Operational Resilience Framework for Futures Commission Merchants, Swap Dealers, and Major Swap Participants, 4706-4768 [2023-28745]
Download as PDF
<![CDATA[
4706
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
COMMODITY FUTURES TRADING
COMMISSION
17 CFR Parts 1 and 23
RIN 3038–AF23
Operational Resilience Framework for
Futures Commission Merchants, Swap
Dealers, and Major Swap Participants
Commodity Futures Trading
Commission.
ACTION: Notice of proposed rulemaking.
AGENCY:
The Commodity Futures
Trading Commission (CFTC or
Commission) is proposing to require
that futures commission merchants,
swap dealers, and major swap
participants establish, document,
implement, and maintain an
Operational Resilience Framework
reasonably designed to identify,
monitor, manage, and assess risks
relating to information and technology
security, third-party relationships, and
emergencies or other significant
disruptions to normal business
operations. The framework would
include three components—an
information and technology security
program, a third-party relationship
program, and a business continuity and
disaster recovery plan—supported by
broad requirements relating to
governance, training, testing, and
recordkeeping. The proposed rule
would also require certain notifications
to the Commission and customers or
counterparties. The Commission is
further proposing guidance relating to
the management of risks stemming from
third-party relationships.
DATES: Comments must be received on
or before March 2, 2024.
ADDRESSES: You may submit comments,
identified by RIN number 3038–AF23,
by any of the following methods:
• CFTC Comments Portal: https://
comments.cftc.gov. Select the ‘‘Submit
Comments’’ link for this rulemaking and
follow the instructions on the Public
Comment Form.
• Mail: Christopher Kirkpatrick,
Secretary of the Commission,
Commodity Futures Trading
Commission, Three Lafayette Centre,
1155 21st Street NW, Washington, DC
20581.
• Hand Delivery/Courier: Follow the
same instructions as for Mail, above.
Please submit your comments using
only one of these methods. Submissions
through the CFTC Comments Portal are
encouraged.
All comments must be submitted in
English, or if not, accompanied by an
English translation. Comments will be
ddrumheller on DSK120RN23PROD with PROPOSALS2
SUMMARY:
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
posted as received to https://comments.
cftc.gov. You should submit only
information that you wish to make
available publicly. If you wish the
Commission to consider information
that you believe is exempt from
disclosure under the Freedom of
Information Act (FOIA), a petition for
confidential treatment of the exempt
information may be submitted according
to the procedures established in
Commission regulation 145.9.1
The Commission reserves the right,
but shall have no obligation, to review,
pre-screen, filter, redact, refuse or
remove any or all of your submission
from https://comments.cftc.gov that it
may deem to be inappropriate for
publication, such as obscene language.
All submissions that have been redacted
or removed that contain comments on
the merits of the rulemaking will be
retained in the public comment file and
will be considered as required under the
Administrative Procedure Act and other
applicable laws, and may be accessible
under the FOIA.
FOR FURTHER INFORMATION CONTACT:
Amanda L. Olear, Director, at 202–418–
5283 or aolear@cftc.gov; Pamela
Geraghty, Deputy Director, at 202–418–
5634 or pgeraghty@cftc.gov; Fern
Simmons, Associate Director, at 202–
418–5901 or fsimmons@cftc.gov; Elise
Bruntel, Special Counsel, at 202–418–
5577 or ebruntel@cftc.gov; Market
Participants Division, Commodity
Futures Trading Commission, Three
Lafayette Centre, 1151 21st Street NW,
Washington, DC 20581.
SUPPLEMENTARY INFORMATION:
Table of Contents
I. Introduction
II. Proposal
A. Generally—Proposed Paragraph (b)
1. Purpose and Scope; Components—
Proposed Paragraphs (b)(1) and (b)(2)
2. Standard—Proposed Paragraph (b)(3)
3. Request for Comment
B. Governance—Proposed Paragraph (c)
1. Approval of Components—Proposed
Paragraph (c)(1)
2. Risk Appetite and Risk Tolerance
Limits—Proposed Paragraph (c)(2)
3. Internal Escalations—Proposed
Paragraph (c)(3)
4. Consolidated Program or Plan—
Proposed Paragraph (c)(4)
5. Request for Comment
C. Information and Technology Security
Program—Proposed Paragraph (d)
1. Risk Assessment—Proposed Paragraph
(d)(1)
2. Effective Controls—Proposed Paragraph
(d)(2)
3. Incident Response Plan—Proposed
Paragraph (d)(3)
1 17 CFR 145.9. The Commission’s regulations are
found at 17 CFR chapter I (2022).
PO 00000
Frm 00002
Fmt 4701
Sfmt 4702
4. Request for Comment
D. Third-Party Relationship Program—
Proposed Paragraph (e)
1. Third-Party Relationship Lifecyle
Stages—Proposed Paragraph (e)(1)
2. Heightened Requirements for Critical
Third-Party Service Providers—Proposed
Paragraph (e)(2)
3. Third-Party Service Provider
Inventory—Proposed Paragraph (e)(3)
4. Retention of Responsibility—Proposed
Paragraph (e)(3)
5. Application to Existing Third-Party
Relationships
6. Guidance on Third-Party Relationship
Programs—Proposed Paragraph (e)(4);
Appendix A to Part 1; Appendix A to
Subpart J of Part 23
7. Request for Comment
E. Business Continuity and Disaster
Recovery Plan—Proposed Paragraph (f)
1. Definition of ‘‘Business Continuity and
Disaster Recovery Plan’’
2. Purpose—Proposed Paragraph (f)(1)
3. Minimum Contents—Proposed
Paragraph (f)(2)
4. Accessibility—Proposed Paragraph (f)(3)
5. Request for Comment
F. Training and Distribution—Proposed
Paragraph (g)
G. Review and Testing—Proposed
Paragraph (h)
1. Reviews—Proposed Paragraph (h)(1)
2. Testing—Proposed Paragraph (h)(2)
3. Independence—Proposed Paragraph
(h)(3)
4. Documentation—Proposed Paragraph
(h)(4)
5. Internal Reporting—Proposed Paragraph
(h)(5)
6. Request for Comment
H. Required Notifications—Proposed
Paragraphs (i) and (j)
1. Commission Notification of Incidents—
Proposed Paragraph (i)(1)
2. Commission Notification of BCDR Plan
Activation—Proposed Paragraph (i)(2)
3. Notifications to Customers or
Counterparties—Proposed Paragraph (j)
4. Request for Comment
I. Amendment and Expansion of Other
Provisions in Current Commission
Regulation 23.603
1. Emergency Contacts—Proposed
Paragraph (k)
2. Recordkeeping—Proposed Paragraph (l)
3. Request for Comment
J. Cross-Border Application for Swap
Entities
K. Implementation Period
III. Related Matters
A. Regulatory Flexibility Act
B. Paperwork Reduction Act
C. Cost-Benefit Considerations
D. Antitrust Laws
I. Introduction
In 2012 and 2013, the Commission
adopted rules requiring that futures
commission merchants (FCMs),2 swap
dealers (SDs) 3 and major swap
2 See 7 U.S.C. 1a(28), 17 CFR 1.3 (defining
‘‘futures commission merchant’’).
3 See 7 U.S.C. 1a(49), 17 CFR 1.3 (defining ‘‘swap
dealer’’).
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
participants (MSPs) 4 establish risk
management programs (RMPs).5 The
rules require that SDs and MSPs
(together, swap entities) and FCMs
design their RMPs to monitor and
manage the risks associated with their
activities as swap entities or FCMs.6
Such risks include, but are not limited
to, market, credit, liquidity, segregation,
settlement, capital, and operational
risk.7 Taken together, the RMP rules
support a unified Commission objective:
to require FCMs and swap entities
(collectively, covered entities) to
establish comprehensive risk
management practices to mitigate
systemic risk and promote customer
protection.8 Recognizing that covered
entities vary in size and complexity, the
RMP rules identify certain elements that
must, at a minimum, be included as part
of the RMP, and require that certain
risks must be taken into account; but the
rules otherwise allow covered entities
flexibility to design RMPs tailored to
their circumstances and organizational
structures.9
In the decade since the RMP rules
were adopted, covered entities have
encountered a wide variety of
challenging conditions, including
Brexit, the LIBOR transition, the
COVID–19 pandemic stress period, the
invasion of Ukraine, and general interest
rate increases to tame inflation.
Throughout this period, the
Commission has, through its various
oversight activities, observed that
adherence to its RMP rules has
supported covered entities’ ability to
withstand and recover from market
challenges. The Commission therefore
believes the RMP rules have helped
establish a solid foundation of risk
management among covered entities
4 See 7 U.S.C. 1a(33), 17 CFR 1.3 (defining ‘‘major
swap participant’’).’’
5 See 17 CFR 1.11; 17 CFR 23.600; Enhancing
Protections Afforded Customers and Customer
Funds Held by Futures Commission Merchants and
Derivatives Clearing Organizations, 78 FR 68506
(Nov. 14, 2013) (Final FCM RMP Rule); Swap
Dealer and Major Swap Participant Recordkeeping,
Reporting, and Duties Rules; Futures Commission
Merchant and Introducing Broker Conflicts of
Interest Rules; and Chief Compliance Officer Rules
for Swap Dealers, Major Swap Participants, and
Futures Commission Merchants, 77 FR 20128 (Apr.
3, 2012) (Final Swap Entities RMP Rule).
6 See 17 CFR 1.11(c); 17 CFR 23.600(b). The RMP
rule for FCMs does not apply to FCMs that do not
accept or hold customer assets. See 17 CFR 1.11(a).
7 See 17 CFR 1.11(e); 17 CFR 23.600(c).
8 See Final Swap Entities RMP Rule, 77 FR at
20128; Final FCM RMP Rule, 78 FR 68506.
9 See, e.g., Regulations Establishing and
Governing the Duties of Swap Dealers and Major
Swap Participants, 75 FR 71397, 71399 (Nov. 23,
2010) (Proposed Swap Entities RMP Rule) (‘‘The
Commission’s rule has been designed such that the
specific elements of a risk management program
will vary depending on the size and complexity of
a [swap entity’s] business operations.’’).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
across various risk types, promoting a
solid baseline standard of risk
management that reduces overall
systemic risk and enhances the
Commission’s customer protections.
Nevertheless, the Commission
believes it has identified opportunities
to adapt its regulations to further
promote sound risk management
practices, reduce risk to the U.S.
financial system, and protect
commodity interest customers and
counterparties.10 Specifically, as it
relates to this proposal, the Commission
believes that recent events, noted below,
have highlighted the need for more
particularized risk management
requirements for covered entities
designed to promote operational
resilience. An outcome of the effective
management of operational risk,
‘‘operational resilience’’ can be broadly
defined as the ability of a firm to detect,
resist, adapt to, respond to, and recover
from operational disruptions.11 As the
use of technology and associated thirdparty service providers have expanded
within the financial sector, so too have
the sources of operational risk facing
covered entities, notably the potential
for technological failures and
cyberattacks.12 The Commission
10 The Commission recently solicited public
comment on an advanced notice of proposed
rulemaking regarding potential amendments to the
RMP requirements. See Risk Management Program
Regulations for Swap Dealers, Major Swap
Participants, and Futures Commission Merchants,
88 FR 45826 (Jul. 18, 2023) (RMP ANPRM). The
comment file is available at https://comments.cftc.
gov/PublicComments/CommentList.aspx?id=7412.
11 See Proposed Swap Entities RMP Rule, 75 FR
71399, n.12 (defining ‘‘operational risk’’ as
including ‘‘the risk of loss due to deficiencies in
information systems, internal processes and
staffing, or disruptions from external events that
result in the reduction, deterioration, or breakdown
in services or controls within the firm.’’). Several
sources have produced definitions of ‘‘operational
resilience’’ relevant to the financial sector. See e.g.,
Board of Governors of the Federal Reserve System
(FRB), the Office of the Comptroller of the Currency
(OCC), and the Federal Deposit Insurance
Corporation (FDIC) (together, the prudential
regulators), Sound Practices to Strengthen
Operational Resilience at 2 (Oct. 30, 2020)
(Prudential Operational Resilience Paper) (defining
‘‘operational resilience’’ as the ‘‘ability to deliver
operations, including critical operations and core
business lines, through a disruption from any
hazard.’’); Basel Committee on Banking Supervision
(BCBS), Principles for Operational Resilience at 2,
3 (Mar. 31, 2021) (BCBS Operational Resilience
Principles) (‘‘ability of a bank to deliver critical
operations through disruption’’); National Institute
of Standards and Technology (NIST), Developing
Cyber-Resilient Systems: A Systems Security
Engineering Approach, SP 800–160, Vol. 2, Rev. 1
at 76 (Dec. 2021) (‘‘ability of systems to resist,
absorb, and recover from or adapt to an adverse
occurrence during operation that may cause harm,
destruction, or loss of ability to perform missionrelated functions.’’). Core to each of these
definitions is the notion of being able to continue
to operate or perform despite a disruption.
12 See Jason Harrell, Depository Trust & Clearing
Corporation (DTCC) Managing Director, Head of
PO 00000
Frm 00003
Fmt 4701
Sfmt 4702
4707
preliminarily believes that requirements
for covered entities directed at
promoting sound practices for managing
these risks, as well as the risk of other
potential physical disruptions to
operations (e.g., power outages, natural
disasters, pandemics), and for mitigating
their potential impact would not only
strengthen individual covered entity
operational resilience but would reduce
risk to the U.S. financial system as a
whole and help protect derivatives
customers and counterparties.13
The importance of operational
resilience in the financial industry has
come into stark relief in the past few
years, particularly following the
COVID–19 pandemic. At the start of the
pandemic, Commission staff initiated
near daily in-depth discussions with
covered entities as those registrants
navigated the myriad challenges
presented during that time. Through a
combination of sustained intensive
effort on the part of the covered entities,
and targeted no-action positions and
exemptive relief provided by
Commission staff, covered entities
generally continued to operate without
material disruption to their CFTCregulated activities. As a result of this
unprecedented experience, the
Commission considered whether there
were additional opportunities for it to
act to gain ongoing transparency into,
and to provide further regulatory
support to, covered entities’ operational
resilience practices outside of an
unfolding crisis. Commission staff then
began the work of assessing the current
operational resilience landscape for
covered entities and determining how
the Commission could act to further the
holistic consideration and adoption of
operational resilience practices amongst
covered entities to ensure that certain
External Engagements, ‘‘Operational and
Technology Risk, Evolving Cybersecurity Risks in a
Digitalized Era’’ (Sept. 20, 2023) (‘‘While
partnerships with third parties offer rapid solutions
for institutions to access the latest technologies and
capabilities, they also increase the surface area for
potential threat actors to gain access to an
institution, causing cyber incidents that can impact
the institution’s operations and potentially create
additional sector impacts.’’).
13 Responding to the RMP ANPRM, several
commenters suggested the Commission consider
addressing cybersecurity risk independently. See
Americans for Financial Reform Education Fund
(AFREF) and Public Citizen Letter at 6 (Sept. 18,
2023) (AFREF&PC Letter); Better Markets Letter Re:
Risk Management Program Regulations for Swap
Dealers, Major Swap Participants, and Futures
Commission Merchants (RIN 3038–AE59) at 6–9
(Sept. 18, 2023) (Better Markets Letter); R.J. O’Brien
& Associates LLC Letter at 5–6 (Sept. 18, 2023) (R.J.
O’Brien Letter). AFRF and Public Citizen also
recommended that the Commission consider
extending its risk management regulations to
encompass third-party service providers for
information technology services. See AFREF&PC
Letter at 2.
E:\FR\FM\24JAP2.SGM
24JAP2
4708
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
operational risks impacting their CFTCregulated activities were being
addressed on an ongoing basis.
In particular, one area of increased
focus is cyber risk. In 2022, cyber
intelligence firms reported that the
financial sector was among the most
impacted by malicious emails, and was
ultimately the most breached over the
course of the year, with more than 566
successful attacks resulting in 254
million leaked records by early
December 2022.14 For the past two
years, financial institutions responding
to a DTCC risk survey have identified
cyber risk as one of the top five risks to
global financial markets, highlighting
the increased sophistication of cyber
criminals and the industry’s growing
digital footprint as key drivers.15 Given
that remote access and cloud computing
may become permanent features of the
financial markets, the need for financial
institutions to strengthen, adapt, and
prioritize their information and
technology risk practices would seem
critical to preserving the continued
integrity and stability of U.S. financial
markets.16
Covered entities have experienced
firsthand how breaches of information
and technology security can reduce
their ability to protect customers. In
2016, for instance, a hacker was able to
access customer records held on an
FCM’s backup storage device after a
default configuration of that device left
14 See Trellix, The Threat Report Fall 2022 at 11
(Nov. 2022) (noting that the financial services sector
was the most targeted by malicious emails in Q3 of
2022); Flashpoint, Flashpoint Year In Review: 2022
Financial Threat Landscape (Dec. 20, 2022) (citing
finance and insurance as the most-breached sector
in 2022).
15 See DTCC, Systemic Risk Barometer Survey:
2023 Risk Forecast (Dec. 7, 2022); DTCC, Systemic
Risk Barometer Survey: 2022 Risk Forecast (Dec. 13,
2021) (naming cyber risk as the top risk to the
economy). See also Bank for International
Settlements (BIS), Financial Stability Institute (FSI),
FSI Insights on policy implementation No. 50,
Banks’ cyber security—a second generation of
regulatory approaches (June 12, 2023) (FSI
Cybersecurity Paper) (citing a 2023 report that most
chief risk officers consider cyber risk the top threat
to the banking industry and the most likely to result
in a crisis or major operational disruption); Federal
Bureau of Investigation, internet Crime Complaint
Center Releases 2022 Statistics (Mar. 22, 2023)
(‘‘Cyber-enabled crime has been around for many
years, but methods used by perpetrators continue to
increase in scope and sophistication emanating
from around the world.’’).
16 See FRB, Cybersecurity and Financial System
Resilience Report at 15 (Aug. 2023) (‘‘The rising
number of advanced persistent threats increases the
potential for malicious cyber activity within the
financial sector. Combined with the increased
internet-based interconnectedness between
financial institutions and the increasing
dependence on third-party service providers, these
threats may result in incidents that affect one or
more participants in the financial services sector
simultaneously and have potentially systemic
consequences.’’).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
it open to infiltration via the internet.17
In 2018, a successful phishing attack on
an FCM compromised customer
information and resulted in the FCM’s
acceptance of a fraudulent wire request
that took $1 million in funds from a
customer’s account.18 Other regulators
have also taken action against banks
registered as swap entities where failed
controls and third-party service
providers intersected to result in the
significant exposure of customer
information.19 Even more recently, a
ransomware attack on a U.S. brokerdealer in November 2023 was so
significant, news reports indicate that
the brokerage required a capital
injection from a parent entity to settle
$9 billion in trades, an amount many
times larger than its net capital.20
Against the backdrop of that work, a
recent and well-documented incident
serves as an important cautionary tale
about the potential systemic impact of
an operational event at a third-party
service provider. On January 30, 2023,
a ransomware attack on ION Markets, a
division of UK-based third-party service
provider ION Group LLC (ION), resulted
in a two-week disruption in mid-office
activities at several FCMs. ION provides
order management, execution, trading,
and trade processing services for several
FCMs, including about 20 percent of
clearing members at the Chicago
Mercantile Exchange (CME), but also
provides software services to many
other financial institutions, notably
many systemically important banks.21
17 See In re AMP Global Clearing LLC, CFTC
Docket No. 18–10 (Feb. 12, 2018).
18 See In re Phillip Capital Inc., CFTC Docket No.
19–22 (Sept. 12, 2019).
19 See, e.g., In re Capital One, N.A. and Capital
One Bank (USA), N.A., AA–EC–20–49 (Aug. 5,
2020) (OCC finding that failed risk management
practices resulted in exposure of 100 million
individual credit card applications, including
approximately 140,000 social security numbers, by
a former cloud servicer employee); In re Morgan
Stanley Smith Barney LLC, File No. 3–17280 (Jun.
8, 2016) (Securities and Exchange Commission
(SEC) finding that failed risk management controls
allowed an employee to impermissibly access and
transfer data regarding 730,000 accounts to a
personal server, which was ultimately hacked by
third parties).
20 See Paritosh Bansal, Reuters, ‘‘Inside Wall
Street’s scramble after ICBC hack’’ (Nov. 13, 2023)
(reporting that the firm asked clients to temporarily
suspend business with them and clear trades
elsewhere).
21 See Luke Clancy, Risk.net, ‘‘One-fifth of CME
clearing members hit by Ion hack’’ (Mar. 9, 2023);
see also Statement of Todd Conklin, Deputy
Assistant Secretary, Department of the Treasury
(Treasury), Office of Cybersecurity and Critical
Infrastructure Protection (OCCIP), The Cyber Threat
Landscape for Financial Markets: Lessons Learned
from ION Markets, Cloud Use in Financial Services,
and Beyond, CFTC Technology Advisory
Committee Meeting Transcript at 160–166 (Mar. 22,
2023) (Conklin TAC Presentation) (describing the
potential ‘‘sprawling impact zone’’ had the ION
PO 00000
Frm 00004
Fmt 4701
Sfmt 4702
FCMs affected by the attack had to
process trades manually, leading to
delays in the timely and accurate
reporting of trade data to the CFTC, and
consequently a temporary lag in
production of the Commission’s weekly
Commitments of Traders report.22 The
incident was initially so concerning that
Japan cut off all connectivity with
ION.23 Within a couple days of the
attack, however, regulators, including
the CFTC, coordinated efforts to
determine that the attack was limited to
a small number of software applications
relied on within the cleared derivatives
space by about forty-two (42)
institutions, with no significant impact
to systemically important banks.24
During a March 8, 2023, meeting of
the CFTC’s Market Risk Advisory
Committee (MRAC), panelists discussed
how the collaborative work of the CFTC,
industry, and self-regulatory
organizations (including CME, the
National Futures Association (NFA),
and the Financial Industry Regulatory
Authority (FINRA)) helped mitigate the
impact of the ION incident, allowing
affected firms to return to business as
usual within a couple weeks.25
Nevertheless, panelists agreed that the
incident highlighted the
interconnectedness of the derivatives
markets and the need for firms to
continue to adapt safeguards to address
the ever-evolving threat landscape.26 As
the ION incident demonstrates, a
incident not been limited to its derivatives software
services), available at https://www.cftc.gov/sites/
default/files/2023/07/1688400024/tac_032223_
transcript.pdf.
22 CFTC, Statement on ION and the Impact to the
Derivatives Markets (Feb. 2, 2023), available at
https://www.cftc.gov/PressRoom/Speeches
Testimony/cftcstatement020223. The Commitment
of Traders report is widely relied on by market
participants for insight into positions held on
exchange-traded futures and options.
23 See Conklin TAC Presentation (Mar. 22, 2023).
24 Id.
25 See CFTC, The Market Risk Advisory
Committee to Meet on March 8 (Mar. 8, 2023)
(MRAC Meeting), available at https://www.cftc.gov/
PressRoom/Events/opaeventmrac030823; see also
Conklin TAC Presentation (discussing how
Treasury implemented its cyber incident response
playbook in the days following the ION incident to
mitigate the potential for panic after news reports
began circulating information that the incident was
more significant than regulators had initially
determined it was).
26 See Statement of Walt Lukken, President and
Chief Executive Officer, Futures Industry
Association (FIA), MRAC Meeting Transcript at 41
(‘‘While the number of clearing firms that use ION’s
suite of clearing products is limited, the
interconnectedness of our markets made the outage
impactful throughout the entirety of our
marketplace.’’); see also Statement of Tom W.
Sexton, III, President and Chief Executive Officer,
NFA, MRAC Meeting Transcript at 46 (‘‘[O]ur
member firms have adopted robust safeguards
already that need to be adapted in light of today’s
and tomorrow’s ongoing challenges and threats.’’).
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
disruptive cyber event can reach beyond
particular financial institutions directly
experiencing events to other institutions
in the financial markets or to others
doing business with an impacted
financial institution, and could
potentially impact financial stability.27
In light of these and other events, the
Commission believes that customer
protection and the broader stability of
the derivatives markets at large warrant
more targeted CFTC requirements
relating to the management of
operational risk designed to promote
operational resilience.28 Specifically,
the Commission believes that the
absence of CFTC-specific requirements
for covered entities that explicitly
address information and technology
security, as well as third-party risk,
could impede the Commission’s ability
to fulfill its regulatory oversight
obligations with respect to covered
entities and ultimately weaken its
ability to address systemic risk, protect
customer assets, and promote
responsible innovation.29 The
Commission further believes that
enhanced CFTC oversight of covered
entities with respect to operational
resilience would help improve
27 See FIA, FIA Taskforce on Cyber Risk, After
Action Report and Findings at 3 (Sept. 2023) (FIA
Taskforce Report) (‘‘The [ION incident]
demonstrated that an outage at a single service
provider can have damaging effects across a wide
range of firms and threaten the orderly functioning
of markets. The attack also demonstrated in vivid
detail the complexities of restoring normal
service.’’).
28 Existing CFTC requirements for covered
entities relating to operational risk or information
security are more general in nature or limited in
application. See, e.g., 17 CFR 1.11(e)(3)(ii)
(providing, with respect to operational risk, that
FCMs have automated financial risk management
controls reasonably designed to prevent the placing
of erroneous orders); Enhancing Protections
Afforded Customers and Customer Funds Held by
Futures Commission Merchants and Derivatives
Clearing Organizations, 77 FR 67866, 67906 (Nov.
14, 2012) (describing Commission regulation
1.11(e)(3)(ii) as requiring an FCM’s RMP to include
automated financial risk management controls in
order to reduce operational risk that could result
from ‘‘fat finger’’ errors when submitting trades, or
from technological ‘‘glitches’’ using automated
trading); 17 CFR 23.600(c)(4)(vi) (requiring swap
entities to take into account, among other things,
secure and reliable operating and information
systems with adequate, scalable capacity, and
independence from the business trading unit;
safeguards to detect, identify, and promptly correct
deficiencies in operating and information systems;
and reconciliation of all data and information in
operating and information systems); 17 CFR 162.21
and 17 CFR 160.30 (requiring covered entities to
adopt written policies and procedures addressing
administrative, technical, and physical safeguards
with respect to the information of consumers).
29 See 7 U.S.C. 5 (establishing among the
purposes of the Commodity Exchange Act to deter
disruptions to market integrity, to ensure the
financial integrity of covered transactions and the
avoidance of systemic risk, and to promote
responsible innovation and fair competition among
market participants).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
outcomes following operational
disruptions by giving the Commission
the ability to ensure that covered
entities have actionable plans in place
to address key operational risks.
II. Proposal
Section 4s(j)(2) of the Commodity
Exchange Act (CEA or Act) expressly
requires swap entities to establish
robust and professional risk
management systems adequate for
managing their day-to-day business.30
Section 4s(j)(7) further directs the
Commission to prescribe rules
governing the duties of swap entities,
including the duty to establish risk
management systems, which would
include the management of operational
risk.31 The Commission is authorized to
promulgate operational risk
management requirements for FCMs
pursuant to section 8a(5) of the CEA,
which authorizes the Commission to
make and promulgate such rules and
regulations as, in the judgment of the
Commission, are reasonably necessary
to effectuate any of the provisions of, or
to accomplish any of the purposes of,
the CEA.32 This general rulemaking
authority may be used to prevent
problems before they arise in the
agency’s blind spots,33 and may be
exercised to regulate circumstances or
parties beyond those explicated in a
statute.34 Accordingly, the Commission
has broad authority to promulgate
regulations provided that such
regulations are supported by a sufficient
nexus to the CFTC’s delegated authority.
Specifically, Congress expressly
empowered the Commission to
prescribe certain requirements with
respect to FCMs, namely, to require
FCMs to register (sections 8a(1),
4d(a)(1), and 4f(a)(1) of the CEA 35); to
segregate customer funds (section 4d of
the CEA 36); to establish safeguards to
minimize conflicts of interest (section
4d of the CEA 37); to meet minimum
financial requirements (section 4f of the
CEA 38); to manage and maintain
records and reporting on the financial
and operational risks of affiliates
30 See
7 U.S.C. 6s(j)(2).
7 U.S.C. 6s(j)(7).
32 7 U.S.C. 12a(5).
33 Inv. Co. Inst. v. CFTC, 891 F. Supp. 2d 162, 193
(D.D.C. 2012), as amended (Jan. 2, 2013) (citing
Stilwell v. Office of Thrift Supervision, 569 F.3d
514, 519 (D.C. Cir. 2009)).
34 Nat’l Ass’n of Mfrs. v. SEC, 748 F.3d 359, 366
(D.C. Cir. 2014), overruled on other grounds by Am.
Meat Inst. v. U.S. Dept. of Agric., 760 F.3d 18 (D.C.
Cir. 2014) (en banc).
35 7 U.S.C. 12a(1); 7 U.S.C. 6d(a)(1); 7 U.S.C.
6f(a)(1).
36 7 U.S.C. 6d.
37 Id.
38 7 U.S.C. 6f.
31 See
PO 00000
Frm 00005
Fmt 4701
Sfmt 4702
4709
(section 4f of the CEA 39); and to
establish administrative, technical, and
physical safeguards to protect the
security and confidentiality of certain
nonpublic personal information (section
5g of the CEA 40), among other
requirements.
The Commission believes that more
particularized operational risk
management requirements are
reasonably necessary to help effectuate
these statutory requirements for FCMs
and to accomplish the purposes of the
CEA. FCMs play an important role in
the derivatives markets, serving as both
the primary point of access to the
cleared commodity interest markets for
customers and the custodian of the
funds used to maintain their positions.
Given their position at the center of the
derivatives market ecosystem, FCMs’
operational resilience is essential to
well-functioning derivatives markets
and to ensuring that customers receive
the protections provided by the CEA.
However, as discussed above,
operational risks, notably cyber and
third-party risks, have become an
increasing threat to financial
institutions, including FCMs. These
risks can cause major disruptions to
FCMs’ operations, and consequently
impact the ability of FCMs to fulfill
their obligations as Commission
registrants. In particular, information
security threats and operational
disruptions can place an FCM’s
financial resources at risk; disrupt an
FCM’s ability to segregate and protect
customer funds; impede accurate
recordkeeping, including records related
to customer funds; and cause a host of
other issues for FCMs, which ultimately
inure to the detriment of their customers
and the derivatives markets.
Accordingly, the Commission believes a
comprehensive operational resilience
regime is reasonably necessary to ensure
that an FCM adequately addresses and
mitigates risks that could adversely
impact its ability to operate and fulfill
its statutory obligations and duties as an
FCM.
As discussed in detail in subsequent
sections of this release, the Commission
is proposing to require that FCMs and
swap entities establish an Operational
Resilience Framework (ORF) that is
reasonably designed to identify,
monitor, manage, and assess risks
relating to information and technology
security, third-party relationships, and
emergencies or other significant
disruptions to normal business
operations. At its core, the ORF would
have three key components: an
39 Id.
40 See
E:\FR\FM\24JAP2.SGM
7 U.S.C. 7b–2; 15 U.S.C. 6801.
24JAP2
4710
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
information and technology security
program, a third-party relationship
program, and a business continuity and
disaster recovery plan. The proposed
ORF rule reflects a principles-based
approach buttressed by certain
minimum requirements specific to each
of the component programs or plans,
such as requiring an annual risk
assessment and controls relating to
information and technology security,
and due diligence and monitoring
requirements for third-party service
providers. Proposed requirements
relating to governance, training, testing,
and recordkeeping would apply broadly
and support the ORF as a whole. The
proposed rule would further require
covered entities to notify the
Commission (and, in certain instances,
customers or counterparties) of certain
ORF-related events. Detailed guidance
intended to assist covered entities in
designing and implementing their thirdparty relationship program would be
included in appendices to the rule.
In developing the proposed rule, the
Commission endeavored to incorporate
general directives to federal agencies
articulated in the White House’s March
2023 National Cybersecurity Strategy:
Leverage existing standards and
guidance, harmonize where sensible
and appropriate to achieve better
outcomes, and demonstrate an approach
that is sufficiently nimble to meet the
challenges of the ever-evolving
technological threat landscape and fit
the unique business and risk profile of
each covered entity.41 To that end, the
proposal builds on the Commission’s
experience establishing system
safeguard requirements for registered
entities, as well as the approaches
adopted by self-regulatory organizations
and other regulatory authorities.42
Notably, the proposal draws on
41 The White House, National Cybersecurity
Strategy at 8–9 (Mar. 2023) (National Cyber
Strategy) (‘‘Our strategic environment requires
modern and nimble regulatory frameworks for
cybersecurity tailored for each sector’s risk profile,
harmonized to reduce duplication, complementary
to public-private collaboration, and cognizant of the
cost of implementation.’’). See also FIA Taskforce
Report, supra note 27, at 9 (‘‘[T]he Taskforce
encourages regulators and legislators to take a
principles-based approach to cyber risk and
operational resilience. That approach may not be
sufficient in all areas, but such a flexible approach
is well suited to a threat landscape that is likely to
continue evolving at a rapid rate.’’).
42 See 17 CFR 37.1400 and 17 CFR 37.1401
(system safeguard requirements for swap execution
facilities (SEFs)); 17 CFR 38.1050 and 17 CFR
38.1051 (designated contract markets (DCMs)); 17
CFR 39.18 (derivatives clearing organizations
(DCOs)); 17 CFR 49.24 (swap data repositories
(SDRs)). See also 17 CFR 1.3 (defining ‘‘registered
entity’’ to include DCMs, DCOs, SEFs, and SDRs).
For a summary of international regulatory efforts
related to operational resilience, see FIA Taskforce
Report, supra note 27, at 7–8.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
approaches adopted by NFA, whose
rules and interpretative notices relating
to information systems security, thirdparty risk, and business continuity and
disaster recovery planning apply to
covered entities by virtue of being NFA
members, and prudential regulators,
who also regulate many covered
entities, and have recently issued
interagency positions on operational
resilience and third-party relationship
management.43
The Commission also surveyed the
work of international standard-setting
bodies, notably the BCBS Principles for
Operational Resilience.44 The
Commission also conferred with, and
reviewed the standards published by the
National Institute of Standards and
Technology (NIST), a part of the U.S.
Department of Commerce charged by
Executive Order 13636 in 2013 with
developing a framework to reduce cyber
risks to critical infrastructure that
incorporates voluntary consensus
standards and industry best practices.45
Standards developed in response to this
charge and reviewed by the Commission
include the Framework for Improving
Critical Infrastructure Cybersecurity and
the Security and Privacy Controls for
Information Systems and Organizations,
among others.46 The Commission and
43 See NFA Interpretive Notice 9070, NFA
Compliance Rules 2–9, 2–36 and 2–49: Information
Systems Security (rev. Sept. 30, 2019) (NFA ISSP
Notice); NFA Interpretive Notice 9079, NFA
Compliance Rules 2–9 and 2–36: Members’ Use of
Third-Party Service Providers (NFA Third-Party
Notice) (effective Sept. 30, 2021); NFA Rule 2–38:
Business Continuity and Disaster Recovery Plan
(rev. July 1, 2019); NFA Interpretive Notice 9052,
NFA Compliance Rule 2–38: Business Continuity
and Disaster Recovery Plan (NFA BCDR Notice)
(April 7, 2003); Prudential Operational Resilience
Paper, supra note 11; Interagency Guidance on
Third-Party Relationships: Risk Management, 88 FR
37920 (Jun. 9, 2023) (Prudential Third-Party
Guidance). See also Computer-Security Incident
Notification Requirements for Banking
Organizations and their Bank Service Providers, 86
FR 66424 (Nov. 23, 2021); 12 CFR part 30, app. A
(Interagency Guidelines Establishing Standards for
Safety and Soundness), 12 CFR part 30, app. B
(Interagency Guidelines Establishing Information
Security Standards).
44 See BCBS Operational Resilience Principles,
supra note 11. See also International Organization
of Securities Commissions (IOSCO), Cyber Task
Force: Final Report (2019) (identifying different but
comparable core standards or frameworks,
including both NIST and ISO standards); Financial
Stability Board (FSB), Final report on Enhancing
Third-Party Risk Management and Oversight—a
toolkit for financial institutions and financial
authorities (Dec. 4, 2023) (FSB Third-Party Report).
Materials related to the FSB’s work on cyber
resilience are available at https://www.fsb.org/workof-the-fsb/financial-innovation-and-structuralchange/cyber-resilience/.
45 See The White House, Office of the Press
Secretary, Executive Order—Improving Critical
Infrastructure Cybersecurity, E.O. 13636 (Feb. 12,
2013).
46 See NIST, Framework for Improving Critical
Infrastructure Cybersecurity (Version 1.1) at 2 (Apr.
PO 00000
Frm 00006
Fmt 4701
Sfmt 4702
other financial regulators have
previously adapted NIST’s standards in
regulation and guidance related to
operational resilience. The
Commission’s system safeguards
requirements treat NIST’s CSF as a
source for well-established best
practices for cybersecurity.47 In
Appendix A of the Interagency Sound
Resilience Paper, the prudential
regulators presented ‘‘a collection of
sound practices for cyber risk
management, aligned to NIST and
augmented to emphasize governance
and third-party risk management.’’ 48
The Commission also considered
standards published by equivalent
standard setting bodies like the
International Standards Organization
(ISO).49
Finally, in putting together the
proposal, Commission staff engaged
with staff at NFA and various federal
agencies, including prudential
regulators, and the SEC.50 Based on
these efforts, the Commission
preliminarily believes that, if adopted,
the proposed rule would strike an
16, 2018) (NIST CSF); NIST, SP 800–53, Security
and Privacy Controls for Information Systems and
Organizations (Sept. 2020, rev. Dec. 10, 2020) (NIST
SP 800–53). See also Cybersecurity & Infrastructure
Security Agency (CISA), Financial Services SectorSpecific Plan—2015 at 16 (rev. Dec. 17, 2020)
(‘‘While the [NIST cybersecurity framework] is
designed to manage cybersecurity risks, its core
functions of Identify, Protect, Detect, Respond, and
Recover provide a model for considering physical
risks as well. This methodology is increasingly
central to the sector’s thinking on security and
resilience, and the concept aligns with existing
[Federal Financial Institutions Examination Council
(FFIEC)] guidance.’’).
47 System Safeguards Testing Requirements for
Derivatives Clearing Organizations, 81 FR 64322,
64329 (Sept. 19, 2016).
48 Board of Governors of the Federal Reserve
System, the Office of the Comptroller of the
Currency, and the Federal Deposit Insurance
Corporation, Sound Practices to Strengthen
Operational Resilience (Nov. 2, 2020), available at
https://www.federalreserve.gov/supervisionreg/
srletters/SR2024.html.
49 See, e.g., ISO/IEC 27001:2022, Information
security, cybersecurity and privacy protection:
Information security controls (Oct. 2022) (ISO/IEC
27001:2022).
50 In accordance with section 712(a) of the DoddFrank Act (15 U.S.C. 8302), the Commission has
consulted and coordinated, to the extent possible,
with the SEC and the prudential regulators,
including with the FRB, the OCC, and the FDIC, for
purposes of assuring regulatory consistency and
comparability. The Securities Exchange Act of 1934
and existing and proposed SEC regulations include
requirements relating to risk management including
cybersecurity, including requirements for SECregulated broker-dealers and security-based swap
dealers. See, e.g. Cybersecurity Risk Management
Rule for Broker-Dealers, Clearing Agencies, Major
Security-Based Swap Participants, the Municipal
Securities Rulemaking Board, National Securities
Associations, National Securities Exchanges,
Security-Based Swap Data Repositories, SecurityBased Swap Dealers, and Transfer Agents, 88 FR
20212, sections IV.C.1.b.i and IV.C.1.b.iii (Apr. 5,
2023).
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
appropriate balance between supporting
technological and market innovation
and fair competition, ensuring covered
entities devote the necessary thought,
planning, and resources to their
operational resilience so as to support
the resilience of the U.S. derivatives
markets and the financial sector as a
whole.51
The Commission is proposing to
codify the ORF rule for swap entities in
existing Commission regulation 23.603,
which currently contains the
Commission’s business continuity and
disaster recovery requirements for swap
entities.52 As discussed in greater detail
below, the Commission is proposing to
retain the substance of the existing
business continuity and disaster
recovery requirements in current
Commission regulation 23.603 as part of
the ORF rule for swap entities, with
certain modifications. Similar
requirements would also be imposed on
FCMs. The proposed ORF rule for FCMs
would be codified in new Commission
regulation 1.13. The proposed guidance
on third-party relationships would be
included in the appendices to parts 1
and 23 for FCMs and swap entities,
respectively.
As proposed, the regulatory text of the
ORF rule for swap entities is nearly
identical in structure and substance to
the ORF rule for FCMs. Accordingly, to
promote readability, when referencing
sections of the regulatory text, this
notice generally refers to the relevant
paragraph of the proposed regulations
(i.e., ‘‘proposed paragraph (b)’’ would
refer to paragraph (b) of both proposed
Commission regulations 1.13 and
proposed Commission regulation
23.603).
The Commission invites comment on
all aspects of the proposed rule, as
further detailed below.
A. Generally—Proposed Paragraph (b) 53
ddrumheller on DSK120RN23PROD with PROPOSALS2
1. Purpose and Scope; Components—
Proposed Paragraphs (b)(1) and (b)(2)
As previously mentioned, the
proposed rule would require covered
entities to establish, document,
implement, and maintain an
Operational Resilience Framework, or
ORF.54 The ORF would need to be
reasonably designed to identify,
monitor, manage, and assess risks
51 See
7 U.S.C. 5.
CFR 23.603.
53 Paragraph (a) of proposed Commission
regulations 1.13 and 23.603 provides definitions for
terms used within the ORF rule. Each proposed
definition is discussed in the context of the relevant
substantive regulatory requirement throughout the
remainder of this notice.
54 See paragraph (b)(1) of proposed Commission
regulations 1.13 and 23.603.
52 17
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
relating to three key risk areas that
challenge operational resilience: (i)
information and technology security, as
defined in the proposed rule and
discussed further below; (ii) third-party
relationships; and (iii) emergencies or
other significant disruptions to the
continuity of normal business
operations as a covered entity.55
Although these risk areas are often
viewed distinctly, as the introduction to
this notice illustrates, they are
significantly interrelated, as the relative
strength of information and technology
security and third-party risk
management can directly affect recovery
activities and improve outcomes
following an emergency or other
significant disruption.56 Together, the
Commission believes they represent
important sources of potential
operational risk, the effective
management of which is key to
operational resilience.
The proposed rule would require
covered entities to establish three
written component programs or plans,
each dedicated to addressing one of the
three enumerated risks within the ORF.
The three component programs or plans
would be: (i) an information and
technology security program, (ii) a thirdparty relationship program, and (iii) a
business continuity and disaster
recovery plan.57 Each component
program or plan would need to be
supported by written policies and
procedures and meet the requirements
55 See paragraphs (b)(1)(i)–(iii) of proposed
Commission regulations 1.13 and 23.603.
56 See, e.g., ISO/IEC 27031:2011, Information
technology—Security techniques—Guidelines for
information and communication technology
readiness for business continuity (Mar. 2011)
(‘‘Failures of [information and communication
technology (ICT)] services, including the occurrence
of security issues such as systems intrusion and
malware infections, will impact the continuity of
business operations. Thus, managing ICT and
related continuity and other security aspects form
a key part of business continuity requirements.
Furthermore, in the majority of cases, the critical
business functions that require business continuity
are usually dependent upon ICT. This dependence
means that disruptions to ICT can constitute
strategic risks to the reputation of the organization
and its ability to operate . . . As a result, effective
[business continuity management] is frequently
dependent upon effective ICT readiness to ensure
that the organization’s objectives can continue to be
met in times of disruptions.’’). See Prudential
Operational Resilience Paper, supra note 11, at 8
(‘‘Secure and resilient information systems
underpin the operational resilience of a firm’s
critical operations and core business lines.’’); see
also Prudential Third-Party Guidance, 88 FR 37920
(discussing the interplay of third-party risks and
operational resilience).
57 See paragraph (b)(2) of proposed Commission
regulations 1.13 and 23.603; see also paragraph (a)
of proposed Commission regulations 1.13 and
23.603 (defining ‘‘information and technology
security program,’’ ‘‘third-party relationship
program,’’ and ‘‘business continuity and disaster
recovery plan’’).
PO 00000
Frm 00007
Fmt 4701
Sfmt 4702
4711
set forth in the rule, as discussed in
subsequent sections of this notice.58 The
definitions and specific requirements
for the information and technology
security program, the third-party
relationship program, and the business
continuity and disaster recovery plan
are discussed in detail in subsequent
sections of this notice specifically
dedicated to discussing each of the three
components.59
Although they may go by different
names, the Commission understands
that written programs or plans of these
types are generally recognized as
common ways to address these risks and
are even currently required of covered
entities. NFA, for instance, currently
requires members to adopt a written
information systems security program
(ISSP), a written supervisory framework
to address outsourcing to third-party
service providers, and a written
business continuity and disaster
recovery plan.60 The Commission itself
requires swap entities to have a written
business continuity and disaster
recovery plan.61 Accordingly, to the
extent that covered entities have
existing programs or plans and policies
and procedures that address the
requirements of the ORF rule, by virtue
of other regulatory requirements or
otherwise, the Commission would not
expect such covered entities to adopt
entirely new component programs or
plans. The Commission would only
expect that covered entities review their
existing programs and plans to ensure
they meet the minimum requirements of
the ORF rule and make any necessary
amendments.
The Commission appreciates that
covered entities may assign
responsibility for the establishment,
implementation, and maintenance of
each ORF component program or plan
to distinct functions within their
organizations. By structuring the
proposed rule to require a ‘‘framework’’
directed at operational resilience,
58 See paragraph (b)(2) of proposed Commission
regulations 1.13 and 23.603. See paragraphs (d)
(information and technology security program), (e)
(third-party relationship program), and (f) (business
continuity and disaster recovery plan) of proposed
Commission regulations 1.13 and 23.603
(describing the requirements for each program,
respectively).
59 See sections II.C (information and technology
security program), II.D (third-party relationship
program), II.E (business continuity and disaster
recovery plan) of this notice, infra.
60 See NFA ISSP Notice, supra note 43; NFA
Third-Party Notice, supra note 43; and NFA BCDR
Notice, supra note 43. NFA’s requirement to
establish a business continuity and disaster
recovery plan does not currently apply to swap
entities, see NFA Rule 2–38, paragraph (a), supra
note 43.
61 See 17 CFR 23.603.
E:\FR\FM\24JAP2.SGM
24JAP2
4712
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
however, the Commission intends for
executive leadership at covered entities
to address the risk areas covered by the
ORF as a cohesive and interrelated
whole, breaking down any unnecessary
internal silos, and to consider all
aspects of operational resilience in
determining their operational strategies,
risk appetite, and risk tolerance limits.62
ddrumheller on DSK120RN23PROD with PROPOSALS2
2. Standard—Proposed Paragraph (b)(3)
The Commission is proposing to
require that each covered entity
implement the requirements of the
proposed ORF rule in a manner that is
appropriate and proportionate to the
nature, scope, complexity, and risk
profile of its business activities as a
covered entity, following generally
accepted standards and best practices
(the (b)(3) standard).63 The proposed
(b)(3) standard reflects the general
principles-based approach
underpinning the proposed rule, which
the Commission believes would be
appropriate given the increased reliance
on and rapid evolution of technology
within the financial industry and its
attendant risks.64 This standard
incorporates two themes that have broad
support from other governmental and
international standard-setting bodies
when addressing matters related to
operational resilience: (i)
proportionality; and (ii) reliance on
established standards and best
practices.65
62 The specific governance requirements of the
proposed rule, which include the requirement to
establish risk appetite and risk tolerance limits with
respect to the ORF, further support this view. See
paragraph (c) of proposed Commission regulations
1.13 and 23.603.
63 See paragraph (b)(3) of proposed Commission
regulations 1.13 and 23.603.
64 See BCBS Operational Resilience Principles,
supra note 11, at 1 (‘‘Recognising that a range of
potential hazards cannot be prevented, the
Committee believes that a pragmatic, flexible
approach to operational resilience can enhance the
ability of banks to withstand, adapt to and recover
from potential hazards and thereby mitigate
potentially severe adverse impacts.’’); see also
Prudential Operational Resilience Paper, supra note
11, at 9 (providing as a sound practice of
operational resilience that firms review information
systems ‘‘on a regular basis against common
industry standards and best practices.’’).
65 See, e.g., BCBS Operational Resilience
Principles at 2–3 (‘‘The principles for operational
resilience set forth in this document are largely
derived and adapted from existing guidance that
has been issued by the Committee or national
supervisors over a number of years. The Committee
recognizes that many banks have well established
risk management processes that are appropriate for
their individual risk profile, operational structure,
corporate governance and culture, and conform to
the specific risk management requirements of their
jurisdictions. By building upon existing guidance
and current practices, the Committee is issuing a
principles-based approach to operational resilience
that will help to ensure proportional
implementation across banks of various size,
complexity and geographical location.’’); FSB
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
Broadly speaking, the principle of
proportionality recognizes that
operational resilience, and information
and technology security, in particular,
cannot be addressed with a one-size-fitsall approach.66 On the contrary,
differences in operational structures and
business strategies among covered
entities necessitate a more flexible and
adaptive approach that would allow
individual covered entities to best
address their specific risks and evolve to
address emerging challenges as they
arise. Covered entities vary widely in
terms of their business structure and
risk profiles, such that a covered entity
operating within a large bank holding
company group structure and involved
in a broad array of asset classes would
likely have a different risk profile and
different resources than an entity that is
solely registered with the CFTC or that
has a narrower scope to its CFTCregulated business. The Commission
would therefore expect that covered
entities facing different operational risks
may take different approaches to
managing and monitoring those risks.
Designing an operational resilience
framework that would apply uniformly
across all covered entities would not
only pose significant challenges, it
would likely be ineffective, imposing
operational costs where no risks
demand it. Accordingly, the
Commission preliminarily believes that
a proportional, risk-based approach
would help ensure that firms,
customers, counterparties, and the
financial system at large can
appropriately respond to and recover
from operational shocks in context.
Interpretive notices adopted by NFA
reflect a comparable approach.
Specifically, NFA’s notices on ISSPs
and the use of third-party service
providers establish general, baseline
requirements (e.g., assess risks
associated with the use of information
technology systems or with reliance on
third-party service providers) and then
direct NFA members, including covered
entities, to tailor the specifics to their
Third-Party Report, supra note 44, at 10–11; IOSCO,
Principles on Outsourcing: Final Report at 10
(IOSCO Outsourcing Report) (Oct. 2021) (providing
that ‘‘[t]he application and implementation of these
Principles should be proportional to the size,
complexity and risk posed by the outsourcing’’ of
tasks, functions, processes, services, or activities to
a service provider that would otherwise be
undertaken by the regulated entity itself).
66 See e.g., FINRA, 2018 Report on Selected
Cybersecurity Practices at 1 (Dec. 2018) (FINRA
Cybersecurity Report) (‘‘[T]here is no one-size-fitsall approach to cybersecurity.’’); NIST CSF, supra
note 46, at 2 (‘‘The [NIST CSF] is not a one-sizefits-all approach to managing cybersecurity risk for
critical infrastructure. Organizations will continue
to have unique risks—different threats, different
vulnerabilities, different risk tolerances.’’).
PO 00000
Frm 00008
Fmt 4701
Sfmt 4702
businesses.67 This approach is also
consistent with the CFTC’s own
approach with respect to system
safeguard requirements for registered
entities,68 as well as those of the
prudential regulators.69 Generally
accepted standards and best practices
themselves also generally support a
proportional approach.70
The Commission emphasizes,
however, that ‘‘proportional’’ does not
mean ‘‘permissive.’’ The Commission’s
proposed standard for the ORF rule
would not support a ‘‘race to the
bottom,’’ where covered entities default
to the minimum requirements of the
proposed rule. On the contrary, covered
entities would be required to implement
an ORF that is reasonably designed to
reflect and address their unique risk
profile and activities, consistent with
the proposed (b)(3) standard.
Accordingly, the Commission would
expect larger, more complex entities
that operate more varied business lines,
rely on more technological platforms, or
67 See NFA ISSP Notice, supra note 43 (requiring
each NFA member to adopt an ISSP appropriate to
the its ‘‘size, complexity of operations, type of
customers and counterparties, the sensitivity of the
data accessible within its systems, and its electronic
interconnectivity with other entities’’); NFA ThirdParty Notice, supra note 43 (‘‘NFA recognizes that
a Member must have flexibility to adopt a written
supervisory framework relating to outsourcing
functions to a [third-party service provider] that is
tailored to a Member’s specific needs and business
. . .’’).
68 See, e.g., 17 CFR 37.1401(b) (SEFs); 17 CFR
38.1051(b) (DCMs); 17 CFR 39.18(b)(3) (DCOs); 17
CFR 49.24(c) (SDRs) (requiring registered entities to
follow generally accepted standards and best
practices with respect to the development,
operation, reliability, security, and capacity of
automated systems); see also System Safeguards
Testing Requirements for Derivatives Clearing
Organizations, 81 FR 64322, 64329 (Sept. 19, 2016)
(DCO System Safeguards Testing Requirements)
(describing the CFTC’s approach to system
safeguards for DCOs as providing DCOs with
‘‘flexibility to design systems and testing
procedures based on the best practices that are most
appropriate for that DCO’s risks’’).
69 12 CFR part 30, app. B (Interagency Guidelines
Establishing Information Security Standards); id. at
II.A. (Information Security Program) (‘‘Each
[financial institution] shall implement a
comprehensive written information security
program that includes administrative, technical,
and physical safeguards appropriate to the size and
complexity of the [financial institution] and the
nature and scope of its activities.’’); FFIEC
Information Technology Examination Handbook,
Information Security at 2 (Sept. 2016) (FFIEC
Information Security Booklet) (‘‘Institutions should
maintain effective information security programs
commensurate with their operational
complexities.’’).
70 The NIST CSF, for example, identifies activities
designed to achieve specific cybersecurity outcomes
and tiers practices by increasing degree of rigor and
sophistication. In selecting a tier, NIST directs
entities to consider their ‘‘current risk management
practices, threat environment, legal and regulatory
requirements, information sharing practices,
business/mission objectives, supply chain
cybersecurity requirements, and organizational
constraints.’’ See NIST CSF, supra note 46, at 8.
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
have more complicated agreements with
third-party service providers to arrive at
an ORF that is appropriate to their likely
increased level of operational risk.71
The requirement for covered entities
to follow generally accepted standards
and best practices serves to ground
covered entities’ approaches to
operational resilience in practices that
are widely recognized as effective in
aiding financial institutions to mitigate
and recover from operational shocks. In
adopting system safeguard requirements
for registered entities, which require
registered entities to follow generally
accepted standards and best practices,
the Commission identified several
sources of standards and best
practices.72 NFA and other bodies have
compiled similar lists.73 Among
perhaps the most commonly relied on
by financial institutions are the NIST
CSF, ISO, the Center for internet
Security (CIS), and FFIEC, whose
examination booklets and Cyber
Assessment Tool (CAT) are specifically
designed to guide financial
institutions.74 The Commission would
expect covered entities to use generally
accepted standards and industry best
practices that are appropriate and
proportionate to the nature, size, scope,
complexities, and risk profile of their
business activities, in designing or
updating an ORF that would comply
with the proposed rule. For instance, in
conducting the risk assessment required
under proposed paragraph (c)(1), a
covered entity would need to identify
risks to its information and technology
security with reference to risks
discussed in an appropriate standard or
based on industry best practices, and
then assess and prioritize those risks
using frameworks and metrics
71 See National Cyber Strategy, supra note 41, at
4 (‘‘The most capable and best-positioned actors in
cyberspace must be better stewards of the digital
ecosystem.’’); see also IOSCO Outsourcing Report,
supra note 65, at 10.
72 See, e.g., DCO System Safeguards Testing
Requirements, 81 FR 64322–23; 17 CFR 39.18(b)(3)
(requiring DCOs to follow generally accepted
standards and best practices with respect to the
development, operation, reliability, security, and
capacity of automated systems); see also 17 CFR
37.1401(b) (SEFs) (requiring the same); 17 CFR
38.1051(b) (DCMs) (same); 17 CFR 49.24(c) (SDRs)
(same).
73 See, e.g., NFA, Cybersecurity FAQs, ‘‘Does
NFA recommend any particular consultants that
can help a Member draft an ISSP or perform
penetration testing?’’; see also FFIEC, Cybersecurity
Resource Guide for Financial Institutions (Sept.
2022) (rev. Nov. 2022).
74 The Financial Services Sector Coordinating
Council (FSSC) has also developed a NIST CSF
profile specifically designed for financial
institutions. The profile is now maintained,
updated, and managed by the Cyber Risk Institute
(CRI) and was last updated in January 2023. See CRI
Profile v1.2 (Dec. 14, 2021), available at https://
cyberriskinstitute.org/the-profile/.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
recommended by those standards or
practices. Requiring covered entities to
follow generally accepted standards and
industry best practices in developing
and implementing the ORF would help
ensure that covered entities establish,
document, implement, and maintain
ORFs reasonably designed to address
their particular operational resiliencerelated risks.
The proposed rule leverages these
standards not only by directing covered
entities to consider them in developing
their approaches but by incorporating
common themes contained within them
into the substance of the proposed rule.
In the Commission’s view, reliance on
such standards supports the use of a
common lexicon, facilitating the
development of understandable and
transposable practices on a cross-border
basis. The Commission further
recognizes that generally accepted
standards and best practices are likely to
evolve over time, and the applicability
of any particular standard may vary
based on the unique circumstances and
risk profile of each covered entity.
Accordingly, the Commission
preliminarily believes requiring covered
entities to follow generally accepted
standards and best practices supports
the goal of an adaptive approach that
can respond nimbly to rapid changes in
emerging threats.75
3. Request for Comment
The Commission invites comment on
all aspects of proposed paragraph (b),
including the following questions:
1. Applicability to FCMs. In adopting
the RMP rule for FCMs in 2013, the
Commission determined to limit the
rule’s applicability to FCMs that hold or
accept customer funds.76 The CEA and
Commission regulations define a
‘‘futures commission merchant’’ as an
entity that solicits or accepts orders to
buy or sell futures contracts, options on
futures, retail off-exchange forex
contracts or swaps, and accepts money
or other assets from customers to
support such orders.77 Although some
entities are, for various reasons,
currently registered as FCMs despite not
75 See National Cyber Strategy, supra note 41, at
9 (‘‘By leveraging existing international standards in
a manner consistent with current policy and law,
regulatory agencies can minimize the burden of
unique requirements and reduce the need for
regulatory harmonization.’’).
76 See 17 CFR 1.11(a) (Nothing in this section
shall apply to a futures commission merchant that
does not accept any money, securities, or property
(or extend credit in lieu thereof) to margin,
guarantee, or secure any trades or contracts that
result from soliciting or accepting orders for the
purchase or sale of any commodity interest.).
77 See 7 U.S.C. 1a(28)(A); 17 CFR 1.3 (defining
‘‘futures commission merchant’’) (emphasis added).
PO 00000
Frm 00009
Fmt 4701
Sfmt 4702
4713
accepting customer funds, as the
Commission explained in the adopting
release for the FCM RMP rule, FCMs
that do not accept or hold customer
funds to margin, guarantee, or security
commodity interests are generally not
operating as FCMs.78 With respect to the
proposed ORF rule, the Commission has
preliminarily determined to apply the
proposed requirements to all registered
FCMs. Although the customer
protection concerns may be mitigated
for FCMs that do not handle customer
assets, the Commission preliminarily
believes that the potential systemic risk
that can result from failures to manage
information and technology risk, thirdparty relationships, emergencies, or
other significant disruptions persist for
all FCMs, given their access to customer
information and their potential
relationships with and/or connectivity
to other regulated entities, including
exchanges and clearinghouses.79
a. Are the risks associated with
information and technology security,
third-party relationships, and
emergencies or other significant
disruptions substantially different or
reduced for FCMs that do not hold
customer funds? If yes, please explain.
b. Should the Commission consider
limiting the ORF rule to FCMs that do
not hold customer funds, consistent
with the FCM RMP rule? Why or why
not? Please explain.
2. Standard. The proposed rule would
require covered entities to follow
‘‘generally accepted standards and best
practices’’ in establishing,
implementing, and maintaining their
ORFs. Although this notice identifies
various sources of such standards and
practices, including NIST, ISO, CIS, and
FFIEC, the proposed rule does not
further define or otherwise limit the
scope of ‘‘generally accepted standards
and best practices,’’ acknowledging that
there are several sources of recognized
standards currently relied on by covered
entities and that standards and practices
78 As of July 31, 2023, twelve (12) entities were
registered as FCMs but were not required to
segregate any funds on behalf of customers. See
CFTC, Financial Data for FCMs (July 31, 2023),
available at https://www.cftc.gov/MarketReports/
financialfcmdata/index.htm. The Commission
made clear in the adopting notice for the FCM RMP
rule that it would expect that, prior to changing
their business model to begin accepting customer
funds, any registered FCM that does not currently
accept customer funds would need to establish a
risk management program that complies with
Commission regulation 1.11 and file such program
with the Commission and with the FCM’s
designated self-regulatory organization (DSRO). See
Final FCM RMP Rule, 78 FR 68517.
79 The Final FCM RMP rule, by contrast, could be
viewed as more directly targeting the management
of specific risks associated with operating as an
FCM.
E:\FR\FM\24JAP2.SGM
24JAP2
4714
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
are likely to evolve over time in
response to changes in technology or
emerging threats. Nevertheless, the
Commission understands that,
particularly in the United States, NIST
and ISO standards are heavily relied on
by covered entities and referenced by
other regulators, making them widely
recognized as the leading industry
standards for cybersecurity and
operational risk management.
a. Should the Commission further
define or otherwise limit what
constitutes ‘‘generally accepted
standards and best practices’’?
Specifically, should the Commission
require covered entities to follow NIST
or ISO standards, as some commenters
on the RMP ANPRM recommended? 80
Why or why not? Please explain.
b. Are there any other standards or
practices commonly relied on by
covered entities that the Commission
did not identify, directly or indirectly,
in this notice? If so, please identify them
and specify how they are currently
relied on by covered entities.
B. Governance—Proposed Paragraph (c)
ddrumheller on DSK120RN23PROD with PROPOSALS2
The topic of governance has gained
increased attention within the context of
operational resilience, particularly with
respect to the area of information and
technology security. As of the date of
this notice, NIST is undergoing a
process to update the NIST CSF, and
new governance outcomes are expected
to feature prominently.81 Prudential
regulators have also emphasized the role
of effective governance to operational
resilience.82 In the Commission’s view,
the overall objective of an effective
governance regime for an ORF should be
the integration of operational resilience
topics into existing reporting lines and
operational structures, including the
entity’s overall operational strategy, to
ensure active executive engagement and
oversight in the management of
80 See, e.g., R.J. O’Brien Letter, supra note 13, at
6 (‘‘The Commission should also seek to implement
the [NIST CSF] as a part of its standard for
managing and mitigating this area of risk. The NIST
CSF is widely accepted throughout many different
industries and would set a universal standard and
best practices for registrants to follow.’’).
81 See NIST, NIST Cybersecurity Framework 2.0
Concept Paper: Potential Significant Updates to the
Cybersecurity Framework at 10–11 (Jan. 19, 2023)
(discussing how the update ‘‘will emphasize the
importance of cybersecurity governance’’ by adding
a new govern function); see also CRI, The Profile
Workbook: Guidance for Implementing the CRI
Profile v1.2.1 and Responding to its Diagnostic
Statements at 16 (rev. Jan. 2023) (CRI Profile
Workbook) (providing guidance on governance
outcomes that have already been incorporated into
the NIST CSF financial services sector profile).
82 See Prudential Operational Resilience Paper,
supra note 11, at 3.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
operational risk that could challenge a
covered entity’s operational resilience.83
1. Approval of Components—Proposed
Paragraph (c)(1)
Accordingly, to ensure that a covered
entity’s senior leadership is involved in
key decision-making around operational
resilience, and is ultimately held
accountable for implementation of the
ORF, the proposed rule would require
covered entities to have their senior
leadership annually approve the ORF.84
In recognition of the wide variety of
corporate structures represented among
covered entities, however, the proposed
rule would give covered entities broad
flexibility and discretion to identify the
appropriate senior-level individual or
body to provide such approval.
Specifically, paragraph (c)(1) of the
proposed rule would require that each
ORF component program or plan
required by paragraph (b)(2) of the
proposed rule is approved in writing, on
at least an annual basis, by either the
senior officer, an oversight body, or a
senior-level official of the covered
entity.85 The term ‘‘oversight body’’
itself would be broadly defined to
encompass any board, body, or
committee of a board or body of the
covered entity specifically granted the
authority and responsibility for making
strategic decisions, setting objectives
and overall direction, implementing
policies and procedures, or overseeing
the management of operations for the
covered entity.86 Consistent with
Commission regulation 3.1(j), ‘‘senior
officer’’ would mean the chief executive
officer or other equivalent officer of the
covered entity.87 As an example, under
the proposed rule, a covered entity
could elect to have its information and
technology security program annually
approved by its chief executive officer,
its chief information security officer, or
a committee with oversight authority
over information and technology
83 See BCBS Operational Resilience Principles,
supra note 11, at 4 (‘‘Principle 1: Banks should
utilise their existing governance structure to
establish, oversee and implement an effective
operational resilience approach that enables them
to respond and adapt to, as well as recover and
learn from, disruptive events in order to minimise
their impact on delivering critical operations
through disruption.’’) (internal citation omitted).
84 See paragraph (c)(1) of proposed Commission
regulations 1.13 and 23.603.
85 Id.
86 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘oversight
body’’).
87 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘senior
officer’’). See also 17 CFR 3.1(j) (defining ‘‘senior
officer’’).
PO 00000
Frm 00010
Fmt 4701
Sfmt 4702
security.88 Again, the intention behind
offering this flexibility is to ensure that
covered entities would be able to rely on
and incorporate operational resilience
into their existing governance structures
when complying with the proposed
ORF rule, while ensuring that each
component program or plan would be
approved by an individual or group of
individuals with senior-level
responsibilities and authority.
2. Risk Appetite and Risk Tolerance
Limits—Proposed Paragraph (c)(2)
The proposed rule would further
require covered entities to establish and
implement appropriate risk appetite and
risk tolerance limits with respect to the
three risk areas enumerated in
paragraph (b)(1) (information and
technology security, third-party
relationships, and emergencies or other
significant disruptions to the continuity
of normal business operations).89
Although the terms ‘‘risk appetite’’ and
‘‘risk tolerance’’ are sometimes used
interchangeably, the Commission
intends the terms to have distinct
meanings within the context of the
proposed rule. Specifically, in the
context of the proposed rule, ‘‘risk
appetite’’ would mean the aggregate
amount of risk a covered entity is
willing to assume to achieve its strategic
objectives.90 Risk appetite is typically
documented through a risk appetite
statement, which establishes qualitative
and quantitative measures designed to
help identify when risk appetite has
been exceeded and what appropriate
mitigating strategies that can be taken.91
88 Other possible senior-level officials could be
the covered entity’s chief risk officer or chief
operating officer, as appropriate.
89 See paragraph (c)(2)(i) of proposed Commission
regulations 1.13 and 23.603. See also paragraph
(b)(1) of proposed Commission regulations 1.11 and
23.603 (identifying the risk areas proposed to be
covered by the ORF).
90 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘risk
appetite’’). See also 12 CFR part 30, app. D, I.E.10
(Definitions) (defining ‘‘risk appetite’’ as the
aggregate level and types of risk the board of
directors and management are willing to assume to
achieve a covered bank’s strategic objectives and
business program, consistent with applicable
capital, liquidity, and other regulatory
requirements); Prudential Operational Resilience
Paper, supra note 11, at 14 (defining ‘‘risk appetite’’
as ‘‘[t]he aggregate level and types of risk the board
and senior management are willing to assume to
achieve a firm’s strategic business objectives,
consistent with applicable capital, liquidity, and
other requirements and constraints’’); BCBS
Operational Resilience Principles, supra note 11, at
3, n.7 (defining ‘‘risk appetite’’ as ‘‘the aggregate
level and types of risk a bank is willing to assume,
decided in advance and within its risk capacity, to
achieve its strategic objectives and business
program’’).
91 See 12 CFR part 30, app. D (requiring covered
financial institutions to have a comprehensive
written risk appetite statement). See also CRI Profile
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
With its proposed definition of ‘‘risk
tolerance limit,’’ the Commission
intends to capture a more focused
measure of acceptable risk. Specifically,
‘‘risk tolerance limit’’ would mean the
amount of risk, beyond its risk appetite,
that a covered entity is prepared to
tolerate through mitigating actions.92
Thus, risk tolerance limits assume a
particular type of risk has materialized
(e.g., an operational disruption has
occurred) and identify the amount of
disruption a firm is prepared to tolerate
beyond its risk appetite.93 Risk tolerance
limits are also more likely to be
measured in quantitative terms (e.g.,
number of hours a particular system or
application is down).94
As with each component ORF
program or plan, the proposed rule
would require that a covered entity’s
risk appetite and risk tolerance limits be
reviewed and approved in writing on at
least an annual basis by either the senior
officer, an oversight body, or a seniorWorkbook, supra note 78, at 16 (‘‘Risk appetite
statements define certain risk tolerance metrics that
help describe systems and services that the
organization may consider high-risk.’’).
92 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘risk
tolerance limit’’). See also Prudential Operational
Resilience Paper, at 3, n. 11; 14 (defining ‘‘tolerance
for disruption’’ as ‘‘determined by a firm’s risk
appetite for weathering disruption from operational
risks considering its risk profile and the capabilities
of its supporting operational environment’’ and
‘‘informed by existing regulations and guidance and
by the analysis of a range of severe but plausible
scenarios that would affect its critical operations
and core business lines.’’); CRI Profile Workbook at
291 (stating that ‘‘risk tolerance’’ ‘‘reflects the
acceptable variation in outcomes related to specific
performance measures linked to objectives the
entity seeks to achieve’’). ISACA, Risk IT
Framework, 2nd Ed. (July 27, 2020) (defining ‘‘risk
tolerance’’ as ‘‘the acceptable deviation from the
level set by the risk appetite and business
objectives’’).
93 The Commission recognizes that Commission
regulations 1.11 and 23.600 incorporate the term
‘‘risk tolerance limits.’’ See 17 CFR 1.11(e)(1), 17
CFR 23.600(c)(1). As proposed to be defined in the
ORF rule, however, ‘‘risk tolerance limits’’ would
be limited to the context of the risks identified in
paragraph (b)(1) of the proposed rule and associated
disruptions. Accordingly, if adopted, the defined
use of the term ‘‘risk tolerance limit’’ in the
proposed rule would not be intended to affect how
covered entities use or interpret the term in the
context of the Commission’s RMP rules.
94 The Commission believes its proposed
definitions are in line with proposed definitions of
‘‘risk appetite’’ and ‘‘risk tolerance’’ used by NIST.
For example, in NIST Interagency or Internal Report
8286 (NIST IR 8286), NIST explains that a statement
of risk appetite might be that ‘‘[e]mail shall be
available during the large majority of a 24-hour
period,’’ while the associated risk tolerance would
be narrower, stating something like ‘‘[e]mail
services shall not be interrupted more than five
minutes during core hours.’’ See NIST IR 8286 at
5–6 (Oct. 2020). Accordingly, any existing risk
appetite and risk tolerance limits established by
covered entities pursuant to NIST or prudential
regulator standards would be considered consistent
with the proposed rule.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
level official of the covered entity.95
This proposed requirement is intended
to ensure that the risk appetite and risk
tolerance limits are consistent with the
covered entity’s operational strategy and
objectives, as established by senior
leadership, and that senior leadership is
involved in, and ultimately held
accountable for, how operational risks
faced by the covered entity are
internalized by the covered entity.
The setting and approval of risk
appetite and risk tolerance limits for
operational risk is a well-recognized key
component of effective governance and
oversight.96 The Commission therefore
preliminarily believes the setting and
approval of risk appetite and risk
tolerance limits for operational risks
captured by the ORF would be helpful
to ensuring effective governance and
oversight of the ORF. Specifically, the
Commission believes that the process of
identifying appropriate risk appetite and
risk tolerance limits would have a
disciplining effect, encouraging covered
entities to think critically about the risks
they face and their ability to
comfortably manage them without
incurring intolerable harm to
themselves or their customers or
counterparties. The Commission further
believes that operating within set risk
appetite and risk tolerance limits would
help support a culture where senior
leaders at covered entities can make
more informed decisions about the risks
they are willing to take and the
mitigation measures they would need to
employ to manage these risks, which
would further support operational
resilience.
3. Internal Escalations—Proposed
Paragraph (c)(3)
To further ensure that senior
leadership remains involved in and
accountable for the ORF as it is
implemented, the proposed rule would
require either the senior officer, an
oversight body, or a senior-level official
of the covered entity to be notified of:
(i) circumstances that exceed the risk
tolerance limits established pursuant to
95 See paragraph (c)(2)(ii) of proposed
Commission regulations 1.13 and 23.603.
96 See, e.g., BCBS Operational Resilience
Principles, supra note 11, at 4 (‘‘The board of
directors should review and approve the bank’s
operational resilience approach considering the
bank’s risk appetite and tolerance for disruption to
its critical operations. In formulating the bank’s
tolerance for disruption, the board of directors
should consider the bank’s operational capabilities
given a broad range of severe but plausible
scenarios that would affect its critical operations.
The board of directors should ensure that the bank’s
policies effectively address instances where the
bank’s capabilities are insufficient to meet its stated
tolerance for disruption.’’); CRI Profile v1.2, supra
note 74.
PO 00000
Frm 00011
Fmt 4701
Sfmt 4702
4715
paragraph (c)(2)(i) of the proposed rule;
and (ii) incidents that require
notification to the Commission,
customers, or counterparties under the
proposed rule, as further discussed in
subsequent sections of this notice.97
The Commission believes that
circumstances that would push a
covered entity outside of its risk
tolerance limits or trigger a Commission
notification requirement would be
extraordinary, non-business-as-usual
events, and would likely require the
involvement of senior leadership to
direct responsive actions to preserve or
mitigate damage to operational
resilience and prevent situations of
intolerable harm. Ensuring that
appropriate senior leadership, as
determined by the covered entity, is
apprised of instances where expected
risk tolerance limits have been exceeded
would further help senior leadership
determine whether the risk appetite and
risk tolerance limits are appropriately
calibrated and whether identified
mitigation strategies are working,
creating opportunities to update either
as necessary.
4. Consolidated Program or Plan—
Proposed Paragraph (c)(4)
The Commission is aware that many
covered entities function as a division
or affiliate of a larger entity or holding
company structure; and that, in such
instances, operational risks stemming
from information and technology
security, third-party relationships, and
emergencies or other significant
disruptions are generally monitored and
managed at the enterprise level to
address the risks holistically and to
achieve economies of scale.98 The
proposed rule recognizes the benefits of
such a consolidated approach and is not
intended to interfere with covered
entities’ operational structures.
Accordingly, the proposed rule would
allow covered entities to satisfy the
component program or plan
requirement in paragraph (b)(2) through
its participation in a consolidated
program or plan, provided the
consolidated program or plan meets the
97 See paragraph (c)(3) of proposed Commission
regulations 1.13 and 23.603. See also paragraphs (i)
and (j) of proposed Commission regulations 1.13
and 23.603, discussed in section II.G of this notice,
infra.
98 In responding to the RMP ANPRM, several
commenters noted how cybersecurity risk is
generally managed at the enterprise level and
should not be managed at the level of the entity
regulated by the Commission. See FIA Letter at 11
(Sept. 18, 2023); International Swaps and
Derivatives Association, Inc. (‘‘ISDA’’) and the
Securities Industry and Financial Markets
Association (‘‘SIFMA’’) Letter at 9 (Sept. 18, 2023).
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
4716
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
requirements of the proposed rule.99 As
defined in the proposed rule, a
‘‘consolidated program or plan’’ would
mean any information and technology
security program, third-party
relationship program, or business
continuity and disaster recovery plan in
which a covered entity participates with
one or more affiliates and is managed
and approved at the enterprise level.100
Nevertheless, the Commission does
have a strong regulatory interest in
ensuring that operational shocks, such
as cyber incidents or technological
failures, having an impact on the
discrete interests and operations of the
covered entity are appropriately
considered through the unique lens of
the covered entity, which is regulated
by the Commission. Accordingly, for a
covered entity to satisfy the component
program or plan requirement through its
participation in a consolidated program
or plan, the consolidated program or
plan would need to meet the
requirements of the proposed rule, as
discussed in this notice. Those
requirements include the establishment
of appropriate risk appetite and risk
tolerance limits that address the covered
entity, as well as testing and other
requirements, as discussed further
below.
With respect to the requirements in
proposed paragraphs (c)(1) and (c)(2)(i)
that senior leadership of the covered
entity approve, respectively, the
component program or plan and the risk
appetite and risk tolerance limits at least
annually, the Commission recognizes
that such a requirement might be
challenging in the context of a
consolidated program or plan, which is
likely to address matters related to
affiliates that are not within the scope
of knowledge or responsibility of the
covered entity. Accordingly, the
proposed rule would allow covered
entities relying on a consolidated
program or plan to satisfy the approval
requirements in paragraphs (c)(1) and
(c)(2)(i) of the proposed rule, provided
that either the senior officer, an
oversight body, or a senior-level official
of the covered entity attests in writing,
on at least an annual basis, that the
consolidated program or plan meets the
requirements of this section and reflects
the risk appetite and risk tolerance
limits appropriate to the covered
99 See paragraph (c)(4)(i) of proposed Commission
regulations 1.13 and 23.603.
100 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘consolidated
program’’). Again, the specific definitions and
minimum requirements of each program are
discussed in sections II.C, II.D, and II.E of this
notice, infra.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
entity.101 Notably, the senior officer, an
oversight body, or a senior-level official
at the covered entity would still need to
be notified when the risk appetite and
risk tolerance limits related to the
covered entity are exceeded.102 The
Commission believes that such an
attestation requirement would promote
efficiency by allowing covered entities
to continue to rely on an enterpriselevel ORF and governance structures
that have acknowledged benefits while
also ensuring that such enterprise-level
ORF appropriately addresses the risks
specific to the covered entity, and
would ensure that the requirements of
the Commission’s proposed rule are
addressed for those covered entities in
the same way as they would for a
covered entity that is not a part of a
larger enterprise.103
5. Request for Comment
The Commission invites comment on
all aspects of the proposed governance
requirements for the ORF, including the
following questions:
1. Governance structures. The
proposed rule is intended to provide
covered entities sufficient flexibility to
integrate the proposed operational
resilience requirements into existing
reporting lines and operational
structures, as well as to select the
individual or body with senior-level
responsibilities and authority to
approve the component programs or
plans of the ORF. Does the proposed
rule accomplish this goal? If not, what
other governance structure(s) should the
Commission consider? Alternatively,
should the Commission consider a more
prescriptive, bright-line approach where
only the senior officer or board of
directors of the covered entity may
provide any approvals required under
the proposed rule? Please explain.
2. Internal escalations. The proposed
rule would require that the senior
officer, an oversight body, or other
senior-level official(s) of the covered
entity be notified of circumstances that
exceed risk tolerance limits or that
require reporting to the Commission or
counterparties or customers under the
101 See paragraph (c)(4)(ii) of proposed
Commission regulations 1.13 and 23.603.
102 See paragraph (c)(3)(i) of proposed
Commission regulations 1.13 and 23.603.
103 The Commission also believes this approach
would be consistent with NFA’s current
interpretive notice on ISSPs. See NFA ISSP Notice,
supra note 43 (‘‘[T]o the extent a Member firm is
part of a holding company that has adopted and
implemented privacy and security safeguards
organization-wide, then the Member firm can meet
its supervisory responsibilities imposed by
Compliance Rules 2–9, 2–36 and 2–49 to address
the risks associated with information systems
through its participation in a consolidated entity
ISSP.’’).
PO 00000
Frm 00012
Fmt 4701
Sfmt 4702
proposed rule. Should the Commission
require internal escalation to any other
specific personnel or under any other
circumstances? Please identify and
explain why.
3. Consolidated program or plan. The
proposed rule would allow covered
entities relying on a consolidated
program or plan to satisfy certain
governance requirements by requiring
the senior officer, an oversight body, or
another senior-level official of the
covered entity to attest in writing, on at
least an annual basis, that the
consolidated program or plan meets the
requirements of the rule and reflects a
risk appetite and risk tolerance limits
appropriate to the covered entity. Is this
standard workable for covered entities
that function as a division or affiliate of
a larger entity or holding company?
Why or why not? Do such covered
entities typically set their own risk
appetite and risk tolerance limits, or are
setting such limits conducted at the
enterprise level? If they are set at the
enterprise level, how is senior
leadership of the covered entity
typically involved in setting risk
appetite and risk tolerance limits?
C. Information and Technology Security
Program—Proposed Paragraph (d)
As mentioned above, the proposed
rule would require each covered entity’s
ORF to include an information and
technology security program, defined as
a written program reasonably designed
to identify, monitor, manage, and assess
risks relating to information and
technology security and that meets the
minimum requirements for the program,
as set forth in the proposed rule and
discussed below.104 The proposed rule
would define ‘‘information and
technology security’’ as the preservation
of (a) the confidentiality, integrity, and
availability of covered information and
(b) the reliability, security, capacity, and
resilience of covered technology.105
‘‘Covered information’’ would be
defined to mean any sensitive or
confidential data or information
maintained by a covered entity in
connection with its business activities
as a covered entity.106 ‘‘Covered
technology’’ would be defined to mean
any application, device, information
technology asset, network service,
104 See paragraph (d) of proposed Commission
regulations 1.13 and 23.603. See also paragraph (a)
of proposed Commission regulations 1.13 and
23.603 (defining ‘‘information and technology
security program’’).
105 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘information
and technology security’’).
106 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘covered
information’’).
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
system, and other information-handling
component, including the operating
environment, that is used by a covered
entity to conduct its business activities,
or to meet its regulatory obligations, as
a covered entity.107
The proposed definition of ‘‘covered
information’’ is intended to focus the
requirements of the ORF on protecting
data and information that are sensitive
or otherwise intended to be kept
confidential, whether by law or for
business purposes. Notably, such data
and information would include
position, order, and account
information, all of which covered
entities have an obligation to keep
confidential and which if made public
could result in harm to customers,
counterparties, or the markets more
broadly. Often referred to as the ‘‘CIA
triad,’’ confidentiality, integrity, and
availability represent the three pillars of
information security: preserving
authorized restrictions on information
access and disclosure, including means
for protecting personal privacy and
proprietary information; guarding
against the improper modification or
destruction of data and information,
ensuring its authenticity; and ensuring
the timely and reliable access to and use
of information.108 The Commission
therefore believes that compromising
any aspect of the CIA triad with respect
to covered information would have
meaningful consequences for customers,
counterparties, the covered entity, or
even the market.
The proposed definition of
‘‘information and technology security’’
is likewise intended to ensure that the
ORF is designed to address risks to two
key facets of a covered entities’ business
for which they are registered with the
Commission: the technology they use to
conduct their regulated business
activities and the sensitive information
stored or transmitted therein. The
proposed definition of ‘‘covered
technology’’ is sufficiently broad to
capture all types of technology (and
related components) but is tailored to
focus on the technology that is used by
covered entities in the context of their
regulated business activities, such that
its disruption would have an impact on
regulated business activities. The
Commission preliminarily believes that
reliability, security, capacity, and
resilience are all key attributes of
covered technology that must be
107 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘covered
technology’’).
108 See NIST, SP 1800–26, Data Integrity:
Detecting and Responding to Ransomware and
Other Destructive Events (Dec. 2020) (discussing
the CIA triad).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
4717
preserved for it to function as intended
without posing a disruption to
operations. Accordingly, the
Commission believes that having a
program designed to preserve the
confidentiality, integrity, and
availability of covered information and
the reliability, security, capacity, and
resilience of covered technology is key
to ensuring operational resilience.
Under the proposed rule, each
covered entity’s information and
technology security program would
need to meet the (b)(3) standard, i.e., be
appropriate and proportionate to the
nature, size, scope, complexities and
risk profiles of the covered entity’s
business activities, following generally
accepted standards and best
practices.109 The proposed rule would
nevertheless establish certain minimum
requirements for the information and
technology security program, including
a periodic risk assessment, effective
controls, and an incident response plan.
Each proposed minimum requirement is
discussed in turn below.
NIST, the purpose of a risk assessment
is to inform decision makers and
support risk responses by identifying: (i)
relevant threats to organizations or
threats directed through organizations
against other organizations; (ii)
vulnerabilities both internal and
external to organizations; (iii) impact
(i.e., harm) to organizations that may
occur given the potential for threats
exploiting vulnerabilities; and (iv) the
likelihood that harm will occur.112
Given this broad and important
purpose, the Commission believes
conducting a comprehensive risk
assessment would be reasonably
necessary for covered entities to have a
thorough understanding of their
information and technology security
risks, including the types of threats the
covered entities face, internal and
external vulnerabilities, the impact of
such risks, and their relative priorities,
to guide mitigation efforts.
As stated, the risk assessment would
need to identify, assess, and prioritize
risks to information and technology
security.113 In broad terms, the
1. Risk Assessment—Proposed
Commission anticipates that conducting
Paragraph (d)(1)
the assessment could first involve taking
As part of the information and
an inventory of covered technology and
technology security program, covered
then identifying and assessing the
entities would be required to conduct
likelihood and potential impact of
and document the results of a periodic
reasonably foreseeable threats and
and comprehensive risk assessment
vulnerabilities to information and
reasonably designed to identify, assess,
technology security (i.e., to the
and prioritize risks to information and
confidentiality, integrity, and
technology security.110 Risk assessments
availability of covered information, or to
are widely recognized as a necessary
the reliability, security, capacity or
and effective first step to monitoring
resilience of covered technology) in
and managing risks to information and
light of the existing operational
technology security.111 According to
environment. Identified threats and
vulnerabilities could derive from a wide
109 See paragraph (b)(3) of proposed Commission
array of sources, including both external
regulations 1.13 and 23.603.
110 See paragraph (d)(1)(i) proposed Commission
cyber threats and internal gaps in
regulations 1.13 and 23.603.
existing systems or controls.
111 See, e.g., ISO/IEC 27001:2022, supra note 48
The Commission would then expect
(requiring a risk assessment to help organizations
the risks to be prioritized in light of the
identify, analyze, and evaluate weaknesses in their
covered entity’s stated risk appetite and
information systems); ISO/IEC 31010:2019, Risk
management: Risk assessment techniques (July 2,
risk tolerance limits to help direct
2019); NIST, SP 800–39, Managing Information
resources and other activities in order to
Security Risk: Organization, Mission, and
best support information and
Information System View at 37 (Mar. 2011) (NIST
SP 800–39) (‘‘Risk assessment identifies, prioritizes, technology security. If the proposal is
and estimates risk to organizational operations (i.e.,
adopted as final, the Commission would
mission, functions, image, and reputation),
expect covered entities to use the results
organizational assets, individuals, other
of each risk assessment as a basis for
organizations, and the Nation, resulting from the
designing, implementing, and refining
operation and use of information systems. Risk
assessments use the results of threat and
other elements of its information and
vulnerability assessments to identify and evaluate
technology security program, including
risk in terms of likelihood of occurrence and
potential adverse impact (i.e., magnitude of harm)
to organizations, assets, and individuals.’’); NIST,
SP 800–30, Guide for Conducting Risk Assessments,
Rev. 1, at ix (Sept. 2012) (NIST SP 800–30) (‘‘Risk
assessments are a key part of effective risk
management and facilitate decision making . . .’’).
See also 12 CFR part 30, app. B (establishing a
requirement to assess risk by identifying reasonably
foreseeable threats, assessing the likelihood and
potential damage of the threats, and assessing the
sufficiency of arrangements to control risks);
PO 00000
Frm 00013
Fmt 4701
Sfmt 4702
Prudential Operational Resilience Paper, supra note
11, at 4 (‘‘The firm’s operational risk management
function implements and maintains risk
identification and assessment approaches that
adequately capture business processes and their
associated operational risks, including technology
and third-party risks.’’).
112 See NIST SP 800–30 at 1.
113 See paragraph (d)(1)(i) proposed Commission
regulations 1.13 and 23.603.
E:\FR\FM\24JAP2.SGM
24JAP2
4718
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
but not limited to, the development of
controls, testing protocols, and the
incident response plan, as discussed
further below.114 In this way, a wellconducted risk assessment should
support the development of a more
rational, effective, and valuable
information and technology security
framework, especially as the assessment
is repeated and built upon over time.
The proposed rule would not
prescribe a specific process or
methodology for the risk assessment,
but the risk assessment would need to
be consistent with the proposed (b)(3)
standard.115 Following generally
accepted standards and best practices,
covered entities would need to
implement processes and methodologies
that ensure the risk assessment reflects
the nature, size, scope, complexities,
and risk profile of its business activities
as a covered entity. Any such processes
or methodologies should also be
sufficient to identify, assess, and
prioritize risks to information and
technology security and to evaluate
their potential impact on covered
technology and covered information.116
To ensure that the risk assessment is
conducted objectively, the proposal
would require that the personnel
involved in conducting the assessment
are not responsible for the development
or implementation of the covered
technology or related controls.117 Such
personnel could be employees of the
covered entity, an affiliated entity, or a
third-party service provider. To ensure
that senior leadership is aware of risks
to information security, and can
appropriately prioritize them within the
covered entity’s broader strategy and
risk management framework, the
proposed rule would expressly require
that the results of the risk assessment be
provided to the senior officer, oversight
body, or other senior-level official who
approves the information and
technology security program upon the
risk assessment’s completion.118 The
114 See NIST SP 800–39 at 34 (‘‘Information
generated during the risk assessment may influence
the original assumptions, change the constraints
regarding appropriate risk responses, identify
additional tradeoffs, or shift priorities.’’).
115 See paragraph (b)(3) of proposed Commission
regulations 1.13 and 23.603, discussed supra. The
Commission is aware of several sources for industry
standards and best practices regarding information
security risk assessments. See, e.g., NIST SP 800–
39; see also FFIEC Information Security Booklet,
supra note 69.
116 See paragraph (d)(1)(i) of proposed
Commission regulations 1.13 and 23.603.
117 See paragraph (d)(1)(ii) of proposed
Commission regulations 1.13 and 23.603.
118 See paragraph (d)(1)(iii) of proposed
Commission regulations 1.13 and 23.603. See also
NIST SP 800–30, supra note 111, at 1 (‘‘The
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
Commission believes the results of the
risk assessment would be key
information for senior leadership in
determining whether to approve an
information and technology security
program.
The proposed rule would require that
the covered entity conduct the risk
assessment at a frequency consistent
with the (b)(3) standard (i.e., a frequency
appropriate and proportionate to the
nature, scope, and complexities of its
business activities as a covered entity,
following generally accepted standards
and best practices) but, in any case, no
less frequently than annually.119 Given
the rapidly evolving nature of
technological developments and related
threats, the Commission preliminarily
believes that a uniform requirement to
conduct a risk assessment on at least an
annual basis would support the
development of a strong, foundational
level of information and technology
security across the industry, thereby
mitigating the overall threat of systemic
risk. However, the Commission
understands that generally accepted
standards and best practices may
encourage more frequent risk
assessments for covered entities that
engage in broader or more complex
business activities and would expect
covered entities to conduct risk
assessments more frequently if the
circumstances so require.
As mentioned above, the proposed
rule would allow covered entities to
satisfy the requirement to have an
information and technology security
program through its participation in a
consolidated information and
technology security program.120
Accordingly, such covered entities
would be allowed to rely on a risk
assessment that is conducted at an
enterprise level. In such cases, the
Commission would expect that the
covered entities review the program and
supporting policies and procedures for
conducting the risk assessment to
ensure it captures and assesses the risks
to the covered entity consistent with the
proposed rule so as to support the
related attestation requirement.121
2. Effective Controls—Proposed
Paragraph (d)(2)
The proposed rule would require that
the information and technology security
program establish, document,
purpose of risk assessments is to inform decision
makers and support risk responses . . .’’).
119 See paragraph (d)(1)(ii) of proposed
Commission regulations 1.13 and 23.603.
120 See paragraph (c)(4)(i) of proposed
Commission regulations 1.13 and 23.603.
121 See paragraph (c)(4)(ii) of proposed
Commission regulations 1.13 and 23.603.
PO 00000
Frm 00014
Fmt 4701
Sfmt 4702
implement, and maintain controls
reasonably designed to prevent, detect,
and mitigate identified risks to
information and technology security.122
An essential component of any
information and technology security
program, and a critical component of a
covered entity’s overall ORF, controls
(also referred to as ‘‘countermeasures’’
or ‘‘safeguards’’) include any measures
(actions, devices, procedures,
techniques) designed to promote
information and technology security.123
The selection, design, and
implementation of controls can
therefore have significant implications
for a covered entity’s information and
technology security and overall
operational resilience.124 Accordingly,
the Commission believes effective
controls would be a critical component
of a covered entity’s overall ORF.
Although the proposed rule would
not mandate that covered entities
implement specific controls, it would
require covered entities to consider, at
a minimum, certain categories of
controls, discussed below, and adopt
those consistent with the (b)(3)
standard.125 If the proposal is adopted
as final, the Commission would further
expect that a particular covered entity’s
determination of which controls to
implement would be guided by the
results of its risk assessment,
considering the covered entity’s risk
appetite and risk tolerance limits.126
122 See paragraph (d)(2) of proposed Commission
regulations 1.13 and 23.603.
123 See Committee on Payments and Market
Infrastructures (CPMI), IOSCO, Guidance on cyber
resilience for financial market infrastructures at 7
(Jun. 2016) (CPMI IOSCO Cyber Resilience
Guidance) (noting that a strong information and
communications technologies control environment
is a fundamental and critical component of overall
cyber resilience). See also NIST SP 800–53, supra
note 46, at 8 (‘‘Controls can be viewed as
descriptions of the safeguards and protection
capabilities appropriate for achieving the particular
security and privacy objectives of the organization
and reflecting the protection needs of organizational
stakeholders. Controls are selected and
implemented by the organization in order to satisfy
the system requirements. Controls can include
administrative, technical, and physical aspects.’’);
ISO/IEC 27001:2022, supra note 48, Annex A
(Information security management systems)
(providing guidelines for 93 objectives and
controls).
124 See Prudential Operational Resilience Paper,
supra note 11, at 8 (identifying as a sound practice
for operational resilience routinely applying and
evaluating the effectiveness of processes and
controls to protect confidentiality, integrity,
availability, and overall security of data and
information systems).
125 See paragraphs (d)(2)(i)–(xii) of proposed
Commission regulations 1.13 and 23.603
(identifying categories of controls for covered
entities to consider). See also paragraph (b)(3) of
proposed Commission regulations 1.13 and 23.603.
126 See paragraph (c)(2) of proposed Commission
regulations 1.13 and 23.603 (requiring covered
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
Adopted controls would also need to
address risks to information and
technology security identified through
other means, including outcomes of
continuous monitoring of threats and
vulnerabilities, actual and attempted
cyber-attacks, threat intelligence,
scenario analysis, and the likelihood
and realistic impact of such attacks. In
other words, the controls would need to
be linked to and address the identified
and prioritized risks to information and
technology security. The Commission
would advise covered entities to
document their consideration of
controls within each of the enumerated
categories and their reasoning for
adopting specific controls within any
given category, or for declining to adopt
any controls within a particular
category. Further, the Commission
would expect those controls to be
reviewed and revised as needed to
reflect the results of the covered entity’s
most recent risk assessment.
The specific categories of controls the
Commission would require covered
entities to consider under the proposed
rule include: access controls; access
restrictions; encryption; dual control
procedures,127 segregation of duties, and
background checks; change management
practices; system development and
configuration management practices;
flaw remediation; measures to protect
against destruction, loss, or damage to
covered information; monitoring
systems and procedures to detect attacks
or intrusions; response programs; and
measures to promptly recover and
secure any compromised covered
information.128
The Commission preliminarily
believes that these categories of controls
collectively represent a comprehensive
array of controls for ensuring the
information and technology security.
Access controls, access restrictions,
encryption, and background checks
would limit access to covered
technology and covered information to
individuals with a legitimate business
need in both physical and digital
environments. Dual control procedures,
segregation of duties, procedures
entities to establish and implement risk appetite
and risk tolerance limits).
127 Dual control procedures refer to a technique
that requires two or more separate persons,
operating together, to protect sensitive data and
information. Both persons are equally responsible
for protecting the information and neither can
access the information alone. See Interagency
Guidelines Establishing Standards for Safeguarding
Customer Information and Rescission of Year 2000
Standards for Safety and Soundness, 66 FR 8616,
8622 (Feb. 1, 2001) (Interagency Guidelines
Safeguarding Customer Information).
128 See paragraphs (d)(2)(i)–(xi) of proposed
Commission regulations 1.13 and 23.600.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
relating to modifications to covered
technology, and measures to protect
against destruction, loss, or damage to
covered information, would support the
integrity and availability of covered
information from accidental or
intentional damage or disclosure to
unauthorized recipients. Change
management practices would ensure
that the information and technology
security program, and associated
controls, continue to operate as
intended over time as systems and
processes are updated. Systems
development, configuration
management, and flaw remediation
practices would operate to ensure the
integrity and availability of covered
technology throughout any updates to
covered technology or following a
vulnerability analysis.129 Measures to
protect against destruction of covered
information due to environmental
hazards would further ensure that
covered information remains available
even following a physical disruption.
Monitoring systems and procedures,
response programs, and measures to
promptly recover and secure any
compromised covered information
would serve to detect unauthorized
access to covered information and to
recover it if the covered entity’s access
to the covered information were
impaired (e.g., through a ransomware
attack).
The proposed rule is modeled after an
approach adopted by prudential
regulators. Since the early 2000s,
prudential regulators have required
financial institutions to consider a
similar list of categories of controls
when designing their information
security programs.130 In adopting their
list of categories, prudential regulators
described them as designed to control
identified risks and to achieve the
overall objective of ensuring the security
and confidentiality of customer
information.131 Prudential regulators
further emphasized that the categories
were broad enough to be adapted by
institutions of varying sizes, scope of
operations, and risk management
structures, such that the manner of
129 Based on its experience, the Commission
further believes that that failures in change
management, systems development, and
vulnerability patching practices are common
sources of disruption among financial institutions
and are often neglected control areas.
130 See Interagency Guidelines Safeguarding
Customer Information, 66 FR 8616; see also 12 CFR
part 30, app. B. The guidelines were expanded and
retitled, ‘‘Interagency Guidelines Establishing
Information Security Standards’’ in 2004, see
Proper Disposal of Consumer Information Under the
Fair and Accurate Credit Transactions Act of 2003,
69 FR 77610 (Dec. 28, 2004).
131 See Interagency Guidelines Safeguarding
Customer Information, 66 FR 8621.
PO 00000
Frm 00015
Fmt 4701
Sfmt 4702
4719
implementing the guidelines would
vary from institution to institution.132
Given that the list of control categories
developed by prudential regulators,
many of which are included in the
Commission’s proposed rule, has a
longstanding history of being effective
and adaptable to the financial industry
at large, the Commission preliminarily
believes that incorporating a similar
approach with respect to covered
entities would also further the
Commission’s intent to adopt a flexible
rule that can be tailored to each
individual covered entity and adapted
over time to respond to changing threat
environments and risk profiles.133
3. Incident Response Plan—Proposed
Paragraph (d)(3)
The proposed rule would require that
the information and technology security
program include a written incident
response plan that is reasonably
designed to detect, assess, contain,
mitigate the impact of, and recover from
an incident.134 A hallmark of
operational resilience is the recognition
that although meaningful steps can be
taken to prevent and deter risks to
information and technology security,
such risks may never be entirely
eliminated.135 As the ION incident
illustrated, quick and complete recovery
of covered technology and operations
may be key to mitigating the potential
systemic impact to the financial
markets. Accordingly, a crucial aspect of
any information and technology security
program, and therefore any ORF, is
having a plan to respond to and recover
from events that may create risks to
information and technology security.136
132 Commenters further supported the level of
detail, see id. at 8622.
133 NIST has compiled a comprehensive catalog of
security and privacy controls for all types of
computing platforms, including general purpose
computing systems, cyber-physical systems, cloud
systems, mobile systems, and Internet of Things
(IoT) devices. See NIST SP 800–53, supra note 123.
134 See paragraph (d)(3) of proposed Commission
regulations 1.13 and 23.603. The Commission is
aware that some covered entities may have
established an incident response plan as a separate
document or as an attachment to another plan, such
as a BCDR plan. If the proposed rule is adopted, the
Commission would be agnostic as to where a
covered entity elects to house its incident response
plan provided it otherwise meets the requirements
of the proposed rule, including recordkeeping,
furnishing it to the Commission upon request, and
distributing it to personnel.
135 See BCBS Operational Resilience Principles,
supra note 12, at 1 (stating that, in recognition that
‘‘the range of potential hazards cannot be
prevented,’’ the focus should be on ‘‘the ability of
banks to withstand, adapt to and recover from
potential hazards and thereby mitigate potentially
severe adverse impacts’’).
136 See, e.g., BCBS Operational Resilience
Principles at 7, n.18 (‘‘The goal of incident
E:\FR\FM\24JAP2.SGM
Continued
24JAP2
4720
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
The Commission believes, therefore,
that an effective incident response plan
would help covered entities minimize
the potential impact to their operations
and customers or counterparties when
negative events occur, facilitating their
recovery as swiftly and successfully as
possible.137 It can also assist in securing
against the destruction or theft of
sensitive and important confidential
customer or counterparty information,
which could have a very real impact on
their business and assets.
For purposes of the proposed rule,
‘‘incident’’ would be defined as any
event, occurrence, or circumstance that
could jeopardize information and
technology security, including if it
occurs at a third-party service
provider.138 The purpose of the incident
response plan is to identify and classify
foreseeable types of incidents and to
establish steps to detect, assess, contain,
mitigate the impact of, and recover from
incidents. The Commission’s proposed
definition of ‘‘incident’’ is intentionally
broad to ensure that the incident
response plan would address any event
that could reasonably jeopardize (i.e.,
endanger or put at risk) information and
technology security, even if that danger
never materializes or the incident
response plan is otherwise successful at
preventing or reversing the danger. As
defined in the proposed rule, ‘‘incident’’
is broad enough to cover various types
of risks to covered technology (e.g.,
disruption or modification) or covered
information (e.g., disclosure or
destruction), regardless of the source
(e.g., external threat actor or internal
staff, physical or electronic) or whether
the event was accidental or malicious in
management is to limit the disruption and restore
critical operations in line with the bank’s risk
tolerance for disruption.’’). See also FFIEC
Information Security Booklet, supra note 69, 50–51
(‘‘containing the incident, coordinating with law
enforcement and third parties, restoring systems,
preserving data and evidence, providing assistance
to customers, and otherwise facilitating operational
resilience’’); NIST, SP 800–184, Guide for
Cybersecurity Event Recovery (Dec. 2016) (NIST SP
800–184) (‘‘evaluate the potential impact, planned
response activities, and resulting recovery processes
long before an actual cyber event takes place’’); CIS,
Incident Response Policy Template: Critical
Security Controls (Mar. 8, 2023) at 4 (‘‘The primary
goal of incident response is to identify threats on
the enterprise, respond to them before they can
spread, and remediate them before they can cause
harm.’’) (CIS Incident Response Template).
137 See FFIEC, CAT at 52 (May 2017) (‘‘The
incident response plan is designed to ensure
recovery from disruption of services, assurance of
data integrity, and recovery of lost or corrupted data
following a cybersecurity incident’’); CPMI IOSCO
Cyber Resilience Guidance, supra note 123, at 16
(recognizing the incident response plan enables the
business ‘‘to resume critical operations rapidly,
safely and with accurate data’’).
138 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘incident’’).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
nature, since intent may not be readily
determined at the outset of an incident.
Common examples of incidents would
include unauthorized access to a system
or data; unauthorized changes to system
hardware, software, or data; or a failure
of controls that could, if not addressed,
endanger information and technology
security.
Consistent with the general
framework for the ORF as a whole, the
proposal would require the incident
response plan to meet certain minimum
requirements.139 In broad terms, these
requirements focus on identifying
persons relevant to an incident response
(i.e., personnel involved in responding
to the incident and persons who should
be notified of such incidents) and how
and when they should be involved;
documenting the nature of the covered
entity’s response; and remediating any
weaknesses that lead to the incident.140
The Commission believes that clearly
identifying parties who would be
involved in incident response,
including external parties like thirdparty service providers and law
enforcement, and establishing
associated roles and responsibilities
would help ensure that incidents are: (1)
resolved in a timely manner and by
appropriate personnel; (2) adequately
resourced financially, operationally, and
staffing-wise; and (3) disclosed to
appropriate persons either within senior
leadership of the covered entity or
externally, where required.141 The
process of documenting incidents and
management’s response, as well as any
subsequent remediation efforts, would
assist with any related reporting
obligations and required information
sharing, as well as with subsequent
testing of the incident response plan or
post-mortem analysis, which would
potentially lead to adjustments in
subsequent risk assessments and
provide lessons learned that could serve
to help prevent the occurrence of
incidents in the future.142
Among these minimum requirements
for the incident response plan is the
need for it to include escalation
protocols, i.e., a process of identifying
139 See paragraphs (d)(3)(i)–(vi) of proposed
Commission regulations 1.13 and 23.603.
140 See id.
141 See also NIST SP 800–61 (‘‘It is important to
identify other groups within the organization that
may need to participate in incident handling so that
their cooperation can be solicited before it is
needed. Every incident response team relies on the
expertise, judgment, and abilities of others . . .’’).
142 See NIST SP 800–184, supra note 132; CIS
Incident Response Template, supra note 136, at 4
(‘‘Without understanding the full scope of an
incident, how it happened, and what can be done
to prevent it from happening again, defenders will
just be in a perpetual ‘whack-a-mole’ pattern.’’).
PO 00000
Frm 00016
Fmt 4701
Sfmt 4702
when to involve or alert specific
personnel, including senior leadership,
of an incident.143 Specifically, the
proposed rule would require that the
senior officer, oversight body, or other
senior-level official that has primary
responsibility for overseeing the
information and technology security
program; the Chief Compliance Officer
(CCO); 144 and any other relevant
personnel be timely informed of
incidents that may significantly impact
the covered entity’s regulatory
obligations or require notification to the
Commission.145 This provision is
designed to ensure that every individual
who has a role in responding to an
incident at a covered entity would be
appropriately notified. CCOs of covered
entities in particular have a duty to take
reasonable steps to ensure compliance
with Commission regulations relating to
the covered entities’ business as a
covered entity.146 Timely disclosure of
incidents to the CCO that could impact
a covered entity’s regulatory obligations
or require disclosure to the Commission
would therefore be crucial for a covered
entity CCO to fulfill the duty to take
reasonable steps to ensure compliance.
As previously discussed above in the
section addressing governance, the
Commission believes that involving
senior leadership in incident response
would be particularly important to
ensure that they are apprised of and
held accountable for the ultimate
effectiveness of the ORF, and that
incidents receive proper attention and
are swiftly addressed.
4. Request for Comment
The Commission invites comment on
all aspects of the proposed information
and technology security program
requirement, including the following
questions:
1. Risk Assessment.
a. The proposed rule would require
that the risk assessment be provided to
relevant senior leadership of the
covered entity upon its completion but
would not require that such senior
leadership certify in writing that they
have received the results of the risk
assessment or approve the results of the
risk assessment. Such approvals and
certifications may be required in other
contexts to ensure that senior leadership
143 See paragraph (d)(3)(ii) of proposed
Commission regulations 1.13 and 23.603.
144 See 17 CFR 3.3 (establishing the qualifications
and duties of covered entity CCOs).
145 See paragraph (d)(3)(ii) of proposed
Commission regulations 1.13 and 23.603. See also
paragraph (i) of proposed Commission regulations
1.13 and 23.603 (requiring notification of certain
incidents to the Commission), discussed in section
II.H of this release, infra.
146 See 17 CFR 3.3(d)(3).
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
is aware of risk assessments and
consider them in establishing strategic
goals, risk appetite, and risk tolerance
limits. Should the Commission require
such a certification or approval? Why or
why not? Please explain.
b. Given the rapidly evolving
technological and threat landscape, the
proposed rule would require risk
assessments to be performed on at least
an annual basis to support the
mitigation of systemic risk and develop
a strong baseline standard across
covered entities. The Commission is
aware of standards imposing risk
assessments as frequently as every six
months and as infrequently as every two
years. Should the Commission consider
a shorter or longer baseline frequency
for risk assessments? Why or why not?
Please explain.
2. Effective controls. The proposed
rule would require covered entities to
consider broad categories of controls
and determine which to adopt
consistent with the proposed (b)(3)
standard. The Commission is also aware
that certain controls, including
firewalls, antivirus, and multifactor
authentication (MFA) are commonly
recommended within the industry. With
respect to MFA, which requires users to
present two or more authentication
factors at login to verify their identity
before they are granted access, CISA
advises that implementing MFA is
important because it makes it more
difficult for threat actors to gain access
to information systems, even if
passwords or PINs are compromised
through phishing attacks or other
means.147 In 2021, FFIEC issued
guidance advising financial institutions
that MFA or controls of equivalent
strength, including for those employees,
could help more effectively mitigate
risks when a financial institution’s risk
assessment indicates that single-factor
authentication with layered security is
inadequate.148 The guidance added that
MFA factors, which may include
memorized secrets, look-up secrets, outof-band devices, one-time-password
devices, biometrics identifiers, and
cryptographic keys, can vary in terms of
147 CISA, Multi-Factor Authentication Fact Sheet
(Jan. 2022), available at https://www.cisa.gov/sites/
default/files/publications/MFA-Fact-Sheet-Jan22508.pdf. NIST defines MFA as ‘‘[a]n authentication
system that requires more than one distinct
authentication factor for successful authentication.
Multi-factor authentication can be performed using
a multi-factor authenticator or by a combination of
authenticators that provide different factors. The
three authentication factors are something you
know, something you have, and something you
are.’’ NIST, SP 800–63–3, Digital Identity
Guidelines at 49 (June 2017).
148 FFIEC, Authentication and Access to Financial
Institution Services and Systems at 7 (rev. Jan. 5,
2022).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
usability, convenience, and strength and
their ability to be exploited.149 That
same year, the Federal Trade
Commission updated its rule for
safeguarding customer information to
mandate financial institutions to adopt
MFA for all users.150 The Commission
preliminarily believes that requiring
covered entities to implement such
widely recommended controls, such as
and including MFA, would help reduce
cyber security risks and clarify
expectations. Should the Commission
mandate the use of any specific
controls, including firewalls, antivirus,
and/or MFA? Why or why not? Please
explain.
3. Incident response plan. As
proposed, covered entities would be
required to notify their CCOs of
incidents that they have determined
may significantly impact regulatory
obligations or require notification to the
Commission. Commission staff are
aware of instances where covered entity
CCOs have not been notified of
incidents sufficiently early to play a
meaningful role in determining whether
the incident implicates any CFTC
requirements and in developing an
appropriate remediation plan. Should
covered entities be required to notify
their CCOs of all incidents, only
incidents that may require notification
under the proposed rule, or incidents
that may require notification under the
proposed rule to other financial
regulatory authorities? Why or why not?
D. Third-Party Relationship Program—
Proposed Paragraph (e)
The second program required to be
included as part of the proposed ORF
would be a third-party relationship
program, defined as a written program
reasonably designed to identify,
monitor, manage, and assess risks
relating to third-party relationships that
meets the requirements of the proposed
rule.151 The Commission understands
that covered entities currently routinely
rely upon third parties for a wide
variety of products, services, and
activities, including, for example,
information technology, counterparty or
customer relationship management,
accounting, compliance, human
149 Id.
150 See Standards for Safeguarding Customer
Information, 86 FR 70272 (Dec. 9, 2021); see also
16 CFR 314.4(c)(5) (requiring financial intuitions to
‘‘[i]mplement multi-factor authentication for any
individual accessing any information system unless
[a qualified individual, as defined in the rule] has
approved in writing the use of reasonably
equivalent or more secure access controls.’’).
151 See paragraph (e) of proposed Commission
regulations 1.13 and 23.603. See also paragraph (a)
of proposed regulations 1.13 and 23.603 (defining
‘‘third-party relationship program’’).
PO 00000
Frm 00017
Fmt 4701
Sfmt 4702
4721
resources, margin processing, trading,
and risk management. Reliance on thirdparty service providers carries many
potential benefits, including a reduction
in operating costs and access to
technological advancements that can
improve operations and regulatory
compliance.152
But that reliance is not riskless.153 As
the ION incident illustrated, operational
disruptions of third-party services,
particularly of those important to a
firm’s operations or regulatory
obligations, can present challenges for
individual firms and even the financial
system as a whole.154 The risks may
vary from minor to significant,
depending on the nature of the provider
or the service being rendered, but they
are inherent in the nature of a thirdparty service provider relationship, in
which a firm relies on the performance
of another entity and the quality and
reliability of that performance is not in
the direct control of the firm.155 The
Commission accordingly believes that,
in order to support their operational
resilience, covered entities should have
a plan in place to identify, monitor,
manage, and assess the risks associated
with third-party relationships.156
152 See Prudential Third-Party Guidance, 88 FR
37927 (‘‘The use of third parties can offer banking
organizations significant benefits, such as access to
new technologies, human capital, delivery
channels, products, services, and markets.’’); IOSCO
Outsourcing Report, supra note 65, at 4 (‘‘The
benefits of outsourcing include lowering costs,
increasing automation to speed up tasks and reduce
the need for manual intervention, and providing
flexibility to allow regulated entities to rapidly
adjust both to the scope and scale of their
activities.’’); FFIEC, Information Technology
Examination Handbook, Outsourcing Technology
Services Booklet at 1 (June 2004) (‘‘The ability to
contract for technology services typically enables an
institution to offer its customers enhanced services
without the various expenses involved in owning
the required technology or maintaining the human
capital required to deploy and operate it.’’).
153 See Prudential Third-Party Guidance, 88 FR
37927 (‘‘[T]he use of third parties can reduce a
banking organization’s direct control over activities
and may introduce new risks or increase existing
risks, such as operational, compliance, and strategic
risks.’’).
154 See supra note 20 and accompanying text.
155 See Prudential Third-Party Guidance, 88 FR
37927 (‘‘Increased risk often arises from greater
operational or technological complexity, newer or
different types of relationships, or potential inferior
performance by the third party. A banking
organization can be exposed to adverse impacts,
including substantial financial loss and operational
disruption, if it fails to appropriately manage the
risks associated with third-party relationships.’’).
156 For purposes of the proposed rule, the
Commission would construe ‘‘third-party service
provider’’ broadly and consistently with the terms
‘‘third-party’’ and ‘‘business arrangement’’ as used
in the Prudential Third-Party Relationship
Guidance. See id. (‘‘Third-party relationships can
include, but are not limited to, outsourced services,
use of independent consultants, referral
arrangements, merchant payment processing
E:\FR\FM\24JAP2.SGM
Continued
24JAP2
4722
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
As mentioned above, the Commission
appreciates that the risks presented by
individual third-party relationships may
vary depending on the firm, the
provider, or service. For instance, risks
may be more elevated if the service
provider is a new entrant to the
marketplace or the service relates to a
new, untested technology, and covered
entities with more numerous or intricate
third-party relationships may
experience greater overall risk from
third parties by virtue of the number
and complexity of their relationships.
Accordingly, the proposed rule would
not require third-party relationship
programs to apply an identical degree of
scrutiny and oversight to all third-party
relationships. Instead, consistent with
the principles-based focus of the
proposed rule, and the proposed (b)(3)
standard, the Commission would expect
covered entities to adopt a third-party
relationship program that helps them
identify and assess the risks of their
existing and future third-party
relationships and adapt their risk
management practices consistent with
those risks, their risk appetite and risk
tolerance limits, and the nature, size,
scope, complexity, and risk profile of
their business activities, following
generally accepted standards and best
practices.157
ddrumheller on DSK120RN23PROD with PROPOSALS2
1. Third-Party Relationship Lifecyle
Stages—Proposed Paragraph (e)(1)
To guide covered entities in
developing their third-party relationship
programs, and to ensure that the
programs address the full scope of risks
that third-party relationships can
present, the proposed rule would
require the third-party relationship
program to describe how the covered
entity would address the risks attendant
to each stage of the third-party
relationship lifecycle.158 Specifically,
the proposed rule would require the
services, services provided by affiliates and
subsidiaries, and joint ventures. Some banking
organizations may form third-party relationships
with new or novel structures and features—such as
those observed in relationships with some financial
technology (fintech) companies.’’).
157 See paragraph (b)(3) of proposed Commission
regulations 1.13 and 23.603. See also NFA ThirdParty Notice, supra note 43 (‘‘NFA recognizes that
a Member must have flexibility to adopt a written
supervisory framework relating to outsourcing
functions to a Third-Party Service Provider that is
tailored to a Member’s specific needs and business
. . .’’); Prudential Third-Party Guidance, 88 FR
37924 (‘‘[I]t is the responsibility of the banking
organization to identify and evaluate the risks
associated with each third-party relationship and to
tailor its risk management practices, commensurate
with the banking organization’s size, complexity,
and risk profile, as well as with the nature of its
third-party relationships.’’).
158 See paragraph (e)(1) of proposed Commission
regulations 1.13 and 23.603.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
program to address: (i) pre-selection risk
assessment; (ii) the due diligence
process for prospective third-party
relationships; 159 (iii) contractual
negotiations; (iv) ongoing monitoring
during the course of the relationship;
and (v) termination of the relationship,
including preparations for planned and
unplanned terminations.160
Each of these stages offers covered
entities opportunities to assess and take
steps to mitigate the potential risks
associated with reliance on third-party
service providers. At the outset, covered
entities should determine whether it is
appropriate for a third-party service
provider to perform a particular service
and evaluate the associated risks.161 For
instance, the determination to secure a
third-party service provider may carry
greater risks where the service directly
impacts a regulatory requirement, where
the third-party service provider would
be given direct access to covered
information, or where a disruption of
services could impact regulatory
compliance or have a negative impact
on customers or counterparties. Due
diligence provides covered entities with
information to assess whether a
prospective third-party service provider
is equipped, operationally and
otherwise, to perform as expected.162
159 The proposed rule is not intended to interfere
with the obligation in Commission regulation
1.11(e) for FCMs to conduct onboarding and
ongoing due diligence on depositories carrying
customer funds. See 17 CFR 1.11(e)(3)(i)(A)–(B).
160 See paragraphs (e)(1)(i)–(v) of proposed
Commission regulations 1.13 and 23.603. See also
NFA Third-Party Notice (requiring NFA members to
establish a written supervisory framework that
includes an initial risk assessment, onboarding due
diligence, ongoing monitoring, termination, and
recordkeeping); 12 CFR part 30, app. B, III.D.
(Oversee Service Provider Arrangements) (requiring
financial institutions to exercise appropriate due
diligence in selecting service providers, contract
with service providers to implement ‘‘appropriate
measures designed to meet the objectives of’’
prudential guidelines for information security; and,
where indicated by its risk assessment, monitor
service providers to confirm they have satisfied
their obligations).
161 See NFA Third-Party Notice (‘‘At the outset,
a Member should determine whether a particular
regulatory function is appropriate to outsource and
evaluate the risks associated with outsourcing the
function.’’); Prudential Third-Party Guidance, 88 FR
37928 (‘‘As part of sound risk management,
effective planning allows a banking organization to
evaluate and consider how to manage risks before
entering into a third-party relationship.’’).
162 See IOSCO Outsourcing Report, supra note 65,
at 18 (‘‘It is important that regulated entities
exercise due care, skill, and diligence in the
selection of service providers. The regulated entity
should be satisfied that the service provider has the
ability and capacity to undertake the provision of
the outsourced task effectively at all times.’’);
Prudential Third-Party Guidance, 88 FR 37929
(‘‘Conducting due diligence on third parties before
selecting and entering into third-party relationships
is an important part of sound risk management. It
provides management with the information needed
about potential third parties to determine if a
PO 00000
Frm 00018
Fmt 4701
Sfmt 4702
Contractual negotiations offer a
possibility to mitigate potential risks by
including provisions to assign specific
responsibilities or liabilities, but may
also contribute to risks, especially
where a covered entity may have more
limited negotiating power.163 Ongoing
monitoring of a third-party service
provider’s performance likewise aids
covered entities in identifying whether
selected third-party service providers
remain able to perform as expected
throughout the duration of the
relationship.164 Finally, the manner in
which the relationship ends can have a
major impact on the covered entity,
particularly if it ends due to a breach of
performance. Plans to address the
termination, through contingencies or
otherwise, could therefore prove
important to ensuring the covered
entity’s ongoing operations.165 The
Commission therefore preliminarily
believes that effective management of
third-party risks would require covered
entities to have a program that
establishes methodologies and practices
to assess and manage the risks of thirdparty relationships throughout each of
these five stages of the third-party
relationship lifecycle.166
2. Heightened Requirements for Critical
Third-Party Service Providers—
Proposed Paragraph (e)(2)
Although the Commission appreciates
that third-party risks are not uniform, it
nevertheless believes that certain
circumstances warrant enhanced risk
management practices across all covered
entities. Specifically, the proposed rule
would require that the third-party
relationship program establish
heightened due diligence and ongoing
relationship would help achieve a banking
organization’s strategic and financial goals. The due
diligence process also provides a banking
organization with the information needed to
evaluate whether it can appropriately identify,
monitor, and control risks associated with the
particular third-party relationship.’’).
163 See IOSCO Outsourcing Report at 21
(‘‘Contractual provisions can reduce the risks of
non-performance or aid the resolution of
disagreements about the scope, nature, and quality
of the service to be provided.’’).
164 See id. at 18 (‘‘The regulated entity should
also establish appropriate processes and procedures
for monitoring the performance of the service
provider on an ongoing basis to ensure that it
retains the ability and capacity to continue to
provide the outsourced task.’’).
165 See id. at 33 (‘‘Where a task is outsourced,
there is an increased risk that the continuity of the
particular task in terms of daily management and
control of that task, related information and data,
staff training, and knowledge management, is
dependent on the service provider continuing in
that role and performing that task.’’).
166 See Prudential Third-Party Guidance, 88 FR
37928 (‘‘Effective third-party risk management
generally follows a continuous life cycle for thirdparty relationships.’’).
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
monitoring practices with respect to
third-party service providers deemed
critical third-party service providers.167
The proposed rule would define
‘‘critical third-party service provider’’ to
mean a third-party service provider, the
disruption of whose performance would
be reasonably likely to either (a)
significantly disrupt a covered entity’s
businesses operations or (b)
significantly and adversely impact the
covered entity’s counterparties or
customers.168 The Commission
understands that it is common practice
for financial institutions, whether by
regulatory mandate or otherwise, to
identify a subset of services or providers
more central to their operations and
apply greater scrutiny and oversight to
them to ensure the services are provided
without disruption. The proposed rule’s
definition of ‘‘critical third-party service
provider’’ focuses on the potential
impact a disruption to performance
would have on the covered entity’s
regulated business operations,
customers, or counterparties. Where
such an impact would be significant, as
assessed in light of the covered entity’s
business activities, risk appetite, and
risk tolerance limits, the Commission
believes heightened due diligence for
potential critical third-party service
providers and ongoing monitoring for
onboarded critical third-party service
providers are warranted to both mitigate
the potential for such an occurrence and
to promote the ability for covered
entities to take early and effective action
if a critical third-party service provider’s
performance is disrupted to mitigate the
impact and effectively recover.169
ddrumheller on DSK120RN23PROD with PROPOSALS2
3. Third-Party Service Provider
Inventory—Proposed Paragraph (e)(3)
To help ensure that covered entities
implement a comprehensive and
consistent approach to identifying their
critical third-party service providers,
covered entities would be required to
create, maintain, and regularly update
an inventory of third-party service
providers they have engaged to support
their activities as a covered entity,
identifying whether each third-party
service provider in the inventory is a
167 See paragraph (e)(2) of proposed Commission
regulations 1.13 and 23.603.
168 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘critical
third-party service provider’’).
169 See NFA Third-Party Notice, supra note 43
(‘‘Additionally, a Member’s onboarding due
diligence process should be heightened for ThirdParty Service Providers that obtain or have access
to a Member’s critical and/or confidential data and
those that support a Member’s critical regulatoryrelated systems (e.g., handling customer segregated
funds, keeping required records, filing financial
reports, etc.).’’).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
critical third-party service provider.170
The Commission preliminarily believes
that the process of creating an inventory
of service providers, particularly the
deliberative process involved in
designating certain providers as critical
third-party service providers, would
help covered entities assess and
evaluate the risks they face from their
third-party service providers, and
determine when to apply heightened
monitoring. Maintaining such an
inventory would also reflect that not all
third-party service providers present the
same level and types of risks to a
covered entity, and would help covered
entities assess and evaluate who is
providing services and the attendant
risk that any disruption of those services
would have on a covered entity’s
business. The inventory would also
provide covered entities a holistic view
of their third-party service providers,
which would help them better
understand how risks identified during
due diligence and ongoing monitoring
may interact or require additional
management. Having a clear
understanding of who is providing
services, particularly those services
identified as critical, would further
assist covered entities in identifying
potential interconnections that may not
be readily apparent if the entities are not
assembled and reviewed collectively.171
Covered entities relying on a
consolidated third-party relationship
program would be able to rely on an
enterprise-wide third-party service
provider inventory provided that the
inventory meets the requirements of the
proposed rule, including identifying
critical third-party service providers
specific to the covered entity.172
4. Retention of Responsibility—
Proposed Paragraph (e)(3)
For the avoidance of doubt, the
proposed rule would make clear that,
notwithstanding their determination to
rely on a third-party service provider,
covered entities remain responsible for
meeting their obligations under the CEA
and Commission regulations.173 This
provision reflects the principle, widely
recognized among financial regulatory
170 See paragraph (e)(3) of proposed Commission
regulations 1.13 and 23.603.
171 Prudential Third-Party Guidance, 88 FR 37927
(‘‘Maintaining a complete inventory of its thirdparty relationships and periodically conducting risk
assessments for each third-party relationship
supports a banking organization’s determination of
whether risks have changed over time and to update
risk management practices accordingly.’’).
172 See paragraph (c)(4)(i) of proposed
Commission regulations 1.13 and 23.603 (allowing
covered entities to rely on consolidated programs).
173 See paragraph (e)(3) of proposed Commission
regulations 1.13 and 23.603.
PO 00000
Frm 00019
Fmt 4701
Sfmt 4702
4723
authorities, including the Commission,
that while financial institutions may be
able to delegate functions to third-party
service providers, they cannot delegate
their responsibility to comply with
applicable laws and regulations.174 This
provision is intended to ensure that
covered entities are aware that they
remain responsible for the performance
of all applicable regulatory functions,
whether performed by the covered
entity or by a third-party service
provider, and are accordingly fully
subject to the Commission’s
jurisdiction, including its examination
and enforcement authorities.
5. Application to Existing Third-Party
Relationships
Should the proposed rule be adopted
as final, the Commission would expect
covered entities to apply their thirdparty relationship programs across all
stages of the relationship lifecycle on a
going-forward basis. Although the
Commission would not require covered
entities to renegotiate or terminate
existing agreements, it would expect
covered entities to conduct ongoing
monitoring of existing third-party
service providers consistent with the
program and this regulation and, to the
extent possible, to rely on its program
with respect to termination. For any
third-party service providers
contemplated or onboarded after the
effective date of the proposed rule, or
for any contracts renegotiated or
renewed after the effective date of the
rule, however, the Commission would
expect covered entities to apply the
entirety of the third-party relationship
program from pre-selection through
termination.
174 See NFA Third-Party Notice, supra note 43
(‘‘If a Member outsources a regulatory function,
however, it remains responsible for complying with
NFA and/or CFTC Requirements and may be
subject to discipline if a Third-Party Service
Provider’s performance causes the Member to fail
to comply with those Requirements.’’); Prudential
Third-Party Guidance, 88 FR 37927 (‘‘A banking
organization’s use of third parties does not diminish
its responsibility to meet these requirements to the
same extent as if its activities were performed by
the banking organization in-house.’’); IOSCO
Outsourcing Report, supra note 65, at 12 (‘‘The
regulated entity retains full responsibility, legal
liability, and accountability to the regulator for all
tasks that it may outsource to a service provider to
the same extent as if the service were provided inhouse.’’). See also 17 CFR 37.204 (SEFs); 17 CFR
38.154 (DCMs); 17 CFR 39.18(d) (DCOs) (providing
that such registered entities retain responsibility for
meeting relevant regulatory requirements when
entering into contractual outsourcing
arrangements).
E:\FR\FM\24JAP2.SGM
24JAP2
4724
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
6. Guidance on Third-Party Relationship
Programs—Proposed Paragraph (e)(4);
Appendix A to Part 1; Appendix A to
Subpart J of Part 23
To assist covered entities in
developing third-party relationship
programs that adequately address risks
from third-party relationships, the
Commission is proposing guidance
outlining potential risks, considerations,
and strategies for covered entities to
consider.175 The proposed guidance
addresses all five stages of the
relationship lifecycle and, if adopted,
would be codified as appendices to
parts 1 and 23 of the Commission’s
regulations for FCMs and swap entities,
respectively.176 Designed to be broadly
applicable to all covered entities, the
proposed guidance identifies actions
and factors for covered entities to
consider. The factors and actions
identified are not exhaustive, nor
should they be viewed as a required
checklist. The nonbinding guidance
would merely be intended to aid
covered entities as they design thirdparty relationship programs tailored to
their own unique circumstances,
consistent with the general ORF
‘‘appropriate and proportionate
standard’’ discussed above.
In developing the proposed guidance,
the Commission considered the
recommendations of international
standard-setting bodies, including
IOSCO and FSB, in light of observations
and lessons derived from its own
oversight activities.177 In an effort to
incorporate as much consensus as
possible, the Commission also gave
special consideration to existing
guidance from NFA and the guidance on
third-party relationships recently
adopted by prudential regulators, both
of which currently apply to at least
some covered entities.178
The full text of the guidance is
included at the end of this notice as
proposed appendix A to part 1 for FCMs
and proposed appendix A to subpart J
of part 23. The guidance is identical in
substance for FCMs and swap entities.
ddrumheller on DSK120RN23PROD with PROPOSALS2
7. Request for Comment
The Commission invites comment on
all aspects of the proposed third-party
relationship program requirement and
associated guidance, including the
following questions:
1. Scope of Application. NFA’s
interpretive notice on third-party
relationships is limited in scope to
‘‘outsourcing,’’ which NFA defines as
third-party relationships in which an
NFA member has a third-party service
provider or vendor perform certain
functions that would otherwise by
undertaken by the member itself to
comply with NFA and CFTC
requirements.179 The proposed rule
would follow the approach taken by
prudential regulators in their third-party
guidance, which more broadly
addresses any circumstances where
banking organizations rely on third
parties for products, services, or
activities to ‘‘capture[ ] the full range of
third-party relationships that may pose
risk to banking organizations.’’ 180
Should the Commission consider
limiting the scope of its guidance to
outsourcing of CFTC regulatory
obligations? Why or why not? Please
explain.
2. Critical third-party service provider.
The proposed rule includes a definition
of ‘‘critical third-party service
provider.’’ The Commission
understands it is common practice for
financial institutions to identify and
apply heightened oversight of thirdparty service providers they deem
critical. NFA’s interpretive notice
related to third-party relationships, for
instance, advises members to tailor the
frequency and scope of ongoing
monitoring reviews to the criticality of
and risk associated with the outsourced
function but does not define
‘‘criticality’’ for covered entities. Is the
Commission’s proposed definition
consistent with existing standards or
definitions of ‘‘criticality’’ applied by
covered entities? If not, how is it
different? Should the Commission
consider allowing covered entities to
generate and apply their own definition
of ‘‘critical third-party service
provider’’? Why or why not? Please
explain.
3. Guidance—Affiliated Third-Party
Service Providers. The proposed thirdparty relationship program requirement
would apply to all third-party
relationships, including where the
third-party is an affiliate of the covered
entity. This position is consistent with
both NFA and prudential guidance
related to third-party relationships.181
179 See
175 See
paragraph (e)(4) of proposed Commission
regulations 1.13 and 23.603.
176 See proposed Appendix A to part 1 and
proposed Appendix A to Subpart J of part 23.
177 See IOSCO Outsourcing Report, supra note 65;
FSB Third-Party Report, supra note 44.
178 See NFA Third-Party Notice; Prudential ThirdParty Guidance, 88 FR 37920.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
NFA Third-Party Notice, supra note 43.
Prudential Third-Party Guidance, 88 FR
37921–22.
181 See NFA Third-Party Notice at n.1 (‘‘Further,
even if a Member outsources a regulatory obligation
to an affiliate, . . . a Member should comply with
this Notice’s requirements.’’); Prudential ThirdParty Guidance, 88 FR 37927 (‘‘Third-party
relationships can include, but are not limited to,
180 See
PO 00000
Frm 00020
Fmt 4701
Sfmt 4702
Nevertheless, the Commission
recognizes that arrangements with
affiliates may present different or lower
risks than with unaffiliated third
parties. Should the Commission
consider including any additional
guidance with respect to the
management of third-party service
providers that are affiliated entities? If
so, what factors should covered entities
consider when evaluating relationships
with affiliated third-party service
providers?
4. Guidance—Due Diligence. The
proposed guidance recommends that
covered entities perform due diligence
on prospective third-party service
providers to assess their ability to
deliver contracted services to an
acceptable standard (i.e., consistent
with risk appetite and risk tolerance
limits) and provides examples of
information that covered entities should
review and sources for obtaining that
information.
a. Are there any additional due
diligence tasks that should be
conducted by the covered entity beyond
reviewing information about the
potential third-party service provider?
Are there additional risks that should be
included in the guidance for the covered
entity to inquire into? If yes, please
identify and explain.
b. Are there additional sources of due
diligence information beyond those
listed in the guidance (see section B of
the guidance) that should be included in
the guidance? If yes, please identify and
explain.
c. Should covered entities be advised
to periodically refresh their due
diligence, or upon the occurrence of
specific triggers (e.g., a material change
to the service outsourced)? Why or why
not? Would such a recommendation be
duplicative of the covered entity’s
ongoing monitoring activities, or would
the subsequent due diligence provide
additional valuable information to the
covered entity beyond that provided by
ongoing monitoring? Why or why not?
Please explain.
d. The proposed guidance does not
recommend that covered entities
perform due diligence directly on any
subcontractors secured by third-party
service providers. Rather, the
Commission’s guidance suggests that
covered entities review the operational
risk management practices of the
potential third-party service provider
with respect to their subcontractors.
Should the Commission recommend
more enhanced due diligence of
subcontractors? Why or why not? What
. . . services provided by affiliates and
subsidiaries. . .’’).
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
means are practicable for covered
entities to conduct due diligence on
subcontractors to their third-party
service providers? Please identify and
explain.
E. Business Continuity and Disaster
Recovery Plan—Proposed Paragraph (f)
The third component of the ORF
would be a business continuity and
disaster recovery (BCDR) plan, defined
as a written plan outlining the
procedures to be followed in the event
of an emergency or other significant
disruption to the continuity of a covered
entity’s normal business operations and
that meets the requirements of the
proposed rule.182 Similar to the incident
response plan (and, in extreme cases,
possibly triggered by an incident
covered by the incident response plan),
the proposed BCDR plan requirement
recognizes the operational reality that
not all operational disruptions can be
prevented or immediately mitigated and
asks covered entities to strategize and
implement plans for how to minimize
the impact to operations, customers, and
counterparties when such adverse
events occur.
Although NFA requires FCMs to
establish and maintain a BCDR plan, if
adopted, the proposed rule would create
a new CFTC BCDR plan requirement for
FCMs.183 Current Commission
regulation 23.603 contains an active
BCDR plan requirement for swap
entities.184 In essence, the proposal
would make certain amendments to the
CFTC BCDR plan requirement for swap
entities and expand the requirement to
include FCMs. The proposed
amendments to the swap entity BCDR
plan requirement have two general
purposes. For the most part, the
proposal would streamline and simplify
some of the language to help it further
conform to the proposed ORF rule more
broadly, in ways the Commission
intends to be non-substantive. The
proposal would also make a few
substantive changes, informed either by
the Commission’s review of NFA’s and
CME’s current BCDR requirements for
their members or by its decade of
experience applying current
Commission regulation 23.603 to swap
entities.185 The proposed substantive
changes, each subsequently discussed in
this notice, relate to either the defined
182 See paragraph (f) proposed Commission
regulations 1.13 and 23.603. See also paragraph (a)
of proposed Commission regulations 1.13 and
23.603 (defining ‘‘business continuity and disaster
recovery plan’’).
183 See NFA Rule 2–38, supra note 43.
184 See 17 CFR 23.603.
185 See NFA Rule 2–38; CME Rule 983 (Disaster
Recovery and Business Continuity).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
scope of and recovery objective for the
BCDR plan or the testing and audit
requirements for the plan.
Current Commission regulation
23.603 includes requirements that the
proposed rule would apply to the
entirety of the proposed ORF more
broadly. Those requirements include
requirements to: distribute the BCDR
plan to relevant employees (current
Commission regulation 23.603(c));
notify the Commission of emergencies
or disruptions (current Commission
regulation 23.603(d)); identify
emergency contacts (current
Commission regulation 23.603(e));
review, test, and update the BCDR plan
(current Commission regulation
23.603(f) and (g)); and recordkeeping
(current Commission regulation
23.603(i)). Each of these requirements is
discussed in the relevant sections of this
notice that follow.186 Accordingly, the
Commission’s proposed amendment to
the current BCDR audit requirement is
discussed in the context of the ORF’s
broader proposed review and testing
requirements.187
1. Definition of ‘‘Business Continuity
and Disaster Recovery Plan’’
The proposed definition of ‘‘business
continuity and disaster recovery plan’’
is slightly modified from the language in
the current BCDR plan requirement for
swap entities. Current Commission
regulation 23.603 requires swap entities
to establish and maintain a BCDR plan
that ‘‘outlines the procedures to be
followed in the event of an emergency
or other disruption of its normal
business activities.’’ 188 As stated above,
the proposed rule would specify that the
BCDR plan would need to address
‘‘significant’’ disruptions to the
continuity of a covered entity’s normal
business operations, which the
Commission preliminarily believes is
more in line with what would constitute
an ‘‘emergency’’ that would result in
activation of a BCDR plan and how
Commission regulation 23.603 has
operated in practice.189
186 See sections II.F (Training), G (Review and
Testing), H (Required Notifications), and I
(Emergency Contacts, Recordkeeping) of this notice,
infra. The proposed rule would not retain
Commission regulation 23.603(h), which merely
articulates the fact that swap entities are required
to comply with Commission’s BCDR requirements
in addition to any other applicable BCDR
requirements from other regulatory bodies. See 17
CFR 23.603(h). The Commission accordingly views
this amendment as non-substantive.
187 See paragraph (h) of proposed Commission
regulations 1.13 and 23.603 and section II.G, infra.
188 See 17 CFR 23.603(a).
189 See also NFA Rule 2–38, supra note 43
(requiring certain members, including FCMs, to
establish a BCDR plan to be followed in the event
of a ‘‘significant business disruption’’). The
PO 00000
Frm 00021
Fmt 4701
Sfmt 4702
4725
2. Purpose—Proposed Paragraph (f)(1)
Under the proposed rule, the BCDR
plan would need to be reasonably
designed to enable covered entities to:
(i) continue or resume normal business
operations with minimal disruption to
customers or counterparties and the
markets and (ii) recover and make use
of all covered information, as well as
any other data, information, or
documentation required to be
maintained by law and regulation.190
The Commission preliminarily believes
that this standard, which emphasizes
the need to quickly resume regulated
activities and to recover all information
kept and required to be kept in
connection with those activities,
supports the overall regulatory
objectives of the ORF rule of enhancing
the operational resilience of covered
entities to promote the protection of
customers and the mitigation of system
risk.
Current Commission regulation
23.603 requires swap entities’ BCDR
plans to ‘‘be designed to enable the
[swap entity] to continue or to resume
any operations by the next business day
with minimal disturbance to its
counterparties and the market.’’ The
proposed rule would modify this
language by requiring that the BCDR
plan be ‘‘reasonably’’ designed to
continue or resume operations with
minimal disruption and by removing
the requirement that such operations be
resumed ‘‘by the next business day.’’ 191
The Commission views the qualification
that the BCDR plan be ‘‘reasonably’’
designed as simply a more concrete
expression of the Commission’s current
expectations, in recognition that what
might be necessary to achieve recovery
is not an absolute fact and may vary
depending on the circumstances,
including the nature, size, scope,
complexity, and risk profile of a covered
entity’s business activities.192 The
proposed language change from ‘‘normal business
activities’’ to ‘‘the continuity of normal business
operations’’ is intended only to bring the language
more in line with the focus of the proposed ORF
rule on the resiliency of operations and is not
intended to have substantive effect. See paragraph
(a) of proposed Commission regulations 1.13 and
23.603 (defining ‘‘business continuity and disaster
recovery plan’’); 17 CFR 23.603(a).
190 See paragraphs (f)(1)(i)–(ii) of proposed
Commission regulations 1.13 and 23.603. See also
17 CFR 23.603(a).
191 The Commission views the use of the phrase
‘‘minimal disturbance’’ in current Commission
regulation 23.603 as equivalent to the phrase
‘‘minimal disruption’’ in the proposed rule and
therefore views this change in language with
respect to swap entities to be non-substantive.
Compare 17 CFR 23.603(a) with paragraph (f)(1) of
proposed Commission regulations 1.13 and 23.603.
192 See also NFA Rule 2–38 (requiring BCDR
plans be ‘‘reasonably designed’’) (emphasis added).
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
4726
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
reasonableness of the plan would thus
be viewed in light of the proposed (b)(3)
standard (i.e., what is appropriate and
proportional to the covered entity,
following generally accepted standards
and best practices).
The proposal not to include a next
business day recovery time objective is
based in the Commission’s preliminary
view that, depending on the
circumstances, a next business day
recovery standard could be either too
short or too long, to the point where it
may be misdirecting the focus of the
rule. The Commission understands that
the ‘‘next business day’’ standard has
been common for businesses to employ
for BCDR purposes in the context of
purely physical disasters, such as power
outages or natural disasters. Based on its
experience in recent years, however, the
Commission believes a next-day
standard may in some cases be
impractical in an era where rapid
innovation has deepened and expanded
reliance on technology among financial
institutions, and pandemics and
cyberattacks have become more
prevalent or alarming forms of
disruption. With the ION incident, for
instance, it took weeks before back
office operations were back to normal.
Nevertheless, the impact to customers
and the markets during that time was
manageable. Were even one business
day to stretch between FCMs paying and
collecting margin, for example, the
Commission does not believe the impact
to customers or the markets could be
characterized as minimal.
Accordingly, the Commission
preliminarily believes that by not
including a precise recovery time
objective, such as next business day, the
emphasis of the proposed BCDR plan
standard appropriately lies on ensuring
that any disruption to customers,
counterparties, and the markets is
‘‘minimal.’’ 193 For that standard to be
met, however, the Commission would
still expect covered entities to plan for
a recovery that is expeditious. The
longer a covered entity is not operating
as usual, the more likely it is that
customers and counterparties may be
affected and that a crisis in confidence
could develop, potentially affecting the
industry more broadly.
Current Commission regulation
23.603 requires swap entities’ BCDR
plans to be designed ‘‘to recover all
documentation and data required to be
maintained by applicable law and
regulation.’’ The proposal to require
193 The Commission notes that neither NFA nor
CME includes a specific recovery time objective in
its BCDR plan requirements. See NFA Rule 2–38;
CME Rule 938.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
covered entities to reasonably design
their BCDR plans to ‘‘recover and make
use of all covered information, as well
as any other data, information, or
documentation required to be
maintained by law and regulation’’ is
intended to both incorporate the
proposed defined term ‘‘covered
information,’’ and make clear the need
to also preserve the availability of the
recovered data and information (i.e.,
reliable access to and use of
information), which the Commission
believes is an integral component of
information and technology security.194
The Commission believes that making
plans to ensure covered information—
sensitive or confidential information
and data the proposed ORF rule is
designed, at its core, to ensure covered
entities protect—as well as any other
information covered entities are legally
required to maintain, is recovered and
accessible following an emergency is
key to ensuring the protection of
customers and counterparties and the
ongoing orderly functioning of the
commodity interest markets, as this
information is vital to a covered entity’s
ability to assess its ongoing compliance
with the Commission’s regulations
governing the requirements for covered
entities.195
3. Minimum Contents—Proposed
Paragraph (f)(2)
Consistent with the proposed (b)(3)
standard for the ORF as a whole, the
BCDR plan would need to be
appropriate and proportionate to the
covered entity, following generally
accepted standards and best
practices.196 Accordingly, should the
proposal be adopted as final, the
Commission would expect each BCDR
plan to be highly tailored to each
specific covered entity. However, the
proposed rule would also require the
BCDR plan to include certain minimum
contents, which are generally
comparable to the current requirements
in Commission regulation 23.603.197
First, the proposed rule would require
the BCDR plan to identify its covered
information, as well as any other data or
information required to be maintained
by law or regulation, and to establish
and implement procedures to backup or
copy it with sufficient frequency and to
store it offsite in either hard-copy or
electronic format.198 The BCDR plan
would also need to identify any
resources, including covered
technology, facilities, infrastructure,
personnel, and competencies, essential
to the operations of the swap entity or
to fulfill the regulatory obligations of the
swap entity, and establish and maintain
procedures and arrangements to provide
for their backup in a manner that is
sufficient to meet the requirements of
the rule (i.e., to continue or resume
operations with minimal disruption, to
recover and make use of
information).199 These minimum
requirements are intended to ensure that
the BCDR plan meets the proposed
recovery standard by ensuring covered
entities have gone through the process
of cataloging everything they need
(information, technology, infrastructure,
human capital, etc.) to operate as a
covered entity, and have established
ways to recover them and to continue or
resume operations with minimal
disruption to customers, counterparties,
or the markets. Furthermore, in
establishing arrangements for backup
resources, the Commission would want
covered entities to consider
diversification to the greatest extent
possible to reduce the likelihood that an
emergency that affects a primary
operating resource affects any planned
backups. Accordingly, the proposed rule
would require covered entities to
establish backup arrangements for
resources that are in one or more areas
geographically separate from the
covered entity’s primary resources (e.g.,
a different power grid than the primary
facility).200 The proposed rule would
make clear those resources could be
194 See supra note 108 and accompanying text
(discussing the ‘‘CIA triad’’ of confidentiality,
integrity, and availability).
195 In designing a BCDR plan that would meet this
recovery standard, the Commission would advise
covered entities to identify a broad range of events
that could constitute emergencies or pose
significant disruptions, including natural events
(e.g., hurricanes, wildfires), technical events (e.g.,
power failures, system failures), malicious activity
(e.g., fraud, cyberattacks), failures of controls, and
low likelihood but high impact events (e.g., terrorist
attacks, pandemics), and consider potential impact
on business operations and data and information.
196 See paragraph (b)(3) of proposed Commission
regulations 1.13 and 23.603.
197 See paragraph (f)(2) of proposed Commission
regulations 1.13 and 23.603. See also 17 CFR
23.603(b). Although the exact language of the
proposed minimum contents in paragraph (f)(2)
may diverge somewhat from that of current
Commission regulation 23.603(b), the modifications
were intended to streamline language and
incorporate the proposed terms ‘‘covered
information’’ and ‘‘covered technology.’’ The
Commission does not intend any of the changes to
have a substantive impact on compliance with the
Commission’s BCDR plan requirement for swap
entities.
198 See paragraph (f)(2)(i) of proposed
Commission regulations 1.13 and 23.603. See also
17 CFR 23.603(b)(1), (b)(6).
199 See paragraph (f)(2)(ii) of proposed
Commission regulations 1.13 and 23.603. See also
17 CFR 23.603(b)(2), (b)(4), (b)(5).
200 See paragraph (f)(2)(ii) of proposed
Commission regulations 1.13 and 23.603. See also
17 CFR 23.603(b)(5).
PO 00000
Frm 00022
Fmt 4701
Sfmt 4702
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
provided by third-party service
providers.201
To ensure that critical third-party
service providers are given particular
consideration when planning for
disruptions, the proposed rule would
specifically require the BCDR plan to
identify potential disruptions to critical
third-party service providers and
establish a plan to minimize the impact
of such potential disruptions.202
Additionally, given the importance of
internal and external communication in
times of crisis, and for duties and
responsibilities to be well established,
the proposed rule would require the
BCDR plan to identify supervisory
personnel responsible for implementing
the BCDR plan, along with the covered
entity’s required ORF emergency
contacts, and establish a procedure for
communicating with relevant persons in
the event of an emergency or significant
disruption.203
The minimum contents of the
proposed BCDR plan requirement were
designed to align with the substance of
the ‘‘essential components’’ of a BCDR
plan identified in current Commission
regulation 23.603(b), with certain
modifications.204 The changes are
intended to streamline language,
incorporate the proposed BCDR plan
standard and defined terms (e.g.,
covered information, covered
technology, critical third-party service
provider), and reorder and combine
elements to improve readability and
application. Key changes include:
• Replacing the identification or
backup of documents and information
essential to the continued operations of
the swap entity and/or to fulfill the
regulatory obligations of the swap dealer
or major swap participant with covered
information, as well as any other data or
information required to be maintained
by law and regulation.205 This change is
201 See
id.
paragraph (f)(2)(iii) of proposed
Commission regulations 1.13 and 23.603. See also
17 CFR 23.603(b)(7) (identify ‘‘potential business
interruptions encountered by third parties that are
necessary to the continued operations of the swap
dealer or major swap participant and a plan to
minimize the impact of such disruptions’’).
203 See paragraphs (f)(2)(iv)–(v) of proposed
Commission regulations 1.13 and 23.603. See also
paragraph (k) of proposed Commission regulations
1.13 and 23.603 (requiring emergency contacts),
discussed in section II.I.1 of this notice, infra; 17
CFR 23.603(b)(3).
204 See 17 CFR 23.603(b).
205 See proposed paragraph (f)(2)(i) of
Commission regulations 1.13 and 23.603; 17 CFR
23.603(b)(1) (Identification of the documents and
data essential to the continued operations of the
swap entity and to fulfill the obligations of the swap
entity); (b)(6) (Back-up or copying of documents
and data essential to the operations of the swap
entity or to fulfill the regulatory obligations of the
swap entity’’).
ddrumheller on DSK120RN23PROD with PROPOSALS2
202 See
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
intended to align the information
required to be identified in the proposed
BCDR plan with its purpose (recover
and make use of all covered
information, as well as any other data,
information, or documentation required
to be maintained by law and regulation).
• Specifying that data and
information must be backed up or
copied with sufficient frequency ‘‘to
meet the requirements of this section,’’
to make clear that the backup frequency
should be linked to the broader purpose
of the BCDR plan (i.e., to continue or
resume operations with minimal
disruption and to recover and make use
of in-scope information).206
• Removing the qualification that
resource backups be designed to achieve
the timely recovery of data and
documentation and to resume
operations as soon as reasonably
possible and generally within the next
business day.207 This language could be
viewed as in contradiction with the
overall proposed purpose of the BCDR
plan, which would not include a ‘‘next
business day’’ recovery time objective.
• Replacing third parties that are
necessary to the continued operations of
the swap dealer or major swap
participant with critical third-party
service provider, as defined in the
proposed rule, as the Commission
believes these terms are intended to
capture similar concepts.208
4. Accessibility—Proposed Paragraph
(f)(3)
Finally, to ensure that the BCDR plan
is available in the event of an emergency
or other significant disruption that
prevents a covered entity from accessing
its primary office location, the proposed
rule would require each covered entity
to maintain copies of its BCDR plan at
one or more accessible off-site
locations.209
5. Request for Comment
The Commission invites comment on
all aspects of the proposed business
continuity and disaster recovery plan
206 Cf. 17 CFR 23.603(b)(6) (Back-up or copying,
with sufficient frequency, of documents and data).
207 See 17 CFR 23.603(b)(4) (Procedures for, and
the maintenance of, back-up facilities, systems,
infrastructure, alternative staffing and other
resources to achieve the timely recovery of data and
documentation and to resume operations as soon as
reasonably possible and generally within the next
business day.).
208 See 17 CFR 23.603(b)(7) (Identification of
potential business interruptions encountered by
third parties that are necessary to the continued
operations of the swap dealer or major swap
participant and a plan to minimize the impact of
such disruptions.).
209 See paragraph (e)(3) of proposed Commission
regulations 1.13 and 23.603. See also 17 CFR
23.603(c).
PO 00000
Frm 00023
Fmt 4701
Sfmt 4702
4727
requirement, including the following
question:
1. Recovery time objective. Under
current Commission regulation 23.603,
the Commission requires swap entities
to establish and maintain a BCDR plan
that is designed to enable the swap
entity to continue or resume any
operations ‘‘by the next business day’’
with minimal disturbance to is
counterparties.210 Noting that such a
standard may pose some challenges, the
Commission has proposed to not
include a recovery time objective,
relying on covered entities to establish
a BCDR plan that allows for sufficiently
exigent recovery so as to impose
‘‘minimal disruption’’ to customers,
counterparties, or the markets.
a. Has a next business day standard
posed challenges for swap entities to
implement? Would such a standard be
achievable for FCMs? Why or why not?
Please explain.
b. Should the Commission consider
including additional language to ensure
covered entities design BCDR plans that
enable quick recovery (e.g., ‘‘as soon as
possible’’ or ‘‘as soon as practicable’’)?
Why or why not? Please explain.
2. Transfer of business to another
entity. NFA and CME rules allow for
BCDR plans to include the possibility of
transferring their business to another
regulated entity in the event of an
emergency or disruption. NFA Rule 2–
38 provides that a BCDR plan ‘‘shall be
reasonably designed to . . . transfer its
business to another Member with
minimal disruption to its customers,
other members, and the commodity
futures markets.’’ 211 CME Rule 983
provides that clearing members must
have procedures in place to allow them
to continue to operate during periods of
stress ‘‘or to transfer accounts to another
fully operational clearing member with
minimal disruption to either [CME] or
their customers.’’ 212 Do any covered
entities currently have arrangements
with other covered entities to transfer
business or accounts in the event of an
emergency or disruption? Should the
Commission consider adding the option
to transfer business to another regulated
entity into its proposed BCDR rule?
Why or why not? How would such a
transfer function in practice? Please
explain.
F. Training and Plan Distribution—
Proposed Paragraph (g)
To support the effectiveness of the
ORF by ensuring personnel are aware of
relevant policies, procedures, and
210 See
17 CFR 23.603(a).
NFA Rule 2–38, supra note 43.
212 See CME Rule 983, supra note 185.
211 See
E:\FR\FM\24JAP2.SGM
24JAP2
4728
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
practices, the proposed rule would
require that each covered entity
establish, implement, and maintain
training with respect to all aspects of the
ORF.213 Relevant training is important
to ensuring the ORF operates as
intended, and to supporting a firm
culture that promotes and prioritizes
operational resilience.214 The training
would therefore need to include, at a
minimum, (i) cybersecurity awareness
training for all personnel and (ii) rolespecific training for personnel involved
in establishing, documenting,
implementing, and maintaining the
ORF.215 The importance of
cybersecurity training is widely
recognized, as incidents commonly
occur because well-intentioned
employees or other users make
preventable mistakes.216 The
Commission would further expect that
role-specific training would include not
only training on relevant policies and
procedures but additional relevant
threat and vulnerability response
training for personnel involved in the
development and maintenance of the
information and technology security
program (e.g., system administration
213 See paragraph (g) of proposed Commission
regulations 1.13 and 23.603.
214 See FFIEC Information Security Booklet, supra
note 69, at 17 (‘‘Training ensures personnel have
the necessary knowledge and skills to perform their
job functions.’’); CIS Critical Security Controls v.8.,
Control no. 14 (Security Awareness and Skills
Training) at 43 (May 2021) (CIS Control 14)
(training helps ‘‘influence behavior among the
workforce to be security conscious and properly
skilled to reduce cybersecurity risks to the
enterprise’’).
215 See paragraphs (g)(1)(i)–(ii) of proposed
Commission regulations 1.13 and 23.603. Proposed
paragraph (g)(1)(ii) would supplant the current
requirement in Commission regulation 23.603 for
swap entities to train relevant employees on
applicable components of the BCDR plan. See 17
CFR 23.603(c). The Commission does not intend
any substantive difference in the BCDR plan
training for swap entities.
216 The FSB found that most successful
cyberattacks involved human error, which is why
training is important for all personnel. See FSB,
Summary Report on Financial Sector Cybersecurity
Regulations, Guidance and Supervisory Practices at
7 (Oct. 13, 2017), available at https://www.fsb.org/
wp-content/uploads/P131017-1.pdf. See also CIS
Control 14 (‘‘Users themselves, both intentionally
and unintentionally, can cause incidents as a result
of mishandling sensitive data, sending an email
with sensitive data to the wrong recipient, losing a
portable end-user device, using weak passwords, or
using the same password they use on public site
. . .); Prudential Operational Resilience Paper,
supra note 11, at 11 (‘‘The firm provides
cybersecurity awareness education especially to
personnel engaged in the operations of critical
operations and core business lines, . . . and
adequately trains them to perform their information
security-related duties and responsibilities
consistent with related processes and
agreements.’’).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
courses for IT professionals, secure
coding training for web developers).217
As with all aspects of the ORF, if the
proposal is adopted as final, the
Commission would expect each covered
entity’s ORF training to meet the (b)(3)
standard (i.e., be appropriate and
proportionate to the nature, scope, and
complexities of its business activities as
a covered entity, following generally
accepted standards and best
practices).218 To ensure the training
remains relevant overtime and that
personnel are adequately informed with
respect to the ORF, covered entities
would also be required to provide and
update their ORF training as necessary,
but no less frequently than annually.219
Requiring that the training occur
annually would be a new CFTC
requirement with respect to the BCDR
plan training requirement for swap
entities.220 The Commission
nevertheless believes an annual training
requirement is necessary for staff
involved in BCDR planning to ensure
they remain up-to-date on changes to
the BCDR plan following the annual
reviews and testing of the plan.221
To further support the proposed
training requirement and ensure
relevant personnel have access to and
are aware of the current information and
technology security, third-party
relationships, and BCDR plans that form
the ORF, the proposed rule would
require that covered entities distribute
copies of those plans to relevant
personnel and promptly provide any
significant revisions thereto.222 This
proposed plan distribution requirement
is consistent with the current BCDR
plan distribution requirement for swap
entities in current Commission
regulation 23.603.223
Request for Comment
The Commission invites comment on
all aspects of the proposed training
requirement.
217 See CISA, Incident Response Plan (IRP) Basics
(advising that all staff need to understand their role
in maintaining and improving the security of the
organization), available at https://www.cisa.gov/
sites/default/files/publications/Incident-ResponsePlan-Basics_508c.pdf.
218 See paragraph (b)(3) of proposed Commission
regulations 1.13 and 23.603; supra note 63 and
accompanying text.
219 See paragraph (g)(2) of proposed Commission
regulations 1.13 and 23.603.
220 See 17 CFR 23.603(c).
221 See paragraph (h) of proposed Commission
regulations 1.13 and 23.603, discussed in section
II.G, infra.
222 See paragraph (g)(3) of proposed Commission
regulations 1.13 and 23.603.
223 See 17 CFR 23.603(c) (Each swap entity shall
distribute a copy of its business continuity and
disaster recovery plan to relevant employees and
promptly provide any significant revision thereto.).
PO 00000
Frm 00024
Fmt 4701
Sfmt 4702
G. Reviews and Testing—Proposed
Paragraph (h)
To ensure the ORF remains viable and
effective over time, the proposed rule
would require covered entities to
establish, implement, and maintain a
plan reasonably designed to assess its
adherence to, and the effectiveness of,
the ORF through regular reviews and
risk-based testing.224 As discussed
above, the purpose of the proposed ORF
would be to identify, monitor, manage,
assess, and report on risks relating to
information and technology security,
third-party relationships, and
emergencies or other significant
business disruptions.225 Monitoring and
managing these risks is a dynamic, everevolving process, especially given the
increased reliance on and rapid
evolution of technological
advancements and related cyber
risks.226 The Commission believes
regular reviews and testing are an
important tool needed to confirm that
systems and information remain
protected, controls are working as
expected, and policies and procedures
are being followed.227 Accordingly, the
Commission preliminarily believes that
regular reviews and testing would
provide covered entities with essential
information about the actual quality,
performance, and reliability of the ORF
in relation to its objectives and
regulatory requirements. The
Commission further expects that
reviews and testing would be key to
revealing unknown gaps or weaknesses
in systems or controls that could then be
analyzed to identify corrective actions
designed to improve overall operational
resilience over time.228 The results of
the reviews and testing should be used
to support sound decision-making at the
covered entity regarding prioritization
and funding of resources in a manner
224 See paragraph (h) of proposed Commission
regulations 1.13 and 23.603.
225 See paragraph (b)(1) of proposed Commission
regulations 1.13 and 23.603, supra note 55 and
accompanying text.
226 See Prudential Operational Resilience Paper,
supra note 11, at 9 (‘‘The firm also regularly reviews
and updates its systems and controls for security
against evolving threats including cyber threats and
emerging or new technologies.’’).
227 See, e.g., 17 CFR 37.1401 (SEFs); 17 CFR
38.1051 (DCMs); 17 CFR 39.18 (DCOs); 17 CFR
49.24 (SDRs) (requiring system safeguard testing).
See also FFIEC Information Security Booklet, supra
note 69 (providing that entities should have a
documented testing and evaluation plan).
228 See also CPMI IOSCO Cyber Resilience
Guidance, supra note 123, at 18 (‘‘Sound testing
regimes produce findings that are used to identify
gaps in stated resilience objectives and provide
credible and meaningful inputs to the [entity’s]
cyber risk management process. Analysis of testing
results provides direction on how to correct
weaknesses or deficiencies in the cyber resilience
posture and reduce or eliminate identified gaps.’’).
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
that furthers operational resilience.229
Without such regular reviews and
testing, the Commission is concerned
that the ORF would quickly grow stale
and ineffective, allowing unseen
vulnerabilities to go unaddressed and
potentially weaken the stability of the
covered entity or the financial system at
large.
1. Reviews—Proposed Paragraph (h)(1)
ddrumheller on DSK120RN23PROD with PROPOSALS2
Under the proposed rule, reviews
would need to include an analysis of the
adherence to, and the effectiveness of,
the ORF, as well as any
recommendations for modifications or
improvements that address root causes
of issues identified by the review.230
Again, the Commission believes that the
process of reviewing the ORF to
evaluate both its current effectiveness
and make recommendations for
prospective improvements that relate to
deficiencies found through the review
would help ensure that the ORF remains
effective at managing operational
resilience as circumstances change over
time.
The proposed rule would require
covered entities to conduct such
reviews at least annually and in
connection with any material change to
the activities or operations of the
covered entity that is reasonably likely
to affect the risks addressed by the
ORF.231 An annual review standard is
consistent with the Commission’s
existing review requirement for the RMP
for covered entities, the BCDR plan for
swap entities, and NFA’s ISSP
Interpretive Notice.232 Although the
Commission would expect the ORF to
be reviewed at least annually in its
entirety, including not only the required
plans but training and governance, the
reviews could be broken into phases,
staged over the course of the year. The
Commission preliminarily believes that
requiring the ORF to be reviewed on at
least an annual basis and in connection
with any relevant, material business
change is sufficiently frequent to help
ensure that the ORF remains effective
229 See id. at 18 (‘‘The results of the testing
programme should be used by the [entity] to
support the ongoing improvement of its cyber
resilience.’’).
230 See paragraph (h)(1) of proposed Commission
regulations 1.13 and 23.603.
231 Id.
232 See 17 CFR 1.11(f)(1); 17 CFR 23.600(e)(1)
(requiring covered entities to review their RMPs on
an annual basis or upon any material change in the
business reasonably likely to alter their risk profile);
17 CFR 23.603(f) (requiring an annual review of
swap entities’ BCDR plan); NFA ISSP Notice, supra
note 43 (providing that members should perform a
regular review of their information systems security
program at least once every twelve months).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
and continues to meet its objectives over
time.
The proposed review requirement for
the ORF would replace the similar
annual review requirement for swap
entities’ BCDR plans contained in
current Commission regulation 23.603.
Current Commission regulation
23.603(f) requires that a member of
senior management for a swap entity
review the BCDR plan annually or upon
any material change to the business and
to document any deficiencies found or
corrective action taken.233 The
Commission preliminarily believes that
the proposed annual review of the ORF,
which would encompass a review of the
BCDR plan, is sufficient to ensure the
ORF’s effectiveness and that it would no
longer be necessary for a separate
review of the BCDR plan to be
conducted by senior management.
2. Testing—Proposed Paragraph (h)(2)
With respect to risk-based testing of
the ORF, the proposed rule would
generally provide that covered entities
determine the frequency, nature, and
scope of the testing consistent with the
proposed (b)(3) standard.234 Covered
entities have available to them a wide
range of testing tools, techniques, and
methodologies, particularly with respect
to information and technology security.
Those tools and techniques include
open source analysis, network security
assessments, physical security reviews,
source code reviews, compatibility
testing, performance testing, and end-toend testing, just to name a few.235 Such
testing methods can vary significantly in
terms of what they test and how, and in
the degree of sophistication and
sensitivity they need to run them
correctly and reliably.236 Covered
technology among covered entities
varies, both in terms of the sensitivity of
the data and information it contains and
transmits, as well as its operational
importance and risk profile.
The Commission therefore
preliminarily believes that leaving the
specifics of the design and
implementation of ORF testing to the
reasonable judgment of each covered
entity would help ensure that such
testing protocols remain nimble as
operations and recommended testing
techniques change progressively over
233 See
17 CFR 23.603(f).
paragraph (h)(2) of proposed Commission
regulations 1.13 and 23.603. See also paragraph
(b)(3) of proposed Commission regulations 1.13 and
23.603; supra note 63 and accompanying text.
235 See NIST, SP 800–115, Technical Guide to
Information Security Testing and Assessment (Sept.
2008).
236 Id.
234 See
PO 00000
Frm 00025
Fmt 4701
Sfmt 4702
4729
time.237 Covered entities would,
however, need to ensure that the testing
is reasonably designed to test the
effectiveness of the function or system
being tested.238 Covered entities should
determine which particular tests to
incorporate, consistent with the (b)(3)
standard and their risk assessments, to
ensure the testing effectively targets
their particular business lines, activities,
operations, and risk profile. Covered
entities would accordingly be
encouraged to document the decisionmaking regarding how it determined the
nature, scope, and frequency of testing.
Although the proposed rule would
generally not mandate the use of any
specific techniques, it would establish
certain minimum testing frequencies
with respect to a few testing categories
that have broad consensus. With respect
to testing of the information and
technology security program, the
proposed rule would require testing of
key controls and the incident response
plan at least annually.239 Consistent
with the definition in the Commission’s
system safeguard rules for registered
entities, the proposal would define ‘‘key
controls’’ as those controls that an
appropriate risk analysis determines are
either critically important for effective
information and technology security, or
are intended to address risks that evolve
or change more frequently and therefore
require more frequent review to ensure
their continuing effectiveness in
addressing such risks.240 Given their
importance to preserving information
and technology security and recovering
from incidents, the Commission
believes that regular testing of the
incident response plan and key controls
on at least an annual basis is an
important baseline requirement to
ensure the continued effectiveness of
237 See also Interagency Guidelines Safeguarding
Customer Information, 66 FR 8623 (‘‘The Agencies
believe that a variety of tests may be used to ensure
the controls, systems, and procedures of the
information security program work properly and
also recognize that such tests will progressively
change over time’’); FINRA Cybersecurity Report,
supra note 66, at 13 (‘‘Many firms determined the
systems to be tested and the frequency with which
they should be tested based on a risk assessment
where higher risk systems were tested more
frequently.’’).
238 See paragraph (h) of proposed Commission
regulations 1.13 and 23.603 (requiring that the
testing plan be reasonably designed to assess the
adherence to, and the effectiveness of, the ORF).
239 See paragraph (h)(2)(i)(A) of proposed
Commission regulations 1.13 and 23.603.
240 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘key
controls’’). See also 17 CFR 37.1401(h)(1) (SEFs); 17
CFR 38.1051(h)(1) (DCMs); 17 CFR 39.18(a) (DCOs);
17 CFR 49.24(j)(1) (SDRs) (defining ‘‘key controls’’
for purposes of system safeguard requirements).
E:\FR\FM\24JAP2.SGM
24JAP2
4730
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
the information and technology security
program.241
The proposed rule would also require
that testing of the information and
technology security program include
vulnerability assessments and
penetration testing.242 Vulnerability
assessments include methods and
techniques to identify, diagnose, and
prioritize vulnerabilities in the security
of covered technology.243 Technical
vulnerabilities can be identified through
scanner tools, which can be run
continuously or periodically, often
daily, and may include checking servers
for security patches to ensure they are
current.244 Penetration testing (or ‘‘pen
testing’’), meanwhile, attempts to
identify ways to exploit vulnerabilities
and circumvent or defeat security
features, mimicking potential real-world
attacks. Experts have developed a wide
variety of penetration tests (e.g.,
wireless, network, web application,
cloud, client side, social engineering,
physical, threat-led) and approaches to
or modes of completing them (e.g., black
box, white box, gray box).245 Some tests
go further by using cyber-threat
intelligence in designing these
simulated attacks, a testing referred to as
threat-led penetration testing or ‘‘red
teaming.’’ 246
With respect to vulnerability
assessments, the proposed rule would
require covered entities to test their
information and technology security
programs using vulnerability
assessments, including daily or
continuous automated vulnerability
scans.247 The Commission preliminarily
believes that some degree of
vulnerability assessment is considered
standard cybersecurity hygiene in order
to monitor systems and controls for
vulnerabilities, and that the availability
of automated vulnerability scanning
241 See 17 CFR 37.1401(h)(5) (SEFs); 17 CFR
38.1051(h)(5) (DCMs); 17 CFR 39.18(e)(5) (DCOs);
17 CFR 49.24(j)(5) (SDRs) (annual testing of
incident response plans and key controls); see also
FFIEC, Information Technology Handbook, Audit
Booklet at A–15 (Apr. 2012) (including testing of
key controls at least annually as an examination
point
242 See paragraphs (h)(2)(i)(B)–(C) of proposed
Commission regulations 1.13 and 23.603.
243 See FFIEC Information Security Booklet, supra
note 69, at 8.
244 Id.
245 See FINRA Cybersecurity Report, supra note
66, at 13.
246 See FSI, FSI Insights on policy
implementation No. 21, Varying shades of red: how
red team testing frameworks can enhance the cyber
resilience of financial institutions (Nov. 2019).
247 See paragraph (h)(2)(i)(B) of proposed
Commission regulations 1.13 and 23.603. See also
17 CFR 37.1401(h)(2) (SEFs); 17 CFR 38.1051(h)(2)
(DCMs); 17 CFR 39.18(e)(2) (DCOs); 17 CFR
49.24(j)(2) (SDRs) (requiring automated
vulnerability scanning).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
tools help provide a base level of
monitoring that is easily accessible to all
covered entities.248
With respect to penetration testing,
the proposed rule would not require
covered entities to undertake specific
types of testing. Given the diverse
nature of entities registered as FCMs
and swap entities, the Commission
believes that determination of the type
and method of penetration testing
would be best left to the reasoned
judgement of each covered entity after
conducting its own assessment. The
Commission would, however, require
that covered entities conduct some
penetration testing at least annually.249
The Commission preliminarily believes
that annual penetration testing of some
type, determined consistent with the
proposed (b)(3) standard, would be
important for covered entities to have
knowledge and awareness of the actual
vulnerability of their covered
technology to internal or external
threats. According to FINRA’s 2018
cyber risk report, firms with strong
cybersecurity programs conducted
penetration tests at least annually and
more frequently for mission critical,
high risk systems such as for an online
trading system.250 Covered entities
would also be encouraged to consider
additional risk-based penetration testing
after key events, such as any time a
significant change is made to important
elements of the firm’s applications and
systems infrastructure, in addition to
any other regular compliance testing.
Current Commission regulation
23.603 includes a testing requirement
for the BCDR plan for swap entities.251
The proposed ORF testing provision
would replace that requirement in
current Commission regulation 23.603
and specify that, as part of the testing,
covered entities would need to conduct
a walk-through or tabletop exercise
designed to test the effectiveness of
backup facilities and capabilities at least
248 For instance, CISA makes available a free
vulnerability scanner. See CISA, Cyber Hygiene
Services, available at https://www.cisa.gov/cyberhygiene-services.
249 See paragraph (h)(2)(i)(C) of proposed
Commission regulations 1.13 and 23.603.
250 FINRA Cybersecurity Report, supra note 66, at
13–14. FFIEC’s exam book also appears to
contemplate at least some degree of penetration
testing among financial institutions. See FFIEC
Information Security Booklet, supra note 69, at 55
(noting that independent testing, including
penetration testing and vulnerability scanning, is
conducted according to the risk assessment for
external-facing systems and the internal network).
251 See 17 CFR 23.603(g) (requiring the BCDR
plan to tested annually by qualified, independent
internal personnel or a qualified third-party
service).
PO 00000
Frm 00026
Fmt 4701
Sfmt 4702
annually.252 The Commission
preliminarily believes that swap entities
currently test their BCDR plans through
such exercises and that they are an
important way to test the effectiveness
of a BCDR plan in practice. Unlike
current Commission regulation 23.603,
however, the proposed rule would not
require that covered entities’ BCDR
plans be audited every three years by a
qualified third-party service provider.253
Based on the Commission’s experience,
this audit requirement has proven
redundant and unnecessary in light of
the requirements to review and test the
plan annually.
3. Independence—Proposed Paragraph
(h)(3)
To support the reliability and
objectivity of the review and testing
results, the proposed rule would require
the reviews and testing to be conducted
by qualified personnel who are
independent of the aspect of the ORF
being reviewed or tested.254 The
personnel conducting the testing could
be employees of the covered entity
itself, an affiliate, or of a third-party
service provider, provided that such
personnel are sufficiently trained and
not responsible for the development,
installation, operation, or maintenance
of the ‘‘object’’ of the testing (e.g.,
covered technology, key controls,
training, etc.). For example, a covered
entity’s internal audit department may
be sufficiently trained and independent
to test certain key controls but may need
to secure a third-party to test certain
systems or program installations if it
does not have sufficient capabilities inhouse. Covered entities would therefore
be permitted under the proposal to
determine whether a particular test
should be conducted in-house or by a
third-party service provider, provided
that the qualification and independence
requirements are met.255
This proposed independence
requirement is consistent with the
testing requirement for swap entity
252 Current Commission regulation 23.603 does
not specify the nature of the BCDR testing, see id.
253 See id. (‘‘Each business continuity and
disaster recovery plan shall be audited at least once
every three years by a qualified third party service.
The date the audit was performed shall be
documented, together with the nature and scope of
the audit, any deficiencies found, any corrective
action taken, and the date that corrective action was
taken.’’).
254 See paragraph (h)(3) of proposed Commission
regulations 1.13 and 23.603.
255 If a covered entity determines to use a thirdparty service provider, the proposed requirements
and guidance with respect to the management of
third-party relationships would apply. See supra
note 153 and accompanying text.
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
BCDR plans in current Commission
regulation 23.603.256
4. Documentation—Proposed Paragraph
(h)(4)
The proposed rule would require
covered entities to document all reviews
and testing of the ORF. The
documentation would need to include,
at a minimum: (i) the date the review or
testing was conducted; (ii) the nature
and scope of the review or testing,
including methodologies employed; (iii)
the results of the review or testing,
including any assessment of
effectiveness; (iv) any identified
deficiencies and recommendations for
remediation; and (v) any corrective
action(s) taken, including the date(s)
such actions were taken.257 The
Commission primarily believes
documenting these key aspects of the
testing and related results would not
only assist in ensuring accountability
for the testing, but would help covered
entities take full advantage of any
insights the testing may provide and to
build upon their resiliency from lessons
learned. Such documentation would
also assist the Commission in
performing its oversight duties with
respect to covered entities and their
implementation of their ORF.
This proposed documentation
requirement is consistent with the
requirement for swap entity BCDR plans
in current Commission regulation
23.603.258
ddrumheller on DSK120RN23PROD with PROPOSALS2
5. Internal Reporting—Proposed
Paragraph (h)(5)
To support covered entities’
compliance with the ORF rule and
ensure that senior leadership is apprised
of and held accountable for the
effectiveness of the ORF, the proposed
rule would expressly require covered
entities to report on the results of their
reviews and testing to the CCO and any
other relevant senior-level official(s) and
oversight body(ies).259 The proposed
rule would not mandate the form,
method, or frequency of such reporting,
but the Commission would encourage
the reporting to be provided in a
sufficiently timely manner so as to
allow the CCO and senior leadership to
256 See 17 CFR 23.603(g) (requiring the BCDR
plan to tested annually by qualified, independent
internal personnel or a qualified third-party
service).
257 See paragraph (h)(4)(i)–(v) of proposed
Commission regulations 1.13 and 23.603.
258 See 17 CFR 23.603(g) (‘‘The date the testing
was performed shall be documented, together with
the nature and scope of the testing, any deficiencies
found, any corrective action taken, and the date that
corrective action was taken.’’).
259 See paragraph (h)(5) of proposed Commission
regulations 1.13 and 23.603.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
act upon the information to take steps
to improve compliance and the overall
effectiveness of the ORF.
This requirement does not exist with
respect to the swap entity BCDR plan
requirement in current Commission
regulation 23.603 and would therefore
be a new requirement.
6. Request for Comment
The Commission invites comment on
all aspects of the proposed review and
testing requirements, including the
following question:
1. Key Controls. The proposed rule
would require covered entities to test
key controls on at least an annual basis
and includes a definition of ‘‘key
controls’’ that is comparable to how the
term is defined for purposes of the
Commission’s system safeguard
requirements for registered entities.260
Are covered entities currently testing
key controls? How are they determining
what controls should be regularly
tested? Should the Commission
consider allowing covered entities to
define ‘‘key controls’’ for themselves
consistent with the proposed (b)(3)
standard?
H. Required Notifications—Proposed
Paragraphs (i) and (j)
The proposed rule would require
covered entities to notify the
Commission, customers, or
counterparties of certain events within
the scope of the ORF. Notifications to
the Commission would relate to
incidents that have an adverse impact,
or a covered entity’s decision to activate
its BCDR plan.261 Notifications to
customers or counterparties would
relate to incidents that adversely impact
their interests.262 These notification
provisions are discussed in turn below.
1. Commission Notification of
Incidents—Proposed Paragraph (i)(1)
The proposed rule would require
covered entities to notify the
Commission of any incident that
adversely impacts, or is reasonably
likely to adversely impact, (A)
information and technology security, (B)
the ability of the covered entity to
continue its business activities as a
covered entity, or (C) the assets or
positions of a customer or
counterparty.263 The notification would
260 See, e.g., 17 CFR 37.1401(h)(1) (SEFs); 17 CFR
38.1051(h)(1) (DCMs); 17 CFR 39.18(a) (DCOs); 17
CFR 49.24(j)(1) (SDRs) (defining ‘‘key controls’’ for
purposes of system safeguard requirements).
261 See paragraph (i) of proposed Commission
regulations 1.13 and 23.603.
262 See paragraph (j) of proposed Commission
regulations 1.13 and 23.603.
263 See paragraph (i)(1)(A)–(C) of proposed
Commission regulations 1.13 and 23.603.
PO 00000
Frm 00027
Fmt 4701
Sfmt 4702
4731
need to include any information
available to the covered entity at the
time of the notification that could assist
the Commission in assessing and
responding to the incident, including
the date the incident was detected,
possible cause(s) of the incident, its
apparent or likely impacts, and any
actions the covered entity has taken or
is taking to mitigate or recover from the
incident, including measures to protect
customers or counterparties.264 Covered
entities would need to provide the
notification as soon as possible, but no
later than 24 hours after such incident
has been detected.265
The purpose of this proposed
notification provision is multifold. At a
fundamental level, the proposed rule
would allow the Commission to exercise
its oversight function with respect to the
ORF, offering the Commission a realworld, real-time insight into the
effectiveness of a particular covered
entity’s ORF and whether it is operating
as intended. Early warning of impactful
incidents would also enable the
Commission to be more responsive,
providing guidance or appropriate relief
to help the covered entity withstand and
recover from the incident. The
Commission would also expect such
early warnings to aid it in identifying
and reacting to events that could pose
a more systemic threat, either to the
markets due to the severity of the
impact of the incident or to other
covered entities due to the nature of the
incident (e.g., a ransomware attack
against multiple covered entities or a
third-party service provider engaged by
more than one covered entity). In such
potentially systemic circumstances,
early awareness of the incident is
expected to facilitate the Commission’s
role in coordinating industry efforts and
information sharing, allowing it to help
forestall the impact of potential broadscale threats by sharing information
with other regulators through its
involvement in Financial and Banking
Information Infrastructure Committee
(FBIIC), issue timely statements to
stabilize public confidence, and
potentially take emergency regulatory
action. Over time, the Commission
preliminarily believes that the
knowledge and experience gained from
these incident reports could provide the
Commission a vantage point from which
to identify trends and lessons learned
that could improve its supervisory
guidance supporting industry efforts to
264 See paragraph (i)(1)(ii) of proposed
Commission regulations 1.13 and 23.603.
265 See paragraph (i)(1)(iii) of proposed
Commission regulations 1.13 and 23.603.
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
4732
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
enhance their ORF practices, or lead to
other regulatory improvements.
As discussed above, the proposed rule
would define ‘‘incident’’ as any event,
occurrence or circumstance that could
jeopardize (i.e., put into danger)
information and technology security.266
This standard would include events that
have the potential to harm information
and technology security regardless of
whether a harm actually materializes.
The proposed notification standard, by
contrast, would limit the scope of
incidents required to be reported to the
Commission to those where there is an
observable negative impact or harm, or
such negative impact or harm is
reasonably likely. Covered entities
would not, for instance, need to notify
the Commission of unsuccessful
attempts at unauthorized access, as the
detection and deterrence of such an
attempt would not require Commission
action and would appear to be
suggestive of an ORF that is operating as
expected. If, however, a covered entity
determines that an unauthorized person
did access covered information, the
Commission would need to be notified,
regardless of how much information
was accessed or whether the covered
entity believes it has been used. The
Commission would similarly want to
know of any successful distributed
denial-of-service attack that disrupts
business operations, regardless of the
length of time of that disruption.267
The Commission appreciates that, at
the outset, information regarding an
incident is likely to be incomplete and
in flux, and the full impact and root
cause of an incident may take some time
to reveal itself. Covered entities may
also not be able to detect incidents
immediately after their occurrence, and
with sophisticated malicious attacks,
culprits often take steps to hide their
intrusions. Nevertheless, the
Commission preliminarily believes that
delays in reporting an incident to the
Commission could impede its ability to
make timely assessments and take
appropriate action. The Commission is
concerned that such delays could have
broad implications, especially when
there are potential sector-wide
ramifications or spill-over effects to
other regulated entities that the
Commission could assist in managing.
Accordingly, the proposed rule would
not prescribe a specific form or content
for the notification or include a
materiality limiter. The proposed rule
266 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘incident’’).
267 Covered entities would not need to notify the
Commission of routine testing or planned
maintenance.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
would only require that covered entities
provide whatever information they have
on hand at the time that could assist the
Commission in its assessment and
response activities.268 If the proposed
rule is adopted, the Commission would
simply expect that as an incident
progresses, covered entities would
continue to engage with the
Commission and provide updates as
needed.269
The proposed rule would not
prescribe a particular form for the
notification but would require
notification via email.270
2. Commission Notification of BCDR
Plan Activation—Proposed Paragraph
(i)(2)
For similar reasons, the proposed rule
would also require covered entities to
notify the Commission of any
determination to activate its BCDR
plan.271 Consistent with the proposed
incident notification, covered entities
would need to notify the Commission of
its determination to activate their BCDR
plan within 24 hours of making that
determination.272 Current Commission
regulation 23.603 requires swap entities
to notify the Commission ‘‘promptly’’ of
any emergency or other disruption that
may affect the ability of a swap entity
to fulfill its regulatory obligations or
would have a significant adverse effect
on the swap entity, its counterparties, or
the market.273 Based on the
Commission’s experience with this
provision, which became particularly
relevant during the onset of the COVID–
19 pandemic, the Commission believes
this standard has been open to wide
interpretation among swap entities,
leading to broad variations in the
timeliness of the notifications to the
Commission regarding their decisions to
implement their BCDR plans and
employ a remote work posture. The
Commission therefore preliminarily
believes that a more bright-line test that
centers on the decision to activate the
268 See paragraph (i)(1)(ii) of proposed
Commission regulations 1.13 and 23.603.
269 For avoidance of doubt, the proposed rule
would not have any impact on covered entities’
obligations to notify criminal authorities as
appropriate or required by other law or regulation.
270 See paragraph (i)(2)(iii) of proposed
Commission regulations 1.13 and 23.603.
271 See paragraph (i)(2)(i) of proposed
Commission regulations 1.13 and 23.603.
272 See paragraph (i)(2)(iii) of proposed
Commission regulations 1.13 and 23.603.
273 See 17 CFR 23.603(d) (‘‘Each swap dealer and
major swap participant shall promptly notify the
Commission of any emergency or other disruption
that may affect the ability of the swap dealer or
major swap participant to fulfill its regulatory
obligations or would have a significant adverse
effect on the swap dealer or major swap participant,
its counterparties, or the market.’’).
PO 00000
Frm 00028
Fmt 4701
Sfmt 4702
BCDR plan, an action that presumably
would not occur absent an emergency or
significant disruption impacting the
covered entity, would be easier to apply.
The Commission also believes such a
standard would facilitate the prompt
delivery of information to the
Commission so that it may consider
whether any action to support the
continued integrity of the markets
during the course of the emergency is
necessary to continue to fulfill its
oversight obligations. For that purpose,
the Commission believes that 24 hours
from activation of the BCDR plan would
both encourage covered entities to
inform the Commission with sufficient
time for it to take any needed action and
encourage covered entities to focus
initial efforts on resuming or continuing
operations.
Under the proposed rule, the
notification would need to include all
information available to the covered
entity at that time, including the date of
the emergency or disruption, a brief
description thereof, its apparent impact,
and any actions the covered entity has
taken or is taking to mitigate or recover
from the incident, including measures
to protect customers and counterparties,
as the Commission believes this
information would be necessary for it to
perform its oversight obligations and
take responsive action if needed.274 The
proposed rule would not prescribe a
particular form for the notification but
would require notification via email.275
3. Notifications to Customers or
Counterparties—Proposed Paragraph (j)
Finally, the proposed rule would
require covered entities to notify
customers or counterparties as soon as
possible of any incident that could have
adversely affected the confidentiality or
integrity of such customer or
counterparty’s covered information or
their assets or positions.276 Such
incidents could include the
identification of a longstanding
vulnerability that left exposed covered
information, regardless of whether the
covered entity has determined that a
274 See paragraph (i)(2)(ii) of proposed
Commission regulations 1.13 and 23.603.
275 See paragraph (i)(2)(iii) of proposed
Commission regulations 1.13 and 23.603. Current
Commission regulation 23.603 does not prescribe
the contents of the notification or the method of
notification, so these would be new requirements
for swap entities. See 17 CFR 23.603(d) (‘‘Each
swap dealer and major swap participant shall
promptly notify the Commission of any emergency
or other disruption that may affect the ability of the
swap dealer or major swap participant to fulfill its
regulatory obligations or would have a significant
adverse effect on the swap dealer or major swap
participant, its counterparties, or the market.’’).
276 See paragraph (j)(1) of proposed Commission
regulations 1.13 and 23.603.
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
bad actor has obtained access to that
information. The Commission
preliminarily believes that covered
entities owe an enhanced duty to
protect the covered information
provided to them by their customers
and counterparties in order to ensure
market integrity and support customer
protections. The proposed notification
standard therefore encompasses
incidents where an impact on customers
or counterparties may not be definite so
that they may have an opportunity to
take whatever actions they deem
necessary to protect their interests.
Unlike with the proposed
notifications to the Commission,
however, the Commission preliminarily
believes that the accuracy of
information provided to customers and
counterparties should be prioritized
over early delivery to avoid causing
unnecessary panic that could have
potentially negative and irreversible
spill-over effects. Accordingly, the
proposed customer/counterparty
notification provision does not include
a specific minimum timing requirement
for the notification other than to require
the notification to be provided to
customers and counterparties as soon as
possible.277 The proposed rule would
further require covered entities to
disclose to customers and
counterparties information necessary for
them to understand and assess the
potential impact of the incident on their
information, assets, or positions and
take any necessary actions (e.g., closing
accounts, changing passwords).278 Such
information would include, at a
minimum, a description of the incident,
the particular way in which the
customer or counterparty may have
been adversely impacted, measures
taken by the covered entity to protect
against further harm, and contact
information for the covered entity where
the customer or counterparty may learn
more or ask questions.279
4. Request for Comment
The Commission invites comment on
all aspects of its proposed ORF
notification provisions, including the
following questions:
1. Incident notification to
Commission. The proposed rule would
require covered entities to notify the
Commission of any incident that
‘‘adversely impacts, or is reasonably
likely to adversely impact,’’ information
and technology security, the ability of
the covered entity to continue its
277 See
id.
paragraphs (j)(2)(i)–(iv) of proposed
Commission regulations 1.13 and 23.603.
279 See id.
278 See
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
business activities as a covered entity,
or the assets or positions of a customer
or counterparty. As discussed above, the
Commission believes this standard
would give the Commission an early
warning of incidents that do result in an
observable negative impact or harm, or
such negative impact or harm is
reasonably likely, i.e., where
information and technology security,
business operations, or customers/
counterparties is harmed or
compromised. Given the purpose of the
proposed rule as providing the
Commission an early warning so that it
may act to help mitigate the potential
impacts of the event, the proposed rule
does not include a materiality limiter.
Should the Commission consider
including changing the requirement to
further limit the incident notice to the
incidents with a ‘‘material’’ or
‘‘significant’’ adverse impact, or where
such a material or significant adverse
impact would be reasonably likely? If
yes, how would including such a
materiality limiter change the scope of
incidents that would be reported to the
Commission? In other words, what
types of incidents would not be reported
to the Commission under a standard
that includes a materiality limiter, and
why should the Commission not receive
an early warning of those types of
incidents? Please explain and provide
examples.
2. BCDR notification to Commission.
The Commission is proposing to change
the notification requirement in
Commission regulation 23.603 to trigger
upon a covered entity’s determination to
activate its BCDR plan, rather than
‘‘promptly’’ after an emergency or other
disruption. Do covered entities typically
make a specific determination before
activating the BCDR plan? What is the
process for making that determination
and who makes it? Are there aspects of
the BCDR plan that may become active
before any formal determination is
made? Should the Commission instead
require notification ‘‘when’’ or ‘‘as soon
as’’ a BCDR plan is activated? Why or
why not? Please explain.
3. Notifications to customers or
counterparties. The proposed rule
would require covered entities to
provide affected customers and
counterparties information necessary for
the affected customer/counterparty to
understand and assess the potential
impact of the incident on its
information, assets, or positions and to
take any necessary action. Does the
proposed rule provide sufficient
information for covered entities to
assess and comply with that standard?
PO 00000
Frm 00029
Fmt 4701
Sfmt 4702
4733
I. Amendment and Expansion of Other
Provisions in Current Commission
Regulation 23.603
As mentioned in previous sections of
this notice, the proposed rule would
expand and apply the substance of
existing provisions in current
Commission regulation 23.603 to all
covered entities and the ORF in its
entirety. Such provisions not yet
addressed include (1) the establishment
of emergency contacts for the
Commission and (2) recordkeeping
obligations.280
1. Emergency Contacts—Proposed
Paragraph (k)
To assist the Commission in
responding to a reported incident, or an
emergency or other significant
disruption causing a covered entity to
activate its BCDR plan, the proposed
rule would require each covered entity
to provide the Commission the name
and contact information for two
employees with knowledge of the
covered entity’s incident response plan
and two employees with knowledge of
the covered entity’s BCDR plan.281 Each
identified employee would need to be
authorized to make key decisions on
behalf of the covered entity in the event
of either an incident or the BCDR plan
activation, as applicable, as the
Commission would want to be sure to
be contacting personnel with
appropriate knowledge and authority.282
Any updates to the ORF contacts would
need to be made to the Commission as
necessary to ensure the Commission’s
contact information remains accurate
and up to date.283
This provision is consistent with the
existing emergency contacts
requirement in the swap entity BCDR
plan requirement in current
Commission regulation 23.603.284
280 See 17 CFR 23.603(e) and (i). The Commission
would not retain Commission regulation 23.603(h)
(business continuity and disaster recovery plans
required by other regulatory authorities) as
superfluous, see supra note 198.
281 See paragraph (k)(1) of proposed Commission
regulations 1.13 and 23.603. See also 17 CFR
23.603(e) (requiring the designation of two
emergency contacts with respect to the BCDR plan
for swap entities).
282 See paragraph (k)(2) of proposed Commission
regulations 1.13 and 23.603. The two employee
contacts identified with respect to the information
and technology security program could be the same
as the employee contacts for the BCDR plan,
provided that they have the requisite authority. See
id.
283 See paragraph (k)(3) of proposed Commission
regulations 1.13 and 23.603.
284 See 17 CFR 23.603(e) (‘‘Each swap dealer and
major swap participant shall provide to the
Commission the name and contact information of
two employees who the Commission can contact in
the event of an emergency or other disruption. The
E:\FR\FM\24JAP2.SGM
Continued
24JAP2
4734
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
2. Recordkeeping—Proposed Paragraph
(l)
To aid the Commission in fulfilling its
oversight responsibilities, the proposed
rule would require each covered entity
to maintain all records required
pursuant to the proposed ORF rule,
including the information and
technology security program, the thirdparty relationship program, and the
BCDR plan, in accordance with
Commission regulation 1.31 and to
make them available promptly upon
request to representatives of the
Commission and to representations of
applicable prudential regulators as
defined in section 1a(39) of the CEA.285
This provision is consistent with the
existing recordkeeping requirement in
the swap entity BCDR plan requirement
in current Commission regulation
23.603.286
3. Request for Comment
The Commission invites comment on
all aspects of the proposed emergency
contacts and recordkeeping
requirements.
J. Cross-Border Application for Swap
Entities
ddrumheller on DSK120RN23PROD with PROPOSALS2
In September 2020, the Commission
published a final rule addressing the
cross-border application of certain
provisions of the CEA applicable to
swap entities.287 The rule addresses the
application of the registration
thresholds and certain requirements
applicable to swap entities and
establishes a formal process for
requesting comparability determinations
for such requirements from the
Commission.288 Therein, the
Commission classified current
Commission regulation 23.603 (BCDR
requirements for swap entities) as a
individuals identified shall be authorized to make
key decisions on behalf of the swap dealer or major
swap participant and have knowledge of the firm’s
business continuity and disaster recovery plan. The
swap dealer or major swap participant shall provide
the Commission with any updates to this
information promptly.’’).
285 See paragraph (l) of proposed Commission
regulations 1.13 and 23.603. See 7 U.S.C. 1(a)(39).
286 See 17 CFR 23.603(i) (‘‘The business
continuity and disaster recovery plan of the swap
dealer and major swap participant and all other
records required to be maintained pursuant to this
section shall be maintained in accordance with
Commission Regulation § 1.31 and shall be made
available promptly upon request to representatives
of the Commission and to representatives of
applicable prudential regulators.’’).
287 See Cross-Border Application of the
Registration Thresholds and Certain Requirements
Applicable to Swap Dealers and Major Swap
Participants, 85 FR 56924 (Sept. 14, 2020) (Final
Cross Border Rule); 17 CFR 23.23.
288 Id.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
group A requirement.289 The
Commission described the group A
requirements as helping swap entities
‘‘implement and maintain a
comprehensive and robust system of
internal controls to ensure the financial
integrity of the firm, and, in turn, the
protection of the financial system’’ and
as ‘‘constitut[ing] an important line of
defense against financial, operational,
and compliance risks that could lead to
a firm’s default.’’ 290 Pursuant to
Commission regulation 23.23(f)(1), a
non-U.S. swap entity may satisfy any
applicable group A requirement on an
entity-wide basis by complying with the
applicable standards of a foreign
jurisdiction to the extent permitted by,
and subject to any conditions specified
in, a comparability determination issued
by the Commission.291 In determining to
offer substituted compliance for group A
requirements broadly to all non-U.S.
swap entities, the Commission
explained its belief that group A
requirements cannot be effectively
applied on a fragmented jurisdictional
basis, such that it would not be practical
to limit substituted compliance for
group A requirements to transactions
involving only non-U.S. persons.292
As discussed above, the proposed rule
would amend current Commission
regulation 23.603 to contain the entirety
of the ORF requirements applicable to
swap entities, which would include
requirements not only relating to BCDR
but also those relating to information
and technology security and third-party
relationships. The Commission
preliminarily believes that the same
rationale for classifying BCDR
requirements as a group A requirement
would apply to the ORF rule more
broadly. As discussed in detail above,
the Commission preliminarily believes
that the proposed information and
technology security and third-party risk
relationship requirements would also
serve to help swap entities implement
and maintain a comprehensive and
robust system of internal controls,
serving as an important line of defense
against the threat of failure at the firm
level and of the financial system more
broadly. Accordingly, should the ORF
rule be adopted, the Commission would
289 Id. at 56964–65; 17 CFR 23.23(a)(6) (defining
‘‘group A requirements’’).
290 Final Cross-Border Rule, 85 FR 56964
(providing that ‘‘requiring swap entities to
rigorously monitor and address the risks they incur
as part of their day-to-day businesses lowers the
registrants’ risk of default—and ultimately protects
the public and the financial system.’’).
291 See 17 CFR 23.23(f)(1). See also 17 CFR
23.23(a)(11) (defining ‘‘non-U.S. swap entity’’); 17
CFR 23.23(g) (describing the process for the
issuance of comparability determinations).
292 See Final Cross-Border Rule, 85 FR 56977.
PO 00000
Frm 00030
Fmt 4701
Sfmt 4702
continue to classify Commission
regulation 23.603 in its entirety as a
group A requirement, for which
substituted compliance would broadly
be available pursuant to the
requirements of Commission regulation
23.23(f)(1).
As mentioned above, Commission
regulation 23.23(f)(1) only allows
substituted compliance ‘‘to the extent
permitted by, and subject to any
conditions specified in, a comparability
determination issued by the
Commission under [Commission
regulation 23.23(g)].’’ 293 Current
Commission comparability
determinations do not address the
entirety of the proposed ORF rule, as it
has yet to be adopted. Rather, they only
address the requirements in current
Commission regulation 23.603, which
are limited to the BCDR plan
requirement.
The Commission appreciates that
non-U.S. swap entities have come to
rely on existing comparability
determinations with respect to the
current BCDR requirements in
Commission regulation 23.603.
Accordingly, in the interest of comity
and good governance, should the
proposed rule be adopted, the
Commission has preliminarily
determined to permit non-U.S. swap
entities to continue to rely on current
comparability determinations with
respect to the Commission’s BCDR
requirements, even as amended.
However, for substituted compliance to
be available for the ORF rule in its
entirety, an eligible swap entity or
foreign regulatory authority would need
to submit a request for a comparability
determination pursuant to Commission
regulation 23.23(g). The submission
would need to address the full
complement of the provisions of the
ORF rule, however codified in amended
Commission regulation 23.603,
including the BCDR requirements. The
Commission would then evaluate the
request, considering amended
Commission regulation 23.603 in its
entirety, and, if the Commission were to
conclude it appropriate to do so, issue
updated comparability determinations
that would supersede any pre-existing
comparability determinations with
respect to BCDR requirements for swap
entities.
Request for Comment
The Commission invites comment on
all aspects of the cross-border
implications of the proposed rule.
293 See
E:\FR\FM\24JAP2.SGM
17 CFR 23.23(f)(1).
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
K. Implementation Period
Should the proposed rule be adopted,
the Commission recognizes that covered
entities may need time to establish an
ORF or review and update existing
plans and procedures for compliance
with the proposed ORF rule. The
Commission preliminarily believes that,
given existing and applicable NFA,
prudential, and foreign requirements,
six months from the rule’s adoption
would be a sufficient amount of time for
covered entities to achieve compliance
with the ORF rule.
The Commission invites comment on
the Commission’s proposed
implementation period for the proposed
ORF rule, including the following
questions:
1. Would six months be as sufficient
amount of time for covered entities to
develop compliant ORFs? If not, why
not? Please explain.
2. If covered entities would need more
than six months to implement the ORF
as proposed, how much more time
would they estimate to need, and what
would they be doing with that time?
Please be as detailed as possible.
III. Related Matters
ddrumheller on DSK120RN23PROD with PROPOSALS2
A. Regulatory Flexibility Act
The Regulatory Flexibility Act (RFA)
requires Federal agencies, in
promulgating regulations, to consider
the impact of those regulations on small
entities—whether the rules will have a
significant economic impact on a
substantial number of small entities—
and if so, to provide a regulatory
flexibility analysis reflecting the
impact.294 The Commission has
established certain definitions of ‘‘small
entities’’ to be used by the Commission
in evaluating the impact of its rules on
small entities in accordance with the
RFA.295 The proposed regulations
would affect FCMs, SDs, and MSPs. The
Commission has previously determined
that FCMs, SDs, and MSPs are not small
entities for purposes of the RFA.296
Accordingly, the Chairman, on behalf of
the Commission, hereby certifies
pursuant to 5 U.S.C. 506(b) that the
proposed rule and rule amendments
would not have a significant economic
impact on a substantial number of small
entities.
294 5
U.S.C. 601 et seq.
Policy Statement and Establishment of
Definitions of ‘‘Small Entities’’ for Purposes of the
Regulatory Flexibility Act, 47 FR 18618 (Apr. 30,
1982) (RFA Definitions of ‘‘Small Entities’’).
296 See RFA Definitions of ‘‘Small Entities,’’ 47 FR
18619 (FCMs); Final Swap Entities RMP Rule, 77
FR 20193–94 (SDs and MSPs).
295 See
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
B. Paperwork Reduction Act
The Paperwork Reduction Act (PRA)
imposes certain requirements on federal
agencies, including the Commission, in
connection with conducting or
sponsoring any ‘‘collection of
information,’’ as defined by the PRA.297
The PRA is intended, in part, to
minimize the paperwork burden created
for individuals, businesses, and other
persons as a result of the collection of
information by federal agencies, and to
ensure the greatest possible benefit and
utility of information created, collected,
maintained, used, shared, and
disseminated by or for the Federal
Government.298 The PRA applies to all
information, regardless of form or
format, whenever the Federal
Government is obtaining, causing to be
obtained, or soliciting information, and
includes required disclosure to third
parties or the public, of facts or
opinions, when the information
collection calls for answers to identical
questions posed to, or identical
reporting or recordkeeping requirements
imposed on, ten or more persons.299
This proposed rulemaking would
result in new collection of information
requirements within the meaning of the
PRA. The Commission is therefore
submitting this proposal to the Office of
Management and Budget (OMB) for
review.300 The title for this collection of
information is ‘‘Operational Resilience
Framework for Futures Commission
Merchants, Swap Dealers, and Major
Swap Participants.’’ The OMB has not
yet assigned this collection a control
number. An agency may not conduct or
sponsor, and a person is not required to
respond to, a collection of information
unless it displays a currently valid
control number.301
If the proposed regulations are
adopted, responses to this collection of
information would be mandatory. The
Commission will protect proprietary
information according to the Freedom of
Information Act and part 145 of the
Commission’s regulations, ‘‘Commission
Records and Information.’’ 302 In
addition, section 8(a)(1) of the CEA
strictly prohibits the Commission,
unless specifically authorized by the
CEA, from making public ‘‘data and
information that would separately
disclose the business transactions or
market positions of any person and
trade secrets or names of customers.’’ 303
297 44
U.S.C. 3501 et seq.
298 Id.
299 See
44 U.S.C. 3502(3).
44 U.S.C. 3507(d); 5 CFR 1320.11.
301 See 44 U.S.C. 3507(a)(3); 5 CFR 1320.5(a)(3).
302 See 5 U.S.C. 552. See also 17 CFR part 145.
303 7 U.S.C. 12(a)(1).
300 See
PO 00000
Frm 00031
Fmt 4701
Sfmt 4702
4735
The Commission is also required to
protect certain information contained in
a government system of records
according to the Privacy Act of 1974.304
1. Information Provided by Reporting
Entities/Persons
The proposed regulations would
require each covered entity to establish,
document, implement, and maintain an
ORF that includes an information and
technology security program, a thirdparty relationship program, and a BCDR
plan, each of which would need to be
supported by written policies and
procedures. In addition, the proposed
regulations would impose the following
reporting, recordkeeping, and disclosure
obligations on each covered entity: (1)
on an annual basis, written approval of
each component program or plan of the
ORF and of risk appetite and risk
tolerance limits, or in the case of
covered entities relying on a
consolidated program or plan, written
attestation; (2) on an annual basis,
documenting review and testing of the
ORF; (3) as applicable, notifying the
Commission of certain ‘‘incidents,’’ as
defined in the proposed rule; (4) as
applicable, notifying the Commission
upon activation of the BCDR plan; (5) as
applicable, notifying customers or
counterparties of certain ‘‘incidents,’’ as
defined in the proposed rule; and (6)
providing emergency contact
information to the Commission in
connection with the information and
technology security program and the
BCDR plan. These requirements will
result in new PRA burdens for covered
entities.
For purposes of the PRA, the term
‘‘burden’’ means the ‘‘time, effort, or
financial resources expended by persons
to generate, maintain, or provide
information to or for a Federal
Agency.’’ 305 This total includes the
anticipated burden associated with the
development of the required written
policies and procedures, satisfaction of
various reporting, recordkeeping, and
disclosure obligations, the
documentation of required ORF testing
and review, and the documentation of
risk appetite and risk tolerance limits
approval.
As of October 31, 2023, there are 160
covered entities that would become
subject to the proposed rule (100
registered swaps dealers, 54 registered
futures commission merchants, and 6
dually-registered swap dealers/futures
commission merchants). The estimated
burden associated with the proposed
304 See
305 44
E:\FR\FM\24JAP2.SGM
5 U.S.C. 552a.
U.S.C. 3502(2).
24JAP2
4736
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
information collections is calculated as
follows:
ddrumheller on DSK120RN23PROD with PROPOSALS2
a. Recordkeeping Requirements
The proposed regulation contains
recordkeeping requirements that would
result in a collection of information
from ten or more persons over a 12month period.
Establishing, documenting,
implementing, and maintaining
information and technology security
program: As part of an overall ORF,
proposed Commission regulations
1.13(d) and 23.603(d) would require
covered entities to establish an
information and technology security
program reasonably designed to
identify, monitor, manage, and assess
risks relating to information and
technology security, including through
conducting and documenting risk
assessments at least annually. Upon the
risk assessment’s completion, the results
would need to be provided to the
oversight body, senior officer, or other
senior-level official who approves the
information and technology security
program. As part of the information and
technology security program, the
proposed rule would require the
covered entity to establish, document,
implement, and maintain controls to
prevent, detect, and mitigate identified
risks to information and technology
security. In addition, the proposed rule
would require that the information and
technology security program include a
written incident response plan
reasonably designed to detect, assess,
contain, mitigate the impact of, and
recover from an incident.
The Commission anticipates that a
covered entity would require an
estimated 200 hours to develop their
information and technology security
program, including conducting and
documenting an annual risk assessment
and developing an incident response
plan. This yields a total annual burden
of 32,000 burden hours (160
respondents × 200 hours = 32,000
hours).
Accordingly, the aggregate annual
estimate for the recordkeeping burden
associated with this proposal would be
as follows:306
Number of registrants: 160.
306 This estimate reflects the aggregate
information collection burden estimate associated
with the proposed recordkeeping requirement for
the first annual period following implementation of
the proposed regulations. Because proposed
Commission regulations 1.13(d) and 23.603(d)
would require the one-time recordkeeping
requirement as to developing the information and
technology security program, Commission staff
estimates that for each subsequent annual period,
the number of burden hours would be reduced
accordingly.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
Estimated number of responses: 1.
Estimated total annual burden per
registrant: 200 hours.
Frequency of collection: Annually.
Total annual burden: 32,000 burden
hours [160 registrants × 200 hours].
Establishing, documenting,
implementing, and maintaining thirdparty relationship program: Proposed
Commission regulations 1.13(e) and
23.603(e) would require covered entities
to develop a program reasonably
designed to identify, monitor, manage,
and assess risks relating to third-party
relationships. The program would be
required to address the risks attendant
to each stage of the third-party
relationship lifecycle and would be
required to include an inventory of
third-party service providers the
covered entity has engaged to support
its activities as a covered entity.
The Commission anticipates that a
covered entity would require an
estimated 160 hours annually to
develop their third-party relationship
program, including creating and
maintaining a third-party service
provider inventory. This yields a total
annual burden of 25,600 hours (160
respondents × 160 hours = 25,600
burden hours). The aggregate annual
estimate for the recordkeeping burden
associated with this proposal would be
as follows: 307
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per
registrant: 160 hours.
Frequency of collection: Annually.
Total annual burden: 25,600 burden
hours [160 registrants × 160 hours].
Establishing, documenting,
implementing, and maintaining BCDR
plan: Proposed Commission regulations
1.13(f) and 23.603(f) would require
covered entities to establish a written
BCDR plan reasonably designed to
identify, monitor, manage, and assess
risks relating to emergencies or other
significant disruptions to the continuity
of normal business operations as a
covered entity.308 The proposed rule
307 This estimate reflects the aggregate
information collection burden estimate associated
with the proposed recordkeeping requirement for
the first annual period following implementation of
the proposed regulations. Because proposed
Commission regulations 1.13(e) and 23.603(e)
would require the one-time recordkeeping
requirement as to developing the third-party
relationship program, Commission staff estimates
that for each subsequent annual period, the number
of burden hours would be reduced accordingly.
308 As discussed in section II.E (Continuity and
Disaster Recovery Plan) of this notice, swap entities
are already required to establish a written BCDR
plan pursuant to current Commission regulation
23.603. The existing burdens for current
Commission regulation 23.603 are found in the
following information collection, Regulations
PO 00000
Frm 00032
Fmt 4701
Sfmt 4702
would require the BCDR plan be
reasonably designed to enable the
covered entity to: (1) continue or resume
any activities as a covered entity with
minimal disruption to customers,
counterparties, and markets; and (2)
recover and make use of covered
information, in addition to any other
data, information, or documentation
required to be maintained by law and
regulation. These plans would be
required to, among other things,
establish procedures for data backup
and establish and maintain
arrangements to provide for
redundancies or their backup for
covered technology, facilities,
infrastructure, personnel, and
competencies.
The Commission anticipates that a
covered entity would require an
estimated 50 hours annually to develop
or to update their existing written BCDR
plan. This yields a total annual burden
of 8,000 burden hours (160 respondents
× 50 hours = 8,000 hours).
Accordingly, the aggregate annual
estimate for the recordkeeping burden
associated with this proposal would be
as follows:309
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per
registrant: 50 hours.
Frequency of collection: Annually.
Total annual burden: 8,000 burden
hours [160 registrants × 50 hours].
Documentation of ORF review:
Proposed Commission regulations
1.13(h) and 23.603(h) would require
covered entities to establish, implement,
and maintain plans reasonably designed
to assess their adherence to, and the
effectiveness of, their ORF through
regular reviews and risk-based testing.
The proposed rule would require that
reviews be conducted at least annually
and when any material change to
covered entities’ activities or operations
occurs that is reasonably likely to affect
Establishing and Governing the Duties of Swap
Dealers and Major Swap Participants (OMB Control
No. 3038–0084). The burden of swap entities
updating their BCDR plan is included in the new
collection of information established by the
proposed rule, but the Commission is retaining its
existing burden estimates under Control No. 3038–
0084 at this time to avoid undercounting. The
Commission will adjust its burden estimates
associated with OMB Control No. 3038–0084 at a
later date, as necessary.
309 This estimate reflects the aggregate
information collection burden estimate associated
with the proposed recordkeeping requirement for
the first annual period following implementation of
the proposed regulations. Because proposed
Commission regulations 1.13(f) and 23.603(f) would
require the one-time recordkeeping requirement, as
to developing the BCDR plan, Commission staff
estimates that for each subsequent annual period,
the number of burden hours would be reduced
accordingly.
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
the risks identified in the ORF. With
regard to testing, the proposed rule
would require that the testing of
information and technology security
program include, at a minimum, the
testing of key controls and the incident
response plan at least annually; daily or
continuous automated vulnerability
scans; and penetration testing at least
annually. Additionally, the proposed
rule would require that testing of the
BCDR plan must include, at a minimum,
a walk-through or tabletop exercise
designed to test the effectiveness of
backup facilities and capabilities at least
annually.
The proposed rule would also require
covered entities to document all reviews
and testing of their ORFs. The proposed
rule would require that documentation
to include, at a minimum, (i) the date
the review or testing was conducted; (ii)
the nature and scope of the review or
testing, including methodologies
employed; (iii) the results of the review
or testing, including any assessment of
effectiveness; (iv) any identified
deficiencies and recommendations for
remediation; and (v) any corrective
action(s) taken or initiated, including
the date(s) of such action(s).
The Commission anticipates that
covered entities would require an
estimated 80 hours annually to establish
a plan to assess adherence to, and the
effectiveness of, its ORF, as well as
documenting all reviews and testing of
the ORF. This yields a total annual
burden of 12,800 hours (160
respondents × 80 hours = 12,800 burden
hours).
The aggregate annual estimate for the
recordkeeping burden associated with
this proposal would be as follows: 310
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per
registrant: 80 hours.
Frequency of collection: Annually.
Total annual burden: 12,800 burden
hours [160 registrants × 80 hours].
Documentation of approval of the
component programs or plan, risk
appetite, and risk tolerance limits:
Proposed Commission regulations
1.13(c)(1) and 23.603(c)(1) would
require covered entities to ensure that
the information and technology security
310 This estimate reflects the aggregate
information collection burden estimate associated
with the proposed recordkeeping requirement for
the first annual period following implementation of
the proposed regulations. Because proposed
Commission regulations 1.13(h) and 23.603(h)
would require the one-time recordkeeping
requirement as to developing a plan to assess the
effectiveness of the ORF, Commission staff
estimates that for each subsequent annual period,
the number of burden hours would be reduced
accordingly.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
program, third-party relationship
program, and BCDR plan are approved
in writing on at least an annual basis by
either the senior officer, an oversight
body, or a senior-level official with
primary responsibility for the
component programs or plan. Proposed
Commission regulations 1.13(c)(2) and
23.603(c)(2) would require the risk
appetite and risk tolerance limits
established by covered entities be
approved in writing at least annually by
either the senior officer, an oversight
body, or a senior-level official. Proposed
Commission regulations 1.13(c)(4)(ii)
and 23.603(c)(4)(ii) would allow
covered entities that rely on a
consolidated program or plan for its
ORF to meet the annual approval
requirement for the component
programs or plan of the ORF, risk
appetite, and risk tolerance limits
through an annual written attestation by
either the senior officer, an oversight
body, or a senior-level official.
The Commission anticipates that
covered entities would require an
estimated 20 hours annually to
document approval of the ORF, risk
appetite, and risk tolerance limits or to
prepare the written attestation. This
yields a total annual burden of 3,200
hours (160 respondents × 20 hours =
3,200 burden hours).
The aggregate annual estimate for the
recordkeeping burden associated with
this proposal would be as follows:
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per
registrant: 20 hours.
Frequency of collection: Annually.
Total annual burden: 3,200 burden
hours [160 registrants × 20 hours].
b. Reporting Requirements
The proposed regulation contains
reporting requirements that would
result in a collection of information
from ten or more persons over a 12month period.
Notification of incidents to the
Commission: Proposed Commission
regulations 1.13(i)(1) and 23.603(i)(1)
would require covered entities to notify
the Commission regarding incidents that
adversely impact or are reasonably
likely to adversely impact: (1)
information technology and security; (2)
the covered entity’s ability to continue
its business activities; or (3) the assets
or positions of a customer or
counterparty. These notifications would
be required to include information that
may assist the Commission in assessing
and responding to the incident,
including the date the incident was
detected, possible cause(s) of the
incident, its apparent or likely impacts,
PO 00000
Frm 00033
Fmt 4701
Sfmt 4702
4737
and any actions the covered entity has
taken or is taking to mitigate or recover
from the incident. Notifications would
be required to be submitted via email as
soon as possible, but no later than 24
hours after an incident is detected.
The Commission anticipates that
covered entities may experience one
reportable incident per year and that
covered entities would expend
approximately 10 hours to gather the
information required and provide the
required notification to the Commission.
This would result in an estimated total
annual burden of 1,600 hours (160
respondents × 1 reportable incident per
year × 10 hours per reportable incident
= 1,600 hours).
The aggregate annual estimate for the
reporting burden associated with this
proposal would be as follows:
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per
registrant: 10 hours.
Frequency of collection: As needed.
Total annual burden: 1,600 burden
hours [160 registrants × 10 hours].
Notification of BCDR plan activation:
Proposed Commission regulations
1.13(i)(2) and 23.603(i)(2) would require
covered entities to notify the
Commission of any determination to
activate the BCDR plan. Covered entities
would be required to provide such
notices via email and include any
information available at the time of the
notification that may assist the
Commission in assessing or responding
to the emergency or disruption,
including the date of the emergency or
disruption, a description thereof, the
possible cause(s), its apparent or likely
impacts, and any actions the covered
entity has taken or is taking to mitigate
or recover from the emergency or
disruption, including measures taken or
being taken to protect customers.
The Commission anticipates that
approximately 3 covered entities may
activate their BCDR plan per year and
that such covered entities would expend
approximately 10 hours to gather the
information required and to provide the
required notification to the Commission.
This would result in an estimated total
annual burden of 30 burden hours (3
BCDR activations per year × 10 hours
per BCDR activation = 30 hours).
The aggregate annual estimate for the
reporting burden associated with this
proposal would be as follows:
Number of registrants: 3.
Estimated number of responses per
respondent: 1.
Estimated total annual burden per
registrant: 10 hours.
Frequency of collection: As needed.
E:\FR\FM\24JAP2.SGM
24JAP2
4738
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
Total annual burden: 30 burden hours
[3 BCDR activations per year × 10
hours].
Filing emergency contact information:
Proposed Commission regulations
1.13(k) and 23.603(k) would require
covered entities to provide the
Commission with emergency contact
information for employees to serve as
contacts in connection with required
incident notifications under the ORF
and the activation of the covered
entity’s BCDR plan.
The Commission anticipates that
covered entities would require an
estimated 1 hour annually to provide
the Commission with emergency contact
information. This yields a total annual
burden of 160 burden hours (160
respondents × 1 hour = 160 burden
hours).
The aggregate annual estimate for the
reporting burden associated with this
proposal would be as follows: 311
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per
registrant: 1 hour.
Frequency of collection: As needed.
Total annual burden: 160 burden
hours [160 registrants × 1 hour].
ddrumheller on DSK120RN23PROD with PROPOSALS2
c. Disclosure Requirements
The proposed regulation contains
disclosure requirements that would
result in a collection of information
from ten or more persons over a 12month period.
Notification of incidents to affected
customers and counterparties: Proposed
Commission regulations 1.13(j) and
23.603(j) would require covered entities
to notify their customers and
counterparties as soon as possible of any
incident that is reasonably likely to have
adversely affected the confidentiality or
integrity of the customer’s or
counterparty’s covered information,
assets, or positions. The proposed rule
would require that notifications include
information necessary for the affected
customer or counterparty to understand
and assess the potential impact of the
incident on its information, assets, or
positions and to take any necessary
action. Such notifications shall include,
at a minimum, a description of the
incident; the way the customer or
counterparty, or its covered information,
311 This estimate reflects the aggregate
information collection burden estimate associated
with the proposed reporting requirement for the
first annual period following implementation of the
proposed regulations. Because proposed
Commission regulations 1.13(k) and 23.603(k)
would require the emergency contact information
provided to the Commission to be updated only as
necessary, Commission staff estimates that for each
subsequent annual period, the number of burden
hours would be reduced accordingly.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
may have been adversely impacted;
measures being taken by the covered
entity to protect against further harm;
and contact information for the covered
entity where the customer or
counterparty may learn more about the
incident or ask questions.
The Commission anticipates that
covered entities may experience 17
reportable incidents per year and that
covered entities would expend
approximately 50 hours to gather the
required information necessary to
provide notice of an incident and to
prepare and deliver the required
notification. This would result in an
estimated total annual burden of 850
burden hours (17 reportable incidents
per year × 50 hours per reportable
incident = 850 burden hours).
The aggregate annual estimate for the
disclosure burden associated with this
proposal would be as follows:
Number of registrants: 17.
Estimated number of responses per
respondent: 1.
Estimated total annual burden per
registrant: 50 hours.
Frequency of collection: As needed.
Total annual burden: 850 burden
hours [17 reportable incidents per year
× 50 hours].
d. Total Burden
Based upon the estimates above, the
aggregate annual cost for all covered
entities is 84,240 burden hours.
It is expected that covered entities
will utilize existing software,
information technology and systems.
Thus, the Commission believes any
additional capital/startup costs or
operational/maintenance costs incurred
by respondents to report the information
required by the proposed regulations to
the Commission would be negligible, if
any.
2. Request for Comment
The Commission invites the public
and other federal agencies to comment
on any aspect of the reporting,
recordkeeping, and disclosure burdens
discussed above. Pursuant to 44 U.S.C.
3506(c)(2)(B), the Commission will
consider public comments on this
proposed collection of information in:
(1) Evaluating whether the proposed
collection of information is necessary
for the proper performance of the
functions of the Commission, including
whether the information will have
practical utility;
(2) Evaluating the accuracy of the
Commission’s estimate of the burden of
the proposed collection of information,
including the degree to which the
methodology and the assumptions that
the Commission employed were valid;
PO 00000
Frm 00034
Fmt 4701
Sfmt 4702
(3) Enhancing the quality, utility, and
clarity of the information proposed to be
collected; and
(4) Minimizing the burden of the
collection of information on covered
entities, including through the use of
appropriate automated, electronic,
mechanical, or other technological
information collection techniques, e.g.,
permitting electronic submission of
responses.
A copy of the supporting statements
for the collections of information
discussed above are available from the
CFTC Clearance Officer, 1155 21st
Street NW, Washington, DC 20581, 202–
418–5714, or from https://
www.RegInfo.gov. Organizations and
individuals desiring to submit
comments on the proposed information
collection requirements should send
those comments to:
• The Office of Information and
Regulatory Affairs, Office of
Management and Building, Room
10235, New Executive Office Building,
Washington, DC 20503, Attn: Desk
Officer of the Commodity Futures
Trading Commission;
• 202–395–6566 (fax);
• OIRAsubmissions@omb.eop.gov
(email).
Please provide the Commission with
a copy of submitted comments so that
all comments can be summarized and
addressed in the final rulemaking.
Please refer to the ADDRESSES section of
this notice of proposed rulemaking for
comment submission instructions to the
Commission. OMB is required to decide
concerning the collection of information
between 30 and 60 days after
publication of this document in the
Federal Register. Therefore, a comment
is best assured of receiving full
consideration if OMB (and the
Commission) receives it within 30
calendar days of publication of this
notice. Nothing in the foregoing affects
the deadline enumerated above for
public comment to the Commission on
the proposed rule.
C. Cost-Benefit Considerations
Section 15(a) of the CEA requires the
Commission to consider the costs and
benefits of its discretionary actions
before promulgating a regulation under
the CEA or issuing certain orders.312
Section 15(a) further specifies that the
costs and benefits shall be evaluated in
light of five broad areas of market and
public concern: (1) Protection of market
participants and the public; (2)
efficiency, competitiveness, and
financial integrity of swaps markets; (3)
price discovery; (4) sound risk
312 See
E:\FR\FM\24JAP2.SGM
7 U.S.C. 19(a).
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
management practices; and (5) other
public interest considerations.313 In
conducting its analysis, the Commission
may, in its discretion, give greater
weight to any one of the five
enumerated areas of concern. The
Commission considers the costs and
benefits resulting from its discretionary
determinations with respect to the
considerations of section 15(a) of the
CEA.
As detailed above, the proposed rule
would require covered entities (FCMs,
SDs, and MSPs) to establish, document,
implement, and maintain an ORF
reasonably designed to identify,
monitor, manage, and assess risks
relating to (i) information and
technology security, (ii) third-party
service providers, and (iii) emergencies
or other significant disruptions to the
continuity of their normal business
operations.314 The ORF would
accordingly need to include a program
or plan directed at each of these three
risk areas (an information and
technology security program, a thirdparty relationship program, and a
business continuity and disaster
recovery plan), as well as a plan for the
review and testing of the ORF, each of
which would need to meet certain
specified minimum requirements.315
The proposed rule would further
establish governance, training, and
recordkeeping requirements related to
the ORF, as well as require notification
of certain ORF-related events to the
Commission and customers or
counterparties.316 The main purpose of
the proposed ORF, as discussed above,
is to promote sound practices for
managing risks relating to information
and technology security, third-party
relationships, and emergencies or other
significant disruptions, so as to support
covered entity operational resilience, to
the benefit of customers, counterparties,
and the derivatives markets more
broadly.
The Commission identifies and
considers the benefits and costs of the
proposed amendments relative to the
baseline of the current status quo. As
discussed above, all of the proposed
ddrumheller on DSK120RN23PROD with PROPOSALS2
313 Id.
314 See paragraph (b)(1) of proposed Commission
regulations 1.13 and 23.603.
315 See paragraphs (b)(2) (components), (d)
(information and technology security program), (e)
(third-party relationship program), (f) (business
continuity and disaster recovery plan), and (h)
(reviews and testing) of proposed Commission
regulations 1.13 and 23.603.
316 See paragraphs (c) (governance), (g) (training),
(i) (notifications to the Commission), (j)
(notification of incidents to affected customers or
counterparties), (k) (emergency contacts), and (l)
(recordkeeping) of proposed Commission
regulations 1.13 and 23.603.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
requirements would be new CFTC
requirements for covered entities, with
the exception of the BCDR plan
requirement for swap entities, which the
proposed rule would amend in certain
respects.317 Nevertheless, the
Commission preliminarily believes that
many, if not all, covered entities
currently registered with the
Commission have likely adopted
documents, policies, and practices
consistent with the proposed ORF rule.
Current NFA rules and interpretive
notices, for instance, address the core
risks at the center of the ORF—
information and technology security,
third-party risks, and BCDR planning—
and establish related requirements that
apply to covered entities, including a
BCDR plan requirement for FCMs.318
Additionally, many covered entities are
subject to prudential regulation, which
includes requirements relating to
information security and notifications of
related incidents.319 Prudential
regulators have also provided guidance
relating to operational resilience and
third-party relationships.320
Furthermore, based on its oversight
activities, the Commission preliminarily
believes that certain aspects of the
proposed rule requirements are already
employed by many covered entities as
recommended best practices.
The Commission acknowledges that,
no matter the degree to which a covered
entity currently operates in a manner
consistent with the requirements of the
proposed rule, covered entities would
all incur some level of costs in
reviewing the proposed rule and
comparing their existing practices and
procedures against it to ensure they
meet the minimum requirements and
make any necessary updates.
Nevertheless, the Commission
preliminarily believes that the actual
costs and benefits of the proposed rule
317 See
17 CFR 23.603.
supra note 43; see also supra note 60
(noting that NFA’s requirement to establish a
business continuity and disaster recovery plan does
not apply to swap entities).
319 See Computer-Security Incident Notification
Requirements for Banking Organizations and their
Bank Service Providers, 86 FR 66424 (Nov. 23,
2021); 12 CFR part 30, app. A (Interagency
Guidelines Establishing Standards for Safety and
Soundness); 12 CFR part 30, app. B (Interagency
Guidelines Establishing Information Security
Standards).
320 See supra note 43. See also supra note 50. The
Commission notes that the Prudential Operational
Resilience Paper was ‘‘written for use by the largest
and most complex domestic firms,’’ including
financial institutions with average total
consolidated assets greater than or equal to (a) $250
billion or (b) $100 billion and have $75 billion or
more in average weighted short-term wholesale
funding, average nonbank assets, or average offbalance-sheet exposure. See Prudential Operational
Resilience Paper, supra note 11, at 1.
318 See
PO 00000
Frm 00035
Fmt 4701
Sfmt 4702
4739
as realized by most current covered
entities may not be as significant as they
would be for entities not already subject
to NFA or prudential authority or that
have not already adopted operational
resilience practices in line with general
standards and best practices. The
Commission also preliminarily believes
that leveraging existing standards and
guidance and aligning with other
applicable authorities to the degree
sensible and appropriate, as
recommended by the National Cyber
Strategy, in itself is a benefit to covered
entities and the markets more broadly,
by reducing compliance burdens while
promoting practices that have proven to
support operational resilience and
positive regulatory outcomes.
Customers, counterparties, and the
public more generally would likely
benefit as well, as the proposed rule
would allow the Commission to exercise
its oversight authority to foster
compliance with the ORF requirements
that are currently absent from its
regulations.
By its terms, section 15(a) does not
specifically require the Commission to
quantify the costs and benefits of a new
rule or to determine whether the
benefits of the adopted rule outweigh its
costs. Rather, section 15(a) requires the
Commission to ‘‘consider the costs and
benefits’’ of a subject rule.321 The
Commission has endeavored to assess
the expected costs and benefits of the
proposed amendments in quantitative
terms, including PRA related costs,
where possible. In situations where the
Commission is unable to quantify the
costs and benefits, the Commission
identifies and considers the costs and
benefits of the applicable proposed
amendments in qualitative terms.
However, the Commission lacks the data
necessary to reasonably quantify all of
the costs and benefits considered below.
Additionally, any initial and recurring
compliance costs for any particular
covered entity would depend on its size,
existing infrastructure, practices, and
cost structures, as well as the nature,
size, scope, complexity, and risk profile
of its operations as a covered entity. It
is impossible to place a reliable dollar
figure on potential future incidents that
might be prevented through this
rulemaking because the threats are too
varied. The constantly changing nature
of technology exacerbates this
difficulty.322
321 See
7 U.S.C. 19(a).
Cybersecurity Paper, supra note 15, at 1
(‘‘The cyber threat landscape is also characterised
by a significant and continuous rise in the cost of
cyber incidents. Statista (2023) estimated the global
cost of cyber crime in 2022 at $8.4 trillion and
322 FSI
E:\FR\FM\24JAP2.SGM
Continued
24JAP2
4740
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
Regarding covered entities’ costs,
while the Commission generally
believes—based on anecdotal
information and its general
understanding—that covered entities
have already instituted, to a large
degree, the practices called for in the
proposed rule, the Commission lacks
empirical evidence or data to verify that
belief (including the number of covered
entities whose practices currently meet
the requirements being proposed) and
quantify what, if any, material costs
covered entities would incur to comply
with the proposed regulations. To the
extent covered entities would need to
make operational changes to comply
with the proposed amendments, the
Commission expects they would be
proportionate to the nature, size, scope,
complexity, and risk profile of their
operations as covered entities. The
Commission therefore invites comments
providing data and other empirical
information to allow it to quantify the
degree to which: (1) covered entities
currently have implemented (or
independent of the proposed
amendments, otherwise plan to
implement) practices that are compliant
with the Commission’s proposed
regulations and (2) the expected
additional costs for any covered entities
that, to date, have not completely done
so or are otherwise moving
independently towards doing so.
The Commission notes that this costbenefit consideration is based on its
understanding that the derivatives
markets regulated by the Commission
function internationally with: (1)
transactions that involve U.S. entities
occurring across different international
jurisdictions; (2) some entities organized
outside of the United States that are
registered with the Commission; and (3)
some entities that typically operate both
within and outside the United States
and that follow substantially similar
business practices wherever they are
located. Where the Commission does
not specifically refer to matters of
location, the discussion of costs and
benefits below refers to the effects of the
proposed regulations on all relevant
derivatives activity, whether based on
expects this to go beyond $11 trillion in 2023. This
reflects an annual increase of 30% in the cost of
cyber crime during the 2021–23 period. Moreover,
the average cost of a data breach between 2020 and
2022 increased by 13%, with the financial industry
scoring the second highest average cost after
healthcare at $6 million. According to Chainalysis
(202[3]), 2022 was the biggest year ever for crypto
hacking, with $3.8 billion stolen from
cryptocurrency businesses. Cyber insurance
demand continues to outweigh supply and that the
cyber protection gap appears to be widening amid
a market characterised by rising premiums,
narrowing coverage and tighter underwriting
standards.’’).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
their actual occurrence in the United
States, or on their connection with, or
effect on, U.S. commerce.
In the sections that follow, the
Commission discusses the costs and
benefits associated with the proposed
rule, as well as reasonable alternatives,
relative to the baseline. The
Commission generally requests
comment on all aspects of its costbenefit consideration, including the
baseline; assumptions and methodology
employed; the identification and
measurement of costs and benefits
relative to the baseline; the
identification, measurement, and
assessment of any costs and benefits not
discussed herein; data and any other
information to assist or otherwise
inform the Commission’s ability to
better quantify or qualitatively
understand and describe the costs and
benefits of the proposed amendments;
whether and what specific alternatives
would be more reasonable in terms of
their costs and benefits and why; and
substantiating data, statistics, and any
other information to support positions
posited by commenters with respect to
the Commission’s discussion and/or
requests for comments.
1. Costs and Benefits
The following sections discuss the
costs and benefits that the Commission
preliminarily expects to result from the
requirements in the proposed rule.
e. Generally—Proposed Paragraph (b)
The proposed rule would require
covered entities to establish, document,
implement, and maintain an ORF
reasonably designed to identify,
monitor, manage, and assess risks
relating to: (i) information and
technology security; (ii) third-party
relationships; and (iii) emergencies or
other significant disruptions to the
continuity of normal business
operations as covered entities.323 The
ORF would need to, at a minimum,
include an information and technology
security program, a third-party
relationship program, and a business
continuity and disaster recovery plan,
and each component program or plan
would need to be supported by written
policies and procedures.324 Covered
entities would further need to ensure
that their ORF is appropriate and
proportionate to the nature, size, scope,
complexity, and risk profile of their
business activities as covered entities,
323 See paragraph (b)(1) of proposed Commission
regulations 1.13 and 23.603.
324 See paragraph (b)(2) of proposed Commission
regulations 1.13 and 23.603.
PO 00000
Frm 00036
Fmt 4701
Sfmt 4702
following generally accepted standards
and best practices.325
The Commission anticipates that the
main source of costs associated with
establishing, documenting,
implementing, and maintaining the
ORF, as required, would derive from
creating and implementing the
necessary core component programs and
plan, the detailed requirements and
costs and benefits of which are
discussed in greater detail in the
sections that follow. As discussed
above, although the Commission
expects that most covered entities have
already established at least some of
elements of the ORF in place by virtue
of NFA or other requirements, covered
entities would, at minimum, need to
devote time and resources to reviewing
their existing programs to ensure they
meet the requirements of the proposed
rule and making any necessary
amendments. Accordingly, the
Commission anticipates all covered
entities would incur at least a one-time
fixed cost associated with reviewing
their existing programs to ensure
compliance, and to identify and make
any potential required updates.
Specifically, the Commission expects
covered entities would incur a one-time
initial cost of $41,000 (410 hours 326 ×
$100/hour) to review their existing
programs and identify and make any
necessary changes, or an estimated
aggregate dollar cost of $6,560,000 (160
covered entities × $41,000).327
To the extent that covered entities’
current operational resilience practices
do not meet the minimum requirements
325 See paragraph (b)(3) of proposed Commission
regulations 1.13 and 23.603.
326 This hour estimate reflects the aggregate
amount of time the Commission estimates covered
entities will expend establishing, documenting,
implementing and maintaining the core component
programs and plan of their ORF (i.e., information
and technology security program, third-party
relationship program, and business continuity and
disaster recovery plan). See section III.B (Paperwork
Reduction Act) of this notice, supra.
327 The cost estimates in this section were
determined using an average salary of $100.00 per
hour. The Commission believes that this is an
appropriate salary estimate for purposes of the
proposed rule based upon the May 2022 Bureau of
Labor Statistics’ average hourly rate for the
following positions: (1) $63.08 for management
occupations; (2) $41.39 for business and financial
operations occupations; (3) $51.99 for computer and
mathematical occupations; (4) $67.71 for computer
engineering occupations; (5) $59.87 for legal
occupations; and (6) $21.90 for office and
administrative support occupations. Based on this
data, the Commission took the mean hourly wage
for these positions and increased it to $100 in
recognition that some covered entities are large
financial institutions whose employees’ salaries
may exceed the mean wage. See U.S. Bureau of
Labor Statistics, May 2022 National Occupational
Employment and Wage Estimates (last updated Apr.
25, 2023), available at https://www.bls.gov/oes/
current/oes_nat.htm#43-0000.
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
of the proposed rule, they may incur
more and other forms of costs in
updating the programs. Such costs
could include fixed costs associated
with securing new technology or other
services (e.g., upgrading technology,
incorporating penetration testing), or
even adding new staffing to support
new required functions, as well as new
ongoing costs related to monitoring and
training. By requiring that the ORF, and
consequently the associated programs
and plan, are appropriate and
proportionate to the covered entity, the
Commission expects that the extent of
those costs should be reasonably
mitigated, such that covered entities
should be able to tailor their ORFs to
their unique circumstances and not
incur costs to adopt practices or
technologies that would not be
recommended or necessary for them.
Additionally, to the extent costs in
updating programs are unavoidable, the
Commission believes the proposed ORF
rule is reasonably designed to ensure
that the costs would support covered
entities’ operational resilience, and the
broader security of the derivatives
markets as a whole, as discussed in
greater detail below. More specifically,
the Commission believes the proposed
ORF rule is reasonably designed to
ensure customer and counterparty
information and assets remain
protected, and that the derivatives
markets remain stable and functioning,
particularly as covered entities become
ever more reliant on rapidly evolving
technology and/or third-party service
providers to support their operations.
Requiring all covered entities to have a
framework directed at operational
resilience that meets certain minimum
requirements, including governance,
training, and testing requirements,
would give the CFTC, customers,
counterparties, and covered entities
themselves confidence that there exists
among all covered entities a certain
foundational level of security and
resilience. Requiring covered entities to
base their ORFs on generally accepted
standards and best practices further
buttresses that assurance by making sure
adopted practices are grounded in
standards that are commonly known
and accepted, widely recognized as
effective, and require adaptation as risk
profiles change. Relying on existing
known standards should also help
mitigate implementation costs
compared to complying with specific
and detailed requirements created by
the Commission and applied more
uniformly. Furthermore, as the
Commission engages in oversight of
ORFs, it would expect to be able to
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
identify additional recommended best
practices unique to covered entities that
it could share through guidance or
future rulemakings, which would
operate to further support the stability
of the derivatives markets.
f. Governance—Proposed Paragraph (c)
The proposed rule would require that
each of the three required component
programs and plan (the information and
technology security program, the thirdparty relationship program, and the
business continuity and disaster
recovery plan) be approved in writing,
on at least an annual basis, by either the
senior officer, an oversight body, or a
senior-level official of the covered
entity.328 Covered entities would likely
experience some costs associated with
selecting the responsible official or body
to provide the approval and associated
costs to obtain their approval, including
the time and resources needed to
develop any explanatory materials,
making amendments in light of any
comments from leadership, and
ministerial costs associated with
obtaining signatures. More specifically,
the Commission estimates that covered
entities would incur an initial cost of
$4,000 (40 hours × $100/hour) to select
the responsible official or body to
approve the component programs and
plan of the ORF,329 or an estimated
aggregate dollar cost of $640,000 (160
covered entities × $4,000). Additionally,
the Commission estimates that covered
entities will incur an ongoing annual
cost of $1,000 for the approval of the
component programs or plan of the ORF
(10 hours × $100/hour),330 or an
estimated aggregate dollar cost of
$160,000 (160 covered entities ×
$1,000).
However, the Commission anticipates
that providing a covered entity broad
discretion to select whomever it deems
appropriate to provide the approval
would serve to mitigate some of those
costs by allowing the covered entity to
embed the approval process within its
existing operational structures. The
Commission further believes that
requiring regular and formal approval of
the ORF component programs and plan
by senior leadership would help ensure
that the ORF is in line with operational
328 See paragraph (c)(1) of proposed Commission
regulations 1.13 and 23.603.
329 Covered entities may also incur subsequent
costs in the event there is a change in official or
body responsible for the approval of the ORF
component programs or plan.
330 As discussed supra in section III.B (Paperwork
Reduction Act) of this notice, the Commission
expects covered entities will expend a total of 20
burden hours to approve the component programs
and plan of the ORF, risk appetite, and risk
tolerance limits, or to prepare a written attestation.
PO 00000
Frm 00037
Fmt 4701
Sfmt 4702
4741
strategy and risk capacity, improving
the chances that the covered entity
would be adequately prepared for, and
able to withstand and recover from
operational shocks, that could otherwise
significantly harm customers,
counterparties, or even have spillover
effects into the derivatives market as a
whole.
The proposed rule would further
require covered entities to establish risk
appetite and risk tolerance limits with
respect to the risk areas underlying the
ORF (information and technology
security, third-party relationships, and
emergencies or other significant
disruptions to the continuity of normal
business operations).331 The
Commission believes that establishing
and operating within established risk
appetite and risk tolerance limits would
help ensure that covered entities do not
engage in activities that would present
risks beyond those they can comfortably
manage, helping to mitigate the
potential for covered entities to take on
risk that could lead to intolerable harm
to customers or disruption to the
financial system at large.
Covered entities that do not currently
have a practice of creating a risk
appetite statement and establishing and
monitoring metrics for risk tolerance
limits would likely incur costs
associated with establishing a
methodology to identify them, which
would involve time and staffing
resources, or perhaps even the use of
consultants, but the Commission
anticipates such costs should be
reduced year over year as such covered
entities gain experience and streamline
processes. Nevertheless, the
Commission understands that
establishing risk appetite and tolerance
limits is common practice in the
financial industry, and is included as a
recommended part of governance in the
NIST financial sector profile.332 To the
extent that covered entities already
follow this practice, such covered
entities would incur general costs
associated with reviewing their risk
appetite and risk tolerance limits against
the rule requirements to ensure they
cover the full scope of the rule, but they
would avoid the heavier resource
burdens of developing risk appetite and
risk tolerance limits from whole cloth.
The risk appetite and risk tolerance
limits would further need to be
331 See paragraph (c)(2)(i) of proposed
Commission regulations 1.13 and 23.603.
332 See CRI Profile Workbook, supra note 81, at
16 (‘‘An appropriate governing authority . . .
endorses and periodically reviews the cyber risk
appetite and is regularly informed about the status
of and material changes in the organization’s
inherent cyber risk profile).
E:\FR\FM\24JAP2.SGM
24JAP2
4742
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
reviewed and approved in writing on at
least an annual basis by the oversight
body, senior officer, or other seniorlevel official with primary responsibility
for the relevant risk area.333 Similar to
the broad approval of the ORF
component programs and plan in
general, covered entities would likely
incur some costs preparing information
for approval, making amendments in
response to comments, and obtaining
signatures. Specifically, the Commission
estimates covered entities would incur
an ongoing annual cost of $1,000 for the
approval of risk appetite and risk
tolerance limits (10 hours × $1,000),334
or an estimated aggregate dollar cost of
$160,000 (160 covered entities ×
$1,000). The Commission believes that
the process of securing formal approval
would encourage covered entities to
think critically about the risk appetite
and risk tolerance limits they establish
and to justify them in light of
operational strategy. This exercise
should bring more awareness to
activities that create operational risk
and lead to better outcomes from an
operational resilience standpoint, with
attendant benefits to customers,
counterparties, and the market more
broadly.
Relatedly, the proposed rule would
require covered entities to notify
selected senior leadership of
circumstances that exceed risk tolerance
limits and incidents requiring
notification to either the Commission or
customers and counterparties.335 The
Commission understands that such an
internal escalation requirement would
require covered entities to incur some
costs in developing policies and
procedures that reflect this requirement,
or reviewing existing escalation
protocols to ensure they meet the terms
of the rule, but the Commission believes
the requirement is sufficiently flexible
to allow covered entities to rely on
existing operational structures and
reporting lines, and does not anticipate
that any organizational changes, or
attendant costs, would be necessary.
Additionally, the Commission views the
involvement and awareness of senior
leadership in cases where risk tolerance
limits are exceeded, or where significant
incidents have occurred that clearly
threaten operational resilience, as
333 See
paragraph (c)(2)(ii) of proposed
Commission regulations 1.13 and 23.603.
334 As discussed in section III.B (Paperwork
Reduction Act) of this notice, the Commission
expects covered entities will expend a total of 20
burden hours annually to document approval of the
component plans of the ORF, risk appetite, and risk
tolerance limits, or to prepare a written attestation.
335 See paragraphs (c)(3)(i)–(ii) of proposed
Commission regulations 1.13 and 23.603.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
critical to ensuring recovery efforts are
coordinated and thus more likely to be
successful.
The proposed rule would allow
covered entities that form a part of a
larger enterprise to satisfy the
requirements of the proposed rule
through their participation in a
consolidated program or plan that meets
the requirements of the proposed
rule.336 Additionally, a covered entity
relying on a consolidated program or
plan would be able to satisfy the
requirements for senior leadership to
approve both the component program or
plan and risk appetite and risk tolerance
limits by having senior leadership attest
on an annual basis that the consolidated
program or plan meet the requirements
of the proposed ORF rule, and reflects
risk appetite and risk tolerance limits
appropriate to the covered entity.337 The
Commission estimates that covered
entities would incur an ongoing annual
cost of $2,000 (20 hours × $100/hour) to
prepare an written attestation,338 or an
estimated aggregate dollar cost of
$320,000 (160 covered entities ×
$2,000). The Commission believes
allowing covered entities to rely on a
consolidated program or plan would
mitigate costs for such entities,
specifically by benefiting from
economies of scale present in relying on
shared corporate infrastructure and a
larger parent company’s resources to
manage operational risk at a broader
enterprise level, and through using
existing practices that meet the
requirements of the proposed rule.
Nevertheless, the Commission expects
that such covered entities would incur
at least some costs associated with
reviewing the consolidated program or
plan to ensure it meets the requirements
of the proposed rule and reflect risk
appetite and risk tolerance limits
appropriate to the covered entities. Such
covered entities may face challenges in
ensuring that their consolidated
programs or plans, which may be
written with the parent corporate entity
as the primary focus, appropriately
address the risks as they relate more
specifically to the business and
operations of the covered entity, which
may be a relatively small line of
business for the parent. Accordingly, a
covered entity may incur some costs, in
336 See paragraph (c)(4)(i) of proposed
Commission regulations 1.13 and 23.603.
337 See paragraph (c)(4)(ii) of proposed
Commission regulations 1.13 and 23.603.
338 As discussed supra in section III.B (Paperwork
Reduction Act) of this notice, the Commission
expects covered entities will expend a total of 20
burden hours annually to document approval of the
component programs or plans of the ORF, risk
appetite, and risk tolerance limits, or to prepare a
written attestation.
PO 00000
Frm 00038
Fmt 4701
Sfmt 4702
terms of time and staffing resources,
associated with amending any
consolidated program or plan to ensure
it reflects the proposed rule’s
requirements and risk appetite and risk
tolerance limits appropriate to the
covered entity. The Commission cannot
accurately quantify such costs, as these
costs could range from minimal to more
substantial depending on the
complexity of the organization and how
closely the current consolidated
program or plan meets the requirements
of the proposed rule, including how
particularized they are with respect to
identifying and managing the risks
specific to the covered entity. The
Commission believes that such
requirements are important to ensuring
that all covered entities, regardless of
their operational structure, have a
baseline level of operational risk
management that is tailored to the entity
itself, helping reduce risk to the overall
financial system and the commodity
derivatives markets in particular. The
Commission also preliminarily believes
that the overall costs of the proposed
rule are reduced, without any loss of
benefit, by allowing covered entities to
rely on consolidated programs or plans
over requiring them to duplicate
existing larger corporate entity efforts to
produce programs or plans that are
independent and unique to the covered
entity.
g. Information and Technology Security
Program—Proposed Paragraph (d)
The proposed rule would require
covered entities to have an information
and technology security program,
defined as a written program reasonably
designed to identify, monitor, manage,
and assess risks relating to information
and technology security and that meets
certain requirements.339 Specifically,
the information and technology security
program would need to include (1) a
risk assessment, conducted at least
annually; (2) effective controls; and (3)
an incident response plan.340 The
proposed risk assessment requirement
would require covered entities to
identify and devote resources to
planning and performing the risk
assessment and then analyzing its
results. These resources would need to
include reliance on personnel not
responsible for the development or
implementation of covered technology
or related controls, which could impose
additional staffing needs on some
339 See paragraphs (a) (defining ‘‘information and
technology security program’’) and (b)(2)
(components) of proposed Commission regulations
1.13 and 23.603.
340 See paragraph (d) of proposed Commission
regulations 1.13 and 23.603.
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
covered entities.341 The amount of time
and resources expended would likely
vary depending on the size, complexity,
and risk profile of the covered entity
and its degree of reliance on covered
technology. The Commission believes
that larger covered entities with more
complex business operations and
broader risk profiles would likely need
to devote more permanent and extensive
resources, staffing and otherwise, to
performing and analyzing their risk
assessments. Presenting the results of
the assessment to selected senior
leadership would also require the
devotion of time and staffing resources
to prepare for and respond to leadership
feedback.
In establishing effective controls,
covered entities would be required to
consider a broad range of categories of
controls, determine which to implement
in line with identified risks, implement
them, and then review and revise the
controls as needed over time in
response to continued risk assessments.
Depending on the types of controls they
would need to implement, covered
entities may take on additional costs to
acquire new security technology and/or
hire additional staff or third-party
service providers to oversee and
implement the controls. Again, the
Commission would expect any outlays
to be appropriate and proportionate to
the covered entity and its risk profile, so
the exact costs would vary by covered
entity. Nevertheless, given that the
approach of the proposed rule, and list
of required categories, closely aligns
with the longstanding approach adopted
by prudential regulators with respect to
information and technology security
controls, the Commission believes that
costs for at least prudentially regulated
covered entities may be reduced
compared to other covered entities that
have not been required to apply and
consider such categories of controls.342
Development of an incident response
plan would likely require a noticeable
devotion of resources at the outset, as
staff would need to dedicate time and
effort to forming and documenting the
plan, including creating policies and
procedures for identifying the types of
incidents that need to be reported and
to whom. Should an incident occur, the
plan would require staff at the covered
entity to devote time to documenting
and responding to the incident, as well
as identifying and taking on remediation
efforts.
Nevertheless, the Commission expects
that, given the NFA’s ISSP Notice,
341 See paragraph (d)(1)(ii) of proposed
Commission regulations 1.13 and 23.603.
342 See supra note 130 and accompanying text.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
covered entities would likely not need
to expend resources to develop an
information and technology security
program from scratch. Notably, NFA
requires its members to adopt and
enforce a written ISSP, assess and
prioritize the risks associated with its
use of information technology systems,
document and describe in their ISSPs
safeguards deployed in light of
identified and prioritized threats and
vulnerabilities, and create an incident
response plan.343 Accordingly, some of
the compliance burdens associated with
implementing an information and
technology security program should be
reduced. Covered entities overseen by
prudential regulators are also required
to consider similar categories of controls
to those in the proposed rule, so
compliance costs as realized by
prudentially regulated covered entities
may be even further reduced.344
Notably, however, NFA does not
mandate that a risk assessment be
conducted at least annually by
personnel not responsible for the
development or implementation of
covered technology or related controls.
Although the Commission believes
these requirements to be consistent with
generally accepted standards and best
practices, such that covered entities may
be following them anyway, some
covered entities may nevertheless
experience some additional costs
associated with ensuring or otherwise
acquiring staff sufficiently independent
to conduct the risk assessment and in
potentially conducting the risk
assessment more frequently than they
currently do. The Commission also
recognizes that, if adopted, the proposed
rule would at minimum require covered
entities to expend resources to review
the ISSPs they established pursuant to
NFA rules to ensure they meet the
requirements of the information and
technology security program.
Notwithstanding the potential
operational and staffing costs to covered
entities associated with the proposed
rule, the Commission believes the
benefits of the requirements of the
proposed information and technology
security program are well established.
Risk assessments are crucial to
identifying threats and vulnerabilities,
which is key to directing resources to
mitigate those risks in a way that
increases the effectiveness of security
efforts. The Commission likewise
believes the benefits of an independent
risk assessment (a more unbiased and
reliable assessment) and conducting it at
least annually (ensuring the information
343 See
344 See
PO 00000
NFA ISSP Notice, supra note 43.
12 CFR part 30, app. B.
Frm 00039
Fmt 4701
Sfmt 4702
4743
and technology security program is upto-date and responsive in light of
current threat landscape and
vulnerabilities at the covered entity) are
important to supporting covered entity
operational resilience. Likewise,
controls are the methods or techniques
for monitoring and managing those risks
and safeguarding information,
operations, and assets. Without them,
the potential for a system weakness to
be exploited, and for customers and
counterparties, covered entities, or the
market at large to be harmed is
increased, as the interconnected nature
of the commodity derivatives markets
enhances the possibility for spillover
effects. Incident response plans operate
to reduce the potential magnitude of the
harm should a safeguard fail by creating
a concrete plan, known in advance, for
how the covered entity should respond,
thereby shortening response times
following an incident. Accordingly, the
Commission believes the proposed
minimum requirements of the
information and technology security
program, in combination with the
Commission’s oversight, would further
support the development of a
foundational level of operational risk
management practices with respect to
information and technology security
that would benefit customers,
counterparties, and the market at large.
h. Third-Party Relationship Program—
Proposed Paragraph (e)
The proposed rule would require
covered entities to have a third-party
relationship program, defined as a
written program reasonably designed to
identify, monitor, manage, and assess
risks relating to third-party
relationships.345 The program would
need to describe how covered entities
address the risks attendant to each of
the five identified stages of the thirdparty relationship lifestyle, ranging from
pre-selection to termination, with
heightened due diligence and
monitoring required for critical thirdparty service providers.346 The
proposed rule would further require
covered entities to create, maintain, and
regularly update an inventory of thirdparty service providers engaged to
support their activities as covered
entities, identifying whether each is a
critical third-party service provider.347
345 See paragraphs (a) (defining ‘‘third-party
relationship program’’) and (e) (third-party
relationship program) of proposed Commission
regulations 1.13 and 23.603.
346 See paragraphs (e)(1)(i)–(v) and (e)(2) of
proposed Commission regulations 1.13 and 23.603.
347 See paragraph (e)(3) of proposed Commission
regulations 1.13 and 23.603.
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
4744
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
As with the information and
technology security program, complying
with this aspect of the proposed rule
would require covered entities to
expend staff resources at the outset to
develop the program and put it into
writing. Although NFA requires its
members, including covered entities, to
have a written supervisory framework
for its third-party service providers,
which could help mitigate these costs,
NFA’s written supervisory framework
only extends to outsourcing functions,
i.e., regulatory functions that would
otherwise be undertaken by the NFA
member itself to comply with NFA and
CFTC requirements.348 Accordingly,
covered entities would likely experience
at least some staffing burdens expanding
their NFA frameworks to fit the broader
scope of third-party relationships
covered by the proposed rule and
implementing it across their third-party
service providers more broadly.
However, applying the proposed (b)(3)
standard, covered entities should be
able to align their third-party risk
management practices to the risks
presented by each individual third-party
service provider, which would allow
covered entities to tailor and fit the
costs of their third-party practices to
their unique circumstances. Covered
entities following prudential rules and
guidance with respect to third-party
service providers, which applies to all
third-party relationships, would likely
experience reduced costs compared to
other covered entities with respect to
any need to modify their existing
programs.349 Additionally, the proposed
rule would not require covered entities
to perform due diligence or renegotiate
contracts with existing third-party
service providers, which would avoid a
potentially substantial initial fixed cost
from implementing the third-party
relationship program.
Creating an initial inventory of thirdparty service providers, and assessing
whether they meet the definition of
‘‘critical third-party service provider’’
would also require a temporary
redirection of staff resources, with the
amount of time and resources required
varying depending on the extent and
complexity of a given covered entity’s
reliance on third-party service
providers. With respect to critical thirdparty service providers, the Commission
preliminarily believes that many, if not
all, covered entities currently have in
place a process to identify and
categorize covered entities as ‘‘critical’’
348 See
NFA Third-Party Notice, supra note 43.
349 See 12 CFR part 30, app. B, III.D. (Oversee
Service Provider Arrangements); Prudential ThirdParty Guidance, supra note 43.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
or otherwise requiring enhanced
supervisory activities. Additionally,
NFA requires its members to have
heightened due diligence for third-party
service providers that obtain or have
access to critical and/or confidential
data and those that support critical
regulatory-related systems, which could
potentially reduce burdens on covered
entities in designing and implementing
heightened due diligence and
monitoring with respect to critical thirdparty service providers.350 Although the
Commission preliminarily believes that
its proposed definition of ‘‘critical thirdparty service provider’’ should identify
many, if not all, of the same providers
covered entities would themselves
identify as ‘‘critical,’’ the Commission
recognizes that the process of applying
the proposed definition to an existing
process would, at minimum, require
some initial expenditure of staff
resources to ensure existing practices
and taxonomies align with the proposed
rule.351 Additionally, the process of
creating an inventory of third-party
service providers, which is not currently
required by NFA or prudential
regulators, could be particularly
burdensome, especially for covered
entities with a large number of complex
third-party relationships, or that rely on
an affiliate to secure and coordinate
third-party service providers as part of
a larger enterprise-wide function,
potentially involving staff from many
different departments or the review of
multiple contracts or contract databases.
Nevertheless, the Commission
believes that requiring covered entities
to have a program to identify, monitor,
manage, and assess risks relating to
third-party relationships, and inventory
their third-party service providers,
would have meaningful benefits at the
individual covered entity-level, as well
as for customers and counterparties and
the derivatives markets at large. Given
their roles and interconnectedness in
the derivatives markets, an operational
shock at one covered entity can have
ripple effects across the markets.
Requiring covered entities to develop
and maintain a program to help evaluate
and address the risk at each stage of the
third-party relationship—from before
selecting a third-party service provider
to how such a relationship would be
supervised and terminated—may not
only help covered entities be more fully
aware of and manage the risks of their
third-party relationships, it could also
help increase overall confidence levels
350 See
NFA Third-Party Notice, supra note 43.
351 See paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ‘‘critical
third-party service provider’’).
PO 00000
Frm 00040
Fmt 4701
Sfmt 4702
in the derivatives markets by ensuring
customers and counterparties that there
is a foundational level of third-party risk
management practices across covered
entities.
Additionally, the proposed rule could
operate to raise minimum standards
with regards to how third-party risks are
managed, by introducing enhanced due
diligence or monitoring practices for
critical third-party service providers, for
instance, which could lead to real and
measurable reduction in risk to the
financial system. The act of creating an
inventory of third-party service
providers would also help increase the
likelihood of identifying
interdependencies or overdependencies,
which could cause covered entities to
reevaluate particular relationships (i.e.,
diversify third-party service providers to
reduce concentration risk) or take on
additional activities (e.g., insurance) to
help mitigate those risks, thereby
promoting operational resilience.
Identifying critical third-party service
providers should also help enhance
operational awareness of those entities
and ensure they receive the required
heightened monitoring to ensure that
the risk of disruption to critical services,
which could have a broader impact on
the markets or customers and
counterparties, is mitigated.
i. Business Continuity and Disaster
Recovery Plan—Proposed Paragraph (f)
The proposed rule would require
covered entities to have a BCDR plan,
defined as a written plan outlining the
procedures to be followed in the event
of an emergency or other significant
disruption to the continuity of normal
business operations and that meets
certain requirements.352 This would be
a new CFTC requirement for FCMs, but
current Commission regulation 23.603
imposes a BCDR plan requirement on
swap entities that is substantially
similar to the proposed rule, as the
proposed rule was modeled after the
current BCDR requirement for swap
entities with certain modifications.353
Additionally, although the CFTC does
not currently impose a BCDR plan
requirement on FCMs, NFA and CME
do, which the Commission believes
should help FCMs mitigate the costs of
establishing a BCDR plan for purposes
of complying with the proposed rule,
particularly since some of the
amendments to the current BCDR plan
requirement for swap entities have the
effect of further aligning the regulatory
352 See paragraphs (a) (defining ‘‘business
continuity and disaster recovery plan’’) and (b)(2)
(components) of proposed Commission regulation
1.13 and 23.603.
353 See 17 CFR 23.603.
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
text with NFA and CME BCDR plan
requirements.354
The proposed rule would require
covered entities’ BCDR plans to be
reasonably designed to enable the
covered entities to continue or resume
any activities as a covered entity with
minimal disruption to counterparties,
customers, and the markets, and to
recover and make use of covered
information, as well as any other data,
information, or documentation required
to be maintained by law and
regulation.355 The proposed rule would
further require the BCDR plans to
include certain minimum contents,
including: identifying and backing up
required information; identifying and
developing backups for required
resources, including technology,
facilities, and staff; identifying potential
disruptions to critical third-party
service providers; identifying
implicated personnel; and establishing a
communication plan.356
To design a BCDR plan that meets that
standard, covered entities would need
to expend resources to establish and
preserve backup resources (staffing,
technology, inputs) for use in the event
of the BCDR plan’s activation, and to
create backups of the information the
BCDR plan would cover. Depending on
the size and complexity of a particular
covered entity’s business, those costs
could be sizeable, as they may require
negotiating and entering into new
contracts with backup resource
providers, or other third-party service
providers. Covered entities would also
need to expend resources to establish a
plan to minimize the impact of
disruptions and establish a
communication plan, which would
include identifying implicated persons
and bodies and establishing potential
contacts, methods, modes, and priorities
of communication. Finally, the
resources to document all of this work
in the plan would likely be more than
simply ministerial effort, as staff would
likely have to spend time working
through various deliberative points, at
least at the outset in first developing the
BCDR plan. The costs to maintaining the
plan would likely be reduced compared
to the initial fixed costs, however, as the
plan put into action over time.
Nevertheless, the Commission expects
that most covered entities have already
incurred at least some of these potential
costs by virtue of either the existing
CFTC BCDR plan requirements for swap
entities, or the NFA and CME BCDR
plan requirements applicable to FCMs.
Notably, the ‘‘essential elements’’ of
NFA’s BCDR Notice aligns closely with
the minimum requirements for the
Commission’s proposed BCDR plan
requirement, requiring FCMs to
establish backups in one more
reasonably separate geographic areas, to
backup or copy essential documents and
data and store them off-site, to consider
the impact of interruptions by thirdparties and ways to minimize the
impact, and to develop a
communication plan.357 Accordingly,
although the Commission expects FCMs
would incur at least some costs
reviewing their BCDR plans to ensure
they meet the proposed CFTC
requirements, the Commission
preliminarily believes most FCMs
would be able to avoid the more
substantial initial costs of developing a
BCDR plan from scratch.
The Commission further believes that
the expenditure of resources required to
create the proposed plan would help
give the derivatives markets and
customers and/or counterparties
confidence that covered entities’
operations would be able to be quickly
reestablished following an emergency or
significant disruption, improving the
overall resilience of the market and
perhaps lowering customer/
counterparty risk and its associated
costs. Having a plan that centralizes key
information related to an emergency—
including identifying core information,
personnel, systems, and resources
needed to resume operations—should
also help facilitate covered entities in
achieving the recovery time objective of
being back up and running with
minimal disruption to counterparties,
customers, and the derivatives markets,
supporting market confidence and
reducing overall systemic risk.
Maintaining copies of the plan in
accessible off-site locations should
impose no more than ministerial costs
and would help ensure that covered
entities can access the plan in a crisis.
The proposed rule would amend the
current BCDR plan requirement for
swap entities in a few ways, some of
which the Commission expects would
have cost-benefit implications.358 For
instance, the proposed rule would
require covered entities to ‘‘recover and
make use of all covered information, as
357 See
NFA BCDR Notice, supra note 43.
with the other sections of this notice,
portions of the BCDR plan requirement for swap
entities in current Commission regulation 23.603
that have been expanded in the proposal to apply
to the ORF more broadly, notably testing, are
discussed in the context of the discussion of those
specific requirements.
358 As
354 See NFA Rule 3–38, supra note 43; CME Rule
983, supra note 185.
355 See paragraph (f)(1) of proposed Commission
regulation 1.13 and 23.603.
356 See paragraph (f)(2) of proposed Commission
regulation 1.13 and 23.603.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
PO 00000
Frm 00041
Fmt 4701
Sfmt 4702
4745
well as any other data, information, or
documentation required to be
maintained by law and regulation,’’
which expands the information BCDR
plans would be required to cover
beyond that required to be maintained
by applicable law and regulation, and
makes clear the information should not
only be recovered but also accessible
and still useable.359 Depending on
current BCDR plan practices by swap
entities, the proposal could potentially
cause covered entities to expand the
sources of information they need to
backup and/or augment their backup
systems to ensure the information stored
there is useable. The proposed rule
would also no longer require swap
entities to ensure their BCDR plans are
designed to enable swap entities to
continue or resume operations ‘‘by the
next business day.’’ 360 Although the
Commission does not believe that this
change would have an impact on the
actual recovery time of swap entities
following an emergency or other
significant disruption, given that both
current Commission regulation 23.603
and the proposed rule require that the
BCDR plan be designed to ensure
recovery with minimal disruption to
counterparties and the market, swap
entities could need to dedicate at least
some staff time to review their BCDR
plans to ensure that they continue to
meet the rule requirements.
j. Training and Distribution—Proposed
Paragraph (g)
The proposed rule would require
covered entities to establish, implement,
and maintain training with respect to
the ORF, including general
cybersecurity awareness training and
role-specific training for personnel
involved in the ORF.361 If the proposed
rule is adopted, covered entities would
need to expend resources to develop
and/or evaluate and acquire externally
sourced training. Those outlays would
include the costs associated with
establishing the training at the outset, as
well as ongoing costs associated with
updating and providing the training at
least every year.362 There would also be
administrative costs associated with
distributing copies of the component
programs or plan to relevant personnel
and providing them with any significant
revisions.363 Nevertheless, the
359 See
17 CFR 23.603(a).
360 Id.
361 See paragraph (g)(1) of proposed Commission
regulations 1.13 and 23.603.
362 See paragraph (g)(2) of proposed Commission
regulations 1.13 and 23.603
363 See paragraph (g)(3) of proposed Commission
regulations 1.13 and 23.603.
E:\FR\FM\24JAP2.SGM
24JAP2
4746
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
Commission believes that establishing,
implementing, and maintaining a
training program is crucial to realizing
the benefits of the proposed ORF. Not
only would it help ensure that
employees of covered entities are kept
aware of good cyber hygiene practices,
which should reduce the potential for
covered information to be compromised
and customers and counterparties to be
negatively impacted, training would
help ensure that the ORF practices
covered entities establish are accurately
implemented and maintained by the
personnel tasked with operationalizing
the ORF. Although allowing covered
entities to provide training less
frequently than annually would reduce
compliance costs for covered entities,
the Commission believes that annual
training is needed to preserve its
benefits given the rapidly evolving pace
of technology and the potential for
human error to result in actual harm to
operations or even customers or
counterparties.364
ddrumheller on DSK120RN23PROD with PROPOSALS2
k. Reviews and Testing—Proposed
Paragraph (h)
The proposed rule would require
covered entities to establish, implement,
and maintain a plan reasonably
designed to assess adherence to, and the
effectiveness of, their ORF through
regular reviews and risk-based
testing.365 At the outset, covered entities
would need to dedicate staff resources
to develop a review and testing plan for
the ORF; ongoing staff resources would
be needed to conduct reviews at least
annually and risk-based testing at a
frequency that is appropriate and
proportionate to each covered entity’s
nature, size, scope, complexity, and risk
profile, following generally accepted
standards and best practices.366 Covered
entities would further assume regular
costs associated with documenting the
reviews and testing (e.g., results of
testing, assessment of effectiveness,
recommendations for modifications/
improvements/corrective actions) and
reporting on them to the CCO and any
other relevant senior-level official(s) and
oversight body(ies).367 In general, the
ongoing costs of the required testing and
reviews are likely to vary by covered
entity, with larger, more complicated
covered entities likely expending
significantly more resources to conduct
364 See
supra note 18 and accompanying text.
paragraph (h) of proposed Commission
regulations 1.13 and 23.603.
366 See paragraph (b)(3) of proposed Commission
regulations 1.13 and 23.603.
367 See paragraphs (h)(4) and (h)(5) of proposed
Commission regulations 1.13 and 23.603.
365 See
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
testing consistent with the proposed
(b)(3) standard.368
With respect to the reviews of the
ORF, the proposed rule would require
that they be conducted at least annually
and in connection with any material
change that is reasonably likely to affect
the risks addressed by the ORF. The
proposed rule would further require the
reviews to include an analysis of
adherence to, and the effectiveness of
the ORF, as well as any
recommendations for improvements.369
This standard is generally consistent
with, and would replace, the current
review standard in current Commission
regulation 23.603 for swap entity BCDR
plans, such that associated costs for
reviewing the BCDR plan should not be
affected by the proposal.370 NFA’s ISSP
Notice and BCDR Notice also require
NFA members to review their ISSPs or
BCDR pans on a regular or periodic
basis.371 Accordingly, while covered
entities may experience some staffing
costs in assuring their reviews are at
least annual, costs associated with
establishing a review process more
broadly should have already been
realized by most covered entities.
For testing, the proposed rule would
generally require that its frequency,
nature, and scope would be determined
consistent with the proposed (b)(3)
standard.372 The Commission believes
that such a risk-based standard would
allow covered entities to tailor testing to
their unique business and risk profile,
focusing testing efforts on areas that
would be the most impactful or
revealing and avoiding unnecessary
costs. Nevertheless, with respect to
testing of the information and
technology security program, the
proposed rule would require covered
entities to assume costs for some
specific testing, including testing of key
controls and the incident response plan,
as well as daily or continuous
vulnerability assessments and
368 The Commission estimates, on average, that
covered entities will incur an initial annual cost of
$8,000 (80 hours × $100/hour) to establish a plan
to assess adherence to, and the effectiveness of, its
ORF, and to document all reviews and testing of the
ORF, or an estimated aggregate dollar cost of
$1,280,000 (160 covered entities × $8,000).
369 See paragraph (h)(1) of proposed Commission
regulations 1.13 and 23.603
370 See 17 CFR 23.603(f) (‘‘A member of the senior
management of each swap dealer and major swap
participant shall review the business continuity and
disaster recovery plan annually or upon any
material change to the business. Any deficiencies
found or corrective action taken shall be
documented.’’)
371 See NFA BCDR Notice, supra note 43; NFA
ISSP Notice, supra note 43.
372 See paragraph (h)(2) of proposed Commission
regulations 1.13 and 23.603.
PO 00000
Frm 00042
Fmt 4701
Sfmt 4702
penetration testing at least annually.373
Although regular testing of key controls
and the incident response plan is likely
to require time and staff resources, the
Commission believes that without
testing, it would be impossible for
covered entities to know whether the
controls are functioning to mitigate risk
as expected, and for the incident
response plan to be actionable in times
of emergency. Daily or continuous
vulnerability assessments and
penetration testing at least annually
could require additional staff and
technology outlays.374 The exact cost of
testing as realized by each covered
entity, however, is likely to vary
depending on the scope and complexity
of its operations, and the degree to
which it has already incorporated
vulnerability assessments and
penetration testing as part of its ISSP.375
The Commission believes that
vulnerability assessments and
penetration testing are essential for
covered entities to know what their
vulnerabilities are and how they might
be exploited, so they can take steps to
mitigate associated risks, including by
adapting internal controls, which are a
key component of preserving
operational resilience. Given the
dynamic, ever changing nature of
technology and cybersecurity, the
Commission believes that continual and
active action and engagement are
necessary to ensure controls are
operating as intended, and for covered
entities to have an accurate assessment
of the risks to their covered information
and technology. By not mandating
specific types of penetration testing,
however, the Commission believes the
proposed rule is adapted to allow the
wide range of covered entities subject to
the proposed rule to adopt types of
testing that are recommended for and
best fit their unique circumstances, so as
to achieve the highest level of improved
cybersecurity without incurring
unnecessary costs. The Commission
further believes such testing is essential
cyber hygiene and their use among
covered entities would help ensure a
base level of monitoring in the
derivatives markets that is readily
accessible.
373 See paragraph (h)(2)(i) of proposed
Commission regulations 1.13 and 23.603.
374 CISA makes available a free vulnerability
scanner, see supra note 248.
375 The NFA ISSP Notice provides that a member
‘‘may include penetration testing of the firm’s
systems, the scope and timing of which is highly
dependent upon the Member’s size, business,
technology, its electronic interconnectivity with
other entities and the potential threats identified in
its risk assessment.’’ See NFA ISSP Notice, supra
note 43.
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
With respect to testing of the BCDR
plan, the proposed rule would require
covered entities to dedicate time and
staff resources to conduct a walkthrough or tabletop exercise designed to
test the effectiveness of backup facilities
and capabilities at least annually, which
could involve outreach to operators of
backup facilities.376 Such a periodic
effort would likely consume staff time
and resources to put into place,
including potentially in designing
tabletop exercise scenarios. The
Commission expects that this aspect of
the proposed rule would not have any
cost impact on swap entities, as current
23.603 requires annual testing of their
BCDR plan, and the Commission does
not believe the clarification that the
testing be a walk-through or tabletop
exercise would have substantive effect.
Because the proposed rule would
require the reviews and testing to be
conducted by qualified personnel who
are independent of the aspect of the
ORF being reviewed or tested, the
Commission anticipates this work
would either be conducted by internal
compliance audit staff, external
independent auditors, or other internal
staff, provided they were not involved
in creating the ORF component being
tested.377 Accordingly, this
independence requirement could
require covered entities to reassign
duties or secure additional staffing
resources, either of which would
impose some additional costs.
Nevertheless, the Commission
believes that annual reviews and testing
are essential to ensuring that the ORF is
operating as intended, and thus to
ensuring the intended and expected
benefits of the ORF with respect to
protecting customers and mitigating
systemic risk are actually realized.
Without proper review and testing,
determining whether the intended
benefits of the ORF are being achieved
would not be possible. Although
eliminating the independence
requirement could alleviate some
potential staffing burdens on covered
entities, the Commission believes that
independence in reviews and testing is
critical to preserving their benefits by
helping to ensure that the results are
reliable and unbiased. The Commission
further believes that by allowing
covered entities to adjust the frequency,
nature, and scope of their risk-based
testing of the ORF in a manner that is
appropriate and proportionate to the
circumstances, following generally
accepted standards and best practices,
the proposed rule would ensure that
costs of the rule would be as well
tailored to the covered entity as possible
to realize benefits at the least cost.
With respect to the BCDR plan
requirement for swap entities in
particular, the Commission believes the
proposed rule could reduce review and
testing costs. First, it would eliminate
costs associated with securing an
independent auditor to audit the plan
every three years.378 Although there
may be some benefits to having an
independent audit of a BCDR plan,
including having an external party with
fresh eyes identify issues and potential
improvements that might not be readily
apparent to internal staff, the
Commission preliminarily believes,
based on its experience, that the internal
reviews and testing of the BCDR plan
are sufficient to achieve iterative
improvements to the BCDR plan,
making the costs associated with the
independent audit unnecessary. Second,
the proposed rule would eliminate the
separate requirement that a member of
senior management for a swap entity
review the BCDR plan annually or upon
any material change to the business and
to document any deficiencies found or
corrective action taken.379 While the
proposed rule would retain the annual
review requirement for the BCDR plan,
not requiring the review to be
undertaken by a member of senior
management may result in at least some
burden reduction for senior
management.
l. Notification Provisions—Proposed
Paragraphs (i) and (j)
The proposed rule would require
covered entities to provide certain
notifications to either the Commission
or affected customers or
counterparties.380 Notifications to the
Commission, made electronically via
email, would relate either to the covered
entity’s determination to activate the
BCDR plan, or an ‘‘incident,’’ as defined
in the proposed rule, that adversely
impacts, or is reasonably likely to
adversely impact information and
technology security, the covered entity’s
ability to operate, or the assets or
positions of a customer or
counterparty.381 In both cases, the
notifications to the Commission would
be intended to function as early
warnings and thus would not need to be
complete or detailed. Understanding
378 See
17 CFR 23.603(g).
17 CFR 23.603(f).
380 See paragraphs (i) and (j) of proposed
Commission regulations 1.13 and 23.603.
381 See paragraph (i) of proposed Commission
regulations 1.13 and 23.603.
379 See
376 See paragraph (h)(2)(i) of proposed
Commission regulations 1.13 and 23.603.
377 See proposed paragraph (h)(3) of proposed
Commission regulations 1.13 and 23.603.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
PO 00000
Frm 00043
Fmt 4701
Sfmt 4702
4747
that the information available to covered
entities would be preliminary and
incomplete at the time of the
notification, the Commission would not
expect covered entities to expend
considerable resources to assemble
notifications that are perfectly accurate
and complete. Rather, the proposed rule
would only require that the information
provided to the Commission would be
whatever the covered entity has
available at the time that could assist
the Commission in its oversight or
response, with the understanding that
resources should predominantly be
directed at mitigating and recovering
from the incident, emergency, or
significant disruption.382 Prioritizing an
early warning over complete
information should not only reduce the
costs for covered entities in delivering
the notification, but also allow the
Commission the best opportunity to take
quick responsive action, if appropriate.
Accordingly, while the Commission
recognizes that there would be at least
some information gathering and
administrative costs associated with
providing the notice, the Commission
does not intend or expect the resource
burden for providing the notification to
be significant.383 This limited earlywarning function for the notice
requirement is further supported by the
relatively brief 24-hour time period for
providing the notices.384
With respect to the BCDR plan in
particular, the Commission does not
believe covered entities would expend
significant resources to notify the
Commission, since the notification
trigger (activation of the BCDR plan) is
relatively bright-line. The Commission
recognizes that with respect to the
incident notification, however, covered
entities may need to engage in some
deliberation to determine whether an
incident has or is reasonably likely to
have an adverse impact, which would
consume some staff resources.
Preliminarily, the Commission estimates
that covered entities activating their
BCDR plan would incur a cost of $1000
(10 hours × $100/hour) to notify the
Commission, or an estimated aggregate
dollar cost of $160,000 (160 covered
entities × $1,000). The Commission
believes, however, that these costs may
go down over time, as covered entities
382 See paragraphs (i)(1)(ii) and (i)(2)(ii) of
proposed Commission regulations 1.13 and 23.603.
383 The Commission estimates that for each
‘‘incident’’ requiring notification, covered entities
will incur a cost of $1,000 (10 hours × $100/hour)
to gather the information required and to provide
notification to the Commission, or an estimated
aggregate dollar cost of $160,000 (160 covered
entities × $1,000).
384 See paragraphs (i)(1)(iii) and (i)(2)(iii) of
proposed Commission regulations 1.13 and 23.603.
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
4748
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
gain familiarity in applying the
notification provision. The Commission
also preliminarily believes that an
adverse impact standard would be
potentially easier to apply than one that
included a materiality limiter, which
could introduce further need for
interpretation and internal deliberation
for covered entities to determine
whether the impact is ‘‘material’’ or
‘‘significant.’’ Additionally, scoping
notifications to incidents with a likely
adverse impact and to BCDR activation
would help focus the Commission’s
oversight activities and responsive
efforts on cases where it could act to
support the derivatives markets and
customers and counterparties,
potentially reducing the potential for
ripple effects.
In addition to notifications to the
Commission, the proposed rule would
require covered entities to notify
affected customers or counterparties as
soon as possible of any incident that is
reasonably likely to have adversely
affected the confidentiality or integrity
of their covered information, assets, or
positions.385 Because the rule does not
contain a specific timing limit for
providing this notification, the
Commission does not expect that this
notification requirement would cause
covered entities to need to divert any
resources while managing the incident
to draft the notification. Rather, the
Commission expects that most of the
costs associated with this notification
requirement would be in spending the
necessary staff resources to gather and
report facts as accurately as possible to
aid affected customers and
counterparties in understanding and
assessing the potential impact of the
incident on their information, assets, or
positions and to take any necessary
action.386 Covered entities may also
need to dedicate staff resources to
interacting with customers or
counterparties after the notification is
given to provide more information or
answer questions. The Commission
estimates that for each ‘‘incident’’
requiring notification, covered entities
will incur a cost of $5,000 (50 hours ×
$100/hour) to gather the required
information necessary to provide notice
to customers or counterparties and to
prepare and deliver the required
notification, or an estimated aggregate
dollar cost of $800,000 (160 covered
entities × $5,000). The Commission
believes that this notification could
produce substantial benefits to
385 See paragraph (j)(1) of proposed Commission
regulations 1.13 and 23.603.
386 See paragraph (j)(2) of proposed Commission
regulations 1.13 and 23.603.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
customers and counterparties,
especially where state or other federal
law does not otherwise require such
notifications, as they would give
customers and counterparties the
information they would need to further
protect their information and assets and
allow them to seek other avenues of
redress.
m. Emergency Contacts and
Recordkeeping—Proposed Paragraphs
(k) and (l)
The proposed rule would require
covered entities to provide the
Commission with the name and contact
information of employees in connection
with incidents triggering notification to
the Commission and in connection with
the activation of the covered entity’s
BCDR plan.387 The identified employees
would need to be authorized to make
key decisions on behalf of the covered
entity and have knowledge of the
covered entity’s incident response plan
or BCDR plan, as appropriate.388
Covered entities would also need to
update their contacts with the
Commission, as necessary.389 The
Commission believes that ensuring it
has knowledgeable contacts with whom
to direct communications during a crisis
would aid the Commission’s ability to
take any necessary responsive action,
and that the costs associated with
identifying and updating the
appropriate contacts would be
ministerial in nature.390 With respect to
BCDR plan emergency contacts for swap
entities, the proposed rule is identical in
substance to current Commission
regulation 23.603, such that it should
impose no additional costs on swap
entities.391
The proposed rule would also further
require covered entities to maintain all
records required to be maintained
pursuant to this section in accordance
with Commission regulation 1.31, and
make them available promptly upon
request to representatives of the
Commission and to representatives of
applicable prudential regulators.392
Covered entities would incur costs
associated with maintaining a
recordkeeping system that allows for
387 See paragraph (k)(1) of proposed Commission
regulations 1.13 and 23.603.
388 See paragraph (k)(2) of proposed Commission
regulations 1.13 and 23.603.
389 See paragraph (k)(3) of proposed Commission
regulations 1.13 and 23.603.
390 The Commission estimates that covered
entities will incur a cost of $100 (1 hour × $100/
hour) to provide the Commission with emergency
contact information, or an estimated aggregate
dollar cost of $16,000 (160 covered entities × $100).
391 See 17 CFR 23.603(3).
392 See paragraph (l) of proposed Commission
regulations 1.13 and 23.603.
PO 00000
Frm 00044
Fmt 4701
Sfmt 4702
easy records retrieval, which would
require both staff resources and likely
reliance on electronic recordkeeping
systems. The Commission believes these
costs are likely mitigated for most
covered entities, as they would be able
to rely on existing recordkeeping
systems designed to maintain other
records in accordance with Commission
regulation 1.31, and proper
recordkeeping would help covered
entities demonstrate compliance with
the ORF rule, and ensure their ORFs are
operating as expected as they conduct
required reviews and testing.
2. Section 15(a) Factors
a. Protection of Market Participants and
the Public
The Commission believes the
proposed rule would support protection
of market participants and the public.
The Commission preliminarily believes
the proposed rule will help protect
market participants and the public by
increasing the operational resiliency of
covered entities to disruptions caused
by natural disasters, cyber-attacks, and
failures at third-party service providers.
As covered entities are responsible for
safeguarding customers’ accounts,
executing trades, maintaining records,
and reporting to relevant agencies, their
operational resiliency will mitigate the
negative impact on customers, clients,
and counterparties in case of an
incident. The proposed rule may also
help reduce the likelihood of an
incident due to proposed proactive
measures such as penetration and
vulnerability testing and cyber security
training. For market participants and the
public more generally, the benefits
include enhanced market protection
against the spread of contagion risk to
the financial system from operational
risks.
b. Efficiency, Competitiveness, and
Financial Integrity of Markets
The Commission believes the
proposed rule would enhance the
financial integrity of CFTC-regulated
derivatives markets. SDs, MSPs, and
FCMs are essential intermediaries in the
financial markets regulated by the
Commission. Due to the
interconnectedness of markets,
disruptions to the business operations of
these intermediaries pose risks to other
markets. The Commission believes that
increasing and helping to ensure the
operational resiliency of these covered
entities would help improve the
financial integrity of the derivatives
markets. The proposed rule’s
requirement to report to the
Commission incidents and BCDR plan
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
activation would assist the Commission
effectuate a timely response to business
disruptions, which will help mitigate
the impact on other market participants
and promote financial stability and
confidence. Additionally, to the degree
that the proposed rule aligns with other
existing applicable requirements,
including NFA rules and interpretive
notices, and incorporates generally
accepted standards and best practices
currently broadly relied on by covered
entities, the proposed rule would
support regulatory convergence and the
efficiencies that may generate.
c. Price Discovery
The Commission does not anticipate
the proposed rule directly impacting the
price discovery process. Nevertheless, if
a trading disruption would be prevented
or shortened by this proposed
rulemaking, then price discovery would
be improved.
ddrumheller on DSK120RN23PROD with PROPOSALS2
d. Sound Risk Management Practices
The Commission believes the
proposed rule would promote the
development of sound risk management
practices among covered entities.
Programs, plans, policies, and
procedures are required for operational
risks, which now explicitly include
cybersecurity and third-party risks that
adhere to current best practices. These
processes seek to help covered entities
identify, protect, detect, respond, and
recover from such risks. As such, the
operational risk management processes
of covered entities may be improved.
e. Other Public Interest Considerations
The proposed rule relies on and
incorporates aspects of existing
standards and practices developed by
other regulators and standard-setting
bodies, including NFA rules and
interpretive notices; prudential rules
and guidance; and NIST, ISO, FFIEC
and other sources of cyber and
operational resilience standards.
Accordingly, the proposed rule should
support the development of further
convergence in the area of operational
resilience and allow covered entities to
develop ORFs that are adaptive and
responsive to rapidly changing
circumstances and technology, which
the Commission believes could lead to
better protection of markets against the
spread of contagion risks to the financial
system from operational risks, in
general.
3. Request for Comments
As noted, the Commission invites
public comment on all aspects of its
cost-benefit consideration, including,
but not limited to the baseline and the
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
identification and measurement of costs
and benefits relative to it; the
identification, measurement, and
assessment of any costs and benefits not
discussed herein; whether the
Commission has misidentified any costs
or benefits; what, if any, alternatives
would be more reasonable in terms of
their costs and benefits; and the Section
15(a) factors described above. The
Commission asks that commenters
explain and support the reasons for
positions asserted in their comment
letters and, further, include in them any
data or other information that they may
have to assist the Commission’s ability
to better quantify the costs and benefits
of the Proposal.
1. Has the Commission misidentified
any costs or benefits? If so, please
explain.
2. Please explain whether compliance
costs would increase or decrease as a
result the proposed rule. Please provide
all quantitative and qualitative costs,
including, but not limited to personnel
costs and technological costs.
3. The Commission seeks additional
information on the costs and benefits of
the proposed rule’s requirement for
covered entities to have a governance
regime for their ORF, including risk
appetite and tolerance limits,
consolidated programs or plans, and
internal escalation policies. Specifically,
to what extent do covered entities
already have or plan to have relevant
programs or plans, policies, and
procedures compliant with those
prescribed in the proposed rule? To
what practical extent do NFA’s
requirements, prudential regulation
and/or best practices currently duplicate
or differ from the ORF governance
regime, including risk appetite limits,
consolidated programs or plans, and
internal escalation policies, being
proposed? Will covered entities
experience additional or lowered costs
to comply with the proposed rule, and
if so, to what degree?
4. The Commission seeks additional
information regarding the costs and
benefits of establishing an information
and technology security program.
Specifically, to what extent are covered
entities already conducting
comprehensive risk assessments that
follow standards described in the
proposed rule? Are these assessments
being conducted on at least an annual
basis? Do existing effective controls
likewise meet the standards in the
proposed rule? Will covered entities
experience additional or lowered costs
relative to current practice to establish,
document, and maintain an incident
response plan as called for in the
proposed rule, and if so, to what degree?
PO 00000
Frm 00045
Fmt 4701
Sfmt 4702
4749
5. The Commission seeks additional
information regarding the costs and
benefits of establishing a business
continuity and disaster recovery plan. In
particular, is the Commission’s
proposed rule different from current
practice, and, if so, how? Would
covered entities experience additional
or lowered costs to comply with the
proposed rule, and, if so, to what
degree?
6. The Commission seeks additional
information regarding the costs and
benefits of the proposed rule’s required
notice of ORF events to the
Commission. Will covered entities
experience additional or lowered costs
to comply with the proposed rule, and,
if so, to what degree? Will compliance
with the 24-hour cap for as-soon-aspossible notification entail additional
costs relative to some shorter or longer
cap and, if so, why and to what degree?
7. The Commission seeks additional
information on the costs and benefits of
the proposed rule’s requirement that
covered entities provide notification to
customers and counterparties following
an incident. In particular, is the
Commission’s proposed rule different
from current practice, and, if so, how?
Would covered entities experience
additional or lowered costs to comply
with the proposed rule, and, if so, to
what degree?
8. The Commission seeks additional
information regarding the costs and
benefits of ORF review and testing. In
particular, to what extent, if any, does
the proposed rule differ from existing
procedures? How do covered entities
determine the amount of review and
testing that is appropriate? Do all
covered entities currently undertake
penetration and vulnerability testing,
and at what frequency? Would covered
entities experience additional or
lowered costs to comply with the
proposed rule, and, if so, to what
degree?
9. The Commission seeks additional
information regarding the costs and
benefits of the cross-border application
of the proposed rule. Would added
specificity in the proposed regulations
improve the cost-benefit calculus for
those covered entities impacted by their
cost-benefit application? If so, in what
areas would more specificity be helpful
and how would costs and benefits be
impacted?
D. Antitrust Laws
Section 15(b) of the CEA requires the
Commission to ‘‘take into consideration
the public interest to be protected by the
antitrust laws and endeavor to take the
least anticompetitive means of
achieving the purposes of the CEA, in
E:\FR\FM\24JAP2.SGM
24JAP2
4750
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
issuing any order or adopting any
Commission rule or regulation
(including any exemption under CEA
section 4(c) or 4c(b)), or in requiring or
approving any bylaw, rule, or regulation
of a contract market or registered futures
association established pursuant to
section 17 of this Act.’’ 393
The Commission preliminarily
believes that the public interest to be
protected by the antitrust laws is
generally to protect competition. The
Commission invites comment on
whether the proposed rule implicates
any other specific public interest to be
protected by the antitrust laws.
The Commission has also assessed the
proposal for potential anticompetitive
effects. To the extent that there are
substantial fixed costs associated with
improved operational risk management,
there may be competitive implications,
though likely anticompetitive impacts
have not been identified. Smaller firms
may bear a disproportionate cost
relative to larger firms in total asset size
due to this proposed rule. Nevertheless,
smaller firms may be able to realize
economies of scope and scale through
outsourcing to third-parties, albeit at the
cost of raising their third-party risk
exposure. In addition, the proposed rule
allows smaller firms to choose programs
or plans, policies, and procedures that
are appropriate to their businesses,
further mitigating competitive concerns.
The Commission invites comment on
its CEA section 15(b) assessment,
including what other means, if any,
would be more procompetitive than
what the Commission now proposes and
why.
List of Subjects
17 CFR Part 1
Brokers, Commodity futures,
Consumer protection, Reporting and
recordkeeping requirements.
ddrumheller on DSK120RN23PROD with PROPOSALS2
17 CFR Part 23
Banks, Banking, Commodity futures,
Reporting and recordkeeping
requirements, Swaps.
For the reasons stated in the
preamble, the Commodity Futures
Trading Commission proposes to amend
17 CFR parts 1 and 23 as set forth
below:
PART 1—GENERAL REGULATIONS
UNDER THE COMMODITY EXCHANGE
ACT
1. The authority citation for part 1
continues to read as follows:
■
Authority: 7 U.S.C. 1a, 2, 5, 6, 6a, 6b, 6c,
6d, 6e, 6f, 6g, 6h, 6i, 6k, 6l, 6m, 6n, 6o, 6p,
393 7
U.S.C. 19(b).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
6r, 6s, 7, 7a–1, 7a–2, 7b, 7b–3, 8, 9, 10a, 12,
12a, 12c, 13a, 13a–1, 16, 16a, 19, 21, 23, and
24 (2012).
■
2. Add § 1.13 to read as follows:
§ 1.13 Operational Resilience Framework
for Futures Commission Merchants
(a) Definitions. For purposes of this
section:
Affiliate means, with respect to any
person, a person controlling, controlled
by, or under common control with, such
person.
Business continuity and disaster
recovery plan means a written plan
outlining the procedures to be followed
in the event of an emergency or other
significant disruption to the continuity
of normal business operations and that
meets the requirements of paragraph (f)
of this section.
Consolidated program or plan means
any information and technology security
program, third-party relationship
program, or business continuity and
disaster recovery plan in which the
futures commission merchant
participates with one or more affiliates
and that is managed and approved at the
enterprise level.
Covered information means any
sensitive or confidential data or
information maintained by a futures
commission merchant in connection
with its business activities as a futures
commission merchant.
Covered technology means any
application, device, information
technology asset, network service,
system, and other information-handling
component, including the operating
environment, that is used by a futures
commission merchant to conduct its
business activities, or to meet its
regulatory obligations, as a futures
commission merchant.
Critical third-party service provider
means a third-party service provider,
the disruption of whose performance
would be reasonably likely to:
(i) Significantly disrupt a futures
commission merchant’s business
operations as a futures commission
merchant; or
(ii) Significantly and adversely impact
the futures commission merchant’s
customers.
Information and technology security
means the preservation of:
(i) The confidentiality, integrity, and
availability of covered information; and
(ii) The reliability, security, capacity,
and resilience of covered technology.
Incident means any event, occurrence,
or circumstance that could jeopardize
information and technology security,
including if it occurs at a third-party
service provider.
Information and technology security
program means a written program
PO 00000
Frm 00046
Fmt 4701
Sfmt 4702
reasonably designed to identify,
monitor, manage, and assess risks
relating to information and technology
security and that meets the
requirements of paragraph (d) of this
section.
Key controls mean controls that an
appropriate risk analysis determines are
either critically important for effective
information and technology security or
intended to address risks that evolve or
change more frequently and therefore
require more frequent review to ensure
their continuing effectiveness in
addressing such risks.
Oversight body means any board,
body, or committee of a board or body
of the futures commission merchant
specifically granted the authority and
responsibility for making strategic
decisions, setting objectives and overall
direction, implementing policies and
procedures, or overseeing the
implementation of operations for the
futures commission merchant.
Risk appetite means the aggregate
amount of risk a futures commission
merchant is willing to assume to
achieve its strategic objectives.
Risk tolerance limit means the amount
of risk, beyond its risk appetite, that a
futures commission merchant is
prepared to tolerate through mitigating
actions.
Senior officer means the chief
executive officer or other equivalent
officer of the futures commission
merchant.
Third-party relationship program
means a written program reasonably
designed to identify, monitor, manage,
and assess risks relating to third-party
relationships and that meets the
requirements of paragraph (e) of this
section.
(b) Generally. (1) Purpose and scope.
Each futures commission merchant shall
establish, document, implement, and
maintain an Operational Resilience
Framework reasonably designed to
identify, monitor, manage, and assess
risks relating to:
(i) information and technology
security;
(ii) third-party relationships; and
(iii) emergencies or other significant
disruptions to the continuity of normal
business operations as a futures
commission merchant.
(2) Components. The Operational
Resilience Framework shall include an
information and technology security
program, a third-party relationship
program, and a business continuity and
disaster recovery plan. Each component
program or plan shall be supported by
written policies and procedures.
(3) Standard. The Operational
Resilience Framework shall be
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
appropriate and proportionate to the
nature, size, scope, complexity, and risk
profile of its business activities as a
futures commission merchant, following
generally accepted standards and best
practices.
(c) Governance. (1) Approval of
components. Each component program
or plan required by paragraph (b)(2) of
this section shall be approved in
writing, on at least an annual basis, by
either the senior officer, an oversight
body, or a senior-level official of the
futures commission merchant.
(2) Risk appetite and risk tolerance
limits. (i) Each futures commission
merchant shall establish and implement
appropriate risk appetite and risk
tolerance limits with respect to the risk
areas identified in paragraph (b)(1) of
this section.
(ii) The risk appetite and risk
tolerance limits established pursuant to
paragraph (c)(2)(i) of this section shall
be reviewed and approved in writing on
at least an annual basis by either the
senior officer, an oversight body, or a
senior-level official of the futures
commission merchant.
(3) Internal escalations. The senior
officer, an oversight body, or a seniorlevel official of the futures commission
merchant shall be notified of:
(i) circumstances that exceed risk
tolerance limits established and
approved pursuant to paragraph (c)(2)(i)
of this section; and
(ii) incidents that require notification
pursuant to paragraphs (i) or (j) of this
section.
(4) Futures commission merchants
forming part of a larger enterprise. (i)
Generally. A futures commission
merchant may satisfy the requirements
of paragraph (b)(2) of this section
through its participation in a
consolidated program or plan, provided
that each consolidated program or plan
meets the requirements of this section.
(ii) Attestation. A futures commission
merchant that relies on a consolidated
program or plan pursuant to paragraph
(c)(4)(i) of this section may satisfy the
requirements in paragraphs (c)(1) and
(c)(2)(ii) of this section provided that
either the senior officer, an oversight
body, or a senior-level official of the
futures commission merchant attests in
writing, on at least an annual basis, that
the consolidated program or plan meets
the requirements of this section and
reflects a risk appetite and risk tolerance
limits appropriate to the futures
commission merchant.
(d) Information and technology
security program. (1) Risk assessment.
(i) The information and technology
security program shall require the
futures commission merchant to
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
conduct and document the results of a
comprehensive risk assessment
reasonably designed to identify, assess,
and prioritize risks to information and
technology security.
(ii) Such risk assessment shall be
conducted at a frequency consistent
with the standard set forth in paragraph
(b)(3) of this section, but at least
annually, and be conducted by
personnel not responsible for the
development or implementation of
covered technology or related controls.
(iii) The results of the risk assessment
shall be provided to the oversight body,
senior officer, or other senior-level
official who approves the information
and technology security program upon
the risk assessment’s completion.
(2) Effective controls. The information
and technology security program shall
require the futures commission
merchant to establish, document,
implement, and maintain controls
reasonably designed to prevent, detect,
and mitigate identified risks to
information and technology security.
Each futures commission merchant shall
consider, at a minimum, the following
types of controls and adopt those
consistent with the standard set forth in
paragraph (b)(3) of this section:
(i) Access controls on covered
technology, including controls to
authenticate and permit access only by
authorized individuals and controls
preventing misappropriation or misuse
of covered information by employees;
(ii) Access restrictions designed to
permit only authorized individuals to
access physical locations containing
covered information, including, but not
limited to, buildings, computer
facilities, and records storage facilities;
(iii) Encryption of electronic covered
information, including while in transit
or in storage on networks or systems, to
which unauthorized individuals may
have access;
(iv) Dual control procedures,
segregation of duties, and background
checks for employees or third-party
service providers with responsibilities
for or access to covered information;
(v) Change management practices,
including defined roles and
responsibilities, logging, and monitoring
practices;
(vi) Systems development and
configuration management practices,
including practices for initializing,
changing, testing, and monitoring
configurations;
(vii) Flaw remediation, including
vulnerability patching practices;
(viii) Measures to protect against
destruction, loss, or damage of covered
information due to potential
PO 00000
Frm 00047
Fmt 4701
Sfmt 4702
4751
environmental hazards, such as fire and
water damage or technological failures;
(ix) Monitoring systems and
procedures to detect actual and
attempted attacks on or intrusions into
covered technology;
(x) Response programs that specify
actions to be taken when the futures
commission merchant suspects or
detects that unauthorized individuals
have gained access to covered
technology, including appropriate
reports to regulatory and law
enforcement agencies; and
(xi) Measures to promptly recover and
secure any compromised covered
information.
(3) Incident response plan. The
information and technology security
program shall include a written incident
response plan that is reasonably
designed to detect, assess, contain,
mitigate the impact of, and recover from
an incident. This incident response plan
shall include, at a minimum:
(i) The roles and responsibilities of
the futures commission merchant’s
management, staff, and third-party
service providers in responding to
incidents;
(ii) Escalation protocols, including a
requirement to timely inform the
oversight body, senior officer, or other
senior-level official that has primary
responsibility for overseeing the
information and technology security
program; the chief compliance officer of
the futures commission merchant; and
any other relevant personnel of
incidents that may significantly impact
the futures commission merchant’s
regulatory obligations or require
notification to the Commission;
(iii) The points of contact for external
coordination of incident responses as
determined necessary by the futures
commission merchant based on the
severity of incidents;
(iv) The required reporting of
incidents, whether by internal policy,
contract, or law, including as required
in this section;
(v) Procedures for documenting
incidents and managements’ response;
and
(vi) The remediation of weaknesses in
information and technology security,
controls, and training, if any.
(e) Third-party relationship program.
(1) Third-party relationship lifecycle
stages. The third-party relationship
program shall describe how the futures
commission merchant addresses the
risks attendant to each stage of the thirdparty relationship lifecycle, including:
(i) Pre-selection risk assessment;
(ii) Due diligence of prospective thirdparty service providers;
(iii) Contractual negotiations;
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
4752
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
(iv) Ongoing monitoring; and
(v) Termination, including
preparations for planned and unplanned
terminations.
(2) Heightened duties for critical
third-party service providers. The thirdparty relationship program shall
establish heightened due diligence
practices for potential critical thirdparty service providers and heightened
monitoring for critical third-party
service providers.
(3) Third-party service provider
inventory. As part of its third-party
relationship program, each futures
commission merchant shall create,
maintain, and regularly update an
inventory of third-party service
providers the futures commission
merchant has engaged to support its
activities as a futures commission
merchant, identifying whether each
third-party service provider in the
inventory is a critical third-party service
provider.
(3) Retention of responsibility.
Notwithstanding a futures commission
merchant’s determination to rely on a
third-party service provider, each
futures commission merchant remains
responsible for meeting its obligations
under the Act and Commission
regulations.
(4) Guidance on third-party
relationship program. For guidance
outlining potential risks, considerations,
and strategies for developing a thirdparty relationship program consistent
with paragraph (e), see Appendix A to
this part.
(f) Business continuity and disaster
recovery plan. (1) Purpose. The business
continuity and disaster recovery plan
shall be reasonably designed to enable
the futures commission merchant to:
(i) Continue or resume normal
business operations with minimal
disruption to customers and the
markets; and
(ii) Recover and make use of covered
information, as well as any other data,
information, or documentation required
to be maintained by law and regulation.
(2) Minimum contents. The business
continuity and disaster recovery plan
shall, at a minimum:
(i) Identify covered information, as
well as any other data or information
required to be maintained by law and
regulation, and establish and implement
procedures to backup or copy all such
data and information with sufficient
frequency to meet the requirements of
this section, and to store such data and
information off-site in either hard-copy
or electronic format;
(ii) Identify any resources, including
covered technology, facilities,
infrastructure, personnel, and
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
competencies, essential to the
operations of the futures commission
merchant or to fulfill the regulatory
obligations of the futures commission
merchant, and establish and maintain
procedures and arrangements to provide
for their backup in a manner that is
sufficient to meet the requirements of
this section. Such arrangements must
provide for backups that are located in
one or more areas that are
geographically separate from the futures
commission merchant’s primary
systems, facilities, infrastructure, and
personnel, and may include the use of
resources provided by third-party
service providers;
(iii) Identify potential disruptions to
critical third-party service providers and
establish a plan to minimize the impact
of such disruptions;
(iv) Identify supervisory personnel
responsible for implementing each
aspect of the business continuity and
disaster recovery plan, including the
emergency contacts required to be
provided pursuant to paragraph (k) of
this section; and
(v) Establish a plan for
communicating with the following
persons in the event of an emergency or
other significant disruption, to the
extent applicable: employees;
customers; swap data repositories;
execution facilities; trading facilities;
clearing facilities; regulatory authorities;
data, communications and
infrastructure providers and other
vendors; disaster recovery specialists;
and other persons essential to the
recovery of documentation and data, the
resumption of operations, and
compliance with the Act and
Commission regulations.
(3) Accessibility. Each futures
commission merchant shall maintain
copies of its business continuity and
disaster recovery plan at one or more
accessible off-site locations.
(g) Training and distribution. (1)
Training. Each futures commission
merchant shall establish, implement,
and maintain training with respect to all
aspects of the Operational Resilience
Framework, including, but not limited
to:
(i) Cybersecurity awareness training
for all personnel; and
(ii) Role-specific training for
personnel involved in establishing,
documenting, implementing, and
maintaining the Operational Resilience
Framework.
(2) Frequency. Each futures
commission merchant shall provide and
update the training required in
paragraph (g)(1) as necessary, but no
less frequently than annually.
PO 00000
Frm 00048
Fmt 4701
Sfmt 4702
(3) Distribution. Each futures
commission merchant shall distribute
copies of each component program or
plan required by paragraph (b)(2) of this
section to relevant personnel and
promptly provide any significant
revisions thereto.
(h) Reviews and Testing. Each futures
commission merchant shall establish,
implement, and maintain a plan
reasonably designed to assess its
adherence to, and the effectiveness of,
its Operational Resilience Framework
through regular reviews and risk-based
testing.
(1) Reviews. Reviews of the
Operational Resilience Framework shall
be conducted at least annually and in
connection with any material change to
the activities or operations of the futures
commission merchant that is reasonably
likely to affect the risks identified in
paragraph (b)(1) of this section. Reviews
shall include an analysis of adherence
to, and the effectiveness of, the
Operational Resilience Framework and
any recommendations for modifications
or improvements that address root
causes of any issues identified by the
review.
(2) Testing. The frequency, nature,
and scope of risk-based testing of the
Operational Resilience Framework shall
be determined by the futures
commission merchant, consistent with
the standard in paragraph (b)(3) of this
section.
(i) Testing of the information and
technology security program shall
include, at a minimum:
(A) Testing of key controls and the
incident response plan at least annually;
(B) Vulnerability assessments,
including daily or continuous
automated vulnerability scans; and
(C) Penetration testing at least
annually.
(ii) Testing of the business continuity
and disaster recovery plan shall include,
at a minimum, a walk-through or
tabletop exercise designed to test the
effectiveness of backup facilities and
capabilities at least annually.
(3) Independence. The reviews and
testing shall be conducted by qualified
personnel who are independent of the
aspect of the Operational Resilience
Framework being reviewed or tested.
(4) Documentation. Each futures
commission merchant shall document
all reviews and testing of the
Operational Resilience Framework. The
documentation shall, at a minimum,
include:
(i) The date the review or testing was
conducted;
(ii) The nature and scope of the
review or testing, including
methodologies employed;
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
(iii) The results of the review or
testing, including any assessment of
effectiveness;
(iv) Any identified deficiencies and
recommendations for remediation; and
(v) Any corrective action(s) taken or
initiated, including the date(s) such
action(s) were taken.
(5) Internal reporting. Each futures
commission merchant shall report on
the results of its reviews and testing to
the futures commission merchant’s chief
compliance officer and any other
relevant senior-level official(s) and
oversight body(ies).
(i) Notifications to the Commission.
(1) Incidents. (i) Notification trigger.
Each futures commission merchant shall
notify the Commission of any incident
that adversely impacts, or is reasonably
likely to adversely impact:
(A) information and technology
security;
(B) the ability of the futures
commission merchant to continue its
business activities as a futures
commission merchant; or
(C) the assets or positions of a
customer of the futures commission
merchant.
(ii) Contents. The notification shall
provide any information available to the
futures commission merchant at the
time of notification that may assist the
Commission in assessing and
responding to the incident, including
the date the incident was detected,
possible cause(s) of the incident, its
apparent or likely impacts, and any
actions the futures commission
merchant has taken or is taking to
mitigate or recover from the incident,
including measures to protect
customers.
(iii) Timing and method. Each futures
commission merchant shall provide the
incident notification as soon as possible
but in any event no later than 24 hours
after such incident has been detected.
The notification shall be provided via
email to ORFnotices@cftc.gov.
(2) Business continuity and disaster
recovery plan activation. (i) Notification
trigger. Each futures commission
merchant shall notify the Commission
of any determination to activate the
business continuity and disaster
recovery plan.
(ii) Contents. The notification shall
provide any information available to the
futures commission merchant at the
time of notification that may assist the
Commission in assessing or responding
to the emergency or disruption,
including the date of the emergency or
disruption, a description thereof, the
possible cause(s), its apparent or likely
impacts, and any actions the futures
commission merchant has taken or is
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
taking to mitigate or recover from the
emergency or disruption, including
measures taken or being taken to protect
customers.
(iii) Timing and method. Each futures
commission merchant shall provide the
business continuity and disaster
recovery plan activation notification
within 24 hours of determining to
activate the business continuity and
disaster recovery plan. The notification
shall be provided via email to
ORFnotices@cftc.gov.
(j) Notification of incidents to affected
customers. (1) Notification trigger. Each
futures commission merchant shall
notify a customer as soon as possible of
any incident that is reasonably likely to
have adversely affected the
confidentiality or integrity of the
customer’s covered information, assets,
or positions.
(2) Contents. The notification to
affected customers shall include
information necessary for the affected
customer to understand and assess the
potential impact of the incident on its
information, assets, or positions, and to
take any necessary action. Such
notification shall include, at a
minimum:
(i) a description of the incident;
(ii) the particular way in which the
customer, or its covered information,
may have been adversely impacted;
(iii) measures being taken by the
futures commission merchant to protect
against further harm; and
(iv) contact information for the futures
commission merchant where the
customer may learn more about the
incident or ask questions.
(k) Emergency Contacts. (1) Each
futures commission merchant shall
provide the Commission the name and
contact information of:
(i) two employees whom the
Commission may contact in connection
with incidents triggering notification to
the Commission under paragraph (i)(1)
of this section; and
(ii) two employees whom the
Commission may contact in connection
with the activation of the futures
commission merchant’s business
continuity and disaster recovery plan
triggering notification to the
Commission under paragraph (i)(2) of
this section.
(2) The identified employees shall be
authorized to make key decisions on
behalf of the futures commission
merchant and have knowledge of the
futures commission merchant’s incident
response plan or business continuity
and disaster recovery plan, as
appropriate.
PO 00000
Frm 00049
Fmt 4701
Sfmt 4702
4753
(3) The futures commission merchant
shall update its emergency contacts
with the Commission as necessary.
(l) Recordkeeping. Each futures
commission merchant shall maintain all
records required to be maintained
pursuant to this section in accordance
with section 1.31 of this chapter and
shall make them available promptly
upon request to representatives of the
Commission and to representatives of
applicable prudential regulators, as
defined in section 1a(39) of the Act.
■ 3. Add appendix A to part 1 to read
as follows:
Appendix A to Part 1—Guidance on
Third-Party Relationship Programs
The following guidance offers factors,
actions, and strategies for futures commission
merchants to consider in preparing and
implementing third-party relationship
programs reasonably designed to identify,
monitor, manage, and assess risks relating to
third-party relationships, as required by
Commission regulation 1.13. The guidance is
also not intended to reduce or replace the
obligation of futures commission merchants
to comply with the requirements in
Commission regulation 1.13, including the
requirement to ensure that each futures
commission merchant’s Operational
Resilience Framework is appropriate and
proportionate to the nature, size, scope,
complexity, and risk profile of its business
activities as a futures commission merchant,
following generally accepted standards and
best practices. The guidance is not
exhaustive and is nonbinding.
The guidance is written to be broadly
relevant to all futures commission merchants,
but it may not be universally applicable. The
degree to which the guidance would be
applicable to a particular futures commission
merchant would depend on its unique facts
and circumstances and may vary from
relationship to relationship. Each futures
commission merchant should assess the
relevance of the guidance as it applies to its
particular risk profile and tailor its thirdparty relationship program accordingly.
Comparable guidance for swap dealers and
major swap participants is included in
Appendix A to subpart J of part 23 of the
Commission’s regulations.
A. Pre-Selection Risk Assessment—
Commission Regulation 1.13(e)(1)(i)
Before entering into a third-party
relationship, futures commission merchants
should determine which services should be
performed by a third-party and plan for how
to manage associated risks. The Commission
appreciates that reliance on third-party
service providers may be unavoidable,
particularly given the rapid pace of
technological innovation, which may render
it uneconomical or even infeasible for
financial institutions to meet all of their
technological needs in-house.
Nevertheless, given the risks associated
with relying on third-party service providers,
and that each additional third-party
relationship a futures commission merchant
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
4754
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
employs is likely to add further risk and
complexity, a futures commission merchant’s
third-party relationship program should
include a deliberative process for
affirmatively determining whether to source
a particular service from a third-party service
provider. In determining whether a particular
function should be performed by a thirdparty service provider, futures commission
merchants should consider whether:
• The service would support the futures
commission merchant’s strategic goals and
objectives.
• The same goals and objectives could be
addressed through an alternative means that
may not require reliance on a third-party
service provider.
• The futures commission merchant has or
could otherwise secure the resources,
financial and otherwise, to effectively
monitor the third-party service provider.
• Relevant and reputable third-party
service providers are available.
• The provision of the service would
implicate information and technology
security concerns, including by requiring the
third-party service provider to obtain access
to covered information or provide covered
technology.
• A disruption of the service would have
a negative impact on customers or regulatory
compliance.
• The relationship could be structured to
reduce associated risks, such as by limiting
the third-party service provider’s access to
covered information or covered technology.
• Lack of direct control over performance
of the service would present unacceptable
risk, i.e., risk outside the futures commission
merchant’s risk tolerance limits.
As the above considerations illustrate,
futures commission merchants should
consider ways in which they might structure
their third-party relationships to reduce the
associated risks. For example, where giving
a third-party service provider direct access to
its technology or data may be outside a
futures commission merchant’s risk
tolerance, structuring the relationship to
provide the third-party service provider
access on a read-only basis or via reports
delivered by the futures commission
merchants could render the relationship
more acceptable. Futures commission
merchants should therefore consider the
availability of safer means of performing the
service as part of their assessment.
Changes in technology, businesses
practices, regulation, market structure,
market participants (e.g., new entrants to the
market), or service delivery may change the
risk profile of the third-party relationship
over time. Accordingly, futures commission
merchants should consider periodically
reassessing their selection of services to be
performed by third-party service providers.
Futures commission merchants should stay
abreast of these changes by monitoring the
external environment and communicating
with current and prospective service
providers and other participants in industry.
B. Due Diligence in Selecting Third-Party
Service Providers—Commission Regulation
1.13(e)(1)(ii)
After a futures commission merchant has
determined that a service is suitable for a
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
third-party to perform, it should conduct due
diligence on prospective third-party service
providers. Due diligence provides futures
commission merchants with the information
they need to assess and conclude, with a
reasonable level of assurance, that the
prospective third-party service provider is
capable of effectively providing the service as
expected, adhering to the futures commission
merchant’s policies, maintaining the futures
commission merchant’s compliance with
Commission regulations, and protecting
covered information. Appropriate due
diligence should also enable futures
commission merchants to evaluate whether
they would be able to effectively monitor and
manage the risks associated with a particular
third-party relationship.
Due diligence may be conducted before or
contemporaneously with contractual
negotiations with prospective third-party
service providers but should be concluded
prior to executing any agreements. Futures
commission merchants should conduct due
diligence even in situations where, for a
particular service, there may only be one or
a small number of providers with a dominant
market share whose services are used by all
or most of the futures commission merchants’
industry peers, and futures commission
merchants should not rely solely on those
providers’ reputations or prior experience
with them. The depth and rigor of the due
diligence should be proportionate to the
nature of the third-party relationship, with
the required heightened due diligence for
potential critical third-party service
providers pursuant to Commission regulation
1.13(e)(2). Specifically, when conducting due
diligence for a potential critical third-party
servicer provider, futures commission
merchants should expand the type and
sources of information they rely on, the rigor
and scrutiny they apply in reviewing the
information to identify potential risks, and
the level of confidence in their assessment of
the third-party service provider’s ability to
perform.
When establishing their due diligence
protocols, futures commission merchants
should consider the full range of risks that
reliance on the third-party service providers
could introduce in light of the nature of the
service they would be performing. Relevant
considerations with respect to the potential
third-party service provider include its:
• Financial condition, business experience
and reputation, and business prospects,
particularly the third-party service provider’s
experience providing services to financial
institutions.
• Background, experience, and
qualifications with respect to key personnel.
• Information and technology security
practices, including incident reporting and
incident management programs, and whether
there are clearly documented processes for
identifying and escalating incidents.
• Risk management practices, including
governance, controls, testing, and issue
management practices, as well as the results
of any independent risk assessments.
• Regulatory environment, including the
legal jurisdiction in which it is based and
applicable regulatory or licensing
requirements.
PO 00000
Frm 00050
Fmt 4701
Sfmt 4702
• History of disruptions to operations,
including whether the third-party service
provider has suffered incidents that would
meet the standard for reporting to the
Commission in Commission regulation
1.13(i).
• Violations of legal, compliance, or
contractual obligations, including civil or
criminal proceedings or administrative
enforcement actions, including from selfregulatory organizations.
• Understanding of Commission regulatory
requirements applicable to the futures
commission merchant.
• Use of and reliance on subcontractors,
including the volume and types of
subcontracted activities, and the third-party
service provider’s process for identifying,
assessing, managing, and monitoring
associated risks.
• Business continuity and contingency
plans.
• Financial protections, such as insurance
coverage against losses or liabilities from
intentional or negligent acts or hazards
involving physical destruction and data or
documentation losses.
Futures commission merchants should
memorialize their assessment of these factors
and identify how the review was heightened
for critical third-party service providers.
Futures commission merchants should not
rely solely on their prior knowledge of or
experience with a potential third-party.
Potential sources of due diligence
information include:
• Audit reports, including pooled audit
plans and System and Organizational
Controls (SOC) reports.
• Financial statements and projections and
relevant accompanying information (e.g.,
annual or quarterly reports, management
commentary, auditors’ opinions, and investor
relations materials).
• Incident response plans, including the
results of recent testing or assessments
thereof.
• Business continuity and disaster
recovery plans, as well as the result of recent
testing or assessments thereof.
• Public filings.
• News reports, trade publications, and
press releases.
• Reports from market intelligence
providers.
• References from current or previous
customers, or other parties which have had
business relationships with the third-party
service provider.
• Informal industry discussions.
• Information provided directly by the
third-party service provider, such as internal
performance metrics.
Obtaining and reviewing audit reports,
including SOC reports, may be of particular
value for conducting heightened due
diligence of critical third-party service
providers. In certain circumstances, futures
commission merchants may not be able to
gather all the information necessary to reach
an informed conclusion that a prospective
third-party service provider is an adequate
provider. Examples include instances where
the third-party service provider is a new
entrant into the market and little information
exists; where information provided by the
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
third-party service provider is insufficient or
appears unreliable; or where the third-party
service provider is reluctant to provide
internal information. In such cases, the
futures commission merchant should identify
and document the limitations of its due
diligence, the attendant risks, and any
available methods for mitigating them (e.g.,
obtaining alternate information,
implementing enhanced monitoring or
controls, negotiating protective contractual
provisions). Ultimately, such factors could
weigh against the use of the potential thirdparty service provider, particularly a
potential critical third-party service provider.
Futures commission merchants that proceed
with the third-party service arrangements
notwithstanding the limited due diligence
should do so with caution, applying
heightened scrutiny of the information they
do receive, and consider the implementation
of their own mitigating controls to
compensate for the uncertainty.
C. Contractual Negotiations—Commission
Regulation 1.13(e)(1)(iii)
After selecting a third-party service
provider, futures commission merchants
should proceed to finalizing the agreement,
typically through entering into an
enforceable written contract. Written
contracts are an important tool for clarifying
the scope of services to be delivered,
establishing standards or performance
benchmarks, allocating risks and
responsibilities, and facilitating resolution of
disputes. They can also reduce the risks of
non-performance and assist in monitoring the
third-party service provider. Because of their
importance, the Commission recommends
that futures commission merchants enter
written agreements with third-party service
providers before services are delivered,
particularly with critical third-party service
providers.
In negotiating a written contract, futures
commission merchants should seek to
negotiate contractual provisions that would
support their ability to mitigate, manage, and
monitor the risks associated with the
relationship, as identified through their
initial pre-selection and due diligence
activities. The contractual provisions should
be informed by the nature of the service
provided and be proportionate to the
criticality of the services provided. In
particular, futures commission merchants
should consider negotiating for the contract
to include the following provisions:
• Timely notification to the futures
commission merchant of any incidents
suffered by third-party service providers, or
of significant disruptions to the operations of
the third-party service provider.
• Timely notification to the futures
commission merchant of any material
changes to the services provided.
• Required periodic, independent audits of
the third-party service provider, the results of
which would be shared with the futures
commission merchant.
• Restrictions on the third-party service
provider’s use of the futures commission
merchant’s covered information, except as
necessary to deliver the service or meet legal
obligations.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
• Security measures to protect the futures
commission merchant’s covered information
and covered technology to which the thirdparty service provider has access.
• Insurance, guarantees, indemnification,
and limitations on liability.
• Dispute resolution procedures.
• Performance measures or benchmarks.
• Remediation of identified performance
issues.
• Dispute resolution procedures.
• Compliance with regulatory
requirements, including reasonable
assurances that the third-party service
provider is willing and able to coordinate
with the futures commission merchant for
the purpose of ensuring the futures
commission merchant complies with its legal
and regulatory obligations.
• Use of subcontractors, including
notification or approval procedures for their
use, the extension of contractual rights of the
futures commission merchant against the
third-party service provider to its
subcontractors, and contractual obligations
for reporting on or oversight of
subcontractors.
• Termination provisions, including rights
to terminate following breaches of the thirdparty service provider’s obligations, notice
requirements, obligations of the third-party
service provider to provide support for a
successful transition, and the return or
destruction of records or covered
information, as further described in section E
of this guidance.
• Information sharing necessary to
facilitate other provisions of this proposed
guidance (for example, reporting
requirements to support ongoing monitoring,
as discussed in section D of this guidance, or
notice requirements for termination, as
discussed in section E of this guidance).
These provisions focus on key risk factors
generally associated with third-party service
provider relationships. They are not
exhaustive of all contractual provisions
futures commission merchants should seek to
include in their written contracts, including
ordinary commercial contract terms (e.g.,
choice of law provisions) and terms that may
relate only to specific services, among other
provisions. While third-parties may initially
offer a standard contract, a futures
commission merchant may seek to request
modifications, additional contractual
provisions, or addendums to satisfy its needs.
Futures commission merchants should work
to tailor the level of detail and
comprehensiveness of the contractual
provisions based on the risk and complexity
posed by the particular third-party
relationship, contracts with critical thirdparty service providers likely being the most
tailored.
In some circumstances, a futures
commission merchant may be at a bargaining
power disadvantage, which prevents it from
negotiating optimal contractual provisions.
For example, a prospective third-party
service provider may be the sole provider of
a service or may have such dominant market
share that it can offer its services on a ‘‘takeit-or-leave-it’’ basis. In such situations, the
futures commission merchant should work to
understand any resulting limitations in the
PO 00000
Frm 00051
Fmt 4701
Sfmt 4702
4755
contract and attendant risks and consider
whether it can achieve outcomes comparable
to those provided by contractual protections
through non-contractual means. Examples
could include the futures commission
merchant implementing additional controls,
augmenting its monitoring of the third-party
service provider using public sources or
market intelligence services, or purchasing
insurance. The futures commission merchant
should make an assessment, however, of
whether these alternatives would provide an
adequate substitute for the unobtained
contractual protections and document its
assessment and mitigation plan, considering
its risk appetite and risk tolerance limits.
Where a third-party service provider is
unable or unwilling to agree to provisions
necessary for the futures commission
merchant to meet its obligations under
Commission regulations, particularly a
critical third-party service provider, the
futures commission merchant should
consider finding an alternative third-party
service provider.
D. Ongoing Monitoring—Commission
Regulation 1.13(e)(1)(iv)
After a third-party service provider has
initiated performance, futures commission
merchants should engage in ongoing
monitoring. Ongoing monitoring is important
to ensure the third-party service provider is
properly carrying out its outsourced function
and contractual obligations, as well as
meeting quality or performance expectations.
Effective monitoring can aid futures
commission merchants in the early
identification of performance deficits,
allowing for a quicker response that may then
mitigate the impact.
Ongoing monitoring should occur
throughout the duration of a third-party
relationship, commensurate with the level of
risk and complexity of the relationship and
the activity performed by the third-party.
Examples of possible monitoring activities
include:
• Reviewing reports on performance and
effectiveness of controls, including
independent audit reports and SOC reports.
• Periodic on-site visits or meetings to
discuss open issues and plans for changes to
the relationship.
• Reviewing updated due diligence
information.
• Documenting service-level agreements
with the third-party service provider to
establish performance targets.
• Establishing measures for the third-party
service provider to identify, record, and
remediate instances of failure to meet
contractual obligations or unsatisfactory
performance and to report such instances to
the futures commission merchant on a timely
basis.
• Direct testing of the third-party service
provider’s control environment.
The frequency and depth of the futures
commission merchant’s monitoring activities
should reflect the nature of the third-party
relationship, including heightened
monitoring for critical third-party service
providers, and may change over the duration
of the relationship. The futures commission
merchant should dedicate sufficient staffing
E:\FR\FM\24JAP2.SGM
24JAP2
4756
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
ddrumheller on DSK120RN23PROD with PROPOSALS2
resources to its monitoring activities and be
particularly alert to any circumstances that
could signal that a third-party service
provider may not be able to perform to an
acceptable standard. A futures commission
merchant should be cognizant that certain
events may trigger the need for it to take
further action, including terminating its
relationship with the third-party service
provider. Such events could include
cyberattacks, natural disasters, financial
distress or insolvency, adverse or qualified
audit opinions, or litigation or enforcement
actions.
In addition to the continuous monitoring
described above, futures commission
merchants should periodically review and
reevaluate their relationships with thirdparty service providers holistically. Such
reviews should be more thorough than
routine monitoring and may involve
additional personnel, such as in-house or
outside auditors, compliance and risk
functions, information technology staff, or by
a central function or committee whose
visibility into other third-party relationships
could provide valuable context for the
relationship at issue. Additionally, to the
extent a futures commission merchant uses
enterprise risk management techniques, it
should seek to integrate the information
gathered from its ongoing monitoring with
those practices. For example, to the extent
that a futures commission merchant
maintains a standardized approach across
risk types to escalate concerns or issues to
senior management or governance bodies
(e.g., through the use of predefined criteria or
escalation paths), the futures commission
merchant should consider using the same
protocols for escalating concerns identified
through its ongoing monitoring of third-party
service providers. The ongoing monitoring
approach itself may be subject to enterprise
risk management practices, such as periodic
self-assessment for effectiveness,
independent testing, and quality assurance.
To the extent that monitoring activities
reveal a change in their assessment of the
risks associated with the third-party
relationship, futures commission merchants
should adjust the frequency and types of
monitoring they conduct, including reports,
regular testing, and on-site visits. One
example of information that may change the
level of monitoring is a notification that a
third-party service provider has suffered or
may suffer from a severe adverse event that
could trigger a material change in the systems
or process used to carry out an outsourced
function.
E. Terminating the Third-Party
Relationship—Commission Regulation
1.13(e)(1)(v)
Futures commission merchants should
ensure that their third-party service provider
relationship programs include advance
preparation for the termination of the thirdparty relationship to ensure an orderly
transition. Futures commission merchants
should prepare for both planned terminations
(i.e., where one or both parties elects to end
the relationship pursuant to their contract)
and unplanned terminations (e.g., following
a sudden withdrawal of the third-party
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
service). The plans should include both the
contractual provisions for terminating the
service (termination provisions), and the
futures commission merchant’s plan to
facilitate an orderly transition of the function
to an alternative provider or to bring it inhouse (exit strategy). The goal of termination
planning is to support an efficient transition
to alternative arrangements for the provision
of the service, regardless of the circumstances
of the termination.
Termination provisions include all terms
needed by the futures commission merchant
to wind down a third-party service
relationship while ensuring that the futures
commission merchant can continue to serve
its customers without interruption and to
meet its regulatory compliance obligations.
Because information, data, staff training, and
knowledge may reside in the third-party
service provider, there is an increased risk of
disruption during the termination phase.
When negotiating termination provisions, a
futures commission merchant should ensure
that the terms negotiated support its exit
strategy. For example, a futures commission
merchant should ensure that termination
rights are accompanied by notice periods that
leave the futures commission merchant
enough time to find an alternative provider
(or to provide the service itself) to ensure an
orderly transition.
Similarly, the futures commission
merchant should ensure that all customer
data or other covered information in the
third-party service provider’s possession is
promptly returned to the futures commission
merchant or destroyed, as appropriate. The
futures commission merchant should also
verify that the third-party’s access to its
systems and covered information ceases at
termination. Futures commission merchants
should also consider negotiating more
stringent terms for third-party service
providers that breach their obligations under
the agreement, other than for ‘‘no-fault’’
terminations. Such breaches may signal an
inability of the third-party service provider to
provide the services contracted for and
thereby threaten the ability of the futures
commission merchant to serve its customers
and meet its regulatory obligations. (See
section C of this guidance for examples of
termination provisions.)
Futures commission merchants’ exit
strategies should include the steps needed to
end the service provision with the third-party
service provider and retain a new service
provider or begin providing the service inhouse. Although elements of an exit strategy
may be reflected in termination provisions,
not all elements of the exit strategy may be
suitable for the contract. Examples include
approvals, identification of alternative
providers, description of the roles of staff in
the futures commission merchant, and other
internal matters. These elements may be
memorialized in a procedure or similar
document, such as the third-party
relationship program. The exit strategy
should contain the internal steps to be taken
to ensure notification to the third-party
service provider, identification of the
proposed new provider, or, if bringing the
function in-house, the hiring and training of
personnel, development of procedures, and
PO 00000
Frm 00052
Fmt 4701
Sfmt 4702
launch of new technology, along with the
time periods and responsible personnel for
each.
Futures commission merchants should be
aware that, in practice, implementing an exit
strategy may be complex and timeconsuming and that the exercise of
termination arrangements may be difficult.
Futures commission merchants should also
be aware that some third parties possess
expertise that is not readily available and
plan accordingly. Futures commission
merchants should ensure that their plans are
flexible enough to account for a range of
plausible termination scenarios, including
situations where the third-party service
provider rapidly becomes unviable. Futures
commission merchants may need to design
backup or interim procedures sufficient to
meet regulatory requirements in such
situations.
PART 23—SWAP DEALERS AND
MAJOR SWAP PARTICIPANTS
4. The authority citation for part 23
continues to read as follows:
■
Authority: 7 U.S.C. 1a, 2, 6, 6a, 6b, 6b–1,
6c, 6p, 6r, 6s, 6t, 9, 9a, 12, 12a, 13b, 13c, 16a,
18, 19, 21.
Section 23.160 also issued under 7 U.S.C.
2(i); Sec. 721(b), Pub. L. 111–203, 124 Stat.
1641 (2010).
■
5. Revise § 23.603 to read as follows:
§ 23.603 Operational Resilience
Framework for Swap Dealers and Major
Swap Participants.
(a) Definitions. For purposes of this
section:
Affiliate means, with respect to any person,
a person controlling, controlled by, or under
common control with, such person.
Business continuity and disaster recovery
plan means a written plan outlining the
procedures to be followed in the event of an
emergency or other significant disruption to
the continuity of normal business operations
and that meets the requirements of paragraph
(f) of this section.
Consolidated program or plan means any
information and technology security
program, third-party relationship program, or
business continuity and disaster recovery
plan in which the swap entity participates
with one or more affiliates and that is
managed and approved at the enterprise
level.
Covered information means any sensitive
or confidential data or information
maintained by a swap entity in connection
with its business activities as a swap entity.
Covered technology means any application,
device, information technology asset,
network service, system, and other
information-handling component, including
the operating environment, that is used by a
swap entity to conduct its business activities,
or to meet its regulatory obligations, as a
swap entity.
Critical third-party service provider means
a third-party service provider, the disruption
of whose performance would be reasonably
likely to:
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
(1) Significantly disrupt a swap entity’s
business operations as a swap entity; or
(2) Significantly and adversely impact the
swap entity’s counterparties.
Information and technology security means
the preservation of:
(1) The confidentiality, integrity, and
availability of covered information; and
(2) The reliability, security, capacity, and
resilience of covered technology.
Incident means any event, occurrence, or
circumstance that could jeopardize
information and technology security,
including if it occurs at a third-party service
provider.
Information and technology security
program means a written program reasonably
designed to identify, monitor, manage, and
assess risks relating to information and
technology security and that meets the
requirements of paragraph (d) of this section.
Key controls mean controls that an
appropriate risk analysis determines are
either critically important for effective
information and technology security or
intended to address risks that evolve or
change more frequently and therefore require
more frequent review to ensure their
continuing effectiveness in addressing such
risks.
Oversight body means any board, body, or
committee of a board or body of the swap
entity specifically granted the authority and
responsibility for making strategic decisions,
setting objectives and overall direction,
implementing policies and procedures, or
overseeing the implementation of operations
for the swap entity.
Risk appetite means the aggregate amount
of risk a swap entity is willing to assume to
achieve its strategic objectives.
Risk tolerance limit means the amount of
risk, beyond its risk appetite, that a swap
entity is prepared to tolerate through
mitigating actions.
Senior officer means the chief executive
officer or other equivalent officer of the swap
entity.
Swap entity means a person that is
registered with the Commission as a swap
dealer or major swap participant pursuant to
the Act.
Third-party relationship program means a
written program reasonably designed to
identify, monitor, manage, and assess risks
relating to third-party relationships and that
meets the requirements of paragraph (e) of
this section.
(b) Generally. (1) Purpose and scope. Each
swap entity shall establish, document,
implement, and maintain an Operational
Resilience Framework reasonably designed to
identify, monitor, manage, and assess risks
relating to:
(i) information and technology security;
(ii) third-party relationships; and
(iii) emergencies or other significant
disruptions to the continuity of normal
business operations as a swap entity.
(2) Components. The Operational
Resilience Framework shall include an
information and technology security
program, a third-party relationship program,
and a business continuity and disaster
recovery plan. Each component program or
plan shall be supported by written policies
and procedures.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
(3) Standard. The Operational Resilience
Framework shall be appropriate and
proportionate to the nature, size, scope,
complexity, and risk profile of its business
activities as a swap entity, following
generally accepted standards and best
practices.
(c) Governance. (1) Approval of
components. Each component program or
plan required by paragraph (b)(2) of this
section shall be approved in writing, on at
least an annual basis, by either the senior
officer, an oversight body, or a senior-level
official of the swap entity.
(2) Risk appetite and risk tolerance limits.
(i) Each swap entity shall establish and
implement appropriate risk appetite and risk
tolerance limits with respect to the risk areas
identified in paragraph (b)(1) of this section.
(ii) The risk appetite and risk tolerance
limits established pursuant to paragraph
(c)(2)(i) of this section shall be reviewed and
approved in writing on at least an annual
basis by either the senior officer, an oversight
body, or a senior-level official of the swap
entity.
(3) Internal escalations. The senior officer,
an oversight body, or a senior-level official of
the swap entity shall be notified of:
(i) circumstances that exceed risk tolerance
limits established and approved pursuant to
paragraph (c)(2)(i) of this section; and
(ii) incidents that require notification
pursuant to paragraphs (i) or (j) of this
section.
(4) Swap entities forming part of a larger
enterprise. (i) Generally. A swap entity may
satisfy the requirements of paragraph (b)(2) of
this section through its participation in a
consolidated program or plan, provided that
each consolidated program or plan meets the
requirements of this section.
(ii) Attestation. A swap entity that relies on
a consolidated program or plan pursuant to
paragraph (c)(4)(i) of this section may satisfy
the requirements in paragraphs (c)(1) and
(c)(2)(ii) of this section provided that either
the senior officer, an oversight body, or a
senior-level official of the swap entity attests
in writing, on at least an annual basis, that
the consolidated program or plan meets the
requirements of this section and reflects a
risk appetite and risk tolerance limits
appropriate to the swap entity.
(d) Information and technology security
program. (1) Risk assessment.
(i) The information and technology
security program shall require the swap
entity to conduct and document the results
of a comprehensive risk assessment
reasonably designed to identify, assess, and
prioritize risks to information and technology
security.
(ii) Such risk assessment shall be
conducted at a frequency consistent with the
standard set forth in paragraph (b)(3) of this
section, but at least annually, and be
conducted by personnel not responsible for
the development or implementation of
covered technology or related controls.
(iii) The results of the risk assessment shall
be provided to the oversight body, senior
officer, or other senior-level official who
approves the information and technology
security program upon the risk assessment’s
completion.
PO 00000
Frm 00053
Fmt 4701
Sfmt 4702
4757
(2) Effective controls. The information and
technology security program shall require the
swap entity to establish, document,
implement, and maintain controls reasonably
designed to prevent, detect, and mitigate
identified risks to information and
technology security. Each swap entity shall
consider, at a minimum, the following types
of controls and adopt those consistent with
the standard set forth in paragraph (b)(3) of
this section:
(i) Access controls on covered technology,
including controls to authenticate and permit
access only by authorized individuals and
controls preventing misappropriation or
misuse of covered information by employees;
(ii) Access restrictions designed to permit
only authorized individuals to access
physical locations containing covered
information, including, but not limited to,
buildings, computer facilities, and records
storage facilities;
(iii) Encryption of electronic covered
information, including while in transit or in
storage on networks or systems, to which
unauthorized individuals may have access;
(iv) Dual control procedures, segregation of
duties, and background checks for employees
or third-party service providers with
responsibilities for or access to covered
information;
(v) Change management practices,
including defined roles and responsibilities,
logging, and monitoring practices;
(vi) Systems development and
configuration management practices,
including practices for initializing, changing,
testing, and monitoring configurations;
(vii) Flaw remediation, including
vulnerability patching practices;
(viii) Measures to protect against
destruction, loss, or damage of covered
information due to potential environmental
hazards, such as fire and water damage or
technological failures;
(ix) Monitoring systems and procedures to
detect actual and attempted attacks on or
intrusions into covered technology;
(x) Response programs that specify actions
to be taken when the swap entity suspects or
detects that unauthorized individuals have
gained access to covered technology,
including appropriate reports to regulatory
and law enforcement agencies; and
(xi) Measures to promptly recover and
secure any compromised covered
information.
(3) Incident response plan. The
information and technology security program
shall include a written incident response
plan that is reasonably designed to detect,
assess, contain, mitigate the impact of, and
recover from an incident. This incident
response plan shall include, at a minimum:
(i) The roles and responsibilities of the
swap entity’s management, staff, and thirdparty service providers in responding to
incidents;
(ii) Escalation protocols, including a
requirement to timely inform the oversight
body, senior officer, or other senior-level
official that has primary responsibility for
overseeing the information and technology
security program; the chief compliance
officer of the swap entity; and any other
relevant personnel of incidents that may
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
4758
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
significantly impact the swap entity’s
regulatory obligations or require notification
to the Commission;
(iii) The points of contact for external
coordination of incident responses as
determined necessary by the swap entity
based on the severity of incidents;
(iv) The required reporting of incidents,
whether by internal policy, contract, or law,
including as required in this section;
(v) Procedures for documenting incidents
and managements’ response; and
(vi) The remediation of weaknesses in
information and technology security,
controls, and training, if any.
(e) Third-party relationship program. (1)
Third-party relationship lifecycle stages. The
third-party relationship program shall
describe how the swap entity addresses the
risks attendant to each stage of the thirdparty relationship lifecycle, including:
(i) Pre-selection risk assessment;
(ii) Due diligence of prospective third-party
service providers;
(iii) Contractual negotiations;
(iv) Ongoing monitoring; and
(v) Termination, including preparations for
planned and unplanned terminations.
(2) Heightened duties for critical thirdparty service providers. The third-party
relationship program shall establish
heightened due diligence practices for
potential critical third-party service
providers and heightened monitoring for
critical third-party service providers.
(3) Third-party service provider inventory.
As part of its third-party relationship
program, each swap entity shall create,
maintain, and regularly update an inventory
of third-party service providers the swap
entity has engaged to support its activities as
a swap entity, identifying whether each
third-party service provider in the inventory
is a critical third-party service provider.
(3) Retention of responsibility.
Notwithstanding a swap entity’s
determination to rely on a third-party service
provider, each swap entity remains
responsible for meeting its obligations under
the Act and Commission regulations.
(4) Guidance on third-party relationship
programs. For guidance outlining potential
risks, considerations, and strategies for
developing a third-party relationship
program consistent with paragraph (e), see
Appendix A to Subpart J of this part.
(f) Business continuity and disaster
recovery plan. (1) Purpose. The business
continuity and disaster recovery plan shall be
reasonably designed to enable the swap
entity to:
(i) Continue or resume normal business
operations with minimal disruption to
counterparties and the markets; and
(ii) Recover and make use of covered
information, as well as any other data,
information, or documentation required to be
maintained by law and regulation.
(2) Minimum contents. The business
continuity and disaster recovery plan shall,
at a minimum:
(i) Identify covered information, as well as
any other data or information required to be
maintained by law and regulation, and
establish and implement procedures to
backup or copy all such data and information
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
with sufficient frequency to meet the
requirements of this section and to store such
data and information off-site in either hardcopy or electronic format;
(ii) Identify any resources, including
covered technology, facilities, infrastructure,
personnel, and competencies, essential to the
operations of the swap entity or to fulfill the
regulatory obligations of the swap entity, and
establish and maintain procedures and
arrangements to provide for their backup in
a manner that is sufficient to meet the
requirements of this section. Such
arrangements must provide for backups that
are located in one or more areas that are
geographically separate from the swap
entity’s primary systems, facilities,
infrastructure, and personnel, and may
include the use of resources provided by
third-party service providers;
(iii) Identify potential disruptions to
critical third-party service providers and
establish a plan to minimize the impact of
such disruptions;
(iv) Identify supervisory personnel
responsible for implementing each aspect of
the business continuity and disaster recovery
plan, including the emergency contacts
required to be provided pursuant to
paragraph (k) of this section; and
(v) Establish a plan for communicating
with the following persons in the event of an
emergency or other significant disruption, to
the extent applicable: employees;
counterparties; swap data repositories;
execution facilities; trading facilities; clearing
facilities; regulatory authorities; data,
communications and infrastructure providers
and other vendors; disaster recovery
specialists; and other persons essential to the
recovery of documentation and data, the
resumption of operations, and compliance
with the Act and Commission regulations.
(3) Accessibility. Each swap entity shall
maintain copies of its business continuity
and disaster recovery plan at one or more
accessible off-site locations.
(g) Training and distribution. (1) Training.
Each swap entity shall establish, implement,
and maintain training with respect to all
aspects of the Operational Resilience
Framework, including, but not limited to:
(i) Cybersecurity awareness training for all
personnel; and
(ii) Role-specific training for personnel
involved in establishing, documenting,
implementing, and maintaining the
Operational Resilience Framework.
(2) Frequency. Each swap entity shall
provide and update the training required in
paragraph (g)(1) as necessary, but no less
frequently than annually.
(3) Distribution. Each swap entity shall
distribute copies of each component program
or plan required by paragraph (b)(2) of this
section to relevant personnel and promptly
provide any significant revisions thereto.
(h) Reviews and Testing. Each swap entity
shall establish, implement, and maintain a
plan reasonably designed to assess its
adherence to, and the effectiveness of, its
Operational Resilience Framework through
regular reviews and risk-based testing.
(1) Reviews. Reviews of the Operational
Resilience Framework shall be conducted at
least annually and in connection with any
PO 00000
Frm 00054
Fmt 4701
Sfmt 4702
material change to the activities or operations
of the swap entity that is reasonably likely to
affect the risks identified in paragraph (b)(1)
of this section. Reviews shall include an
analysis of adherence to, and the
effectiveness of, the Operational Resilience
Framework and any recommendations for
modifications or improvements that address
root causes of any issues identified by the
review.
(2) Testing. The frequency, nature, and
scope of risk-based testing of the Operational
Resilience Framework shall be determined by
the swap entity, consistent with the standard
in paragraph (b)(3) of this section.
(i) Testing of the information and
technology security program shall include, at
a minimum:
(A) Testing of key controls and the incident
response plan at least annually;
(B) Vulnerability assessments, including
daily or continuous automated vulnerability
scans; and
(C) Penetration testing at least annually.
(ii) Testing of the business continuity and
disaster recovery plan shall include, at a
minimum, a walk-through or tabletop
exercise designed to test the effectiveness of
backup facilities and capabilities at least
annually.
(3) Independence. The reviews and testing
shall be conducted by qualified personnel
who are independent of the aspect of the
Operational Resilience Framework being
reviewed or tested.
(4) Documentation. Each swap entity shall
document all reviews and testing of the
Operational Resilience Framework. The
documentation shall, at a minimum, include:
(i) The date the review or testing was
conducted;
(ii) The nature and scope of the review or
testing, including methodologies employed;
(iii) The results of the review or testing,
including any assessment of effectiveness;
(iv) Any identified deficiencies and
recommendations for remediation; and
(v) Any corrective action(s) taken or
initiated, including the date(s) such action(s)
were taken.
(5) Internal reporting. Each swap entity
shall report on the results of its reviews and
testing to the swap entity’s chief compliance
officer and any other relevant senior-level
official(s) and oversight body(ies).
(i) Notifications to the Commission. (1)
Incidents.
(i) Notification trigger. Each swap entity
shall notify the Commission of any incident
that adversely impacts, or is reasonably likely
to adversely impact:
(A) Information and technology security;
(B) The ability of the swap entity to
continue its business activities as a swap
entity; or
(C) The assets or positions of a
counterparty of the swap entity.
(ii) Contents. The notification shall provide
any information available to the swap entity
at the time of notification that may assist the
Commission in assessing and responding to
the incident, including the date the incident
was detected, possible cause(s) of the
incident, its apparent or likely impacts, and
any actions the swap entity has taken or is
taking to mitigate or recover from the
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
incident, including measures to protect
counterparties.
(iii) Timing and method. Each swap entity
shall provide the incident notification as
soon as possible but in any event no later
than 24 hours after such incident has been
detected. The notification shall be provided
via email to ORFnotices@cftc.gov.
(2) Business continuity and disaster
recovery plan activation. (i) Notification
trigger. Each swap entity shall notify the
Commission of any determination to activate
the business continuity and disaster recovery
plan.
(ii) Contents. The notification shall provide
any information available to the swap entity
at the time of notification that may assist the
Commission in assessing or responding to the
emergency or disruption, including the date
of the emergency or disruption, a description
thereof, the possible cause(s), its apparent or
likely impacts, and any actions the swap
entity has taken or is taking to mitigate or
recover from the emergency or disruption,
including measures taken or being taken to
protect counterparties.
(iii) Timing and method. Each swap entity
shall provide the business continuity and
disaster recovery plan activation notification
within 24 hours of determining to activate
the business continuity and disaster recovery
plan. The notification shall be provided via
email to ORFnotices@cftc.gov.
(j) Notification of incidents to affected
counterparties. (1) Notification trigger. Each
swap entity shall notify a counterparty as
soon as possible of any incident that is
reasonably likely to have adversely affected
the confidentiality or integrity of the
counterparty’s covered information, assets, or
positions.
(2) Contents. The notification to affected
counterparties shall include information
necessary for the affected counterparty to
understand and assess the potential impact of
the incident on its information, assets, or
positions, and to take any necessary action.
Such notification shall include, at a
minimum:
(i) A description of the incident;
(ii) The particular way in which the
counterparty, or its covered information, may
have been adversely impacted;
(iii) Measures being taken by the swap
entity to protect against further harm; and
(iv) Contact information for the swap entity
where the counterparty may learn more about
the incident or ask questions.
(k) Emergency Contacts. (1) Each swap
entity shall provide the Commission the
name and contact information of:
(i) Two employees whom the Commission
may contact in connection with incidents
triggering notification to the Commission
under paragraph (i)(1) of this section; and
(ii) Two employees whom the Commission
may contact in connection with the
activation of the swap entity’s business
continuity and disaster recovery plan
triggering notification to the Commission
under paragraph (i)(2) of this section.
(2) The identified employees shall be
authorized to make key decisions on behalf
of the swap entity and have knowledge of the
swap entity’s incident response plan or
business continuity and disaster recovery
plan, as appropriate.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
(3) The swap entity shall update its
emergency contacts with the Commission as
necessary.
(l) Recordkeeping. Each swap entity shall
maintain all records required to be
maintained pursuant to this section in
accordance with section 1.31 of this chapter
and shall make them available promptly
upon request to representatives of the
Commission and to representatives of
applicable prudential regulators, as defined
in section 1a(39) of the Act.
6. Add appendix A to subpart J of part
23 to read as follows:
■
Appendix A to Subpart J of Part 23—
Guidance on Third-Party Relationship
Programs
The following guidance offers factors,
actions, and strategies for swap entities to
consider in preparing and implementing
third-party relationship programs reasonably
designed to identify, monitor, manage, and
assess risks relating to third-party
relationships, as required by Commission
regulation 23.603. The guidance is also not
intended to reduce or replace the obligation
of swap entities to comply with the
requirements in Commission regulation
23.603, including the requirement to ensure
that each swap entity’s Operational
Resilience Framework is appropriate and
proportionate to the nature, size, scope,
complexity, and risk profile of its business
activities as a swap entity, following
generally accepted standards and best
practices. The guidance is not exhaustive and
is nonbinding.
The guidance is written to be broadly
relevant to all swap entities, but it may not
be universally applicable. The degree to
which the guidance would be applicable to
a particular swap entity would depend on its
unique facts and circumstances and may vary
from relationship to relationship. Each swap
entity should assess the relevance of the
guidance as it applies to its particular risk
profile and tailor its third-party relationship
program accordingly.
Comparable guidance for futures
commission merchants is included in
Appendix A to part 1 of the Commission’s
regulations.
A. Pre-Selection Risk Assessment—
Commission Regulation 23.603(e)(1)(i)
Before entering into a third-party
relationship, swap entities should determine
which services should be performed by a
third-party and plan for how to manage
associated risks. The Commission appreciates
that reliance on third-party service providers
may be unavoidable, particularly given the
rapid pace of technological innovation,
which may render it uneconomical or even
infeasible for financial institutions to meet all
of their technological needs in-house.
Nevertheless, given the risks associated
with relying on third-party service providers,
and that each additional third-party
relationship a swap entity employs is likely
to add further risk and complexity, a swap
entity’s third-party relationship program
should include a deliberative process for
affirmatively determining whether to source
a particular service from a third-party service
PO 00000
Frm 00055
Fmt 4701
Sfmt 4702
4759
provider. In determining whether a particular
function should be performed by a thirdparty service provider, swap entities should
consider whether:
• The service would support the swap
entity’s strategic goals and objectives.
• The same goals and objectives could be
addressed through an alternative means that
may not require reliance on a third-party
service provider.
• The swap entity has or could otherwise
secure the resources, financial and otherwise,
to effectively monitor the third-party service
provider.
• Relevant and reputable third-party
service providers are available.
• The provision of the service would
implicate information and technology
security concerns, including by requiring the
third-party service provider to obtain access
to covered information or provide covered
technology.
• A disruption of the service would have
a negative impact on counterparties or
regulatory compliance.
• The relationship could be structured to
reduce associated risks, such as by limiting
the third-party service provider’s access to
covered information or covered technology.
• Lack of direct control over performance
of the service would present unacceptable
risk, i.e., risk outside the swap entity’s risk
tolerance limits.
As the above considerations illustrate,
swap entities should consider ways in which
they might structure their third-party
relationships to reduce the associated risks.
For example, where giving a third-party
service provider direct access to its
technology or data may be outside a swap
entity’s risk tolerance, structuring the
relationship to provide the third-party
service provider access on a read-only basis
or via reports delivered by the swap entity
could render the relationship more
acceptable. Swap entities should therefore
consider the availability of safer means of
performing the service as part of their
assessment.
Changes in technology, businesses
practices, regulation, market structure,
market participants (e.g., new entrants to the
market), or service delivery may change the
risk profile of the third-party relationship
over time. Accordingly, swap entities should
consider periodically reassessing their
selection of services to be performed by
third-party service providers. Swap entities
should stay abreast of these changes by
monitoring the external environment and
communicating with current and prospective
service providers and other participants in
industry.
B. Due Diligence in Selecting Third-Party
Service Providers—Commission Regulation
23.603(e)(1)(ii)
After a swap entity has determined that a
service is suitable for a third-party to
perform, it should conduct due diligence on
prospective third-party service providers.
Due diligence provides swap entities with
the information they need to assess and
conclude, with a reasonable level of
assurance, that the prospective third-party
service provider is capable of effectively
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
4760
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
providing the service as expected, adhering
to the swap entity’s policies, maintaining the
swap entity’s compliance with Commission
regulations, and protecting covered
information. Appropriate due diligence
should also enable swap entities to evaluate
whether they would be able to effectively
monitor and manage the risks associated with
a particular third-party relationship.
Due diligence may be conducted before or
contemporaneously with contractual
negotiations with prospective third-party
service providers but should be concluded
prior to executing any agreements. Swap
entities should conduct due diligence even in
situations where, for a particular service,
there may only be one or a small number of
providers with a dominant market share
whose services are used by all or most of the
swap entities’ industry peers, and swap
entities should not rely solely on those
providers’ reputations or prior experience
with them. The depth and rigor of the due
diligence should be proportionate to the
nature of the third-party relationship, with
the required heightened due diligence
required for potential critical third-party
service providers pursuant to Commission
regulation 23.603(e)(2). Specifically, when
conducting due diligence for a potential
critical third-party servicer provider, swap
entities should expand the type and sources
of information they rely on, the rigor and
scrutiny they apply in reviewing the
information to identify potential risks, and
the level of confidence in their assessment of
the third-party service provider’s ability to
perform.
When establishing their due diligence
protocols, swap entities should consider the
full range of risks that reliance on the thirdparty service providers could introduce in
light of the nature of the service they would
be performing. Relevant considerations with
respect to the potential third-party service
provider include its:
• Financial condition, business experience
and reputation, and business prospects,
particularly the third-party service provider’s
experience providing services to financial
institutions.
• Background, experience, and
qualifications with respect to key personnel.
• Information and technology security
practices, including incident reporting and
incident management programs, and whether
there are clearly documented processes for
identifying and escalating incidents.
• Risk management practices, including
governance, controls, testing, and issue
management practices, as well as the results
of any independent risk assessments.
• Regulatory environment, including the
legal jurisdiction in which it is based and
applicable regulatory or licensing
requirements.
• History of disruptions to operations,
including whether the third-party service
provider has suffered incidents that would
meet the standard for reporting to the
Commission in Commission regulation
23.603(i).
• Violations of legal, compliance, or
contractual obligations, including civil or
criminal proceedings or administrative
enforcement actions, including from selfregulatory organizations.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
• Understanding of Commission regulatory
requirements applicable to the swap entity.
• Use of and reliance on subcontractors,
including the volume and types of
subcontracted activities, and the third-party
service provider’s process for identifying,
assessing, managing, and monitoring
associated risks.
• Business continuity and contingency
plans.
• Financial protections, such as insurance
coverage against losses or liabilities from
intentional or negligent acts or hazards
involving physical destruction and data or
documentation losses.
Swap entities should memorialize their
assessment of these factors and identify how
the review was heightened for critical thirdparty service providers. Swap entities should
not rely solely on their prior knowledge of or
experience with a potential third-party.
Potential sources of due diligence
information include:
• Audit reports, including pooled audit
plans, and System and Organizational
Controls (SOC) reports.
• Financial statements and projections and
relevant accompanying information (e.g.,
annual or quarterly reports, management
commentary, auditors’ opinions, and investor
relations materials).
• Incident response plans, including the
results of recent testing or assessments
thereof.
• Business continuity and disaster
recovery plans, as well as the result of recent
testing or assessments thereof.
• Public filings.
• News reports, trade publications, and
press releases.
• Reports from market intelligence
providers.
• References from current or previous
customers, or other parties which have had
business relationships with the third-party
service provider.
• Informal industry discussions.
• Information provided directly by the
third-party service provider, such as internal
performance metrics.
Obtaining and reviewing audit reports,
including SOC reports, may be of particular
value for conducting heightened due
diligence of critical third-party service
providers. In certain circumstances, swap
entities may not be able to gather all the
information necessary to reach an informed
conclusion that a prospective third-party
service provider is an adequate provider.
Examples include instances where the thirdparty service provider is a new entrant into
the market and little information exists;
where information provided by the thirdparty service provider is insufficient or
appears unreliable; or where the third-party
service provider is reluctant to provide
internal information. In such cases, the swap
entity should identify and document the
limitations of its due diligence, the attendant
risks, and any available methods for
mitigating them (e.g., obtaining alternate
information, implementing enhanced
monitoring or controls, negotiating protective
contractual provisions). Ultimately, such
factors could weigh against the use of the
potential third-party service provider,
PO 00000
Frm 00056
Fmt 4701
Sfmt 4702
particularly a potential critical third-party
service provider. Swap entities that proceed
with the third-party service arrangements
notwithstanding the limited due diligence
should do so with caution, applying
heightened scrutiny of the information they
do receive, and consider the implementation
of their own mitigating controls to
compensate for the uncertainty.
C. Contractual Negotiations—Commission
Regulation 23.603(e)(1)(iii)
After selecting a third-party service
provider, swap entities should proceed to
finalizing the agreement, typically through
entering into an enforceable written contract.
Written contracts are an important tool for
clarifying the scope of services to be
delivered, establishing standards or
performance benchmarks, allocating risks
and responsibilities, and facilitating
resolution of disputes. They can also reduce
the risks of non-performance and assist in
monitoring the third-party service provider.
Because of their importance, the Commission
recommends that swap entities enter written
agreements with third-party service providers
before services are delivered, particularly
with critical third-party service providers.
In negotiating a written contract, swap
entities should seek to negotiate contractual
provisions that would support their ability to
mitigate, manage, and monitor the risks
associated with the relationship, as identified
through their initial pre-selection and due
diligence activities. The contractual
provisions should be informed by the nature
of the service provided and be proportionate
to the criticality of the services provided. In
particular, swap entities should consider
negotiating for the contract to include the
following provisions:
• Timely notification to the swap entity of
any incidents suffered by third-party service
providers, or of significant disruptions to the
operations of the third-party service provider.
• Timely notification to the swap entity of
any material changes to the services
provided.
• Required periodic, independent audits of
the third-party service provider, the results of
which would be shared with the swap entity.
• Restrictions on the third-party service
provider’s use of the swap entity’s covered
information, except as necessary to deliver
the service or meet legal obligations.
• Security measures to protect the swap
entity’s covered information and covered
technology to which the third-party service
provider has access.
• Insurance, guarantees, indemnification,
and limitations on liability.
• Dispute resolution procedures.
• Performance measures or benchmarks.
• Remediation of identified performance
issues.
• Compliance with regulatory
requirements, including reasonable
assurances that the third-party service
provider is willing and able to coordinate
with the swap entity for the purpose of
ensuring the swap entity complies with its
legal and regulatory obligations.
• Use of subcontractors, including
notification or approval procedures for their
use, the extension of contractual rights of the
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
swap entity against the third-party service
provider to its subcontractors, and
contractual obligations for reporting on or
oversight of subcontractors.
• Termination provisions, including rights
to terminate following breaches of the thirdparty service provider’s obligations, notice
requirements, obligations of the third-party
service provider to provide support for a
successful transition, and the return or
destruction of records or covered
information, as further described in section E
of this guidance.
• Information sharing necessary to
facilitate other provisions of this proposed
guidance (for example, reporting
requirements to support ongoing monitoring,
as discussed in section D of this guidance, or
notice requirements for termination, as
discussed in section E of this guidance).
These provisions focus on key risk factors
generally associated with third-party service
provider relationships. They are not
exhaustive of all contractual provisions swap
entities should seek to include in their
written contracts, including ordinary
commercial contract terms (e.g., choice of
law provisions) and terms that may relate
only to specific services, among other
provisions. While third-parties may initially
offer a standard contract, a swap entity may
seek to request modifications, additional
contractual provisions, or addendums to
satisfy its needs. Swap entities should work
to tailor the level of detail and
comprehensiveness of the contractual
provisions based on the risk and complexity
posed by the particular third-party
relationship, contracts with critical thirdparty service providers likely being the most
tailored.
In some circumstances, a swap entity may
be at a bargaining power disadvantage, which
prevents it from negotiating optimal
contractual provisions. For example, a
prospective third-party service provider may
be the sole provider of a service or may have
such dominant market share that it can offer
its services on a ‘‘take-it-or-leave-it’’ basis. In
such situations, the swap entity should work
to understand any resulting limitations in the
contract and attendant risks and consider
whether it can achieve outcomes comparable
to those provided by contractual protections
through non-contractual means. Examples
could include the swap entity implementing
additional controls, augmenting its
monitoring of the third-party service provider
using public sources or market intelligence
services, or purchasing insurance. The swap
entity should make an assessment, however,
of whether these alternatives would provide
an adequate substitute for the unobtained
contractual protections and document its
assessment and mitigation plan, considering
its risk appetite and risk tolerance limits.
Where a third-party service provider is
unable or unwilling to agree to provisions
necessary for the swap entity to meet its
obligations under Commission regulations,
particularly a critical third-party service
provider, the swap entity should consider
finding an alternative third-party service
provider.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
D. Ongoing Monitoring—Commission
Regulation 23.603(e)(1)(iv)
After a third-party service provider has
initiated performance, swap entities should
engage in ongoing monitoring. Ongoing
monitoring is important to ensure the thirdparty service provider is properly carrying
out its outsourced function and contractual
obligations, as well as meeting quality or
performance expectations. Effective
monitoring can aid swap entities in the early
identification of performance deficits,
allowing for a quicker response that may then
mitigate the impact.
Ongoing monitoring should occur
throughout the duration of a third-party
relationship, commensurate with the level of
risk and complexity of the relationship and
the activity performed by the third-party.
Examples of possible monitoring activities
include:
• Reviewing reports on performance and
effectiveness of controls, including
independent audit reports and SOC reports.
• Periodic on-site visits or meetings to
discuss open issues and plans for changes to
the relationship.
• Reviewing updated due diligence
information.
• Documenting service-level agreements
with the third-party service provider to
establish performance targets.
• Establishing measures for the third-party
service provider to identify, record, and
remediate instances of failure to meet
contractual obligations or unsatisfactory
performance and to report such instances to
the swap entity on a timely basis.
• Direct testing of the third-party service
provider’s control environment.
The frequency and depth of the swap
entity’s monitoring activities should reflect
the nature of the third-party relationship,
including heightened monitoring for critical
third-party service providers, and may
change over the duration of the relationship.
The swap entity should dedicate sufficient
staffing resources to its monitoring activities
and be particularly alert to any circumstances
that could signal that a third-party service
provider may not be able to perform to an
acceptable standard. A swap entity should be
cognizant that certain events may trigger the
need for it to take further action, including
terminating its relationship with the thirdparty service provider. Such events could
include cyberattacks, natural disasters,
financial distress or insolvency, adverse or
qualified audit opinions, or litigation or
enforcement actions.
In addition to the continuous monitoring
described above, swap entities should
periodically review and reevaluate their
relationships with third-party service
providers holistically. Such reviews should
be more thorough than routine monitoring
and may involve additional personnel, such
as in-house or outside auditors, compliance
and risk functions, information technology
staff, or by a central function or committee
whose visibility into other third-party
relationships could provide valuable context
for the relationship at issue. Additionally, to
the extent a swap entity uses enterprise risk
management techniques, it should seek to
integrate the information gathered from its
PO 00000
Frm 00057
Fmt 4701
Sfmt 4702
4761
ongoing monitoring with those practices. For
example, to the extent that a swap entity
maintains a standardized approach across
risk types to escalate concerns or issues to
senior management or governance bodies
(e.g., through the use of predefined criteria or
escalation paths), the swap entity should
consider using the same protocols for
escalating concerns identified through its
ongoing monitoring of third-party service
providers. The ongoing monitoring approach
itself may be subject to enterprise risk
management practices, such as periodic selfassessment for effectiveness, independent
testing, and quality assurance.
To the extent that monitoring activities
reveal a change in their assessment of the
risks associated with the third-party
relationship, swap entities should adjust the
frequency and types of monitoring they
conduct, including reports, regular testing,
and on-site visits. One example of
information that may change the level of
monitoring is a notification that a third-party
service provider has suffered or may suffer
from a severe adverse event that could trigger
a material change in the systems or process
used to carry out an outsourced function.
E. Terminating the Third-Party
Relationship—Commission Regulation
23.603(e)(1)(v)
Swap entities should ensure that their
third-party service provider relationship
programs include advance preparation for the
termination of the third-party relationship to
ensure an orderly transition. Swap entities
should prepare for both planned terminations
(i.e., where one or both parties elects to end
the relationship pursuant to their contract)
and unplanned terminations (e.g., following
a sudden withdrawal of the third-party
service). The programs should include both
the contractual provisions for terminating the
service (termination provisions), and the
swap entity’s plan to facilitate an orderly
transition of the function to an alternative
provider or to bring it in-house (exit strategy).
The goal of termination planning is to
support an efficient transition to alternative
arrangements for the provision of the service,
regardless of the circumstances of the
termination.
Termination provisions include all terms
needed by the swap entity to wind down a
third-party service relationship while
ensuring that the swap entity can continue to
serve its counterparties without interruption
and to meet its regulatory compliance
obligations. Because information, data, staff
training, and knowledge may reside in the
third-party service provider, there is an
increased risk of disruption during the
termination phase. When negotiating
termination provisions, a swap entity should
ensure that the terms negotiated support its
exit strategy. For example, a swap entity
should ensure that termination rights are
accompanied by notice periods that leave the
swap entity enough time to find an
alternative provider (or to provide the service
itself) to ensure an orderly transition.
Similarly, the swap entity should ensure
that all customer data or other covered
information in the third-party service
provider’s possession is promptly returned to
E:\FR\FM\24JAP2.SGM
24JAP2
4762
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
the swap entity or destroyed, as appropriate.
The swap entity should also verify that the
third-party’s access to its systems and
covered information ceases at termination.
Swap entities should also consider
negotiating more stringent terms for thirdparty service providers that breach their
obligations under the agreement, other than
for ‘‘no-fault’’ terminations. Such breaches
may signal an inability of the third-party
service provider to provide the services
contracted for and thereby threaten the
ability of the swap entity to serve its
customers and meet its regulatory
obligations. (See section C of this guidance
for examples of termination provisions.)
Swap entities’ exit strategies should
include the steps needed to end the service
provision with the third-party service
provider and retain a new service provider or
begin providing the service in-house.
Although elements of an exit strategy may be
reflected in termination provisions, not all
elements of the exit strategy may be suitable
for the contract. Examples include approvals,
identification of alternative providers,
description of the roles of staff in the swap
entity, and other internal matters. These
elements may be memorialized in a
procedure or similar document, such as the
third-party relationship program. The exit
strategy should contain the internal steps to
be taken to ensure notification to the thirdparty service provider, identification of the
proposed new provider, or, if bringing the
function in-house, the hiring and training of
personnel, development of procedures, and
launch of new technology, along with the
time periods and responsible personnel for
each.
Swap entities should be aware that, in
practice, implementing an exit strategy may
be complex and time-consuming and that the
exercise of termination arrangements may be
difficult. Swap entities should also be aware
that some third parties possess expertise that
is not readily available and plan accordingly.
Swap entities should ensure that their plans
are flexible enough to account for a range of
plausible termination scenarios, including
situations where the third-party service
provider rapidly becomes unviable. Swap
entities may need to design backup or
interim procedures sufficient to meet
regulatory requirements in such situations.
Issued in Washington, DC, on December
22, 2023, by the Commission.
Robert Sidman,
Deputy Secretary of the Commission.
ddrumheller on DSK120RN23PROD with PROPOSALS2
NOTE: The following appendices will not
appear in the Code of Federal Regulations.
Appendices to Operational Resilience
Framework for Futures Commission
Merchants, Swap Dealers, and Major
Swap Participants—Voting Summary
and Chairman’s and Commissioners’
Statements
Appendix 1—Voting Summary
On this matter, Chairman Behnam,
Commissioners Johnson, Goldsmith Romero,
Mersinger and Pham voted in the affirmative.
No Commissioner voted in the negative.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
Appendix 2—Statement of Support of
Chairman Rostin Behnam
I support the Commission’s approval of the
notice of proposed rulemaking to require
futures commission merchants (FCMs), swap
dealers (SDs), and major swap participants
(MSPs) to establish an operational resilience
framework (ORF).
The proposal recognizes that while FCMs,
SDs, and MSPs (collectively, ‘‘covered
entities’’) have generally withstood
challenging market conditions since the
Commission promulgated its risk
management program requirements over a
decade ago, the Commission must bolster
that foundational framework to promote
operational resilience in the face of
increasingly sophisticated cyberattacks and
heightened technological disruptions. A
strong ORF is especially important as the
financial sector increasingly relies on thirdparty service providers; the disruption of
which can lead to major interruptions in—
and potential corruption of—FCM and SD
operations. In addition to market impacts,
events like these may impact covered
entities’ ability to comply with the
Commission’s statutory and regulatory
requirements.
FCMs’ customers and SDs’ counterparties
expect covered entities to take a 360-degree
approach to identify, monitor, manage, and
assess risks for potential vulnerabilities.
Similarly, the Commission must identify,
monitor, manage, and assess any potential
gaps in its own risk management
requirements that could impede sound risk
management practices, expose the U.S.
financial system to unmanaged risk, or
weaken customer protection. Operational
disruptions that place a covered entity’s
financial resources at risk; disrupt the
segregation and protection of customer funds;
hinder recordkeeping; introduce uncertainty
or delay; or otherwise inject operational risk
into the derivatives market must be avoided
to the extent possible to ensure customers,
counterparties, and market participants have
confidence in the integrity of our markets.
The operational resilience framework
proposal is the product of many months of
in-depth research regarding operational
resilience standards and guidance issued by
the prudential regulators, the U.S. Securities
and Exchange Commission, the National
Futures Association, the International
Organization of Securities Commissions, the
Financial Stability Board, and other subject
matter experts to avoid those operational
disruptions and failures. The proposal also
reflects staff’s own observations and lessons
learned from its own oversight activities.
The proposal is a holistic, principles-based
approach that is calibrated with certain
minimum requirements. Specifically, the
proposed rule would require covered entities
to establish, document, implement, and
maintain an ORF reasonably designed to
identify, monitor, manage, and assess risks
relating to three key risk areas: (1)
information and technology security, (2)
third-party relationships, and (3) emergencies
and other significant disruptions. The ORF
would also include requirements related to
governance, training, testing, and
recordkeeping.
PO 00000
Frm 00058
Fmt 4701
Sfmt 4702
The proposal would require covered
entities to establish risk appetite and risk
tolerance limits and would allow these
registrants to rely on an information and
technology security program, third-party
relationship program, or business continuity
and disaster recovery plan in which the
covered entity participates with one or more
affiliates and that is managed and approved
at the enterprise level. Testing would need to
be risk-based and include, at a minimum,
daily or continuous vulnerability assessment
and annual penetration testing, among
others. The proposed rule would also require
certain notifications to the Commission and
customers or counterparties. The
Commission is also proposing non-binding
guidance that FCMs and SDs could consider
to identify factors, actions, and strategies as
they design their third-party relationship
programs.
The Commission recognizes that covered
entities subject to this proposal include many
different business models. As a result, the
proposal is tailored to accommodate firms
that vary in size and complexity, including
corporate structures in which operational
resilience frameworks may be managed at an
enterprise level and have governance
arrangements with different reporting line
structures. In the same vein, the proposed
ORF standard would require covered entities
to implement an ORF that is appropriate and
proportionate to the nature, size, scope,
complexity, and risk profile of the firm’s
business as an FCM or SD, following
generally accepted standards and best
practices.
I look forward to reading the public’s
comments on how the proposed operational
resilience framework requirements and
guidance can strengthen the operational
resilience of FCMs, SDs, and MSPs as well
as help protect their respective customers
and counterparties in the derivatives
markets. The 75-day comment period will
begin upon the Commission’s publication of
the release on its website.
I thank staff in the Market Participants
Division, Office of the General Counsel, and
the Office of the Chief Economist for all of
their work on the proposal.
Appendix 3—Statement of
Commissioner Kristin N. Johnson
Cyberattacks are an ever-increasing threat.
The rising cost, frequency, and severity of
cyber threats represent one of the most
critical issues facing city, state, and federal
government authorities, businesses in each
sector of our economy, educational and
philanthropic institutions, and significant
energy and transportation infrastructure, and
national security resources.
Less than a month before the White House
released its National Cybersecurity Strategy
in March of this year, international media
headlines reported a ransomware attack that
demonstrated that ‘‘big financial firms’’ are
among the most attractive targets of cyber
threats.1 Even for firms that have successfully
1 James Rundle, Wall Street Journal, Cyberattack
on ION Derivatives Unit Had Ripple Effects on
Financial Markets (Feb. 10, 2023), https://
www.wsj.com/articles/cyberattack-on-ion-
E:\FR\FM\24JAP2.SGM
24JAP2
ddrumheller on DSK120RN23PROD with PROPOSALS2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
developed business continuity plans to
identify, assess, or mitigate cyber threats, the
networked or interconnected systems that
comprise our operational market
infrastructure may still render sophisticated,
well-resourced firms vulnerable to the knockon effects of cyberattacks leveled against
critical third-party service providers.
The ransomware attack, carried out on a
critical third-party service provider, ION
Cleared Derivatives,2 disrupted trade
settlement and reconciliation in derivatives
markets.
ION provides trading, clearing, analytics,
treasury, and risk management services for
capital markets and futures and derivatives
markets. A significant number of market
participants, including a notable number of
futures commission merchants (FCMs), rely
on ION for back-office trade processing and
settlement of exchange-traded derivatives.
The cyber-incident that disrupted ION’s
operations caused a ripple effect across
markets, halting deal matching, requiring
affected parties to rely on manual (old
school) trade processing, and causing delays
in reconciliation and information sharing and
reporting.
the public understand the dynamics of the
futures and options on futures markets.6 The
COT report is a reflection of the effectiveness
of the Commission’s surveillance of markets;
it increases transparency and aids in price
discovery. Thus, indirectly, the ION incident
disrupted regulatory functions even though
the cyberattack was not directed at the
Commission nor any of the Commission’s
registrants.
As a consequence, it is imperative to begin
to examine the scope of our regulations
governing cyber-system safeguards not only
for registered market participants, but for
mission-critical third-party service providers.
There is increasing reliance on third parties
for the provision of important services,
particularly, for example, services that
facilitate digital connectivity and cloudbased services.
While outsourcing may allow companies to
rely on outside expertise, reduce operating
costs, and enhance operational infrastructure
necessary for executing business activities,
reliance, may, in some instances, create
vulnerability and risks that must be
identified, managed, and mitigated.
MRAC Leads on Cyber Reform Discussions
I sponsor the Market Risk Advisory
Committee (MRAC). On March 8, 2023, the
MRAC held a first-of-its-kind convening
focused on the interconnectedness of our
markets and the potential for
interconnectedness and correlation to
amplify contagion in the event of successful
cyberattacks against critical infrastructure
resources.3 At the March MRAC meeting,
Futures Industry Association (FIA) President
Walt Lukken announced the creation of a
Cyber Risk Taskforce, charged with
‘‘recommend[ing] ways to improve the ability
of the exchange-traded and cleared
derivatives industry to withstand the
disruptive impacts of a cyberattack.’’ 4
The After Action Report issued by the FIA
at the conclusion of the Taskforce’s work
outlines the challenges that both markets and
regulators faced as a result of the ION cyberincident. Trade reconciliation for affected
firms continued to lag. For weeks following
the ION cyberattack, the Commission
continued to work to consistently publish the
Commitments of Traders (COT) report on a
timely basis because ‘‘reporting firms
continu[ed] to experience . . . issues
submitting timely and accurate data to the
CFTC.’’ 5 The COT report is designed to help
Operational Resilience Proposed
Rulemaking
derivatives-unit-had-ripple-effects-on-financialmarkets-11675979210.
2 See Press Release, ION Markets, Cleared
Derivatives Cyber Event (Jan. 31, 2023), https://
iongroup.com/press-release/markets/clearedderivatives-cyber-event/.
3 Kristin N. Johnson, Commissioner, CFTC,
Opening Statement Before the Market Risk
Advisory Committee Meeting (Mar. 8, 2023),
https://www.cftc.gov/PressRoom/Speeches
Testimony/johnsonstatement030823.
4 Futures Industry Association, FIA Taskforce on
Cyber Risk, After Action Report and Findings, at 3
(Sept. 28, 2023), https://www.fia.org/sites/default/
files/2023-09/FIA_
Taskforce%20on%20Cyber%20Risk_
Recommendations_SEPT2023_Final2.pdf.
5 Press Release No. 8662–23, CFTC, CFTC
Announces Postponement of Commitments of
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
Today, the Market Participants Division
(MPD) has introduced a robust and
comprehensive proposed rulemaking that
addresses: business continuity and disaster
planning, cybersecurity, and assessment of
the risk posed by reliance on third parties. I
want to commend MPD, in particular Pamela
Geraghty, Elise Bruntel, Fern Simmons, and
Amanda Olear.
The Commission has the authority to direct
swap entities (swap dealers and major swap
participants) to establish this operational
resilience framework under Section 4s(j)(2)
and (7) of the Commodity Exchange Act
(CEA), which require swap entities to
establish risk management systems over their
day-to-day business and their operational
risk.7 Likewise, the Commission may require
operational resilience framework of FCMs
(collectively with swap entities, ‘‘covered
entities’’) under Section 8a(5) of the CEA,8
which authorizes the Commission to
promulgate regulations sufficient to
accomplish the purposes of the CEA,
including, for example, the need to maintain
records of the operational risk of affiliates,9
and to establish safeguards to protect the
confidentiality of nonpublic personal
information.10
The proposed rulemaking sets out three
major pillars of its operational resilience
framework: (1) information and technology
security; (2) a third-party relationship
program to manage risks presented by
mission-critical third-party service providers;
and (3) a business continuity and disaster
recovery plan.11
Layered on top of the of the three pillars
are corporate governance reforms that will
dictate how each covered entity will
incorporate the components of the plan into
existing organizational structures. Each of the
components of the operational resilience
framework must be reviewed by senior
leadership.12 Covered entities must also
establish a risk appetite—the level of risk
acceptable on an ongoing basis—and risk
tolerance limits—the level of excess risk the
entity is willing to accept should a particular
risk materialize 13—and the entities will be
required to escalate incidents that exceed
their risk tolerance limit.14 The rule also
allows for flexibility for entities that function
as a division or affiliate of a larger
organization; such entities will be allowed to
operate under the umbrella company’s
operational resilience plan so long as that
plan meets the rule’s requirements and
considers the covered entity’s particular
risks.15
The information and technology security
program requires the covered entities to
comprehensively assess, on at least an annual
basis, the types of threats the entity faces, the
entity’s internal and external vulnerabilities,
the likely impact of those threats or the
exploitation of those vulnerabilities, and
appropriate priorities for addressing those
risks.16 With that background, covered
entities must then implement controls
reasonably designed to prevent, detect, and
mitigate the identified risks, threats, and
vulnerabilities.17 The program then requires
the covered entities to develop a written
incident response plan, reasonably designed
to detect incidents where risks to information
and technology are realized, and then
provide for how the entity will mitigate the
impact of and recover from such an
incident.18
The third-party relationship plan requires
covered entities to understand the risks
posed by all third-party service providers at
each stage of the relationship: pre-selection,
diligence, contract negotiation, ongoing
monitoring, and termination.19 The proposed
rule then imposes a heightened level of
required diligence and monitoring for
‘‘critical’’ third parties, defined as those
parties for whom disruption of performance
on their service contract would either
‘‘significantly disrupt’’ the covered entity’s
business operations, or ‘‘significantly and
adversely impact’’ the entity’s counterparties
or customers.20 Covered entities will also
have to maintain an inventory of their critical
and non-critical third-party service
providers.21 Finally, regardless of any
11 Proposed
§§ 1.13(b)(2), 23.603(b)(2).
§§ 1.13(c)(1), 23.603(c)(1).
13 Proposed §§ 1.13(c)(1), 23.603(c)(2).
14 Proposed §§ 1.13(c)(3), 23.603(c)(3).
15 Proposed §§ 1.13(c)(4), 23.603(c)(4).
16 Proposed §§ 1.13(d)(1), 23.603(d)(1).
17 Proposed §§ 1.13(d)(2), 23.603(d)(2).
18 Proposed §§ 1.13(d)(3), 23.603(d)(3).
19 Proposed §§ 1.13(e)(1), 23.603(e)(1).
20 Proposed §§ 1.13(e)(2), 23.603(e)(2).
21 Proposed §§ 1.13(e)(3), 23.603(e)(3).
12 Proposed
Traders Report (Feb. 16, 2023), https://
www.cftc.gov/PressRoom/PressReleases/8662-23.
6 CFTC, Commitments of Traders Reports
Descriptions, https://www.cftc.gov/MarketReports/
CommitmentsofTraders/index.htm.
7 7 U.S.C. 6s(j)(2), (7).
8 7 U.S.C. 12a(5).
9 7 U.S.C. 6f.
10 7 U.S.C. 7b–2; 15 U.S.C. 6801.
PO 00000
Frm 00059
Fmt 4701
Sfmt 4702
4763
E:\FR\FM\24JAP2.SGM
24JAP2
4764
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
decision to rely on a third-party service
provider, each covered entity remains
responsible for meeting its obligations under
the CEA and Commission regulations.22
Each entity’s business continuity and
disaster recovery plan (BCDR plan) must
‘‘outline[ ] the procedures to be followed in
the event of an emergency or other disruption
of its normal business activities.’’ 23 The goal
of a BCDR plan will be to enable covered
entities to continue or resume business
operations with minimal disruption to
customers, counterparties, or the markets,
and recover any affected data or
information.24 At minimum, the BCDR plan
must define backup plans for covered
information and data; identify essential
technology, facilities, infrastructure, and
personnel; identify potential disruptions to
critical third-party service providers; and
identify supervisory personnel responsible
for carrying out the plan in the event of an
emergency.25 Covered entities must also
maintain the plan at one or more off-site
locations.26
To support the pillars of the operational
resilience framework, the proposed rule also
lays out training,27 review, and testing
requirements to ensure the framework
evolves with newly generated risks. Covered
entities must review their framework
annually,28 and engage in regular
independent and documented testing,
including penetration testing, vulnerability
assessments, and testing of the incident
response and BCDR plans.29 Results of that
testing must be reported to the entity’s chief
compliance officer and other relevant senior
personnel.30 Finally, the proposed rule lays
out the instances in which the Commission
must be notified of incidents and of
activation of the BCDR plan.31
This proposed rulemaking is both
expansive and thoroughly considered. It
galvanizes much of the preexisting guidance
on these subjects, recognizing that the vast
majority of our market participants already
have programs in place to address these risks
and often already are subject to other
regulators’ rules and obligations, both
domestically and internationally. The rule
also recognizes the vast range in the size of
the operations of our registered market
participants—from some of the world’s
largest financial institutions acting as swap
dealers to small, independent futures
commissions merchants—and consequently
builds flexibility into the proposed rule to
allow businesses to tailor their operational
resilience frameworks to the realities of their
business needs.
ddrumheller on DSK120RN23PROD with PROPOSALS2
The Need for Operational Resilience for
Other Commission Registrants
This rule is necessarily limited in scope to
FCMs and the swap entities overseen by
22 Id.
23 See
17 CFR 23.603(a).
§§ 1.13(f)(1)(i)–(ii), 23.603(f)(1)(i)–(ii).
25 Proposed §§ 1.13(f)(2), 23.603(f)(2).
26 Proposed §§ 1.13(f)(3), 23.603(f)(3).
27 Proposed §§ 1.13(g), 23.603(g).
28 Proposed §§ 1.13(h)(1), 23.603(h)(1).
29 Proposed §§ 1.13(h)(2)–(3), 23.603(h)(2)–(3).
30 Proposed §§ 1.13(h)(5), 23.603(h)(5).
31 Proposed §§ 1.13(i)–(j), 23.603(i)–(j).
24 Proposed
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
MPD. The risks that this rule intends to
mitigate, however, are not similarly siloed.
Designated Contract Markets (DCM), Swap
Execution Facilities (SEF), and Swap Data
Repositories (SDR), overseen by the Division
of Market Oversight, and Derivative Clearing
Organizations (DCO), overseen by the
Division of Clearing and Risk, similarly rely
on mission-critical third-party service
providers, similarly are targeted by
cyberattacks, and similarly risk business
disruption caused by unforeseen disaster
scenarios.
Rulemakings completed in 2016 created
system safeguard testing requirements for
each of these entities, currently codified in
Parts 37, 38, 39, and 49 of the CFR.32 These
rules include obligations for business
continuity and disaster recovery and
cybersecurity. Since 2016, however, the core
issues surrounding the concept of operational
resilience have shifted, most importantly
around the ideas of mission-critical third
parties. DCOs are increasingly contracting
with third parties to manage and conduct
aspects of their regulatory obligations, and
just like with the covered entities subject to
the rule at issue today, the onboarding of
these new third parties also onboards new
risks. The proposed rulemaking today
considers the system safeguards provisions
already on the books; 33 the Commission now
needs to continue to press forward by
considering this proposed rule for future
parallel regulations, for DCOs in particular.
The pandemic underscored the importance
of business operational resilience, namely the
ability of our registrants to react to and
withstand unforeseen disasters. The FIA
conducted its annual Disaster Recovery
Exercise this fall with the stated goal of
probing participants’ ability to ‘‘conduct
critical business functions’’ in the wake of a
large-scale disaster.34 Last year’s exercise saw
participation from 19 major U.S. and
international futures exchanges and
clearinghouses, who indicated that this type
of probing helped them to: ‘‘Exercise their
business continuance/disaster resilience
plans[, i]dentify internal and external single
points of failure . . . [, and t]ighten up and
improve the documentation of their business
continuity procedures.’’ 35
32 See Final Rule, System Safeguards Testing
Requirements, 81 FR 64272 (Sept. 19, 2016)
(covering DCMs, SEFs, and SDRs); Final Rule,
System Safeguards Testing Requirements for
Derivatives Clearing Organizations, 81 FR 64322,
64329 (Sept. 19, 2016) (‘‘System Safeguards for
DCOs’’) (describing the CFTC’s approach to system
safeguards for DCOs as providing DCOs with
‘‘flexibility to design systems and testing
procedures based on the best practices that are most
appropriate for that DCO’s risks’’).
33 C.f., e.g., System Safeguards for DCOs, 81 FR
64322–23; 17 CFR 39.18(b)(3) (requiring DCOs to
follow generally accepted standards and best
practices with respect to the development,
operation, reliability, security, and capacity of
automated systems).
34 Presentation, Futures Industry Association,
Business Continuity Disaster Recovery Test, at 4
(Aug. 23, 2023), https://www.fia.org/sites/default/
files/2023-10/FIA_DR_Test_Briefing_2023_1010_
0.pptx.
35 Summary Report, Futures Industry Association,
2022 FIA Industry-Wide Disaster Recovery Test, at
PO 00000
Frm 00060
Fmt 4701
Sfmt 4702
In 2021, the International Organization of
Securities Commissions (IOSCO) initiated a
consultation examining business continuity
planning.36 IOSCO’s initial recommendations
to member jurisdictions stated that all
regulators should require firms to have in
place ‘‘mechanisms to help ensure the
resiliency, reliability and integrity (including
security) of critical systems’’ including an
appropriate ‘‘Business Continuity Plan.’’ 37
Every industry advisory board and
oversight group to have studied cybersecurity
has reached the same conclusion: risks to
financial institutions from cyberattacks
continue to grow. The Financial Stability
Oversight Council noted in its 2022 annual
report that from 2015 to 2020 the finance and
insurance industries were subject to the most
cyberattacks of any industry, and that the
current global geopolitical climate has only
increased the need for vigilance against cyber
threats.38 In April 2020, the Financial
Stability Board (FSB) issued a guide on cyber
incident response that explained that ‘‘[a]
significant cyber incident, if not properly
contained, could seriously disrupt the
financial system, including critical financial
infrastructure, leading to broader financial
stability implications.’’ 39 Similarly, in its
2019 Cyber Task Force report, IOSCO
reiterated that cyber risk is one of the top
threats to financial markets today given the
‘‘economic costs of such events can be
immense . . . and could potentially
undermine the integrity of global financial
markets.’’ 40 IOSCO went further in their
recommendations to the crypto industry
earlier this year that ‘‘[r]egulators should
require a [crypto-asset service provider] to
put in place sufficient measures to address
cyber and system resiliency.’’ 41
Next Steps for Derivatives Clearing
Organizations
At the MRAC meeting this past Monday, I
announced a new workstream for the CCP
Risk and Governance subcommittee that will
focus on third-party risk for central clearing
counterparties. Work will begin imminently,
with the goal of presenting a proposal for
4 (Dec. 16, 2021), https://www.fia.org/sites/default/
files/2023-05/2022_DR_Test_Results_v2.pdf.
36 The Board of The International Organization of
Securities Commissions, Thematic Review on
Business Continuity Plans with respect to Trading
Venues and Intermediaries (May 21, 2021), https://
www.iosco.org/library/pubdocs/pdf/
IOSCOPD675.pdf.
37 Id. at 1.
38 Financial Stability Oversight Council, 2002
Annual Report, at 37 (Dec. 16, 2022), https://
home.treasury.gov/system/files/261/
FSOC2022AnnualReport.pdf.
39 The Financial Stability Board, Effective
Practices for Cyber Incident Response and
Recovery, at 1 (Oct. 19, 2020), https://www.fsb.org/
wp-content/uploads/P191020-1.pdf.
40 The Board of The International Organization of
Securities Commissions, Cyber Task Force: Final
Report, at 3 (June 19, 2019), https://www.iosco.org/
library/pubdocs/pdf/IOSCOPD633.pdf.
41 The Board of The International Organization of
Securities Commissions, Policy Recommendations
for Crypto and Digital Asset Markets Consultation
Report, at 39 (Nov. 16, 2023), https://
www.iosco.org/library/pubdocs/pdf/
IOSCOPD747.pdf.
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
vote by the parent committee in the first
quarter of 2024. DCOs already retain
responsibility for meeting regulatory
requirements when entering into contractual
outsourcing arrangements; 42 the question
now is how DCOs should be required to
assess and monitor the risks associated with
doing so.
Such a rule should in my view broadly
track the rule for FCMs and swap entities
proposed today, but deep consideration must
be given to the ways in which the core DCO
business differs. For example, DCOs already
occupy a quasi-oversight role with respect to
their clearing members; should a rule on
third-party risk require DCOs to consider not
only the risk posed by their own outsourcing
contracts, but also require that DCOs
consider their clearing members’ third-party
risks, perhaps as an aspect of a DCO’s
assessment of its counterparty risk? How else
might the rule differ given the disparity
between DCOs’ and FCMs’ relative frequency
of interaction with end users? How might
these rules coordinate with prudential
regulators?
A cyberattack on a third party that affected
FCMs last winter was already disruptive
enough, but given their status as SIFMUs
some DCOs are quite literally systemically
important entities. DCOs serve irreplaceable
market functions, and we need update their
operational resilience requirements to take
into account this new conception of thirdparty risk. I look forward to the new MRAC
workstream diving into this critical issue,
and of course to what Division of Clearing
and Risk staff might bring forward in an
eventual proposed rulemaking.
I once again commend the staff of MPD on
their tremendous effort bringing forth this
proposed rule, and look forward to hearing
the thoughts of my fellow Commissioners.
ddrumheller on DSK120RN23PROD with PROPOSALS2
Appendix 4—Statement of
Commissioner Christy Goldsmith
Romero
Today we have before us our first proposed
cyber and operational resilience rule that
would apply to swap dealers (including
banks) and futures commission merchants
(FCMs). I’m excited to see the proposed rule
up for vote today. I support the rule and
thank the staff for their more than one year
of hard work. I also thank all who engaged
with us in an extensive collaborative effort.
I also thank Chairman Behnam for entrusting
me to help with this rule.
This is a critical rule for the CFTC. FBI
Director Christopher Wray recently said ‘‘that
today’s cyber threats are more pervasive, hit
a wider array of victims, and carry the
potential for greater damage than ever
before’’ and we face ‘‘some of our most
complex, most severe, and most rapidly
evolving threats.’’ 1 This rule proposes to
help advance our markets from a mentality
42 17 CFR 39.18(d) (2022) (providing that
registered entities such as DCOs retain
responsibility for meeting relevant regulatory
requirements when entering into contractual
outsourcing arrangements).
1 See FBI, Director Wray’s Remarks at the
Mandiant/mWISE 2023 Cybersecurity Conference
(Sept. 18, 2023).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
of incident response to one of cyber
resilience. This would further President
Biden’s White House National Cybersecurity
Strategy and Executive Order on Improving
the Nation’s Cybersecurity.2
Cyber resilience is one of my top priorities,
and a critical issue on which I am engaged.
Over the last year, the CFTC staff and I have
been engaged with the White House, other
financial regulators, the Department of
Commerce’s National Institute of Standards
and Technology (NIST), the National Futures
Association (NFA), swap dealers, FCMs,
trade groups like the Futures Industry
Association, the International Swaps and
Derivatives Association, and the Securities
Industry and Financial Markets Association,
public interest groups, and third-party
vendors. I also sponsor the Technology
Advisory Committee that covers
cybersecurity, and has a dedicated
Cybersecurity subcommittee stacked with
well-regarded cybersecurity experts.3
It takes this type of collective public and
private engagement to thwart cybercrime,
stay ahead of the continuously changing
threat, and protect our nation’s critical
infrastructure. Director Wray has spoken
about how malicious cyber actors seeking to
cause destruction are working to hit us
somewhere that’s going to hurt—U.S. critical
infrastructure sectors.4 According to the FBI,
in 2021, there were ransomware incidents
against 14 of the 16 U.S. critical
infrastructure sectors.5 That includes an
attack on Colonial Pipeline that led to gas
shortages, and an attack on the world’s
largest meat supplier JBS, that led to meat
shortages and spiking prices.6
As Director Wray has said, ‘‘ransomware
gangs love to go after things we can’t do
without.’’ 7 Our nation cannot do without the
commercial agriculture, energy, metals, and
2 The E.O.’s policy statement of policy is
‘‘Protecting our Nation from malicious cyber actors
requires the Federal Government to partner with the
private sector. The private sector must adapt to the
continuously changing threat environment, ensure
its products are built and operate securely, and
partner with the Federal Government to foster a
more secure cyberspace. In the end, the trust we
place in our digital infrastructure should be
proportional to how trustworthy and transparent
that infrastructure is, and to the consequences we
will incur if that trust is misplaced.’’ The White
House, Executive Order on Improving the Nation’s
Cybersecurity (May 12, 2021).
3 See CFTC, Commissioner Goldsmith Romero
Announces Technology Advisory Committee
Subcommittee Co-Chairs and Members (July 14,
2023); see also CFTC Technology Advisory
Committee July 18 Meeting (July 18, 2023); CFTC
Technology Advisory Committee March 22 Meeting
(March 22, 2023).
4 See FBI, Director’s Remarks to the Boston
Conference on Cyber Security 2022 (June 1, 2022).
5 See FBI, FBI Partnering with the Private Sector
to Counter the Cyber Threat, Remarks at the Detroit
Economic Club (Mar. 22, 2022).
6 See Id. (discussing how an attack led to Colonial
shutting down pipeline operations and a panic
among people in the Southeast that led to a run on
gas and how an attack on JBS resulted in a complete
stoppage of meat production, leading to spiking
prices and less availability of meat).
7 See FBI, Director’s Remarks to the Boston
Conference on Cyber Security 2022 (June 1, 2022).
PO 00000
Frm 00061
Fmt 4701
Sfmt 4702
4765
financial markets, on which derivatives
markets are based.
In June, I presented five key pillars of cyber
resilience, pillars that are contained in the
proposed rule: 8
1. A proportionate and appropriate
approach;
2. Following generally accepted standards
and best practices;
3. Elevating responsibility through
governance;
4. Building resilience to third-party risk;
and
5. Leveraging the important work already
done in this space, including by prudential
regulators and NFA.
Taking a Proportionate and Appropriate
Approach
There is no one-size fits all approach. The
proposed rule would require swap dealers
and FCMs to ensure that their operational
resilience programs are appropriate and
proportionate to the nature and risk profile
of their business. This follows the White
House National Cybersecurity Strategy.9 Our
swap dealers include Globally Systemically
Important Banks (GSIBs). Additionally, some
of our swap dealers and FCMs are involved
in U.S. critical infrastructure such as in the
energy or agricultural sectors, or in supply
chains.
FBI Director Wray testified before Congress
this month that one of the most worrisome
facets of state-sponsored adversaries is their
focus on compromising U.S. critical
infrastructure, especially during a crisis, and
that there is often no bright line that
separates where nation state activity ends
and cybercriminal activity begins.10 He
testified about the disruptive impact of a
supply chain attack in the SolarWinds attack,
conducted by the Russian Foreign
Intelligence Service.11 This summer, Director
Wray said that the FBI is seeing the effects
of Russia’s invasion of Ukraine here at home,
as the FBI has seen Russia conducting
reconnaissance on the U.S. energy sector.12
Director Wray also has said that, ‘‘China
operates on a scale Russia doesn’t come close
to. They’ve got a bigger hacking program than
all other major nations combined. They’ve
stolen more American personal and corporate
data than all nations combined.’’ 13 Director
Wray has said that ‘‘the Chinese government
has hacked more than a dozen U.S. oil and
gas pipeline operators, not just stealing their
8 Commissioner Christy Goldsmith Romero,
Advancing from Incident Response to Cyber
Resilience, (June 20, 2023).
9 See The White House, National Cybersecurity
Strategy (March 2023) (recommending that
organizations ‘‘demonstrate a principles-based
approach that is sufficiently nimble to adapt to
meet the challenges of the ever-evolving
technological threat landscape and to fit the unique
business and risk profile of each individual covered
entity.’’
10 See FBI, Statement of Christopher A. Wray
Director Federal Bureau of Investigation Before the
Committee on the Judiciary United States Senate
(Dec. 5, 2023).
11 See Id.
12 See FBI, Director Wray’s Remarks at the FBI
Atlanta Cyber Threat Summit (July 26, 2023).
13 See FBI, Director’s Remarks to the Boston
Conference on Cyber Security 2022 (June 1, 2022).
E:\FR\FM\24JAP2.SGM
24JAP2
4766
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
information, but holding them, and all of us,
at risk.’’ 14 Swap dealers and FCMs involved
in critical infrastructure sectors will need to
build resilience for these cyber threats.
The proposal also recognizes that cyber
resilience requires continuous attention.
What is appropriate or proportionate may
change with the changing threat vector. It
may also change when a swap dealer or FCM
enters a new line of business, onboards a new
vendor, or takes other action that can carry
cyber risk.
Following Generally Accepted Standards and
Practices
The proposal, like the CFTC’s rules for
exchanges and clearinghouses, would require
swap dealers and FCMs to follow generally
accepted standards and industry best
practices, like NIST or ISO (for international
companies). The NIST Cybersecurity
Framework creates a clear set of
cybersecurity expectations that are risk-and
outcome-based rather than prescriptive, and
adaptable to the size and types of
businesses.15 These standards are regularly
updated to reflect the evolving technology
and threat landscape. The proposed rule also
requires at least annual assessment, testing
and updates to the operational resilience
framework.
ddrumheller on DSK120RN23PROD with PROPOSALS2
Elevating Responsibility Through Governance
The vision of the Biden Administration’s
National Cybersecurity Strategy is to
rebalance the responsibility to defend
cyberspace by shifting the burden for
cybersecurity away from individuals and
small businesses, and onto the organizations
that are most capable and best positioned to
reduce risks.16 This strategy gets away from
vulnerability caused by one person in an
organization clicking on the wrong thing that
leads to total disruption. The banks and
commodity firms this rule would apply to are
capable and best positioned to reduce cyber
risk and cybercrime losses.
Building cyber resilience requires elevating
responsibility to those who make strategic
decisions about the business. The stakes for
businesses are high. There is potential legal
risk, reputational risk, risk to national
security, as well as financial risk. In 2022, the
FBI reported $10.3 billion in cybercrime
losses, shattering the record from the prior
year.17 Tone at the top, including the Csuite’s active participation in cyber resilience
programs as well as making cyber resilience
a top priority, can determine whether an
organization will successfully be cyber
resilient and operationally resilient.
The proposed rule would require
operational resilience plans to be approved
annually by a senior leader and for incidents
14 See FBI, FBI Partnering with the Private Sector
to Counter the Cyber Threat, Remarks at the Detroit
Economic Club (Mar. 22, 2022).
15 See Presentation of Kevin Stine, Chief of the
Applied Security Division at NIST Information
Technology Laboratory, ‘‘Managing Cybersecurity
Risks,’’ CFTC Technology Advisory Committee
Meeting (March 22, 2023).
16 See The White House, National Cybersecurity
Strategy (March 2023).
17 FBI, Internet Crime Report 2022 (March 22,
2023).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
to be escalated promptly. It also would
require senior leaders to set and approve the
firm’s risk appetite and risk tolerance limit.
Leaders should make strategic decisions
about the risk they are willing to take on, as
well as the metrics they will monitor. I am
interested in hearing if the proposal’s
definitions of these terms set a clear
expectation and align with generally
accepted standards.
Building Resilience to Third-Party Risk
Swap dealers and FCMs routinely rely
upon third party (as well as fourth party)
service providers to access new technologies
and expertise, and for efficiencies in business
functions. The rule requires building
resilience to third party risk, an issue brought
sharply into focus with this year’s cyberattack on third-party vendor ION Markets.
Because third parties create points of entry
that need to be secured from cyber criminals,
the banking regulators released updated
interagency guidance on third party risk
management that would apply to many of the
swap dealers subject to the proposed rule.18
The staff and I met with the Federal Reserve,
Federal Deposit Insurance Corporation, and
the Office of the Comptroller of the Currency
about their guidance and their efforts to
promote cyber resilience. Like that
interagency guidance, the proposed rule
includes an inventory of all third-party
service providers, assessments of risk
throughout the lifecycle of the third-party
relationship, the identification of critical
third-parties, and subjects those critical third
parties to heightened due diligence and
monitoring.
The proposed definition of who is a critical
third-party service provider takes a flexible
approach, asking entities to consider the
impact of a disruption.19 At his TAC
presentation, Todd Conklin, Deputy
Assistant Secretary of Treasury’s Office of
Cybersecurity and Critical Infrastructure
Protection (OCCIP) and TAC member
discussed how ION Markets received less
scrutiny because it was not treated as a
critical third-party vendor by most firms.20 I
look forward to comment.
The CFTC also proposes separate guidance
on managing third-party risks. I am interested
18 Board of Governors of the Federal Reserve
System, Federal Deposit Insurance Corporation, and
Office of the Comptroller of the Currency,
Interagency Guidance on Third Party Relationships:
Risk Management (Jun. 6, 2023).
19 I heard from many banks and brokers that
identifying who is a critical third-party service
provider is an issue they regularly grapple with,
and that it often comes down to specific facts and
circumstances, and not just the products and
service they provide.
20 See Presentation of Todd Conklin, Deputy
Assistant Secretary of Treasury’s Office of
Cybersecurity and Critical Infrastructure Protection
(OCCIP), ‘‘The Cyber Threat Landscape for
Financial Markets: Lessons Learned from ION
Markets, Cloud Use in Financial Services, and
Beyond,’’ CFTC Technology Advisory Committee
Meeting (March 22, 2023) (‘‘many institutions
didn’t even classify [ION Markets] necessarily as a
‘critical’ third-party vendor. So many firms who
onboarded ION didn’t use the highest-level scrutiny
that they use for their most critical third-party
vendors.’’).
PO 00000
Frm 00062
Fmt 4701
Sfmt 4702
in commenters’ views on this guidance, and
whether we have it right for harmonization.
Leveraging the Important Work of Others,
Including Prudential Regulators and the NFA
The White House’s 2023 Cybersecurity
Strategy recommends organizations
‘‘harmonize where sensible and appropriate
to achieve better outcomes.’’ 21 The proposal
recognizes that many of our regulated entities
are part of a larger enterprise, with cyber and
operational resilience programs managed at
the enterprise level, and can use those
programs under this rule. I am interested in
commenters’ views on whether we have
achieved appropriate harmonization or
whether we need greater harmonization with
bank regulators’ rules and guidance and NFA
guidance.22
Stronger Together
We are stronger together. The CFTC is part
of coordinated government efforts to learn
about and disseminate information about
emerging cyber threats. We want to work
with our swap dealers and FCMs to help
strengthen their operational resilience,
especially prior to any disruptive event.
Should a disruptive event occur, resilience
requires rapid collaboration among the CFTC
and all those who are potentially affected to
contain any potential damage and to keep
critical market functions running. The
proposed rule includes specific requirements
for notifying the CFTC of an incident as soon
as possible, but no later than 24 hours after
detection. I support immediate notification to
the CFTC because if we know, we can work
with regulated entities and markets to assess
and minimize damage, trigger appropriate
regulatory and law enforcement action, help
in recovery, and protect customers. I note
that this time frame and reporting standards
differs from other regulators, and look
forward to comment.
A two-way flow of information can play a
significant role in the ability to build
resilience, which means the ability to recover
quickly after an attack. According to Deputy
Assistant Secretary Conklin, collaboration
between the government and industry helped
mitigate the impact of the ION Markets
attack.23 The proposal would also require
notification to customers and counterparties
as soon as possible of attacks that affect them.
Early notice helps minimize the impact of an
21 See The White House, National Cybersecurity
Strategy, (March 2023).
22 These requirements and guidance include the
prudential regulator’s Sound Practices to
Strengthen Operational Resilience paper, the
Interagency Guidelines Establishing Standards for
Safeguard Customer Information, and the recently
released Interagency Guidance on Third-Party
Relationships: Risk Management, as well as NFA
guidance on information security, third-party
service provider risk management, and notification
of regulators and business continuity and disaster
recovery.
23 See Presentation of Todd Conklin, Deputy
Assistant Secretary of Treasury’s Office of
Cybersecurity and Critical Infrastructure Protection
(OCCIP), ‘‘The Cyber Threat Landscape for
Financial Markets: Lessons Learned from ION
Markets, Cloud Use in Financial Services, and
Beyond,’’ CFTC Technology Advisory Committee
Meeting (Mar. 22, 2023).
E:\FR\FM\24JAP2.SGM
24JAP2
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
attack by allowing them to secure their
personal data, monitor affected accounts, and
make alternative arrangements for accessing
critical funds or markets.
If we can all work together, we can harden
our defenses, thwart cyber criminals, and
protect critical U.S. infrastructure and
national security. Together, we can build a
safer and more resilient cyberspace.
Appendix 5—Statement of
Commissioner Caroline D. Pham
ddrumheller on DSK120RN23PROD with PROPOSALS2
I support the Notice of Proposed
Rulemaking on Operational Resilience
Framework for Futures Commission
Merchants, Swap Dealers, and Major Swap
Participants (Operational Resilience
Proposal) 1 because I believe this approach is
largely consistent with international
standards for operational resilience, as well
as U.S. prudential regulations and non-U.S.
regulations, which have been implemented
for several years now. I thank the staff of the
Market Participants Division (MPD),
especially Pamela Geraghty, Elise Bruntel,
and Amanda Olear, as well as Chairman
Behnam and Commissioner Goldsmith
Romero, for working with me over the past
year to address my concerns.
Background
My discussions with MPD staff, formerly
the Division of Swap Dealer and
Intermediary Oversight (DSIO), in fact date
back to 2016 when I was in the private sector.
MPD staff have been considering many of the
elements of an operational resilience
framework for years, including operational
risk and cybersecurity risk. I appreciate the
staff’s focus on all of these important issues
that contribute to ensuring that our
registrants have robust risk management and
compliance programs, and that the CFTC is
doing our job to uphold financial stability
and protect against systemic risk.
I would like to mention my background
and experience, as well as familiarity, with
the subject areas covered by the Operational
Resilience Proposal to provide context for my
efforts to support the development of this
Proposal and address my concerns that the
CFTC’s approach should not be overly
prescriptive and generally takes a principlesbased approach in recognition of the
extensive years-long global implementation
of operational resilience requirements by
U.S. and non-U.S. regulators and banking
organizations.
In my previous roles at a global
systemically important bank (GSIB), I have
been involved with operational resilience
since 2019, including the oversight and
coordination of global regulatory advocacy
with the Financial Stability Board (FSB) and
regulatory authorities such as the U.S.
prudential regulators,2 the Bank of England,
and European Union (EU) authorities. I also
1 Because there are no registered major swap
participants, as a practical matter, this statement
will refer to swap dealers and futures commission
merchants (FCMs).
2 U.S. prudential regulators refers to the Board of
Governors of the Federal Reserve System (Fed), the
Office of the Comptroller of the Currency (OCC),
and the Federal Deposit Insurance Corporation
(FDIC).
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
was on the enterprise-wide operational
resilience program steering committee, and I
have implemented enterprise-wide programs
across a global financial institution across all
regions and both institutional or wholesale
and consumer businesses.
Among the specific elements encompassed
in the Operational Resilience Proposal, I have
enhanced the swap dealer and futures
commission merchant (FCM) risk
management programs. I have drafted an
enterprise-wide risk appetite statement. I
have implemented the National Futures
Association’s (NFA) update to its information
systems security programs requirements,
which addresses cybersecurity risk. I have
participated in tabletop exercises, drills, and
simulations of responses to cyber attacks. I
was the lead from the Compliance
department on the third-party risk
management program for cross-asset
activities or other programmatic aspects
across the global markets business. I have
enhanced the business continuity and
disaster recovery (BCDR) swap dealer
policies and procedures and integration with
the enterprise-wide continuity of business
program. I have delivered training for,
respectively, 9,000 and 17,000 employees
across nearly 100 countries and multiple
languages. I have had a compliance
monitoring team that reported directly to me.
I have advised on the design and
implementation of the enterprise-wide
Volcker Rule independent testing program. I
was part of global regulatory notification
protocols for cybersecurity or other incidents.
And also, of course, I have been subject to
regulatory examinations on each one of these
areas. This practical experience has informed
my engagement on this significant
rulemaking initiative.
The CFTC’s Approach to Operational
Resilience Must Be Consistent With
International Standards and Prudential
Regulations
I am pleased that the CFTC is seeking an
approach that is consistent with international
standards and best practices for regulators in
addressing operational resilience. I will
reiterate my previous remarks on the many
years of work by policymakers such as the
FSB, the Basel Committee on Banking
Supervision (BCBS), the International
Organization of Securities Commissions
(IOSCO), and other regulatory authorities
around the world to implement laws,
regulations, and standards for operational
resilience. Operational resilience, as noted by
U.S. prudential regulators in 2020,
encompasses governance, operational risk
management, business continuity
management, third-party risk management,
scenario analysis, secure and resilient
information system management,
surveillance and reporting, and cyber risk
management. Regulated entities, including
the vast majority of our swap dealers and
FCMs that are part of banking organizations,
have already implemented comprehensive
enterprise-wide operational resilience
programs.3
3 Opening Statement of Commissioner Caroline D.
Pham before the Technology Advisory Committee,
PO 00000
Frm 00063
Fmt 4701
Sfmt 4702
4767
Issuing this Proposal can be beneficial to
initiate an open process to request
information and stimulate dialogue with the
public. That is why, although there has been
some hesitation or trepidation around what
the Commission might do since we are
coming onto the tail end of operational
resilience implementation globally, I do
think it is important that we are taking this
step today, because it is critical that the
public has the opportunity to provide input
on any amendment or expansion of our
existing programmatic requirements that is
informed by actual experience from risk
management and compliance officers, other
control functions, and practitioners who have
implemented and complied with operational
resilience requirements pursuant to other
regulations.
Further, as I have noted previously,
because the CFTC’s rules are often only one
part of a much broader risk governance
framework for financial institutions, the
Commission must ensure that it has the full
picture before coming to conclusions to
ensure that our rules not only address any
potential regulatory gaps or changes in risk
profiles, but also to avoid issuing rules that
are conflicting, duplicative, or unworkable
with other regulatory regimes.4
For example, when I last checked earlier
this year, the CFTC currently has 106
provisionally registered swap dealers. Of
these 106 entities, both U.S. and non-U.S., all
but a handful are also registered with and
supervised by another agency or authority,
such as a prudential, functional, or market
regulator. Most of these swap dealers are
subject to three or more regulatory regimes.5
It is imperative that the Commission and
the staff consider how our rules work in
practice together with the rules of other
regulators, whether foreign or domestic. This
key point is easily apparent in looking at the
CFTC’s substituted compliance regime for
non-U.S. swap dealers, where the
Commission has expressly found that nonU.S. swap dealers in certain jurisdictions are
subject to comparable and comprehensive
regulation, and therefore, our rules permit
such non-U.S. swap dealers to, for example,
substitute compliance with their home
jurisdiction risk management regulations to
satisfy our risk management program rules
under CFTC Regulation 23.600.6
Specific Areas for Public Comment
As a preliminary matter, regarding
discussion of the CFTC’s approach to system
safeguards requirements for designated
contract markets (DCMs) and derivatives
clearing organizations (DCOs) and its impact
on the development of today’s Operational
Resilience Proposal, I note that swap dealers
U.S. Commodity Futures Trading Commission (Jul.
18, 2023), https://www.cftc.gov/PressRoom/
SpeechesTestimony/phamstatement071823.
4 Statement of Commissioner Caroline D. Pham
on Risk Management Program for Swap Dealers and
Futures Commission Merchants Advance Notice of
Proposed Rulemaking, U.S. Commodity Futures
Trading Commission (Jun. 1, 2023), https://
www.cftc.gov/PressRoom/SpeechesTestimony/
phamstatement060123.
5 Id.
6 Id.
E:\FR\FM\24JAP2.SGM
24JAP2
4768
Federal Register / Vol. 89, No. 16 / Wednesday, January 24, 2024 / Proposed Rules
and FCMs are very different from exchanges
and clearinghouses. The CFTC should not
overly rely upon its approach to the system
safeguards rulesets because it is akin to the
difference between, for example, the
Securities and Exchange Commission’s (SEC)
Regulation SCI and the U.S. prudential
regulators’ Heightened Standards for Risk
Governance. I believe that the staff has tried
to balance these considerations, and I
welcome public comment on this approach.
Definitions
Words matter, and it is very important for
the Commission to be precise in the words
that we use for defined terms. I encourage all
commenters to review the Proposal’s
definitions and advise whether the
definitions are appropriate or need to be
revised.
ddrumheller on DSK120RN23PROD with PROPOSALS2
Third-Party Relationship Program Guidance
The Operational Resilience Proposal
includes an appendix to the rule text with
more prescriptive guidance on third-party
relationships (third-party risk management).
This is unusual because I do not believe that
the CFTC has this level of prescriptiveness
for any other category of risk, such as credit
risk. I question whether this heralds a change
to the CFTC’s approach to setting forth risk
management requirements, and why would
the Commission issue prescriptive guidance
for third-party risk, but not other risks such
as operational risk or market risk.
I also question the approach of issuing
Commission guidance, which would have to
undergo notice-and-comment rulemaking
and that could take a year or two to update,
instead of issuing staff guidance, which
could be updated more flexibly. I believe that
any prescriptive guidance would be more
appropriate as staff guidance, not
Commission guidance, because staff guidance
can be kept up-to-date more easily to address
changes in best practices or to adapt to
emerging risks. This is similar to how, for
example, U.S. prudential regulators update
their bank examiners handbook or circulars.
I am interested in public comment on the
CFTC’s requirements for third-party risk
management, and whether it should be
issued as Commission guidance or staff
guidance.
VerDate Sep<11>2014
18:32 Jan 23, 2024
Jkt 262001
Risk Appetite
The Operational Resilience Proposal refers
to risk appetite, which is a new concept to
CFTC regulations. I am interested in whether
commenters believe risk appetite is workable
under the CFTC’s regulatory framework,
which is focused on enforcement rather than
ongoing supervision. Indeed, I have
repeatedly noted that the CFTC lacks a swap
dealer examination program. As a
consequence, non-material operational or
technical issues are the subject of
enforcement actions, rather than addressed
more appropriately through supervisory
findings and exam reports like every other
regulatory authority in the world. This makes
the CFTC an outlier amongst U.S. and nonU.S. regulators, and therefore prudential
concepts like risk appetite may not be
workable.
Risk Tolerance Limits
Risk tolerance limits are a requirement
under the CFTC’s risk management program
(RMP) rules for swap dealers and FCMs. The
Operational Resilience Proposal also requires
risk tolerance limits, but sets forth a different
definition and does not refer to the risk
tolerance limits under the RMP rules. I am
interested in public comment on whether the
two differing requirements may cause
confusion or can be implemented without
any issues.
Annual Attestation
The Operational Resilience Proposal
requires an annual attestation by the senior
officer, an oversight body, or a senior-level
official of a swap dealer or FCM that relies
on a consolidated operational resilience
program. Such attestation is to the effect that
the consolidated program meets CFTC
requirements and reflects the risk appetite
and risk tolerance limits appropriate to the
swap dealer or FCM. I encourage commenters
to discuss the attestation requirement and
suggest appropriate attestation language.
Substituted Compliance
Under the Operational Resilience Proposal,
substituted compliance would be available
for non-U.S. swap dealers subject to a
comparability determination issued by the
Commission. I appreciate the recognition in
PO 00000
Frm 00064
Fmt 4701
Sfmt 9990
the Proposal of the importance of a homehost regulator approach to maintaining
regulatory cohesion and addressing systemic
risk and financial stability. I am interested in
whether commenters believe the Proposal
presents any cross-border issues in
implementation.
Conclusion
I believe in continuous improvement for
not only our market participants, but also for
the Commission and its regulations, and that
is why I would like to thank the MPD staff
again for being proactive in thinking about
these issues. I want to particularly recognize
the leadership of Commissioner Goldsmith
Romero in first highlighting these risks and
exploring ways to address them through the
work of the CFTC’s Technology Advisory
Committee, which she sponsors.
As I have stated before, the benefit of the
CFTC’s principles-based regulatory
framework is that it can quickly anticipate
and adapt to changes in risk profiles or the
operating environment. That is why I believe
our rules must be broad and flexible enough
to be forward-looking and evergreen, because
it is simply not possible to prescribe every
last requirement for the unknown future.
Consistent with international standards, I
have discussed the importance of utilizing
existing risk governance frameworks and risk
management disciplines to identify, measure,
monitor, and control emerging risks and new
technologies. Swap dealers and FCMs must
be vigilant and address new and emerging
risks through various risk stripes as
appropriate, whether from changing market
conditions, technological developments,
geopolitical concerns, or any other event, and
maintain operational resilience.
With that, I welcome the input from the
public comments to inform the Commission
and the staff regarding the application of the
Operational Resilience Proposal to swap
dealers and FCMs, especially those entities
that are part of a banking organization and
have already implemented operational
resilience requirements pursuant to U.S. or
non-U.S. regulations.
[FR Doc. 2023–28745 Filed 1–23–24; 8:45 am]
BILLING CODE 6351–01–P
E:\FR\FM\24JAP2.SGM
24JAP2
]]>Agencies
[Federal Register Volume 89, Number 16 (Wednesday, January 24, 2024)]
[Proposed Rules]
[Pages 4706-4768]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-28745]
[[Page 4705]]
Vol. 89
Wednesday,
No. 16
January 24, 2024
Part III
Commodity Futures Trading Commission
-----------------------------------------------------------------------
17 CFR Parts 1 and 23
Operational Resilience Framework for Futures Commission Merchants, Swap
Dealers, and Major Swap Participants; Proposed Rule
Federal Register / Vol. 89 , No. 16 / Wednesday, January 24, 2024 /
Proposed Rules
[[Page 4706]]
-----------------------------------------------------------------------
COMMODITY FUTURES TRADING COMMISSION
17 CFR Parts 1 and 23
RIN 3038-AF23
Operational Resilience Framework for Futures Commission
Merchants, Swap Dealers, and Major Swap Participants
AGENCY: Commodity Futures Trading Commission.
ACTION: Notice of proposed rulemaking.
-----------------------------------------------------------------------
SUMMARY: The Commodity Futures Trading Commission (CFTC or Commission)
is proposing to require that futures commission merchants, swap
dealers, and major swap participants establish, document, implement,
and maintain an Operational Resilience Framework reasonably designed to
identify, monitor, manage, and assess risks relating to information and
technology security, third-party relationships, and emergencies or
other significant disruptions to normal business operations. The
framework would include three components--an information and technology
security program, a third-party relationship program, and a business
continuity and disaster recovery plan--supported by broad requirements
relating to governance, training, testing, and recordkeeping. The
proposed rule would also require certain notifications to the
Commission and customers or counterparties. The Commission is further
proposing guidance relating to the management of risks stemming from
third-party relationships.
DATES: Comments must be received on or before March 2, 2024.
ADDRESSES: You may submit comments, identified by RIN number 3038-AF23,
by any of the following methods:
CFTC Comments Portal: https://comments.cftc.gov. Select
the ``Submit Comments'' link for this rulemaking and follow the
instructions on the Public Comment Form.
Mail: Christopher Kirkpatrick, Secretary of the
Commission, Commodity Futures Trading Commission, Three Lafayette
Centre, 1155 21st Street NW, Washington, DC 20581.
Hand Delivery/Courier: Follow the same instructions as for
Mail, above.
Please submit your comments using only one of these methods.
Submissions through the CFTC Comments Portal are encouraged.
All comments must be submitted in English, or if not, accompanied
by an English translation. Comments will be posted as received to
https://comments.cftc.gov. You should submit only information that you
wish to make available publicly. If you wish the Commission to consider
information that you believe is exempt from disclosure under the
Freedom of Information Act (FOIA), a petition for confidential
treatment of the exempt information may be submitted according to the
procedures established in Commission regulation 145.9.\1\
---------------------------------------------------------------------------
\1\ 17 CFR 145.9. The Commission's regulations are found at 17
CFR chapter I (2022).
---------------------------------------------------------------------------
The Commission reserves the right, but shall have no obligation, to
review, pre-screen, filter, redact, refuse or remove any or all of your
submission from https://comments.cftc.gov that it may deem to be
inappropriate for publication, such as obscene language. All
submissions that have been redacted or removed that contain comments on
the merits of the rulemaking will be retained in the public comment
file and will be considered as required under the Administrative
Procedure Act and other applicable laws, and may be accessible under
the FOIA.
FOR FURTHER INFORMATION CONTACT: Amanda L. Olear, Director, at 202-418-
5283 or [email protected]; Pamela Geraghty, Deputy Director, at 202-418-
5634 or [email protected]; Fern Simmons, Associate Director, at 202-
418-5901 or [email protected]; Elise Bruntel, Special Counsel, at 202-
418-5577 or [email protected]; Market Participants Division, Commodity
Futures Trading Commission, Three Lafayette Centre, 1151 21st Street
NW, Washington, DC 20581.
SUPPLEMENTARY INFORMATION:
Table of Contents
I. Introduction
II. Proposal
A. Generally--Proposed Paragraph (b)
1. Purpose and Scope; Components--Proposed Paragraphs (b)(1) and
(b)(2)
2. Standard--Proposed Paragraph (b)(3)
3. Request for Comment
B. Governance--Proposed Paragraph (c)
1. Approval of Components--Proposed Paragraph (c)(1)
2. Risk Appetite and Risk Tolerance Limits--Proposed Paragraph
(c)(2)
3. Internal Escalations--Proposed Paragraph (c)(3)
4. Consolidated Program or Plan--Proposed Paragraph (c)(4)
5. Request for Comment
C. Information and Technology Security Program--Proposed
Paragraph (d)
1. Risk Assessment--Proposed Paragraph (d)(1)
2. Effective Controls--Proposed Paragraph (d)(2)
3. Incident Response Plan--Proposed Paragraph (d)(3)
4. Request for Comment
D. Third-Party Relationship Program--Proposed Paragraph (e)
1. Third-Party Relationship Lifecyle Stages--Proposed Paragraph
(e)(1)
2. Heightened Requirements for Critical Third-Party Service
Providers--Proposed Paragraph (e)(2)
3. Third-Party Service Provider Inventory--Proposed Paragraph
(e)(3)
4. Retention of Responsibility--Proposed Paragraph (e)(3)
5. Application to Existing Third-Party Relationships
6. Guidance on Third-Party Relationship Programs--Proposed
Paragraph (e)(4); Appendix A to Part 1; Appendix A to Subpart J of
Part 23
7. Request for Comment
E. Business Continuity and Disaster Recovery Plan--Proposed
Paragraph (f)
1. Definition of ``Business Continuity and Disaster Recovery
Plan''
2. Purpose--Proposed Paragraph (f)(1)
3. Minimum Contents--Proposed Paragraph (f)(2)
4. Accessibility--Proposed Paragraph (f)(3)
5. Request for Comment
F. Training and Distribution--Proposed Paragraph (g)
G. Review and Testing--Proposed Paragraph (h)
1. Reviews--Proposed Paragraph (h)(1)
2. Testing--Proposed Paragraph (h)(2)
3. Independence--Proposed Paragraph (h)(3)
4. Documentation--Proposed Paragraph (h)(4)
5. Internal Reporting--Proposed Paragraph (h)(5)
6. Request for Comment
H. Required Notifications--Proposed Paragraphs (i) and (j)
1. Commission Notification of Incidents--Proposed Paragraph
(i)(1)
2. Commission Notification of BCDR Plan Activation--Proposed
Paragraph (i)(2)
3. Notifications to Customers or Counterparties--Proposed
Paragraph (j)
4. Request for Comment
I. Amendment and Expansion of Other Provisions in Current
Commission Regulation 23.603
1. Emergency Contacts--Proposed Paragraph (k)
2. Recordkeeping--Proposed Paragraph (l)
3. Request for Comment
J. Cross-Border Application for Swap Entities
K. Implementation Period
III. Related Matters
A. Regulatory Flexibility Act
B. Paperwork Reduction Act
C. Cost-Benefit Considerations
D. Antitrust Laws
I. Introduction
In 2012 and 2013, the Commission adopted rules requiring that
futures commission merchants (FCMs),\2\ swap dealers (SDs) \3\ and
major swap
[[Page 4707]]
participants (MSPs) \4\ establish risk management programs (RMPs).\5\
The rules require that SDs and MSPs (together, swap entities) and FCMs
design their RMPs to monitor and manage the risks associated with their
activities as swap entities or FCMs.\6\ Such risks include, but are not
limited to, market, credit, liquidity, segregation, settlement,
capital, and operational risk.\7\ Taken together, the RMP rules support
a unified Commission objective: to require FCMs and swap entities
(collectively, covered entities) to establish comprehensive risk
management practices to mitigate systemic risk and promote customer
protection.\8\ Recognizing that covered entities vary in size and
complexity, the RMP rules identify certain elements that must, at a
minimum, be included as part of the RMP, and require that certain risks
must be taken into account; but the rules otherwise allow covered
entities flexibility to design RMPs tailored to their circumstances and
organizational structures.\9\
---------------------------------------------------------------------------
\2\ See 7 U.S.C. 1a(28), 17 CFR 1.3 (defining ``futures
commission merchant'').
\3\ See 7 U.S.C. 1a(49), 17 CFR 1.3 (defining ``swap dealer'').
\4\ See 7 U.S.C. 1a(33), 17 CFR 1.3 (defining ``major swap
participant'').''
\5\ See 17 CFR 1.11; 17 CFR 23.600; Enhancing Protections
Afforded Customers and Customer Funds Held by Futures Commission
Merchants and Derivatives Clearing Organizations, 78 FR 68506 (Nov.
14, 2013) (Final FCM RMP Rule); Swap Dealer and Major Swap
Participant Recordkeeping, Reporting, and Duties Rules; Futures
Commission Merchant and Introducing Broker Conflicts of Interest
Rules; and Chief Compliance Officer Rules for Swap Dealers, Major
Swap Participants, and Futures Commission Merchants, 77 FR 20128
(Apr. 3, 2012) (Final Swap Entities RMP Rule).
\6\ See 17 CFR 1.11(c); 17 CFR 23.600(b). The RMP rule for FCMs
does not apply to FCMs that do not accept or hold customer assets.
See 17 CFR 1.11(a).
\7\ See 17 CFR 1.11(e); 17 CFR 23.600(c).
\8\ See Final Swap Entities RMP Rule, 77 FR at 20128; Final FCM
RMP Rule, 78 FR 68506.
\9\ See, e.g., Regulations Establishing and Governing the Duties
of Swap Dealers and Major Swap Participants, 75 FR 71397, 71399
(Nov. 23, 2010) (Proposed Swap Entities RMP Rule) (``The
Commission's rule has been designed such that the specific elements
of a risk management program will vary depending on the size and
complexity of a [swap entity's] business operations.'').
---------------------------------------------------------------------------
In the decade since the RMP rules were adopted, covered entities
have encountered a wide variety of challenging conditions, including
Brexit, the LIBOR transition, the COVID-19 pandemic stress period, the
invasion of Ukraine, and general interest rate increases to tame
inflation. Throughout this period, the Commission has, through its
various oversight activities, observed that adherence to its RMP rules
has supported covered entities' ability to withstand and recover from
market challenges. The Commission therefore believes the RMP rules have
helped establish a solid foundation of risk management among covered
entities across various risk types, promoting a solid baseline standard
of risk management that reduces overall systemic risk and enhances the
Commission's customer protections.
Nevertheless, the Commission believes it has identified
opportunities to adapt its regulations to further promote sound risk
management practices, reduce risk to the U.S. financial system, and
protect commodity interest customers and counterparties.\10\
Specifically, as it relates to this proposal, the Commission believes
that recent events, noted below, have highlighted the need for more
particularized risk management requirements for covered entities
designed to promote operational resilience. An outcome of the effective
management of operational risk, ``operational resilience'' can be
broadly defined as the ability of a firm to detect, resist, adapt to,
respond to, and recover from operational disruptions.\11\ As the use of
technology and associated third-party service providers have expanded
within the financial sector, so too have the sources of operational
risk facing covered entities, notably the potential for technological
failures and cyberattacks.\12\ The Commission preliminarily believes
that requirements for covered entities directed at promoting sound
practices for managing these risks, as well as the risk of other
potential physical disruptions to operations (e.g., power outages,
natural disasters, pandemics), and for mitigating their potential
impact would not only strengthen individual covered entity operational
resilience but would reduce risk to the U.S. financial system as a
whole and help protect derivatives customers and counterparties.\13\
---------------------------------------------------------------------------
\10\ The Commission recently solicited public comment on an
advanced notice of proposed rulemaking regarding potential
amendments to the RMP requirements. See Risk Management Program
Regulations for Swap Dealers, Major Swap Participants, and Futures
Commission Merchants, 88 FR 45826 (Jul. 18, 2023) (RMP ANPRM). The
comment file is available at https://comments.cftc.gov/PublicComments/CommentList.aspx?id=7412.
\11\ See Proposed Swap Entities RMP Rule, 75 FR 71399, n.12
(defining ``operational risk'' as including ``the risk of loss due
to deficiencies in information systems, internal processes and
staffing, or disruptions from external events that result in the
reduction, deterioration, or breakdown in services or controls
within the firm.''). Several sources have produced definitions of
``operational resilience'' relevant to the financial sector. See
e.g., Board of Governors of the Federal Reserve System (FRB), the
Office of the Comptroller of the Currency (OCC), and the Federal
Deposit Insurance Corporation (FDIC) (together, the prudential
regulators), Sound Practices to Strengthen Operational Resilience at
2 (Oct. 30, 2020) (Prudential Operational Resilience Paper)
(defining ``operational resilience'' as the ``ability to deliver
operations, including critical operations and core business lines,
through a disruption from any hazard.''); Basel Committee on Banking
Supervision (BCBS), Principles for Operational Resilience at 2, 3
(Mar. 31, 2021) (BCBS Operational Resilience Principles) (``ability
of a bank to deliver critical operations through disruption'');
National Institute of Standards and Technology (NIST), Developing
Cyber-Resilient Systems: A Systems Security Engineering Approach, SP
800-160, Vol. 2, Rev. 1 at 76 (Dec. 2021) (``ability of systems to
resist, absorb, and recover from or adapt to an adverse occurrence
during operation that may cause harm, destruction, or loss of
ability to perform mission-related functions.''). Core to each of
these definitions is the notion of being able to continue to operate
or perform despite a disruption.
\12\ See Jason Harrell, Depository Trust & Clearing Corporation
(DTCC) Managing Director, Head of External Engagements,
``Operational and Technology Risk, Evolving Cybersecurity Risks in a
Digitalized Era'' (Sept. 20, 2023) (``While partnerships with third
parties offer rapid solutions for institutions to access the latest
technologies and capabilities, they also increase the surface area
for potential threat actors to gain access to an institution,
causing cyber incidents that can impact the institution's operations
and potentially create additional sector impacts.'').
\13\ Responding to the RMP ANPRM, several commenters suggested
the Commission consider addressing cybersecurity risk independently.
See Americans for Financial Reform Education Fund (AFREF) and Public
Citizen Letter at 6 (Sept. 18, 2023) (AFREF&PC Letter); Better
Markets Letter Re: Risk Management Program Regulations for Swap
Dealers, Major Swap Participants, and Futures Commission Merchants
(RIN 3038-AE59) at 6-9 (Sept. 18, 2023) (Better Markets Letter);
R.J. O'Brien & Associates LLC Letter at 5-6 (Sept. 18, 2023) (R.J.
O'Brien Letter). AFRF and Public Citizen also recommended that the
Commission consider extending its risk management regulations to
encompass third-party service providers for information technology
services. See AFREF&PC Letter at 2.
---------------------------------------------------------------------------
The importance of operational resilience in the financial industry
has come into stark relief in the past few years, particularly
following the COVID-19 pandemic. At the start of the pandemic,
Commission staff initiated near daily in-depth discussions with covered
entities as those registrants navigated the myriad challenges presented
during that time. Through a combination of sustained intensive effort
on the part of the covered entities, and targeted no-action positions
and exemptive relief provided by Commission staff, covered entities
generally continued to operate without material disruption to their
CFTC-regulated activities. As a result of this unprecedented
experience, the Commission considered whether there were additional
opportunities for it to act to gain ongoing transparency into, and to
provide further regulatory support to, covered entities' operational
resilience practices outside of an unfolding crisis. Commission staff
then began the work of assessing the current operational resilience
landscape for covered entities and determining how the Commission could
act to further the holistic consideration and adoption of operational
resilience practices amongst covered entities to ensure that certain
[[Page 4708]]
operational risks impacting their CFTC-regulated activities were being
addressed on an ongoing basis.
In particular, one area of increased focus is cyber risk. In 2022,
cyber intelligence firms reported that the financial sector was among
the most impacted by malicious emails, and was ultimately the most
breached over the course of the year, with more than 566 successful
attacks resulting in 254 million leaked records by early December
2022.\14\ For the past two years, financial institutions responding to
a DTCC risk survey have identified cyber risk as one of the top five
risks to global financial markets, highlighting the increased
sophistication of cyber criminals and the industry's growing digital
footprint as key drivers.\15\ Given that remote access and cloud
computing may become permanent features of the financial markets, the
need for financial institutions to strengthen, adapt, and prioritize
their information and technology risk practices would seem critical to
preserving the continued integrity and stability of U.S. financial
markets.\16\
---------------------------------------------------------------------------
\14\ See Trellix, The Threat Report Fall 2022 at 11 (Nov. 2022)
(noting that the financial services sector was the most targeted by
malicious emails in Q3 of 2022); Flashpoint, Flashpoint Year In
Review: 2022 Financial Threat Landscape (Dec. 20, 2022) (citing
finance and insurance as the most-breached sector in 2022).
\15\ See DTCC, Systemic Risk Barometer Survey: 2023 Risk
Forecast (Dec. 7, 2022); DTCC, Systemic Risk Barometer Survey: 2022
Risk Forecast (Dec. 13, 2021) (naming cyber risk as the top risk to
the economy). See also Bank for International Settlements (BIS),
Financial Stability Institute (FSI), FSI Insights on policy
implementation No. 50, Banks' cyber security--a second generation of
regulatory approaches (June 12, 2023) (FSI Cybersecurity Paper)
(citing a 2023 report that most chief risk officers consider cyber
risk the top threat to the banking industry and the most likely to
result in a crisis or major operational disruption); Federal Bureau
of Investigation, internet Crime Complaint Center Releases 2022
Statistics (Mar. 22, 2023) (``Cyber-enabled crime has been around
for many years, but methods used by perpetrators continue to
increase in scope and sophistication emanating from around the
world.'').
\16\ See FRB, Cybersecurity and Financial System Resilience
Report at 15 (Aug. 2023) (``The rising number of advanced persistent
threats increases the potential for malicious cyber activity within
the financial sector. Combined with the increased internet-based
interconnectedness between financial institutions and the increasing
dependence on third-party service providers, these threats may
result in incidents that affect one or more participants in the
financial services sector simultaneously and have potentially
systemic consequences.'').
---------------------------------------------------------------------------
Covered entities have experienced firsthand how breaches of
information and technology security can reduce their ability to protect
customers. In 2016, for instance, a hacker was able to access customer
records held on an FCM's backup storage device after a default
configuration of that device left it open to infiltration via the
internet.\17\ In 2018, a successful phishing attack on an FCM
compromised customer information and resulted in the FCM's acceptance
of a fraudulent wire request that took $1 million in funds from a
customer's account.\18\ Other regulators have also taken action against
banks registered as swap entities where failed controls and third-party
service providers intersected to result in the significant exposure of
customer information.\19\ Even more recently, a ransomware attack on a
U.S. broker-dealer in November 2023 was so significant, news reports
indicate that the brokerage required a capital injection from a parent
entity to settle $9 billion in trades, an amount many times larger than
its net capital.\20\
---------------------------------------------------------------------------
\17\ See In re AMP Global Clearing LLC, CFTC Docket No. 18-10
(Feb. 12, 2018).
\18\ See In re Phillip Capital Inc., CFTC Docket No. 19-22
(Sept. 12, 2019).
\19\ See, e.g., In re Capital One, N.A. and Capital One Bank
(USA), N.A., AA-EC-20-49 (Aug. 5, 2020) (OCC finding that failed
risk management practices resulted in exposure of 100 million
individual credit card applications, including approximately 140,000
social security numbers, by a former cloud servicer employee); In re
Morgan Stanley Smith Barney LLC, File No. 3-17280 (Jun. 8, 2016)
(Securities and Exchange Commission (SEC) finding that failed risk
management controls allowed an employee to impermissibly access and
transfer data regarding 730,000 accounts to a personal server, which
was ultimately hacked by third parties).
\20\ See Paritosh Bansal, Reuters, ``Inside Wall Street's
scramble after ICBC hack'' (Nov. 13, 2023) (reporting that the firm
asked clients to temporarily suspend business with them and clear
trades elsewhere).
---------------------------------------------------------------------------
Against the backdrop of that work, a recent and well-documented
incident serves as an important cautionary tale about the potential
systemic impact of an operational event at a third-party service
provider. On January 30, 2023, a ransomware attack on ION Markets, a
division of UK-based third-party service provider ION Group LLC (ION),
resulted in a two-week disruption in mid-office activities at several
FCMs. ION provides order management, execution, trading, and trade
processing services for several FCMs, including about 20 percent of
clearing members at the Chicago Mercantile Exchange (CME), but also
provides software services to many other financial institutions,
notably many systemically important banks.\21\ FCMs affected by the
attack had to process trades manually, leading to delays in the timely
and accurate reporting of trade data to the CFTC, and consequently a
temporary lag in production of the Commission's weekly Commitments of
Traders report.\22\ The incident was initially so concerning that Japan
cut off all connectivity with ION.\23\ Within a couple days of the
attack, however, regulators, including the CFTC, coordinated efforts to
determine that the attack was limited to a small number of software
applications relied on within the cleared derivatives space by about
forty-two (42) institutions, with no significant impact to systemically
important banks.\24\
---------------------------------------------------------------------------
\21\ See Luke Clancy, Risk.net, ``One-fifth of CME clearing
members hit by Ion hack'' (Mar. 9, 2023); see also Statement of Todd
Conklin, Deputy Assistant Secretary, Department of the Treasury
(Treasury), Office of Cybersecurity and Critical Infrastructure
Protection (OCCIP), The Cyber Threat Landscape for Financial
Markets: Lessons Learned from ION Markets, Cloud Use in Financial
Services, and Beyond, CFTC Technology Advisory Committee Meeting
Transcript at 160-166 (Mar. 22, 2023) (Conklin TAC Presentation)
(describing the potential ``sprawling impact zone'' had the ION
incident not been limited to its derivatives software services),
available at https://www.cftc.gov/sites/default/files/2023/07/1688400024/tac_032223_transcript.pdf.
\22\ CFTC, Statement on ION and the Impact to the Derivatives
Markets (Feb. 2, 2023), available at https://www.cftc.gov/PressRoom/SpeechesTestimony/cftcstatement020223. The Commitment of Traders
report is widely relied on by market participants for insight into
positions held on exchange-traded futures and options.
\23\ See Conklin TAC Presentation (Mar. 22, 2023).
\24\ Id.
---------------------------------------------------------------------------
During a March 8, 2023, meeting of the CFTC's Market Risk Advisory
Committee (MRAC), panelists discussed how the collaborative work of the
CFTC, industry, and self-regulatory organizations (including CME, the
National Futures Association (NFA), and the Financial Industry
Regulatory Authority (FINRA)) helped mitigate the impact of the ION
incident, allowing affected firms to return to business as usual within
a couple weeks.\25\ Nevertheless, panelists agreed that the incident
highlighted the interconnectedness of the derivatives markets and the
need for firms to continue to adapt safeguards to address the ever-
evolving threat landscape.\26\ As the ION incident demonstrates, a
[[Page 4709]]
disruptive cyber event can reach beyond particular financial
institutions directly experiencing events to other institutions in the
financial markets or to others doing business with an impacted
financial institution, and could potentially impact financial
stability.\27\
---------------------------------------------------------------------------
\25\ See CFTC, The Market Risk Advisory Committee to Meet on
March 8 (Mar. 8, 2023) (MRAC Meeting), available at https://www.cftc.gov/PressRoom/Events/opaeventmrac030823; see also Conklin
TAC Presentation (discussing how Treasury implemented its cyber
incident response playbook in the days following the ION incident to
mitigate the potential for panic after news reports began
circulating information that the incident was more significant than
regulators had initially determined it was).
\26\ See Statement of Walt Lukken, President and Chief Executive
Officer, Futures Industry Association (FIA), MRAC Meeting Transcript
at 41 (``While the number of clearing firms that use ION's suite of
clearing products is limited, the interconnectedness of our markets
made the outage impactful throughout the entirety of our
marketplace.''); see also Statement of Tom W. Sexton, III, President
and Chief Executive Officer, NFA, MRAC Meeting Transcript at 46
(``[O]ur member firms have adopted robust safeguards already that
need to be adapted in light of today's and tomorrow's ongoing
challenges and threats.'').
\27\ See FIA, FIA Taskforce on Cyber Risk, After Action Report
and Findings at 3 (Sept. 2023) (FIA Taskforce Report) (``The [ION
incident] demonstrated that an outage at a single service provider
can have damaging effects across a wide range of firms and threaten
the orderly functioning of markets. The attack also demonstrated in
vivid detail the complexities of restoring normal service.'').
---------------------------------------------------------------------------
In light of these and other events, the Commission believes that
customer protection and the broader stability of the derivatives
markets at large warrant more targeted CFTC requirements relating to
the management of operational risk designed to promote operational
resilience.\28\ Specifically, the Commission believes that the absence
of CFTC-specific requirements for covered entities that explicitly
address information and technology security, as well as third-party
risk, could impede the Commission's ability to fulfill its regulatory
oversight obligations with respect to covered entities and ultimately
weaken its ability to address systemic risk, protect customer assets,
and promote responsible innovation.\29\ The Commission further believes
that enhanced CFTC oversight of covered entities with respect to
operational resilience would help improve outcomes following
operational disruptions by giving the Commission the ability to ensure
that covered entities have actionable plans in place to address key
operational risks.
---------------------------------------------------------------------------
\28\ Existing CFTC requirements for covered entities relating to
operational risk or information security are more general in nature
or limited in application. See, e.g., 17 CFR 1.11(e)(3)(ii)
(providing, with respect to operational risk, that FCMs have
automated financial risk management controls reasonably designed to
prevent the placing of erroneous orders); Enhancing Protections
Afforded Customers and Customer Funds Held by Futures Commission
Merchants and Derivatives Clearing Organizations, 77 FR 67866, 67906
(Nov. 14, 2012) (describing Commission regulation 1.11(e)(3)(ii) as
requiring an FCM's RMP to include automated financial risk
management controls in order to reduce operational risk that could
result from ``fat finger'' errors when submitting trades, or from
technological ``glitches'' using automated trading); 17 CFR
23.600(c)(4)(vi) (requiring swap entities to take into account,
among other things, secure and reliable operating and information
systems with adequate, scalable capacity, and independence from the
business trading unit; safeguards to detect, identify, and promptly
correct deficiencies in operating and information systems; and
reconciliation of all data and information in operating and
information systems); 17 CFR 162.21 and 17 CFR 160.30 (requiring
covered entities to adopt written policies and procedures addressing
administrative, technical, and physical safeguards with respect to
the information of consumers).
\29\ See 7 U.S.C. 5 (establishing among the purposes of the
Commodity Exchange Act to deter disruptions to market integrity, to
ensure the financial integrity of covered transactions and the
avoidance of systemic risk, and to promote responsible innovation
and fair competition among market participants).
---------------------------------------------------------------------------
II. Proposal
Section 4s(j)(2) of the Commodity Exchange Act (CEA or Act)
expressly requires swap entities to establish robust and professional
risk management systems adequate for managing their day-to-day
business.\30\ Section 4s(j)(7) further directs the Commission to
prescribe rules governing the duties of swap entities, including the
duty to establish risk management systems, which would include the
management of operational risk.\31\ The Commission is authorized to
promulgate operational risk management requirements for FCMs pursuant
to section 8a(5) of the CEA, which authorizes the Commission to make
and promulgate such rules and regulations as, in the judgment of the
Commission, are reasonably necessary to effectuate any of the
provisions of, or to accomplish any of the purposes of, the CEA.\32\
This general rulemaking authority may be used to prevent problems
before they arise in the agency's blind spots,\33\ and may be exercised
to regulate circumstances or parties beyond those explicated in a
statute.\34\ Accordingly, the Commission has broad authority to
promulgate regulations provided that such regulations are supported by
a sufficient nexus to the CFTC's delegated authority. Specifically,
Congress expressly empowered the Commission to prescribe certain
requirements with respect to FCMs, namely, to require FCMs to register
(sections 8a(1), 4d(a)(1), and 4f(a)(1) of the CEA \35\); to segregate
customer funds (section 4d of the CEA \36\); to establish safeguards to
minimize conflicts of interest (section 4d of the CEA \37\); to meet
minimum financial requirements (section 4f of the CEA \38\); to manage
and maintain records and reporting on the financial and operational
risks of affiliates (section 4f of the CEA \39\); and to establish
administrative, technical, and physical safeguards to protect the
security and confidentiality of certain nonpublic personal information
(section 5g of the CEA \40\), among other requirements.
---------------------------------------------------------------------------
\30\ See 7 U.S.C. 6s(j)(2).
\31\ See 7 U.S.C. 6s(j)(7).
\32\ 7 U.S.C. 12a(5).
\33\ Inv. Co. Inst. v. CFTC, 891 F. Supp. 2d 162, 193 (D.D.C.
2012), as amended (Jan. 2, 2013) (citing Stilwell v. Office of
Thrift Supervision, 569 F.3d 514, 519 (D.C. Cir. 2009)).
\34\ Nat'l Ass'n of Mfrs. v. SEC, 748 F.3d 359, 366 (D.C. Cir.
2014), overruled on other grounds by Am. Meat Inst. v. U.S. Dept. of
Agric., 760 F.3d 18 (D.C. Cir. 2014) (en banc).
\35\ 7 U.S.C. 12a(1); 7 U.S.C. 6d(a)(1); 7 U.S.C. 6f(a)(1).
\36\ 7 U.S.C. 6d.
\37\ Id.
\38\ 7 U.S.C. 6f.
\39\ Id.
\40\ See 7 U.S.C. 7b-2; 15 U.S.C. 6801.
---------------------------------------------------------------------------
The Commission believes that more particularized operational risk
management requirements are reasonably necessary to help effectuate
these statutory requirements for FCMs and to accomplish the purposes of
the CEA. FCMs play an important role in the derivatives markets,
serving as both the primary point of access to the cleared commodity
interest markets for customers and the custodian of the funds used to
maintain their positions. Given their position at the center of the
derivatives market ecosystem, FCMs' operational resilience is essential
to well-functioning derivatives markets and to ensuring that customers
receive the protections provided by the CEA. However, as discussed
above, operational risks, notably cyber and third-party risks, have
become an increasing threat to financial institutions, including FCMs.
These risks can cause major disruptions to FCMs' operations, and
consequently impact the ability of FCMs to fulfill their obligations as
Commission registrants. In particular, information security threats and
operational disruptions can place an FCM's financial resources at risk;
disrupt an FCM's ability to segregate and protect customer funds;
impede accurate recordkeeping, including records related to customer
funds; and cause a host of other issues for FCMs, which ultimately
inure to the detriment of their customers and the derivatives markets.
Accordingly, the Commission believes a comprehensive operational
resilience regime is reasonably necessary to ensure that an FCM
adequately addresses and mitigates risks that could adversely impact
its ability to operate and fulfill its statutory obligations and duties
as an FCM.
As discussed in detail in subsequent sections of this release, the
Commission is proposing to require that FCMs and swap entities
establish an Operational Resilience Framework (ORF) that is reasonably
designed to identify, monitor, manage, and assess risks relating to
information and technology security, third-party relationships, and
emergencies or other significant disruptions to normal business
operations. At its core, the ORF would have three key components: an
[[Page 4710]]
information and technology security program, a third-party relationship
program, and a business continuity and disaster recovery plan. The
proposed ORF rule reflects a principles-based approach buttressed by
certain minimum requirements specific to each of the component programs
or plans, such as requiring an annual risk assessment and controls
relating to information and technology security, and due diligence and
monitoring requirements for third-party service providers. Proposed
requirements relating to governance, training, testing, and
recordkeeping would apply broadly and support the ORF as a whole. The
proposed rule would further require covered entities to notify the
Commission (and, in certain instances, customers or counterparties) of
certain ORF-related events. Detailed guidance intended to assist
covered entities in designing and implementing their third-party
relationship program would be included in appendices to the rule.
In developing the proposed rule, the Commission endeavored to
incorporate general directives to federal agencies articulated in the
White House's March 2023 National Cybersecurity Strategy: Leverage
existing standards and guidance, harmonize where sensible and
appropriate to achieve better outcomes, and demonstrate an approach
that is sufficiently nimble to meet the challenges of the ever-evolving
technological threat landscape and fit the unique business and risk
profile of each covered entity.\41\ To that end, the proposal builds on
the Commission's experience establishing system safeguard requirements
for registered entities, as well as the approaches adopted by self-
regulatory organizations and other regulatory authorities.\42\ Notably,
the proposal draws on approaches adopted by NFA, whose rules and
interpretative notices relating to information systems security, third-
party risk, and business continuity and disaster recovery planning
apply to covered entities by virtue of being NFA members, and
prudential regulators, who also regulate many covered entities, and
have recently issued interagency positions on operational resilience
and third-party relationship management.\43\
---------------------------------------------------------------------------
\41\ The White House, National Cybersecurity Strategy at 8-9
(Mar. 2023) (National Cyber Strategy) (``Our strategic environment
requires modern and nimble regulatory frameworks for cybersecurity
tailored for each sector's risk profile, harmonized to reduce
duplication, complementary to public-private collaboration, and
cognizant of the cost of implementation.''). See also FIA Taskforce
Report, supra note 27, at 9 (``[T]he Taskforce encourages regulators
and legislators to take a principles-based approach to cyber risk
and operational resilience. That approach may not be sufficient in
all areas, but such a flexible approach is well suited to a threat
landscape that is likely to continue evolving at a rapid rate.'').
\42\ See 17 CFR 37.1400 and 17 CFR 37.1401 (system safeguard
requirements for swap execution facilities (SEFs)); 17 CFR 38.1050
and 17 CFR 38.1051 (designated contract markets (DCMs)); 17 CFR
39.18 (derivatives clearing organizations (DCOs)); 17 CFR 49.24
(swap data repositories (SDRs)). See also 17 CFR 1.3 (defining
``registered entity'' to include DCMs, DCOs, SEFs, and SDRs). For a
summary of international regulatory efforts related to operational
resilience, see FIA Taskforce Report, supra note 27, at 7-8.
\43\ See NFA Interpretive Notice 9070, NFA Compliance Rules 2-9,
2-36 and 2-49: Information Systems Security (rev. Sept. 30, 2019)
(NFA ISSP Notice); NFA Interpretive Notice 9079, NFA Compliance
Rules 2-9 and 2-36: Members' Use of Third-Party Service Providers
(NFA Third-Party Notice) (effective Sept. 30, 2021); NFA Rule 2-38:
Business Continuity and Disaster Recovery Plan (rev. July 1, 2019);
NFA Interpretive Notice 9052, NFA Compliance Rule 2-38: Business
Continuity and Disaster Recovery Plan (NFA BCDR Notice) (April 7,
2003); Prudential Operational Resilience Paper, supra note 11;
Interagency Guidance on Third-Party Relationships: Risk Management,
88 FR 37920 (Jun. 9, 2023) (Prudential Third-Party Guidance). See
also Computer-Security Incident Notification Requirements for
Banking Organizations and their Bank Service Providers, 86 FR 66424
(Nov. 23, 2021); 12 CFR part 30, app. A (Interagency Guidelines
Establishing Standards for Safety and Soundness), 12 CFR part 30,
app. B (Interagency Guidelines Establishing Information Security
Standards).
---------------------------------------------------------------------------
The Commission also surveyed the work of international standard-
setting bodies, notably the BCBS Principles for Operational
Resilience.\44\ The Commission also conferred with, and reviewed the
standards published by the National Institute of Standards and
Technology (NIST), a part of the U.S. Department of Commerce charged by
Executive Order 13636 in 2013 with developing a framework to reduce
cyber risks to critical infrastructure that incorporates voluntary
consensus standards and industry best practices.\45\ Standards
developed in response to this charge and reviewed by the Commission
include the Framework for Improving Critical Infrastructure
Cybersecurity and the Security and Privacy Controls for Information
Systems and Organizations, among others.\46\ The Commission and other
financial regulators have previously adapted NIST's standards in
regulation and guidance related to operational resilience. The
Commission's system safeguards requirements treat NIST's CSF as a
source for well-established best practices for cybersecurity.\47\ In
Appendix A of the Interagency Sound Resilience Paper, the prudential
regulators presented ``a collection of sound practices for cyber risk
management, aligned to NIST and augmented to emphasize governance and
third-party risk management.'' \48\ The Commission also considered
standards published by equivalent standard setting bodies like the
International Standards Organization (ISO).\49\
---------------------------------------------------------------------------
\44\ See BCBS Operational Resilience Principles, supra note 11.
See also International Organization of Securities Commissions
(IOSCO), Cyber Task Force: Final Report (2019) (identifying
different but comparable core standards or frameworks, including
both NIST and ISO standards); Financial Stability Board (FSB), Final
report on Enhancing Third-Party Risk Management and Oversight--a
toolkit for financial institutions and financial authorities (Dec.
4, 2023) (FSB Third-Party Report). Materials related to the FSB's
work on cyber resilience are available at https://www.fsb.org/work-of-the-fsb/financial-innovation-and-structural-change/cyber-resilience/.
\45\ See The White House, Office of the Press Secretary,
Executive Order--Improving Critical Infrastructure Cybersecurity,
E.O. 13636 (Feb. 12, 2013).
\46\ See NIST, Framework for Improving Critical Infrastructure
Cybersecurity (Version 1.1) at 2 (Apr. 16, 2018) (NIST CSF); NIST,
SP 800-53, Security and Privacy Controls for Information Systems and
Organizations (Sept. 2020, rev. Dec. 10, 2020) (NIST SP 800-53). See
also Cybersecurity & Infrastructure Security Agency (CISA),
Financial Services Sector-Specific Plan--2015 at 16 (rev. Dec. 17,
2020) (``While the [NIST cybersecurity framework] is designed to
manage cybersecurity risks, its core functions of Identify, Protect,
Detect, Respond, and Recover provide a model for considering
physical risks as well. This methodology is increasingly central to
the sector's thinking on security and resilience, and the concept
aligns with existing [Federal Financial Institutions Examination
Council (FFIEC)] guidance.'').
\47\ System Safeguards Testing Requirements for Derivatives
Clearing Organizations, 81 FR 64322, 64329 (Sept. 19, 2016).
\48\ Board of Governors of the Federal Reserve System, the
Office of the Comptroller of the Currency, and the Federal Deposit
Insurance Corporation, Sound Practices to Strengthen Operational
Resilience (Nov. 2, 2020), available at https://www.federalreserve.gov/supervisionreg/srletters/SR2024.html.
\49\ See, e.g., ISO/IEC 27001:2022, Information security,
cybersecurity and privacy protection: Information security controls
(Oct. 2022) (ISO/IEC 27001:2022).
---------------------------------------------------------------------------
Finally, in putting together the proposal, Commission staff engaged
with staff at NFA and various federal agencies, including prudential
regulators, and the SEC.\50\ Based on these efforts, the Commission
preliminarily believes that, if adopted, the proposed rule would strike
an
[[Page 4711]]
appropriate balance between supporting technological and market
innovation and fair competition, ensuring covered entities devote the
necessary thought, planning, and resources to their operational
resilience so as to support the resilience of the U.S. derivatives
markets and the financial sector as a whole.\51\
---------------------------------------------------------------------------
\50\ In accordance with section 712(a) of the Dodd-Frank Act (15
U.S.C. 8302), the Commission has consulted and coordinated, to the
extent possible, with the SEC and the prudential regulators,
including with the FRB, the OCC, and the FDIC, for purposes of
assuring regulatory consistency and comparability. The Securities
Exchange Act of 1934 and existing and proposed SEC regulations
include requirements relating to risk management including
cybersecurity, including requirements for SEC-regulated broker-
dealers and security-based swap dealers. See, e.g. Cybersecurity
Risk Management Rule for Broker-Dealers, Clearing Agencies, Major
Security-Based Swap Participants, the Municipal Securities
Rulemaking Board, National Securities Associations, National
Securities Exchanges, Security-Based Swap Data Repositories,
Security-Based Swap Dealers, and Transfer Agents, 88 FR 20212,
sections IV.C.1.b.i and IV.C.1.b.iii (Apr. 5, 2023).
\51\ See 7 U.S.C. 5.
---------------------------------------------------------------------------
The Commission is proposing to codify the ORF rule for swap
entities in existing Commission regulation 23.603, which currently
contains the Commission's business continuity and disaster recovery
requirements for swap entities.\52\ As discussed in greater detail
below, the Commission is proposing to retain the substance of the
existing business continuity and disaster recovery requirements in
current Commission regulation 23.603 as part of the ORF rule for swap
entities, with certain modifications. Similar requirements would also
be imposed on FCMs. The proposed ORF rule for FCMs would be codified in
new Commission regulation 1.13. The proposed guidance on third-party
relationships would be included in the appendices to parts 1 and 23 for
FCMs and swap entities, respectively.
---------------------------------------------------------------------------
\52\ 17 CFR 23.603.
---------------------------------------------------------------------------
As proposed, the regulatory text of the ORF rule for swap entities
is nearly identical in structure and substance to the ORF rule for
FCMs. Accordingly, to promote readability, when referencing sections of
the regulatory text, this notice generally refers to the relevant
paragraph of the proposed regulations (i.e., ``proposed paragraph (b)''
would refer to paragraph (b) of both proposed Commission regulations
1.13 and proposed Commission regulation 23.603).
The Commission invites comment on all aspects of the proposed rule,
as further detailed below.
A. Generally--Proposed Paragraph (b) 53
---------------------------------------------------------------------------
\53\ Paragraph (a) of proposed Commission regulations 1.13 and
23.603 provides definitions for terms used within the ORF rule. Each
proposed definition is discussed in the context of the relevant
substantive regulatory requirement throughout the remainder of this
notice.
---------------------------------------------------------------------------
1. Purpose and Scope; Components--Proposed Paragraphs (b)(1) and (b)(2)
As previously mentioned, the proposed rule would require covered
entities to establish, document, implement, and maintain an Operational
Resilience Framework, or ORF.\54\ The ORF would need to be reasonably
designed to identify, monitor, manage, and assess risks relating to
three key risk areas that challenge operational resilience: (i)
information and technology security, as defined in the proposed rule
and discussed further below; (ii) third-party relationships; and (iii)
emergencies or other significant disruptions to the continuity of
normal business operations as a covered entity.\55\ Although these risk
areas are often viewed distinctly, as the introduction to this notice
illustrates, they are significantly interrelated, as the relative
strength of information and technology security and third-party risk
management can directly affect recovery activities and improve outcomes
following an emergency or other significant disruption.\56\ Together,
the Commission believes they represent important sources of potential
operational risk, the effective management of which is key to
operational resilience.
---------------------------------------------------------------------------
\54\ See paragraph (b)(1) of proposed Commission regulations
1.13 and 23.603.
\55\ See paragraphs (b)(1)(i)-(iii) of proposed Commission
regulations 1.13 and 23.603.
\56\ See, e.g., ISO/IEC 27031:2011, Information technology--
Security techniques--Guidelines for information and communication
technology readiness for business continuity (Mar. 2011) (``Failures
of [information and communication technology (ICT)] services,
including the occurrence of security issues such as systems
intrusion and malware infections, will impact the continuity of
business operations. Thus, managing ICT and related continuity and
other security aspects form a key part of business continuity
requirements. Furthermore, in the majority of cases, the critical
business functions that require business continuity are usually
dependent upon ICT. This dependence means that disruptions to ICT
can constitute strategic risks to the reputation of the organization
and its ability to operate . . . As a result, effective [business
continuity management] is frequently dependent upon effective ICT
readiness to ensure that the organization's objectives can continue
to be met in times of disruptions.''). See Prudential Operational
Resilience Paper, supra note 11, at 8 (``Secure and resilient
information systems underpin the operational resilience of a firm's
critical operations and core business lines.''); see also Prudential
Third-Party Guidance, 88 FR 37920 (discussing the interplay of
third-party risks and operational resilience).
---------------------------------------------------------------------------
The proposed rule would require covered entities to establish three
written component programs or plans, each dedicated to addressing one
of the three enumerated risks within the ORF. The three component
programs or plans would be: (i) an information and technology security
program, (ii) a third-party relationship program, and (iii) a business
continuity and disaster recovery plan.\57\ Each component program or
plan would need to be supported by written policies and procedures and
meet the requirements set forth in the rule, as discussed in subsequent
sections of this notice.\58\ The definitions and specific requirements
for the information and technology security program, the third-party
relationship program, and the business continuity and disaster recovery
plan are discussed in detail in subsequent sections of this notice
specifically dedicated to discussing each of the three components.\59\
---------------------------------------------------------------------------
\57\ See paragraph (b)(2) of proposed Commission regulations
1.13 and 23.603; see also paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ``information and technology
security program,'' ``third-party relationship program,'' and
``business continuity and disaster recovery plan'').
\58\ See paragraph (b)(2) of proposed Commission regulations
1.13 and 23.603. See paragraphs (d) (information and technology
security program), (e) (third-party relationship program), and (f)
(business continuity and disaster recovery plan) of proposed
Commission regulations 1.13 and 23.603 (describing the requirements
for each program, respectively).
\59\ See sections II.C (information and technology security
program), II.D (third-party relationship program), II.E (business
continuity and disaster recovery plan) of this notice, infra.
---------------------------------------------------------------------------
Although they may go by different names, the Commission understands
that written programs or plans of these types are generally recognized
as common ways to address these risks and are even currently required
of covered entities. NFA, for instance, currently requires members to
adopt a written information systems security program (ISSP), a written
supervisory framework to address outsourcing to third-party service
providers, and a written business continuity and disaster recovery
plan.\60\ The Commission itself requires swap entities to have a
written business continuity and disaster recovery plan.\61\
Accordingly, to the extent that covered entities have existing programs
or plans and policies and procedures that address the requirements of
the ORF rule, by virtue of other regulatory requirements or otherwise,
the Commission would not expect such covered entities to adopt entirely
new component programs or plans. The Commission would only expect that
covered entities review their existing programs and plans to ensure
they meet the minimum requirements of the ORF rule and make any
necessary amendments.
---------------------------------------------------------------------------
\60\ See NFA ISSP Notice, supra note 43; NFA Third-Party Notice,
supra note 43; and NFA BCDR Notice, supra note 43. NFA's requirement
to establish a business continuity and disaster recovery plan does
not currently apply to swap entities, see NFA Rule 2-38, paragraph
(a), supra note 43.
\61\ See 17 CFR 23.603.
---------------------------------------------------------------------------
The Commission appreciates that covered entities may assign
responsibility for the establishment, implementation, and maintenance
of each ORF component program or plan to distinct functions within
their organizations. By structuring the proposed rule to require a
``framework'' directed at operational resilience,
[[Page 4712]]
however, the Commission intends for executive leadership at covered
entities to address the risk areas covered by the ORF as a cohesive and
interrelated whole, breaking down any unnecessary internal silos, and
to consider all aspects of operational resilience in determining their
operational strategies, risk appetite, and risk tolerance limits.\62\
---------------------------------------------------------------------------
\62\ The specific governance requirements of the proposed rule,
which include the requirement to establish risk appetite and risk
tolerance limits with respect to the ORF, further support this view.
See paragraph (c) of proposed Commission regulations 1.13 and
23.603.
---------------------------------------------------------------------------
2. Standard--Proposed Paragraph (b)(3)
The Commission is proposing to require that each covered entity
implement the requirements of the proposed ORF rule in a manner that is
appropriate and proportionate to the nature, scope, complexity, and
risk profile of its business activities as a covered entity, following
generally accepted standards and best practices (the (b)(3)
standard).\63\ The proposed (b)(3) standard reflects the general
principles-based approach underpinning the proposed rule, which the
Commission believes would be appropriate given the increased reliance
on and rapid evolution of technology within the financial industry and
its attendant risks.\64\ This standard incorporates two themes that
have broad support from other governmental and international standard-
setting bodies when addressing matters related to operational
resilience: (i) proportionality; and (ii) reliance on established
standards and best practices.\65\
---------------------------------------------------------------------------
\63\ See paragraph (b)(3) of proposed Commission regulations
1.13 and 23.603.
\64\ See BCBS Operational Resilience Principles, supra note 11,
at 1 (``Recognising that a range of potential hazards cannot be
prevented, the Committee believes that a pragmatic, flexible
approach to operational resilience can enhance the ability of banks
to withstand, adapt to and recover from potential hazards and
thereby mitigate potentially severe adverse impacts.''); see also
Prudential Operational Resilience Paper, supra note 11, at 9
(providing as a sound practice of operational resilience that firms
review information systems ``on a regular basis against common
industry standards and best practices.'').
\65\ See, e.g., BCBS Operational Resilience Principles at 2-3
(``The principles for operational resilience set forth in this
document are largely derived and adapted from existing guidance that
has been issued by the Committee or national supervisors over a
number of years. The Committee recognizes that many banks have well
established risk management processes that are appropriate for their
individual risk profile, operational structure, corporate governance
and culture, and conform to the specific risk management
requirements of their jurisdictions. By building upon existing
guidance and current practices, the Committee is issuing a
principles-based approach to operational resilience that will help
to ensure proportional implementation across banks of various size,
complexity and geographical location.''); FSB Third-Party Report,
supra note 44, at 10-11; IOSCO, Principles on Outsourcing: Final
Report at 10 (IOSCO Outsourcing Report) (Oct. 2021) (providing that
``[t]he application and implementation of these Principles should be
proportional to the size, complexity and risk posed by the
outsourcing'' of tasks, functions, processes, services, or
activities to a service provider that would otherwise be undertaken
by the regulated entity itself).
---------------------------------------------------------------------------
Broadly speaking, the principle of proportionality recognizes that
operational resilience, and information and technology security, in
particular, cannot be addressed with a one-size-fits-all approach.\66\
On the contrary, differences in operational structures and business
strategies among covered entities necessitate a more flexible and
adaptive approach that would allow individual covered entities to best
address their specific risks and evolve to address emerging challenges
as they arise. Covered entities vary widely in terms of their business
structure and risk profiles, such that a covered entity operating
within a large bank holding company group structure and involved in a
broad array of asset classes would likely have a different risk profile
and different resources than an entity that is solely registered with
the CFTC or that has a narrower scope to its CFTC-regulated business.
The Commission would therefore expect that covered entities facing
different operational risks may take different approaches to managing
and monitoring those risks. Designing an operational resilience
framework that would apply uniformly across all covered entities would
not only pose significant challenges, it would likely be ineffective,
imposing operational costs where no risks demand it. Accordingly, the
Commission preliminarily believes that a proportional, risk-based
approach would help ensure that firms, customers, counterparties, and
the financial system at large can appropriately respond to and recover
from operational shocks in context.
---------------------------------------------------------------------------
\66\ See e.g., FINRA, 2018 Report on Selected Cybersecurity
Practices at 1 (Dec. 2018) (FINRA Cybersecurity Report) (``[T]here
is no one-size-fits-all approach to cybersecurity.''); NIST CSF,
supra note 46, at 2 (``The [NIST CSF] is not a one-size-fits-all
approach to managing cybersecurity risk for critical infrastructure.
Organizations will continue to have unique risks--different threats,
different vulnerabilities, different risk tolerances.'').
---------------------------------------------------------------------------
Interpretive notices adopted by NFA reflect a comparable approach.
Specifically, NFA's notices on ISSPs and the use of third-party service
providers establish general, baseline requirements (e.g., assess risks
associated with the use of information technology systems or with
reliance on third-party service providers) and then direct NFA members,
including covered entities, to tailor the specifics to their
businesses.\67\ This approach is also consistent with the CFTC's own
approach with respect to system safeguard requirements for registered
entities,\68\ as well as those of the prudential regulators.\69\
Generally accepted standards and best practices themselves also
generally support a proportional approach.\70\
---------------------------------------------------------------------------
\67\ See NFA ISSP Notice, supra note 43 (requiring each NFA
member to adopt an ISSP appropriate to the its ``size, complexity of
operations, type of customers and counterparties, the sensitivity of
the data accessible within its systems, and its electronic
interconnectivity with other entities''); NFA Third-Party Notice,
supra note 43 (``NFA recognizes that a Member must have flexibility
to adopt a written supervisory framework relating to outsourcing
functions to a [third-party service provider] that is tailored to a
Member's specific needs and business . . .'').
\68\ See, e.g., 17 CFR 37.1401(b) (SEFs); 17 CFR 38.1051(b)
(DCMs); 17 CFR 39.18(b)(3) (DCOs); 17 CFR 49.24(c) (SDRs) (requiring
registered entities to follow generally accepted standards and best
practices with respect to the development, operation, reliability,
security, and capacity of automated systems); see also System
Safeguards Testing Requirements for Derivatives Clearing
Organizations, 81 FR 64322, 64329 (Sept. 19, 2016) (DCO System
Safeguards Testing Requirements) (describing the CFTC's approach to
system safeguards for DCOs as providing DCOs with ``flexibility to
design systems and testing procedures based on the best practices
that are most appropriate for that DCO's risks'').
\69\ 12 CFR part 30, app. B (Interagency Guidelines Establishing
Information Security Standards); id. at II.A. (Information Security
Program) (``Each [financial institution] shall implement a
comprehensive written information security program that includes
administrative, technical, and physical safeguards appropriate to
the size and complexity of the [financial institution] and the
nature and scope of its activities.''); FFIEC Information Technology
Examination Handbook, Information Security at 2 (Sept. 2016) (FFIEC
Information Security Booklet) (``Institutions should maintain
effective information security programs commensurate with their
operational complexities.'').
\70\ The NIST CSF, for example, identifies activities designed
to achieve specific cybersecurity outcomes and tiers practices by
increasing degree of rigor and sophistication. In selecting a tier,
NIST directs entities to consider their ``current risk management
practices, threat environment, legal and regulatory requirements,
information sharing practices, business/mission objectives, supply
chain cybersecurity requirements, and organizational constraints.''
See NIST CSF, supra note 46, at 8.
---------------------------------------------------------------------------
The Commission emphasizes, however, that ``proportional'' does not
mean ``permissive.'' The Commission's proposed standard for the ORF
rule would not support a ``race to the bottom,'' where covered entities
default to the minimum requirements of the proposed rule. On the
contrary, covered entities would be required to implement an ORF that
is reasonably designed to reflect and address their unique risk profile
and activities, consistent with the proposed (b)(3) standard.
Accordingly, the Commission would expect larger, more complex entities
that operate more varied business lines, rely on more technological
platforms, or
[[Page 4713]]
have more complicated agreements with third-party service providers to
arrive at an ORF that is appropriate to their likely increased level of
operational risk.\71\
---------------------------------------------------------------------------
\71\ See National Cyber Strategy, supra note 41, at 4 (``The
most capable and best-positioned actors in cyberspace must be better
stewards of the digital ecosystem.''); see also IOSCO Outsourcing
Report, supra note 65, at 10.
---------------------------------------------------------------------------
The requirement for covered entities to follow generally accepted
standards and best practices serves to ground covered entities'
approaches to operational resilience in practices that are widely
recognized as effective in aiding financial institutions to mitigate
and recover from operational shocks. In adopting system safeguard
requirements for registered entities, which require registered entities
to follow generally accepted standards and best practices, the
Commission identified several sources of standards and best
practices.\72\ NFA and other bodies have compiled similar lists.\73\
Among perhaps the most commonly relied on by financial institutions are
the NIST CSF, ISO, the Center for internet Security (CIS), and FFIEC,
whose examination booklets and Cyber Assessment Tool (CAT) are
specifically designed to guide financial institutions.\74\ The
Commission would expect covered entities to use generally accepted
standards and industry best practices that are appropriate and
proportionate to the nature, size, scope, complexities, and risk
profile of their business activities, in designing or updating an ORF
that would comply with the proposed rule. For instance, in conducting
the risk assessment required under proposed paragraph (c)(1), a covered
entity would need to identify risks to its information and technology
security with reference to risks discussed in an appropriate standard
or based on industry best practices, and then assess and prioritize
those risks using frameworks and metrics recommended by those standards
or practices. Requiring covered entities to follow generally accepted
standards and industry best practices in developing and implementing
the ORF would help ensure that covered entities establish, document,
implement, and maintain ORFs reasonably designed to address their
particular operational resilience-related risks.
---------------------------------------------------------------------------
\72\ See, e.g., DCO System Safeguards Testing Requirements, 81
FR 64322-23; 17 CFR 39.18(b)(3) (requiring DCOs to follow generally
accepted standards and best practices with respect to the
development, operation, reliability, security, and capacity of
automated systems); see also 17 CFR 37.1401(b) (SEFs) (requiring the
same); 17 CFR 38.1051(b) (DCMs) (same); 17 CFR 49.24(c) (SDRs)
(same).
\73\ See, e.g., NFA, Cybersecurity FAQs, ``Does NFA recommend
any particular consultants that can help a Member draft an ISSP or
perform penetration testing?''; see also FFIEC, Cybersecurity
Resource Guide for Financial Institutions (Sept. 2022) (rev. Nov.
2022).
\74\ The Financial Services Sector Coordinating Council (FSSC)
has also developed a NIST CSF profile specifically designed for
financial institutions. The profile is now maintained, updated, and
managed by the Cyber Risk Institute (CRI) and was last updated in
January 2023. See CRI Profile v1.2 (Dec. 14, 2021), available at
https://cyberriskinstitute.org/the-profile/.
---------------------------------------------------------------------------
The proposed rule leverages these standards not only by directing
covered entities to consider them in developing their approaches but by
incorporating common themes contained within them into the substance of
the proposed rule. In the Commission's view, reliance on such standards
supports the use of a common lexicon, facilitating the development of
understandable and transposable practices on a cross-border basis. The
Commission further recognizes that generally accepted standards and
best practices are likely to evolve over time, and the applicability of
any particular standard may vary based on the unique circumstances and
risk profile of each covered entity. Accordingly, the Commission
preliminarily believes requiring covered entities to follow generally
accepted standards and best practices supports the goal of an adaptive
approach that can respond nimbly to rapid changes in emerging
threats.\75\
---------------------------------------------------------------------------
\75\ See National Cyber Strategy, supra note 41, at 9 (``By
leveraging existing international standards in a manner consistent
with current policy and law, regulatory agencies can minimize the
burden of unique requirements and reduce the need for regulatory
harmonization.'').
---------------------------------------------------------------------------
3. Request for Comment
The Commission invites comment on all aspects of proposed paragraph
(b), including the following questions:
1. Applicability to FCMs. In adopting the RMP rule for FCMs in
2013, the Commission determined to limit the rule's applicability to
FCMs that hold or accept customer funds.\76\ The CEA and Commission
regulations define a ``futures commission merchant'' as an entity that
solicits or accepts orders to buy or sell futures contracts, options on
futures, retail off-exchange forex contracts or swaps, and accepts
money or other assets from customers to support such orders.\77\
Although some entities are, for various reasons, currently registered
as FCMs despite not accepting customer funds, as the Commission
explained in the adopting release for the FCM RMP rule, FCMs that do
not accept or hold customer funds to margin, guarantee, or security
commodity interests are generally not operating as FCMs.\78\ With
respect to the proposed ORF rule, the Commission has preliminarily
determined to apply the proposed requirements to all registered FCMs.
Although the customer protection concerns may be mitigated for FCMs
that do not handle customer assets, the Commission preliminarily
believes that the potential systemic risk that can result from failures
to manage information and technology risk, third-party relationships,
emergencies, or other significant disruptions persist for all FCMs,
given their access to customer information and their potential
relationships with and/or connectivity to other regulated entities,
including exchanges and clearinghouses.\79\
---------------------------------------------------------------------------
\76\ See 17 CFR 1.11(a) (Nothing in this section shall apply to
a futures commission merchant that does not accept any money,
securities, or property (or extend credit in lieu thereof) to
margin, guarantee, or secure any trades or contracts that result
from soliciting or accepting orders for the purchase or sale of any
commodity interest.).
\77\ See 7 U.S.C. 1a(28)(A); 17 CFR 1.3 (defining ``futures
commission merchant'') (emphasis added).
\78\ As of July 31, 2023, twelve (12) entities were registered
as FCMs but were not required to segregate any funds on behalf of
customers. See CFTC, Financial Data for FCMs (July 31, 2023),
available at https://www.cftc.gov/MarketReports/financialfcmdata/index.htm. The Commission made clear in the adopting notice for the
FCM RMP rule that it would expect that, prior to changing their
business model to begin accepting customer funds, any registered FCM
that does not currently accept customer funds would need to
establish a risk management program that complies with Commission
regulation 1.11 and file such program with the Commission and with
the FCM's designated self-regulatory organization (DSRO). See Final
FCM RMP Rule, 78 FR 68517.
\79\ The Final FCM RMP rule, by contrast, could be viewed as
more directly targeting the management of specific risks associated
with operating as an FCM.
---------------------------------------------------------------------------
a. Are the risks associated with information and technology
security, third-party relationships, and emergencies or other
significant disruptions substantially different or reduced for FCMs
that do not hold customer funds? If yes, please explain.
b. Should the Commission consider limiting the ORF rule to FCMs
that do not hold customer funds, consistent with the FCM RMP rule? Why
or why not? Please explain.
2. Standard. The proposed rule would require covered entities to
follow ``generally accepted standards and best practices'' in
establishing, implementing, and maintaining their ORFs. Although this
notice identifies various sources of such standards and practices,
including NIST, ISO, CIS, and FFIEC, the proposed rule does not further
define or otherwise limit the scope of ``generally accepted standards
and best practices,'' acknowledging that there are several sources of
recognized standards currently relied on by covered entities and that
standards and practices
[[Page 4714]]
are likely to evolve over time in response to changes in technology or
emerging threats. Nevertheless, the Commission understands that,
particularly in the United States, NIST and ISO standards are heavily
relied on by covered entities and referenced by other regulators,
making them widely recognized as the leading industry standards for
cybersecurity and operational risk management.
a. Should the Commission further define or otherwise limit what
constitutes ``generally accepted standards and best practices''?
Specifically, should the Commission require covered entities to follow
NIST or ISO standards, as some commenters on the RMP ANPRM recommended?
\80\ Why or why not? Please explain.
---------------------------------------------------------------------------
\80\ See, e.g., R.J. O'Brien Letter, supra note 13, at 6 (``The
Commission should also seek to implement the [NIST CSF] as a part of
its standard for managing and mitigating this area of risk. The NIST
CSF is widely accepted throughout many different industries and
would set a universal standard and best practices for registrants to
follow.'').
---------------------------------------------------------------------------
b. Are there any other standards or practices commonly relied on by
covered entities that the Commission did not identify, directly or
indirectly, in this notice? If so, please identify them and specify how
they are currently relied on by covered entities.
B. Governance--Proposed Paragraph (c)
The topic of governance has gained increased attention within the
context of operational resilience, particularly with respect to the
area of information and technology security. As of the date of this
notice, NIST is undergoing a process to update the NIST CSF, and new
governance outcomes are expected to feature prominently.\81\ Prudential
regulators have also emphasized the role of effective governance to
operational resilience.\82\ In the Commission's view, the overall
objective of an effective governance regime for an ORF should be the
integration of operational resilience topics into existing reporting
lines and operational structures, including the entity's overall
operational strategy, to ensure active executive engagement and
oversight in the management of operational risk that could challenge a
covered entity's operational resilience.\83\
---------------------------------------------------------------------------
\81\ See NIST, NIST Cybersecurity Framework 2.0 Concept Paper:
Potential Significant Updates to the Cybersecurity Framework at 10-
11 (Jan. 19, 2023) (discussing how the update ``will emphasize the
importance of cybersecurity governance'' by adding a new govern
function); see also CRI, The Profile Workbook: Guidance for
Implementing the CRI Profile v1.2.1 and Responding to its Diagnostic
Statements at 16 (rev. Jan. 2023) (CRI Profile Workbook) (providing
guidance on governance outcomes that have already been incorporated
into the NIST CSF financial services sector profile).
\82\ See Prudential Operational Resilience Paper, supra note 11,
at 3.
\83\ See BCBS Operational Resilience Principles, supra note 11,
at 4 (``Principle 1: Banks should utilise their existing governance
structure to establish, oversee and implement an effective
operational resilience approach that enables them to respond and
adapt to, as well as recover and learn from, disruptive events in
order to minimise their impact on delivering critical operations
through disruption.'') (internal citation omitted).
---------------------------------------------------------------------------
1. Approval of Components--Proposed Paragraph (c)(1)
Accordingly, to ensure that a covered entity's senior leadership is
involved in key decision-making around operational resilience, and is
ultimately held accountable for implementation of the ORF, the proposed
rule would require covered entities to have their senior leadership
annually approve the ORF.\84\ In recognition of the wide variety of
corporate structures represented among covered entities, however, the
proposed rule would give covered entities broad flexibility and
discretion to identify the appropriate senior-level individual or body
to provide such approval.
---------------------------------------------------------------------------
\84\ See paragraph (c)(1) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
Specifically, paragraph (c)(1) of the proposed rule would require
that each ORF component program or plan required by paragraph (b)(2) of
the proposed rule is approved in writing, on at least an annual basis,
by either the senior officer, an oversight body, or a senior-level
official of the covered entity.\85\ The term ``oversight body'' itself
would be broadly defined to encompass any board, body, or committee of
a board or body of the covered entity specifically granted the
authority and responsibility for making strategic decisions, setting
objectives and overall direction, implementing policies and procedures,
or overseeing the management of operations for the covered entity.\86\
Consistent with Commission regulation 3.1(j), ``senior officer'' would
mean the chief executive officer or other equivalent officer of the
covered entity.\87\ As an example, under the proposed rule, a covered
entity could elect to have its information and technology security
program annually approved by its chief executive officer, its chief
information security officer, or a committee with oversight authority
over information and technology security.\88\ Again, the intention
behind offering this flexibility is to ensure that covered entities
would be able to rely on and incorporate operational resilience into
their existing governance structures when complying with the proposed
ORF rule, while ensuring that each component program or plan would be
approved by an individual or group of individuals with senior-level
responsibilities and authority.
---------------------------------------------------------------------------
\85\ Id.
\86\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``oversight body'').
\87\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``senior officer''). See also 17 CFR 3.1(j)
(defining ``senior officer'').
\88\ Other possible senior-level officials could be the covered
entity's chief risk officer or chief operating officer, as
appropriate.
---------------------------------------------------------------------------
2. Risk Appetite and Risk Tolerance Limits--Proposed Paragraph (c)(2)
The proposed rule would further require covered entities to
establish and implement appropriate risk appetite and risk tolerance
limits with respect to the three risk areas enumerated in paragraph
(b)(1) (information and technology security, third-party relationships,
and emergencies or other significant disruptions to the continuity of
normal business operations).\89\ Although the terms ``risk appetite''
and ``risk tolerance'' are sometimes used interchangeably, the
Commission intends the terms to have distinct meanings within the
context of the proposed rule. Specifically, in the context of the
proposed rule, ``risk appetite'' would mean the aggregate amount of
risk a covered entity is willing to assume to achieve its strategic
objectives.\90\ Risk appetite is typically documented through a risk
appetite statement, which establishes qualitative and quantitative
measures designed to help identify when risk appetite has been exceeded
and what appropriate mitigating strategies that can be taken.\91\
[[Page 4715]]
With its proposed definition of ``risk tolerance limit,'' the
Commission intends to capture a more focused measure of acceptable
risk. Specifically, ``risk tolerance limit'' would mean the amount of
risk, beyond its risk appetite, that a covered entity is prepared to
tolerate through mitigating actions.\92\ Thus, risk tolerance limits
assume a particular type of risk has materialized (e.g., an operational
disruption has occurred) and identify the amount of disruption a firm
is prepared to tolerate beyond its risk appetite.\93\ Risk tolerance
limits are also more likely to be measured in quantitative terms (e.g.,
number of hours a particular system or application is down).\94\
---------------------------------------------------------------------------
\89\ See paragraph (c)(2)(i) of proposed Commission regulations
1.13 and 23.603. See also paragraph (b)(1) of proposed Commission
regulations 1.11 and 23.603 (identifying the risk areas proposed to
be covered by the ORF).
\90\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``risk appetite''). See also 12 CFR part 30,
app. D, I.E.10 (Definitions) (defining ``risk appetite'' as the
aggregate level and types of risk the board of directors and
management are willing to assume to achieve a covered bank's
strategic objectives and business program, consistent with
applicable capital, liquidity, and other regulatory requirements);
Prudential Operational Resilience Paper, supra note 11, at 14
(defining ``risk appetite'' as ``[t]he aggregate level and types of
risk the board and senior management are willing to assume to
achieve a firm's strategic business objectives, consistent with
applicable capital, liquidity, and other requirements and
constraints''); BCBS Operational Resilience Principles, supra note
11, at 3, n.7 (defining ``risk appetite'' as ``the aggregate level
and types of risk a bank is willing to assume, decided in advance
and within its risk capacity, to achieve its strategic objectives
and business program'').
\91\ See 12 CFR part 30, app. D (requiring covered financial
institutions to have a comprehensive written risk appetite
statement). See also CRI Profile Workbook, supra note 78, at 16
(``Risk appetite statements define certain risk tolerance metrics
that help describe systems and services that the organization may
consider high-risk.'').
\92\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``risk tolerance limit''). See also Prudential
Operational Resilience Paper, at 3, n. 11; 14 (defining ``tolerance
for disruption'' as ``determined by a firm's risk appetite for
weathering disruption from operational risks considering its risk
profile and the capabilities of its supporting operational
environment'' and ``informed by existing regulations and guidance
and by the analysis of a range of severe but plausible scenarios
that would affect its critical operations and core business
lines.''); CRI Profile Workbook at 291 (stating that ``risk
tolerance'' ``reflects the acceptable variation in outcomes related
to specific performance measures linked to objectives the entity
seeks to achieve''). ISACA, Risk IT Framework, 2nd Ed. (July 27,
2020) (defining ``risk tolerance'' as ``the acceptable deviation
from the level set by the risk appetite and business objectives'').
\93\ The Commission recognizes that Commission regulations 1.11
and 23.600 incorporate the term ``risk tolerance limits.'' See 17
CFR 1.11(e)(1), 17 CFR 23.600(c)(1). As proposed to be defined in
the ORF rule, however, ``risk tolerance limits'' would be limited to
the context of the risks identified in paragraph (b)(1) of the
proposed rule and associated disruptions. Accordingly, if adopted,
the defined use of the term ``risk tolerance limit'' in the proposed
rule would not be intended to affect how covered entities use or
interpret the term in the context of the Commission's RMP rules.
\94\ The Commission believes its proposed definitions are in
line with proposed definitions of ``risk appetite'' and ``risk
tolerance'' used by NIST. For example, in NIST Interagency or
Internal Report 8286 (NIST IR 8286), NIST explains that a statement
of risk appetite might be that ``[e]mail shall be available during
the large majority of a 24-hour period,'' while the associated risk
tolerance would be narrower, stating something like ``[e]mail
services shall not be interrupted more than five minutes during core
hours.'' See NIST IR 8286 at 5-6 (Oct. 2020). Accordingly, any
existing risk appetite and risk tolerance limits established by
covered entities pursuant to NIST or prudential regulator standards
would be considered consistent with the proposed rule.
---------------------------------------------------------------------------
As with each component ORF program or plan, the proposed rule would
require that a covered entity's risk appetite and risk tolerance limits
be reviewed and approved in writing on at least an annual basis by
either the senior officer, an oversight body, or a senior-level
official of the covered entity.\95\ This proposed requirement is
intended to ensure that the risk appetite and risk tolerance limits are
consistent with the covered entity's operational strategy and
objectives, as established by senior leadership, and that senior
leadership is involved in, and ultimately held accountable for, how
operational risks faced by the covered entity are internalized by the
covered entity.
---------------------------------------------------------------------------
\95\ See paragraph (c)(2)(ii) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
The setting and approval of risk appetite and risk tolerance limits
for operational risk is a well-recognized key component of effective
governance and oversight.\96\ The Commission therefore preliminarily
believes the setting and approval of risk appetite and risk tolerance
limits for operational risks captured by the ORF would be helpful to
ensuring effective governance and oversight of the ORF. Specifically,
the Commission believes that the process of identifying appropriate
risk appetite and risk tolerance limits would have a disciplining
effect, encouraging covered entities to think critically about the
risks they face and their ability to comfortably manage them without
incurring intolerable harm to themselves or their customers or
counterparties. The Commission further believes that operating within
set risk appetite and risk tolerance limits would help support a
culture where senior leaders at covered entities can make more informed
decisions about the risks they are willing to take and the mitigation
measures they would need to employ to manage these risks, which would
further support operational resilience.
---------------------------------------------------------------------------
\96\ See, e.g., BCBS Operational Resilience Principles, supra
note 11, at 4 (``The board of directors should review and approve
the bank's operational resilience approach considering the bank's
risk appetite and tolerance for disruption to its critical
operations. In formulating the bank's tolerance for disruption, the
board of directors should consider the bank's operational
capabilities given a broad range of severe but plausible scenarios
that would affect its critical operations. The board of directors
should ensure that the bank's policies effectively address instances
where the bank's capabilities are insufficient to meet its stated
tolerance for disruption.''); CRI Profile v1.2, supra note 74.
---------------------------------------------------------------------------
3. Internal Escalations--Proposed Paragraph (c)(3)
To further ensure that senior leadership remains involved in and
accountable for the ORF as it is implemented, the proposed rule would
require either the senior officer, an oversight body, or a senior-level
official of the covered entity to be notified of: (i) circumstances
that exceed the risk tolerance limits established pursuant to paragraph
(c)(2)(i) of the proposed rule; and (ii) incidents that require
notification to the Commission, customers, or counterparties under the
proposed rule, as further discussed in subsequent sections of this
notice.\97\
---------------------------------------------------------------------------
\97\ See paragraph (c)(3) of proposed Commission regulations
1.13 and 23.603. See also paragraphs (i) and (j) of proposed
Commission regulations 1.13 and 23.603, discussed in section II.G of
this notice, infra.
---------------------------------------------------------------------------
The Commission believes that circumstances that would push a
covered entity outside of its risk tolerance limits or trigger a
Commission notification requirement would be extraordinary, non-
business-as-usual events, and would likely require the involvement of
senior leadership to direct responsive actions to preserve or mitigate
damage to operational resilience and prevent situations of intolerable
harm. Ensuring that appropriate senior leadership, as determined by the
covered entity, is apprised of instances where expected risk tolerance
limits have been exceeded would further help senior leadership
determine whether the risk appetite and risk tolerance limits are
appropriately calibrated and whether identified mitigation strategies
are working, creating opportunities to update either as necessary.
4. Consolidated Program or Plan--Proposed Paragraph (c)(4)
The Commission is aware that many covered entities function as a
division or affiliate of a larger entity or holding company structure;
and that, in such instances, operational risks stemming from
information and technology security, third-party relationships, and
emergencies or other significant disruptions are generally monitored
and managed at the enterprise level to address the risks holistically
and to achieve economies of scale.\98\ The proposed rule recognizes the
benefits of such a consolidated approach and is not intended to
interfere with covered entities' operational structures. Accordingly,
the proposed rule would allow covered entities to satisfy the component
program or plan requirement in paragraph (b)(2) through its
participation in a consolidated program or plan, provided the
consolidated program or plan meets the
[[Page 4716]]
requirements of the proposed rule.\99\ As defined in the proposed rule,
a ``consolidated program or plan'' would mean any information and
technology security program, third-party relationship program, or
business continuity and disaster recovery plan in which a covered
entity participates with one or more affiliates and is managed and
approved at the enterprise level.\100\
---------------------------------------------------------------------------
\98\ In responding to the RMP ANPRM, several commenters noted
how cybersecurity risk is generally managed at the enterprise level
and should not be managed at the level of the entity regulated by
the Commission. See FIA Letter at 11 (Sept. 18, 2023); International
Swaps and Derivatives Association, Inc. (``ISDA'') and the
Securities Industry and Financial Markets Association (``SIFMA'')
Letter at 9 (Sept. 18, 2023).
\99\ See paragraph (c)(4)(i) of proposed Commission regulations
1.13 and 23.603.
\100\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``consolidated program''). Again, the specific
definitions and minimum requirements of each program are discussed
in sections II.C, II.D, and II.E of this notice, infra.
---------------------------------------------------------------------------
Nevertheless, the Commission does have a strong regulatory interest
in ensuring that operational shocks, such as cyber incidents or
technological failures, having an impact on the discrete interests and
operations of the covered entity are appropriately considered through
the unique lens of the covered entity, which is regulated by the
Commission. Accordingly, for a covered entity to satisfy the component
program or plan requirement through its participation in a consolidated
program or plan, the consolidated program or plan would need to meet
the requirements of the proposed rule, as discussed in this notice.
Those requirements include the establishment of appropriate risk
appetite and risk tolerance limits that address the covered entity, as
well as testing and other requirements, as discussed further below.
With respect to the requirements in proposed paragraphs (c)(1) and
(c)(2)(i) that senior leadership of the covered entity approve,
respectively, the component program or plan and the risk appetite and
risk tolerance limits at least annually, the Commission recognizes that
such a requirement might be challenging in the context of a
consolidated program or plan, which is likely to address matters
related to affiliates that are not within the scope of knowledge or
responsibility of the covered entity. Accordingly, the proposed rule
would allow covered entities relying on a consolidated program or plan
to satisfy the approval requirements in paragraphs (c)(1) and (c)(2)(i)
of the proposed rule, provided that either the senior officer, an
oversight body, or a senior-level official of the covered entity
attests in writing, on at least an annual basis, that the consolidated
program or plan meets the requirements of this section and reflects the
risk appetite and risk tolerance limits appropriate to the covered
entity.\101\ Notably, the senior officer, an oversight body, or a
senior-level official at the covered entity would still need to be
notified when the risk appetite and risk tolerance limits related to
the covered entity are exceeded.\102\ The Commission believes that such
an attestation requirement would promote efficiency by allowing covered
entities to continue to rely on an enterprise-level ORF and governance
structures that have acknowledged benefits while also ensuring that
such enterprise-level ORF appropriately addresses the risks specific to
the covered entity, and would ensure that the requirements of the
Commission's proposed rule are addressed for those covered entities in
the same way as they would for a covered entity that is not a part of a
larger enterprise.\103\
---------------------------------------------------------------------------
\101\ See paragraph (c)(4)(ii) of proposed Commission
regulations 1.13 and 23.603.
\102\ See paragraph (c)(3)(i) of proposed Commission regulations
1.13 and 23.603.
\103\ The Commission also believes this approach would be
consistent with NFA's current interpretive notice on ISSPs. See NFA
ISSP Notice, supra note 43 (``[T]o the extent a Member firm is part
of a holding company that has adopted and implemented privacy and
security safeguards organization-wide, then the Member firm can meet
its supervisory responsibilities imposed by Compliance Rules 2-9, 2-
36 and 2-49 to address the risks associated with information systems
through its participation in a consolidated entity ISSP.'').
---------------------------------------------------------------------------
5. Request for Comment
The Commission invites comment on all aspects of the proposed
governance requirements for the ORF, including the following questions:
1. Governance structures. The proposed rule is intended to provide
covered entities sufficient flexibility to integrate the proposed
operational resilience requirements into existing reporting lines and
operational structures, as well as to select the individual or body
with senior-level responsibilities and authority to approve the
component programs or plans of the ORF. Does the proposed rule
accomplish this goal? If not, what other governance structure(s) should
the Commission consider? Alternatively, should the Commission consider
a more prescriptive, bright-line approach where only the senior officer
or board of directors of the covered entity may provide any approvals
required under the proposed rule? Please explain.
2. Internal escalations. The proposed rule would require that the
senior officer, an oversight body, or other senior-level official(s) of
the covered entity be notified of circumstances that exceed risk
tolerance limits or that require reporting to the Commission or
counterparties or customers under the proposed rule. Should the
Commission require internal escalation to any other specific personnel
or under any other circumstances? Please identify and explain why.
3. Consolidated program or plan. The proposed rule would allow
covered entities relying on a consolidated program or plan to satisfy
certain governance requirements by requiring the senior officer, an
oversight body, or another senior-level official of the covered entity
to attest in writing, on at least an annual basis, that the
consolidated program or plan meets the requirements of the rule and
reflects a risk appetite and risk tolerance limits appropriate to the
covered entity. Is this standard workable for covered entities that
function as a division or affiliate of a larger entity or holding
company? Why or why not? Do such covered entities typically set their
own risk appetite and risk tolerance limits, or are setting such limits
conducted at the enterprise level? If they are set at the enterprise
level, how is senior leadership of the covered entity typically
involved in setting risk appetite and risk tolerance limits?
C. Information and Technology Security Program--Proposed Paragraph (d)
As mentioned above, the proposed rule would require each covered
entity's ORF to include an information and technology security program,
defined as a written program reasonably designed to identify, monitor,
manage, and assess risks relating to information and technology
security and that meets the minimum requirements for the program, as
set forth in the proposed rule and discussed below.\104\ The proposed
rule would define ``information and technology security'' as the
preservation of (a) the confidentiality, integrity, and availability of
covered information and (b) the reliability, security, capacity, and
resilience of covered technology.\105\ ``Covered information'' would be
defined to mean any sensitive or confidential data or information
maintained by a covered entity in connection with its business
activities as a covered entity.\106\ ``Covered technology'' would be
defined to mean any application, device, information technology asset,
network service,
[[Page 4717]]
system, and other information-handling component, including the
operating environment, that is used by a covered entity to conduct its
business activities, or to meet its regulatory obligations, as a
covered entity.\107\
---------------------------------------------------------------------------
\104\ See paragraph (d) of proposed Commission regulations 1.13
and 23.603. See also paragraph (a) of proposed Commission
regulations 1.13 and 23.603 (defining ``information and technology
security program'').
\105\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``information and technology security'').
\106\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``covered information'').
\107\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``covered technology'').
---------------------------------------------------------------------------
The proposed definition of ``covered information'' is intended to
focus the requirements of the ORF on protecting data and information
that are sensitive or otherwise intended to be kept confidential,
whether by law or for business purposes. Notably, such data and
information would include position, order, and account information, all
of which covered entities have an obligation to keep confidential and
which if made public could result in harm to customers, counterparties,
or the markets more broadly. Often referred to as the ``CIA triad,''
confidentiality, integrity, and availability represent the three
pillars of information security: preserving authorized restrictions on
information access and disclosure, including means for protecting
personal privacy and proprietary information; guarding against the
improper modification or destruction of data and information, ensuring
its authenticity; and ensuring the timely and reliable access to and
use of information.\108\ The Commission therefore believes that
compromising any aspect of the CIA triad with respect to covered
information would have meaningful consequences for customers,
counterparties, the covered entity, or even the market.
---------------------------------------------------------------------------
\108\ See NIST, SP 1800-26, Data Integrity: Detecting and
Responding to Ransomware and Other Destructive Events (Dec. 2020)
(discussing the CIA triad).
---------------------------------------------------------------------------
The proposed definition of ``information and technology security''
is likewise intended to ensure that the ORF is designed to address
risks to two key facets of a covered entities' business for which they
are registered with the Commission: the technology they use to conduct
their regulated business activities and the sensitive information
stored or transmitted therein. The proposed definition of ``covered
technology'' is sufficiently broad to capture all types of technology
(and related components) but is tailored to focus on the technology
that is used by covered entities in the context of their regulated
business activities, such that its disruption would have an impact on
regulated business activities. The Commission preliminarily believes
that reliability, security, capacity, and resilience are all key
attributes of covered technology that must be preserved for it to
function as intended without posing a disruption to operations.
Accordingly, the Commission believes that having a program designed to
preserve the confidentiality, integrity, and availability of covered
information and the reliability, security, capacity, and resilience of
covered technology is key to ensuring operational resilience.
Under the proposed rule, each covered entity's information and
technology security program would need to meet the (b)(3) standard,
i.e., be appropriate and proportionate to the nature, size, scope,
complexities and risk profiles of the covered entity's business
activities, following generally accepted standards and best
practices.\109\ The proposed rule would nevertheless establish certain
minimum requirements for the information and technology security
program, including a periodic risk assessment, effective controls, and
an incident response plan. Each proposed minimum requirement is
discussed in turn below.
---------------------------------------------------------------------------
\109\ See paragraph (b)(3) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
1. Risk Assessment--Proposed Paragraph (d)(1)
As part of the information and technology security program, covered
entities would be required to conduct and document the results of a
periodic and comprehensive risk assessment reasonably designed to
identify, assess, and prioritize risks to information and technology
security.\110\ Risk assessments are widely recognized as a necessary
and effective first step to monitoring and managing risks to
information and technology security.\111\ According to NIST, the
purpose of a risk assessment is to inform decision makers and support
risk responses by identifying: (i) relevant threats to organizations or
threats directed through organizations against other organizations;
(ii) vulnerabilities both internal and external to organizations; (iii)
impact (i.e., harm) to organizations that may occur given the potential
for threats exploiting vulnerabilities; and (iv) the likelihood that
harm will occur.\112\ Given this broad and important purpose, the
Commission believes conducting a comprehensive risk assessment would be
reasonably necessary for covered entities to have a thorough
understanding of their information and technology security risks,
including the types of threats the covered entities face, internal and
external vulnerabilities, the impact of such risks, and their relative
priorities, to guide mitigation efforts.
---------------------------------------------------------------------------
\110\ See paragraph (d)(1)(i) proposed Commission regulations
1.13 and 23.603.
\111\ See, e.g., ISO/IEC 27001:2022, supra note 48 (requiring a
risk assessment to help organizations identify, analyze, and
evaluate weaknesses in their information systems); ISO/IEC
31010:2019, Risk management: Risk assessment techniques (July 2,
2019); NIST, SP 800-39, Managing Information Security Risk:
Organization, Mission, and Information System View at 37 (Mar. 2011)
(NIST SP 800-39) (``Risk assessment identifies, prioritizes, and
estimates risk to organizational operations (i.e., mission,
functions, image, and reputation), organizational assets,
individuals, other organizations, and the Nation, resulting from the
operation and use of information systems. Risk assessments use the
results of threat and vulnerability assessments to identify and
evaluate risk in terms of likelihood of occurrence and potential
adverse impact (i.e., magnitude of harm) to organizations, assets,
and individuals.''); NIST, SP 800-30, Guide for Conducting Risk
Assessments, Rev. 1, at ix (Sept. 2012) (NIST SP 800-30) (``Risk
assessments are a key part of effective risk management and
facilitate decision making . . .''). See also 12 CFR part 30, app. B
(establishing a requirement to assess risk by identifying reasonably
foreseeable threats, assessing the likelihood and potential damage
of the threats, and assessing the sufficiency of arrangements to
control risks); Prudential Operational Resilience Paper, supra note
11, at 4 (``The firm's operational risk management function
implements and maintains risk identification and assessment
approaches that adequately capture business processes and their
associated operational risks, including technology and third-party
risks.'').
\112\ See NIST SP 800-30 at 1.
---------------------------------------------------------------------------
As stated, the risk assessment would need to identify, assess, and
prioritize risks to information and technology security.\113\ In broad
terms, the Commission anticipates that conducting the assessment could
first involve taking an inventory of covered technology and then
identifying and assessing the likelihood and potential impact of
reasonably foreseeable threats and vulnerabilities to information and
technology security (i.e., to the confidentiality, integrity, and
availability of covered information, or to the reliability, security,
capacity or resilience of covered technology) in light of the existing
operational environment. Identified threats and vulnerabilities could
derive from a wide array of sources, including both external cyber
threats and internal gaps in existing systems or controls.
---------------------------------------------------------------------------
\113\ See paragraph (d)(1)(i) proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
The Commission would then expect the risks to be prioritized in
light of the covered entity's stated risk appetite and risk tolerance
limits to help direct resources and other activities in order to best
support information and technology security. If the proposal is adopted
as final, the Commission would expect covered entities to use the
results of each risk assessment as a basis for designing, implementing,
and refining other elements of its information and technology security
program, including
[[Page 4718]]
but not limited to, the development of controls, testing protocols, and
the incident response plan, as discussed further below.\114\ In this
way, a well-conducted risk assessment should support the development of
a more rational, effective, and valuable information and technology
security framework, especially as the assessment is repeated and built
upon over time.
---------------------------------------------------------------------------
\114\ See NIST SP 800-39 at 34 (``Information generated during
the risk assessment may influence the original assumptions, change
the constraints regarding appropriate risk responses, identify
additional tradeoffs, or shift priorities.'').
---------------------------------------------------------------------------
The proposed rule would not prescribe a specific process or
methodology for the risk assessment, but the risk assessment would need
to be consistent with the proposed (b)(3) standard.\115\ Following
generally accepted standards and best practices, covered entities would
need to implement processes and methodologies that ensure the risk
assessment reflects the nature, size, scope, complexities, and risk
profile of its business activities as a covered entity. Any such
processes or methodologies should also be sufficient to identify,
assess, and prioritize risks to information and technology security and
to evaluate their potential impact on covered technology and covered
information.\116\
---------------------------------------------------------------------------
\115\ See paragraph (b)(3) of proposed Commission regulations
1.13 and 23.603, discussed supra. The Commission is aware of several
sources for industry standards and best practices regarding
information security risk assessments. See, e.g., NIST SP 800-39;
see also FFIEC Information Security Booklet, supra note 69.
\116\ See paragraph (d)(1)(i) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
To ensure that the risk assessment is conducted objectively, the
proposal would require that the personnel involved in conducting the
assessment are not responsible for the development or implementation of
the covered technology or related controls.\117\ Such personnel could
be employees of the covered entity, an affiliated entity, or a third-
party service provider. To ensure that senior leadership is aware of
risks to information security, and can appropriately prioritize them
within the covered entity's broader strategy and risk management
framework, the proposed rule would expressly require that the results
of the risk assessment be provided to the senior officer, oversight
body, or other senior-level official who approves the information and
technology security program upon the risk assessment's completion.\118\
The Commission believes the results of the risk assessment would be key
information for senior leadership in determining whether to approve an
information and technology security program.
---------------------------------------------------------------------------
\117\ See paragraph (d)(1)(ii) of proposed Commission
regulations 1.13 and 23.603.
\118\ See paragraph (d)(1)(iii) of proposed Commission
regulations 1.13 and 23.603. See also NIST SP 800-30, supra note
111, at 1 (``The purpose of risk assessments is to inform decision
makers and support risk responses . . .'').
---------------------------------------------------------------------------
The proposed rule would require that the covered entity conduct the
risk assessment at a frequency consistent with the (b)(3) standard
(i.e., a frequency appropriate and proportionate to the nature, scope,
and complexities of its business activities as a covered entity,
following generally accepted standards and best practices) but, in any
case, no less frequently than annually.\119\ Given the rapidly evolving
nature of technological developments and related threats, the
Commission preliminarily believes that a uniform requirement to conduct
a risk assessment on at least an annual basis would support the
development of a strong, foundational level of information and
technology security across the industry, thereby mitigating the overall
threat of systemic risk. However, the Commission understands that
generally accepted standards and best practices may encourage more
frequent risk assessments for covered entities that engage in broader
or more complex business activities and would expect covered entities
to conduct risk assessments more frequently if the circumstances so
require.
---------------------------------------------------------------------------
\119\ See paragraph (d)(1)(ii) of proposed Commission
regulations 1.13 and 23.603.
---------------------------------------------------------------------------
As mentioned above, the proposed rule would allow covered entities
to satisfy the requirement to have an information and technology
security program through its participation in a consolidated
information and technology security program.\120\ Accordingly, such
covered entities would be allowed to rely on a risk assessment that is
conducted at an enterprise level. In such cases, the Commission would
expect that the covered entities review the program and supporting
policies and procedures for conducting the risk assessment to ensure it
captures and assesses the risks to the covered entity consistent with
the proposed rule so as to support the related attestation
requirement.\121\
---------------------------------------------------------------------------
\120\ See paragraph (c)(4)(i) of proposed Commission regulations
1.13 and 23.603.
\121\ See paragraph (c)(4)(ii) of proposed Commission
regulations 1.13 and 23.603.
---------------------------------------------------------------------------
2. Effective Controls--Proposed Paragraph (d)(2)
The proposed rule would require that the information and technology
security program establish, document, implement, and maintain controls
reasonably designed to prevent, detect, and mitigate identified risks
to information and technology security.\122\ An essential component of
any information and technology security program, and a critical
component of a covered entity's overall ORF, controls (also referred to
as ``countermeasures'' or ``safeguards'') include any measures
(actions, devices, procedures, techniques) designed to promote
information and technology security.\123\ The selection, design, and
implementation of controls can therefore have significant implications
for a covered entity's information and technology security and overall
operational resilience.\124\ Accordingly, the Commission believes
effective controls would be a critical component of a covered entity's
overall ORF.
---------------------------------------------------------------------------
\122\ See paragraph (d)(2) of proposed Commission regulations
1.13 and 23.603.
\123\ See Committee on Payments and Market Infrastructures
(CPMI), IOSCO, Guidance on cyber resilience for financial market
infrastructures at 7 (Jun. 2016) (CPMI IOSCO Cyber Resilience
Guidance) (noting that a strong information and communications
technologies control environment is a fundamental and critical
component of overall cyber resilience). See also NIST SP 800-53,
supra note 46, at 8 (``Controls can be viewed as descriptions of the
safeguards and protection capabilities appropriate for achieving the
particular security and privacy objectives of the organization and
reflecting the protection needs of organizational stakeholders.
Controls are selected and implemented by the organization in order
to satisfy the system requirements. Controls can include
administrative, technical, and physical aspects.''); ISO/IEC
27001:2022, supra note 48, Annex A (Information security management
systems) (providing guidelines for 93 objectives and controls).
\124\ See Prudential Operational Resilience Paper, supra note
11, at 8 (identifying as a sound practice for operational resilience
routinely applying and evaluating the effectiveness of processes and
controls to protect confidentiality, integrity, availability, and
overall security of data and information systems).
---------------------------------------------------------------------------
Although the proposed rule would not mandate that covered entities
implement specific controls, it would require covered entities to
consider, at a minimum, certain categories of controls, discussed
below, and adopt those consistent with the (b)(3) standard.\125\ If the
proposal is adopted as final, the Commission would further expect that
a particular covered entity's determination of which controls to
implement would be guided by the results of its risk assessment,
considering the covered entity's risk appetite and risk tolerance
limits.\126\
[[Page 4719]]
Adopted controls would also need to address risks to information and
technology security identified through other means, including outcomes
of continuous monitoring of threats and vulnerabilities, actual and
attempted cyber-attacks, threat intelligence, scenario analysis, and
the likelihood and realistic impact of such attacks. In other words,
the controls would need to be linked to and address the identified and
prioritized risks to information and technology security. The
Commission would advise covered entities to document their
consideration of controls within each of the enumerated categories and
their reasoning for adopting specific controls within any given
category, or for declining to adopt any controls within a particular
category. Further, the Commission would expect those controls to be
reviewed and revised as needed to reflect the results of the covered
entity's most recent risk assessment.
---------------------------------------------------------------------------
\125\ See paragraphs (d)(2)(i)-(xii) of proposed Commission
regulations 1.13 and 23.603 (identifying categories of controls for
covered entities to consider). See also paragraph (b)(3) of proposed
Commission regulations 1.13 and 23.603.
\126\ See paragraph (c)(2) of proposed Commission regulations
1.13 and 23.603 (requiring covered entities to establish and
implement risk appetite and risk tolerance limits).
---------------------------------------------------------------------------
The specific categories of controls the Commission would require
covered entities to consider under the proposed rule include: access
controls; access restrictions; encryption; dual control
procedures,\127\ segregation of duties, and background checks; change
management practices; system development and configuration management
practices; flaw remediation; measures to protect against destruction,
loss, or damage to covered information; monitoring systems and
procedures to detect attacks or intrusions; response programs; and
measures to promptly recover and secure any compromised covered
information.\128\
---------------------------------------------------------------------------
\127\ Dual control procedures refer to a technique that requires
two or more separate persons, operating together, to protect
sensitive data and information. Both persons are equally responsible
for protecting the information and neither can access the
information alone. See Interagency Guidelines Establishing Standards
for Safeguarding Customer Information and Rescission of Year 2000
Standards for Safety and Soundness, 66 FR 8616, 8622 (Feb. 1, 2001)
(Interagency Guidelines Safeguarding Customer Information).
\128\ See paragraphs (d)(2)(i)-(xi) of proposed Commission
regulations 1.13 and 23.600.
---------------------------------------------------------------------------
The Commission preliminarily believes that these categories of
controls collectively represent a comprehensive array of controls for
ensuring the information and technology security. Access controls,
access restrictions, encryption, and background checks would limit
access to covered technology and covered information to individuals
with a legitimate business need in both physical and digital
environments. Dual control procedures, segregation of duties,
procedures relating to modifications to covered technology, and
measures to protect against destruction, loss, or damage to covered
information, would support the integrity and availability of covered
information from accidental or intentional damage or disclosure to
unauthorized recipients. Change management practices would ensure that
the information and technology security program, and associated
controls, continue to operate as intended over time as systems and
processes are updated. Systems development, configuration management,
and flaw remediation practices would operate to ensure the integrity
and availability of covered technology throughout any updates to
covered technology or following a vulnerability analysis.\129\ Measures
to protect against destruction of covered information due to
environmental hazards would further ensure that covered information
remains available even following a physical disruption. Monitoring
systems and procedures, response programs, and measures to promptly
recover and secure any compromised covered information would serve to
detect unauthorized access to covered information and to recover it if
the covered entity's access to the covered information were impaired
(e.g., through a ransomware attack).
---------------------------------------------------------------------------
\129\ Based on its experience, the Commission further believes
that that failures in change management, systems development, and
vulnerability patching practices are common sources of disruption
among financial institutions and are often neglected control areas.
---------------------------------------------------------------------------
The proposed rule is modeled after an approach adopted by
prudential regulators. Since the early 2000s, prudential regulators
have required financial institutions to consider a similar list of
categories of controls when designing their information security
programs.\130\ In adopting their list of categories, prudential
regulators described them as designed to control identified risks and
to achieve the overall objective of ensuring the security and
confidentiality of customer information.\131\ Prudential regulators
further emphasized that the categories were broad enough to be adapted
by institutions of varying sizes, scope of operations, and risk
management structures, such that the manner of implementing the
guidelines would vary from institution to institution.\132\ Given that
the list of control categories developed by prudential regulators, many
of which are included in the Commission's proposed rule, has a
longstanding history of being effective and adaptable to the financial
industry at large, the Commission preliminarily believes that
incorporating a similar approach with respect to covered entities would
also further the Commission's intent to adopt a flexible rule that can
be tailored to each individual covered entity and adapted over time to
respond to changing threat environments and risk profiles.\133\
---------------------------------------------------------------------------
\130\ See Interagency Guidelines Safeguarding Customer
Information, 66 FR 8616; see also 12 CFR part 30, app. B. The
guidelines were expanded and retitled, ``Interagency Guidelines
Establishing Information Security Standards'' in 2004, see Proper
Disposal of Consumer Information Under the Fair and Accurate Credit
Transactions Act of 2003, 69 FR 77610 (Dec. 28, 2004).
\131\ See Interagency Guidelines Safeguarding Customer
Information, 66 FR 8621.
\132\ Commenters further supported the level of detail, see id.
at 8622.
\133\ NIST has compiled a comprehensive catalog of security and
privacy controls for all types of computing platforms, including
general purpose computing systems, cyber-physical systems, cloud
systems, mobile systems, and Internet of Things (IoT) devices. See
NIST SP 800-53, supra note 123.
---------------------------------------------------------------------------
3. Incident Response Plan--Proposed Paragraph (d)(3)
The proposed rule would require that the information and technology
security program include a written incident response plan that is
reasonably designed to detect, assess, contain, mitigate the impact of,
and recover from an incident.\134\ A hallmark of operational resilience
is the recognition that although meaningful steps can be taken to
prevent and deter risks to information and technology security, such
risks may never be entirely eliminated.\135\ As the ION incident
illustrated, quick and complete recovery of covered technology and
operations may be key to mitigating the potential systemic impact to
the financial markets. Accordingly, a crucial aspect of any information
and technology security program, and therefore any ORF, is having a
plan to respond to and recover from events that may create risks to
information and technology security.\136\
[[Page 4720]]
The Commission believes, therefore, that an effective incident response
plan would help covered entities minimize the potential impact to their
operations and customers or counterparties when negative events occur,
facilitating their recovery as swiftly and successfully as
possible.\137\ It can also assist in securing against the destruction
or theft of sensitive and important confidential customer or
counterparty information, which could have a very real impact on their
business and assets.
---------------------------------------------------------------------------
\134\ See paragraph (d)(3) of proposed Commission regulations
1.13 and 23.603. The Commission is aware that some covered entities
may have established an incident response plan as a separate
document or as an attachment to another plan, such as a BCDR plan.
If the proposed rule is adopted, the Commission would be agnostic as
to where a covered entity elects to house its incident response plan
provided it otherwise meets the requirements of the proposed rule,
including recordkeeping, furnishing it to the Commission upon
request, and distributing it to personnel.
\135\ See BCBS Operational Resilience Principles, supra note 12,
at 1 (stating that, in recognition that ``the range of potential
hazards cannot be prevented,'' the focus should be on ``the ability
of banks to withstand, adapt to and recover from potential hazards
and thereby mitigate potentially severe adverse impacts'').
\136\ See, e.g., BCBS Operational Resilience Principles at 7,
n.18 (``The goal of incident management is to limit the disruption
and restore critical operations in line with the bank's risk
tolerance for disruption.''). See also FFIEC Information Security
Booklet, supra note 69, 50-51 (``containing the incident,
coordinating with law enforcement and third parties, restoring
systems, preserving data and evidence, providing assistance to
customers, and otherwise facilitating operational resilience'');
NIST, SP 800-184, Guide for Cybersecurity Event Recovery (Dec. 2016)
(NIST SP 800-184) (``evaluate the potential impact, planned response
activities, and resulting recovery processes long before an actual
cyber event takes place''); CIS, Incident Response Policy Template:
Critical Security Controls (Mar. 8, 2023) at 4 (``The primary goal
of incident response is to identify threats on the enterprise,
respond to them before they can spread, and remediate them before
they can cause harm.'') (CIS Incident Response Template).
\137\ See FFIEC, CAT at 52 (May 2017) (``The incident response
plan is designed to ensure recovery from disruption of services,
assurance of data integrity, and recovery of lost or corrupted data
following a cybersecurity incident''); CPMI IOSCO Cyber Resilience
Guidance, supra note 123, at 16 (recognizing the incident response
plan enables the business ``to resume critical operations rapidly,
safely and with accurate data'').
---------------------------------------------------------------------------
For purposes of the proposed rule, ``incident'' would be defined as
any event, occurrence, or circumstance that could jeopardize
information and technology security, including if it occurs at a third-
party service provider.\138\ The purpose of the incident response plan
is to identify and classify foreseeable types of incidents and to
establish steps to detect, assess, contain, mitigate the impact of, and
recover from incidents. The Commission's proposed definition of
``incident'' is intentionally broad to ensure that the incident
response plan would address any event that could reasonably jeopardize
(i.e., endanger or put at risk) information and technology security,
even if that danger never materializes or the incident response plan is
otherwise successful at preventing or reversing the danger. As defined
in the proposed rule, ``incident'' is broad enough to cover various
types of risks to covered technology (e.g., disruption or modification)
or covered information (e.g., disclosure or destruction), regardless of
the source (e.g., external threat actor or internal staff, physical or
electronic) or whether the event was accidental or malicious in nature,
since intent may not be readily determined at the outset of an
incident. Common examples of incidents would include unauthorized
access to a system or data; unauthorized changes to system hardware,
software, or data; or a failure of controls that could, if not
addressed, endanger information and technology security.
---------------------------------------------------------------------------
\138\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``incident'').
---------------------------------------------------------------------------
Consistent with the general framework for the ORF as a whole, the
proposal would require the incident response plan to meet certain
minimum requirements.\139\ In broad terms, these requirements focus on
identifying persons relevant to an incident response (i.e., personnel
involved in responding to the incident and persons who should be
notified of such incidents) and how and when they should be involved;
documenting the nature of the covered entity's response; and
remediating any weaknesses that lead to the incident.\140\ The
Commission believes that clearly identifying parties who would be
involved in incident response, including external parties like third-
party service providers and law enforcement, and establishing
associated roles and responsibilities would help ensure that incidents
are: (1) resolved in a timely manner and by appropriate personnel; (2)
adequately resourced financially, operationally, and staffing-wise; and
(3) disclosed to appropriate persons either within senior leadership of
the covered entity or externally, where required.\141\ The process of
documenting incidents and management's response, as well as any
subsequent remediation efforts, would assist with any related reporting
obligations and required information sharing, as well as with
subsequent testing of the incident response plan or post-mortem
analysis, which would potentially lead to adjustments in subsequent
risk assessments and provide lessons learned that could serve to help
prevent the occurrence of incidents in the future.\142\
---------------------------------------------------------------------------
\139\ See paragraphs (d)(3)(i)-(vi) of proposed Commission
regulations 1.13 and 23.603.
\140\ See id.
\141\ See also NIST SP 800-61 (``It is important to identify
other groups within the organization that may need to participate in
incident handling so that their cooperation can be solicited before
it is needed. Every incident response team relies on the expertise,
judgment, and abilities of others . . .'').
\142\ See NIST SP 800-184, supra note 132; CIS Incident Response
Template, supra note 136, at 4 (``Without understanding the full
scope of an incident, how it happened, and what can be done to
prevent it from happening again, defenders will just be in a
perpetual `whack-a-mole' pattern.'').
---------------------------------------------------------------------------
Among these minimum requirements for the incident response plan is
the need for it to include escalation protocols, i.e., a process of
identifying when to involve or alert specific personnel, including
senior leadership, of an incident.\143\ Specifically, the proposed rule
would require that the senior officer, oversight body, or other senior-
level official that has primary responsibility for overseeing the
information and technology security program; the Chief Compliance
Officer (CCO); \144\ and any other relevant personnel be timely
informed of incidents that may significantly impact the covered
entity's regulatory obligations or require notification to the
Commission.\145\ This provision is designed to ensure that every
individual who has a role in responding to an incident at a covered
entity would be appropriately notified. CCOs of covered entities in
particular have a duty to take reasonable steps to ensure compliance
with Commission regulations relating to the covered entities' business
as a covered entity.\146\ Timely disclosure of incidents to the CCO
that could impact a covered entity's regulatory obligations or require
disclosure to the Commission would therefore be crucial for a covered
entity CCO to fulfill the duty to take reasonable steps to ensure
compliance. As previously discussed above in the section addressing
governance, the Commission believes that involving senior leadership in
incident response would be particularly important to ensure that they
are apprised of and held accountable for the ultimate effectiveness of
the ORF, and that incidents receive proper attention and are swiftly
addressed.
---------------------------------------------------------------------------
\143\ See paragraph (d)(3)(ii) of proposed Commission
regulations 1.13 and 23.603.
\144\ See 17 CFR 3.3 (establishing the qualifications and duties
of covered entity CCOs).
\145\ See paragraph (d)(3)(ii) of proposed Commission
regulations 1.13 and 23.603. See also paragraph (i) of proposed
Commission regulations 1.13 and 23.603 (requiring notification of
certain incidents to the Commission), discussed in section II.H of
this release, infra.
\146\ See 17 CFR 3.3(d)(3).
---------------------------------------------------------------------------
4. Request for Comment
The Commission invites comment on all aspects of the proposed
information and technology security program requirement, including the
following questions:
1. Risk Assessment.
a. The proposed rule would require that the risk assessment be
provided to relevant senior leadership of the covered entity upon its
completion but would not require that such senior leadership certify in
writing that they have received the results of the risk assessment or
approve the results of the risk assessment. Such approvals and
certifications may be required in other contexts to ensure that senior
leadership
[[Page 4721]]
is aware of risk assessments and consider them in establishing
strategic goals, risk appetite, and risk tolerance limits. Should the
Commission require such a certification or approval? Why or why not?
Please explain.
b. Given the rapidly evolving technological and threat landscape,
the proposed rule would require risk assessments to be performed on at
least an annual basis to support the mitigation of systemic risk and
develop a strong baseline standard across covered entities. The
Commission is aware of standards imposing risk assessments as
frequently as every six months and as infrequently as every two years.
Should the Commission consider a shorter or longer baseline frequency
for risk assessments? Why or why not? Please explain.
2. Effective controls. The proposed rule would require covered
entities to consider broad categories of controls and determine which
to adopt consistent with the proposed (b)(3) standard. The Commission
is also aware that certain controls, including firewalls, antivirus,
and multifactor authentication (MFA) are commonly recommended within
the industry. With respect to MFA, which requires users to present two
or more authentication factors at login to verify their identity before
they are granted access, CISA advises that implementing MFA is
important because it makes it more difficult for threat actors to gain
access to information systems, even if passwords or PINs are
compromised through phishing attacks or other means.\147\ In 2021,
FFIEC issued guidance advising financial institutions that MFA or
controls of equivalent strength, including for those employees, could
help more effectively mitigate risks when a financial institution's
risk assessment indicates that single-factor authentication with
layered security is inadequate.\148\ The guidance added that MFA
factors, which may include memorized secrets, look-up secrets, out-of-
band devices, one-time-password devices, biometrics identifiers, and
cryptographic keys, can vary in terms of usability, convenience, and
strength and their ability to be exploited.\149\ That same year, the
Federal Trade Commission updated its rule for safeguarding customer
information to mandate financial institutions to adopt MFA for all
users.\150\ The Commission preliminarily believes that requiring
covered entities to implement such widely recommended controls, such as
and including MFA, would help reduce cyber security risks and clarify
expectations. Should the Commission mandate the use of any specific
controls, including firewalls, antivirus, and/or MFA? Why or why not?
Please explain.
---------------------------------------------------------------------------
\147\ CISA, Multi-Factor Authentication Fact Sheet (Jan. 2022),
available at https://www.cisa.gov/sites/default/files/publications/MFA-Fact-Sheet-Jan22-508.pdf. NIST defines MFA as ``[a]n
authentication system that requires more than one distinct
authentication factor for successful authentication. Multi-factor
authentication can be performed using a multi-factor authenticator
or by a combination of authenticators that provide different
factors. The three authentication factors are something you know,
something you have, and something you are.'' NIST, SP 800-63-3,
Digital Identity Guidelines at 49 (June 2017).
\148\ FFIEC, Authentication and Access to Financial Institution
Services and Systems at 7 (rev. Jan. 5, 2022).
\149\ Id.
\150\ See Standards for Safeguarding Customer Information, 86 FR
70272 (Dec. 9, 2021); see also 16 CFR 314.4(c)(5) (requiring
financial intuitions to ``[i]mplement multi-factor authentication
for any individual accessing any information system unless [a
qualified individual, as defined in the rule] has approved in
writing the use of reasonably equivalent or more secure access
controls.'').
---------------------------------------------------------------------------
3. Incident response plan. As proposed, covered entities would be
required to notify their CCOs of incidents that they have determined
may significantly impact regulatory obligations or require notification
to the Commission. Commission staff are aware of instances where
covered entity CCOs have not been notified of incidents sufficiently
early to play a meaningful role in determining whether the incident
implicates any CFTC requirements and in developing an appropriate
remediation plan. Should covered entities be required to notify their
CCOs of all incidents, only incidents that may require notification
under the proposed rule, or incidents that may require notification
under the proposed rule to other financial regulatory authorities? Why
or why not?
D. Third-Party Relationship Program--Proposed Paragraph (e)
The second program required to be included as part of the proposed
ORF would be a third-party relationship program, defined as a written
program reasonably designed to identify, monitor, manage, and assess
risks relating to third-party relationships that meets the requirements
of the proposed rule.\151\ The Commission understands that covered
entities currently routinely rely upon third parties for a wide variety
of products, services, and activities, including, for example,
information technology, counterparty or customer relationship
management, accounting, compliance, human resources, margin processing,
trading, and risk management. Reliance on third-party service providers
carries many potential benefits, including a reduction in operating
costs and access to technological advancements that can improve
operations and regulatory compliance.\152\
---------------------------------------------------------------------------
\151\ See paragraph (e) of proposed Commission regulations 1.13
and 23.603. See also paragraph (a) of proposed regulations 1.13 and
23.603 (defining ``third-party relationship program'').
\152\ See Prudential Third-Party Guidance, 88 FR 37927 (``The
use of third parties can offer banking organizations significant
benefits, such as access to new technologies, human capital,
delivery channels, products, services, and markets.''); IOSCO
Outsourcing Report, supra note 65, at 4 (``The benefits of
outsourcing include lowering costs, increasing automation to speed
up tasks and reduce the need for manual intervention, and providing
flexibility to allow regulated entities to rapidly adjust both to
the scope and scale of their activities.''); FFIEC, Information
Technology Examination Handbook, Outsourcing Technology Services
Booklet at 1 (June 2004) (``The ability to contract for technology
services typically enables an institution to offer its customers
enhanced services without the various expenses involved in owning
the required technology or maintaining the human capital required to
deploy and operate it.'').
---------------------------------------------------------------------------
But that reliance is not riskless.\153\ As the ION incident
illustrated, operational disruptions of third-party services,
particularly of those important to a firm's operations or regulatory
obligations, can present challenges for individual firms and even the
financial system as a whole.\154\ The risks may vary from minor to
significant, depending on the nature of the provider or the service
being rendered, but they are inherent in the nature of a third-party
service provider relationship, in which a firm relies on the
performance of another entity and the quality and reliability of that
performance is not in the direct control of the firm.\155\ The
Commission accordingly believes that, in order to support their
operational resilience, covered entities should have a plan in place to
identify, monitor, manage, and assess the risks associated with third-
party relationships.\156\
---------------------------------------------------------------------------
\153\ See Prudential Third-Party Guidance, 88 FR 37927 (``[T]he
use of third parties can reduce a banking organization's direct
control over activities and may introduce new risks or increase
existing risks, such as operational, compliance, and strategic
risks.'').
\154\ See supra note 20 and accompanying text.
\155\ See Prudential Third-Party Guidance, 88 FR 37927
(``Increased risk often arises from greater operational or
technological complexity, newer or different types of relationships,
or potential inferior performance by the third party. A banking
organization can be exposed to adverse impacts, including
substantial financial loss and operational disruption, if it fails
to appropriately manage the risks associated with third-party
relationships.'').
\156\ For purposes of the proposed rule, the Commission would
construe ``third-party service provider'' broadly and consistently
with the terms ``third-party'' and ``business arrangement'' as used
in the Prudential Third-Party Relationship Guidance. See id.
(``Third-party relationships can include, but are not limited to,
outsourced services, use of independent consultants, referral
arrangements, merchant payment processing services, services
provided by affiliates and subsidiaries, and joint ventures. Some
banking organizations may form third-party relationships with new or
novel structures and features--such as those observed in
relationships with some financial technology (fintech)
companies.'').
---------------------------------------------------------------------------
[[Page 4722]]
As mentioned above, the Commission appreciates that the risks
presented by individual third-party relationships may vary depending on
the firm, the provider, or service. For instance, risks may be more
elevated if the service provider is a new entrant to the marketplace or
the service relates to a new, untested technology, and covered entities
with more numerous or intricate third-party relationships may
experience greater overall risk from third parties by virtue of the
number and complexity of their relationships. Accordingly, the proposed
rule would not require third-party relationship programs to apply an
identical degree of scrutiny and oversight to all third-party
relationships. Instead, consistent with the principles-based focus of
the proposed rule, and the proposed (b)(3) standard, the Commission
would expect covered entities to adopt a third-party relationship
program that helps them identify and assess the risks of their existing
and future third-party relationships and adapt their risk management
practices consistent with those risks, their risk appetite and risk
tolerance limits, and the nature, size, scope, complexity, and risk
profile of their business activities, following generally accepted
standards and best practices.\157\
---------------------------------------------------------------------------
\157\ See paragraph (b)(3) of proposed Commission regulations
1.13 and 23.603. See also NFA Third-Party Notice, supra note 43
(``NFA recognizes that a Member must have flexibility to adopt a
written supervisory framework relating to outsourcing functions to a
Third-Party Service Provider that is tailored to a Member's specific
needs and business . . .''); Prudential Third-Party Guidance, 88 FR
37924 (``[I]t is the responsibility of the banking organization to
identify and evaluate the risks associated with each third-party
relationship and to tailor its risk management practices,
commensurate with the banking organization's size, complexity, and
risk profile, as well as with the nature of its third-party
relationships.'').
---------------------------------------------------------------------------
1. Third-Party Relationship Lifecyle Stages--Proposed Paragraph (e)(1)
To guide covered entities in developing their third-party
relationship programs, and to ensure that the programs address the full
scope of risks that third-party relationships can present, the proposed
rule would require the third-party relationship program to describe how
the covered entity would address the risks attendant to each stage of
the third-party relationship lifecycle.\158\ Specifically, the proposed
rule would require the program to address: (i) pre-selection risk
assessment; (ii) the due diligence process for prospective third-party
relationships; \159\ (iii) contractual negotiations; (iv) ongoing
monitoring during the course of the relationship; and (v) termination
of the relationship, including preparations for planned and unplanned
terminations.\160\
---------------------------------------------------------------------------
\158\ See paragraph (e)(1) of proposed Commission regulations
1.13 and 23.603.
\159\ The proposed rule is not intended to interfere with the
obligation in Commission regulation 1.11(e) for FCMs to conduct
onboarding and ongoing due diligence on depositories carrying
customer funds. See 17 CFR 1.11(e)(3)(i)(A)-(B).
\160\ See paragraphs (e)(1)(i)-(v) of proposed Commission
regulations 1.13 and 23.603. See also NFA Third-Party Notice
(requiring NFA members to establish a written supervisory framework
that includes an initial risk assessment, onboarding due diligence,
ongoing monitoring, termination, and recordkeeping); 12 CFR part 30,
app. B, III.D. (Oversee Service Provider Arrangements) (requiring
financial institutions to exercise appropriate due diligence in
selecting service providers, contract with service providers to
implement ``appropriate measures designed to meet the objectives
of'' prudential guidelines for information security; and, where
indicated by its risk assessment, monitor service providers to
confirm they have satisfied their obligations).
---------------------------------------------------------------------------
Each of these stages offers covered entities opportunities to
assess and take steps to mitigate the potential risks associated with
reliance on third-party service providers. At the outset, covered
entities should determine whether it is appropriate for a third-party
service provider to perform a particular service and evaluate the
associated risks.\161\ For instance, the determination to secure a
third-party service provider may carry greater risks where the service
directly impacts a regulatory requirement, where the third-party
service provider would be given direct access to covered information,
or where a disruption of services could impact regulatory compliance or
have a negative impact on customers or counterparties. Due diligence
provides covered entities with information to assess whether a
prospective third-party service provider is equipped, operationally and
otherwise, to perform as expected.\162\ Contractual negotiations offer
a possibility to mitigate potential risks by including provisions to
assign specific responsibilities or liabilities, but may also
contribute to risks, especially where a covered entity may have more
limited negotiating power.\163\ Ongoing monitoring of a third-party
service provider's performance likewise aids covered entities in
identifying whether selected third-party service providers remain able
to perform as expected throughout the duration of the
relationship.\164\ Finally, the manner in which the relationship ends
can have a major impact on the covered entity, particularly if it ends
due to a breach of performance. Plans to address the termination,
through contingencies or otherwise, could therefore prove important to
ensuring the covered entity's ongoing operations.\165\ The Commission
therefore preliminarily believes that effective management of third-
party risks would require covered entities to have a program that
establishes methodologies and practices to assess and manage the risks
of third-party relationships throughout each of these five stages of
the third-party relationship lifecycle.\166\
---------------------------------------------------------------------------
\161\ See NFA Third-Party Notice (``At the outset, a Member
should determine whether a particular regulatory function is
appropriate to outsource and evaluate the risks associated with
outsourcing the function.''); Prudential Third-Party Guidance, 88 FR
37928 (``As part of sound risk management, effective planning allows
a banking organization to evaluate and consider how to manage risks
before entering into a third-party relationship.'').
\162\ See IOSCO Outsourcing Report, supra note 65, at 18 (``It
is important that regulated entities exercise due care, skill, and
diligence in the selection of service providers. The regulated
entity should be satisfied that the service provider has the ability
and capacity to undertake the provision of the outsourced task
effectively at all times.''); Prudential Third-Party Guidance, 88 FR
37929 (``Conducting due diligence on third parties before selecting
and entering into third-party relationships is an important part of
sound risk management. It provides management with the information
needed about potential third parties to determine if a relationship
would help achieve a banking organization's strategic and financial
goals. The due diligence process also provides a banking
organization with the information needed to evaluate whether it can
appropriately identify, monitor, and control risks associated with
the particular third-party relationship.'').
\163\ See IOSCO Outsourcing Report at 21 (``Contractual
provisions can reduce the risks of non-performance or aid the
resolution of disagreements about the scope, nature, and quality of
the service to be provided.'').
\164\ See id. at 18 (``The regulated entity should also
establish appropriate processes and procedures for monitoring the
performance of the service provider on an ongoing basis to ensure
that it retains the ability and capacity to continue to provide the
outsourced task.'').
\165\ See id. at 33 (``Where a task is outsourced, there is an
increased risk that the continuity of the particular task in terms
of daily management and control of that task, related information
and data, staff training, and knowledge management, is dependent on
the service provider continuing in that role and performing that
task.'').
\166\ See Prudential Third-Party Guidance, 88 FR 37928
(``Effective third-party risk management generally follows a
continuous life cycle for third-party relationships.'').
---------------------------------------------------------------------------
2. Heightened Requirements for Critical Third-Party Service Providers--
Proposed Paragraph (e)(2)
Although the Commission appreciates that third-party risks are not
uniform, it nevertheless believes that certain circumstances warrant
enhanced risk management practices across all covered entities.
Specifically, the proposed rule would require that the third-party
relationship program establish heightened due diligence and ongoing
[[Page 4723]]
monitoring practices with respect to third-party service providers
deemed critical third-party service providers.\167\ The proposed rule
would define ``critical third-party service provider'' to mean a third-
party service provider, the disruption of whose performance would be
reasonably likely to either (a) significantly disrupt a covered
entity's businesses operations or (b) significantly and adversely
impact the covered entity's counterparties or customers.\168\ The
Commission understands that it is common practice for financial
institutions, whether by regulatory mandate or otherwise, to identify a
subset of services or providers more central to their operations and
apply greater scrutiny and oversight to them to ensure the services are
provided without disruption. The proposed rule's definition of
``critical third-party service provider'' focuses on the potential
impact a disruption to performance would have on the covered entity's
regulated business operations, customers, or counterparties. Where such
an impact would be significant, as assessed in light of the covered
entity's business activities, risk appetite, and risk tolerance limits,
the Commission believes heightened due diligence for potential critical
third-party service providers and ongoing monitoring for onboarded
critical third-party service providers are warranted to both mitigate
the potential for such an occurrence and to promote the ability for
covered entities to take early and effective action if a critical
third-party service provider's performance is disrupted to mitigate the
impact and effectively recover.\169\
---------------------------------------------------------------------------
\167\ See paragraph (e)(2) of proposed Commission regulations
1.13 and 23.603.
\168\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``critical third-party service provider'').
\169\ See NFA Third-Party Notice, supra note 43 (``Additionally,
a Member's onboarding due diligence process should be heightened for
Third-Party Service Providers that obtain or have access to a
Member's critical and/or confidential data and those that support a
Member's critical regulatory-related systems (e.g., handling
customer segregated funds, keeping required records, filing
financial reports, etc.).'').
---------------------------------------------------------------------------
3. Third-Party Service Provider Inventory--Proposed Paragraph (e)(3)
To help ensure that covered entities implement a comprehensive and
consistent approach to identifying their critical third-party service
providers, covered entities would be required to create, maintain, and
regularly update an inventory of third-party service providers they
have engaged to support their activities as a covered entity,
identifying whether each third-party service provider in the inventory
is a critical third-party service provider.\170\ The Commission
preliminarily believes that the process of creating an inventory of
service providers, particularly the deliberative process involved in
designating certain providers as critical third-party service
providers, would help covered entities assess and evaluate the risks
they face from their third-party service providers, and determine when
to apply heightened monitoring. Maintaining such an inventory would
also reflect that not all third-party service providers present the
same level and types of risks to a covered entity, and would help
covered entities assess and evaluate who is providing services and the
attendant risk that any disruption of those services would have on a
covered entity's business. The inventory would also provide covered
entities a holistic view of their third-party service providers, which
would help them better understand how risks identified during due
diligence and ongoing monitoring may interact or require additional
management. Having a clear understanding of who is providing services,
particularly those services identified as critical, would further
assist covered entities in identifying potential interconnections that
may not be readily apparent if the entities are not assembled and
reviewed collectively.\171\
---------------------------------------------------------------------------
\170\ See paragraph (e)(3) of proposed Commission regulations
1.13 and 23.603.
\171\ Prudential Third-Party Guidance, 88 FR 37927
(``Maintaining a complete inventory of its third-party relationships
and periodically conducting risk assessments for each third-party
relationship supports a banking organization's determination of
whether risks have changed over time and to update risk management
practices accordingly.'').
---------------------------------------------------------------------------
Covered entities relying on a consolidated third-party relationship
program would be able to rely on an enterprise-wide third-party service
provider inventory provided that the inventory meets the requirements
of the proposed rule, including identifying critical third-party
service providers specific to the covered entity.\172\
---------------------------------------------------------------------------
\172\ See paragraph (c)(4)(i) of proposed Commission regulations
1.13 and 23.603 (allowing covered entities to rely on consolidated
programs).
---------------------------------------------------------------------------
4. Retention of Responsibility--Proposed Paragraph (e)(3)
For the avoidance of doubt, the proposed rule would make clear
that, notwithstanding their determination to rely on a third-party
service provider, covered entities remain responsible for meeting their
obligations under the CEA and Commission regulations.\173\ This
provision reflects the principle, widely recognized among financial
regulatory authorities, including the Commission, that while financial
institutions may be able to delegate functions to third-party service
providers, they cannot delegate their responsibility to comply with
applicable laws and regulations.\174\ This provision is intended to
ensure that covered entities are aware that they remain responsible for
the performance of all applicable regulatory functions, whether
performed by the covered entity or by a third-party service provider,
and are accordingly fully subject to the Commission's jurisdiction,
including its examination and enforcement authorities.
---------------------------------------------------------------------------
\173\ See paragraph (e)(3) of proposed Commission regulations
1.13 and 23.603.
\174\ See NFA Third-Party Notice, supra note 43 (``If a Member
outsources a regulatory function, however, it remains responsible
for complying with NFA and/or CFTC Requirements and may be subject
to discipline if a Third-Party Service Provider's performance causes
the Member to fail to comply with those Requirements.''); Prudential
Third-Party Guidance, 88 FR 37927 (``A banking organization's use of
third parties does not diminish its responsibility to meet these
requirements to the same extent as if its activities were performed
by the banking organization in-house.''); IOSCO Outsourcing Report,
supra note 65, at 12 (``The regulated entity retains full
responsibility, legal liability, and accountability to the regulator
for all tasks that it may outsource to a service provider to the
same extent as if the service were provided in-house.''). See also
17 CFR 37.204 (SEFs); 17 CFR 38.154 (DCMs); 17 CFR 39.18(d) (DCOs)
(providing that such registered entities retain responsibility for
meeting relevant regulatory requirements when entering into
contractual outsourcing arrangements).
---------------------------------------------------------------------------
5. Application to Existing Third-Party Relationships
Should the proposed rule be adopted as final, the Commission would
expect covered entities to apply their third-party relationship
programs across all stages of the relationship lifecycle on a going-
forward basis. Although the Commission would not require covered
entities to renegotiate or terminate existing agreements, it would
expect covered entities to conduct ongoing monitoring of existing
third-party service providers consistent with the program and this
regulation and, to the extent possible, to rely on its program with
respect to termination. For any third-party service providers
contemplated or onboarded after the effective date of the proposed
rule, or for any contracts renegotiated or renewed after the effective
date of the rule, however, the Commission would expect covered entities
to apply the entirety of the third-party relationship program from pre-
selection through termination.
[[Page 4724]]
6. Guidance on Third-Party Relationship Programs--Proposed Paragraph
(e)(4); Appendix A to Part 1; Appendix A to Subpart J of Part 23
To assist covered entities in developing third-party relationship
programs that adequately address risks from third-party relationships,
the Commission is proposing guidance outlining potential risks,
considerations, and strategies for covered entities to consider.\175\
The proposed guidance addresses all five stages of the relationship
lifecycle and, if adopted, would be codified as appendices to parts 1
and 23 of the Commission's regulations for FCMs and swap entities,
respectively.\176\ Designed to be broadly applicable to all covered
entities, the proposed guidance identifies actions and factors for
covered entities to consider. The factors and actions identified are
not exhaustive, nor should they be viewed as a required checklist. The
nonbinding guidance would merely be intended to aid covered entities as
they design third-party relationship programs tailored to their own
unique circumstances, consistent with the general ORF ``appropriate and
proportionate standard'' discussed above.
---------------------------------------------------------------------------
\175\ See paragraph (e)(4) of proposed Commission regulations
1.13 and 23.603.
\176\ See proposed Appendix A to part 1 and proposed Appendix A
to Subpart J of part 23.
---------------------------------------------------------------------------
In developing the proposed guidance, the Commission considered the
recommendations of international standard-setting bodies, including
IOSCO and FSB, in light of observations and lessons derived from its
own oversight activities.\177\ In an effort to incorporate as much
consensus as possible, the Commission also gave special consideration
to existing guidance from NFA and the guidance on third-party
relationships recently adopted by prudential regulators, both of which
currently apply to at least some covered entities.\178\
---------------------------------------------------------------------------
\177\ See IOSCO Outsourcing Report, supra note 65; FSB Third-
Party Report, supra note 44.
\178\ See NFA Third-Party Notice; Prudential Third-Party
Guidance, 88 FR 37920.
---------------------------------------------------------------------------
The full text of the guidance is included at the end of this notice
as proposed appendix A to part 1 for FCMs and proposed appendix A to
subpart J of part 23. The guidance is identical in substance for FCMs
and swap entities.
7. Request for Comment
The Commission invites comment on all aspects of the proposed
third-party relationship program requirement and associated guidance,
including the following questions:
1. Scope of Application. NFA's interpretive notice on third-party
relationships is limited in scope to ``outsourcing,'' which NFA defines
as third-party relationships in which an NFA member has a third-party
service provider or vendor perform certain functions that would
otherwise by undertaken by the member itself to comply with NFA and
CFTC requirements.\179\ The proposed rule would follow the approach
taken by prudential regulators in their third-party guidance, which
more broadly addresses any circumstances where banking organizations
rely on third parties for products, services, or activities to
``capture[ ] the full range of third-party relationships that may pose
risk to banking organizations.'' \180\ Should the Commission consider
limiting the scope of its guidance to outsourcing of CFTC regulatory
obligations? Why or why not? Please explain.
---------------------------------------------------------------------------
\179\ See NFA Third-Party Notice, supra note 43.
\180\ See Prudential Third-Party Guidance, 88 FR 37921-22.
---------------------------------------------------------------------------
2. Critical third-party service provider. The proposed rule
includes a definition of ``critical third-party service provider.'' The
Commission understands it is common practice for financial institutions
to identify and apply heightened oversight of third-party service
providers they deem critical. NFA's interpretive notice related to
third-party relationships, for instance, advises members to tailor the
frequency and scope of ongoing monitoring reviews to the criticality of
and risk associated with the outsourced function but does not define
``criticality'' for covered entities. Is the Commission's proposed
definition consistent with existing standards or definitions of
``criticality'' applied by covered entities? If not, how is it
different? Should the Commission consider allowing covered entities to
generate and apply their own definition of ``critical third-party
service provider''? Why or why not? Please explain.
3. Guidance--Affiliated Third-Party Service Providers. The proposed
third-party relationship program requirement would apply to all third-
party relationships, including where the third-party is an affiliate of
the covered entity. This position is consistent with both NFA and
prudential guidance related to third-party relationships.\181\
Nevertheless, the Commission recognizes that arrangements with
affiliates may present different or lower risks than with unaffiliated
third parties. Should the Commission consider including any additional
guidance with respect to the management of third-party service
providers that are affiliated entities? If so, what factors should
covered entities consider when evaluating relationships with affiliated
third-party service providers?
---------------------------------------------------------------------------
\181\ See NFA Third-Party Notice at n.1 (``Further, even if a
Member outsources a regulatory obligation to an affiliate, . . . a
Member should comply with this Notice's requirements.''); Prudential
Third-Party Guidance, 88 FR 37927 (``Third-party relationships can
include, but are not limited to, . . . services provided by
affiliates and subsidiaries. . .'').
---------------------------------------------------------------------------
4. Guidance--Due Diligence. The proposed guidance recommends that
covered entities perform due diligence on prospective third-party
service providers to assess their ability to deliver contracted
services to an acceptable standard (i.e., consistent with risk appetite
and risk tolerance limits) and provides examples of information that
covered entities should review and sources for obtaining that
information.
a. Are there any additional due diligence tasks that should be
conducted by the covered entity beyond reviewing information about the
potential third-party service provider? Are there additional risks that
should be included in the guidance for the covered entity to inquire
into? If yes, please identify and explain.
b. Are there additional sources of due diligence information beyond
those listed in the guidance (see section B of the guidance) that
should be included in the guidance? If yes, please identify and
explain.
c. Should covered entities be advised to periodically refresh their
due diligence, or upon the occurrence of specific triggers (e.g., a
material change to the service outsourced)? Why or why not? Would such
a recommendation be duplicative of the covered entity's ongoing
monitoring activities, or would the subsequent due diligence provide
additional valuable information to the covered entity beyond that
provided by ongoing monitoring? Why or why not? Please explain.
d. The proposed guidance does not recommend that covered entities
perform due diligence directly on any subcontractors secured by third-
party service providers. Rather, the Commission's guidance suggests
that covered entities review the operational risk management practices
of the potential third-party service provider with respect to their
subcontractors. Should the Commission recommend more enhanced due
diligence of subcontractors? Why or why not? What
[[Page 4725]]
means are practicable for covered entities to conduct due diligence on
subcontractors to their third-party service providers? Please identify
and explain.
E. Business Continuity and Disaster Recovery Plan--Proposed Paragraph
(f)
The third component of the ORF would be a business continuity and
disaster recovery (BCDR) plan, defined as a written plan outlining the
procedures to be followed in the event of an emergency or other
significant disruption to the continuity of a covered entity's normal
business operations and that meets the requirements of the proposed
rule.\182\ Similar to the incident response plan (and, in extreme
cases, possibly triggered by an incident covered by the incident
response plan), the proposed BCDR plan requirement recognizes the
operational reality that not all operational disruptions can be
prevented or immediately mitigated and asks covered entities to
strategize and implement plans for how to minimize the impact to
operations, customers, and counterparties when such adverse events
occur.
---------------------------------------------------------------------------
\182\ See paragraph (f) proposed Commission regulations 1.13 and
23.603. See also paragraph (a) of proposed Commission regulations
1.13 and 23.603 (defining ``business continuity and disaster
recovery plan'').
---------------------------------------------------------------------------
Although NFA requires FCMs to establish and maintain a BCDR plan,
if adopted, the proposed rule would create a new CFTC BCDR plan
requirement for FCMs.\183\ Current Commission regulation 23.603
contains an active BCDR plan requirement for swap entities.\184\ In
essence, the proposal would make certain amendments to the CFTC BCDR
plan requirement for swap entities and expand the requirement to
include FCMs. The proposed amendments to the swap entity BCDR plan
requirement have two general purposes. For the most part, the proposal
would streamline and simplify some of the language to help it further
conform to the proposed ORF rule more broadly, in ways the Commission
intends to be non-substantive. The proposal would also make a few
substantive changes, informed either by the Commission's review of
NFA's and CME's current BCDR requirements for their members or by its
decade of experience applying current Commission regulation 23.603 to
swap entities.\185\ The proposed substantive changes, each subsequently
discussed in this notice, relate to either the defined scope of and
recovery objective for the BCDR plan or the testing and audit
requirements for the plan.
---------------------------------------------------------------------------
\183\ See NFA Rule 2-38, supra note 43.
\184\ See 17 CFR 23.603.
\185\ See NFA Rule 2-38; CME Rule 983 (Disaster Recovery and
Business Continuity).
---------------------------------------------------------------------------
Current Commission regulation 23.603 includes requirements that the
proposed rule would apply to the entirety of the proposed ORF more
broadly. Those requirements include requirements to: distribute the
BCDR plan to relevant employees (current Commission regulation
23.603(c)); notify the Commission of emergencies or disruptions
(current Commission regulation 23.603(d)); identify emergency contacts
(current Commission regulation 23.603(e)); review, test, and update the
BCDR plan (current Commission regulation 23.603(f) and (g)); and
recordkeeping (current Commission regulation 23.603(i)). Each of these
requirements is discussed in the relevant sections of this notice that
follow.\186\ Accordingly, the Commission's proposed amendment to the
current BCDR audit requirement is discussed in the context of the ORF's
broader proposed review and testing requirements.\187\
---------------------------------------------------------------------------
\186\ See sections II.F (Training), G (Review and Testing), H
(Required Notifications), and I (Emergency Contacts, Recordkeeping)
of this notice, infra. The proposed rule would not retain Commission
regulation 23.603(h), which merely articulates the fact that swap
entities are required to comply with Commission's BCDR requirements
in addition to any other applicable BCDR requirements from other
regulatory bodies. See 17 CFR 23.603(h). The Commission accordingly
views this amendment as non-substantive.
\187\ See paragraph (h) of proposed Commission regulations 1.13
and 23.603 and section II.G, infra.
---------------------------------------------------------------------------
1. Definition of ``Business Continuity and Disaster Recovery Plan''
The proposed definition of ``business continuity and disaster
recovery plan'' is slightly modified from the language in the current
BCDR plan requirement for swap entities. Current Commission regulation
23.603 requires swap entities to establish and maintain a BCDR plan
that ``outlines the procedures to be followed in the event of an
emergency or other disruption of its normal business activities.''
\188\ As stated above, the proposed rule would specify that the BCDR
plan would need to address ``significant'' disruptions to the
continuity of a covered entity's normal business operations, which the
Commission preliminarily believes is more in line with what would
constitute an ``emergency'' that would result in activation of a BCDR
plan and how Commission regulation 23.603 has operated in
practice.\189\
---------------------------------------------------------------------------
\188\ See 17 CFR 23.603(a).
\189\ See also NFA Rule 2-38, supra note 43 (requiring certain
members, including FCMs, to establish a BCDR plan to be followed in
the event of a ``significant business disruption''). The proposed
language change from ``normal business activities'' to ``the
continuity of normal business operations'' is intended only to bring
the language more in line with the focus of the proposed ORF rule on
the resiliency of operations and is not intended to have substantive
effect. See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``business continuity and disaster recovery
plan''); 17 CFR 23.603(a).
---------------------------------------------------------------------------
2. Purpose--Proposed Paragraph (f)(1)
Under the proposed rule, the BCDR plan would need to be reasonably
designed to enable covered entities to: (i) continue or resume normal
business operations with minimal disruption to customers or
counterparties and the markets and (ii) recover and make use of all
covered information, as well as any other data, information, or
documentation required to be maintained by law and regulation.\190\ The
Commission preliminarily believes that this standard, which emphasizes
the need to quickly resume regulated activities and to recover all
information kept and required to be kept in connection with those
activities, supports the overall regulatory objectives of the ORF rule
of enhancing the operational resilience of covered entities to promote
the protection of customers and the mitigation of system risk.
---------------------------------------------------------------------------
\190\ See paragraphs (f)(1)(i)-(ii) of proposed Commission
regulations 1.13 and 23.603. See also 17 CFR 23.603(a).
---------------------------------------------------------------------------
Current Commission regulation 23.603 requires swap entities' BCDR
plans to ``be designed to enable the [swap entity] to continue or to
resume any operations by the next business day with minimal disturbance
to its counterparties and the market.'' The proposed rule would modify
this language by requiring that the BCDR plan be ``reasonably''
designed to continue or resume operations with minimal disruption and
by removing the requirement that such operations be resumed ``by the
next business day.'' \191\ The Commission views the qualification that
the BCDR plan be ``reasonably'' designed as simply a more concrete
expression of the Commission's current expectations, in recognition
that what might be necessary to achieve recovery is not an absolute
fact and may vary depending on the circumstances, including the nature,
size, scope, complexity, and risk profile of a covered entity's
business activities.\192\ The
[[Page 4726]]
reasonableness of the plan would thus be viewed in light of the
proposed (b)(3) standard (i.e., what is appropriate and proportional to
the covered entity, following generally accepted standards and best
practices).
---------------------------------------------------------------------------
\191\ The Commission views the use of the phrase ``minimal
disturbance'' in current Commission regulation 23.603 as equivalent
to the phrase ``minimal disruption'' in the proposed rule and
therefore views this change in language with respect to swap
entities to be non-substantive. Compare 17 CFR 23.603(a) with
paragraph (f)(1) of proposed Commission regulations 1.13 and 23.603.
\192\ See also NFA Rule 2-38 (requiring BCDR plans be
``reasonably designed'') (emphasis added).
---------------------------------------------------------------------------
The proposal not to include a next business day recovery time
objective is based in the Commission's preliminary view that, depending
on the circumstances, a next business day recovery standard could be
either too short or too long, to the point where it may be misdirecting
the focus of the rule. The Commission understands that the ``next
business day'' standard has been common for businesses to employ for
BCDR purposes in the context of purely physical disasters, such as
power outages or natural disasters. Based on its experience in recent
years, however, the Commission believes a next-day standard may in some
cases be impractical in an era where rapid innovation has deepened and
expanded reliance on technology among financial institutions, and
pandemics and cyberattacks have become more prevalent or alarming forms
of disruption. With the ION incident, for instance, it took weeks
before back office operations were back to normal. Nevertheless, the
impact to customers and the markets during that time was manageable.
Were even one business day to stretch between FCMs paying and
collecting margin, for example, the Commission does not believe the
impact to customers or the markets could be characterized as minimal.
Accordingly, the Commission preliminarily believes that by not
including a precise recovery time objective, such as next business day,
the emphasis of the proposed BCDR plan standard appropriately lies on
ensuring that any disruption to customers, counterparties, and the
markets is ``minimal.'' \193\ For that standard to be met, however, the
Commission would still expect covered entities to plan for a recovery
that is expeditious. The longer a covered entity is not operating as
usual, the more likely it is that customers and counterparties may be
affected and that a crisis in confidence could develop, potentially
affecting the industry more broadly.
---------------------------------------------------------------------------
\193\ The Commission notes that neither NFA nor CME includes a
specific recovery time objective in its BCDR plan requirements. See
NFA Rule 2-38; CME Rule 938.
---------------------------------------------------------------------------
Current Commission regulation 23.603 requires swap entities' BCDR
plans to be designed ``to recover all documentation and data required
to be maintained by applicable law and regulation.'' The proposal to
require covered entities to reasonably design their BCDR plans to
``recover and make use of all covered information, as well as any other
data, information, or documentation required to be maintained by law
and regulation'' is intended to both incorporate the proposed defined
term ``covered information,'' and make clear the need to also preserve
the availability of the recovered data and information (i.e., reliable
access to and use of information), which the Commission believes is an
integral component of information and technology security.\194\ The
Commission believes that making plans to ensure covered information--
sensitive or confidential information and data the proposed ORF rule is
designed, at its core, to ensure covered entities protect--as well as
any other information covered entities are legally required to
maintain, is recovered and accessible following an emergency is key to
ensuring the protection of customers and counterparties and the ongoing
orderly functioning of the commodity interest markets, as this
information is vital to a covered entity's ability to assess its
ongoing compliance with the Commission's regulations governing the
requirements for covered entities.\195\
---------------------------------------------------------------------------
\194\ See supra note 108 and accompanying text (discussing the
``CIA triad'' of confidentiality, integrity, and availability).
\195\ In designing a BCDR plan that would meet this recovery
standard, the Commission would advise covered entities to identify a
broad range of events that could constitute emergencies or pose
significant disruptions, including natural events (e.g., hurricanes,
wildfires), technical events (e.g., power failures, system
failures), malicious activity (e.g., fraud, cyberattacks), failures
of controls, and low likelihood but high impact events (e.g.,
terrorist attacks, pandemics), and consider potential impact on
business operations and data and information.
---------------------------------------------------------------------------
3. Minimum Contents--Proposed Paragraph (f)(2)
Consistent with the proposed (b)(3) standard for the ORF as a
whole, the BCDR plan would need to be appropriate and proportionate to
the covered entity, following generally accepted standards and best
practices.\196\ Accordingly, should the proposal be adopted as final,
the Commission would expect each BCDR plan to be highly tailored to
each specific covered entity. However, the proposed rule would also
require the BCDR plan to include certain minimum contents, which are
generally comparable to the current requirements in Commission
regulation 23.603.\197\
---------------------------------------------------------------------------
\196\ See paragraph (b)(3) of proposed Commission regulations
1.13 and 23.603.
\197\ See paragraph (f)(2) of proposed Commission regulations
1.13 and 23.603. See also 17 CFR 23.603(b). Although the exact
language of the proposed minimum contents in paragraph (f)(2) may
diverge somewhat from that of current Commission regulation
23.603(b), the modifications were intended to streamline language
and incorporate the proposed terms ``covered information'' and
``covered technology.'' The Commission does not intend any of the
changes to have a substantive impact on compliance with the
Commission's BCDR plan requirement for swap entities.
---------------------------------------------------------------------------
First, the proposed rule would require the BCDR plan to identify
its covered information, as well as any other data or information
required to be maintained by law or regulation, and to establish and
implement procedures to backup or copy it with sufficient frequency and
to store it offsite in either hard-copy or electronic format.\198\ The
BCDR plan would also need to identify any resources, including covered
technology, facilities, infrastructure, personnel, and competencies,
essential to the operations of the swap entity or to fulfill the
regulatory obligations of the swap entity, and establish and maintain
procedures and arrangements to provide for their backup in a manner
that is sufficient to meet the requirements of the rule (i.e., to
continue or resume operations with minimal disruption, to recover and
make use of information).\199\ These minimum requirements are intended
to ensure that the BCDR plan meets the proposed recovery standard by
ensuring covered entities have gone through the process of cataloging
everything they need (information, technology, infrastructure, human
capital, etc.) to operate as a covered entity, and have established
ways to recover them and to continue or resume operations with minimal
disruption to customers, counterparties, or the markets. Furthermore,
in establishing arrangements for backup resources, the Commission would
want covered entities to consider diversification to the greatest
extent possible to reduce the likelihood that an emergency that affects
a primary operating resource affects any planned backups. Accordingly,
the proposed rule would require covered entities to establish backup
arrangements for resources that are in one or more areas geographically
separate from the covered entity's primary resources (e.g., a different
power grid than the primary facility).\200\ The proposed rule would
make clear those resources could be
[[Page 4727]]
provided by third-party service providers.\201\
---------------------------------------------------------------------------
\198\ See paragraph (f)(2)(i) of proposed Commission regulations
1.13 and 23.603. See also 17 CFR 23.603(b)(1), (b)(6).
\199\ See paragraph (f)(2)(ii) of proposed Commission
regulations 1.13 and 23.603. See also 17 CFR 23.603(b)(2), (b)(4),
(b)(5).
\200\ See paragraph (f)(2)(ii) of proposed Commission
regulations 1.13 and 23.603. See also 17 CFR 23.603(b)(5).
\201\ See id.
---------------------------------------------------------------------------
To ensure that critical third-party service providers are given
particular consideration when planning for disruptions, the proposed
rule would specifically require the BCDR plan to identify potential
disruptions to critical third-party service providers and establish a
plan to minimize the impact of such potential disruptions.\202\
Additionally, given the importance of internal and external
communication in times of crisis, and for duties and responsibilities
to be well established, the proposed rule would require the BCDR plan
to identify supervisory personnel responsible for implementing the BCDR
plan, along with the covered entity's required ORF emergency contacts,
and establish a procedure for communicating with relevant persons in
the event of an emergency or significant disruption.\203\
---------------------------------------------------------------------------
\202\ See paragraph (f)(2)(iii) of proposed Commission
regulations 1.13 and 23.603. See also 17 CFR 23.603(b)(7) (identify
``potential business interruptions encountered by third parties that
are necessary to the continued operations of the swap dealer or
major swap participant and a plan to minimize the impact of such
disruptions'').
\203\ See paragraphs (f)(2)(iv)-(v) of proposed Commission
regulations 1.13 and 23.603. See also paragraph (k) of proposed
Commission regulations 1.13 and 23.603 (requiring emergency
contacts), discussed in section II.I.1 of this notice, infra; 17 CFR
23.603(b)(3).
---------------------------------------------------------------------------
The minimum contents of the proposed BCDR plan requirement were
designed to align with the substance of the ``essential components'' of
a BCDR plan identified in current Commission regulation 23.603(b), with
certain modifications.\204\ The changes are intended to streamline
language, incorporate the proposed BCDR plan standard and defined terms
(e.g., covered information, covered technology, critical third-party
service provider), and reorder and combine elements to improve
readability and application. Key changes include:
---------------------------------------------------------------------------
\204\ See 17 CFR 23.603(b).
---------------------------------------------------------------------------
Replacing the identification or backup of documents and
information essential to the continued operations of the swap entity
and/or to fulfill the regulatory obligations of the swap dealer or
major swap participant with covered information, as well as any other
data or information required to be maintained by law and
regulation.\205\ This change is intended to align the information
required to be identified in the proposed BCDR plan with its purpose
(recover and make use of all covered information, as well as any other
data, information, or documentation required to be maintained by law
and regulation).
---------------------------------------------------------------------------
\205\ See proposed paragraph (f)(2)(i) of Commission regulations
1.13 and 23.603; 17 CFR 23.603(b)(1) (Identification of the
documents and data essential to the continued operations of the swap
entity and to fulfill the obligations of the swap entity); (b)(6)
(Back-up or copying of documents and data essential to the
operations of the swap entity or to fulfill the regulatory
obligations of the swap entity'').
---------------------------------------------------------------------------
Specifying that data and information must be backed up or
copied with sufficient frequency ``to meet the requirements of this
section,'' to make clear that the backup frequency should be linked to
the broader purpose of the BCDR plan (i.e., to continue or resume
operations with minimal disruption and to recover and make use of in-
scope information).\206\
---------------------------------------------------------------------------
\206\ Cf. 17 CFR 23.603(b)(6) (Back-up or copying, with
sufficient frequency, of documents and data).
---------------------------------------------------------------------------
Removing the qualification that resource backups be
designed to achieve the timely recovery of data and documentation and
to resume operations as soon as reasonably possible and generally
within the next business day.\207\ This language could be viewed as in
contradiction with the overall proposed purpose of the BCDR plan, which
would not include a ``next business day'' recovery time objective.
---------------------------------------------------------------------------
\207\ See 17 CFR 23.603(b)(4) (Procedures for, and the
maintenance of, back-up facilities, systems, infrastructure,
alternative staffing and other resources to achieve the timely
recovery of data and documentation and to resume operations as soon
as reasonably possible and generally within the next business day.).
---------------------------------------------------------------------------
Replacing third parties that are necessary to the
continued operations of the swap dealer or major swap participant with
critical third-party service provider, as defined in the proposed rule,
as the Commission believes these terms are intended to capture similar
concepts.\208\
---------------------------------------------------------------------------
\208\ See 17 CFR 23.603(b)(7) (Identification of potential
business interruptions encountered by third parties that are
necessary to the continued operations of the swap dealer or major
swap participant and a plan to minimize the impact of such
disruptions.).
---------------------------------------------------------------------------
4. Accessibility--Proposed Paragraph (f)(3)
Finally, to ensure that the BCDR plan is available in the event of
an emergency or other significant disruption that prevents a covered
entity from accessing its primary office location, the proposed rule
would require each covered entity to maintain copies of its BCDR plan
at one or more accessible off-site locations.\209\
---------------------------------------------------------------------------
\209\ See paragraph (e)(3) of proposed Commission regulations
1.13 and 23.603. See also 17 CFR 23.603(c).
---------------------------------------------------------------------------
5. Request for Comment
The Commission invites comment on all aspects of the proposed
business continuity and disaster recovery plan requirement, including
the following question:
1. Recovery time objective. Under current Commission regulation
23.603, the Commission requires swap entities to establish and maintain
a BCDR plan that is designed to enable the swap entity to continue or
resume any operations ``by the next business day'' with minimal
disturbance to is counterparties.\210\ Noting that such a standard may
pose some challenges, the Commission has proposed to not include a
recovery time objective, relying on covered entities to establish a
BCDR plan that allows for sufficiently exigent recovery so as to impose
``minimal disruption'' to customers, counterparties, or the markets.
---------------------------------------------------------------------------
\210\ See 17 CFR 23.603(a).
---------------------------------------------------------------------------
a. Has a next business day standard posed challenges for swap
entities to implement? Would such a standard be achievable for FCMs?
Why or why not? Please explain.
b. Should the Commission consider including additional language to
ensure covered entities design BCDR plans that enable quick recovery
(e.g., ``as soon as possible'' or ``as soon as practicable'')? Why or
why not? Please explain.
2. Transfer of business to another entity. NFA and CME rules allow
for BCDR plans to include the possibility of transferring their
business to another regulated entity in the event of an emergency or
disruption. NFA Rule 2-38 provides that a BCDR plan ``shall be
reasonably designed to . . . transfer its business to another Member
with minimal disruption to its customers, other members, and the
commodity futures markets.'' \211\ CME Rule 983 provides that clearing
members must have procedures in place to allow them to continue to
operate during periods of stress ``or to transfer accounts to another
fully operational clearing member with minimal disruption to either
[CME] or their customers.'' \212\ Do any covered entities currently
have arrangements with other covered entities to transfer business or
accounts in the event of an emergency or disruption? Should the
Commission consider adding the option to transfer business to another
regulated entity into its proposed BCDR rule? Why or why not? How would
such a transfer function in practice? Please explain.
---------------------------------------------------------------------------
\211\ See NFA Rule 2-38, supra note 43.
\212\ See CME Rule 983, supra note 185.
---------------------------------------------------------------------------
F. Training and Plan Distribution--Proposed Paragraph (g)
To support the effectiveness of the ORF by ensuring personnel are
aware of relevant policies, procedures, and
[[Page 4728]]
practices, the proposed rule would require that each covered entity
establish, implement, and maintain training with respect to all aspects
of the ORF.\213\ Relevant training is important to ensuring the ORF
operates as intended, and to supporting a firm culture that promotes
and prioritizes operational resilience.\214\ The training would
therefore need to include, at a minimum, (i) cybersecurity awareness
training for all personnel and (ii) role-specific training for
personnel involved in establishing, documenting, implementing, and
maintaining the ORF.\215\ The importance of cybersecurity training is
widely recognized, as incidents commonly occur because well-intentioned
employees or other users make preventable mistakes.\216\ The Commission
would further expect that role-specific training would include not only
training on relevant policies and procedures but additional relevant
threat and vulnerability response training for personnel involved in
the development and maintenance of the information and technology
security program (e.g., system administration courses for IT
professionals, secure coding training for web developers).\217\
---------------------------------------------------------------------------
\213\ See paragraph (g) of proposed Commission regulations 1.13
and 23.603.
\214\ See FFIEC Information Security Booklet, supra note 69, at
17 (``Training ensures personnel have the necessary knowledge and
skills to perform their job functions.''); CIS Critical Security
Controls v.8., Control no. 14 (Security Awareness and Skills
Training) at 43 (May 2021) (CIS Control 14) (training helps
``influence behavior among the workforce to be security conscious
and properly skilled to reduce cybersecurity risks to the
enterprise'').
\215\ See paragraphs (g)(1)(i)-(ii) of proposed Commission
regulations 1.13 and 23.603. Proposed paragraph (g)(1)(ii) would
supplant the current requirement in Commission regulation 23.603 for
swap entities to train relevant employees on applicable components
of the BCDR plan. See 17 CFR 23.603(c). The Commission does not
intend any substantive difference in the BCDR plan training for swap
entities.
\216\ The FSB found that most successful cyberattacks involved
human error, which is why training is important for all personnel.
See FSB, Summary Report on Financial Sector Cybersecurity
Regulations, Guidance and Supervisory Practices at 7 (Oct. 13,
2017), available at https://www.fsb.org/wp-content/uploads/P131017-1.pdf. See also CIS Control 14 (``Users themselves, both
intentionally and unintentionally, can cause incidents as a result
of mishandling sensitive data, sending an email with sensitive data
to the wrong recipient, losing a portable end-user device, using
weak passwords, or using the same password they use on public site .
. .); Prudential Operational Resilience Paper, supra note 11, at 11
(``The firm provides cybersecurity awareness education especially to
personnel engaged in the operations of critical operations and core
business lines, . . . and adequately trains them to perform their
information security-related duties and responsibilities consistent
with related processes and agreements.'').
\217\ See CISA, Incident Response Plan (IRP) Basics (advising
that all staff need to understand their role in maintaining and
improving the security of the organization), available at https://www.cisa.gov/sites/default/files/publications/Incident-Response-Plan-Basics_508c.pdf.
---------------------------------------------------------------------------
As with all aspects of the ORF, if the proposal is adopted as
final, the Commission would expect each covered entity's ORF training
to meet the (b)(3) standard (i.e., be appropriate and proportionate to
the nature, scope, and complexities of its business activities as a
covered entity, following generally accepted standards and best
practices).\218\ To ensure the training remains relevant overtime and
that personnel are adequately informed with respect to the ORF, covered
entities would also be required to provide and update their ORF
training as necessary, but no less frequently than annually.\219\
Requiring that the training occur annually would be a new CFTC
requirement with respect to the BCDR plan training requirement for swap
entities.\220\ The Commission nevertheless believes an annual training
requirement is necessary for staff involved in BCDR planning to ensure
they remain up-to-date on changes to the BCDR plan following the annual
reviews and testing of the plan.\221\
---------------------------------------------------------------------------
\218\ See paragraph (b)(3) of proposed Commission regulations
1.13 and 23.603; supra note 63 and accompanying text.
\219\ See paragraph (g)(2) of proposed Commission regulations
1.13 and 23.603.
\220\ See 17 CFR 23.603(c).
\221\ See paragraph (h) of proposed Commission regulations 1.13
and 23.603, discussed in section II.G, infra.
---------------------------------------------------------------------------
To further support the proposed training requirement and ensure
relevant personnel have access to and are aware of the current
information and technology security, third-party relationships, and
BCDR plans that form the ORF, the proposed rule would require that
covered entities distribute copies of those plans to relevant personnel
and promptly provide any significant revisions thereto.\222\ This
proposed plan distribution requirement is consistent with the current
BCDR plan distribution requirement for swap entities in current
Commission regulation 23.603.\223\
---------------------------------------------------------------------------
\222\ See paragraph (g)(3) of proposed Commission regulations
1.13 and 23.603.
\223\ See 17 CFR 23.603(c) (Each swap entity shall distribute a
copy of its business continuity and disaster recovery plan to
relevant employees and promptly provide any significant revision
thereto.).
---------------------------------------------------------------------------
Request for Comment
The Commission invites comment on all aspects of the proposed
training requirement.
G. Reviews and Testing--Proposed Paragraph (h)
To ensure the ORF remains viable and effective over time, the
proposed rule would require covered entities to establish, implement,
and maintain a plan reasonably designed to assess its adherence to, and
the effectiveness of, the ORF through regular reviews and risk-based
testing.\224\ As discussed above, the purpose of the proposed ORF would
be to identify, monitor, manage, assess, and report on risks relating
to information and technology security, third-party relationships, and
emergencies or other significant business disruptions.\225\ Monitoring
and managing these risks is a dynamic, ever-evolving process,
especially given the increased reliance on and rapid evolution of
technological advancements and related cyber risks.\226\ The Commission
believes regular reviews and testing are an important tool needed to
confirm that systems and information remain protected, controls are
working as expected, and policies and procedures are being
followed.\227\ Accordingly, the Commission preliminarily believes that
regular reviews and testing would provide covered entities with
essential information about the actual quality, performance, and
reliability of the ORF in relation to its objectives and regulatory
requirements. The Commission further expects that reviews and testing
would be key to revealing unknown gaps or weaknesses in systems or
controls that could then be analyzed to identify corrective actions
designed to improve overall operational resilience over time.\228\ The
results of the reviews and testing should be used to support sound
decision-making at the covered entity regarding prioritization and
funding of resources in a manner
[[Page 4729]]
that furthers operational resilience.\229\ Without such regular reviews
and testing, the Commission is concerned that the ORF would quickly
grow stale and ineffective, allowing unseen vulnerabilities to go
unaddressed and potentially weaken the stability of the covered entity
or the financial system at large.
---------------------------------------------------------------------------
\224\ See paragraph (h) of proposed Commission regulations 1.13
and 23.603.
\225\ See paragraph (b)(1) of proposed Commission regulations
1.13 and 23.603, supra note 55 and accompanying text.
\226\ See Prudential Operational Resilience Paper, supra note
11, at 9 (``The firm also regularly reviews and updates its systems
and controls for security against evolving threats including cyber
threats and emerging or new technologies.'').
\227\ See, e.g., 17 CFR 37.1401 (SEFs); 17 CFR 38.1051 (DCMs);
17 CFR 39.18 (DCOs); 17 CFR 49.24 (SDRs) (requiring system safeguard
testing). See also FFIEC Information Security Booklet, supra note 69
(providing that entities should have a documented testing and
evaluation plan).
\228\ See also CPMI IOSCO Cyber Resilience Guidance, supra note
123, at 18 (``Sound testing regimes produce findings that are used
to identify gaps in stated resilience objectives and provide
credible and meaningful inputs to the [entity's] cyber risk
management process. Analysis of testing results provides direction
on how to correct weaknesses or deficiencies in the cyber resilience
posture and reduce or eliminate identified gaps.'').
\229\ See id. at 18 (``The results of the testing programme
should be used by the [entity] to support the ongoing improvement of
its cyber resilience.'').
---------------------------------------------------------------------------
1. Reviews--Proposed Paragraph (h)(1)
Under the proposed rule, reviews would need to include an analysis
of the adherence to, and the effectiveness of, the ORF, as well as any
recommendations for modifications or improvements that address root
causes of issues identified by the review.\230\ Again, the Commission
believes that the process of reviewing the ORF to evaluate both its
current effectiveness and make recommendations for prospective
improvements that relate to deficiencies found through the review would
help ensure that the ORF remains effective at managing operational
resilience as circumstances change over time.
---------------------------------------------------------------------------
\230\ See paragraph (h)(1) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
The proposed rule would require covered entities to conduct such
reviews at least annually and in connection with any material change to
the activities or operations of the covered entity that is reasonably
likely to affect the risks addressed by the ORF.\231\ An annual review
standard is consistent with the Commission's existing review
requirement for the RMP for covered entities, the BCDR plan for swap
entities, and NFA's ISSP Interpretive Notice.\232\ Although the
Commission would expect the ORF to be reviewed at least annually in its
entirety, including not only the required plans but training and
governance, the reviews could be broken into phases, staged over the
course of the year. The Commission preliminarily believes that
requiring the ORF to be reviewed on at least an annual basis and in
connection with any relevant, material business change is sufficiently
frequent to help ensure that the ORF remains effective and continues to
meet its objectives over time.
---------------------------------------------------------------------------
\231\ Id.
\232\ See 17 CFR 1.11(f)(1); 17 CFR 23.600(e)(1) (requiring
covered entities to review their RMPs on an annual basis or upon any
material change in the business reasonably likely to alter their
risk profile); 17 CFR 23.603(f) (requiring an annual review of swap
entities' BCDR plan); NFA ISSP Notice, supra note 43 (providing that
members should perform a regular review of their information systems
security program at least once every twelve months).
---------------------------------------------------------------------------
The proposed review requirement for the ORF would replace the
similar annual review requirement for swap entities' BCDR plans
contained in current Commission regulation 23.603. Current Commission
regulation 23.603(f) requires that a member of senior management for a
swap entity review the BCDR plan annually or upon any material change
to the business and to document any deficiencies found or corrective
action taken.\233\ The Commission preliminarily believes that the
proposed annual review of the ORF, which would encompass a review of
the BCDR plan, is sufficient to ensure the ORF's effectiveness and that
it would no longer be necessary for a separate review of the BCDR plan
to be conducted by senior management.
---------------------------------------------------------------------------
\233\ See 17 CFR 23.603(f).
---------------------------------------------------------------------------
2. Testing--Proposed Paragraph (h)(2)
With respect to risk-based testing of the ORF, the proposed rule
would generally provide that covered entities determine the frequency,
nature, and scope of the testing consistent with the proposed (b)(3)
standard.\234\ Covered entities have available to them a wide range of
testing tools, techniques, and methodologies, particularly with respect
to information and technology security. Those tools and techniques
include open source analysis, network security assessments, physical
security reviews, source code reviews, compatibility testing,
performance testing, and end-to-end testing, just to name a few.\235\
Such testing methods can vary significantly in terms of what they test
and how, and in the degree of sophistication and sensitivity they need
to run them correctly and reliably.\236\ Covered technology among
covered entities varies, both in terms of the sensitivity of the data
and information it contains and transmits, as well as its operational
importance and risk profile.
---------------------------------------------------------------------------
\234\ See paragraph (h)(2) of proposed Commission regulations
1.13 and 23.603. See also paragraph (b)(3) of proposed Commission
regulations 1.13 and 23.603; supra note 63 and accompanying text.
\235\ See NIST, SP 800-115, Technical Guide to Information
Security Testing and Assessment (Sept. 2008).
\236\ Id.
---------------------------------------------------------------------------
The Commission therefore preliminarily believes that leaving the
specifics of the design and implementation of ORF testing to the
reasonable judgment of each covered entity would help ensure that such
testing protocols remain nimble as operations and recommended testing
techniques change progressively over time.\237\ Covered entities would,
however, need to ensure that the testing is reasonably designed to test
the effectiveness of the function or system being tested.\238\ Covered
entities should determine which particular tests to incorporate,
consistent with the (b)(3) standard and their risk assessments, to
ensure the testing effectively targets their particular business lines,
activities, operations, and risk profile. Covered entities would
accordingly be encouraged to document the decision-making regarding how
it determined the nature, scope, and frequency of testing.
---------------------------------------------------------------------------
\237\ See also Interagency Guidelines Safeguarding Customer
Information, 66 FR 8623 (``The Agencies believe that a variety of
tests may be used to ensure the controls, systems, and procedures of
the information security program work properly and also recognize
that such tests will progressively change over time''); FINRA
Cybersecurity Report, supra note 66, at 13 (``Many firms determined
the systems to be tested and the frequency with which they should be
tested based on a risk assessment where higher risk systems were
tested more frequently.'').
\238\ See paragraph (h) of proposed Commission regulations 1.13
and 23.603 (requiring that the testing plan be reasonably designed
to assess the adherence to, and the effectiveness of, the ORF).
---------------------------------------------------------------------------
Although the proposed rule would generally not mandate the use of
any specific techniques, it would establish certain minimum testing
frequencies with respect to a few testing categories that have broad
consensus. With respect to testing of the information and technology
security program, the proposed rule would require testing of key
controls and the incident response plan at least annually.\239\
Consistent with the definition in the Commission's system safeguard
rules for registered entities, the proposal would define ``key
controls'' as those controls that an appropriate risk analysis
determines are either critically important for effective information
and technology security, or are intended to address risks that evolve
or change more frequently and therefore require more frequent review to
ensure their continuing effectiveness in addressing such risks.\240\
Given their importance to preserving information and technology
security and recovering from incidents, the Commission believes that
regular testing of the incident response plan and key controls on at
least an annual basis is an important baseline requirement to ensure
the continued effectiveness of
[[Page 4730]]
the information and technology security program.\241\
---------------------------------------------------------------------------
\239\ See paragraph (h)(2)(i)(A) of proposed Commission
regulations 1.13 and 23.603.
\240\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``key controls''). See also 17 CFR
37.1401(h)(1) (SEFs); 17 CFR 38.1051(h)(1) (DCMs); 17 CFR 39.18(a)
(DCOs); 17 CFR 49.24(j)(1) (SDRs) (defining ``key controls'' for
purposes of system safeguard requirements).
\241\ See 17 CFR 37.1401(h)(5) (SEFs); 17 CFR 38.1051(h)(5)
(DCMs); 17 CFR 39.18(e)(5) (DCOs); 17 CFR 49.24(j)(5) (SDRs) (annual
testing of incident response plans and key controls); see also
FFIEC, Information Technology Handbook, Audit Booklet at A-15 (Apr.
2012) (including testing of key controls at least annually as an
examination point
---------------------------------------------------------------------------
The proposed rule would also require that testing of the
information and technology security program include vulnerability
assessments and penetration testing.\242\ Vulnerability assessments
include methods and techniques to identify, diagnose, and prioritize
vulnerabilities in the security of covered technology.\243\ Technical
vulnerabilities can be identified through scanner tools, which can be
run continuously or periodically, often daily, and may include checking
servers for security patches to ensure they are current.\244\
Penetration testing (or ``pen testing''), meanwhile, attempts to
identify ways to exploit vulnerabilities and circumvent or defeat
security features, mimicking potential real-world attacks. Experts have
developed a wide variety of penetration tests (e.g., wireless, network,
web application, cloud, client side, social engineering, physical,
threat-led) and approaches to or modes of completing them (e.g., black
box, white box, gray box).\245\ Some tests go further by using cyber-
threat intelligence in designing these simulated attacks, a testing
referred to as threat-led penetration testing or ``red teaming.'' \246\
---------------------------------------------------------------------------
\242\ See paragraphs (h)(2)(i)(B)-(C) of proposed Commission
regulations 1.13 and 23.603.
\243\ See FFIEC Information Security Booklet, supra note 69, at
8.
\244\ Id.
\245\ See FINRA Cybersecurity Report, supra note 66, at 13.
\246\ See FSI, FSI Insights on policy implementation No. 21,
Varying shades of red: how red team testing frameworks can enhance
the cyber resilience of financial institutions (Nov. 2019).
---------------------------------------------------------------------------
With respect to vulnerability assessments, the proposed rule would
require covered entities to test their information and technology
security programs using vulnerability assessments, including daily or
continuous automated vulnerability scans.\247\ The Commission
preliminarily believes that some degree of vulnerability assessment is
considered standard cybersecurity hygiene in order to monitor systems
and controls for vulnerabilities, and that the availability of
automated vulnerability scanning tools help provide a base level of
monitoring that is easily accessible to all covered entities.\248\
---------------------------------------------------------------------------
\247\ See paragraph (h)(2)(i)(B) of proposed Commission
regulations 1.13 and 23.603. See also 17 CFR 37.1401(h)(2) (SEFs);
17 CFR 38.1051(h)(2) (DCMs); 17 CFR 39.18(e)(2) (DCOs); 17 CFR
49.24(j)(2) (SDRs) (requiring automated vulnerability scanning).
\248\ For instance, CISA makes available a free vulnerability
scanner. See CISA, Cyber Hygiene Services, available at https://www.cisa.gov/cyber-hygiene-services.
---------------------------------------------------------------------------
With respect to penetration testing, the proposed rule would not
require covered entities to undertake specific types of testing. Given
the diverse nature of entities registered as FCMs and swap entities,
the Commission believes that determination of the type and method of
penetration testing would be best left to the reasoned judgement of
each covered entity after conducting its own assessment. The Commission
would, however, require that covered entities conduct some penetration
testing at least annually.\249\ The Commission preliminarily believes
that annual penetration testing of some type, determined consistent
with the proposed (b)(3) standard, would be important for covered
entities to have knowledge and awareness of the actual vulnerability of
their covered technology to internal or external threats. According to
FINRA's 2018 cyber risk report, firms with strong cybersecurity
programs conducted penetration tests at least annually and more
frequently for mission critical, high risk systems such as for an
online trading system.\250\ Covered entities would also be encouraged
to consider additional risk-based penetration testing after key events,
such as any time a significant change is made to important elements of
the firm's applications and systems infrastructure, in addition to any
other regular compliance testing.
---------------------------------------------------------------------------
\249\ See paragraph (h)(2)(i)(C) of proposed Commission
regulations 1.13 and 23.603.
\250\ FINRA Cybersecurity Report, supra note 66, at 13-14.
FFIEC's exam book also appears to contemplate at least some degree
of penetration testing among financial institutions. See FFIEC
Information Security Booklet, supra note 69, at 55 (noting that
independent testing, including penetration testing and vulnerability
scanning, is conducted according to the risk assessment for
external-facing systems and the internal network).
---------------------------------------------------------------------------
Current Commission regulation 23.603 includes a testing requirement
for the BCDR plan for swap entities.\251\ The proposed ORF testing
provision would replace that requirement in current Commission
regulation 23.603 and specify that, as part of the testing, covered
entities would need to conduct a walk-through or tabletop exercise
designed to test the effectiveness of backup facilities and
capabilities at least annually.\252\ The Commission preliminarily
believes that swap entities currently test their BCDR plans through
such exercises and that they are an important way to test the
effectiveness of a BCDR plan in practice. Unlike current Commission
regulation 23.603, however, the proposed rule would not require that
covered entities' BCDR plans be audited every three years by a
qualified third-party service provider.\253\ Based on the Commission's
experience, this audit requirement has proven redundant and unnecessary
in light of the requirements to review and test the plan annually.
---------------------------------------------------------------------------
\251\ See 17 CFR 23.603(g) (requiring the BCDR plan to tested
annually by qualified, independent internal personnel or a qualified
third-party service).
\252\ Current Commission regulation 23.603 does not specify the
nature of the BCDR testing, see id.
\253\ See id. (``Each business continuity and disaster recovery
plan shall be audited at least once every three years by a qualified
third party service. The date the audit was performed shall be
documented, together with the nature and scope of the audit, any
deficiencies found, any corrective action taken, and the date that
corrective action was taken.'').
---------------------------------------------------------------------------
3. Independence--Proposed Paragraph (h)(3)
To support the reliability and objectivity of the review and
testing results, the proposed rule would require the reviews and
testing to be conducted by qualified personnel who are independent of
the aspect of the ORF being reviewed or tested.\254\ The personnel
conducting the testing could be employees of the covered entity itself,
an affiliate, or of a third-party service provider, provided that such
personnel are sufficiently trained and not responsible for the
development, installation, operation, or maintenance of the ``object''
of the testing (e.g., covered technology, key controls, training,
etc.). For example, a covered entity's internal audit department may be
sufficiently trained and independent to test certain key controls but
may need to secure a third-party to test certain systems or program
installations if it does not have sufficient capabilities in-house.
Covered entities would therefore be permitted under the proposal to
determine whether a particular test should be conducted in-house or by
a third-party service provider, provided that the qualification and
independence requirements are met.\255\
---------------------------------------------------------------------------
\254\ See paragraph (h)(3) of proposed Commission regulations
1.13 and 23.603.
\255\ If a covered entity determines to use a third-party
service provider, the proposed requirements and guidance with
respect to the management of third-party relationships would apply.
See supra note 153 and accompanying text.
---------------------------------------------------------------------------
This proposed independence requirement is consistent with the
testing requirement for swap entity
[[Page 4731]]
BCDR plans in current Commission regulation 23.603.\256\
---------------------------------------------------------------------------
\256\ See 17 CFR 23.603(g) (requiring the BCDR plan to tested
annually by qualified, independent internal personnel or a qualified
third-party service).
---------------------------------------------------------------------------
4. Documentation--Proposed Paragraph (h)(4)
The proposed rule would require covered entities to document all
reviews and testing of the ORF. The documentation would need to
include, at a minimum: (i) the date the review or testing was
conducted; (ii) the nature and scope of the review or testing,
including methodologies employed; (iii) the results of the review or
testing, including any assessment of effectiveness; (iv) any identified
deficiencies and recommendations for remediation; and (v) any
corrective action(s) taken, including the date(s) such actions were
taken.\257\ The Commission primarily believes documenting these key
aspects of the testing and related results would not only assist in
ensuring accountability for the testing, but would help covered
entities take full advantage of any insights the testing may provide
and to build upon their resiliency from lessons learned. Such
documentation would also assist the Commission in performing its
oversight duties with respect to covered entities and their
implementation of their ORF.
---------------------------------------------------------------------------
\257\ See paragraph (h)(4)(i)-(v) of proposed Commission
regulations 1.13 and 23.603.
---------------------------------------------------------------------------
This proposed documentation requirement is consistent with the
requirement for swap entity BCDR plans in current Commission regulation
23.603.\258\
---------------------------------------------------------------------------
\258\ See 17 CFR 23.603(g) (``The date the testing was performed
shall be documented, together with the nature and scope of the
testing, any deficiencies found, any corrective action taken, and
the date that corrective action was taken.'').
---------------------------------------------------------------------------
5. Internal Reporting--Proposed Paragraph (h)(5)
To support covered entities' compliance with the ORF rule and
ensure that senior leadership is apprised of and held accountable for
the effectiveness of the ORF, the proposed rule would expressly require
covered entities to report on the results of their reviews and testing
to the CCO and any other relevant senior-level official(s) and
oversight body(ies).\259\ The proposed rule would not mandate the form,
method, or frequency of such reporting, but the Commission would
encourage the reporting to be provided in a sufficiently timely manner
so as to allow the CCO and senior leadership to act upon the
information to take steps to improve compliance and the overall
effectiveness of the ORF.
---------------------------------------------------------------------------
\259\ See paragraph (h)(5) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
This requirement does not exist with respect to the swap entity
BCDR plan requirement in current Commission regulation 23.603 and would
therefore be a new requirement.
6. Request for Comment
The Commission invites comment on all aspects of the proposed
review and testing requirements, including the following question:
1. Key Controls. The proposed rule would require covered entities
to test key controls on at least an annual basis and includes a
definition of ``key controls'' that is comparable to how the term is
defined for purposes of the Commission's system safeguard requirements
for registered entities.\260\ Are covered entities currently testing
key controls? How are they determining what controls should be
regularly tested? Should the Commission consider allowing covered
entities to define ``key controls'' for themselves consistent with the
proposed (b)(3) standard?
---------------------------------------------------------------------------
\260\ See, e.g., 17 CFR 37.1401(h)(1) (SEFs); 17 CFR
38.1051(h)(1) (DCMs); 17 CFR 39.18(a) (DCOs); 17 CFR 49.24(j)(1)
(SDRs) (defining ``key controls'' for purposes of system safeguard
requirements).
---------------------------------------------------------------------------
H. Required Notifications--Proposed Paragraphs (i) and (j)
The proposed rule would require covered entities to notify the
Commission, customers, or counterparties of certain events within the
scope of the ORF. Notifications to the Commission would relate to
incidents that have an adverse impact, or a covered entity's decision
to activate its BCDR plan.\261\ Notifications to customers or
counterparties would relate to incidents that adversely impact their
interests.\262\ These notification provisions are discussed in turn
below.
---------------------------------------------------------------------------
\261\ See paragraph (i) of proposed Commission regulations 1.13
and 23.603.
\262\ See paragraph (j) of proposed Commission regulations 1.13
and 23.603.
---------------------------------------------------------------------------
1. Commission Notification of Incidents--Proposed Paragraph (i)(1)
The proposed rule would require covered entities to notify the
Commission of any incident that adversely impacts, or is reasonably
likely to adversely impact, (A) information and technology security,
(B) the ability of the covered entity to continue its business
activities as a covered entity, or (C) the assets or positions of a
customer or counterparty.\263\ The notification would need to include
any information available to the covered entity at the time of the
notification that could assist the Commission in assessing and
responding to the incident, including the date the incident was
detected, possible cause(s) of the incident, its apparent or likely
impacts, and any actions the covered entity has taken or is taking to
mitigate or recover from the incident, including measures to protect
customers or counterparties.\264\ Covered entities would need to
provide the notification as soon as possible, but no later than 24
hours after such incident has been detected.\265\
---------------------------------------------------------------------------
\263\ See paragraph (i)(1)(A)-(C) of proposed Commission
regulations 1.13 and 23.603.
\264\ See paragraph (i)(1)(ii) of proposed Commission
regulations 1.13 and 23.603.
\265\ See paragraph (i)(1)(iii) of proposed Commission
regulations 1.13 and 23.603.
---------------------------------------------------------------------------
The purpose of this proposed notification provision is multifold.
At a fundamental level, the proposed rule would allow the Commission to
exercise its oversight function with respect to the ORF, offering the
Commission a real-world, real-time insight into the effectiveness of a
particular covered entity's ORF and whether it is operating as
intended. Early warning of impactful incidents would also enable the
Commission to be more responsive, providing guidance or appropriate
relief to help the covered entity withstand and recover from the
incident. The Commission would also expect such early warnings to aid
it in identifying and reacting to events that could pose a more
systemic threat, either to the markets due to the severity of the
impact of the incident or to other covered entities due to the nature
of the incident (e.g., a ransomware attack against multiple covered
entities or a third-party service provider engaged by more than one
covered entity). In such potentially systemic circumstances, early
awareness of the incident is expected to facilitate the Commission's
role in coordinating industry efforts and information sharing, allowing
it to help forestall the impact of potential broad-scale threats by
sharing information with other regulators through its involvement in
Financial and Banking Information Infrastructure Committee (FBIIC),
issue timely statements to stabilize public confidence, and potentially
take emergency regulatory action. Over time, the Commission
preliminarily believes that the knowledge and experience gained from
these incident reports could provide the Commission a vantage point
from which to identify trends and lessons learned that could improve
its supervisory guidance supporting industry efforts to
[[Page 4732]]
enhance their ORF practices, or lead to other regulatory improvements.
As discussed above, the proposed rule would define ``incident'' as
any event, occurrence or circumstance that could jeopardize (i.e., put
into danger) information and technology security.\266\ This standard
would include events that have the potential to harm information and
technology security regardless of whether a harm actually materializes.
The proposed notification standard, by contrast, would limit the scope
of incidents required to be reported to the Commission to those where
there is an observable negative impact or harm, or such negative impact
or harm is reasonably likely. Covered entities would not, for instance,
need to notify the Commission of unsuccessful attempts at unauthorized
access, as the detection and deterrence of such an attempt would not
require Commission action and would appear to be suggestive of an ORF
that is operating as expected. If, however, a covered entity determines
that an unauthorized person did access covered information, the
Commission would need to be notified, regardless of how much
information was accessed or whether the covered entity believes it has
been used. The Commission would similarly want to know of any
successful distributed denial-of-service attack that disrupts business
operations, regardless of the length of time of that disruption.\267\
---------------------------------------------------------------------------
\266\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``incident'').
\267\ Covered entities would not need to notify the Commission
of routine testing or planned maintenance.
---------------------------------------------------------------------------
The Commission appreciates that, at the outset, information
regarding an incident is likely to be incomplete and in flux, and the
full impact and root cause of an incident may take some time to reveal
itself. Covered entities may also not be able to detect incidents
immediately after their occurrence, and with sophisticated malicious
attacks, culprits often take steps to hide their intrusions.
Nevertheless, the Commission preliminarily believes that delays in
reporting an incident to the Commission could impede its ability to
make timely assessments and take appropriate action. The Commission is
concerned that such delays could have broad implications, especially
when there are potential sector-wide ramifications or spill-over
effects to other regulated entities that the Commission could assist in
managing.
Accordingly, the proposed rule would not prescribe a specific form
or content for the notification or include a materiality limiter. The
proposed rule would only require that covered entities provide whatever
information they have on hand at the time that could assist the
Commission in its assessment and response activities.\268\ If the
proposed rule is adopted, the Commission would simply expect that as an
incident progresses, covered entities would continue to engage with the
Commission and provide updates as needed.\269\
---------------------------------------------------------------------------
\268\ See paragraph (i)(1)(ii) of proposed Commission
regulations 1.13 and 23.603.
\269\ For avoidance of doubt, the proposed rule would not have
any impact on covered entities' obligations to notify criminal
authorities as appropriate or required by other law or regulation.
---------------------------------------------------------------------------
The proposed rule would not prescribe a particular form for the
notification but would require notification via email.\270\
---------------------------------------------------------------------------
\270\ See paragraph (i)(2)(iii) of proposed Commission
regulations 1.13 and 23.603.
---------------------------------------------------------------------------
2. Commission Notification of BCDR Plan Activation--Proposed Paragraph
(i)(2)
For similar reasons, the proposed rule would also require covered
entities to notify the Commission of any determination to activate its
BCDR plan.\271\ Consistent with the proposed incident notification,
covered entities would need to notify the Commission of its
determination to activate their BCDR plan within 24 hours of making
that determination.\272\ Current Commission regulation 23.603 requires
swap entities to notify the Commission ``promptly'' of any emergency or
other disruption that may affect the ability of a swap entity to
fulfill its regulatory obligations or would have a significant adverse
effect on the swap entity, its counterparties, or the market.\273\
Based on the Commission's experience with this provision, which became
particularly relevant during the onset of the COVID-19 pandemic, the
Commission believes this standard has been open to wide interpretation
among swap entities, leading to broad variations in the timeliness of
the notifications to the Commission regarding their decisions to
implement their BCDR plans and employ a remote work posture. The
Commission therefore preliminarily believes that a more bright-line
test that centers on the decision to activate the BCDR plan, an action
that presumably would not occur absent an emergency or significant
disruption impacting the covered entity, would be easier to apply. The
Commission also believes such a standard would facilitate the prompt
delivery of information to the Commission so that it may consider
whether any action to support the continued integrity of the markets
during the course of the emergency is necessary to continue to fulfill
its oversight obligations. For that purpose, the Commission believes
that 24 hours from activation of the BCDR plan would both encourage
covered entities to inform the Commission with sufficient time for it
to take any needed action and encourage covered entities to focus
initial efforts on resuming or continuing operations.
---------------------------------------------------------------------------
\271\ See paragraph (i)(2)(i) of proposed Commission regulations
1.13 and 23.603.
\272\ See paragraph (i)(2)(iii) of proposed Commission
regulations 1.13 and 23.603.
\273\ See 17 CFR 23.603(d) (``Each swap dealer and major swap
participant shall promptly notify the Commission of any emergency or
other disruption that may affect the ability of the swap dealer or
major swap participant to fulfill its regulatory obligations or
would have a significant adverse effect on the swap dealer or major
swap participant, its counterparties, or the market.'').
---------------------------------------------------------------------------
Under the proposed rule, the notification would need to include all
information available to the covered entity at that time, including the
date of the emergency or disruption, a brief description thereof, its
apparent impact, and any actions the covered entity has taken or is
taking to mitigate or recover from the incident, including measures to
protect customers and counterparties, as the Commission believes this
information would be necessary for it to perform its oversight
obligations and take responsive action if needed.\274\ The proposed
rule would not prescribe a particular form for the notification but
would require notification via email.\275\
---------------------------------------------------------------------------
\274\ See paragraph (i)(2)(ii) of proposed Commission
regulations 1.13 and 23.603.
\275\ See paragraph (i)(2)(iii) of proposed Commission
regulations 1.13 and 23.603. Current Commission regulation 23.603
does not prescribe the contents of the notification or the method of
notification, so these would be new requirements for swap entities.
See 17 CFR 23.603(d) (``Each swap dealer and major swap participant
shall promptly notify the Commission of any emergency or other
disruption that may affect the ability of the swap dealer or major
swap participant to fulfill its regulatory obligations or would have
a significant adverse effect on the swap dealer or major swap
participant, its counterparties, or the market.'').
---------------------------------------------------------------------------
3. Notifications to Customers or Counterparties--Proposed Paragraph (j)
Finally, the proposed rule would require covered entities to notify
customers or counterparties as soon as possible of any incident that
could have adversely affected the confidentiality or integrity of such
customer or counterparty's covered information or their assets or
positions.\276\ Such incidents could include the identification of a
longstanding vulnerability that left exposed covered information,
regardless of whether the covered entity has determined that a
[[Page 4733]]
bad actor has obtained access to that information. The Commission
preliminarily believes that covered entities owe an enhanced duty to
protect the covered information provided to them by their customers and
counterparties in order to ensure market integrity and support customer
protections. The proposed notification standard therefore encompasses
incidents where an impact on customers or counterparties may not be
definite so that they may have an opportunity to take whatever actions
they deem necessary to protect their interests.
---------------------------------------------------------------------------
\276\ See paragraph (j)(1) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
Unlike with the proposed notifications to the Commission, however,
the Commission preliminarily believes that the accuracy of information
provided to customers and counterparties should be prioritized over
early delivery to avoid causing unnecessary panic that could have
potentially negative and irreversible spill-over effects. Accordingly,
the proposed customer/counterparty notification provision does not
include a specific minimum timing requirement for the notification
other than to require the notification to be provided to customers and
counterparties as soon as possible.\277\ The proposed rule would
further require covered entities to disclose to customers and
counterparties information necessary for them to understand and assess
the potential impact of the incident on their information, assets, or
positions and take any necessary actions (e.g., closing accounts,
changing passwords).\278\ Such information would include, at a minimum,
a description of the incident, the particular way in which the customer
or counterparty may have been adversely impacted, measures taken by the
covered entity to protect against further harm, and contact information
for the covered entity where the customer or counterparty may learn
more or ask questions.\279\
---------------------------------------------------------------------------
\277\ See id.
\278\ See paragraphs (j)(2)(i)-(iv) of proposed Commission
regulations 1.13 and 23.603.
\279\ See id.
---------------------------------------------------------------------------
4. Request for Comment
The Commission invites comment on all aspects of its proposed ORF
notification provisions, including the following questions:
1. Incident notification to Commission. The proposed rule would
require covered entities to notify the Commission of any incident that
``adversely impacts, or is reasonably likely to adversely impact,''
information and technology security, the ability of the covered entity
to continue its business activities as a covered entity, or the assets
or positions of a customer or counterparty. As discussed above, the
Commission believes this standard would give the Commission an early
warning of incidents that do result in an observable negative impact or
harm, or such negative impact or harm is reasonably likely, i.e., where
information and technology security, business operations, or customers/
counterparties is harmed or compromised. Given the purpose of the
proposed rule as providing the Commission an early warning so that it
may act to help mitigate the potential impacts of the event, the
proposed rule does not include a materiality limiter. Should the
Commission consider including changing the requirement to further limit
the incident notice to the incidents with a ``material'' or
``significant'' adverse impact, or where such a material or significant
adverse impact would be reasonably likely? If yes, how would including
such a materiality limiter change the scope of incidents that would be
reported to the Commission? In other words, what types of incidents
would not be reported to the Commission under a standard that includes
a materiality limiter, and why should the Commission not receive an
early warning of those types of incidents? Please explain and provide
examples.
2. BCDR notification to Commission. The Commission is proposing to
change the notification requirement in Commission regulation 23.603 to
trigger upon a covered entity's determination to activate its BCDR
plan, rather than ``promptly'' after an emergency or other disruption.
Do covered entities typically make a specific determination before
activating the BCDR plan? What is the process for making that
determination and who makes it? Are there aspects of the BCDR plan that
may become active before any formal determination is made? Should the
Commission instead require notification ``when'' or ``as soon as'' a
BCDR plan is activated? Why or why not? Please explain.
3. Notifications to customers or counterparties. The proposed rule
would require covered entities to provide affected customers and
counterparties information necessary for the affected customer/
counterparty to understand and assess the potential impact of the
incident on its information, assets, or positions and to take any
necessary action. Does the proposed rule provide sufficient information
for covered entities to assess and comply with that standard?
I. Amendment and Expansion of Other Provisions in Current Commission
Regulation 23.603
As mentioned in previous sections of this notice, the proposed rule
would expand and apply the substance of existing provisions in current
Commission regulation 23.603 to all covered entities and the ORF in its
entirety. Such provisions not yet addressed include (1) the
establishment of emergency contacts for the Commission and (2)
recordkeeping obligations.\280\
---------------------------------------------------------------------------
\280\ See 17 CFR 23.603(e) and (i). The Commission would not
retain Commission regulation 23.603(h) (business continuity and
disaster recovery plans required by other regulatory authorities) as
superfluous, see supra note 198.
---------------------------------------------------------------------------
1. Emergency Contacts--Proposed Paragraph (k)
To assist the Commission in responding to a reported incident, or
an emergency or other significant disruption causing a covered entity
to activate its BCDR plan, the proposed rule would require each covered
entity to provide the Commission the name and contact information for
two employees with knowledge of the covered entity's incident response
plan and two employees with knowledge of the covered entity's BCDR
plan.\281\ Each identified employee would need to be authorized to make
key decisions on behalf of the covered entity in the event of either an
incident or the BCDR plan activation, as applicable, as the Commission
would want to be sure to be contacting personnel with appropriate
knowledge and authority.\282\ Any updates to the ORF contacts would
need to be made to the Commission as necessary to ensure the
Commission's contact information remains accurate and up to date.\283\
---------------------------------------------------------------------------
\281\ See paragraph (k)(1) of proposed Commission regulations
1.13 and 23.603. See also 17 CFR 23.603(e) (requiring the
designation of two emergency contacts with respect to the BCDR plan
for swap entities).
\282\ See paragraph (k)(2) of proposed Commission regulations
1.13 and 23.603. The two employee contacts identified with respect
to the information and technology security program could be the same
as the employee contacts for the BCDR plan, provided that they have
the requisite authority. See id.
\283\ See paragraph (k)(3) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
This provision is consistent with the existing emergency contacts
requirement in the swap entity BCDR plan requirement in current
Commission regulation 23.603.\284\
---------------------------------------------------------------------------
\284\ See 17 CFR 23.603(e) (``Each swap dealer and major swap
participant shall provide to the Commission the name and contact
information of two employees who the Commission can contact in the
event of an emergency or other disruption. The individuals
identified shall be authorized to make key decisions on behalf of
the swap dealer or major swap participant and have knowledge of the
firm's business continuity and disaster recovery plan. The swap
dealer or major swap participant shall provide the Commission with
any updates to this information promptly.'').
---------------------------------------------------------------------------
[[Page 4734]]
2. Recordkeeping--Proposed Paragraph (l)
To aid the Commission in fulfilling its oversight responsibilities,
the proposed rule would require each covered entity to maintain all
records required pursuant to the proposed ORF rule, including the
information and technology security program, the third-party
relationship program, and the BCDR plan, in accordance with Commission
regulation 1.31 and to make them available promptly upon request to
representatives of the Commission and to representations of applicable
prudential regulators as defined in section 1a(39) of the CEA.\285\
This provision is consistent with the existing recordkeeping
requirement in the swap entity BCDR plan requirement in current
Commission regulation 23.603.\286\
---------------------------------------------------------------------------
\285\ See paragraph (l) of proposed Commission regulations 1.13
and 23.603. See 7 U.S.C. 1(a)(39).
\286\ See 17 CFR 23.603(i) (``The business continuity and
disaster recovery plan of the swap dealer and major swap participant
and all other records required to be maintained pursuant to this
section shall be maintained in accordance with Commission Regulation
Sec. 1.31 and shall be made available promptly upon request to
representatives of the Commission and to representatives of
applicable prudential regulators.'').
---------------------------------------------------------------------------
3. Request for Comment
The Commission invites comment on all aspects of the proposed
emergency contacts and recordkeeping requirements.
J. Cross-Border Application for Swap Entities
In September 2020, the Commission published a final rule addressing
the cross-border application of certain provisions of the CEA
applicable to swap entities.\287\ The rule addresses the application of
the registration thresholds and certain requirements applicable to swap
entities and establishes a formal process for requesting comparability
determinations for such requirements from the Commission.\288\ Therein,
the Commission classified current Commission regulation 23.603 (BCDR
requirements for swap entities) as a group A requirement.\289\ The
Commission described the group A requirements as helping swap entities
``implement and maintain a comprehensive and robust system of internal
controls to ensure the financial integrity of the firm, and, in turn,
the protection of the financial system'' and as ``constitut[ing] an
important line of defense against financial, operational, and
compliance risks that could lead to a firm's default.'' \290\ Pursuant
to Commission regulation 23.23(f)(1), a non-U.S. swap entity may
satisfy any applicable group A requirement on an entity-wide basis by
complying with the applicable standards of a foreign jurisdiction to
the extent permitted by, and subject to any conditions specified in, a
comparability determination issued by the Commission.\291\ In
determining to offer substituted compliance for group A requirements
broadly to all non-U.S. swap entities, the Commission explained its
belief that group A requirements cannot be effectively applied on a
fragmented jurisdictional basis, such that it would not be practical to
limit substituted compliance for group A requirements to transactions
involving only non-U.S. persons.\292\
---------------------------------------------------------------------------
\287\ See Cross-Border Application of the Registration
Thresholds and Certain Requirements Applicable to Swap Dealers and
Major Swap Participants, 85 FR 56924 (Sept. 14, 2020) (Final Cross
Border Rule); 17 CFR 23.23.
\288\ Id.
\289\ Id. at 56964-65; 17 CFR 23.23(a)(6) (defining ``group A
requirements'').
\290\ Final Cross-Border Rule, 85 FR 56964 (providing that
``requiring swap entities to rigorously monitor and address the
risks they incur as part of their day-to-day businesses lowers the
registrants' risk of default--and ultimately protects the public and
the financial system.'').
\291\ See 17 CFR 23.23(f)(1). See also 17 CFR 23.23(a)(11)
(defining ``non-U.S. swap entity''); 17 CFR 23.23(g) (describing the
process for the issuance of comparability determinations).
\292\ See Final Cross-Border Rule, 85 FR 56977.
---------------------------------------------------------------------------
As discussed above, the proposed rule would amend current
Commission regulation 23.603 to contain the entirety of the ORF
requirements applicable to swap entities, which would include
requirements not only relating to BCDR but also those relating to
information and technology security and third-party relationships. The
Commission preliminarily believes that the same rationale for
classifying BCDR requirements as a group A requirement would apply to
the ORF rule more broadly. As discussed in detail above, the Commission
preliminarily believes that the proposed information and technology
security and third-party risk relationship requirements would also
serve to help swap entities implement and maintain a comprehensive and
robust system of internal controls, serving as an important line of
defense against the threat of failure at the firm level and of the
financial system more broadly. Accordingly, should the ORF rule be
adopted, the Commission would continue to classify Commission
regulation 23.603 in its entirety as a group A requirement, for which
substituted compliance would broadly be available pursuant to the
requirements of Commission regulation 23.23(f)(1).
As mentioned above, Commission regulation 23.23(f)(1) only allows
substituted compliance ``to the extent permitted by, and subject to any
conditions specified in, a comparability determination issued by the
Commission under [Commission regulation 23.23(g)].'' \293\ Current
Commission comparability determinations do not address the entirety of
the proposed ORF rule, as it has yet to be adopted. Rather, they only
address the requirements in current Commission regulation 23.603, which
are limited to the BCDR plan requirement.
---------------------------------------------------------------------------
\293\ See 17 CFR 23.23(f)(1).
---------------------------------------------------------------------------
The Commission appreciates that non-U.S. swap entities have come to
rely on existing comparability determinations with respect to the
current BCDR requirements in Commission regulation 23.603. Accordingly,
in the interest of comity and good governance, should the proposed rule
be adopted, the Commission has preliminarily determined to permit non-
U.S. swap entities to continue to rely on current comparability
determinations with respect to the Commission's BCDR requirements, even
as amended. However, for substituted compliance to be available for the
ORF rule in its entirety, an eligible swap entity or foreign regulatory
authority would need to submit a request for a comparability
determination pursuant to Commission regulation 23.23(g). The
submission would need to address the full complement of the provisions
of the ORF rule, however codified in amended Commission regulation
23.603, including the BCDR requirements. The Commission would then
evaluate the request, considering amended Commission regulation 23.603
in its entirety, and, if the Commission were to conclude it appropriate
to do so, issue updated comparability determinations that would
supersede any pre-existing comparability determinations with respect to
BCDR requirements for swap entities.
Request for Comment
The Commission invites comment on all aspects of the cross-border
implications of the proposed rule.
[[Page 4735]]
K. Implementation Period
Should the proposed rule be adopted, the Commission recognizes that
covered entities may need time to establish an ORF or review and update
existing plans and procedures for compliance with the proposed ORF
rule. The Commission preliminarily believes that, given existing and
applicable NFA, prudential, and foreign requirements, six months from
the rule's adoption would be a sufficient amount of time for covered
entities to achieve compliance with the ORF rule.
The Commission invites comment on the Commission's proposed
implementation period for the proposed ORF rule, including the
following questions:
1. Would six months be as sufficient amount of time for covered
entities to develop compliant ORFs? If not, why not? Please explain.
2. If covered entities would need more than six months to implement
the ORF as proposed, how much more time would they estimate to need,
and what would they be doing with that time? Please be as detailed as
possible.
III. Related Matters
A. Regulatory Flexibility Act
The Regulatory Flexibility Act (RFA) requires Federal agencies, in
promulgating regulations, to consider the impact of those regulations
on small entities--whether the rules will have a significant economic
impact on a substantial number of small entities--and if so, to provide
a regulatory flexibility analysis reflecting the impact.\294\ The
Commission has established certain definitions of ``small entities'' to
be used by the Commission in evaluating the impact of its rules on
small entities in accordance with the RFA.\295\ The proposed
regulations would affect FCMs, SDs, and MSPs. The Commission has
previously determined that FCMs, SDs, and MSPs are not small entities
for purposes of the RFA.\296\ Accordingly, the Chairman, on behalf of
the Commission, hereby certifies pursuant to 5 U.S.C. 506(b) that the
proposed rule and rule amendments would not have a significant economic
impact on a substantial number of small entities.
---------------------------------------------------------------------------
\294\ 5 U.S.C. 601 et seq.
\295\ See Policy Statement and Establishment of Definitions of
``Small Entities'' for Purposes of the Regulatory Flexibility Act,
47 FR 18618 (Apr. 30, 1982) (RFA Definitions of ``Small Entities'').
\296\ See RFA Definitions of ``Small Entities,'' 47 FR 18619
(FCMs); Final Swap Entities RMP Rule, 77 FR 20193-94 (SDs and MSPs).
---------------------------------------------------------------------------
B. Paperwork Reduction Act
The Paperwork Reduction Act (PRA) imposes certain requirements on
federal agencies, including the Commission, in connection with
conducting or sponsoring any ``collection of information,'' as defined
by the PRA.\297\ The PRA is intended, in part, to minimize the
paperwork burden created for individuals, businesses, and other persons
as a result of the collection of information by federal agencies, and
to ensure the greatest possible benefit and utility of information
created, collected, maintained, used, shared, and disseminated by or
for the Federal Government.\298\ The PRA applies to all information,
regardless of form or format, whenever the Federal Government is
obtaining, causing to be obtained, or soliciting information, and
includes required disclosure to third parties or the public, of facts
or opinions, when the information collection calls for answers to
identical questions posed to, or identical reporting or recordkeeping
requirements imposed on, ten or more persons.\299\
---------------------------------------------------------------------------
\297\ 44 U.S.C. 3501 et seq.
\298\ Id.
\299\ See 44 U.S.C. 3502(3).
---------------------------------------------------------------------------
This proposed rulemaking would result in new collection of
information requirements within the meaning of the PRA. The Commission
is therefore submitting this proposal to the Office of Management and
Budget (OMB) for review.\300\ The title for this collection of
information is ``Operational Resilience Framework for Futures
Commission Merchants, Swap Dealers, and Major Swap Participants.'' The
OMB has not yet assigned this collection a control number. An agency
may not conduct or sponsor, and a person is not required to respond to,
a collection of information unless it displays a currently valid
control number.\301\
---------------------------------------------------------------------------
\300\ See 44 U.S.C. 3507(d); 5 CFR 1320.11.
\301\ See 44 U.S.C. 3507(a)(3); 5 CFR 1320.5(a)(3).
---------------------------------------------------------------------------
If the proposed regulations are adopted, responses to this
collection of information would be mandatory. The Commission will
protect proprietary information according to the Freedom of Information
Act and part 145 of the Commission's regulations, ``Commission Records
and Information.'' \302\ In addition, section 8(a)(1) of the CEA
strictly prohibits the Commission, unless specifically authorized by
the CEA, from making public ``data and information that would
separately disclose the business transactions or market positions of
any person and trade secrets or names of customers.'' \303\ The
Commission is also required to protect certain information contained in
a government system of records according to the Privacy Act of
1974.\304\
---------------------------------------------------------------------------
\302\ See 5 U.S.C. 552. See also 17 CFR part 145.
\303\ 7 U.S.C. 12(a)(1).
\304\ See 5 U.S.C. 552a.
---------------------------------------------------------------------------
1. Information Provided by Reporting Entities/Persons
The proposed regulations would require each covered entity to
establish, document, implement, and maintain an ORF that includes an
information and technology security program, a third-party relationship
program, and a BCDR plan, each of which would need to be supported by
written policies and procedures. In addition, the proposed regulations
would impose the following reporting, recordkeeping, and disclosure
obligations on each covered entity: (1) on an annual basis, written
approval of each component program or plan of the ORF and of risk
appetite and risk tolerance limits, or in the case of covered entities
relying on a consolidated program or plan, written attestation; (2) on
an annual basis, documenting review and testing of the ORF; (3) as
applicable, notifying the Commission of certain ``incidents,'' as
defined in the proposed rule; (4) as applicable, notifying the
Commission upon activation of the BCDR plan; (5) as applicable,
notifying customers or counterparties of certain ``incidents,'' as
defined in the proposed rule; and (6) providing emergency contact
information to the Commission in connection with the information and
technology security program and the BCDR plan. These requirements will
result in new PRA burdens for covered entities.
For purposes of the PRA, the term ``burden'' means the ``time,
effort, or financial resources expended by persons to generate,
maintain, or provide information to or for a Federal Agency.'' \305\
This total includes the anticipated burden associated with the
development of the required written policies and procedures,
satisfaction of various reporting, recordkeeping, and disclosure
obligations, the documentation of required ORF testing and review, and
the documentation of risk appetite and risk tolerance limits approval.
---------------------------------------------------------------------------
\305\ 44 U.S.C. 3502(2).
---------------------------------------------------------------------------
As of October 31, 2023, there are 160 covered entities that would
become subject to the proposed rule (100 registered swaps dealers, 54
registered futures commission merchants, and 6 dually-registered swap
dealers/futures commission merchants). The estimated burden associated
with the proposed
[[Page 4736]]
information collections is calculated as follows:
a. Recordkeeping Requirements
The proposed regulation contains recordkeeping requirements that
would result in a collection of information from ten or more persons
over a 12-month period.
Establishing, documenting, implementing, and maintaining
information and technology security program: As part of an overall ORF,
proposed Commission regulations 1.13(d) and 23.603(d) would require
covered entities to establish an information and technology security
program reasonably designed to identify, monitor, manage, and assess
risks relating to information and technology security, including
through conducting and documenting risk assessments at least annually.
Upon the risk assessment's completion, the results would need to be
provided to the oversight body, senior officer, or other senior-level
official who approves the information and technology security program.
As part of the information and technology security program, the
proposed rule would require the covered entity to establish, document,
implement, and maintain controls to prevent, detect, and mitigate
identified risks to information and technology security. In addition,
the proposed rule would require that the information and technology
security program include a written incident response plan reasonably
designed to detect, assess, contain, mitigate the impact of, and
recover from an incident.
The Commission anticipates that a covered entity would require an
estimated 200 hours to develop their information and technology
security program, including conducting and documenting an annual risk
assessment and developing an incident response plan. This yields a
total annual burden of 32,000 burden hours (160 respondents x 200 hours
= 32,000 hours).
Accordingly, the aggregate annual estimate for the recordkeeping
burden associated with this proposal would be as follows:\306\
---------------------------------------------------------------------------
\306\ This estimate reflects the aggregate information
collection burden estimate associated with the proposed
recordkeeping requirement for the first annual period following
implementation of the proposed regulations. Because proposed
Commission regulations 1.13(d) and 23.603(d) would require the one-
time recordkeeping requirement as to developing the information and
technology security program, Commission staff estimates that for
each subsequent annual period, the number of burden hours would be
reduced accordingly.
---------------------------------------------------------------------------
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per registrant: 200 hours.
Frequency of collection: Annually.
Total annual burden: 32,000 burden hours [160 registrants x 200
hours].
Establishing, documenting, implementing, and maintaining third-
party relationship program: Proposed Commission regulations 1.13(e) and
23.603(e) would require covered entities to develop a program
reasonably designed to identify, monitor, manage, and assess risks
relating to third-party relationships. The program would be required to
address the risks attendant to each stage of the third-party
relationship lifecycle and would be required to include an inventory of
third-party service providers the covered entity has engaged to support
its activities as a covered entity.
The Commission anticipates that a covered entity would require an
estimated 160 hours annually to develop their third-party relationship
program, including creating and maintaining a third-party service
provider inventory. This yields a total annual burden of 25,600 hours
(160 respondents x 160 hours = 25,600 burden hours). The aggregate
annual estimate for the recordkeeping burden associated with this
proposal would be as follows: \307\
---------------------------------------------------------------------------
\307\ This estimate reflects the aggregate information
collection burden estimate associated with the proposed
recordkeeping requirement for the first annual period following
implementation of the proposed regulations. Because proposed
Commission regulations 1.13(e) and 23.603(e) would require the one-
time recordkeeping requirement as to developing the third-party
relationship program, Commission staff estimates that for each
subsequent annual period, the number of burden hours would be
reduced accordingly.
---------------------------------------------------------------------------
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per registrant: 160 hours.
Frequency of collection: Annually.
Total annual burden: 25,600 burden hours [160 registrants x 160
hours].
Establishing, documenting, implementing, and maintaining BCDR plan:
Proposed Commission regulations 1.13(f) and 23.603(f) would require
covered entities to establish a written BCDR plan reasonably designed
to identify, monitor, manage, and assess risks relating to emergencies
or other significant disruptions to the continuity of normal business
operations as a covered entity.\308\ The proposed rule would require
the BCDR plan be reasonably designed to enable the covered entity to:
(1) continue or resume any activities as a covered entity with minimal
disruption to customers, counterparties, and markets; and (2) recover
and make use of covered information, in addition to any other data,
information, or documentation required to be maintained by law and
regulation. These plans would be required to, among other things,
establish procedures for data backup and establish and maintain
arrangements to provide for redundancies or their backup for covered
technology, facilities, infrastructure, personnel, and competencies.
---------------------------------------------------------------------------
\308\ As discussed in section II.E (Continuity and Disaster
Recovery Plan) of this notice, swap entities are already required to
establish a written BCDR plan pursuant to current Commission
regulation 23.603. The existing burdens for current Commission
regulation 23.603 are found in the following information collection,
Regulations Establishing and Governing the Duties of Swap Dealers
and Major Swap Participants (OMB Control No. 3038-0084). The burden
of swap entities updating their BCDR plan is included in the new
collection of information established by the proposed rule, but the
Commission is retaining its existing burden estimates under Control
No. 3038-0084 at this time to avoid undercounting. The Commission
will adjust its burden estimates associated with OMB Control No.
3038-0084 at a later date, as necessary.
---------------------------------------------------------------------------
The Commission anticipates that a covered entity would require an
estimated 50 hours annually to develop or to update their existing
written BCDR plan. This yields a total annual burden of 8,000 burden
hours (160 respondents x 50 hours = 8,000 hours).
Accordingly, the aggregate annual estimate for the recordkeeping
burden associated with this proposal would be as follows:\309\
---------------------------------------------------------------------------
\309\ This estimate reflects the aggregate information
collection burden estimate associated with the proposed
recordkeeping requirement for the first annual period following
implementation of the proposed regulations. Because proposed
Commission regulations 1.13(f) and 23.603(f) would require the one-
time recordkeeping requirement, as to developing the BCDR plan,
Commission staff estimates that for each subsequent annual period,
the number of burden hours would be reduced accordingly.
---------------------------------------------------------------------------
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per registrant: 50 hours.
Frequency of collection: Annually.
Total annual burden: 8,000 burden hours [160 registrants x 50
hours].
Documentation of ORF review: Proposed Commission regulations
1.13(h) and 23.603(h) would require covered entities to establish,
implement, and maintain plans reasonably designed to assess their
adherence to, and the effectiveness of, their ORF through regular
reviews and risk-based testing.
The proposed rule would require that reviews be conducted at least
annually and when any material change to covered entities' activities
or operations occurs that is reasonably likely to affect
[[Page 4737]]
the risks identified in the ORF. With regard to testing, the proposed
rule would require that the testing of information and technology
security program include, at a minimum, the testing of key controls and
the incident response plan at least annually; daily or continuous
automated vulnerability scans; and penetration testing at least
annually. Additionally, the proposed rule would require that testing of
the BCDR plan must include, at a minimum, a walk-through or tabletop
exercise designed to test the effectiveness of backup facilities and
capabilities at least annually.
The proposed rule would also require covered entities to document
all reviews and testing of their ORFs. The proposed rule would require
that documentation to include, at a minimum, (i) the date the review or
testing was conducted; (ii) the nature and scope of the review or
testing, including methodologies employed; (iii) the results of the
review or testing, including any assessment of effectiveness; (iv) any
identified deficiencies and recommendations for remediation; and (v)
any corrective action(s) taken or initiated, including the date(s) of
such action(s).
The Commission anticipates that covered entities would require an
estimated 80 hours annually to establish a plan to assess adherence to,
and the effectiveness of, its ORF, as well as documenting all reviews
and testing of the ORF. This yields a total annual burden of 12,800
hours (160 respondents x 80 hours = 12,800 burden hours).
The aggregate annual estimate for the recordkeeping burden
associated with this proposal would be as follows: \310\
---------------------------------------------------------------------------
\310\ This estimate reflects the aggregate information
collection burden estimate associated with the proposed
recordkeeping requirement for the first annual period following
implementation of the proposed regulations. Because proposed
Commission regulations 1.13(h) and 23.603(h) would require the one-
time recordkeeping requirement as to developing a plan to assess the
effectiveness of the ORF, Commission staff estimates that for each
subsequent annual period, the number of burden hours would be
reduced accordingly.
---------------------------------------------------------------------------
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per registrant: 80 hours.
Frequency of collection: Annually.
Total annual burden: 12,800 burden hours [160 registrants x 80
hours].
Documentation of approval of the component programs or plan, risk
appetite, and risk tolerance limits: Proposed Commission regulations
1.13(c)(1) and 23.603(c)(1) would require covered entities to ensure
that the information and technology security program, third-party
relationship program, and BCDR plan are approved in writing on at least
an annual basis by either the senior officer, an oversight body, or a
senior-level official with primary responsibility for the component
programs or plan. Proposed Commission regulations 1.13(c)(2) and
23.603(c)(2) would require the risk appetite and risk tolerance limits
established by covered entities be approved in writing at least
annually by either the senior officer, an oversight body, or a senior-
level official. Proposed Commission regulations 1.13(c)(4)(ii) and
23.603(c)(4)(ii) would allow covered entities that rely on a
consolidated program or plan for its ORF to meet the annual approval
requirement for the component programs or plan of the ORF, risk
appetite, and risk tolerance limits through an annual written
attestation by either the senior officer, an oversight body, or a
senior-level official.
The Commission anticipates that covered entities would require an
estimated 20 hours annually to document approval of the ORF, risk
appetite, and risk tolerance limits or to prepare the written
attestation. This yields a total annual burden of 3,200 hours (160
respondents x 20 hours = 3,200 burden hours).
The aggregate annual estimate for the recordkeeping burden
associated with this proposal would be as follows:
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per registrant: 20 hours.
Frequency of collection: Annually.
Total annual burden: 3,200 burden hours [160 registrants x 20
hours].
b. Reporting Requirements
The proposed regulation contains reporting requirements that would
result in a collection of information from ten or more persons over a
12-month period.
Notification of incidents to the Commission: Proposed Commission
regulations 1.13(i)(1) and 23.603(i)(1) would require covered entities
to notify the Commission regarding incidents that adversely impact or
are reasonably likely to adversely impact: (1) information technology
and security; (2) the covered entity's ability to continue its business
activities; or (3) the assets or positions of a customer or
counterparty. These notifications would be required to include
information that may assist the Commission in assessing and responding
to the incident, including the date the incident was detected, possible
cause(s) of the incident, its apparent or likely impacts, and any
actions the covered entity has taken or is taking to mitigate or
recover from the incident. Notifications would be required to be
submitted via email as soon as possible, but no later than 24 hours
after an incident is detected.
The Commission anticipates that covered entities may experience one
reportable incident per year and that covered entities would expend
approximately 10 hours to gather the information required and provide
the required notification to the Commission. This would result in an
estimated total annual burden of 1,600 hours (160 respondents x 1
reportable incident per year x 10 hours per reportable incident = 1,600
hours).
The aggregate annual estimate for the reporting burden associated
with this proposal would be as follows:
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per registrant: 10 hours.
Frequency of collection: As needed.
Total annual burden: 1,600 burden hours [160 registrants x 10
hours].
Notification of BCDR plan activation: Proposed Commission
regulations 1.13(i)(2) and 23.603(i)(2) would require covered entities
to notify the Commission of any determination to activate the BCDR
plan. Covered entities would be required to provide such notices via
email and include any information available at the time of the
notification that may assist the Commission in assessing or responding
to the emergency or disruption, including the date of the emergency or
disruption, a description thereof, the possible cause(s), its apparent
or likely impacts, and any actions the covered entity has taken or is
taking to mitigate or recover from the emergency or disruption,
including measures taken or being taken to protect customers.
The Commission anticipates that approximately 3 covered entities
may activate their BCDR plan per year and that such covered entities
would expend approximately 10 hours to gather the information required
and to provide the required notification to the Commission. This would
result in an estimated total annual burden of 30 burden hours (3 BCDR
activations per year x 10 hours per BCDR activation = 30 hours).
The aggregate annual estimate for the reporting burden associated
with this proposal would be as follows:
Number of registrants: 3.
Estimated number of responses per respondent: 1.
Estimated total annual burden per registrant: 10 hours.
Frequency of collection: As needed.
[[Page 4738]]
Total annual burden: 30 burden hours [3 BCDR activations per year x
10 hours].
Filing emergency contact information: Proposed Commission
regulations 1.13(k) and 23.603(k) would require covered entities to
provide the Commission with emergency contact information for employees
to serve as contacts in connection with required incident notifications
under the ORF and the activation of the covered entity's BCDR plan.
The Commission anticipates that covered entities would require an
estimated 1 hour annually to provide the Commission with emergency
contact information. This yields a total annual burden of 160 burden
hours (160 respondents x 1 hour = 160 burden hours).
The aggregate annual estimate for the reporting burden associated
with this proposal would be as follows: \311\
---------------------------------------------------------------------------
\311\ This estimate reflects the aggregate information
collection burden estimate associated with the proposed reporting
requirement for the first annual period following implementation of
the proposed regulations. Because proposed Commission regulations
1.13(k) and 23.603(k) would require the emergency contact
information provided to the Commission to be updated only as
necessary, Commission staff estimates that for each subsequent
annual period, the number of burden hours would be reduced
accordingly.
---------------------------------------------------------------------------
Number of registrants: 160.
Estimated number of responses: 1.
Estimated total annual burden per registrant: 1 hour.
Frequency of collection: As needed.
Total annual burden: 160 burden hours [160 registrants x 1 hour].
c. Disclosure Requirements
The proposed regulation contains disclosure requirements that would
result in a collection of information from ten or more persons over a
12-month period.
Notification of incidents to affected customers and counterparties:
Proposed Commission regulations 1.13(j) and 23.603(j) would require
covered entities to notify their customers and counterparties as soon
as possible of any incident that is reasonably likely to have adversely
affected the confidentiality or integrity of the customer's or
counterparty's covered information, assets, or positions. The proposed
rule would require that notifications include information necessary for
the affected customer or counterparty to understand and assess the
potential impact of the incident on its information, assets, or
positions and to take any necessary action. Such notifications shall
include, at a minimum, a description of the incident; the way the
customer or counterparty, or its covered information, may have been
adversely impacted; measures being taken by the covered entity to
protect against further harm; and contact information for the covered
entity where the customer or counterparty may learn more about the
incident or ask questions.
The Commission anticipates that covered entities may experience 17
reportable incidents per year and that covered entities would expend
approximately 50 hours to gather the required information necessary to
provide notice of an incident and to prepare and deliver the required
notification. This would result in an estimated total annual burden of
850 burden hours (17 reportable incidents per year x 50 hours per
reportable incident = 850 burden hours).
The aggregate annual estimate for the disclosure burden associated
with this proposal would be as follows:
Number of registrants: 17.
Estimated number of responses per respondent: 1.
Estimated total annual burden per registrant: 50 hours.
Frequency of collection: As needed.
Total annual burden: 850 burden hours [17 reportable incidents per
year x 50 hours].
d. Total Burden
Based upon the estimates above, the aggregate annual cost for all
covered entities is 84,240 burden hours.
It is expected that covered entities will utilize existing
software, information technology and systems. Thus, the Commission
believes any additional capital/startup costs or operational/
maintenance costs incurred by respondents to report the information
required by the proposed regulations to the Commission would be
negligible, if any.
2. Request for Comment
The Commission invites the public and other federal agencies to
comment on any aspect of the reporting, recordkeeping, and disclosure
burdens discussed above. Pursuant to 44 U.S.C. 3506(c)(2)(B), the
Commission will consider public comments on this proposed collection of
information in:
(1) Evaluating whether the proposed collection of information is
necessary for the proper performance of the functions of the
Commission, including whether the information will have practical
utility;
(2) Evaluating the accuracy of the Commission's estimate of the
burden of the proposed collection of information, including the degree
to which the methodology and the assumptions that the Commission
employed were valid;
(3) Enhancing the quality, utility, and clarity of the information
proposed to be collected; and
(4) Minimizing the burden of the collection of information on
covered entities, including through the use of appropriate automated,
electronic, mechanical, or other technological information collection
techniques, e.g., permitting electronic submission of responses.
A copy of the supporting statements for the collections of
information discussed above are available from the CFTC Clearance
Officer, 1155 21st Street NW, Washington, DC 20581, 202-418-5714, or
from https://www.RegInfo.gov. Organizations and individuals desiring to
submit comments on the proposed information collection requirements
should send those comments to:
The Office of Information and Regulatory Affairs, Office
of Management and Building, Room 10235, New Executive Office Building,
Washington, DC 20503, Attn: Desk Officer of the Commodity Futures
Trading Commission;
202-395-6566 (fax);
[email protected] (email).
Please provide the Commission with a copy of submitted comments so
that all comments can be summarized and addressed in the final
rulemaking. Please refer to the ADDRESSES section of this notice of
proposed rulemaking for comment submission instructions to the
Commission. OMB is required to decide concerning the collection of
information between 30 and 60 days after publication of this document
in the Federal Register. Therefore, a comment is best assured of
receiving full consideration if OMB (and the Commission) receives it
within 30 calendar days of publication of this notice. Nothing in the
foregoing affects the deadline enumerated above for public comment to
the Commission on the proposed rule.
C. Cost-Benefit Considerations
Section 15(a) of the CEA requires the Commission to consider the
costs and benefits of its discretionary actions before promulgating a
regulation under the CEA or issuing certain orders.\312\ Section 15(a)
further specifies that the costs and benefits shall be evaluated in
light of five broad areas of market and public concern: (1) Protection
of market participants and the public; (2) efficiency, competitiveness,
and financial integrity of swaps markets; (3) price discovery; (4)
sound risk
[[Page 4739]]
management practices; and (5) other public interest
considerations.\313\ In conducting its analysis, the Commission may, in
its discretion, give greater weight to any one of the five enumerated
areas of concern. The Commission considers the costs and benefits
resulting from its discretionary determinations with respect to the
considerations of section 15(a) of the CEA.
---------------------------------------------------------------------------
\312\ See 7 U.S.C. 19(a).
\313\ Id.
---------------------------------------------------------------------------
As detailed above, the proposed rule would require covered entities
(FCMs, SDs, and MSPs) to establish, document, implement, and maintain
an ORF reasonably designed to identify, monitor, manage, and assess
risks relating to (i) information and technology security, (ii) third-
party service providers, and (iii) emergencies or other significant
disruptions to the continuity of their normal business operations.\314\
The ORF would accordingly need to include a program or plan directed at
each of these three risk areas (an information and technology security
program, a third-party relationship program, and a business continuity
and disaster recovery plan), as well as a plan for the review and
testing of the ORF, each of which would need to meet certain specified
minimum requirements.\315\ The proposed rule would further establish
governance, training, and recordkeeping requirements related to the
ORF, as well as require notification of certain ORF-related events to
the Commission and customers or counterparties.\316\ The main purpose
of the proposed ORF, as discussed above, is to promote sound practices
for managing risks relating to information and technology security,
third-party relationships, and emergencies or other significant
disruptions, so as to support covered entity operational resilience, to
the benefit of customers, counterparties, and the derivatives markets
more broadly.
---------------------------------------------------------------------------
\314\ See paragraph (b)(1) of proposed Commission regulations
1.13 and 23.603.
\315\ See paragraphs (b)(2) (components), (d) (information and
technology security program), (e) (third-party relationship
program), (f) (business continuity and disaster recovery plan), and
(h) (reviews and testing) of proposed Commission regulations 1.13
and 23.603.
\316\ See paragraphs (c) (governance), (g) (training), (i)
(notifications to the Commission), (j) (notification of incidents to
affected customers or counterparties), (k) (emergency contacts), and
(l) (recordkeeping) of proposed Commission regulations 1.13 and
23.603.
---------------------------------------------------------------------------
The Commission identifies and considers the benefits and costs of
the proposed amendments relative to the baseline of the current status
quo. As discussed above, all of the proposed requirements would be new
CFTC requirements for covered entities, with the exception of the BCDR
plan requirement for swap entities, which the proposed rule would amend
in certain respects.\317\ Nevertheless, the Commission preliminarily
believes that many, if not all, covered entities currently registered
with the Commission have likely adopted documents, policies, and
practices consistent with the proposed ORF rule. Current NFA rules and
interpretive notices, for instance, address the core risks at the
center of the ORF--information and technology security, third-party
risks, and BCDR planning--and establish related requirements that apply
to covered entities, including a BCDR plan requirement for FCMs.\318\
Additionally, many covered entities are subject to prudential
regulation, which includes requirements relating to information
security and notifications of related incidents.\319\ Prudential
regulators have also provided guidance relating to operational
resilience and third-party relationships.\320\ Furthermore, based on
its oversight activities, the Commission preliminarily believes that
certain aspects of the proposed rule requirements are already employed
by many covered entities as recommended best practices.
---------------------------------------------------------------------------
\317\ See 17 CFR 23.603.
\318\ See supra note 43; see also supra note 60 (noting that
NFA's requirement to establish a business continuity and disaster
recovery plan does not apply to swap entities).
\319\ See Computer-Security Incident Notification Requirements
for Banking Organizations and their Bank Service Providers, 86 FR
66424 (Nov. 23, 2021); 12 CFR part 30, app. A (Interagency
Guidelines Establishing Standards for Safety and Soundness); 12 CFR
part 30, app. B (Interagency Guidelines Establishing Information
Security Standards).
\320\ See supra note 43. See also supra note 50. The Commission
notes that the Prudential Operational Resilience Paper was ``written
for use by the largest and most complex domestic firms,'' including
financial institutions with average total consolidated assets
greater than or equal to (a) $250 billion or (b) $100 billion and
have $75 billion or more in average weighted short-term wholesale
funding, average nonbank assets, or average off-balance-sheet
exposure. See Prudential Operational Resilience Paper, supra note
11, at 1.
---------------------------------------------------------------------------
The Commission acknowledges that, no matter the degree to which a
covered entity currently operates in a manner consistent with the
requirements of the proposed rule, covered entities would all incur
some level of costs in reviewing the proposed rule and comparing their
existing practices and procedures against it to ensure they meet the
minimum requirements and make any necessary updates. Nevertheless, the
Commission preliminarily believes that the actual costs and benefits of
the proposed rule as realized by most current covered entities may not
be as significant as they would be for entities not already subject to
NFA or prudential authority or that have not already adopted
operational resilience practices in line with general standards and
best practices. The Commission also preliminarily believes that
leveraging existing standards and guidance and aligning with other
applicable authorities to the degree sensible and appropriate, as
recommended by the National Cyber Strategy, in itself is a benefit to
covered entities and the markets more broadly, by reducing compliance
burdens while promoting practices that have proven to support
operational resilience and positive regulatory outcomes. Customers,
counterparties, and the public more generally would likely benefit as
well, as the proposed rule would allow the Commission to exercise its
oversight authority to foster compliance with the ORF requirements that
are currently absent from its regulations.
By its terms, section 15(a) does not specifically require the
Commission to quantify the costs and benefits of a new rule or to
determine whether the benefits of the adopted rule outweigh its costs.
Rather, section 15(a) requires the Commission to ``consider the costs
and benefits'' of a subject rule.\321\ The Commission has endeavored to
assess the expected costs and benefits of the proposed amendments in
quantitative terms, including PRA related costs, where possible. In
situations where the Commission is unable to quantify the costs and
benefits, the Commission identifies and considers the costs and
benefits of the applicable proposed amendments in qualitative terms.
However, the Commission lacks the data necessary to reasonably quantify
all of the costs and benefits considered below. Additionally, any
initial and recurring compliance costs for any particular covered
entity would depend on its size, existing infrastructure, practices,
and cost structures, as well as the nature, size, scope, complexity,
and risk profile of its operations as a covered entity. It is
impossible to place a reliable dollar figure on potential future
incidents that might be prevented through this rulemaking because the
threats are too varied. The constantly changing nature of technology
exacerbates this difficulty.\322\
---------------------------------------------------------------------------
\321\ See 7 U.S.C. 19(a).
\322\ FSI Cybersecurity Paper, supra note 15, at 1 (``The cyber
threat landscape is also characterised by a significant and
continuous rise in the cost of cyber incidents. Statista (2023)
estimated the global cost of cyber crime in 2022 at $8.4 trillion
and expects this to go beyond $11 trillion in 2023. This reflects an
annual increase of 30% in the cost of cyber crime during the 2021-23
period. Moreover, the average cost of a data breach between 2020 and
2022 increased by 13%, with the financial industry scoring the
second highest average cost after healthcare at $6 million.
According to Chainalysis (202[3]), 2022 was the biggest year ever
for crypto hacking, with $3.8 billion stolen from cryptocurrency
businesses. Cyber insurance demand continues to outweigh supply and
that the cyber protection gap appears to be widening amid a market
characterised by rising premiums, narrowing coverage and tighter
underwriting standards.'').
---------------------------------------------------------------------------
[[Page 4740]]
Regarding covered entities' costs, while the Commission generally
believes--based on anecdotal information and its general
understanding--that covered entities have already instituted, to a
large degree, the practices called for in the proposed rule, the
Commission lacks empirical evidence or data to verify that belief
(including the number of covered entities whose practices currently
meet the requirements being proposed) and quantify what, if any,
material costs covered entities would incur to comply with the proposed
regulations. To the extent covered entities would need to make
operational changes to comply with the proposed amendments, the
Commission expects they would be proportionate to the nature, size,
scope, complexity, and risk profile of their operations as covered
entities. The Commission therefore invites comments providing data and
other empirical information to allow it to quantify the degree to
which: (1) covered entities currently have implemented (or independent
of the proposed amendments, otherwise plan to implement) practices that
are compliant with the Commission's proposed regulations and (2) the
expected additional costs for any covered entities that, to date, have
not completely done so or are otherwise moving independently towards
doing so.
The Commission notes that this cost-benefit consideration is based
on its understanding that the derivatives markets regulated by the
Commission function internationally with: (1) transactions that involve
U.S. entities occurring across different international jurisdictions;
(2) some entities organized outside of the United States that are
registered with the Commission; and (3) some entities that typically
operate both within and outside the United States and that follow
substantially similar business practices wherever they are located.
Where the Commission does not specifically refer to matters of
location, the discussion of costs and benefits below refers to the
effects of the proposed regulations on all relevant derivatives
activity, whether based on their actual occurrence in the United
States, or on their connection with, or effect on, U.S. commerce.
In the sections that follow, the Commission discusses the costs and
benefits associated with the proposed rule, as well as reasonable
alternatives, relative to the baseline. The Commission generally
requests comment on all aspects of its cost-benefit consideration,
including the baseline; assumptions and methodology employed; the
identification and measurement of costs and benefits relative to the
baseline; the identification, measurement, and assessment of any costs
and benefits not discussed herein; data and any other information to
assist or otherwise inform the Commission's ability to better quantify
or qualitatively understand and describe the costs and benefits of the
proposed amendments; whether and what specific alternatives would be
more reasonable in terms of their costs and benefits and why; and
substantiating data, statistics, and any other information to support
positions posited by commenters with respect to the Commission's
discussion and/or requests for comments.
1. Costs and Benefits
The following sections discuss the costs and benefits that the
Commission preliminarily expects to result from the requirements in the
proposed rule.
e. Generally--Proposed Paragraph (b)
The proposed rule would require covered entities to establish,
document, implement, and maintain an ORF reasonably designed to
identify, monitor, manage, and assess risks relating to: (i)
information and technology security; (ii) third-party relationships;
and (iii) emergencies or other significant disruptions to the
continuity of normal business operations as covered entities.\323\ The
ORF would need to, at a minimum, include an information and technology
security program, a third-party relationship program, and a business
continuity and disaster recovery plan, and each component program or
plan would need to be supported by written policies and
procedures.\324\ Covered entities would further need to ensure that
their ORF is appropriate and proportionate to the nature, size, scope,
complexity, and risk profile of their business activities as covered
entities, following generally accepted standards and best
practices.\325\
---------------------------------------------------------------------------
\323\ See paragraph (b)(1) of proposed Commission regulations
1.13 and 23.603.
\324\ See paragraph (b)(2) of proposed Commission regulations
1.13 and 23.603.
\325\ See paragraph (b)(3) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
The Commission anticipates that the main source of costs associated
with establishing, documenting, implementing, and maintaining the ORF,
as required, would derive from creating and implementing the necessary
core component programs and plan, the detailed requirements and costs
and benefits of which are discussed in greater detail in the sections
that follow. As discussed above, although the Commission expects that
most covered entities have already established at least some of
elements of the ORF in place by virtue of NFA or other requirements,
covered entities would, at minimum, need to devote time and resources
to reviewing their existing programs to ensure they meet the
requirements of the proposed rule and making any necessary amendments.
Accordingly, the Commission anticipates all covered entities would
incur at least a one-time fixed cost associated with reviewing their
existing programs to ensure compliance, and to identify and make any
potential required updates. Specifically, the Commission expects
covered entities would incur a one-time initial cost of $41,000 (410
hours \326\ x $100/hour) to review their existing programs and identify
and make any necessary changes, or an estimated aggregate dollar cost
of $6,560,000 (160 covered entities x $41,000).\327\
---------------------------------------------------------------------------
\326\ This hour estimate reflects the aggregate amount of time
the Commission estimates covered entities will expend establishing,
documenting, implementing and maintaining the core component
programs and plan of their ORF (i.e., information and technology
security program, third-party relationship program, and business
continuity and disaster recovery plan). See section III.B (Paperwork
Reduction Act) of this notice, supra.
\327\ The cost estimates in this section were determined using
an average salary of $100.00 per hour. The Commission believes that
this is an appropriate salary estimate for purposes of the proposed
rule based upon the May 2022 Bureau of Labor Statistics' average
hourly rate for the following positions: (1) $63.08 for management
occupations; (2) $41.39 for business and financial operations
occupations; (3) $51.99 for computer and mathematical occupations;
(4) $67.71 for computer engineering occupations; (5) $59.87 for
legal occupations; and (6) $21.90 for office and administrative
support occupations. Based on this data, the Commission took the
mean hourly wage for these positions and increased it to $100 in
recognition that some covered entities are large financial
institutions whose employees' salaries may exceed the mean wage. See
U.S. Bureau of Labor Statistics, May 2022 National Occupational
Employment and Wage Estimates (last updated Apr. 25, 2023),
available at https://www.bls.gov/oes/current/oes_nat.htm#43-0000.
---------------------------------------------------------------------------
To the extent that covered entities' current operational resilience
practices do not meet the minimum requirements
[[Page 4741]]
of the proposed rule, they may incur more and other forms of costs in
updating the programs. Such costs could include fixed costs associated
with securing new technology or other services (e.g., upgrading
technology, incorporating penetration testing), or even adding new
staffing to support new required functions, as well as new ongoing
costs related to monitoring and training. By requiring that the ORF,
and consequently the associated programs and plan, are appropriate and
proportionate to the covered entity, the Commission expects that the
extent of those costs should be reasonably mitigated, such that covered
entities should be able to tailor their ORFs to their unique
circumstances and not incur costs to adopt practices or technologies
that would not be recommended or necessary for them.
Additionally, to the extent costs in updating programs are
unavoidable, the Commission believes the proposed ORF rule is
reasonably designed to ensure that the costs would support covered
entities' operational resilience, and the broader security of the
derivatives markets as a whole, as discussed in greater detail below.
More specifically, the Commission believes the proposed ORF rule is
reasonably designed to ensure customer and counterparty information and
assets remain protected, and that the derivatives markets remain stable
and functioning, particularly as covered entities become ever more
reliant on rapidly evolving technology and/or third-party service
providers to support their operations. Requiring all covered entities
to have a framework directed at operational resilience that meets
certain minimum requirements, including governance, training, and
testing requirements, would give the CFTC, customers, counterparties,
and covered entities themselves confidence that there exists among all
covered entities a certain foundational level of security and
resilience. Requiring covered entities to base their ORFs on generally
accepted standards and best practices further buttresses that assurance
by making sure adopted practices are grounded in standards that are
commonly known and accepted, widely recognized as effective, and
require adaptation as risk profiles change. Relying on existing known
standards should also help mitigate implementation costs compared to
complying with specific and detailed requirements created by the
Commission and applied more uniformly. Furthermore, as the Commission
engages in oversight of ORFs, it would expect to be able to identify
additional recommended best practices unique to covered entities that
it could share through guidance or future rulemakings, which would
operate to further support the stability of the derivatives markets.
f. Governance--Proposed Paragraph (c)
The proposed rule would require that each of the three required
component programs and plan (the information and technology security
program, the third-party relationship program, and the business
continuity and disaster recovery plan) be approved in writing, on at
least an annual basis, by either the senior officer, an oversight body,
or a senior-level official of the covered entity.\328\ Covered entities
would likely experience some costs associated with selecting the
responsible official or body to provide the approval and associated
costs to obtain their approval, including the time and resources needed
to develop any explanatory materials, making amendments in light of any
comments from leadership, and ministerial costs associated with
obtaining signatures. More specifically, the Commission estimates that
covered entities would incur an initial cost of $4,000 (40 hours x
$100/hour) to select the responsible official or body to approve the
component programs and plan of the ORF,\329\ or an estimated aggregate
dollar cost of $640,000 (160 covered entities x $4,000). Additionally,
the Commission estimates that covered entities will incur an ongoing
annual cost of $1,000 for the approval of the component programs or
plan of the ORF (10 hours x $100/hour),\330\ or an estimated aggregate
dollar cost of $160,000 (160 covered entities x $1,000).
---------------------------------------------------------------------------
\328\ See paragraph (c)(1) of proposed Commission regulations
1.13 and 23.603.
\329\ Covered entities may also incur subsequent costs in the
event there is a change in official or body responsible for the
approval of the ORF component programs or plan.
\330\ As discussed supra in section III.B (Paperwork Reduction
Act) of this notice, the Commission expects covered entities will
expend a total of 20 burden hours to approve the component programs
and plan of the ORF, risk appetite, and risk tolerance limits, or to
prepare a written attestation.
---------------------------------------------------------------------------
However, the Commission anticipates that providing a covered entity
broad discretion to select whomever it deems appropriate to provide the
approval would serve to mitigate some of those costs by allowing the
covered entity to embed the approval process within its existing
operational structures. The Commission further believes that requiring
regular and formal approval of the ORF component programs and plan by
senior leadership would help ensure that the ORF is in line with
operational strategy and risk capacity, improving the chances that the
covered entity would be adequately prepared for, and able to withstand
and recover from operational shocks, that could otherwise significantly
harm customers, counterparties, or even have spillover effects into the
derivatives market as a whole.
The proposed rule would further require covered entities to
establish risk appetite and risk tolerance limits with respect to the
risk areas underlying the ORF (information and technology security,
third-party relationships, and emergencies or other significant
disruptions to the continuity of normal business operations).\331\ The
Commission believes that establishing and operating within established
risk appetite and risk tolerance limits would help ensure that covered
entities do not engage in activities that would present risks beyond
those they can comfortably manage, helping to mitigate the potential
for covered entities to take on risk that could lead to intolerable
harm to customers or disruption to the financial system at large.
---------------------------------------------------------------------------
\331\ See paragraph (c)(2)(i) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
Covered entities that do not currently have a practice of creating
a risk appetite statement and establishing and monitoring metrics for
risk tolerance limits would likely incur costs associated with
establishing a methodology to identify them, which would involve time
and staffing resources, or perhaps even the use of consultants, but the
Commission anticipates such costs should be reduced year over year as
such covered entities gain experience and streamline processes.
Nevertheless, the Commission understands that establishing risk
appetite and tolerance limits is common practice in the financial
industry, and is included as a recommended part of governance in the
NIST financial sector profile.\332\ To the extent that covered entities
already follow this practice, such covered entities would incur general
costs associated with reviewing their risk appetite and risk tolerance
limits against the rule requirements to ensure they cover the full
scope of the rule, but they would avoid the heavier resource burdens of
developing risk appetite and risk tolerance limits from whole cloth.
---------------------------------------------------------------------------
\332\ See CRI Profile Workbook, supra note 81, at 16 (``An
appropriate governing authority . . . endorses and periodically
reviews the cyber risk appetite and is regularly informed about the
status of and material changes in the organization's inherent cyber
risk profile).
---------------------------------------------------------------------------
The risk appetite and risk tolerance limits would further need to
be
[[Page 4742]]
reviewed and approved in writing on at least an annual basis by the
oversight body, senior officer, or other senior-level official with
primary responsibility for the relevant risk area.\333\ Similar to the
broad approval of the ORF component programs and plan in general,
covered entities would likely incur some costs preparing information
for approval, making amendments in response to comments, and obtaining
signatures. Specifically, the Commission estimates covered entities
would incur an ongoing annual cost of $1,000 for the approval of risk
appetite and risk tolerance limits (10 hours x $1,000),\334\ or an
estimated aggregate dollar cost of $160,000 (160 covered entities x
$1,000). The Commission believes that the process of securing formal
approval would encourage covered entities to think critically about the
risk appetite and risk tolerance limits they establish and to justify
them in light of operational strategy. This exercise should bring more
awareness to activities that create operational risk and lead to better
outcomes from an operational resilience standpoint, with attendant
benefits to customers, counterparties, and the market more broadly.
---------------------------------------------------------------------------
\333\ See paragraph (c)(2)(ii) of proposed Commission
regulations 1.13 and 23.603.
\334\ As discussed in section III.B (Paperwork Reduction Act) of
this notice, the Commission expects covered entities will expend a
total of 20 burden hours annually to document approval of the
component plans of the ORF, risk appetite, and risk tolerance
limits, or to prepare a written attestation.
---------------------------------------------------------------------------
Relatedly, the proposed rule would require covered entities to
notify selected senior leadership of circumstances that exceed risk
tolerance limits and incidents requiring notification to either the
Commission or customers and counterparties.\335\ The Commission
understands that such an internal escalation requirement would require
covered entities to incur some costs in developing policies and
procedures that reflect this requirement, or reviewing existing
escalation protocols to ensure they meet the terms of the rule, but the
Commission believes the requirement is sufficiently flexible to allow
covered entities to rely on existing operational structures and
reporting lines, and does not anticipate that any organizational
changes, or attendant costs, would be necessary. Additionally, the
Commission views the involvement and awareness of senior leadership in
cases where risk tolerance limits are exceeded, or where significant
incidents have occurred that clearly threaten operational resilience,
as critical to ensuring recovery efforts are coordinated and thus more
likely to be successful.
---------------------------------------------------------------------------
\335\ See paragraphs (c)(3)(i)-(ii) of proposed Commission
regulations 1.13 and 23.603.
---------------------------------------------------------------------------
The proposed rule would allow covered entities that form a part of
a larger enterprise to satisfy the requirements of the proposed rule
through their participation in a consolidated program or plan that
meets the requirements of the proposed rule.\336\ Additionally, a
covered entity relying on a consolidated program or plan would be able
to satisfy the requirements for senior leadership to approve both the
component program or plan and risk appetite and risk tolerance limits
by having senior leadership attest on an annual basis that the
consolidated program or plan meet the requirements of the proposed ORF
rule, and reflects risk appetite and risk tolerance limits appropriate
to the covered entity.\337\ The Commission estimates that covered
entities would incur an ongoing annual cost of $2,000 (20 hours x $100/
hour) to prepare an written attestation,\338\ or an estimated aggregate
dollar cost of $320,000 (160 covered entities x $2,000). The Commission
believes allowing covered entities to rely on a consolidated program or
plan would mitigate costs for such entities, specifically by benefiting
from economies of scale present in relying on shared corporate
infrastructure and a larger parent company's resources to manage
operational risk at a broader enterprise level, and through using
existing practices that meet the requirements of the proposed rule.
---------------------------------------------------------------------------
\336\ See paragraph (c)(4)(i) of proposed Commission regulations
1.13 and 23.603.
\337\ See paragraph (c)(4)(ii) of proposed Commission
regulations 1.13 and 23.603.
\338\ As discussed supra in section III.B (Paperwork Reduction
Act) of this notice, the Commission expects covered entities will
expend a total of 20 burden hours annually to document approval of
the component programs or plans of the ORF, risk appetite, and risk
tolerance limits, or to prepare a written attestation.
---------------------------------------------------------------------------
Nevertheless, the Commission expects that such covered entities
would incur at least some costs associated with reviewing the
consolidated program or plan to ensure it meets the requirements of the
proposed rule and reflect risk appetite and risk tolerance limits
appropriate to the covered entities. Such covered entities may face
challenges in ensuring that their consolidated programs or plans, which
may be written with the parent corporate entity as the primary focus,
appropriately address the risks as they relate more specifically to the
business and operations of the covered entity, which may be a
relatively small line of business for the parent. Accordingly, a
covered entity may incur some costs, in terms of time and staffing
resources, associated with amending any consolidated program or plan to
ensure it reflects the proposed rule's requirements and risk appetite
and risk tolerance limits appropriate to the covered entity. The
Commission cannot accurately quantify such costs, as these costs could
range from minimal to more substantial depending on the complexity of
the organization and how closely the current consolidated program or
plan meets the requirements of the proposed rule, including how
particularized they are with respect to identifying and managing the
risks specific to the covered entity. The Commission believes that such
requirements are important to ensuring that all covered entities,
regardless of their operational structure, have a baseline level of
operational risk management that is tailored to the entity itself,
helping reduce risk to the overall financial system and the commodity
derivatives markets in particular. The Commission also preliminarily
believes that the overall costs of the proposed rule are reduced,
without any loss of benefit, by allowing covered entities to rely on
consolidated programs or plans over requiring them to duplicate
existing larger corporate entity efforts to produce programs or plans
that are independent and unique to the covered entity.
g. Information and Technology Security Program--Proposed Paragraph (d)
The proposed rule would require covered entities to have an
information and technology security program, defined as a written
program reasonably designed to identify, monitor, manage, and assess
risks relating to information and technology security and that meets
certain requirements.\339\ Specifically, the information and technology
security program would need to include (1) a risk assessment, conducted
at least annually; (2) effective controls; and (3) an incident response
plan.\340\ The proposed risk assessment requirement would require
covered entities to identify and devote resources to planning and
performing the risk assessment and then analyzing its results. These
resources would need to include reliance on personnel not responsible
for the development or implementation of covered technology or related
controls, which could impose additional staffing needs on some
[[Page 4743]]
covered entities.\341\ The amount of time and resources expended would
likely vary depending on the size, complexity, and risk profile of the
covered entity and its degree of reliance on covered technology. The
Commission believes that larger covered entities with more complex
business operations and broader risk profiles would likely need to
devote more permanent and extensive resources, staffing and otherwise,
to performing and analyzing their risk assessments. Presenting the
results of the assessment to selected senior leadership would also
require the devotion of time and staffing resources to prepare for and
respond to leadership feedback.
---------------------------------------------------------------------------
\339\ See paragraphs (a) (defining ``information and technology
security program'') and (b)(2) (components) of proposed Commission
regulations 1.13 and 23.603.
\340\ See paragraph (d) of proposed Commission regulations 1.13
and 23.603.
\341\ See paragraph (d)(1)(ii) of proposed Commission
regulations 1.13 and 23.603.
---------------------------------------------------------------------------
In establishing effective controls, covered entities would be
required to consider a broad range of categories of controls, determine
which to implement in line with identified risks, implement them, and
then review and revise the controls as needed over time in response to
continued risk assessments. Depending on the types of controls they
would need to implement, covered entities may take on additional costs
to acquire new security technology and/or hire additional staff or
third-party service providers to oversee and implement the controls.
Again, the Commission would expect any outlays to be appropriate and
proportionate to the covered entity and its risk profile, so the exact
costs would vary by covered entity. Nevertheless, given that the
approach of the proposed rule, and list of required categories, closely
aligns with the longstanding approach adopted by prudential regulators
with respect to information and technology security controls, the
Commission believes that costs for at least prudentially regulated
covered entities may be reduced compared to other covered entities that
have not been required to apply and consider such categories of
controls.\342\
---------------------------------------------------------------------------
\342\ See supra note 130 and accompanying text.
---------------------------------------------------------------------------
Development of an incident response plan would likely require a
noticeable devotion of resources at the outset, as staff would need to
dedicate time and effort to forming and documenting the plan, including
creating policies and procedures for identifying the types of incidents
that need to be reported and to whom. Should an incident occur, the
plan would require staff at the covered entity to devote time to
documenting and responding to the incident, as well as identifying and
taking on remediation efforts.
Nevertheless, the Commission expects that, given the NFA's ISSP
Notice, covered entities would likely not need to expend resources to
develop an information and technology security program from scratch.
Notably, NFA requires its members to adopt and enforce a written ISSP,
assess and prioritize the risks associated with its use of information
technology systems, document and describe in their ISSPs safeguards
deployed in light of identified and prioritized threats and
vulnerabilities, and create an incident response plan.\343\
Accordingly, some of the compliance burdens associated with
implementing an information and technology security program should be
reduced. Covered entities overseen by prudential regulators are also
required to consider similar categories of controls to those in the
proposed rule, so compliance costs as realized by prudentially
regulated covered entities may be even further reduced.\344\ Notably,
however, NFA does not mandate that a risk assessment be conducted at
least annually by personnel not responsible for the development or
implementation of covered technology or related controls. Although the
Commission believes these requirements to be consistent with generally
accepted standards and best practices, such that covered entities may
be following them anyway, some covered entities may nevertheless
experience some additional costs associated with ensuring or otherwise
acquiring staff sufficiently independent to conduct the risk assessment
and in potentially conducting the risk assessment more frequently than
they currently do. The Commission also recognizes that, if adopted, the
proposed rule would at minimum require covered entities to expend
resources to review the ISSPs they established pursuant to NFA rules to
ensure they meet the requirements of the information and technology
security program.
---------------------------------------------------------------------------
\343\ See NFA ISSP Notice, supra note 43.
\344\ See 12 CFR part 30, app. B.
---------------------------------------------------------------------------
Notwithstanding the potential operational and staffing costs to
covered entities associated with the proposed rule, the Commission
believes the benefits of the requirements of the proposed information
and technology security program are well established. Risk assessments
are crucial to identifying threats and vulnerabilities, which is key to
directing resources to mitigate those risks in a way that increases the
effectiveness of security efforts. The Commission likewise believes the
benefits of an independent risk assessment (a more unbiased and
reliable assessment) and conducting it at least annually (ensuring the
information and technology security program is up-to-date and
responsive in light of current threat landscape and vulnerabilities at
the covered entity) are important to supporting covered entity
operational resilience. Likewise, controls are the methods or
techniques for monitoring and managing those risks and safeguarding
information, operations, and assets. Without them, the potential for a
system weakness to be exploited, and for customers and counterparties,
covered entities, or the market at large to be harmed is increased, as
the interconnected nature of the commodity derivatives markets enhances
the possibility for spillover effects. Incident response plans operate
to reduce the potential magnitude of the harm should a safeguard fail
by creating a concrete plan, known in advance, for how the covered
entity should respond, thereby shortening response times following an
incident. Accordingly, the Commission believes the proposed minimum
requirements of the information and technology security program, in
combination with the Commission's oversight, would further support the
development of a foundational level of operational risk management
practices with respect to information and technology security that
would benefit customers, counterparties, and the market at large.
h. Third-Party Relationship Program--Proposed Paragraph (e)
The proposed rule would require covered entities to have a third-
party relationship program, defined as a written program reasonably
designed to identify, monitor, manage, and assess risks relating to
third-party relationships.\345\ The program would need to describe how
covered entities address the risks attendant to each of the five
identified stages of the third-party relationship lifestyle, ranging
from pre-selection to termination, with heightened due diligence and
monitoring required for critical third-party service providers.\346\
The proposed rule would further require covered entities to create,
maintain, and regularly update an inventory of third-party service
providers engaged to support their activities as covered entities,
identifying whether each is a critical third-party service
provider.\347\
---------------------------------------------------------------------------
\345\ See paragraphs (a) (defining ``third-party relationship
program'') and (e) (third-party relationship program) of proposed
Commission regulations 1.13 and 23.603.
\346\ See paragraphs (e)(1)(i)-(v) and (e)(2) of proposed
Commission regulations 1.13 and 23.603.
\347\ See paragraph (e)(3) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
[[Page 4744]]
As with the information and technology security program, complying
with this aspect of the proposed rule would require covered entities to
expend staff resources at the outset to develop the program and put it
into writing. Although NFA requires its members, including covered
entities, to have a written supervisory framework for its third-party
service providers, which could help mitigate these costs, NFA's written
supervisory framework only extends to outsourcing functions, i.e.,
regulatory functions that would otherwise be undertaken by the NFA
member itself to comply with NFA and CFTC requirements.\348\
Accordingly, covered entities would likely experience at least some
staffing burdens expanding their NFA frameworks to fit the broader
scope of third-party relationships covered by the proposed rule and
implementing it across their third-party service providers more
broadly. However, applying the proposed (b)(3) standard, covered
entities should be able to align their third-party risk management
practices to the risks presented by each individual third-party service
provider, which would allow covered entities to tailor and fit the
costs of their third-party practices to their unique circumstances.
Covered entities following prudential rules and guidance with respect
to third-party service providers, which applies to all third-party
relationships, would likely experience reduced costs compared to other
covered entities with respect to any need to modify their existing
programs.\349\ Additionally, the proposed rule would not require
covered entities to perform due diligence or renegotiate contracts with
existing third-party service providers, which would avoid a potentially
substantial initial fixed cost from implementing the third-party
relationship program.
---------------------------------------------------------------------------
\348\ See NFA Third-Party Notice, supra note 43.
\349\ See 12 CFR part 30, app. B, III.D. (Oversee Service
Provider Arrangements); Prudential Third-Party Guidance, supra note
43.
---------------------------------------------------------------------------
Creating an initial inventory of third-party service providers, and
assessing whether they meet the definition of ``critical third-party
service provider'' would also require a temporary redirection of staff
resources, with the amount of time and resources required varying
depending on the extent and complexity of a given covered entity's
reliance on third-party service providers. With respect to critical
third-party service providers, the Commission preliminarily believes
that many, if not all, covered entities currently have in place a
process to identify and categorize covered entities as ``critical'' or
otherwise requiring enhanced supervisory activities. Additionally, NFA
requires its members to have heightened due diligence for third-party
service providers that obtain or have access to critical and/or
confidential data and those that support critical regulatory-related
systems, which could potentially reduce burdens on covered entities in
designing and implementing heightened due diligence and monitoring with
respect to critical third-party service providers.\350\ Although the
Commission preliminarily believes that its proposed definition of
``critical third-party service provider'' should identify many, if not
all, of the same providers covered entities would themselves identify
as ``critical,'' the Commission recognizes that the process of applying
the proposed definition to an existing process would, at minimum,
require some initial expenditure of staff resources to ensure existing
practices and taxonomies align with the proposed rule.\351\
Additionally, the process of creating an inventory of third-party
service providers, which is not currently required by NFA or prudential
regulators, could be particularly burdensome, especially for covered
entities with a large number of complex third-party relationships, or
that rely on an affiliate to secure and coordinate third-party service
providers as part of a larger enterprise-wide function, potentially
involving staff from many different departments or the review of
multiple contracts or contract databases.
---------------------------------------------------------------------------
\350\ See NFA Third-Party Notice, supra note 43.
\351\ See paragraph (a) of proposed Commission regulations 1.13
and 23.603 (defining ``critical third-party service provider'').
---------------------------------------------------------------------------
Nevertheless, the Commission believes that requiring covered
entities to have a program to identify, monitor, manage, and assess
risks relating to third-party relationships, and inventory their third-
party service providers, would have meaningful benefits at the
individual covered entity-level, as well as for customers and
counterparties and the derivatives markets at large. Given their roles
and interconnectedness in the derivatives markets, an operational shock
at one covered entity can have ripple effects across the markets.
Requiring covered entities to develop and maintain a program to help
evaluate and address the risk at each stage of the third-party
relationship--from before selecting a third-party service provider to
how such a relationship would be supervised and terminated--may not
only help covered entities be more fully aware of and manage the risks
of their third-party relationships, it could also help increase overall
confidence levels in the derivatives markets by ensuring customers and
counterparties that there is a foundational level of third-party risk
management practices across covered entities.
Additionally, the proposed rule could operate to raise minimum
standards with regards to how third-party risks are managed, by
introducing enhanced due diligence or monitoring practices for critical
third-party service providers, for instance, which could lead to real
and measurable reduction in risk to the financial system. The act of
creating an inventory of third-party service providers would also help
increase the likelihood of identifying interdependencies or
overdependencies, which could cause covered entities to reevaluate
particular relationships (i.e., diversify third-party service providers
to reduce concentration risk) or take on additional activities (e.g.,
insurance) to help mitigate those risks, thereby promoting operational
resilience. Identifying critical third-party service providers should
also help enhance operational awareness of those entities and ensure
they receive the required heightened monitoring to ensure that the risk
of disruption to critical services, which could have a broader impact
on the markets or customers and counterparties, is mitigated.
i. Business Continuity and Disaster Recovery Plan--Proposed Paragraph
(f)
The proposed rule would require covered entities to have a BCDR
plan, defined as a written plan outlining the procedures to be followed
in the event of an emergency or other significant disruption to the
continuity of normal business operations and that meets certain
requirements.\352\ This would be a new CFTC requirement for FCMs, but
current Commission regulation 23.603 imposes a BCDR plan requirement on
swap entities that is substantially similar to the proposed rule, as
the proposed rule was modeled after the current BCDR requirement for
swap entities with certain modifications.\353\ Additionally, although
the CFTC does not currently impose a BCDR plan requirement on FCMs, NFA
and CME do, which the Commission believes should help FCMs mitigate the
costs of establishing a BCDR plan for purposes of complying with the
proposed rule, particularly since some of the amendments to the current
BCDR plan requirement for swap entities have the effect of further
aligning the regulatory
[[Page 4745]]
text with NFA and CME BCDR plan requirements.\354\
---------------------------------------------------------------------------
\352\ See paragraphs (a) (defining ``business continuity and
disaster recovery plan'') and (b)(2) (components) of proposed
Commission regulation 1.13 and 23.603.
\353\ See 17 CFR 23.603.
\354\ See NFA Rule 3-38, supra note 43; CME Rule 983, supra note
185.
---------------------------------------------------------------------------
The proposed rule would require covered entities' BCDR plans to be
reasonably designed to enable the covered entities to continue or
resume any activities as a covered entity with minimal disruption to
counterparties, customers, and the markets, and to recover and make use
of covered information, as well as any other data, information, or
documentation required to be maintained by law and regulation.\355\ The
proposed rule would further require the BCDR plans to include certain
minimum contents, including: identifying and backing up required
information; identifying and developing backups for required resources,
including technology, facilities, and staff; identifying potential
disruptions to critical third-party service providers; identifying
implicated personnel; and establishing a communication plan.\356\
---------------------------------------------------------------------------
\355\ See paragraph (f)(1) of proposed Commission regulation
1.13 and 23.603.
\356\ See paragraph (f)(2) of proposed Commission regulation
1.13 and 23.603.
---------------------------------------------------------------------------
To design a BCDR plan that meets that standard, covered entities
would need to expend resources to establish and preserve backup
resources (staffing, technology, inputs) for use in the event of the
BCDR plan's activation, and to create backups of the information the
BCDR plan would cover. Depending on the size and complexity of a
particular covered entity's business, those costs could be sizeable, as
they may require negotiating and entering into new contracts with
backup resource providers, or other third-party service providers.
Covered entities would also need to expend resources to establish a
plan to minimize the impact of disruptions and establish a
communication plan, which would include identifying implicated persons
and bodies and establishing potential contacts, methods, modes, and
priorities of communication. Finally, the resources to document all of
this work in the plan would likely be more than simply ministerial
effort, as staff would likely have to spend time working through
various deliberative points, at least at the outset in first developing
the BCDR plan. The costs to maintaining the plan would likely be
reduced compared to the initial fixed costs, however, as the plan put
into action over time.
Nevertheless, the Commission expects that most covered entities
have already incurred at least some of these potential costs by virtue
of either the existing CFTC BCDR plan requirements for swap entities,
or the NFA and CME BCDR plan requirements applicable to FCMs. Notably,
the ``essential elements'' of NFA's BCDR Notice aligns closely with the
minimum requirements for the Commission's proposed BCDR plan
requirement, requiring FCMs to establish backups in one more reasonably
separate geographic areas, to backup or copy essential documents and
data and store them off-site, to consider the impact of interruptions
by third-parties and ways to minimize the impact, and to develop a
communication plan.\357\ Accordingly, although the Commission expects
FCMs would incur at least some costs reviewing their BCDR plans to
ensure they meet the proposed CFTC requirements, the Commission
preliminarily believes most FCMs would be able to avoid the more
substantial initial costs of developing a BCDR plan from scratch.
---------------------------------------------------------------------------
\357\ See NFA BCDR Notice, supra note 43.
---------------------------------------------------------------------------
The Commission further believes that the expenditure of resources
required to create the proposed plan would help give the derivatives
markets and customers and/or counterparties confidence that covered
entities' operations would be able to be quickly reestablished
following an emergency or significant disruption, improving the overall
resilience of the market and perhaps lowering customer/counterparty
risk and its associated costs. Having a plan that centralizes key
information related to an emergency--including identifying core
information, personnel, systems, and resources needed to resume
operations--should also help facilitate covered entities in achieving
the recovery time objective of being back up and running with minimal
disruption to counterparties, customers, and the derivatives markets,
supporting market confidence and reducing overall systemic risk.
Maintaining copies of the plan in accessible off-site locations should
impose no more than ministerial costs and would help ensure that
covered entities can access the plan in a crisis.
The proposed rule would amend the current BCDR plan requirement for
swap entities in a few ways, some of which the Commission expects would
have cost-benefit implications.\358\ For instance, the proposed rule
would require covered entities to ``recover and make use of all covered
information, as well as any other data, information, or documentation
required to be maintained by law and regulation,'' which expands the
information BCDR plans would be required to cover beyond that required
to be maintained by applicable law and regulation, and makes clear the
information should not only be recovered but also accessible and still
useable.\359\ Depending on current BCDR plan practices by swap
entities, the proposal could potentially cause covered entities to
expand the sources of information they need to backup and/or augment
their backup systems to ensure the information stored there is useable.
The proposed rule would also no longer require swap entities to ensure
their BCDR plans are designed to enable swap entities to continue or
resume operations ``by the next business day.'' \360\ Although the
Commission does not believe that this change would have an impact on
the actual recovery time of swap entities following an emergency or
other significant disruption, given that both current Commission
regulation 23.603 and the proposed rule require that the BCDR plan be
designed to ensure recovery with minimal disruption to counterparties
and the market, swap entities could need to dedicate at least some
staff time to review their BCDR plans to ensure that they continue to
meet the rule requirements.
---------------------------------------------------------------------------
\358\ As with the other sections of this notice, portions of the
BCDR plan requirement for swap entities in current Commission
regulation 23.603 that have been expanded in the proposal to apply
to the ORF more broadly, notably testing, are discussed in the
context of the discussion of those specific requirements.
\359\ See 17 CFR 23.603(a).
\360\ Id.
---------------------------------------------------------------------------
j. Training and Distribution--Proposed Paragraph (g)
The proposed rule would require covered entities to establish,
implement, and maintain training with respect to the ORF, including
general cybersecurity awareness training and role-specific training for
personnel involved in the ORF.\361\ If the proposed rule is adopted,
covered entities would need to expend resources to develop and/or
evaluate and acquire externally sourced training. Those outlays would
include the costs associated with establishing the training at the
outset, as well as ongoing costs associated with updating and providing
the training at least every year.\362\ There would also be
administrative costs associated with distributing copies of the
component programs or plan to relevant personnel and providing them
with any significant revisions.\363\ Nevertheless, the
[[Page 4746]]
Commission believes that establishing, implementing, and maintaining a
training program is crucial to realizing the benefits of the proposed
ORF. Not only would it help ensure that employees of covered entities
are kept aware of good cyber hygiene practices, which should reduce the
potential for covered information to be compromised and customers and
counterparties to be negatively impacted, training would help ensure
that the ORF practices covered entities establish are accurately
implemented and maintained by the personnel tasked with
operationalizing the ORF. Although allowing covered entities to provide
training less frequently than annually would reduce compliance costs
for covered entities, the Commission believes that annual training is
needed to preserve its benefits given the rapidly evolving pace of
technology and the potential for human error to result in actual harm
to operations or even customers or counterparties.\364\
---------------------------------------------------------------------------
\361\ See paragraph (g)(1) of proposed Commission regulations
1.13 and 23.603.
\362\ See paragraph (g)(2) of proposed Commission regulations
1.13 and 23.603
\363\ See paragraph (g)(3) of proposed Commission regulations
1.13 and 23.603.
\364\ See supra note 18 and accompanying text.
---------------------------------------------------------------------------
k. Reviews and Testing--Proposed Paragraph (h)
The proposed rule would require covered entities to establish,
implement, and maintain a plan reasonably designed to assess adherence
to, and the effectiveness of, their ORF through regular reviews and
risk-based testing.\365\ At the outset, covered entities would need to
dedicate staff resources to develop a review and testing plan for the
ORF; ongoing staff resources would be needed to conduct reviews at
least annually and risk-based testing at a frequency that is
appropriate and proportionate to each covered entity's nature, size,
scope, complexity, and risk profile, following generally accepted
standards and best practices.\366\ Covered entities would further
assume regular costs associated with documenting the reviews and
testing (e.g., results of testing, assessment of effectiveness,
recommendations for modifications/improvements/corrective actions) and
reporting on them to the CCO and any other relevant senior-level
official(s) and oversight body(ies).\367\ In general, the ongoing costs
of the required testing and reviews are likely to vary by covered
entity, with larger, more complicated covered entities likely expending
significantly more resources to conduct testing consistent with the
proposed (b)(3) standard.\368\
---------------------------------------------------------------------------
\365\ See paragraph (h) of proposed Commission regulations 1.13
and 23.603.
\366\ See paragraph (b)(3) of proposed Commission regulations
1.13 and 23.603.
\367\ See paragraphs (h)(4) and (h)(5) of proposed Commission
regulations 1.13 and 23.603.
\368\ The Commission estimates, on average, that covered
entities will incur an initial annual cost of $8,000 (80 hours x
$100/hour) to establish a plan to assess adherence to, and the
effectiveness of, its ORF, and to document all reviews and testing
of the ORF, or an estimated aggregate dollar cost of $1,280,000 (160
covered entities x $8,000).
---------------------------------------------------------------------------
With respect to the reviews of the ORF, the proposed rule would
require that they be conducted at least annually and in connection with
any material change that is reasonably likely to affect the risks
addressed by the ORF. The proposed rule would further require the
reviews to include an analysis of adherence to, and the effectiveness
of the ORF, as well as any recommendations for improvements.\369\ This
standard is generally consistent with, and would replace, the current
review standard in current Commission regulation 23.603 for swap entity
BCDR plans, such that associated costs for reviewing the BCDR plan
should not be affected by the proposal.\370\ NFA's ISSP Notice and BCDR
Notice also require NFA members to review their ISSPs or BCDR pans on a
regular or periodic basis.\371\ Accordingly, while covered entities may
experience some staffing costs in assuring their reviews are at least
annual, costs associated with establishing a review process more
broadly should have already been realized by most covered entities.
---------------------------------------------------------------------------
\369\ See paragraph (h)(1) of proposed Commission regulations
1.13 and 23.603
\370\ See 17 CFR 23.603(f) (``A member of the senior management
of each swap dealer and major swap participant shall review the
business continuity and disaster recovery plan annually or upon any
material change to the business. Any deficiencies found or
corrective action taken shall be documented.'')
\371\ See NFA BCDR Notice, supra note 43; NFA ISSP Notice, supra
note 43.
---------------------------------------------------------------------------
For testing, the proposed rule would generally require that its
frequency, nature, and scope would be determined consistent with the
proposed (b)(3) standard.\372\ The Commission believes that such a
risk-based standard would allow covered entities to tailor testing to
their unique business and risk profile, focusing testing efforts on
areas that would be the most impactful or revealing and avoiding
unnecessary costs. Nevertheless, with respect to testing of the
information and technology security program, the proposed rule would
require covered entities to assume costs for some specific testing,
including testing of key controls and the incident response plan, as
well as daily or continuous vulnerability assessments and penetration
testing at least annually.\373\ Although regular testing of key
controls and the incident response plan is likely to require time and
staff resources, the Commission believes that without testing, it would
be impossible for covered entities to know whether the controls are
functioning to mitigate risk as expected, and for the incident response
plan to be actionable in times of emergency. Daily or continuous
vulnerability assessments and penetration testing at least annually
could require additional staff and technology outlays.\374\ The exact
cost of testing as realized by each covered entity, however, is likely
to vary depending on the scope and complexity of its operations, and
the degree to which it has already incorporated vulnerability
assessments and penetration testing as part of its ISSP.\375\
---------------------------------------------------------------------------
\372\ See paragraph (h)(2) of proposed Commission regulations
1.13 and 23.603.
\373\ See paragraph (h)(2)(i) of proposed Commission regulations
1.13 and 23.603.
\374\ CISA makes available a free vulnerability scanner, see
supra note 248.
\375\ The NFA ISSP Notice provides that a member ``may include
penetration testing of the firm's systems, the scope and timing of
which is highly dependent upon the Member's size, business,
technology, its electronic interconnectivity with other entities and
the potential threats identified in its risk assessment.'' See NFA
ISSP Notice, supra note 43.
---------------------------------------------------------------------------
The Commission believes that vulnerability assessments and
penetration testing are essential for covered entities to know what
their vulnerabilities are and how they might be exploited, so they can
take steps to mitigate associated risks, including by adapting internal
controls, which are a key component of preserving operational
resilience. Given the dynamic, ever changing nature of technology and
cybersecurity, the Commission believes that continual and active action
and engagement are necessary to ensure controls are operating as
intended, and for covered entities to have an accurate assessment of
the risks to their covered information and technology. By not mandating
specific types of penetration testing, however, the Commission believes
the proposed rule is adapted to allow the wide range of covered
entities subject to the proposed rule to adopt types of testing that
are recommended for and best fit their unique circumstances, so as to
achieve the highest level of improved cybersecurity without incurring
unnecessary costs. The Commission further believes such testing is
essential cyber hygiene and their use among covered entities would help
ensure a base level of monitoring in the derivatives markets that is
readily accessible.
[[Page 4747]]
With respect to testing of the BCDR plan, the proposed rule would
require covered entities to dedicate time and staff resources to
conduct a walk-through or tabletop exercise designed to test the
effectiveness of backup facilities and capabilities at least annually,
which could involve outreach to operators of backup facilities.\376\
Such a periodic effort would likely consume staff time and resources to
put into place, including potentially in designing tabletop exercise
scenarios. The Commission expects that this aspect of the proposed rule
would not have any cost impact on swap entities, as current 23.603
requires annual testing of their BCDR plan, and the Commission does not
believe the clarification that the testing be a walk-through or
tabletop exercise would have substantive effect.
---------------------------------------------------------------------------
\376\ See paragraph (h)(2)(i) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
Because the proposed rule would require the reviews and testing to
be conducted by qualified personnel who are independent of the aspect
of the ORF being reviewed or tested, the Commission anticipates this
work would either be conducted by internal compliance audit staff,
external independent auditors, or other internal staff, provided they
were not involved in creating the ORF component being tested.\377\
Accordingly, this independence requirement could require covered
entities to reassign duties or secure additional staffing resources,
either of which would impose some additional costs.
---------------------------------------------------------------------------
\377\ See proposed paragraph (h)(3) of proposed Commission
regulations 1.13 and 23.603.
---------------------------------------------------------------------------
Nevertheless, the Commission believes that annual reviews and
testing are essential to ensuring that the ORF is operating as
intended, and thus to ensuring the intended and expected benefits of
the ORF with respect to protecting customers and mitigating systemic
risk are actually realized. Without proper review and testing,
determining whether the intended benefits of the ORF are being achieved
would not be possible. Although eliminating the independence
requirement could alleviate some potential staffing burdens on covered
entities, the Commission believes that independence in reviews and
testing is critical to preserving their benefits by helping to ensure
that the results are reliable and unbiased. The Commission further
believes that by allowing covered entities to adjust the frequency,
nature, and scope of their risk-based testing of the ORF in a manner
that is appropriate and proportionate to the circumstances, following
generally accepted standards and best practices, the proposed rule
would ensure that costs of the rule would be as well tailored to the
covered entity as possible to realize benefits at the least cost.
With respect to the BCDR plan requirement for swap entities in
particular, the Commission believes the proposed rule could reduce
review and testing costs. First, it would eliminate costs associated
with securing an independent auditor to audit the plan every three
years.\378\ Although there may be some benefits to having an
independent audit of a BCDR plan, including having an external party
with fresh eyes identify issues and potential improvements that might
not be readily apparent to internal staff, the Commission preliminarily
believes, based on its experience, that the internal reviews and
testing of the BCDR plan are sufficient to achieve iterative
improvements to the BCDR plan, making the costs associated with the
independent audit unnecessary. Second, the proposed rule would
eliminate the separate requirement that a member of senior management
for a swap entity review the BCDR plan annually or upon any material
change to the business and to document any deficiencies found or
corrective action taken.\379\ While the proposed rule would retain the
annual review requirement for the BCDR plan, not requiring the review
to be undertaken by a member of senior management may result in at
least some burden reduction for senior management.
---------------------------------------------------------------------------
\378\ See 17 CFR 23.603(g).
\379\ See 17 CFR 23.603(f).
---------------------------------------------------------------------------
l. Notification Provisions--Proposed Paragraphs (i) and (j)
The proposed rule would require covered entities to provide certain
notifications to either the Commission or affected customers or
counterparties.\380\ Notifications to the Commission, made
electronically via email, would relate either to the covered entity's
determination to activate the BCDR plan, or an ``incident,'' as defined
in the proposed rule, that adversely impacts, or is reasonably likely
to adversely impact information and technology security, the covered
entity's ability to operate, or the assets or positions of a customer
or counterparty.\381\ In both cases, the notifications to the
Commission would be intended to function as early warnings and thus
would not need to be complete or detailed. Understanding that the
information available to covered entities would be preliminary and
incomplete at the time of the notification, the Commission would not
expect covered entities to expend considerable resources to assemble
notifications that are perfectly accurate and complete. Rather, the
proposed rule would only require that the information provided to the
Commission would be whatever the covered entity has available at the
time that could assist the Commission in its oversight or response,
with the understanding that resources should predominantly be directed
at mitigating and recovering from the incident, emergency, or
significant disruption.\382\ Prioritizing an early warning over
complete information should not only reduce the costs for covered
entities in delivering the notification, but also allow the Commission
the best opportunity to take quick responsive action, if appropriate.
---------------------------------------------------------------------------
\380\ See paragraphs (i) and (j) of proposed Commission
regulations 1.13 and 23.603.
\381\ See paragraph (i) of proposed Commission regulations 1.13
and 23.603.
\382\ See paragraphs (i)(1)(ii) and (i)(2)(ii) of proposed
Commission regulations 1.13 and 23.603.
---------------------------------------------------------------------------
Accordingly, while the Commission recognizes that there would be at
least some information gathering and administrative costs associated
with providing the notice, the Commission does not intend or expect the
resource burden for providing the notification to be significant.\383\
This limited early-warning function for the notice requirement is
further supported by the relatively brief 24-hour time period for
providing the notices.\384\
---------------------------------------------------------------------------
\383\ The Commission estimates that for each ``incident''
requiring notification, covered entities will incur a cost of $1,000
(10 hours x $100/hour) to gather the information required and to
provide notification to the Commission, or an estimated aggregate
dollar cost of $160,000 (160 covered entities x $1,000).
\384\ See paragraphs (i)(1)(iii) and (i)(2)(iii) of proposed
Commission regulations 1.13 and 23.603.
---------------------------------------------------------------------------
With respect to the BCDR plan in particular, the Commission does
not believe covered entities would expend significant resources to
notify the Commission, since the notification trigger (activation of
the BCDR plan) is relatively bright-line. The Commission recognizes
that with respect to the incident notification, however, covered
entities may need to engage in some deliberation to determine whether
an incident has or is reasonably likely to have an adverse impact,
which would consume some staff resources. Preliminarily, the Commission
estimates that covered entities activating their BCDR plan would incur
a cost of $1000 (10 hours x $100/hour) to notify the Commission, or an
estimated aggregate dollar cost of $160,000 (160 covered entities x
$1,000). The Commission believes, however, that these costs may go down
over time, as covered entities
[[Page 4748]]
gain familiarity in applying the notification provision. The Commission
also preliminarily believes that an adverse impact standard would be
potentially easier to apply than one that included a materiality
limiter, which could introduce further need for interpretation and
internal deliberation for covered entities to determine whether the
impact is ``material'' or ``significant.'' Additionally, scoping
notifications to incidents with a likely adverse impact and to BCDR
activation would help focus the Commission's oversight activities and
responsive efforts on cases where it could act to support the
derivatives markets and customers and counterparties, potentially
reducing the potential for ripple effects.
In addition to notifications to the Commission, the proposed rule
would require covered entities to notify affected customers or
counterparties as soon as possible of any incident that is reasonably
likely to have adversely affected the confidentiality or integrity of
their covered information, assets, or positions.\385\ Because the rule
does not contain a specific timing limit for providing this
notification, the Commission does not expect that this notification
requirement would cause covered entities to need to divert any
resources while managing the incident to draft the notification.
Rather, the Commission expects that most of the costs associated with
this notification requirement would be in spending the necessary staff
resources to gather and report facts as accurately as possible to aid
affected customers and counterparties in understanding and assessing
the potential impact of the incident on their information, assets, or
positions and to take any necessary action.\386\ Covered entities may
also need to dedicate staff resources to interacting with customers or
counterparties after the notification is given to provide more
information or answer questions. The Commission estimates that for each
``incident'' requiring notification, covered entities will incur a cost
of $5,000 (50 hours x $100/hour) to gather the required information
necessary to provide notice to customers or counterparties and to
prepare and deliver the required notification, or an estimated
aggregate dollar cost of $800,000 (160 covered entities x $5,000). The
Commission believes that this notification could produce substantial
benefits to customers and counterparties, especially where state or
other federal law does not otherwise require such notifications, as
they would give customers and counterparties the information they would
need to further protect their information and assets and allow them to
seek other avenues of redress.
---------------------------------------------------------------------------
\385\ See paragraph (j)(1) of proposed Commission regulations
1.13 and 23.603.
\386\ See paragraph (j)(2) of proposed Commission regulations
1.13 and 23.603.
---------------------------------------------------------------------------
m. Emergency Contacts and Recordkeeping--Proposed Paragraphs (k) and
(l)
The proposed rule would require covered entities to provide the
Commission with the name and contact information of employees in
connection with incidents triggering notification to the Commission and
in connection with the activation of the covered entity's BCDR
plan.\387\ The identified employees would need to be authorized to make
key decisions on behalf of the covered entity and have knowledge of the
covered entity's incident response plan or BCDR plan, as
appropriate.\388\ Covered entities would also need to update their
contacts with the Commission, as necessary.\389\ The Commission
believes that ensuring it has knowledgeable contacts with whom to
direct communications during a crisis would aid the Commission's
ability to take any necessary responsive action, and that the costs
associated with identifying and updating the appropriate contacts would
be ministerial in nature.\390\ With respect to BCDR plan emergency
contacts for swap entities, the proposed rule is identical in substance
to current Commission regulation 23.603, such that it should impose no
additional costs on swap entities.\391\
---------------------------------------------------------------------------
\387\ See paragraph (k)(1) of proposed Commission regulations
1.13 and 23.603.
\388\ See paragraph (k)(2) of proposed Commission regulations
1.13 and 23.603.
\389\ See paragraph (k)(3) of proposed Commission regulations
1.13 and 23.603.
\390\ The Commission estimates that covered entities will incur
a cost of $100 (1 hour x $100/hour) to provide the Commission with
emergency contact information, or an estimated aggregate dollar cost
of $16,000 (160 covered entities x $100).
\391\ See 17 CFR 23.603(3).
---------------------------------------------------------------------------
The proposed rule would also further require covered entities to
maintain all records required to be maintained pursuant to this section
in accordance with Commission regulation 1.31, and make them available
promptly upon request to representatives of the Commission and to
representatives of applicable prudential regulators.\392\ Covered
entities would incur costs associated with maintaining a recordkeeping
system that allows for easy records retrieval, which would require both
staff resources and likely reliance on electronic recordkeeping
systems. The Commission believes these costs are likely mitigated for
most covered entities, as they would be able to rely on existing
recordkeeping systems designed to maintain other records in accordance
with Commission regulation 1.31, and proper recordkeeping would help
covered entities demonstrate compliance with the ORF rule, and ensure
their ORFs are operating as expected as they conduct required reviews
and testing.
---------------------------------------------------------------------------
\392\ See paragraph (l) of proposed Commission regulations 1.13
and 23.603.
---------------------------------------------------------------------------
2. Section 15(a) Factors
a. Protection of Market Participants and the Public
The Commission believes the proposed rule would support protection
of market participants and the public. The Commission preliminarily
believes the proposed rule will help protect market participants and
the public by increasing the operational resiliency of covered entities
to disruptions caused by natural disasters, cyber-attacks, and failures
at third-party service providers. As covered entities are responsible
for safeguarding customers' accounts, executing trades, maintaining
records, and reporting to relevant agencies, their operational
resiliency will mitigate the negative impact on customers, clients, and
counterparties in case of an incident. The proposed rule may also help
reduce the likelihood of an incident due to proposed proactive measures
such as penetration and vulnerability testing and cyber security
training. For market participants and the public more generally, the
benefits include enhanced market protection against the spread of
contagion risk to the financial system from operational risks.
b. Efficiency, Competitiveness, and Financial Integrity of Markets
The Commission believes the proposed rule would enhance the
financial integrity of CFTC-regulated derivatives markets. SDs, MSPs,
and FCMs are essential intermediaries in the financial markets
regulated by the Commission. Due to the interconnectedness of markets,
disruptions to the business operations of these intermediaries pose
risks to other markets. The Commission believes that increasing and
helping to ensure the operational resiliency of these covered entities
would help improve the financial integrity of the derivatives markets.
The proposed rule's requirement to report to the Commission incidents
and BCDR plan
[[Page 4749]]
activation would assist the Commission effectuate a timely response to
business disruptions, which will help mitigate the impact on other
market participants and promote financial stability and confidence.
Additionally, to the degree that the proposed rule aligns with other
existing applicable requirements, including NFA rules and interpretive
notices, and incorporates generally accepted standards and best
practices currently broadly relied on by covered entities, the proposed
rule would support regulatory convergence and the efficiencies that may
generate.
c. Price Discovery
The Commission does not anticipate the proposed rule directly
impacting the price discovery process. Nevertheless, if a trading
disruption would be prevented or shortened by this proposed rulemaking,
then price discovery would be improved.
d. Sound Risk Management Practices
The Commission believes the proposed rule would promote the
development of sound risk management practices among covered entities.
Programs, plans, policies, and procedures are required for operational
risks, which now explicitly include cybersecurity and third-party risks
that adhere to current best practices. These processes seek to help
covered entities identify, protect, detect, respond, and recover from
such risks. As such, the operational risk management processes of
covered entities may be improved.
e. Other Public Interest Considerations
The proposed rule relies on and incorporates aspects of existing
standards and practices developed by other regulators and standard-
setting bodies, including NFA rules and interpretive notices;
prudential rules and guidance; and NIST, ISO, FFIEC and other sources
of cyber and operational resilience standards. Accordingly, the
proposed rule should support the development of further convergence in
the area of operational resilience and allow covered entities to
develop ORFs that are adaptive and responsive to rapidly changing
circumstances and technology, which the Commission believes could lead
to better protection of markets against the spread of contagion risks
to the financial system from operational risks, in general.
3. Request for Comments
As noted, the Commission invites public comment on all aspects of
its cost-benefit consideration, including, but not limited to the
baseline and the identification and measurement of costs and benefits
relative to it; the identification, measurement, and assessment of any
costs and benefits not discussed herein; whether the Commission has
misidentified any costs or benefits; what, if any, alternatives would
be more reasonable in terms of their costs and benefits; and the
Section 15(a) factors described above. The Commission asks that
commenters explain and support the reasons for positions asserted in
their comment letters and, further, include in them any data or other
information that they may have to assist the Commission's ability to
better quantify the costs and benefits of the Proposal.
1. Has the Commission misidentified any costs or benefits? If so,
please explain.
2. Please explain whether compliance costs would increase or
decrease as a result the proposed rule. Please provide all quantitative
and qualitative costs, including, but not limited to personnel costs
and technological costs.
3. The Commission seeks additional information on the costs and
benefits of the proposed rule's requirement for covered entities to
have a governance regime for their ORF, including risk appetite and
tolerance limits, consolidated programs or plans, and internal
escalation policies. Specifically, to what extent do covered entities
already have or plan to have relevant programs or plans, policies, and
procedures compliant with those prescribed in the proposed rule? To
what practical extent do NFA's requirements, prudential regulation and/
or best practices currently duplicate or differ from the ORF governance
regime, including risk appetite limits, consolidated programs or plans,
and internal escalation policies, being proposed? Will covered entities
experience additional or lowered costs to comply with the proposed
rule, and if so, to what degree?
4. The Commission seeks additional information regarding the costs
and benefits of establishing an information and technology security
program. Specifically, to what extent are covered entities already
conducting comprehensive risk assessments that follow standards
described in the proposed rule? Are these assessments being conducted
on at least an annual basis? Do existing effective controls likewise
meet the standards in the proposed rule? Will covered entities
experience additional or lowered costs relative to current practice to
establish, document, and maintain an incident response plan as called
for in the proposed rule, and if so, to what degree?
5. The Commission seeks additional information regarding the costs
and benefits of establishing a business continuity and disaster
recovery plan. In particular, is the Commission's proposed rule
different from current practice, and, if so, how? Would covered
entities experience additional or lowered costs to comply with the
proposed rule, and, if so, to what degree?
6. The Commission seeks additional information regarding the costs
and benefits of the proposed rule's required notice of ORF events to
the Commission. Will covered entities experience additional or lowered
costs to comply with the proposed rule, and, if so, to what degree?
Will compliance with the 24-hour cap for as-soon-as-possible
notification entail additional costs relative to some shorter or longer
cap and, if so, why and to what degree?
7. The Commission seeks additional information on the costs and
benefits of the proposed rule's requirement that covered entities
provide notification to customers and counterparties following an
incident. In particular, is the Commission's proposed rule different
from current practice, and, if so, how? Would covered entities
experience additional or lowered costs to comply with the proposed
rule, and, if so, to what degree?
8. The Commission seeks additional information regarding the costs
and benefits of ORF review and testing. In particular, to what extent,
if any, does the proposed rule differ from existing procedures? How do
covered entities determine the amount of review and testing that is
appropriate? Do all covered entities currently undertake penetration
and vulnerability testing, and at what frequency? Would covered
entities experience additional or lowered costs to comply with the
proposed rule, and, if so, to what degree?
9. The Commission seeks additional information regarding the costs
and benefits of the cross-border application of the proposed rule.
Would added specificity in the proposed regulations improve the cost-
benefit calculus for those covered entities impacted by their cost-
benefit application? If so, in what areas would more specificity be
helpful and how would costs and benefits be impacted?
D. Antitrust Laws
Section 15(b) of the CEA requires the Commission to ``take into
consideration the public interest to be protected by the antitrust laws
and endeavor to take the least anticompetitive means of achieving the
purposes of the CEA, in
[[Page 4750]]
issuing any order or adopting any Commission rule or regulation
(including any exemption under CEA section 4(c) or 4c(b)), or in
requiring or approving any bylaw, rule, or regulation of a contract
market or registered futures association established pursuant to
section 17 of this Act.'' \393\
---------------------------------------------------------------------------
\393\ 7 U.S.C. 19(b).
---------------------------------------------------------------------------
The Commission preliminarily believes that the public interest to
be protected by the antitrust laws is generally to protect competition.
The Commission invites comment on whether the proposed rule implicates
any other specific public interest to be protected by the antitrust
laws.
The Commission has also assessed the proposal for potential
anticompetitive effects. To the extent that there are substantial fixed
costs associated with improved operational risk management, there may
be competitive implications, though likely anticompetitive impacts have
not been identified. Smaller firms may bear a disproportionate cost
relative to larger firms in total asset size due to this proposed rule.
Nevertheless, smaller firms may be able to realize economies of scope
and scale through outsourcing to third-parties, albeit at the cost of
raising their third-party risk exposure. In addition, the proposed rule
allows smaller firms to choose programs or plans, policies, and
procedures that are appropriate to their businesses, further mitigating
competitive concerns.
The Commission invites comment on its CEA section 15(b) assessment,
including what other means, if any, would be more procompetitive than
what the Commission now proposes and why.
List of Subjects
17 CFR Part 1
Brokers, Commodity futures, Consumer protection, Reporting and
recordkeeping requirements.
17 CFR Part 23
Banks, Banking, Commodity futures, Reporting and recordkeeping
requirements, Swaps.
For the reasons stated in the preamble, the Commodity Futures
Trading Commission proposes to amend 17 CFR parts 1 and 23 as set forth
below:
PART 1--GENERAL REGULATIONS UNDER THE COMMODITY EXCHANGE ACT
0
1. The authority citation for part 1 continues to read as follows:
Authority: 7 U.S.C. 1a, 2, 5, 6, 6a, 6b, 6c, 6d, 6e, 6f, 6g, 6h,
6i, 6k, 6l, 6m, 6n, 6o, 6p, 6r, 6s, 7, 7a-1, 7a-2, 7b, 7b-3, 8, 9,
10a, 12, 12a, 12c, 13a, 13a-1, 16, 16a, 19, 21, 23, and 24 (2012).
0
2. Add Sec. 1.13 to read as follows:
Sec. 1.13 Operational Resilience Framework for Futures Commission
Merchants
(a) Definitions. For purposes of this section:
Affiliate means, with respect to any person, a person controlling,
controlled by, or under common control with, such person.
Business continuity and disaster recovery plan means a written plan
outlining the procedures to be followed in the event of an emergency or
other significant disruption to the continuity of normal business
operations and that meets the requirements of paragraph (f) of this
section.
Consolidated program or plan means any information and technology
security program, third-party relationship program, or business
continuity and disaster recovery plan in which the futures commission
merchant participates with one or more affiliates and that is managed
and approved at the enterprise level.
Covered information means any sensitive or confidential data or
information maintained by a futures commission merchant in connection
with its business activities as a futures commission merchant.
Covered technology means any application, device, information
technology asset, network service, system, and other information-
handling component, including the operating environment, that is used
by a futures commission merchant to conduct its business activities, or
to meet its regulatory obligations, as a futures commission merchant.
Critical third-party service provider means a third-party service
provider, the disruption of whose performance would be reasonably
likely to:
(i) Significantly disrupt a futures commission merchant's business
operations as a futures commission merchant; or
(ii) Significantly and adversely impact the futures commission
merchant's customers.
Information and technology security means the preservation of:
(i) The confidentiality, integrity, and availability of covered
information; and
(ii) The reliability, security, capacity, and resilience of covered
technology.
Incident means any event, occurrence, or circumstance that could
jeopardize information and technology security, including if it occurs
at a third-party service provider.
Information and technology security program means a written program
reasonably designed to identify, monitor, manage, and assess risks
relating to information and technology security and that meets the
requirements of paragraph (d) of this section.
Key controls mean controls that an appropriate risk analysis
determines are either critically important for effective information
and technology security or intended to address risks that evolve or
change more frequently and therefore require more frequent review to
ensure their continuing effectiveness in addressing such risks.
Oversight body means any board, body, or committee of a board or
body of the futures commission merchant specifically granted the
authority and responsibility for making strategic decisions, setting
objectives and overall direction, implementing policies and procedures,
or overseeing the implementation of operations for the futures
commission merchant.
Risk appetite means the aggregate amount of risk a futures
commission merchant is willing to assume to achieve its strategic
objectives.
Risk tolerance limit means the amount of risk, beyond its risk
appetite, that a futures commission merchant is prepared to tolerate
through mitigating actions.
Senior officer means the chief executive officer or other
equivalent officer of the futures commission merchant.
Third-party relationship program means a written program reasonably
designed to identify, monitor, manage, and assess risks relating to
third-party relationships and that meets the requirements of paragraph
(e) of this section.
(b) Generally. (1) Purpose and scope. Each futures commission
merchant shall establish, document, implement, and maintain an
Operational Resilience Framework reasonably designed to identify,
monitor, manage, and assess risks relating to:
(i) information and technology security;
(ii) third-party relationships; and
(iii) emergencies or other significant disruptions to the
continuity of normal business operations as a futures commission
merchant.
(2) Components. The Operational Resilience Framework shall include
an information and technology security program, a third-party
relationship program, and a business continuity and disaster recovery
plan. Each component program or plan shall be supported by written
policies and procedures.
(3) Standard. The Operational Resilience Framework shall be
[[Page 4751]]
appropriate and proportionate to the nature, size, scope, complexity,
and risk profile of its business activities as a futures commission
merchant, following generally accepted standards and best practices.
(c) Governance. (1) Approval of components. Each component program
or plan required by paragraph (b)(2) of this section shall be approved
in writing, on at least an annual basis, by either the senior officer,
an oversight body, or a senior-level official of the futures commission
merchant.
(2) Risk appetite and risk tolerance limits. (i) Each futures
commission merchant shall establish and implement appropriate risk
appetite and risk tolerance limits with respect to the risk areas
identified in paragraph (b)(1) of this section.
(ii) The risk appetite and risk tolerance limits established
pursuant to paragraph (c)(2)(i) of this section shall be reviewed and
approved in writing on at least an annual basis by either the senior
officer, an oversight body, or a senior-level official of the futures
commission merchant.
(3) Internal escalations. The senior officer, an oversight body, or
a senior-level official of the futures commission merchant shall be
notified of:
(i) circumstances that exceed risk tolerance limits established and
approved pursuant to paragraph (c)(2)(i) of this section; and
(ii) incidents that require notification pursuant to paragraphs (i)
or (j) of this section.
(4) Futures commission merchants forming part of a larger
enterprise. (i) Generally. A futures commission merchant may satisfy
the requirements of paragraph (b)(2) of this section through its
participation in a consolidated program or plan, provided that each
consolidated program or plan meets the requirements of this section.
(ii) Attestation. A futures commission merchant that relies on a
consolidated program or plan pursuant to paragraph (c)(4)(i) of this
section may satisfy the requirements in paragraphs (c)(1) and
(c)(2)(ii) of this section provided that either the senior officer, an
oversight body, or a senior-level official of the futures commission
merchant attests in writing, on at least an annual basis, that the
consolidated program or plan meets the requirements of this section and
reflects a risk appetite and risk tolerance limits appropriate to the
futures commission merchant.
(d) Information and technology security program. (1) Risk
assessment.
(i) The information and technology security program shall require
the futures commission merchant to conduct and document the results of
a comprehensive risk assessment reasonably designed to identify,
assess, and prioritize risks to information and technology security.
(ii) Such risk assessment shall be conducted at a frequency
consistent with the standard set forth in paragraph (b)(3) of this
section, but at least annually, and be conducted by personnel not
responsible for the development or implementation of covered technology
or related controls.
(iii) The results of the risk assessment shall be provided to the
oversight body, senior officer, or other senior-level official who
approves the information and technology security program upon the risk
assessment's completion.
(2) Effective controls. The information and technology security
program shall require the futures commission merchant to establish,
document, implement, and maintain controls reasonably designed to
prevent, detect, and mitigate identified risks to information and
technology security. Each futures commission merchant shall consider,
at a minimum, the following types of controls and adopt those
consistent with the standard set forth in paragraph (b)(3) of this
section:
(i) Access controls on covered technology, including controls to
authenticate and permit access only by authorized individuals and
controls preventing misappropriation or misuse of covered information
by employees;
(ii) Access restrictions designed to permit only authorized
individuals to access physical locations containing covered
information, including, but not limited to, buildings, computer
facilities, and records storage facilities;
(iii) Encryption of electronic covered information, including while
in transit or in storage on networks or systems, to which unauthorized
individuals may have access;
(iv) Dual control procedures, segregation of duties, and background
checks for employees or third-party service providers with
responsibilities for or access to covered information;
(v) Change management practices, including defined roles and
responsibilities, logging, and monitoring practices;
(vi) Systems development and configuration management practices,
including practices for initializing, changing, testing, and monitoring
configurations;
(vii) Flaw remediation, including vulnerability patching practices;
(viii) Measures to protect against destruction, loss, or damage of
covered information due to potential environmental hazards, such as
fire and water damage or technological failures;
(ix) Monitoring systems and procedures to detect actual and
attempted attacks on or intrusions into covered technology;
(x) Response programs that specify actions to be taken when the
futures commission merchant suspects or detects that unauthorized
individuals have gained access to covered technology, including
appropriate reports to regulatory and law enforcement agencies; and
(xi) Measures to promptly recover and secure any compromised
covered information.
(3) Incident response plan. The information and technology security
program shall include a written incident response plan that is
reasonably designed to detect, assess, contain, mitigate the impact of,
and recover from an incident. This incident response plan shall
include, at a minimum:
(i) The roles and responsibilities of the futures commission
merchant's management, staff, and third-party service providers in
responding to incidents;
(ii) Escalation protocols, including a requirement to timely inform
the oversight body, senior officer, or other senior-level official that
has primary responsibility for overseeing the information and
technology security program; the chief compliance officer of the
futures commission merchant; and any other relevant personnel of
incidents that may significantly impact the futures commission
merchant's regulatory obligations or require notification to the
Commission;
(iii) The points of contact for external coordination of incident
responses as determined necessary by the futures commission merchant
based on the severity of incidents;
(iv) The required reporting of incidents, whether by internal
policy, contract, or law, including as required in this section;
(v) Procedures for documenting incidents and managements' response;
and
(vi) The remediation of weaknesses in information and technology
security, controls, and training, if any.
(e) Third-party relationship program. (1) Third-party relationship
lifecycle stages. The third-party relationship program shall describe
how the futures commission merchant addresses the risks attendant to
each stage of the third-party relationship lifecycle, including:
(i) Pre-selection risk assessment;
(ii) Due diligence of prospective third-party service providers;
(iii) Contractual negotiations;
[[Page 4752]]
(iv) Ongoing monitoring; and
(v) Termination, including preparations for planned and unplanned
terminations.
(2) Heightened duties for critical third-party service providers.
The third-party relationship program shall establish heightened due
diligence practices for potential critical third-party service
providers and heightened monitoring for critical third-party service
providers.
(3) Third-party service provider inventory. As part of its third-
party relationship program, each futures commission merchant shall
create, maintain, and regularly update an inventory of third-party
service providers the futures commission merchant has engaged to
support its activities as a futures commission merchant, identifying
whether each third-party service provider in the inventory is a
critical third-party service provider.
(3) Retention of responsibility. Notwithstanding a futures
commission merchant's determination to rely on a third-party service
provider, each futures commission merchant remains responsible for
meeting its obligations under the Act and Commission regulations.
(4) Guidance on third-party relationship program. For guidance
outlining potential risks, considerations, and strategies for
developing a third-party relationship program consistent with paragraph
(e), see Appendix A to this part.
(f) Business continuity and disaster recovery plan. (1) Purpose.
The business continuity and disaster recovery plan shall be reasonably
designed to enable the futures commission merchant to:
(i) Continue or resume normal business operations with minimal
disruption to customers and the markets; and
(ii) Recover and make use of covered information, as well as any
other data, information, or documentation required to be maintained by
law and regulation.
(2) Minimum contents. The business continuity and disaster recovery
plan shall, at a minimum:
(i) Identify covered information, as well as any other data or
information required to be maintained by law and regulation, and
establish and implement procedures to backup or copy all such data and
information with sufficient frequency to meet the requirements of this
section, and to store such data and information off-site in either
hard-copy or electronic format;
(ii) Identify any resources, including covered technology,
facilities, infrastructure, personnel, and competencies, essential to
the operations of the futures commission merchant or to fulfill the
regulatory obligations of the futures commission merchant, and
establish and maintain procedures and arrangements to provide for their
backup in a manner that is sufficient to meet the requirements of this
section. Such arrangements must provide for backups that are located in
one or more areas that are geographically separate from the futures
commission merchant's primary systems, facilities, infrastructure, and
personnel, and may include the use of resources provided by third-party
service providers;
(iii) Identify potential disruptions to critical third-party
service providers and establish a plan to minimize the impact of such
disruptions;
(iv) Identify supervisory personnel responsible for implementing
each aspect of the business continuity and disaster recovery plan,
including the emergency contacts required to be provided pursuant to
paragraph (k) of this section; and
(v) Establish a plan for communicating with the following persons
in the event of an emergency or other significant disruption, to the
extent applicable: employees; customers; swap data repositories;
execution facilities; trading facilities; clearing facilities;
regulatory authorities; data, communications and infrastructure
providers and other vendors; disaster recovery specialists; and other
persons essential to the recovery of documentation and data, the
resumption of operations, and compliance with the Act and Commission
regulations.
(3) Accessibility. Each futures commission merchant shall maintain
copies of its business continuity and disaster recovery plan at one or
more accessible off-site locations.
(g) Training and distribution. (1) Training. Each futures
commission merchant shall establish, implement, and maintain training
with respect to all aspects of the Operational Resilience Framework,
including, but not limited to:
(i) Cybersecurity awareness training for all personnel; and
(ii) Role-specific training for personnel involved in establishing,
documenting, implementing, and maintaining the Operational Resilience
Framework.
(2) Frequency. Each futures commission merchant shall provide and
update the training required in paragraph (g)(1) as necessary, but no
less frequently than annually.
(3) Distribution. Each futures commission merchant shall distribute
copies of each component program or plan required by paragraph (b)(2)
of this section to relevant personnel and promptly provide any
significant revisions thereto.
(h) Reviews and Testing. Each futures commission merchant shall
establish, implement, and maintain a plan reasonably designed to assess
its adherence to, and the effectiveness of, its Operational Resilience
Framework through regular reviews and risk-based testing.
(1) Reviews. Reviews of the Operational Resilience Framework shall
be conducted at least annually and in connection with any material
change to the activities or operations of the futures commission
merchant that is reasonably likely to affect the risks identified in
paragraph (b)(1) of this section. Reviews shall include an analysis of
adherence to, and the effectiveness of, the Operational Resilience
Framework and any recommendations for modifications or improvements
that address root causes of any issues identified by the review.
(2) Testing. The frequency, nature, and scope of risk-based testing
of the Operational Resilience Framework shall be determined by the
futures commission merchant, consistent with the standard in paragraph
(b)(3) of this section.
(i) Testing of the information and technology security program
shall include, at a minimum:
(A) Testing of key controls and the incident response plan at least
annually;
(B) Vulnerability assessments, including daily or continuous
automated vulnerability scans; and
(C) Penetration testing at least annually.
(ii) Testing of the business continuity and disaster recovery plan
shall include, at a minimum, a walk-through or tabletop exercise
designed to test the effectiveness of backup facilities and
capabilities at least annually.
(3) Independence. The reviews and testing shall be conducted by
qualified personnel who are independent of the aspect of the
Operational Resilience Framework being reviewed or tested.
(4) Documentation. Each futures commission merchant shall document
all reviews and testing of the Operational Resilience Framework. The
documentation shall, at a minimum, include:
(i) The date the review or testing was conducted;
(ii) The nature and scope of the review or testing, including
methodologies employed;
[[Page 4753]]
(iii) The results of the review or testing, including any
assessment of effectiveness;
(iv) Any identified deficiencies and recommendations for
remediation; and
(v) Any corrective action(s) taken or initiated, including the
date(s) such action(s) were taken.
(5) Internal reporting. Each futures commission merchant shall
report on the results of its reviews and testing to the futures
commission merchant's chief compliance officer and any other relevant
senior-level official(s) and oversight body(ies).
(i) Notifications to the Commission. (1) Incidents. (i)
Notification trigger. Each futures commission merchant shall notify the
Commission of any incident that adversely impacts, or is reasonably
likely to adversely impact:
(A) information and technology security;
(B) the ability of the futures commission merchant to continue its
business activities as a futures commission merchant; or
(C) the assets or positions of a customer of the futures commission
merchant.
(ii) Contents. The notification shall provide any information
available to the futures commission merchant at the time of
notification that may assist the Commission in assessing and responding
to the incident, including the date the incident was detected, possible
cause(s) of the incident, its apparent or likely impacts, and any
actions the futures commission merchant has taken or is taking to
mitigate or recover from the incident, including measures to protect
customers.
(iii) Timing and method. Each futures commission merchant shall
provide the incident notification as soon as possible but in any event
no later than 24 hours after such incident has been detected. The
notification shall be provided via email to [email protected].
(2) Business continuity and disaster recovery plan activation. (i)
Notification trigger. Each futures commission merchant shall notify the
Commission of any determination to activate the business continuity and
disaster recovery plan.
(ii) Contents. The notification shall provide any information
available to the futures commission merchant at the time of
notification that may assist the Commission in assessing or responding
to the emergency or disruption, including the date of the emergency or
disruption, a description thereof, the possible cause(s), its apparent
or likely impacts, and any actions the futures commission merchant has
taken or is taking to mitigate or recover from the emergency or
disruption, including measures taken or being taken to protect
customers.
(iii) Timing and method. Each futures commission merchant shall
provide the business continuity and disaster recovery plan activation
notification within 24 hours of determining to activate the business
continuity and disaster recovery plan. The notification shall be
provided via email to [email protected].
(j) Notification of incidents to affected customers. (1)
Notification trigger. Each futures commission merchant shall notify a
customer as soon as possible of any incident that is reasonably likely
to have adversely affected the confidentiality or integrity of the
customer's covered information, assets, or positions.
(2) Contents. The notification to affected customers shall include
information necessary for the affected customer to understand and
assess the potential impact of the incident on its information, assets,
or positions, and to take any necessary action. Such notification shall
include, at a minimum:
(i) a description of the incident;
(ii) the particular way in which the customer, or its covered
information, may have been adversely impacted;
(iii) measures being taken by the futures commission merchant to
protect against further harm; and
(iv) contact information for the futures commission merchant where
the customer may learn more about the incident or ask questions.
(k) Emergency Contacts. (1) Each futures commission merchant shall
provide the Commission the name and contact information of:
(i) two employees whom the Commission may contact in connection
with incidents triggering notification to the Commission under
paragraph (i)(1) of this section; and
(ii) two employees whom the Commission may contact in connection
with the activation of the futures commission merchant's business
continuity and disaster recovery plan triggering notification to the
Commission under paragraph (i)(2) of this section.
(2) The identified employees shall be authorized to make key
decisions on behalf of the futures commission merchant and have
knowledge of the futures commission merchant's incident response plan
or business continuity and disaster recovery plan, as appropriate.
(3) The futures commission merchant shall update its emergency
contacts with the Commission as necessary.
(l) Recordkeeping. Each futures commission merchant shall maintain
all records required to be maintained pursuant to this section in
accordance with section 1.31 of this chapter and shall make them
available promptly upon request to representatives of the Commission
and to representatives of applicable prudential regulators, as defined
in section 1a(39) of the Act.
0
3. Add appendix A to part 1 to read as follows:
Appendix A to Part 1--Guidance on Third-Party Relationship Programs
The following guidance offers factors, actions, and strategies
for futures commission merchants to consider in preparing and
implementing third-party relationship programs reasonably designed
to identify, monitor, manage, and assess risks relating to third-
party relationships, as required by Commission regulation 1.13. The
guidance is also not intended to reduce or replace the obligation of
futures commission merchants to comply with the requirements in
Commission regulation 1.13, including the requirement to ensure that
each futures commission merchant's Operational Resilience Framework
is appropriate and proportionate to the nature, size, scope,
complexity, and risk profile of its business activities as a futures
commission merchant, following generally accepted standards and best
practices. The guidance is not exhaustive and is nonbinding.
The guidance is written to be broadly relevant to all futures
commission merchants, but it may not be universally applicable. The
degree to which the guidance would be applicable to a particular
futures commission merchant would depend on its unique facts and
circumstances and may vary from relationship to relationship. Each
futures commission merchant should assess the relevance of the
guidance as it applies to its particular risk profile and tailor its
third-party relationship program accordingly.
Comparable guidance for swap dealers and major swap participants
is included in Appendix A to subpart J of part 23 of the
Commission's regulations.
A. Pre-Selection Risk Assessment--Commission Regulation 1.13(e)(1)(i)
Before entering into a third-party relationship, futures
commission merchants should determine which services should be
performed by a third-party and plan for how to manage associated
risks. The Commission appreciates that reliance on third-party
service providers may be unavoidable, particularly given the rapid
pace of technological innovation, which may render it uneconomical
or even infeasible for financial institutions to meet all of their
technological needs in-house.
Nevertheless, given the risks associated with relying on third-
party service providers, and that each additional third-party
relationship a futures commission merchant
[[Page 4754]]
employs is likely to add further risk and complexity, a futures
commission merchant's third-party relationship program should
include a deliberative process for affirmatively determining whether
to source a particular service from a third-party service provider.
In determining whether a particular function should be performed by
a third-party service provider, futures commission merchants should
consider whether:
The service would support the futures commission
merchant's strategic goals and objectives.
The same goals and objectives could be addressed
through an alternative means that may not require reliance on a
third-party service provider.
The futures commission merchant has or could otherwise
secure the resources, financial and otherwise, to effectively
monitor the third-party service provider.
Relevant and reputable third-party service providers
are available.
The provision of the service would implicate
information and technology security concerns, including by requiring
the third-party service provider to obtain access to covered
information or provide covered technology.
A disruption of the service would have a negative
impact on customers or regulatory compliance.
The relationship could be structured to reduce
associated risks, such as by limiting the third-party service
provider's access to covered information or covered technology.
Lack of direct control over performance of the service
would present unacceptable risk, i.e., risk outside the futures
commission merchant's risk tolerance limits.
As the above considerations illustrate, futures commission
merchants should consider ways in which they might structure their
third-party relationships to reduce the associated risks. For
example, where giving a third-party service provider direct access
to its technology or data may be outside a futures commission
merchant's risk tolerance, structuring the relationship to provide
the third-party service provider access on a read-only basis or via
reports delivered by the futures commission merchants could render
the relationship more acceptable. Futures commission merchants
should therefore consider the availability of safer means of
performing the service as part of their assessment.
Changes in technology, businesses practices, regulation, market
structure, market participants (e.g., new entrants to the market),
or service delivery may change the risk profile of the third-party
relationship over time. Accordingly, futures commission merchants
should consider periodically reassessing their selection of services
to be performed by third-party service providers. Futures commission
merchants should stay abreast of these changes by monitoring the
external environment and communicating with current and prospective
service providers and other participants in industry.
B. Due Diligence in Selecting Third-Party Service Providers--Commission
Regulation 1.13(e)(1)(ii)
After a futures commission merchant has determined that a
service is suitable for a third-party to perform, it should conduct
due diligence on prospective third-party service providers. Due
diligence provides futures commission merchants with the information
they need to assess and conclude, with a reasonable level of
assurance, that the prospective third-party service provider is
capable of effectively providing the service as expected, adhering
to the futures commission merchant's policies, maintaining the
futures commission merchant's compliance with Commission
regulations, and protecting covered information. Appropriate due
diligence should also enable futures commission merchants to
evaluate whether they would be able to effectively monitor and
manage the risks associated with a particular third-party
relationship.
Due diligence may be conducted before or contemporaneously with
contractual negotiations with prospective third-party service
providers but should be concluded prior to executing any agreements.
Futures commission merchants should conduct due diligence even in
situations where, for a particular service, there may only be one or
a small number of providers with a dominant market share whose
services are used by all or most of the futures commission
merchants' industry peers, and futures commission merchants should
not rely solely on those providers' reputations or prior experience
with them. The depth and rigor of the due diligence should be
proportionate to the nature of the third-party relationship, with
the required heightened due diligence for potential critical third-
party service providers pursuant to Commission regulation
1.13(e)(2). Specifically, when conducting due diligence for a
potential critical third-party servicer provider, futures commission
merchants should expand the type and sources of information they
rely on, the rigor and scrutiny they apply in reviewing the
information to identify potential risks, and the level of confidence
in their assessment of the third-party service provider's ability to
perform.
When establishing their due diligence protocols, futures
commission merchants should consider the full range of risks that
reliance on the third-party service providers could introduce in
light of the nature of the service they would be performing.
Relevant considerations with respect to the potential third-party
service provider include its:
Financial condition, business experience and
reputation, and business prospects, particularly the third-party
service provider's experience providing services to financial
institutions.
Background, experience, and qualifications with respect
to key personnel.
Information and technology security practices,
including incident reporting and incident management programs, and
whether there are clearly documented processes for identifying and
escalating incidents.
Risk management practices, including governance,
controls, testing, and issue management practices, as well as the
results of any independent risk assessments.
Regulatory environment, including the legal
jurisdiction in which it is based and applicable regulatory or
licensing requirements.
History of disruptions to operations, including whether
the third-party service provider has suffered incidents that would
meet the standard for reporting to the Commission in Commission
regulation 1.13(i).
Violations of legal, compliance, or contractual
obligations, including civil or criminal proceedings or
administrative enforcement actions, including from self-regulatory
organizations.
Understanding of Commission regulatory requirements
applicable to the futures commission merchant.
Use of and reliance on subcontractors, including the
volume and types of subcontracted activities, and the third-party
service provider's process for identifying, assessing, managing, and
monitoring associated risks.
Business continuity and contingency plans.
Financial protections, such as insurance coverage
against losses or liabilities from intentional or negligent acts or
hazards involving physical destruction and data or documentation
losses.
Futures commission merchants should memorialize their assessment
of these factors and identify how the review was heightened for
critical third-party service providers. Futures commission merchants
should not rely solely on their prior knowledge of or experience
with a potential third-party. Potential sources of due diligence
information include:
Audit reports, including pooled audit plans and System
and Organizational Controls (SOC) reports.
Financial statements and projections and relevant
accompanying information (e.g., annual or quarterly reports,
management commentary, auditors' opinions, and investor relations
materials).
Incident response plans, including the results of
recent testing or assessments thereof.
Business continuity and disaster recovery plans, as
well as the result of recent testing or assessments thereof.
Public filings.
News reports, trade publications, and press releases.
Reports from market intelligence providers.
References from current or previous customers, or other
parties which have had business relationships with the third-party
service provider.
Informal industry discussions.
Information provided directly by the third-party
service provider, such as internal performance metrics.
Obtaining and reviewing audit reports, including SOC reports,
may be of particular value for conducting heightened due diligence
of critical third-party service providers. In certain circumstances,
futures commission merchants may not be able to gather all the
information necessary to reach an informed conclusion that a
prospective third-party service provider is an adequate provider.
Examples include instances where the third-party service provider is
a new entrant into the market and little information exists; where
information provided by the
[[Page 4755]]
third-party service provider is insufficient or appears unreliable;
or where the third-party service provider is reluctant to provide
internal information. In such cases, the futures commission merchant
should identify and document the limitations of its due diligence,
the attendant risks, and any available methods for mitigating them
(e.g., obtaining alternate information, implementing enhanced
monitoring or controls, negotiating protective contractual
provisions). Ultimately, such factors could weigh against the use of
the potential third-party service provider, particularly a potential
critical third-party service provider. Futures commission merchants
that proceed with the third-party service arrangements
notwithstanding the limited due diligence should do so with caution,
applying heightened scrutiny of the information they do receive, and
consider the implementation of their own mitigating controls to
compensate for the uncertainty.
C. Contractual Negotiations--Commission Regulation 1.13(e)(1)(iii)
After selecting a third-party service provider, futures
commission merchants should proceed to finalizing the agreement,
typically through entering into an enforceable written contract.
Written contracts are an important tool for clarifying the scope of
services to be delivered, establishing standards or performance
benchmarks, allocating risks and responsibilities, and facilitating
resolution of disputes. They can also reduce the risks of non-
performance and assist in monitoring the third-party service
provider. Because of their importance, the Commission recommends
that futures commission merchants enter written agreements with
third-party service providers before services are delivered,
particularly with critical third-party service providers.
In negotiating a written contract, futures commission merchants
should seek to negotiate contractual provisions that would support
their ability to mitigate, manage, and monitor the risks associated
with the relationship, as identified through their initial pre-
selection and due diligence activities. The contractual provisions
should be informed by the nature of the service provided and be
proportionate to the criticality of the services provided. In
particular, futures commission merchants should consider negotiating
for the contract to include the following provisions:
Timely notification to the futures commission merchant
of any incidents suffered by third-party service providers, or of
significant disruptions to the operations of the third-party service
provider.
Timely notification to the futures commission merchant
of any material changes to the services provided.
Required periodic, independent audits of the third-
party service provider, the results of which would be shared with
the futures commission merchant.
Restrictions on the third-party service provider's use
of the futures commission merchant's covered information, except as
necessary to deliver the service or meet legal obligations.
Security measures to protect the futures commission
merchant's covered information and covered technology to which the
third-party service provider has access.
Insurance, guarantees, indemnification, and limitations
on liability.
Dispute resolution procedures.
Performance measures or benchmarks.
Remediation of identified performance issues.
Dispute resolution procedures.
Compliance with regulatory requirements, including
reasonable assurances that the third-party service provider is
willing and able to coordinate with the futures commission merchant
for the purpose of ensuring the futures commission merchant complies
with its legal and regulatory obligations.
Use of subcontractors, including notification or
approval procedures for their use, the extension of contractual
rights of the futures commission merchant against the third-party
service provider to its subcontractors, and contractual obligations
for reporting on or oversight of subcontractors.
Termination provisions, including rights to terminate
following breaches of the third-party service provider's
obligations, notice requirements, obligations of the third-party
service provider to provide support for a successful transition, and
the return or destruction of records or covered information, as
further described in section E of this guidance.
Information sharing necessary to facilitate other
provisions of this proposed guidance (for example, reporting
requirements to support ongoing monitoring, as discussed in section
D of this guidance, or notice requirements for termination, as
discussed in section E of this guidance).
These provisions focus on key risk factors generally associated
with third-party service provider relationships. They are not
exhaustive of all contractual provisions futures commission
merchants should seek to include in their written contracts,
including ordinary commercial contract terms (e.g., choice of law
provisions) and terms that may relate only to specific services,
among other provisions. While third-parties may initially offer a
standard contract, a futures commission merchant may seek to request
modifications, additional contractual provisions, or addendums to
satisfy its needs. Futures commission merchants should work to
tailor the level of detail and comprehensiveness of the contractual
provisions based on the risk and complexity posed by the particular
third-party relationship, contracts with critical third-party
service providers likely being the most tailored.
In some circumstances, a futures commission merchant may be at a
bargaining power disadvantage, which prevents it from negotiating
optimal contractual provisions. For example, a prospective third-
party service provider may be the sole provider of a service or may
have such dominant market share that it can offer its services on a
``take-it-or-leave-it'' basis. In such situations, the futures
commission merchant should work to understand any resulting
limitations in the contract and attendant risks and consider whether
it can achieve outcomes comparable to those provided by contractual
protections through non-contractual means. Examples could include
the futures commission merchant implementing additional controls,
augmenting its monitoring of the third-party service provider using
public sources or market intelligence services, or purchasing
insurance. The futures commission merchant should make an
assessment, however, of whether these alternatives would provide an
adequate substitute for the unobtained contractual protections and
document its assessment and mitigation plan, considering its risk
appetite and risk tolerance limits. Where a third-party service
provider is unable or unwilling to agree to provisions necessary for
the futures commission merchant to meet its obligations under
Commission regulations, particularly a critical third-party service
provider, the futures commission merchant should consider finding an
alternative third-party service provider.
D. Ongoing Monitoring--Commission Regulation 1.13(e)(1)(iv)
After a third-party service provider has initiated performance,
futures commission merchants should engage in ongoing monitoring.
Ongoing monitoring is important to ensure the third-party service
provider is properly carrying out its outsourced function and
contractual obligations, as well as meeting quality or performance
expectations. Effective monitoring can aid futures commission
merchants in the early identification of performance deficits,
allowing for a quicker response that may then mitigate the impact.
Ongoing monitoring should occur throughout the duration of a
third-party relationship, commensurate with the level of risk and
complexity of the relationship and the activity performed by the
third-party. Examples of possible monitoring activities include:
Reviewing reports on performance and effectiveness of
controls, including independent audit reports and SOC reports.
Periodic on-site visits or meetings to discuss open
issues and plans for changes to the relationship.
Reviewing updated due diligence information.
Documenting service-level agreements with the third-
party service provider to establish performance targets.
Establishing measures for the third-party service
provider to identify, record, and remediate instances of failure to
meet contractual obligations or unsatisfactory performance and to
report such instances to the futures commission merchant on a timely
basis.
Direct testing of the third-party service provider's
control environment.
The frequency and depth of the futures commission merchant's
monitoring activities should reflect the nature of the third-party
relationship, including heightened monitoring for critical third-
party service providers, and may change over the duration of the
relationship. The futures commission merchant should dedicate
sufficient staffing
[[Page 4756]]
resources to its monitoring activities and be particularly alert to
any circumstances that could signal that a third-party service
provider may not be able to perform to an acceptable standard. A
futures commission merchant should be cognizant that certain events
may trigger the need for it to take further action, including
terminating its relationship with the third-party service provider.
Such events could include cyberattacks, natural disasters, financial
distress or insolvency, adverse or qualified audit opinions, or
litigation or enforcement actions.
In addition to the continuous monitoring described above,
futures commission merchants should periodically review and
reevaluate their relationships with third-party service providers
holistically. Such reviews should be more thorough than routine
monitoring and may involve additional personnel, such as in-house or
outside auditors, compliance and risk functions, information
technology staff, or by a central function or committee whose
visibility into other third-party relationships could provide
valuable context for the relationship at issue. Additionally, to the
extent a futures commission merchant uses enterprise risk management
techniques, it should seek to integrate the information gathered
from its ongoing monitoring with those practices. For example, to
the extent that a futures commission merchant maintains a
standardized approach across risk types to escalate concerns or
issues to senior management or governance bodies (e.g., through the
use of predefined criteria or escalation paths), the futures
commission merchant should consider using the same protocols for
escalating concerns identified through its ongoing monitoring of
third-party service providers. The ongoing monitoring approach
itself may be subject to enterprise risk management practices, such
as periodic self-assessment for effectiveness, independent testing,
and quality assurance.
To the extent that monitoring activities reveal a change in
their assessment of the risks associated with the third-party
relationship, futures commission merchants should adjust the
frequency and types of monitoring they conduct, including reports,
regular testing, and on-site visits. One example of information that
may change the level of monitoring is a notification that a third-
party service provider has suffered or may suffer from a severe
adverse event that could trigger a material change in the systems or
process used to carry out an outsourced function.
E. Terminating the Third-Party Relationship--Commission Regulation
1.13(e)(1)(v)
Futures commission merchants should ensure that their third-
party service provider relationship programs include advance
preparation for the termination of the third-party relationship to
ensure an orderly transition. Futures commission merchants should
prepare for both planned terminations (i.e., where one or both
parties elects to end the relationship pursuant to their contract)
and unplanned terminations (e.g., following a sudden withdrawal of
the third-party service). The plans should include both the
contractual provisions for terminating the service (termination
provisions), and the futures commission merchant's plan to
facilitate an orderly transition of the function to an alternative
provider or to bring it in-house (exit strategy). The goal of
termination planning is to support an efficient transition to
alternative arrangements for the provision of the service,
regardless of the circumstances of the termination.
Termination provisions include all terms needed by the futures
commission merchant to wind down a third-party service relationship
while ensuring that the futures commission merchant can continue to
serve its customers without interruption and to meet its regulatory
compliance obligations. Because information, data, staff training,
and knowledge may reside in the third-party service provider, there
is an increased risk of disruption during the termination phase.
When negotiating termination provisions, a futures commission
merchant should ensure that the terms negotiated support its exit
strategy. For example, a futures commission merchant should ensure
that termination rights are accompanied by notice periods that leave
the futures commission merchant enough time to find an alternative
provider (or to provide the service itself) to ensure an orderly
transition.
Similarly, the futures commission merchant should ensure that
all customer data or other covered information in the third-party
service provider's possession is promptly returned to the futures
commission merchant or destroyed, as appropriate. The futures
commission merchant should also verify that the third-party's access
to its systems and covered information ceases at termination.
Futures commission merchants should also consider negotiating more
stringent terms for third-party service providers that breach their
obligations under the agreement, other than for ``no-fault''
terminations. Such breaches may signal an inability of the third-
party service provider to provide the services contracted for and
thereby threaten the ability of the futures commission merchant to
serve its customers and meet its regulatory obligations. (See
section C of this guidance for examples of termination provisions.)
Futures commission merchants' exit strategies should include the
steps needed to end the service provision with the third-party
service provider and retain a new service provider or begin
providing the service in-house. Although elements of an exit
strategy may be reflected in termination provisions, not all
elements of the exit strategy may be suitable for the contract.
Examples include approvals, identification of alternative providers,
description of the roles of staff in the futures commission
merchant, and other internal matters. These elements may be
memorialized in a procedure or similar document, such as the third-
party relationship program. The exit strategy should contain the
internal steps to be taken to ensure notification to the third-party
service provider, identification of the proposed new provider, or,
if bringing the function in-house, the hiring and training of
personnel, development of procedures, and launch of new technology,
along with the time periods and responsible personnel for each.
Futures commission merchants should be aware that, in practice,
implementing an exit strategy may be complex and time-consuming and
that the exercise of termination arrangements may be difficult.
Futures commission merchants should also be aware that some third
parties possess expertise that is not readily available and plan
accordingly. Futures commission merchants should ensure that their
plans are flexible enough to account for a range of plausible
termination scenarios, including situations where the third-party
service provider rapidly becomes unviable. Futures commission
merchants may need to design backup or interim procedures sufficient
to meet regulatory requirements in such situations.
PART 23--SWAP DEALERS AND MAJOR SWAP PARTICIPANTS
0
4. The authority citation for part 23 continues to read as follows:
Authority: 7 U.S.C. 1a, 2, 6, 6a, 6b, 6b-1, 6c, 6p, 6r, 6s, 6t,
9, 9a, 12, 12a, 13b, 13c, 16a, 18, 19, 21.
Section 23.160 also issued under 7 U.S.C. 2(i); Sec. 721(b),
Pub. L. 111-203, 124 Stat. 1641 (2010).
0
5. Revise Sec. 23.603 to read as follows:
Sec. 23.603 Operational Resilience Framework for Swap Dealers and
Major Swap Participants.
(a) Definitions. For purposes of this section:
Affiliate means, with respect to any person, a person
controlling, controlled by, or under common control with, such
person.
Business continuity and disaster recovery plan means a written
plan outlining the procedures to be followed in the event of an
emergency or other significant disruption to the continuity of
normal business operations and that meets the requirements of
paragraph (f) of this section.
Consolidated program or plan means any information and
technology security program, third-party relationship program, or
business continuity and disaster recovery plan in which the swap
entity participates with one or more affiliates and that is managed
and approved at the enterprise level.
Covered information means any sensitive or confidential data or
information maintained by a swap entity in connection with its
business activities as a swap entity.
Covered technology means any application, device, information
technology asset, network service, system, and other information-
handling component, including the operating environment, that is
used by a swap entity to conduct its business activities, or to meet
its regulatory obligations, as a swap entity.
Critical third-party service provider means a third-party
service provider, the disruption of whose performance would be
reasonably likely to:
[[Page 4757]]
(1) Significantly disrupt a swap entity's business operations as
a swap entity; or
(2) Significantly and adversely impact the swap entity's
counterparties.
Information and technology security means the preservation of:
(1) The confidentiality, integrity, and availability of covered
information; and
(2) The reliability, security, capacity, and resilience of
covered technology.
Incident means any event, occurrence, or circumstance that could
jeopardize information and technology security, including if it
occurs at a third-party service provider.
Information and technology security program means a written
program reasonably designed to identify, monitor, manage, and assess
risks relating to information and technology security and that meets
the requirements of paragraph (d) of this section.
Key controls mean controls that an appropriate risk analysis
determines are either critically important for effective information
and technology security or intended to address risks that evolve or
change more frequently and therefore require more frequent review to
ensure their continuing effectiveness in addressing such risks.
Oversight body means any board, body, or committee of a board or
body of the swap entity specifically granted the authority and
responsibility for making strategic decisions, setting objectives
and overall direction, implementing policies and procedures, or
overseeing the implementation of operations for the swap entity.
Risk appetite means the aggregate amount of risk a swap entity
is willing to assume to achieve its strategic objectives.
Risk tolerance limit means the amount of risk, beyond its risk
appetite, that a swap entity is prepared to tolerate through
mitigating actions.
Senior officer means the chief executive officer or other
equivalent officer of the swap entity.
Swap entity means a person that is registered with the
Commission as a swap dealer or major swap participant pursuant to
the Act.
Third-party relationship program means a written program
reasonably designed to identify, monitor, manage, and assess risks
relating to third-party relationships and that meets the
requirements of paragraph (e) of this section.
(b) Generally. (1) Purpose and scope. Each swap entity shall
establish, document, implement, and maintain an Operational
Resilience Framework reasonably designed to identify, monitor,
manage, and assess risks relating to:
(i) information and technology security;
(ii) third-party relationships; and
(iii) emergencies or other significant disruptions to the
continuity of normal business operations as a swap entity.
(2) Components. The Operational Resilience Framework shall
include an information and technology security program, a third-
party relationship program, and a business continuity and disaster
recovery plan. Each component program or plan shall be supported by
written policies and procedures.
(3) Standard. The Operational Resilience Framework shall be
appropriate and proportionate to the nature, size, scope,
complexity, and risk profile of its business activities as a swap
entity, following generally accepted standards and best practices.
(c) Governance. (1) Approval of components. Each component
program or plan required by paragraph (b)(2) of this section shall
be approved in writing, on at least an annual basis, by either the
senior officer, an oversight body, or a senior-level official of the
swap entity.
(2) Risk appetite and risk tolerance limits. (i) Each swap
entity shall establish and implement appropriate risk appetite and
risk tolerance limits with respect to the risk areas identified in
paragraph (b)(1) of this section.
(ii) The risk appetite and risk tolerance limits established
pursuant to paragraph (c)(2)(i) of this section shall be reviewed
and approved in writing on at least an annual basis by either the
senior officer, an oversight body, or a senior-level official of the
swap entity.
(3) Internal escalations. The senior officer, an oversight body,
or a senior-level official of the swap entity shall be notified of:
(i) circumstances that exceed risk tolerance limits established
and approved pursuant to paragraph (c)(2)(i) of this section; and
(ii) incidents that require notification pursuant to paragraphs
(i) or (j) of this section.
(4) Swap entities forming part of a larger enterprise. (i)
Generally. A swap entity may satisfy the requirements of paragraph
(b)(2) of this section through its participation in a consolidated
program or plan, provided that each consolidated program or plan
meets the requirements of this section.
(ii) Attestation. A swap entity that relies on a consolidated
program or plan pursuant to paragraph (c)(4)(i) of this section may
satisfy the requirements in paragraphs (c)(1) and (c)(2)(ii) of this
section provided that either the senior officer, an oversight body,
or a senior-level official of the swap entity attests in writing, on
at least an annual basis, that the consolidated program or plan
meets the requirements of this section and reflects a risk appetite
and risk tolerance limits appropriate to the swap entity.
(d) Information and technology security program. (1) Risk
assessment.
(i) The information and technology security program shall
require the swap entity to conduct and document the results of a
comprehensive risk assessment reasonably designed to identify,
assess, and prioritize risks to information and technology security.
(ii) Such risk assessment shall be conducted at a frequency
consistent with the standard set forth in paragraph (b)(3) of this
section, but at least annually, and be conducted by personnel not
responsible for the development or implementation of covered
technology or related controls.
(iii) The results of the risk assessment shall be provided to
the oversight body, senior officer, or other senior-level official
who approves the information and technology security program upon
the risk assessment's completion.
(2) Effective controls. The information and technology security
program shall require the swap entity to establish, document,
implement, and maintain controls reasonably designed to prevent,
detect, and mitigate identified risks to information and technology
security. Each swap entity shall consider, at a minimum, the
following types of controls and adopt those consistent with the
standard set forth in paragraph (b)(3) of this section:
(i) Access controls on covered technology, including controls to
authenticate and permit access only by authorized individuals and
controls preventing misappropriation or misuse of covered
information by employees;
(ii) Access restrictions designed to permit only authorized
individuals to access physical locations containing covered
information, including, but not limited to, buildings, computer
facilities, and records storage facilities;
(iii) Encryption of electronic covered information, including
while in transit or in storage on networks or systems, to which
unauthorized individuals may have access;
(iv) Dual control procedures, segregation of duties, and
background checks for employees or third-party service providers
with responsibilities for or access to covered information;
(v) Change management practices, including defined roles and
responsibilities, logging, and monitoring practices;
(vi) Systems development and configuration management practices,
including practices for initializing, changing, testing, and
monitoring configurations;
(vii) Flaw remediation, including vulnerability patching
practices;
(viii) Measures to protect against destruction, loss, or damage
of covered information due to potential environmental hazards, such
as fire and water damage or technological failures;
(ix) Monitoring systems and procedures to detect actual and
attempted attacks on or intrusions into covered technology;
(x) Response programs that specify actions to be taken when the
swap entity suspects or detects that unauthorized individuals have
gained access to covered technology, including appropriate reports
to regulatory and law enforcement agencies; and
(xi) Measures to promptly recover and secure any compromised
covered information.
(3) Incident response plan. The information and technology
security program shall include a written incident response plan that
is reasonably designed to detect, assess, contain, mitigate the
impact of, and recover from an incident. This incident response plan
shall include, at a minimum:
(i) The roles and responsibilities of the swap entity's
management, staff, and third-party service providers in responding
to incidents;
(ii) Escalation protocols, including a requirement to timely
inform the oversight body, senior officer, or other senior-level
official that has primary responsibility for overseeing the
information and technology security program; the chief compliance
officer of the swap entity; and any other relevant personnel of
incidents that may
[[Page 4758]]
significantly impact the swap entity's regulatory obligations or
require notification to the Commission;
(iii) The points of contact for external coordination of
incident responses as determined necessary by the swap entity based
on the severity of incidents;
(iv) The required reporting of incidents, whether by internal
policy, contract, or law, including as required in this section;
(v) Procedures for documenting incidents and managements'
response; and
(vi) The remediation of weaknesses in information and technology
security, controls, and training, if any.
(e) Third-party relationship program. (1) Third-party
relationship lifecycle stages. The third-party relationship program
shall describe how the swap entity addresses the risks attendant to
each stage of the third-party relationship lifecycle, including:
(i) Pre-selection risk assessment;
(ii) Due diligence of prospective third-party service providers;
(iii) Contractual negotiations;
(iv) Ongoing monitoring; and
(v) Termination, including preparations for planned and
unplanned terminations.
(2) Heightened duties for critical third-party service
providers. The third-party relationship program shall establish
heightened due diligence practices for potential critical third-
party service providers and heightened monitoring for critical
third-party service providers.
(3) Third-party service provider inventory. As part of its
third-party relationship program, each swap entity shall create,
maintain, and regularly update an inventory of third-party service
providers the swap entity has engaged to support its activities as a
swap entity, identifying whether each third-party service provider
in the inventory is a critical third-party service provider.
(3) Retention of responsibility. Notwithstanding a swap entity's
determination to rely on a third-party service provider, each swap
entity remains responsible for meeting its obligations under the Act
and Commission regulations.
(4) Guidance on third-party relationship programs. For guidance
outlining potential risks, considerations, and strategies for
developing a third-party relationship program consistent with
paragraph (e), see Appendix A to Subpart J of this part.
(f) Business continuity and disaster recovery plan. (1) Purpose.
The business continuity and disaster recovery plan shall be
reasonably designed to enable the swap entity to:
(i) Continue or resume normal business operations with minimal
disruption to counterparties and the markets; and
(ii) Recover and make use of covered information, as well as any
other data, information, or documentation required to be maintained
by law and regulation.
(2) Minimum contents. The business continuity and disaster
recovery plan shall, at a minimum:
(i) Identify covered information, as well as any other data or
information required to be maintained by law and regulation, and
establish and implement procedures to backup or copy all such data
and information with sufficient frequency to meet the requirements
of this section and to store such data and information off-site in
either hard-copy or electronic format;
(ii) Identify any resources, including covered technology,
facilities, infrastructure, personnel, and competencies, essential
to the operations of the swap entity or to fulfill the regulatory
obligations of the swap entity, and establish and maintain
procedures and arrangements to provide for their backup in a manner
that is sufficient to meet the requirements of this section. Such
arrangements must provide for backups that are located in one or
more areas that are geographically separate from the swap entity's
primary systems, facilities, infrastructure, and personnel, and may
include the use of resources provided by third-party service
providers;
(iii) Identify potential disruptions to critical third-party
service providers and establish a plan to minimize the impact of
such disruptions;
(iv) Identify supervisory personnel responsible for implementing
each aspect of the business continuity and disaster recovery plan,
including the emergency contacts required to be provided pursuant to
paragraph (k) of this section; and
(v) Establish a plan for communicating with the following
persons in the event of an emergency or other significant
disruption, to the extent applicable: employees; counterparties;
swap data repositories; execution facilities; trading facilities;
clearing facilities; regulatory authorities; data, communications
and infrastructure providers and other vendors; disaster recovery
specialists; and other persons essential to the recovery of
documentation and data, the resumption of operations, and compliance
with the Act and Commission regulations.
(3) Accessibility. Each swap entity shall maintain copies of its
business continuity and disaster recovery plan at one or more
accessible off-site locations.
(g) Training and distribution. (1) Training. Each swap entity
shall establish, implement, and maintain training with respect to
all aspects of the Operational Resilience Framework, including, but
not limited to:
(i) Cybersecurity awareness training for all personnel; and
(ii) Role-specific training for personnel involved in
establishing, documenting, implementing, and maintaining the
Operational Resilience Framework.
(2) Frequency. Each swap entity shall provide and update the
training required in paragraph (g)(1) as necessary, but no less
frequently than annually.
(3) Distribution. Each swap entity shall distribute copies of
each component program or plan required by paragraph (b)(2) of this
section to relevant personnel and promptly provide any significant
revisions thereto.
(h) Reviews and Testing. Each swap entity shall establish,
implement, and maintain a plan reasonably designed to assess its
adherence to, and the effectiveness of, its Operational Resilience
Framework through regular reviews and risk-based testing.
(1) Reviews. Reviews of the Operational Resilience Framework
shall be conducted at least annually and in connection with any
material change to the activities or operations of the swap entity
that is reasonably likely to affect the risks identified in
paragraph (b)(1) of this section. Reviews shall include an analysis
of adherence to, and the effectiveness of, the Operational
Resilience Framework and any recommendations for modifications or
improvements that address root causes of any issues identified by
the review.
(2) Testing. The frequency, nature, and scope of risk-based
testing of the Operational Resilience Framework shall be determined
by the swap entity, consistent with the standard in paragraph (b)(3)
of this section.
(i) Testing of the information and technology security program
shall include, at a minimum:
(A) Testing of key controls and the incident response plan at
least annually;
(B) Vulnerability assessments, including daily or continuous
automated vulnerability scans; and
(C) Penetration testing at least annually.
(ii) Testing of the business continuity and disaster recovery
plan shall include, at a minimum, a walk-through or tabletop
exercise designed to test the effectiveness of backup facilities and
capabilities at least annually.
(3) Independence. The reviews and testing shall be conducted by
qualified personnel who are independent of the aspect of the
Operational Resilience Framework being reviewed or tested.
(4) Documentation. Each swap entity shall document all reviews
and testing of the Operational Resilience Framework. The
documentation shall, at a minimum, include:
(i) The date the review or testing was conducted;
(ii) The nature and scope of the review or testing, including
methodologies employed;
(iii) The results of the review or testing, including any
assessment of effectiveness;
(iv) Any identified deficiencies and recommendations for
remediation; and
(v) Any corrective action(s) taken or initiated, including the
date(s) such action(s) were taken.
(5) Internal reporting. Each swap entity shall report on the
results of its reviews and testing to the swap entity's chief
compliance officer and any other relevant senior-level official(s)
and oversight body(ies).
(i) Notifications to the Commission. (1) Incidents.
(i) Notification trigger. Each swap entity shall notify the
Commission of any incident that adversely impacts, or is reasonably
likely to adversely impact:
(A) Information and technology security;
(B) The ability of the swap entity to continue its business
activities as a swap entity; or
(C) The assets or positions of a counterparty of the swap
entity.
(ii) Contents. The notification shall provide any information
available to the swap entity at the time of notification that may
assist the Commission in assessing and responding to the incident,
including the date the incident was detected, possible cause(s) of
the incident, its apparent or likely impacts, and any actions the
swap entity has taken or is taking to mitigate or recover from the
[[Page 4759]]
incident, including measures to protect counterparties.
(iii) Timing and method. Each swap entity shall provide the
incident notification as soon as possible but in any event no later
than 24 hours after such incident has been detected. The
notification shall be provided via email to [email protected].
(2) Business continuity and disaster recovery plan activation.
(i) Notification trigger. Each swap entity shall notify the
Commission of any determination to activate the business continuity
and disaster recovery plan.
(ii) Contents. The notification shall provide any information
available to the swap entity at the time of notification that may
assist the Commission in assessing or responding to the emergency or
disruption, including the date of the emergency or disruption, a
description thereof, the possible cause(s), its apparent or likely
impacts, and any actions the swap entity has taken or is taking to
mitigate or recover from the emergency or disruption, including
measures taken or being taken to protect counterparties.
(iii) Timing and method. Each swap entity shall provide the
business continuity and disaster recovery plan activation
notification within 24 hours of determining to activate the business
continuity and disaster recovery plan. The notification shall be
provided via email to [email protected].
(j) Notification of incidents to affected counterparties. (1)
Notification trigger. Each swap entity shall notify a counterparty
as soon as possible of any incident that is reasonably likely to
have adversely affected the confidentiality or integrity of the
counterparty's covered information, assets, or positions.
(2) Contents. The notification to affected counterparties shall
include information necessary for the affected counterparty to
understand and assess the potential impact of the incident on its
information, assets, or positions, and to take any necessary action.
Such notification shall include, at a minimum:
(i) A description of the incident;
(ii) The particular way in which the counterparty, or its
covered information, may have been adversely impacted;
(iii) Measures being taken by the swap entity to protect against
further harm; and
(iv) Contact information for the swap entity where the
counterparty may learn more about the incident or ask questions.
(k) Emergency Contacts. (1) Each swap entity shall provide the
Commission the name and contact information of:
(i) Two employees whom the Commission may contact in connection
with incidents triggering notification to the Commission under
paragraph (i)(1) of this section; and
(ii) Two employees whom the Commission may contact in connection
with the activation of the swap entity's business continuity and
disaster recovery plan triggering notification to the Commission
under paragraph (i)(2) of this section.
(2) The identified employees shall be authorized to make key
decisions on behalf of the swap entity and have knowledge of the
swap entity's incident response plan or business continuity and
disaster recovery plan, as appropriate.
(3) The swap entity shall update its emergency contacts with the
Commission as necessary.
(l) Recordkeeping. Each swap entity shall maintain all records
required to be maintained pursuant to this section in accordance
with section 1.31 of this chapter and shall make them available
promptly upon request to representatives of the Commission and to
representatives of applicable prudential regulators, as defined in
section 1a(39) of the Act.
0
6. Add appendix A to subpart J of part 23 to read as follows:
Appendix A to Subpart J of Part 23--Guidance on Third-Party
Relationship Programs
The following guidance offers factors, actions, and strategies
for swap entities to consider in preparing and implementing third-
party relationship programs reasonably designed to identify,
monitor, manage, and assess risks relating to third-party
relationships, as required by Commission regulation 23.603. The
guidance is also not intended to reduce or replace the obligation of
swap entities to comply with the requirements in Commission
regulation 23.603, including the requirement to ensure that each
swap entity's Operational Resilience Framework is appropriate and
proportionate to the nature, size, scope, complexity, and risk
profile of its business activities as a swap entity, following
generally accepted standards and best practices. The guidance is not
exhaustive and is nonbinding.
The guidance is written to be broadly relevant to all swap
entities, but it may not be universally applicable. The degree to
which the guidance would be applicable to a particular swap entity
would depend on its unique facts and circumstances and may vary from
relationship to relationship. Each swap entity should assess the
relevance of the guidance as it applies to its particular risk
profile and tailor its third-party relationship program accordingly.
Comparable guidance for futures commission merchants is included
in Appendix A to part 1 of the Commission's regulations.
A. Pre-Selection Risk Assessment--Commission Regulation 23.603(e)(1)(i)
Before entering into a third-party relationship, swap entities
should determine which services should be performed by a third-party
and plan for how to manage associated risks. The Commission
appreciates that reliance on third-party service providers may be
unavoidable, particularly given the rapid pace of technological
innovation, which may render it uneconomical or even infeasible for
financial institutions to meet all of their technological needs in-
house.
Nevertheless, given the risks associated with relying on third-
party service providers, and that each additional third-party
relationship a swap entity employs is likely to add further risk and
complexity, a swap entity's third-party relationship program should
include a deliberative process for affirmatively determining whether
to source a particular service from a third-party service provider.
In determining whether a particular function should be performed by
a third-party service provider, swap entities should consider
whether:
The service would support the swap entity's strategic
goals and objectives.
The same goals and objectives could be addressed
through an alternative means that may not require reliance on a
third-party service provider.
The swap entity has or could otherwise secure the
resources, financial and otherwise, to effectively monitor the
third-party service provider.
Relevant and reputable third-party service providers
are available.
The provision of the service would implicate
information and technology security concerns, including by requiring
the third-party service provider to obtain access to covered
information or provide covered technology.
A disruption of the service would have a negative
impact on counterparties or regulatory compliance.
The relationship could be structured to reduce
associated risks, such as by limiting the third-party service
provider's access to covered information or covered technology.
Lack of direct control over performance of the service
would present unacceptable risk, i.e., risk outside the swap
entity's risk tolerance limits.
As the above considerations illustrate, swap entities should
consider ways in which they might structure their third-party
relationships to reduce the associated risks. For example, where
giving a third-party service provider direct access to its
technology or data may be outside a swap entity's risk tolerance,
structuring the relationship to provide the third-party service
provider access on a read-only basis or via reports delivered by the
swap entity could render the relationship more acceptable. Swap
entities should therefore consider the availability of safer means
of performing the service as part of their assessment.
Changes in technology, businesses practices, regulation, market
structure, market participants (e.g., new entrants to the market),
or service delivery may change the risk profile of the third-party
relationship over time. Accordingly, swap entities should consider
periodically reassessing their selection of services to be performed
by third-party service providers. Swap entities should stay abreast
of these changes by monitoring the external environment and
communicating with current and prospective service providers and
other participants in industry.
B. Due Diligence in Selecting Third-Party Service Providers--Commission
Regulation 23.603(e)(1)(ii)
After a swap entity has determined that a service is suitable
for a third-party to perform, it should conduct due diligence on
prospective third-party service providers. Due diligence provides
swap entities with the information they need to assess and conclude,
with a reasonable level of assurance, that the prospective third-
party service provider is capable of effectively
[[Page 4760]]
providing the service as expected, adhering to the swap entity's
policies, maintaining the swap entity's compliance with Commission
regulations, and protecting covered information. Appropriate due
diligence should also enable swap entities to evaluate whether they
would be able to effectively monitor and manage the risks associated
with a particular third-party relationship.
Due diligence may be conducted before or contemporaneously with
contractual negotiations with prospective third-party service
providers but should be concluded prior to executing any agreements.
Swap entities should conduct due diligence even in situations where,
for a particular service, there may only be one or a small number of
providers with a dominant market share whose services are used by
all or most of the swap entities' industry peers, and swap entities
should not rely solely on those providers' reputations or prior
experience with them. The depth and rigor of the due diligence
should be proportionate to the nature of the third-party
relationship, with the required heightened due diligence required
for potential critical third-party service providers pursuant to
Commission regulation 23.603(e)(2). Specifically, when conducting
due diligence for a potential critical third-party servicer
provider, swap entities should expand the type and sources of
information they rely on, the rigor and scrutiny they apply in
reviewing the information to identify potential risks, and the level
of confidence in their assessment of the third-party service
provider's ability to perform.
When establishing their due diligence protocols, swap entities
should consider the full range of risks that reliance on the third-
party service providers could introduce in light of the nature of
the service they would be performing. Relevant considerations with
respect to the potential third-party service provider include its:
Financial condition, business experience and
reputation, and business prospects, particularly the third-party
service provider's experience providing services to financial
institutions.
Background, experience, and qualifications with respect
to key personnel.
Information and technology security practices,
including incident reporting and incident management programs, and
whether there are clearly documented processes for identifying and
escalating incidents.
Risk management practices, including governance,
controls, testing, and issue management practices, as well as the
results of any independent risk assessments.
Regulatory environment, including the legal
jurisdiction in which it is based and applicable regulatory or
licensing requirements.
History of disruptions to operations, including whether
the third-party service provider has suffered incidents that would
meet the standard for reporting to the Commission in Commission
regulation 23.603(i).
Violations of legal, compliance, or contractual
obligations, including civil or criminal proceedings or
administrative enforcement actions, including from self-regulatory
organizations.
Understanding of Commission regulatory requirements
applicable to the swap entity.
Use of and reliance on subcontractors, including the
volume and types of subcontracted activities, and the third-party
service provider's process for identifying, assessing, managing, and
monitoring associated risks.
Business continuity and contingency plans.
Financial protections, such as insurance coverage
against losses or liabilities from intentional or negligent acts or
hazards involving physical destruction and data or documentation
losses.
Swap entities should memorialize their assessment of these
factors and identify how the review was heightened for critical
third-party service providers. Swap entities should not rely solely
on their prior knowledge of or experience with a potential third-
party. Potential sources of due diligence information include:
Audit reports, including pooled audit plans, and System
and Organizational Controls (SOC) reports.
Financial statements and projections and relevant
accompanying information (e.g., annual or quarterly reports,
management commentary, auditors' opinions, and investor relations
materials).
Incident response plans, including the results of
recent testing or assessments thereof.
Business continuity and disaster recovery plans, as
well as the result of recent testing or assessments thereof.
Public filings.
News reports, trade publications, and press releases.
Reports from market intelligence providers.
References from current or previous customers, or other
parties which have had business relationships with the third-party
service provider.
Informal industry discussions.
Information provided directly by the third-party
service provider, such as internal performance metrics.
Obtaining and reviewing audit reports, including SOC reports,
may be of particular value for conducting heightened due diligence
of critical third-party service providers. In certain circumstances,
swap entities may not be able to gather all the information
necessary to reach an informed conclusion that a prospective third-
party service provider is an adequate provider. Examples include
instances where the third-party service provider is a new entrant
into the market and little information exists; where information
provided by the third-party service provider is insufficient or
appears unreliable; or where the third-party service provider is
reluctant to provide internal information. In such cases, the swap
entity should identify and document the limitations of its due
diligence, the attendant risks, and any available methods for
mitigating them (e.g., obtaining alternate information, implementing
enhanced monitoring or controls, negotiating protective contractual
provisions). Ultimately, such factors could weigh against the use of
the potential third-party service provider, particularly a potential
critical third-party service provider. Swap entities that proceed
with the third-party service arrangements notwithstanding the
limited due diligence should do so with caution, applying heightened
scrutiny of the information they do receive, and consider the
implementation of their own mitigating controls to compensate for
the uncertainty.
C. Contractual Negotiations--Commission Regulation 23.603(e)(1)(iii)
After selecting a third-party service provider, swap entities
should proceed to finalizing the agreement, typically through
entering into an enforceable written contract. Written contracts are
an important tool for clarifying the scope of services to be
delivered, establishing standards or performance benchmarks,
allocating risks and responsibilities, and facilitating resolution
of disputes. They can also reduce the risks of non-performance and
assist in monitoring the third-party service provider. Because of
their importance, the Commission recommends that swap entities enter
written agreements with third-party service providers before
services are delivered, particularly with critical third-party
service providers.
In negotiating a written contract, swap entities should seek to
negotiate contractual provisions that would support their ability to
mitigate, manage, and monitor the risks associated with the
relationship, as identified through their initial pre-selection and
due diligence activities. The contractual provisions should be
informed by the nature of the service provided and be proportionate
to the criticality of the services provided. In particular, swap
entities should consider negotiating for the contract to include the
following provisions:
Timely notification to the swap entity of any incidents
suffered by third-party service providers, or of significant
disruptions to the operations of the third-party service provider.
Timely notification to the swap entity of any material
changes to the services provided.
Required periodic, independent audits of the third-
party service provider, the results of which would be shared with
the swap entity.
Restrictions on the third-party service provider's use
of the swap entity's covered information, except as necessary to
deliver the service or meet legal obligations.
Security measures to protect the swap entity's covered
information and covered technology to which the third-party service
provider has access.
Insurance, guarantees, indemnification, and limitations
on liability.
Dispute resolution procedures.
Performance measures or benchmarks.
Remediation of identified performance issues.
Compliance with regulatory requirements, including
reasonable assurances that the third-party service provider is
willing and able to coordinate with the swap entity for the purpose
of ensuring the swap entity complies with its legal and regulatory
obligations.
Use of subcontractors, including notification or
approval procedures for their use, the extension of contractual
rights of the
[[Page 4761]]
swap entity against the third-party service provider to its
subcontractors, and contractual obligations for reporting on or
oversight of subcontractors.
Termination provisions, including rights to terminate
following breaches of the third-party service provider's
obligations, notice requirements, obligations of the third-party
service provider to provide support for a successful transition, and
the return or destruction of records or covered information, as
further described in section E of this guidance.
Information sharing necessary to facilitate other
provisions of this proposed guidance (for example, reporting
requirements to support ongoing monitoring, as discussed in section
D of this guidance, or notice requirements for termination, as
discussed in section E of this guidance).
These provisions focus on key risk factors generally associated
with third-party service provider relationships. They are not
exhaustive of all contractual provisions swap entities should seek
to include in their written contracts, including ordinary commercial
contract terms (e.g., choice of law provisions) and terms that may
relate only to specific services, among other provisions. While
third-parties may initially offer a standard contract, a swap entity
may seek to request modifications, additional contractual
provisions, or addendums to satisfy its needs. Swap entities should
work to tailor the level of detail and comprehensiveness of the
contractual provisions based on the risk and complexity posed by the
particular third-party relationship, contracts with critical third-
party service providers likely being the most tailored.
In some circumstances, a swap entity may be at a bargaining
power disadvantage, which prevents it from negotiating optimal
contractual provisions. For example, a prospective third-party
service provider may be the sole provider of a service or may have
such dominant market share that it can offer its services on a
``take-it-or-leave-it'' basis. In such situations, the swap entity
should work to understand any resulting limitations in the contract
and attendant risks and consider whether it can achieve outcomes
comparable to those provided by contractual protections through non-
contractual means. Examples could include the swap entity
implementing additional controls, augmenting its monitoring of the
third-party service provider using public sources or market
intelligence services, or purchasing insurance. The swap entity
should make an assessment, however, of whether these alternatives
would provide an adequate substitute for the unobtained contractual
protections and document its assessment and mitigation plan,
considering its risk appetite and risk tolerance limits. Where a
third-party service provider is unable or unwilling to agree to
provisions necessary for the swap entity to meet its obligations
under Commission regulations, particularly a critical third-party
service provider, the swap entity should consider finding an
alternative third-party service provider.
D. Ongoing Monitoring--Commission Regulation 23.603(e)(1)(iv)
After a third-party service provider has initiated performance,
swap entities should engage in ongoing monitoring. Ongoing
monitoring is important to ensure the third-party service provider
is properly carrying out its outsourced function and contractual
obligations, as well as meeting quality or performance expectations.
Effective monitoring can aid swap entities in the early
identification of performance deficits, allowing for a quicker
response that may then mitigate the impact.
Ongoing monitoring should occur throughout the duration of a
third-party relationship, commensurate with the level of risk and
complexity of the relationship and the activity performed by the
third-party. Examples of possible monitoring activities include:
Reviewing reports on performance and effectiveness of
controls, including independent audit reports and SOC reports.
Periodic on-site visits or meetings to discuss open
issues and plans for changes to the relationship.
Reviewing updated due diligence information.
Documenting service-level agreements with the third-
party service provider to establish performance targets.
Establishing measures for the third-party service
provider to identify, record, and remediate instances of failure to
meet contractual obligations or unsatisfactory performance and to
report such instances to the swap entity on a timely basis.
Direct testing of the third-party service provider's
control environment.
The frequency and depth of the swap entity's monitoring
activities should reflect the nature of the third-party
relationship, including heightened monitoring for critical third-
party service providers, and may change over the duration of the
relationship. The swap entity should dedicate sufficient staffing
resources to its monitoring activities and be particularly alert to
any circumstances that could signal that a third-party service
provider may not be able to perform to an acceptable standard. A
swap entity should be cognizant that certain events may trigger the
need for it to take further action, including terminating its
relationship with the third-party service provider. Such events
could include cyberattacks, natural disasters, financial distress or
insolvency, adverse or qualified audit opinions, or litigation or
enforcement actions.
In addition to the continuous monitoring described above, swap
entities should periodically review and reevaluate their
relationships with third-party service providers holistically. Such
reviews should be more thorough than routine monitoring and may
involve additional personnel, such as in-house or outside auditors,
compliance and risk functions, information technology staff, or by a
central function or committee whose visibility into other third-
party relationships could provide valuable context for the
relationship at issue. Additionally, to the extent a swap entity
uses enterprise risk management techniques, it should seek to
integrate the information gathered from its ongoing monitoring with
those practices. For example, to the extent that a swap entity
maintains a standardized approach across risk types to escalate
concerns or issues to senior management or governance bodies (e.g.,
through the use of predefined criteria or escalation paths), the
swap entity should consider using the same protocols for escalating
concerns identified through its ongoing monitoring of third-party
service providers. The ongoing monitoring approach itself may be
subject to enterprise risk management practices, such as periodic
self-assessment for effectiveness, independent testing, and quality
assurance.
To the extent that monitoring activities reveal a change in
their assessment of the risks associated with the third-party
relationship, swap entities should adjust the frequency and types of
monitoring they conduct, including reports, regular testing, and on-
site visits. One example of information that may change the level of
monitoring is a notification that a third-party service provider has
suffered or may suffer from a severe adverse event that could
trigger a material change in the systems or process used to carry
out an outsourced function.
E. Terminating the Third-Party Relationship--Commission Regulation
23.603(e)(1)(v)
Swap entities should ensure that their third-party service
provider relationship programs include advance preparation for the
termination of the third-party relationship to ensure an orderly
transition. Swap entities should prepare for both planned
terminations (i.e., where one or both parties elects to end the
relationship pursuant to their contract) and unplanned terminations
(e.g., following a sudden withdrawal of the third-party service).
The programs should include both the contractual provisions for
terminating the service (termination provisions), and the swap
entity's plan to facilitate an orderly transition of the function to
an alternative provider or to bring it in-house (exit strategy). The
goal of termination planning is to support an efficient transition
to alternative arrangements for the provision of the service,
regardless of the circumstances of the termination.
Termination provisions include all terms needed by the swap
entity to wind down a third-party service relationship while
ensuring that the swap entity can continue to serve its
counterparties without interruption and to meet its regulatory
compliance obligations. Because information, data, staff training,
and knowledge may reside in the third-party service provider, there
is an increased risk of disruption during the termination phase.
When negotiating termination provisions, a swap entity should ensure
that the terms negotiated support its exit strategy. For example, a
swap entity should ensure that termination rights are accompanied by
notice periods that leave the swap entity enough time to find an
alternative provider (or to provide the service itself) to ensure an
orderly transition.
Similarly, the swap entity should ensure that all customer data
or other covered information in the third-party service provider's
possession is promptly returned to
[[Page 4762]]
the swap entity or destroyed, as appropriate. The swap entity should
also verify that the third-party's access to its systems and covered
information ceases at termination. Swap entities should also
consider negotiating more stringent terms for third-party service
providers that breach their obligations under the agreement, other
than for ``no-fault'' terminations. Such breaches may signal an
inability of the third-party service provider to provide the
services contracted for and thereby threaten the ability of the swap
entity to serve its customers and meet its regulatory obligations.
(See section C of this guidance for examples of termination
provisions.)
Swap entities' exit strategies should include the steps needed
to end the service provision with the third-party service provider
and retain a new service provider or begin providing the service in-
house. Although elements of an exit strategy may be reflected in
termination provisions, not all elements of the exit strategy may be
suitable for the contract. Examples include approvals,
identification of alternative providers, description of the roles of
staff in the swap entity, and other internal matters. These elements
may be memorialized in a procedure or similar document, such as the
third-party relationship program. The exit strategy should contain
the internal steps to be taken to ensure notification to the third-
party service provider, identification of the proposed new provider,
or, if bringing the function in-house, the hiring and training of
personnel, development of procedures, and launch of new technology,
along with the time periods and responsible personnel for each.
Swap entities should be aware that, in practice, implementing an
exit strategy may be complex and time-consuming and that the
exercise of termination arrangements may be difficult. Swap entities
should also be aware that some third parties possess expertise that
is not readily available and plan accordingly. Swap entities should
ensure that their plans are flexible enough to account for a range
of plausible termination scenarios, including situations where the
third-party service provider rapidly becomes unviable. Swap entities
may need to design backup or interim procedures sufficient to meet
regulatory requirements in such situations.
Issued in Washington, DC, on December 22, 2023, by the
Commission.
Robert Sidman,
Deputy Secretary of the Commission.
NOTE: The following appendices will not appear in the Code of
Federal Regulations.
Appendices to Operational Resilience Framework for Futures Commission
Merchants, Swap Dealers, and Major Swap Participants--Voting Summary
and Chairman's and Commissioners' Statements
Appendix 1--Voting Summary
On this matter, Chairman Behnam, Commissioners Johnson,
Goldsmith Romero, Mersinger and Pham voted in the affirmative. No
Commissioner voted in the negative.
Appendix 2--Statement of Support of Chairman Rostin Behnam
I support the Commission's approval of the notice of proposed
rulemaking to require futures commission merchants (FCMs), swap
dealers (SDs), and major swap participants (MSPs) to establish an
operational resilience framework (ORF).
The proposal recognizes that while FCMs, SDs, and MSPs
(collectively, ``covered entities'') have generally withstood
challenging market conditions since the Commission promulgated its
risk management program requirements over a decade ago, the
Commission must bolster that foundational framework to promote
operational resilience in the face of increasingly sophisticated
cyberattacks and heightened technological disruptions. A strong ORF
is especially important as the financial sector increasingly relies
on third-party service providers; the disruption of which can lead
to major interruptions in--and potential corruption of--FCM and SD
operations. In addition to market impacts, events like these may
impact covered entities' ability to comply with the Commission's
statutory and regulatory requirements.
FCMs' customers and SDs' counterparties expect covered entities
to take a 360-degree approach to identify, monitor, manage, and
assess risks for potential vulnerabilities. Similarly, the
Commission must identify, monitor, manage, and assess any potential
gaps in its own risk management requirements that could impede sound
risk management practices, expose the U.S. financial system to
unmanaged risk, or weaken customer protection. Operational
disruptions that place a covered entity's financial resources at
risk; disrupt the segregation and protection of customer funds;
hinder recordkeeping; introduce uncertainty or delay; or otherwise
inject operational risk into the derivatives market must be avoided
to the extent possible to ensure customers, counterparties, and
market participants have confidence in the integrity of our markets.
The operational resilience framework proposal is the product of
many months of in-depth research regarding operational resilience
standards and guidance issued by the prudential regulators, the U.S.
Securities and Exchange Commission, the National Futures
Association, the International Organization of Securities
Commissions, the Financial Stability Board, and other subject matter
experts to avoid those operational disruptions and failures. The
proposal also reflects staff's own observations and lessons learned
from its own oversight activities.
The proposal is a holistic, principles-based approach that is
calibrated with certain minimum requirements. Specifically, the
proposed rule would require covered entities to establish, document,
implement, and maintain an ORF reasonably designed to identify,
monitor, manage, and assess risks relating to three key risk areas:
(1) information and technology security, (2) third-party
relationships, and (3) emergencies and other significant
disruptions. The ORF would also include requirements related to
governance, training, testing, and recordkeeping.
The proposal would require covered entities to establish risk
appetite and risk tolerance limits and would allow these registrants
to rely on an information and technology security program, third-
party relationship program, or business continuity and disaster
recovery plan in which the covered entity participates with one or
more affiliates and that is managed and approved at the enterprise
level. Testing would need to be risk-based and include, at a
minimum, daily or continuous vulnerability assessment and annual
penetration testing, among others. The proposed rule would also
require certain notifications to the Commission and customers or
counterparties. The Commission is also proposing non-binding
guidance that FCMs and SDs could consider to identify factors,
actions, and strategies as they design their third-party
relationship programs.
The Commission recognizes that covered entities subject to this
proposal include many different business models. As a result, the
proposal is tailored to accommodate firms that vary in size and
complexity, including corporate structures in which operational
resilience frameworks may be managed at an enterprise level and have
governance arrangements with different reporting line structures. In
the same vein, the proposed ORF standard would require covered
entities to implement an ORF that is appropriate and proportionate
to the nature, size, scope, complexity, and risk profile of the
firm's business as an FCM or SD, following generally accepted
standards and best practices.
I look forward to reading the public's comments on how the
proposed operational resilience framework requirements and guidance
can strengthen the operational resilience of FCMs, SDs, and MSPs as
well as help protect their respective customers and counterparties
in the derivatives markets. The 75-day comment period will begin
upon the Commission's publication of the release on its website.
I thank staff in the Market Participants Division, Office of the
General Counsel, and the Office of the Chief Economist for all of
their work on the proposal.
Appendix 3--Statement of Commissioner Kristin N. Johnson
Cyberattacks are an ever-increasing threat. The rising cost,
frequency, and severity of cyber threats represent one of the most
critical issues facing city, state, and federal government
authorities, businesses in each sector of our economy, educational
and philanthropic institutions, and significant energy and
transportation infrastructure, and national security resources.
Less than a month before the White House released its National
Cybersecurity Strategy in March of this year, international media
headlines reported a ransomware attack that demonstrated that ``big
financial firms'' are among the most attractive targets of cyber
threats.\1\ Even for firms that have successfully
[[Page 4763]]
developed business continuity plans to identify, assess, or mitigate
cyber threats, the networked or interconnected systems that comprise
our operational market infrastructure may still render
sophisticated, well-resourced firms vulnerable to the knock-on
effects of cyberattacks leveled against critical third-party service
providers.
---------------------------------------------------------------------------
\1\ James Rundle, Wall Street Journal, Cyberattack on ION
Derivatives Unit Had Ripple Effects on Financial Markets (Feb. 10,
2023), https://www.wsj.com/articles/cyberattack-on-ion-derivatives-unit-had-ripple-effects-on-financial-markets-11675979210.
---------------------------------------------------------------------------
The ransomware attack, carried out on a critical third-party
service provider, ION Cleared Derivatives,\2\ disrupted trade
settlement and reconciliation in derivatives markets.
---------------------------------------------------------------------------
\2\ See Press Release, ION Markets, Cleared Derivatives Cyber
Event (Jan. 31, 2023), https://iongroup.com/press-release/markets/cleared-derivatives-cyber-event/.
---------------------------------------------------------------------------
ION provides trading, clearing, analytics, treasury, and risk
management services for capital markets and futures and derivatives
markets. A significant number of market participants, including a
notable number of futures commission merchants (FCMs), rely on ION
for back-office trade processing and settlement of exchange-traded
derivatives.
The cyber-incident that disrupted ION's operations caused a
ripple effect across markets, halting deal matching, requiring
affected parties to rely on manual (old school) trade processing,
and causing delays in reconciliation and information sharing and
reporting.
MRAC Leads on Cyber Reform Discussions
I sponsor the Market Risk Advisory Committee (MRAC). On March 8,
2023, the MRAC held a first-of-its-kind convening focused on the
interconnectedness of our markets and the potential for
interconnectedness and correlation to amplify contagion in the event
of successful cyberattacks against critical infrastructure
resources.\3\ At the March MRAC meeting, Futures Industry
Association (FIA) President Walt Lukken announced the creation of a
Cyber Risk Taskforce, charged with ``recommend[ing] ways to improve
the ability of the exchange-traded and cleared derivatives industry
to withstand the disruptive impacts of a cyberattack.'' \4\
---------------------------------------------------------------------------
\3\ Kristin N. Johnson, Commissioner, CFTC, Opening Statement
Before the Market Risk Advisory Committee Meeting (Mar. 8, 2023),
https://www.cftc.gov/PressRoom/SpeechesTestimony/johnsonstatement030823.
\4\ Futures Industry Association, FIA Taskforce on Cyber Risk,
After Action Report and Findings, at 3 (Sept. 28, 2023), https://www.fia.org/sites/default/files/2023-09/FIA_Taskforce%20on%20Cyber%20Risk_Recommendations_SEPT2023_Final2.pdf
.
---------------------------------------------------------------------------
The After Action Report issued by the FIA at the conclusion of
the Taskforce's work outlines the challenges that both markets and
regulators faced as a result of the ION cyber-incident. Trade
reconciliation for affected firms continued to lag. For weeks
following the ION cyberattack, the Commission continued to work to
consistently publish the Commitments of Traders (COT) report on a
timely basis because ``reporting firms continu[ed] to experience . .
. issues submitting timely and accurate data to the CFTC.'' \5\ The
COT report is designed to help the public understand the dynamics of
the futures and options on futures markets.\6\ The COT report is a
reflection of the effectiveness of the Commission's surveillance of
markets; it increases transparency and aids in price discovery.
Thus, indirectly, the ION incident disrupted regulatory functions
even though the cyberattack was not directed at the Commission nor
any of the Commission's registrants.
---------------------------------------------------------------------------
\5\ Press Release No. 8662-23, CFTC, CFTC Announces Postponement
of Commitments of Traders Report (Feb. 16, 2023), https://www.cftc.gov/PressRoom/PressReleases/8662-23.
\6\ CFTC, Commitments of Traders Reports Descriptions, https://www.cftc.gov/MarketReports/CommitmentsofTraders/index.htm.
---------------------------------------------------------------------------
As a consequence, it is imperative to begin to examine the scope
of our regulations governing cyber-system safeguards not only for
registered market participants, but for mission-critical third-party
service providers. There is increasing reliance on third parties for
the provision of important services, particularly, for example,
services that facilitate digital connectivity and cloud-based
services.
While outsourcing may allow companies to rely on outside
expertise, reduce operating costs, and enhance operational
infrastructure necessary for executing business activities,
reliance, may, in some instances, create vulnerability and risks
that must be identified, managed, and mitigated.
Operational Resilience Proposed Rulemaking
Today, the Market Participants Division (MPD) has introduced a
robust and comprehensive proposed rulemaking that addresses:
business continuity and disaster planning, cybersecurity, and
assessment of the risk posed by reliance on third parties. I want to
commend MPD, in particular Pamela Geraghty, Elise Bruntel, Fern
Simmons, and Amanda Olear.
The Commission has the authority to direct swap entities (swap
dealers and major swap participants) to establish this operational
resilience framework under Section 4s(j)(2) and (7) of the Commodity
Exchange Act (CEA), which require swap entities to establish risk
management systems over their day-to-day business and their
operational risk.\7\ Likewise, the Commission may require
operational resilience framework of FCMs (collectively with swap
entities, ``covered entities'') under Section 8a(5) of the CEA,\8\
which authorizes the Commission to promulgate regulations sufficient
to accomplish the purposes of the CEA, including, for example, the
need to maintain records of the operational risk of affiliates,\9\
and to establish safeguards to protect the confidentiality of
nonpublic personal information.\10\
---------------------------------------------------------------------------
\7\ 7 U.S.C. 6s(j)(2), (7).
\8\ 7 U.S.C. 12a(5).
\9\ 7 U.S.C. 6f.
\10\ 7 U.S.C. 7b-2; 15 U.S.C. 6801.
---------------------------------------------------------------------------
The proposed rulemaking sets out three major pillars of its
operational resilience framework: (1) information and technology
security; (2) a third-party relationship program to manage risks
presented by mission-critical third-party service providers; and (3)
a business continuity and disaster recovery plan.\11\
---------------------------------------------------------------------------
\11\ Proposed Sec. Sec. 1.13(b)(2), 23.603(b)(2).
---------------------------------------------------------------------------
Layered on top of the of the three pillars are corporate
governance reforms that will dictate how each covered entity will
incorporate the components of the plan into existing organizational
structures. Each of the components of the operational resilience
framework must be reviewed by senior leadership.\12\ Covered
entities must also establish a risk appetite--the level of risk
acceptable on an ongoing basis--and risk tolerance limits--the level
of excess risk the entity is willing to accept should a particular
risk materialize \13\--and the entities will be required to escalate
incidents that exceed their risk tolerance limit.\14\ The rule also
allows for flexibility for entities that function as a division or
affiliate of a larger organization; such entities will be allowed to
operate under the umbrella company's operational resilience plan so
long as that plan meets the rule's requirements and considers the
covered entity's particular risks.\15\
---------------------------------------------------------------------------
\12\ Proposed Sec. Sec. 1.13(c)(1), 23.603(c)(1).
\13\ Proposed Sec. Sec. 1.13(c)(1), 23.603(c)(2).
\14\ Proposed Sec. Sec. 1.13(c)(3), 23.603(c)(3).
\15\ Proposed Sec. Sec. 1.13(c)(4), 23.603(c)(4).
---------------------------------------------------------------------------
The information and technology security program requires the
covered entities to comprehensively assess, on at least an annual
basis, the types of threats the entity faces, the entity's internal
and external vulnerabilities, the likely impact of those threats or
the exploitation of those vulnerabilities, and appropriate
priorities for addressing those risks.\16\ With that background,
covered entities must then implement controls reasonably designed to
prevent, detect, and mitigate the identified risks, threats, and
vulnerabilities.\17\ The program then requires the covered entities
to develop a written incident response plan, reasonably designed to
detect incidents where risks to information and technology are
realized, and then provide for how the entity will mitigate the
impact of and recover from such an incident.\18\
---------------------------------------------------------------------------
\16\ Proposed Sec. Sec. 1.13(d)(1), 23.603(d)(1).
\17\ Proposed Sec. Sec. 1.13(d)(2), 23.603(d)(2).
\18\ Proposed Sec. Sec. 1.13(d)(3), 23.603(d)(3).
---------------------------------------------------------------------------
The third-party relationship plan requires covered entities to
understand the risks posed by all third-party service providers at
each stage of the relationship: pre-selection, diligence, contract
negotiation, ongoing monitoring, and termination.\19\ The proposed
rule then imposes a heightened level of required diligence and
monitoring for ``critical'' third parties, defined as those parties
for whom disruption of performance on their service contract would
either ``significantly disrupt'' the covered entity's business
operations, or ``significantly and adversely impact'' the entity's
counterparties or customers.\20\ Covered entities will also have to
maintain an inventory of their critical and non-critical third-party
service providers.\21\ Finally, regardless of any
[[Page 4764]]
decision to rely on a third-party service provider, each covered
entity remains responsible for meeting its obligations under the CEA
and Commission regulations.\22\
---------------------------------------------------------------------------
\19\ Proposed Sec. Sec. 1.13(e)(1), 23.603(e)(1).
\20\ Proposed Sec. Sec. 1.13(e)(2), 23.603(e)(2).
\21\ Proposed Sec. Sec. 1.13(e)(3), 23.603(e)(3).
\22\ Id.
---------------------------------------------------------------------------
Each entity's business continuity and disaster recovery plan
(BCDR plan) must ``outline[ ] the procedures to be followed in the
event of an emergency or other disruption of its normal business
activities.'' \23\ The goal of a BCDR plan will be to enable covered
entities to continue or resume business operations with minimal
disruption to customers, counterparties, or the markets, and recover
any affected data or information.\24\ At minimum, the BCDR plan must
define backup plans for covered information and data; identify
essential technology, facilities, infrastructure, and personnel;
identify potential disruptions to critical third-party service
providers; and identify supervisory personnel responsible for
carrying out the plan in the event of an emergency.\25\ Covered
entities must also maintain the plan at one or more off-site
locations.\26\
---------------------------------------------------------------------------
\23\ See 17 CFR 23.603(a).
\24\ Proposed Sec. Sec. 1.13(f)(1)(i)-(ii), 23.603(f)(1)(i)-
(ii).
\25\ Proposed Sec. Sec. 1.13(f)(2), 23.603(f)(2).
\26\ Proposed Sec. Sec. 1.13(f)(3), 23.603(f)(3).
---------------------------------------------------------------------------
To support the pillars of the operational resilience framework,
the proposed rule also lays out training,\27\ review, and testing
requirements to ensure the framework evolves with newly generated
risks. Covered entities must review their framework annually,\28\
and engage in regular independent and documented testing, including
penetration testing, vulnerability assessments, and testing of the
incident response and BCDR plans.\29\ Results of that testing must
be reported to the entity's chief compliance officer and other
relevant senior personnel.\30\ Finally, the proposed rule lays out
the instances in which the Commission must be notified of incidents
and of activation of the BCDR plan.\31\
---------------------------------------------------------------------------
\27\ Proposed Sec. Sec. 1.13(g), 23.603(g).
\28\ Proposed Sec. Sec. 1.13(h)(1), 23.603(h)(1).
\29\ Proposed Sec. Sec. 1.13(h)(2)-(3), 23.603(h)(2)-(3).
\30\ Proposed Sec. Sec. 1.13(h)(5), 23.603(h)(5).
\31\ Proposed Sec. Sec. 1.13(i)-(j), 23.603(i)-(j).
---------------------------------------------------------------------------
This proposed rulemaking is both expansive and thoroughly
considered. It galvanizes much of the preexisting guidance on these
subjects, recognizing that the vast majority of our market
participants already have programs in place to address these risks
and often already are subject to other regulators' rules and
obligations, both domestically and internationally. The rule also
recognizes the vast range in the size of the operations of our
registered market participants--from some of the world's largest
financial institutions acting as swap dealers to small, independent
futures commissions merchants--and consequently builds flexibility
into the proposed rule to allow businesses to tailor their
operational resilience frameworks to the realities of their business
needs.
The Need for Operational Resilience for Other Commission Registrants
This rule is necessarily limited in scope to FCMs and the swap
entities overseen by MPD. The risks that this rule intends to
mitigate, however, are not similarly siloed. Designated Contract
Markets (DCM), Swap Execution Facilities (SEF), and Swap Data
Repositories (SDR), overseen by the Division of Market Oversight,
and Derivative Clearing Organizations (DCO), overseen by the
Division of Clearing and Risk, similarly rely on mission-critical
third-party service providers, similarly are targeted by
cyberattacks, and similarly risk business disruption caused by
unforeseen disaster scenarios.
Rulemakings completed in 2016 created system safeguard testing
requirements for each of these entities, currently codified in Parts
37, 38, 39, and 49 of the CFR.\32\ These rules include obligations
for business continuity and disaster recovery and cybersecurity.
Since 2016, however, the core issues surrounding the concept of
operational resilience have shifted, most importantly around the
ideas of mission-critical third parties. DCOs are increasingly
contracting with third parties to manage and conduct aspects of
their regulatory obligations, and just like with the covered
entities subject to the rule at issue today, the onboarding of these
new third parties also onboards new risks. The proposed rulemaking
today considers the system safeguards provisions already on the
books; \33\ the Commission now needs to continue to press forward by
considering this proposed rule for future parallel regulations, for
DCOs in particular.
---------------------------------------------------------------------------
\32\ See Final Rule, System Safeguards Testing Requirements, 81
FR 64272 (Sept. 19, 2016) (covering DCMs, SEFs, and SDRs); Final
Rule, System Safeguards Testing Requirements for Derivatives
Clearing Organizations, 81 FR 64322, 64329 (Sept. 19, 2016)
(``System Safeguards for DCOs'') (describing the CFTC's approach to
system safeguards for DCOs as providing DCOs with ``flexibility to
design systems and testing procedures based on the best practices
that are most appropriate for that DCO's risks'').
\33\ C.f., e.g., System Safeguards for DCOs, 81 FR 64322-23; 17
CFR 39.18(b)(3) (requiring DCOs to follow generally accepted
standards and best practices with respect to the development,
operation, reliability, security, and capacity of automated
systems).
---------------------------------------------------------------------------
The pandemic underscored the importance of business operational
resilience, namely the ability of our registrants to react to and
withstand unforeseen disasters. The FIA conducted its annual
Disaster Recovery Exercise this fall with the stated goal of probing
participants' ability to ``conduct critical business functions'' in
the wake of a large-scale disaster.\34\ Last year's exercise saw
participation from 19 major U.S. and international futures exchanges
and clearinghouses, who indicated that this type of probing helped
them to: ``Exercise their business continuance/disaster resilience
plans[, i]dentify internal and external single points of failure . .
. [, and t]ighten up and improve the documentation of their business
continuity procedures.'' \35\
---------------------------------------------------------------------------
\34\ Presentation, Futures Industry Association, Business
Continuity Disaster Recovery Test, at 4 (Aug. 23, 2023), https://www.fia.org/sites/default/files/2023-10/FIA_DR_Test_Briefing_2023_1010_0.pptx.
\35\ Summary Report, Futures Industry Association, 2022 FIA
Industry-Wide Disaster Recovery Test, at 4 (Dec. 16, 2021), https://www.fia.org/sites/default/files/2023-05/2022_DR_Test_Results_v2.pdf.
---------------------------------------------------------------------------
In 2021, the International Organization of Securities
Commissions (IOSCO) initiated a consultation examining business
continuity planning.\36\ IOSCO's initial recommendations to member
jurisdictions stated that all regulators should require firms to
have in place ``mechanisms to help ensure the resiliency,
reliability and integrity (including security) of critical systems''
including an appropriate ``Business Continuity Plan.'' \37\
---------------------------------------------------------------------------
\36\ The Board of The International Organization of Securities
Commissions, Thematic Review on Business Continuity Plans with
respect to Trading Venues and Intermediaries (May 21, 2021), https://www.iosco.org/library/pubdocs/pdf/IOSCOPD675.pdf.
\37\ Id. at 1.
---------------------------------------------------------------------------
Every industry advisory board and oversight group to have
studied cybersecurity has reached the same conclusion: risks to
financial institutions from cyberattacks continue to grow. The
Financial Stability Oversight Council noted in its 2022 annual
report that from 2015 to 2020 the finance and insurance industries
were subject to the most cyberattacks of any industry, and that the
current global geopolitical climate has only increased the need for
vigilance against cyber threats.\38\ In April 2020, the Financial
Stability Board (FSB) issued a guide on cyber incident response that
explained that ``[a] significant cyber incident, if not properly
contained, could seriously disrupt the financial system, including
critical financial infrastructure, leading to broader financial
stability implications.'' \39\ Similarly, in its 2019 Cyber Task
Force report, IOSCO reiterated that cyber risk is one of the top
threats to financial markets today given the ``economic costs of
such events can be immense . . . and could potentially undermine the
integrity of global financial markets.'' \40\ IOSCO went further in
their recommendations to the crypto industry earlier this year that
``[r]egulators should require a [crypto-asset service provider] to
put in place sufficient measures to address cyber and system
resiliency.'' \41\
---------------------------------------------------------------------------
\38\ Financial Stability Oversight Council, 2002 Annual Report,
at 37 (Dec. 16, 2022), https://home.treasury.gov/system/files/261/FSOC2022AnnualReport.pdf.
\39\ The Financial Stability Board, Effective Practices for
Cyber Incident Response and Recovery, at 1 (Oct. 19, 2020), https://www.fsb.org/wp-content/uploads/P191020-1.pdf.
\40\ The Board of The International Organization of Securities
Commissions, Cyber Task Force: Final Report, at 3 (June 19, 2019),
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD633.pdf.
\41\ The Board of The International Organization of Securities
Commissions, Policy Recommendations for Crypto and Digital Asset
Markets Consultation Report, at 39 (Nov. 16, 2023), https://www.iosco.org/library/pubdocs/pdf/IOSCOPD747.pdf.
---------------------------------------------------------------------------
Next Steps for Derivatives Clearing Organizations
At the MRAC meeting this past Monday, I announced a new
workstream for the CCP Risk and Governance subcommittee that will
focus on third-party risk for central clearing counterparties. Work
will begin imminently, with the goal of presenting a proposal for
[[Page 4765]]
vote by the parent committee in the first quarter of 2024. DCOs
already retain responsibility for meeting regulatory requirements
when entering into contractual outsourcing arrangements; \42\ the
question now is how DCOs should be required to assess and monitor
the risks associated with doing so.
---------------------------------------------------------------------------
\42\ 17 CFR 39.18(d) (2022) (providing that registered entities
such as DCOs retain responsibility for meeting relevant regulatory
requirements when entering into contractual outsourcing
arrangements).
---------------------------------------------------------------------------
Such a rule should in my view broadly track the rule for FCMs
and swap entities proposed today, but deep consideration must be
given to the ways in which the core DCO business differs. For
example, DCOs already occupy a quasi-oversight role with respect to
their clearing members; should a rule on third-party risk require
DCOs to consider not only the risk posed by their own outsourcing
contracts, but also require that DCOs consider their clearing
members' third-party risks, perhaps as an aspect of a DCO's
assessment of its counterparty risk? How else might the rule differ
given the disparity between DCOs' and FCMs' relative frequency of
interaction with end users? How might these rules coordinate with
prudential regulators?
A cyberattack on a third party that affected FCMs last winter
was already disruptive enough, but given their status as SIFMUs some
DCOs are quite literally systemically important entities. DCOs serve
irreplaceable market functions, and we need update their operational
resilience requirements to take into account this new conception of
third-party risk. I look forward to the new MRAC workstream diving
into this critical issue, and of course to what Division of Clearing
and Risk staff might bring forward in an eventual proposed
rulemaking.
I once again commend the staff of MPD on their tremendous effort
bringing forth this proposed rule, and look forward to hearing the
thoughts of my fellow Commissioners.
Appendix 4--Statement of Commissioner Christy Goldsmith Romero
Today we have before us our first proposed cyber and operational
resilience rule that would apply to swap dealers (including banks)
and futures commission merchants (FCMs). I'm excited to see the
proposed rule up for vote today. I support the rule and thank the
staff for their more than one year of hard work. I also thank all
who engaged with us in an extensive collaborative effort. I also
thank Chairman Behnam for entrusting me to help with this rule.
This is a critical rule for the CFTC. FBI Director Christopher
Wray recently said ``that today's cyber threats are more pervasive,
hit a wider array of victims, and carry the potential for greater
damage than ever before'' and we face ``some of our most complex,
most severe, and most rapidly evolving threats.'' \1\ This rule
proposes to help advance our markets from a mentality of incident
response to one of cyber resilience. This would further President
Biden's White House National Cybersecurity Strategy and Executive
Order on Improving the Nation's Cybersecurity.\2\
---------------------------------------------------------------------------
\1\ See FBI, Director Wray's Remarks at the Mandiant/mWISE 2023
Cybersecurity Conference (Sept. 18, 2023).
\2\ The E.O.'s policy statement of policy is ``Protecting our
Nation from malicious cyber actors requires the Federal Government
to partner with the private sector. The private sector must adapt to
the continuously changing threat environment, ensure its products
are built and operate securely, and partner with the Federal
Government to foster a more secure cyberspace. In the end, the trust
we place in our digital infrastructure should be proportional to how
trustworthy and transparent that infrastructure is, and to the
consequences we will incur if that trust is misplaced.'' The White
House, Executive Order on Improving the Nation's Cybersecurity (May
12, 2021).
---------------------------------------------------------------------------
Cyber resilience is one of my top priorities, and a critical
issue on which I am engaged. Over the last year, the CFTC staff and
I have been engaged with the White House, other financial
regulators, the Department of Commerce's National Institute of
Standards and Technology (NIST), the National Futures Association
(NFA), swap dealers, FCMs, trade groups like the Futures Industry
Association, the International Swaps and Derivatives Association,
and the Securities Industry and Financial Markets Association,
public interest groups, and third-party vendors. I also sponsor the
Technology Advisory Committee that covers cybersecurity, and has a
dedicated Cybersecurity subcommittee stacked with well-regarded
cybersecurity experts.\3\
---------------------------------------------------------------------------
\3\ See CFTC, Commissioner Goldsmith Romero Announces Technology
Advisory Committee Subcommittee Co-Chairs and Members (July 14,
2023); see also CFTC Technology Advisory Committee July 18 Meeting
(July 18, 2023); CFTC Technology Advisory Committee March 22 Meeting
(March 22, 2023).
---------------------------------------------------------------------------
It takes this type of collective public and private engagement
to thwart cybercrime, stay ahead of the continuously changing
threat, and protect our nation's critical infrastructure. Director
Wray has spoken about how malicious cyber actors seeking to cause
destruction are working to hit us somewhere that's going to hurt--
U.S. critical infrastructure sectors.\4\ According to the FBI, in
2021, there were ransomware incidents against 14 of the 16 U.S.
critical infrastructure sectors.\5\ That includes an attack on
Colonial Pipeline that led to gas shortages, and an attack on the
world's largest meat supplier JBS, that led to meat shortages and
spiking prices.\6\
---------------------------------------------------------------------------
\4\ See FBI, Director's Remarks to the Boston Conference on
Cyber Security 2022 (June 1, 2022).
\5\ See FBI, FBI Partnering with the Private Sector to Counter
the Cyber Threat, Remarks at the Detroit Economic Club (Mar. 22,
2022).
\6\ See Id. (discussing how an attack led to Colonial shutting
down pipeline operations and a panic among people in the Southeast
that led to a run on gas and how an attack on JBS resulted in a
complete stoppage of meat production, leading to spiking prices and
less availability of meat).
---------------------------------------------------------------------------
As Director Wray has said, ``ransomware gangs love to go after
things we can't do without.'' \7\ Our nation cannot do without the
commercial agriculture, energy, metals, and financial markets, on
which derivatives markets are based.
---------------------------------------------------------------------------
\7\ See FBI, Director's Remarks to the Boston Conference on
Cyber Security 2022 (June 1, 2022).
---------------------------------------------------------------------------
In June, I presented five key pillars of cyber resilience,
pillars that are contained in the proposed rule: \8\
---------------------------------------------------------------------------
\8\ Commissioner Christy Goldsmith Romero, Advancing from
Incident Response to Cyber Resilience, (June 20, 2023).
---------------------------------------------------------------------------
1. A proportionate and appropriate approach;
2. Following generally accepted standards and best practices;
3. Elevating responsibility through governance;
4. Building resilience to third-party risk; and
5. Leveraging the important work already done in this space,
including by prudential regulators and NFA.
Taking a Proportionate and Appropriate Approach
There is no one-size fits all approach. The proposed rule would
require swap dealers and FCMs to ensure that their operational
resilience programs are appropriate and proportionate to the nature
and risk profile of their business. This follows the White House
National Cybersecurity Strategy.\9\ Our swap dealers include
Globally Systemically Important Banks (GSIBs). Additionally, some of
our swap dealers and FCMs are involved in U.S. critical
infrastructure such as in the energy or agricultural sectors, or in
supply chains.
---------------------------------------------------------------------------
\9\ See The White House, National Cybersecurity Strategy (March
2023) (recommending that organizations ``demonstrate a principles-
based approach that is sufficiently nimble to adapt to meet the
challenges of the ever-evolving technological threat landscape and
to fit the unique business and risk profile of each individual
covered entity.''
---------------------------------------------------------------------------
FBI Director Wray testified before Congress this month that one
of the most worrisome facets of state-sponsored adversaries is their
focus on compromising U.S. critical infrastructure, especially
during a crisis, and that there is often no bright line that
separates where nation state activity ends and cybercriminal
activity begins.\10\ He testified about the disruptive impact of a
supply chain attack in the SolarWinds attack, conducted by the
Russian Foreign Intelligence Service.\11\ This summer, Director Wray
said that the FBI is seeing the effects of Russia's invasion of
Ukraine here at home, as the FBI has seen Russia conducting
reconnaissance on the U.S. energy sector.\12\
---------------------------------------------------------------------------
\10\ See FBI, Statement of Christopher A. Wray Director Federal
Bureau of Investigation Before the Committee on the Judiciary United
States Senate (Dec. 5, 2023).
\11\ See Id.
\12\ See FBI, Director Wray's Remarks at the FBI Atlanta Cyber
Threat Summit (July 26, 2023).
---------------------------------------------------------------------------
Director Wray also has said that, ``China operates on a scale
Russia doesn't come close to. They've got a bigger hacking program
than all other major nations combined. They've stolen more American
personal and corporate data than all nations combined.'' \13\
Director Wray has said that ``the Chinese government has hacked more
than a dozen U.S. oil and gas pipeline operators, not just stealing
their
[[Page 4766]]
information, but holding them, and all of us, at risk.'' \14\ Swap
dealers and FCMs involved in critical infrastructure sectors will
need to build resilience for these cyber threats.
---------------------------------------------------------------------------
\13\ See FBI, Director's Remarks to the Boston Conference on
Cyber Security 2022 (June 1, 2022).
\14\ See FBI, FBI Partnering with the Private Sector to Counter
the Cyber Threat, Remarks at the Detroit Economic Club (Mar. 22,
2022).
---------------------------------------------------------------------------
The proposal also recognizes that cyber resilience requires
continuous attention. What is appropriate or proportionate may
change with the changing threat vector. It may also change when a
swap dealer or FCM enters a new line of business, onboards a new
vendor, or takes other action that can carry cyber risk.
Following Generally Accepted Standards and Practices
The proposal, like the CFTC's rules for exchanges and
clearinghouses, would require swap dealers and FCMs to follow
generally accepted standards and industry best practices, like NIST
or ISO (for international companies). The NIST Cybersecurity
Framework creates a clear set of cybersecurity expectations that are
risk-and outcome-based rather than prescriptive, and adaptable to
the size and types of businesses.\15\ These standards are regularly
updated to reflect the evolving technology and threat landscape. The
proposed rule also requires at least annual assessment, testing and
updates to the operational resilience framework.
---------------------------------------------------------------------------
\15\ See Presentation of Kevin Stine, Chief of the Applied
Security Division at NIST Information Technology Laboratory,
``Managing Cybersecurity Risks,'' CFTC Technology Advisory Committee
Meeting (March 22, 2023).
---------------------------------------------------------------------------
Elevating Responsibility Through Governance
The vision of the Biden Administration's National Cybersecurity
Strategy is to rebalance the responsibility to defend cyberspace by
shifting the burden for cybersecurity away from individuals and
small businesses, and onto the organizations that are most capable
and best positioned to reduce risks.\16\ This strategy gets away
from vulnerability caused by one person in an organization clicking
on the wrong thing that leads to total disruption. The banks and
commodity firms this rule would apply to are capable and best
positioned to reduce cyber risk and cybercrime losses.
---------------------------------------------------------------------------
\16\ See The White House, National Cybersecurity Strategy (March
2023).
---------------------------------------------------------------------------
Building cyber resilience requires elevating responsibility to
those who make strategic decisions about the business. The stakes
for businesses are high. There is potential legal risk, reputational
risk, risk to national security, as well as financial risk. In 2022,
the FBI reported $10.3 billion in cybercrime losses, shattering the
record from the prior year.\17\ Tone at the top, including the C-
suite's active participation in cyber resilience programs as well as
making cyber resilience a top priority, can determine whether an
organization will successfully be cyber resilient and operationally
resilient.
---------------------------------------------------------------------------
\17\ FBI, Internet Crime Report 2022 (March 22, 2023).
---------------------------------------------------------------------------
The proposed rule would require operational resilience plans to
be approved annually by a senior leader and for incidents to be
escalated promptly. It also would require senior leaders to set and
approve the firm's risk appetite and risk tolerance limit. Leaders
should make strategic decisions about the risk they are willing to
take on, as well as the metrics they will monitor. I am interested
in hearing if the proposal's definitions of these terms set a clear
expectation and align with generally accepted standards.
Building Resilience to Third-Party Risk
Swap dealers and FCMs routinely rely upon third party (as well
as fourth party) service providers to access new technologies and
expertise, and for efficiencies in business functions. The rule
requires building resilience to third party risk, an issue brought
sharply into focus with this year's cyber-attack on third-party
vendor ION Markets.
Because third parties create points of entry that need to be
secured from cyber criminals, the banking regulators released
updated interagency guidance on third party risk management that
would apply to many of the swap dealers subject to the proposed
rule.\18\ The staff and I met with the Federal Reserve, Federal
Deposit Insurance Corporation, and the Office of the Comptroller of
the Currency about their guidance and their efforts to promote cyber
resilience. Like that interagency guidance, the proposed rule
includes an inventory of all third-party service providers,
assessments of risk throughout the lifecycle of the third-party
relationship, the identification of critical third-parties, and
subjects those critical third parties to heightened due diligence
and monitoring.
---------------------------------------------------------------------------
\18\ Board of Governors of the Federal Reserve System, Federal
Deposit Insurance Corporation, and Office of the Comptroller of the
Currency, Interagency Guidance on Third Party Relationships: Risk
Management (Jun. 6, 2023).
---------------------------------------------------------------------------
The proposed definition of who is a critical third-party service
provider takes a flexible approach, asking entities to consider the
impact of a disruption.\19\ At his TAC presentation, Todd Conklin,
Deputy Assistant Secretary of Treasury's Office of Cybersecurity and
Critical Infrastructure Protection (OCCIP) and TAC member discussed
how ION Markets received less scrutiny because it was not treated as
a critical third-party vendor by most firms.\20\ I look forward to
comment.
---------------------------------------------------------------------------
\19\ I heard from many banks and brokers that identifying who is
a critical third-party service provider is an issue they regularly
grapple with, and that it often comes down to specific facts and
circumstances, and not just the products and service they provide.
\20\ See Presentation of Todd Conklin, Deputy Assistant
Secretary of Treasury's Office of Cybersecurity and Critical
Infrastructure Protection (OCCIP), ``The Cyber Threat Landscape for
Financial Markets: Lessons Learned from ION Markets, Cloud Use in
Financial Services, and Beyond,'' CFTC Technology Advisory Committee
Meeting (March 22, 2023) (``many institutions didn't even classify
[ION Markets] necessarily as a `critical' third-party vendor. So
many firms who onboarded ION didn't use the highest-level scrutiny
that they use for their most critical third-party vendors.'').
---------------------------------------------------------------------------
The CFTC also proposes separate guidance on managing third-party
risks. I am interested in commenters' views on this guidance, and
whether we have it right for harmonization.
Leveraging the Important Work of Others, Including Prudential
Regulators and the NFA
The White House's 2023 Cybersecurity Strategy recommends
organizations ``harmonize where sensible and appropriate to achieve
better outcomes.'' \21\ The proposal recognizes that many of our
regulated entities are part of a larger enterprise, with cyber and
operational resilience programs managed at the enterprise level, and
can use those programs under this rule. I am interested in
commenters' views on whether we have achieved appropriate
harmonization or whether we need greater harmonization with bank
regulators' rules and guidance and NFA guidance.\22\
---------------------------------------------------------------------------
\21\ See The White House, National Cybersecurity Strategy,
(March 2023).
\22\ These requirements and guidance include the prudential
regulator's Sound Practices to Strengthen Operational Resilience
paper, the Interagency Guidelines Establishing Standards for
Safeguard Customer Information, and the recently released
Interagency Guidance on Third-Party Relationships: Risk Management,
as well as NFA guidance on information security, third-party service
provider risk management, and notification of regulators and
business continuity and disaster recovery.
---------------------------------------------------------------------------
Stronger Together
We are stronger together. The CFTC is part of coordinated
government efforts to learn about and disseminate information about
emerging cyber threats. We want to work with our swap dealers and
FCMs to help strengthen their operational resilience, especially
prior to any disruptive event.
Should a disruptive event occur, resilience requires rapid
collaboration among the CFTC and all those who are potentially
affected to contain any potential damage and to keep critical market
functions running. The proposed rule includes specific requirements
for notifying the CFTC of an incident as soon as possible, but no
later than 24 hours after detection. I support immediate
notification to the CFTC because if we know, we can work with
regulated entities and markets to assess and minimize damage,
trigger appropriate regulatory and law enforcement action, help in
recovery, and protect customers. I note that this time frame and
reporting standards differs from other regulators, and look forward
to comment.
A two-way flow of information can play a significant role in the
ability to build resilience, which means the ability to recover
quickly after an attack. According to Deputy Assistant Secretary
Conklin, collaboration between the government and industry helped
mitigate the impact of the ION Markets attack.\23\ The proposal
would also require notification to customers and counterparties as
soon as possible of attacks that affect them. Early notice helps
minimize the impact of an
[[Page 4767]]
attack by allowing them to secure their personal data, monitor
affected accounts, and make alternative arrangements for accessing
critical funds or markets.
---------------------------------------------------------------------------
\23\ See Presentation of Todd Conklin, Deputy Assistant
Secretary of Treasury's Office of Cybersecurity and Critical
Infrastructure Protection (OCCIP), ``The Cyber Threat Landscape for
Financial Markets: Lessons Learned from ION Markets, Cloud Use in
Financial Services, and Beyond,'' CFTC Technology Advisory Committee
Meeting (Mar. 22, 2023).
---------------------------------------------------------------------------
If we can all work together, we can harden our defenses, thwart
cyber criminals, and protect critical U.S. infrastructure and
national security. Together, we can build a safer and more resilient
cyberspace.
Appendix 5--Statement of Commissioner Caroline D. Pham
I support the Notice of Proposed Rulemaking on Operational
Resilience Framework for Futures Commission Merchants, Swap Dealers,
and Major Swap Participants (Operational Resilience Proposal) \1\
because I believe this approach is largely consistent with
international standards for operational resilience, as well as U.S.
prudential regulations and non-U.S. regulations, which have been
implemented for several years now. I thank the staff of the Market
Participants Division (MPD), especially Pamela Geraghty, Elise
Bruntel, and Amanda Olear, as well as Chairman Behnam and
Commissioner Goldsmith Romero, for working with me over the past
year to address my concerns.
---------------------------------------------------------------------------
\1\ Because there are no registered major swap participants, as
a practical matter, this statement will refer to swap dealers and
futures commission merchants (FCMs).
---------------------------------------------------------------------------
Background
My discussions with MPD staff, formerly the Division of Swap
Dealer and Intermediary Oversight (DSIO), in fact date back to 2016
when I was in the private sector. MPD staff have been considering
many of the elements of an operational resilience framework for
years, including operational risk and cybersecurity risk. I
appreciate the staff's focus on all of these important issues that
contribute to ensuring that our registrants have robust risk
management and compliance programs, and that the CFTC is doing our
job to uphold financial stability and protect against systemic risk.
I would like to mention my background and experience, as well as
familiarity, with the subject areas covered by the Operational
Resilience Proposal to provide context for my efforts to support the
development of this Proposal and address my concerns that the CFTC's
approach should not be overly prescriptive and generally takes a
principles-based approach in recognition of the extensive years-long
global implementation of operational resilience requirements by U.S.
and non-U.S. regulators and banking organizations.
In my previous roles at a global systemically important bank
(GSIB), I have been involved with operational resilience since 2019,
including the oversight and coordination of global regulatory
advocacy with the Financial Stability Board (FSB) and regulatory
authorities such as the U.S. prudential regulators,\2\ the Bank of
England, and European Union (EU) authorities. I also was on the
enterprise-wide operational resilience program steering committee,
and I have implemented enterprise-wide programs across a global
financial institution across all regions and both institutional or
wholesale and consumer businesses.
---------------------------------------------------------------------------
\2\ U.S. prudential regulators refers to the Board of Governors
of the Federal Reserve System (Fed), the Office of the Comptroller
of the Currency (OCC), and the Federal Deposit Insurance Corporation
(FDIC).
---------------------------------------------------------------------------
Among the specific elements encompassed in the Operational
Resilience Proposal, I have enhanced the swap dealer and futures
commission merchant (FCM) risk management programs. I have drafted
an enterprise-wide risk appetite statement. I have implemented the
National Futures Association's (NFA) update to its information
systems security programs requirements, which addresses
cybersecurity risk. I have participated in tabletop exercises,
drills, and simulations of responses to cyber attacks. I was the
lead from the Compliance department on the third-party risk
management program for cross-asset activities or other programmatic
aspects across the global markets business. I have enhanced the
business continuity and disaster recovery (BCDR) swap dealer
policies and procedures and integration with the enterprise-wide
continuity of business program. I have delivered training for,
respectively, 9,000 and 17,000 employees across nearly 100 countries
and multiple languages. I have had a compliance monitoring team that
reported directly to me. I have advised on the design and
implementation of the enterprise-wide Volcker Rule independent
testing program. I was part of global regulatory notification
protocols for cybersecurity or other incidents. And also, of course,
I have been subject to regulatory examinations on each one of these
areas. This practical experience has informed my engagement on this
significant rulemaking initiative.
The CFTC's Approach to Operational Resilience Must Be Consistent With
International Standards and Prudential Regulations
I am pleased that the CFTC is seeking an approach that is
consistent with international standards and best practices for
regulators in addressing operational resilience. I will reiterate my
previous remarks on the many years of work by policymakers such as
the FSB, the Basel Committee on Banking Supervision (BCBS), the
International Organization of Securities Commissions (IOSCO), and
other regulatory authorities around the world to implement laws,
regulations, and standards for operational resilience. Operational
resilience, as noted by U.S. prudential regulators in 2020,
encompasses governance, operational risk management, business
continuity management, third-party risk management, scenario
analysis, secure and resilient information system management,
surveillance and reporting, and cyber risk management. Regulated
entities, including the vast majority of our swap dealers and FCMs
that are part of banking organizations, have already implemented
comprehensive enterprise-wide operational resilience programs.\3\
---------------------------------------------------------------------------
\3\ Opening Statement of Commissioner Caroline D. Pham before
the Technology Advisory Committee, U.S. Commodity Futures Trading
Commission (Jul. 18, 2023), https://www.cftc.gov/PressRoom/SpeechesTestimony/phamstatement071823.
---------------------------------------------------------------------------
Issuing this Proposal can be beneficial to initiate an open
process to request information and stimulate dialogue with the
public. That is why, although there has been some hesitation or
trepidation around what the Commission might do since we are coming
onto the tail end of operational resilience implementation globally,
I do think it is important that we are taking this step today,
because it is critical that the public has the opportunity to
provide input on any amendment or expansion of our existing
programmatic requirements that is informed by actual experience from
risk management and compliance officers, other control functions,
and practitioners who have implemented and complied with operational
resilience requirements pursuant to other regulations.
Further, as I have noted previously, because the CFTC's rules
are often only one part of a much broader risk governance framework
for financial institutions, the Commission must ensure that it has
the full picture before coming to conclusions to ensure that our
rules not only address any potential regulatory gaps or changes in
risk profiles, but also to avoid issuing rules that are conflicting,
duplicative, or unworkable with other regulatory regimes.\4\
---------------------------------------------------------------------------
\4\ Statement of Commissioner Caroline D. Pham on Risk
Management Program for Swap Dealers and Futures Commission Merchants
Advance Notice of Proposed Rulemaking, U.S. Commodity Futures
Trading Commission (Jun. 1, 2023), https://www.cftc.gov/PressRoom/SpeechesTestimony/phamstatement060123.
---------------------------------------------------------------------------
For example, when I last checked earlier this year, the CFTC
currently has 106 provisionally registered swap dealers. Of these
106 entities, both U.S. and non-U.S., all but a handful are also
registered with and supervised by another agency or authority, such
as a prudential, functional, or market regulator. Most of these swap
dealers are subject to three or more regulatory regimes.\5\
---------------------------------------------------------------------------
\5\ Id.
---------------------------------------------------------------------------
It is imperative that the Commission and the staff consider how
our rules work in practice together with the rules of other
regulators, whether foreign or domestic. This key point is easily
apparent in looking at the CFTC's substituted compliance regime for
non-U.S. swap dealers, where the Commission has expressly found that
non-U.S. swap dealers in certain jurisdictions are subject to
comparable and comprehensive regulation, and therefore, our rules
permit such non-U.S. swap dealers to, for example, substitute
compliance with their home jurisdiction risk management regulations
to satisfy our risk management program rules under CFTC Regulation
23.600.\6\
---------------------------------------------------------------------------
\6\ Id.
---------------------------------------------------------------------------
Specific Areas for Public Comment
As a preliminary matter, regarding discussion of the CFTC's
approach to system safeguards requirements for designated contract
markets (DCMs) and derivatives clearing organizations (DCOs) and its
impact on the development of today's Operational Resilience
Proposal, I note that swap dealers
[[Page 4768]]
and FCMs are very different from exchanges and clearinghouses. The
CFTC should not overly rely upon its approach to the system
safeguards rulesets because it is akin to the difference between,
for example, the Securities and Exchange Commission's (SEC)
Regulation SCI and the U.S. prudential regulators' Heightened
Standards for Risk Governance. I believe that the staff has tried to
balance these considerations, and I welcome public comment on this
approach.
Definitions
Words matter, and it is very important for the Commission to be
precise in the words that we use for defined terms. I encourage all
commenters to review the Proposal's definitions and advise whether
the definitions are appropriate or need to be revised.
Third-Party Relationship Program Guidance
The Operational Resilience Proposal includes an appendix to the
rule text with more prescriptive guidance on third-party
relationships (third-party risk management). This is unusual because
I do not believe that the CFTC has this level of prescriptiveness
for any other category of risk, such as credit risk. I question
whether this heralds a change to the CFTC's approach to setting
forth risk management requirements, and why would the Commission
issue prescriptive guidance for third-party risk, but not other
risks such as operational risk or market risk.
I also question the approach of issuing Commission guidance,
which would have to undergo notice-and-comment rulemaking and that
could take a year or two to update, instead of issuing staff
guidance, which could be updated more flexibly. I believe that any
prescriptive guidance would be more appropriate as staff guidance,
not Commission guidance, because staff guidance can be kept up-to-
date more easily to address changes in best practices or to adapt to
emerging risks. This is similar to how, for example, U.S. prudential
regulators update their bank examiners handbook or circulars.
I am interested in public comment on the CFTC's requirements for
third-party risk management, and whether it should be issued as
Commission guidance or staff guidance.
Risk Appetite
The Operational Resilience Proposal refers to risk appetite,
which is a new concept to CFTC regulations. I am interested in
whether commenters believe risk appetite is workable under the
CFTC's regulatory framework, which is focused on enforcement rather
than ongoing supervision. Indeed, I have repeatedly noted that the
CFTC lacks a swap dealer examination program. As a consequence, non-
material operational or technical issues are the subject of
enforcement actions, rather than addressed more appropriately
through supervisory findings and exam reports like every other
regulatory authority in the world. This makes the CFTC an outlier
amongst U.S. and non-U.S. regulators, and therefore prudential
concepts like risk appetite may not be workable.
Risk Tolerance Limits
Risk tolerance limits are a requirement under the CFTC's risk
management program (RMP) rules for swap dealers and FCMs. The
Operational Resilience Proposal also requires risk tolerance limits,
but sets forth a different definition and does not refer to the risk
tolerance limits under the RMP rules. I am interested in public
comment on whether the two differing requirements may cause
confusion or can be implemented without any issues.
Annual Attestation
The Operational Resilience Proposal requires an annual
attestation by the senior officer, an oversight body, or a senior-
level official of a swap dealer or FCM that relies on a consolidated
operational resilience program. Such attestation is to the effect
that the consolidated program meets CFTC requirements and reflects
the risk appetite and risk tolerance limits appropriate to the swap
dealer or FCM. I encourage commenters to discuss the attestation
requirement and suggest appropriate attestation language.
Substituted Compliance
Under the Operational Resilience Proposal, substituted
compliance would be available for non-U.S. swap dealers subject to a
comparability determination issued by the Commission. I appreciate
the recognition in the Proposal of the importance of a home-host
regulator approach to maintaining regulatory cohesion and addressing
systemic risk and financial stability. I am interested in whether
commenters believe the Proposal presents any cross-border issues in
implementation.
Conclusion
I believe in continuous improvement for not only our market
participants, but also for the Commission and its regulations, and
that is why I would like to thank the MPD staff again for being
proactive in thinking about these issues. I want to particularly
recognize the leadership of Commissioner Goldsmith Romero in first
highlighting these risks and exploring ways to address them through
the work of the CFTC's Technology Advisory Committee, which she
sponsors.
As I have stated before, the benefit of the CFTC's principles-
based regulatory framework is that it can quickly anticipate and
adapt to changes in risk profiles or the operating environment. That
is why I believe our rules must be broad and flexible enough to be
forward-looking and evergreen, because it is simply not possible to
prescribe every last requirement for the unknown future. Consistent
with international standards, I have discussed the importance of
utilizing existing risk governance frameworks and risk management
disciplines to identify, measure, monitor, and control emerging
risks and new technologies. Swap dealers and FCMs must be vigilant
and address new and emerging risks through various risk stripes as
appropriate, whether from changing market conditions, technological
developments, geopolitical concerns, or any other event, and
maintain operational resilience.
With that, I welcome the input from the public comments to
inform the Commission and the staff regarding the application of the
Operational Resilience Proposal to swap dealers and FCMs, especially
those entities that are part of a banking organization and have
already implemented operational resilience requirements pursuant to
U.S. or non-U.S. regulations.
[FR Doc. 2023-28745 Filed 1-23-24; 8:45 am]
BILLING CODE 6351-01-P
