principal relies on the agent to perform services on the principal’s behalf.603 Because principals and their agents may not have perfectly aligned preferences and goals, agents may take actions that increase their well-being at the expense of principals, thereby imposing ‘‘agency costs’’ on the principals.604 Although private contracts between principals and agents may aim to minimize such costs, they are limited in their ability to do so in that agents can decide not enter into such agreements and ultimately not provide the particular services to the principals. Furthermore, agents can charge much higher fees that the principals choose not to bear. These limitations provides one rationale for regulatory intervention.605 Market-based incentives alone are unlikely to result in optimal provision of cybersecurity protection. In this context, having plans and procedures in place to prepare for and respond to cybersecurity incidents,606 and the rule would help ensure that the infrastructure of the U.S. securities markets remains robust, resilient, and secure. A well-functioning financial system is a public good. Beyond reputational damage to the affected agent (Market Entity), the principals (the Market Entity’s customers, counterparties, members, registrants, or users) can be negatively affected by a cybersecurity breach as a result of loss in personal information and/or funds and assets. Thus the principals and the agents may have different reasons for needing cybersecurity protocols. Furthermore, the negative effects of a
cybersecurity incident also can spread among Market Entities due to their interconnectedness.607 Those other Market Entities prefer that the principals employ strong cybersecurity practices that reduce the chances of a successful breach and its negative cascading effects throughout the financial sector. All of the preceding negative externalities are arguments for proposed Rule 10. In the production of cybersecurity defenses and controls, the main input is information. In particular, information about prior attacks and their degree of success, as well as prior human errors and their degree of harm, is valuable in mounting effective countermeasures and controls.608 However, Market Entities may be naturally reluctant to share such information, as doing so could assist future attackers as well as lead to loss of customers, reputational harm, litigation, or regulatory scrutiny, which would be costs associated with public disclosure.609 On the other hand, disclosure of such information creates a positive information externality—the benefits of which accrue to society at large and are not fully captured by the Market Entity making the disclosure.