[Federal Register Volume 89, Number 16 (Wednesday, January 24, 2024)]
[Proposed Rules]
[Pages 4706-4768]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-28745]



[[Page 4705]]

Vol. 89

Wednesday,

No. 16

January 24, 2024

Part III





 Commodity Futures Trading Commission





-----------------------------------------------------------------------





17 CFR Parts 1 and 23





Operational Resilience Framework for Futures Commission Merchants, Swap 
Dealers, and Major Swap Participants; Proposed Rule

  Federal Register / Vol. 89 , No. 16 / Wednesday, January 24, 2024 / 
Proposed Rules  

[[Page 4706]]


-----------------------------------------------------------------------

COMMODITY FUTURES TRADING COMMISSION

17 CFR Parts 1 and 23

RIN 3038-AF23


Operational Resilience Framework for Futures Commission 
Merchants, Swap Dealers, and Major Swap Participants

AGENCY: Commodity Futures Trading Commission.

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: The Commodity Futures Trading Commission (CFTC or Commission) 
is proposing to require that futures commission merchants, swap 
dealers, and major swap participants establish, document, implement, 
and maintain an Operational Resilience Framework reasonably designed to 
identify, monitor, manage, and assess risks relating to information and 
technology security, third-party relationships, and emergencies or 
other significant disruptions to normal business operations. The 
framework would include three components--an information and technology 
security program, a third-party relationship program, and a business 
continuity and disaster recovery plan--supported by broad requirements 
relating to governance, training, testing, and recordkeeping. The 
proposed rule would also require certain notifications to the 
Commission and customers or counterparties. The Commission is further 
proposing guidance relating to the management of risks stemming from 
third-party relationships.

DATES: Comments must be received on or before March 2, 2024.

ADDRESSES: You may submit comments, identified by RIN number 3038-AF23, 
by any of the following methods:
     CFTC Comments Portal: https://comments.cftc.gov. Select 
the ``Submit Comments'' link for this rulemaking and follow the 
instructions on the Public Comment Form.
     Mail: Christopher Kirkpatrick, Secretary of the 
Commission, Commodity Futures Trading Commission, Three Lafayette 
Centre, 1155 21st Street NW, Washington, DC 20581.
     Hand Delivery/Courier: Follow the same instructions as for 
Mail, above.
    Please submit your comments using only one of these methods. 
Submissions through the CFTC Comments Portal are encouraged.
    All comments must be submitted in English, or if not, accompanied 
by an English translation. Comments will be posted as received to 
https://comments.cftc.gov. You should submit only information that you 
wish to make available publicly. If you wish the Commission to consider 
information that you believe is exempt from disclosure under the 
Freedom of Information Act (FOIA), a petition for confidential 
treatment of the exempt information may be submitted according to the 
procedures established in Commission regulation 145.9.\1\
---------------------------------------------------------------------------

    \1\ 17 CFR 145.9. The Commission's regulations are found at 17 
CFR chapter I (2022).
---------------------------------------------------------------------------

    The Commission reserves the right, but shall have no obligation, to 
review, pre-screen, filter, redact, refuse or remove any or all of your 
submission from https://comments.cftc.gov that it may deem to be 
inappropriate for publication, such as obscene language. All 
submissions that have been redacted or removed that contain comments on 
the merits of the rulemaking will be retained in the public comment 
file and will be considered as required under the Administrative 
Procedure Act and other applicable laws, and may be accessible under 
the FOIA.

FOR FURTHER INFORMATION CONTACT: Amanda L. Olear, Director, at 202-418-
5283 or [email protected]; Pamela Geraghty, Deputy Director, at 202-418-
5634 or [email protected]; Fern Simmons, Associate Director, at 202-
418-5901 or [email protected]; Elise Bruntel, Special Counsel, at 202-
418-5577 or [email protected]; Market Participants Division, Commodity 
Futures Trading Commission, Three Lafayette Centre, 1151 21st Street 
NW, Washington, DC 20581.

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Introduction
II. Proposal
    A. Generally--Proposed Paragraph (b)
    1. Purpose and Scope; Components--Proposed Paragraphs (b)(1) and 
(b)(2)
    2. Standard--Proposed Paragraph (b)(3)
    3. Request for Comment
    B. Governance--Proposed Paragraph (c)
    1. Approval of Components--Proposed Paragraph (c)(1)
    2. Risk Appetite and Risk Tolerance Limits--Proposed Paragraph 
(c)(2)
    3. Internal Escalations--Proposed Paragraph (c)(3)
    4. Consolidated Program or Plan--Proposed Paragraph (c)(4)
    5. Request for Comment
    C. Information and Technology Security Program--Proposed 
Paragraph (d)
    1. Risk Assessment--Proposed Paragraph (d)(1)
    2. Effective Controls--Proposed Paragraph (d)(2)
    3. Incident Response Plan--Proposed Paragraph (d)(3)
    4. Request for Comment
    D. Third-Party Relationship Program--Proposed Paragraph (e)
    1. Third-Party Relationship Lifecyle Stages--Proposed Paragraph 
(e)(1)
    2. Heightened Requirements for Critical Third-Party Service 
Providers--Proposed Paragraph (e)(2)
    3. Third-Party Service Provider Inventory--Proposed Paragraph 
(e)(3)
    4. Retention of Responsibility--Proposed Paragraph (e)(3)
    5. Application to Existing Third-Party Relationships
    6. Guidance on Third-Party Relationship Programs--Proposed 
Paragraph (e)(4); Appendix A to Part 1; Appendix A to Subpart J of 
Part 23
    7. Request for Comment
    E. Business Continuity and Disaster Recovery Plan--Proposed 
Paragraph (f)
    1. Definition of ``Business Continuity and Disaster Recovery 
Plan''
    2. Purpose--Proposed Paragraph (f)(1)
    3. Minimum Contents--Proposed Paragraph (f)(2)
    4. Accessibility--Proposed Paragraph (f)(3)
    5. Request for Comment
    F. Training and Distribution--Proposed Paragraph (g)
    G. Review and Testing--Proposed Paragraph (h)
    1. Reviews--Proposed Paragraph (h)(1)
    2. Testing--Proposed Paragraph (h)(2)
    3. Independence--Proposed Paragraph (h)(3)
    4. Documentation--Proposed Paragraph (h)(4)
    5. Internal Reporting--Proposed Paragraph (h)(5)
    6. Request for Comment
    H. Required Notifications--Proposed Paragraphs (i) and (j)
    1. Commission Notification of Incidents--Proposed Paragraph 
(i)(1)
    2. Commission Notification of BCDR Plan Activation--Proposed 
Paragraph (i)(2)
    3. Notifications to Customers or Counterparties--Proposed 
Paragraph (j)
    4. Request for Comment
    I. Amendment and Expansion of Other Provisions in Current 
Commission Regulation 23.603
    1. Emergency Contacts--Proposed Paragraph (k)
    2. Recordkeeping--Proposed Paragraph (l)
    3. Request for Comment
    J. Cross-Border Application for Swap Entities
    K. Implementation Period
III. Related Matters
    A. Regulatory Flexibility Act
    B. Paperwork Reduction Act
    C. Cost-Benefit Considerations
    D. Antitrust Laws

I. Introduction

    In 2012 and 2013, the Commission adopted rules requiring that 
futures commission merchants (FCMs),\2\ swap dealers (SDs) \3\ and 
major swap

[[Page 4707]]

participants (MSPs) \4\ establish risk management programs (RMPs).\5\ 
The rules require that SDs and MSPs (together, swap entities) and FCMs 
design their RMPs to monitor and manage the risks associated with their 
activities as swap entities or FCMs.\6\ Such risks include, but are not 
limited to, market, credit, liquidity, segregation, settlement, 
capital, and operational risk.\7\ Taken together, the RMP rules support 
a unified Commission objective: to require FCMs and swap entities 
(collectively, covered entities) to establish comprehensive risk 
management practices to mitigate systemic risk and promote customer 
protection.\8\ Recognizing that covered entities vary in size and 
complexity, the RMP rules identify certain elements that must, at a 
minimum, be included as part of the RMP, and require that certain risks 
must be taken into account; but the rules otherwise allow covered 
entities flexibility to design RMPs tailored to their circumstances and 
organizational structures.\9\
---------------------------------------------------------------------------

    \2\ See 7 U.S.C. 1a(28), 17 CFR 1.3 (defining ``futures 
commission merchant'').
    \3\ See 7 U.S.C. 1a(49), 17 CFR 1.3 (defining ``swap dealer'').
    \4\ See 7 U.S.C. 1a(33), 17 CFR 1.3 (defining ``major swap 
participant'').''
    \5\ See 17 CFR 1.11; 17 CFR 23.600; Enhancing Protections 
Afforded Customers and Customer Funds Held by Futures Commission 
Merchants and Derivatives Clearing Organizations, 78 FR 68506 (Nov. 
14, 2013) (Final FCM RMP Rule); Swap Dealer and Major Swap 
Participant Recordkeeping, Reporting, and Duties Rules; Futures 
Commission Merchant and Introducing Broker Conflicts of Interest 
Rules; and Chief Compliance Officer Rules for Swap Dealers, Major 
Swap Participants, and Futures Commission Merchants, 77 FR 20128 
(Apr. 3, 2012) (Final Swap Entities RMP Rule).
    \6\ See 17 CFR 1.11(c); 17 CFR 23.600(b). The RMP rule for FCMs 
does not apply to FCMs that do not accept or hold customer assets. 
See 17 CFR 1.11(a).
    \7\ See 17 CFR 1.11(e); 17 CFR 23.600(c).
    \8\ See Final Swap Entities RMP Rule, 77 FR at 20128; Final FCM 
RMP Rule, 78 FR 68506.
    \9\ See, e.g., Regulations Establishing and Governing the Duties 
of Swap Dealers and Major Swap Participants, 75 FR 71397, 71399 
(Nov. 23, 2010) (Proposed Swap Entities RMP Rule) (``The 
Commission's rule has been designed such that the specific elements 
of a risk management program will vary depending on the size and 
complexity of a [swap entity's] business operations.'').
---------------------------------------------------------------------------

    In the decade since the RMP rules were adopted, covered entities 
have encountered a wide variety of challenging conditions, including 
Brexit, the LIBOR transition, the COVID-19 pandemic stress period, the 
invasion of Ukraine, and general interest rate increases to tame 
inflation. Throughout this period, the Commission has, through its 
various oversight activities, observed that adherence to its RMP rules 
has supported covered entities' ability to withstand and recover from 
market challenges. The Commission therefore believes the RMP rules have 
helped establish a solid foundation of risk management among covered 
entities across various risk types, promoting a solid baseline standard 
of risk management that reduces overall systemic risk and enhances the 
Commission's customer protections.
    Nevertheless, the Commission believes it has identified 
opportunities to adapt its regulations to further promote sound risk 
management practices, reduce risk to the U.S. financial system, and 
protect commodity interest customers and counterparties.\10\ 
Specifically, as it relates to this proposal, the Commission believes 
that recent events, noted below, have highlighted the need for more 
particularized risk management requirements for covered entities 
designed to promote operational resilience. An outcome of the effective 
management of operational risk, ``operational resilience'' can be 
broadly defined as the ability of a firm to detect, resist, adapt to, 
respond to, and recover from operational disruptions.\11\ As the use of 
technology and associated third-party service providers have expanded 
within the financial sector, so too have the sources of operational 
risk facing covered entities, notably the potential for technological 
failures and cyberattacks.\12\ The Commission preliminarily believes 
that requirements for covered entities directed at promoting sound 
practices for managing these risks, as well as the risk of other 
potential physical disruptions to operations (e.g., power outages, 
natural disasters, pandemics), and for mitigating their potential 
impact would not only strengthen individual covered entity operational 
resilience but would reduce risk to the U.S. financial system as a 
whole and help protect derivatives customers and counterparties.\13\
---------------------------------------------------------------------------

    \10\ The Commission recently solicited public comment on an 
advanced notice of proposed rulemaking regarding potential 
amendments to the RMP requirements. See Risk Management Program 
Regulations for Swap Dealers, Major Swap Participants, and Futures 
Commission Merchants, 88 FR 45826 (Jul. 18, 2023) (RMP ANPRM). The 
comment file is available at https://comments.cftc.gov/PublicComments/CommentList.aspx?id=7412.
    \11\ See Proposed Swap Entities RMP Rule, 75 FR 71399, n.12 
(defining ``operational risk'' as including ``the risk of loss due 
to deficiencies in information systems, internal processes and 
staffing, or disruptions from external events that result in the 
reduction, deterioration, or breakdown in services or controls 
within the firm.''). Several sources have produced definitions of 
``operational resilience'' relevant to the financial sector. See 
e.g., Board of Governors of the Federal Reserve System (FRB), the 
Office of the Comptroller of the Currency (OCC), and the Federal 
Deposit Insurance Corporation (FDIC) (together, the prudential 
regulators), Sound Practices to Strengthen Operational Resilience at 
2 (Oct. 30, 2020) (Prudential Operational Resilience Paper) 
(defining ``operational resilience'' as the ``ability to deliver 
operations, including critical operations and core business lines, 
through a disruption from any hazard.''); Basel Committee on Banking 
Supervision (BCBS), Principles for Operational Resilience at 2, 3 
(Mar. 31, 2021) (BCBS Operational Resilience Principles) (``ability 
of a bank to deliver critical operations through disruption''); 
National Institute of Standards and Technology (NIST), Developing 
Cyber-Resilient Systems: A Systems Security Engineering Approach, SP 
800-160, Vol. 2, Rev. 1 at 76 (Dec. 2021) (``ability of systems to 
resist, absorb, and recover from or adapt to an adverse occurrence 
during operation that may cause harm, destruction, or loss of 
ability to perform mission-related functions.''). Core to each of 
these definitions is the notion of being able to continue to operate 
or perform despite a disruption.
    \12\ See Jason Harrell, Depository Trust & Clearing Corporation 
(DTCC) Managing Director, Head of External Engagements, 
``Operational and Technology Risk, Evolving Cybersecurity Risks in a 
Digitalized Era'' (Sept. 20, 2023) (``While partnerships with third 
parties offer rapid solutions for institutions to access the latest 
technologies and capabilities, they also increase the surface area 
for potential threat actors to gain access to an institution, 
causing cyber incidents that can impact the institution's operations 
and potentially create additional sector impacts.'').
    \13\ Responding to the RMP ANPRM, several commenters suggested 
the Commission consider addressing cybersecurity risk independently. 
See Americans for Financial Reform Education Fund (AFREF) and Public 
Citizen Letter at 6 (Sept. 18, 2023) (AFREF&PC Letter); Better 
Markets Letter Re: Risk Management Program Regulations for Swap 
Dealers, Major Swap Participants, and Futures Commission Merchants 
(RIN 3038-AE59) at 6-9 (Sept. 18, 2023) (Better Markets Letter); 
R.J. O'Brien & Associates LLC Letter at 5-6 (Sept. 18, 2023) (R.J. 
O'Brien Letter). AFRF and Public Citizen also recommended that the 
Commission consider extending its risk management regulations to 
encompass third-party service providers for information technology 
services. See AFREF&PC Letter at 2.
---------------------------------------------------------------------------

    The importance of operational resilience in the financial industry 
has come into stark relief in the past few years, particularly 
following the COVID-19 pandemic. At the start of the pandemic, 
Commission staff initiated near daily in-depth discussions with covered 
entities as those registrants navigated the myriad challenges presented 
during that time. Through a combination of sustained intensive effort 
on the part of the covered entities, and targeted no-action positions 
and exemptive relief provided by Commission staff, covered entities 
generally continued to operate without material disruption to their 
CFTC-regulated activities. As a result of this unprecedented 
experience, the Commission considered whether there were additional 
opportunities for it to act to gain ongoing transparency into, and to 
provide further regulatory support to, covered entities' operational 
resilience practices outside of an unfolding crisis. Commission staff 
then began the work of assessing the current operational resilience 
landscape for covered entities and determining how the Commission could 
act to further the holistic consideration and adoption of operational 
resilience practices amongst covered entities to ensure that certain

[[Page 4708]]

operational risks impacting their CFTC-regulated activities were being 
addressed on an ongoing basis.
    In particular, one area of increased focus is cyber risk. In 2022, 
cyber intelligence firms reported that the financial sector was among 
the most impacted by malicious emails, and was ultimately the most 
breached over the course of the year, with more than 566 successful 
attacks resulting in 254 million leaked records by early December 
2022.\14\ For the past two years, financial institutions responding to 
a DTCC risk survey have identified cyber risk as one of the top five 
risks to global financial markets, highlighting the increased 
sophistication of cyber criminals and the industry's growing digital 
footprint as key drivers.\15\ Given that remote access and cloud 
computing may become permanent features of the financial markets, the 
need for financial institutions to strengthen, adapt, and prioritize 
their information and technology risk practices would seem critical to 
preserving the continued integrity and stability of U.S. financial 
markets.\16\
---------------------------------------------------------------------------

    \14\ See Trellix, The Threat Report Fall 2022 at 11 (Nov. 2022) 
(noting that the financial services sector was the most targeted by 
malicious emails in Q3 of 2022); Flashpoint, Flashpoint Year In 
Review: 2022 Financial Threat Landscape (Dec. 20, 2022) (citing 
finance and insurance as the most-breached sector in 2022).
    \15\ See DTCC, Systemic Risk Barometer Survey: 2023 Risk 
Forecast (Dec. 7, 2022); DTCC, Systemic Risk Barometer Survey: 2022 
Risk Forecast (Dec. 13, 2021) (naming cyber risk as the top risk to 
the economy). See also Bank for International Settlements (BIS), 
Financial Stability Institute (FSI), FSI Insights on policy 
implementation No. 50, Banks' cyber security--a second generation of 
regulatory approaches (June 12, 2023) (FSI Cybersecurity Paper) 
(citing a 2023 report that most chief risk officers consider cyber 
risk the top threat to the banking industry and the most likely to 
result in a crisis or major operational disruption); Federal Bureau 
of Investigation, internet Crime Complaint Center Releases 2022 
Statistics (Mar. 22, 2023) (``Cyber-enabled crime has been around 
for many years, but methods used by perpetrators continue to 
increase in scope and sophistication emanating from around the 
world.'').
    \16\ See FRB, Cybersecurity and Financial System Resilience 
Report at 15 (Aug. 2023) (``The rising number of advanced persistent 
threats increases the potential for malicious cyber activity within 
the financial sector. Combined with the increased internet-based 
interconnectedness between financial institutions and the increasing 
dependence on third-party service providers, these threats may 
result in incidents that affect one or more participants in the 
financial services sector simultaneously and have potentially 
systemic consequences.'').
---------------------------------------------------------------------------

    Covered entities have experienced firsthand how breaches of 
information and technology security can reduce their ability to protect 
customers. In 2016, for instance, a hacker was able to access customer 
records held on an FCM's backup storage device after a default 
configuration of that device left it open to infiltration via the 
internet.\17\ In 2018, a successful phishing attack on an FCM 
compromised customer information and resulted in the FCM's acceptance 
of a fraudulent wire request that took $1 million in funds from a 
customer's account.\18\ Other regulators have also taken action against 
banks registered as swap entities where failed controls and third-party 
service providers intersected to result in the significant exposure of 
customer information.\19\ Even more recently, a ransomware attack on a 
U.S. broker-dealer in November 2023 was so significant, news reports 
indicate that the brokerage required a capital injection from a parent 
entity to settle $9 billion in trades, an amount many times larger than 
its net capital.\20\
---------------------------------------------------------------------------

    \17\ See In re AMP Global Clearing LLC, CFTC Docket No. 18-10 
(Feb. 12, 2018).
    \18\ See In re Phillip Capital Inc., CFTC Docket No. 19-22 
(Sept. 12, 2019).
    \19\ See, e.g., In re Capital One, N.A. and Capital One Bank 
(USA), N.A., AA-EC-20-49 (Aug. 5, 2020) (OCC finding that failed 
risk management practices resulted in exposure of 100 million 
individual credit card applications, including approximately 140,000 
social security numbers, by a former cloud servicer employee); In re 
Morgan Stanley Smith Barney LLC, File No. 3-17280 (Jun. 8, 2016) 
(Securities and Exchange Commission (SEC) finding that failed risk 
management controls allowed an employee to impermissibly access and 
transfer data regarding 730,000 accounts to a personal server, which 
was ultimately hacked by third parties).
    \20\ See Paritosh Bansal, Reuters, ``Inside Wall Street's 
scramble after ICBC hack'' (Nov. 13, 2023) (reporting that the firm 
asked clients to temporarily suspend business with them and clear 
trades elsewhere).
---------------------------------------------------------------------------

    Against the backdrop of that work, a recent and well-documented 
incident serves as an important cautionary tale about the potential 
systemic impact of an operational event at a third-party service 
provider. On January 30, 2023, a ransomware attack on ION Markets, a 
division of UK-based third-party service provider ION Group LLC (ION), 
resulted in a two-week disruption in mid-office activities at several 
FCMs. ION provides order management, execution, trading, and trade 
processing services for several FCMs, including about 20 percent of 
clearing members at the Chicago Mercantile Exchange (CME), but also 
provides software services to many other financial institutions, 
notably many systemically important banks.\21\ FCMs affected by the 
attack had to process trades manually, leading to delays in the timely 
and accurate reporting of trade data to the CFTC, and consequently a 
temporary lag in production of the Commission's weekly Commitments of 
Traders report.\22\ The incident was initially so concerning that Japan 
cut off all connectivity with ION.\23\ Within a couple days of the 
attack, however, regulators, including the CFTC, coordinated efforts to 
determine that the attack was limited to a small number of software 
applications relied on within the cleared derivatives space by about 
forty-two (42) institutions, with no significant impact to systemically 
important banks.\24\
---------------------------------------------------------------------------

    \21\ See Luke Clancy, Risk.net, ``One-fifth of CME clearing 
members hit by Ion hack'' (Mar. 9, 2023); see also Statement of Todd 
Conklin, Deputy Assistant Secretary, Department of the Treasury 
(Treasury), Office of Cybersecurity and Critical Infrastructure 
Protection (OCCIP), The Cyber Threat Landscape for Financial 
Markets: Lessons Learned from ION Markets, Cloud Use in Financial 
Services, and Beyond, CFTC Technology Advisory Committee Meeting 
Transcript at 160-166 (Mar. 22, 2023) (Conklin TAC Presentation) 
(describing the potential ``sprawling impact zone'' had the ION 
incident not been limited to its derivatives software services), 
available at https://www.cftc.gov/sites/default/files/2023/07/1688400024/tac_032223_transcript.pdf.
    \22\ CFTC, Statement on ION and the Impact to the Derivatives 
Markets (Feb. 2, 2023), available at https://www.cftc.gov/PressRoom/SpeechesTestimony/cftcstatement020223. The Commitment of Traders 
report is widely relied on by market participants for insight into 
positions held on exchange-traded futures and options.
    \23\ See Conklin TAC Presentation (Mar. 22, 2023).
    \24\ Id.
---------------------------------------------------------------------------

    During a March 8, 2023, meeting of the CFTC's Market Risk Advisory 
Committee (MRAC), panelists discussed how the collaborative work of the 
CFTC, industry, and self-regulatory organizations (including CME, the 
National Futures Association (NFA), and the Financial Industry 
Regulatory Authority (FINRA)) helped mitigate the impact of the ION 
incident, allowing affected firms to return to business as usual within 
a couple weeks.\25\ Nevertheless, panelists agreed that the incident 
highlighted the interconnectedness of the derivatives markets and the 
need for firms to continue to adapt safeguards to address the ever-
evolving threat landscape.\26\ As the ION incident demonstrates, a

[[Page 4709]]

disruptive cyber event can reach beyond particular financial 
institutions directly experiencing events to other institutions in the 
financial markets or to others doing business with an impacted 
financial institution, and could potentially impact financial 
stability.\27\
---------------------------------------------------------------------------

    \25\ See CFTC, The Market Risk Advisory Committee to Meet on 
March 8 (Mar. 8, 2023) (MRAC Meeting), available at https://www.cftc.gov/PressRoom/Events/opaeventmrac030823; see also Conklin 
TAC Presentation (discussing how Treasury implemented its cyber 
incident response playbook in the days following the ION incident to 
mitigate the potential for panic after news reports began 
circulating information that the incident was more significant than 
regulators had initially determined it was).
    \26\ See Statement of Walt Lukken, President and Chief Executive 
Officer, Futures Industry Association (FIA), MRAC Meeting Transcript 
at 41 (``While the number of clearing firms that use ION's suite of 
clearing products is limited, the interconnectedness of our markets 
made the outage impactful throughout the entirety of our 
marketplace.''); see also Statement of Tom W. Sexton, III, President 
and Chief Executive Officer, NFA, MRAC Meeting Transcript at 46 
(``[O]ur member firms have adopted robust safeguards already that 
need to be adapted in light of today's and tomorrow's ongoing 
challenges and threats.'').
    \27\ See FIA, FIA Taskforce on Cyber Risk, After Action Report 
and Findings at 3 (Sept. 2023) (FIA Taskforce Report) (``The [ION 
incident] demonstrated that an outage at a single service provider 
can have damaging effects across a wide range of firms and threaten 
the orderly functioning of markets. The attack also demonstrated in 
vivid detail the complexities of restoring normal service.'').
---------------------------------------------------------------------------

    In light of these and other events, the Commission believes that 
customer protection and the broader stability of the derivatives 
markets at large warrant more targeted CFTC requirements relating to 
the management of operational risk designed to promote operational 
resilience.\28\ Specifically, the Commission believes that the absence 
of CFTC-specific requirements for covered entities that explicitly 
address information and technology security, as well as third-party 
risk, could impede the Commission's ability to fulfill its regulatory 
oversight obligations with respect to covered entities and ultimately 
weaken its ability to address systemic risk, protect customer assets, 
and promote responsible innovation.\29\ The Commission further believes 
that enhanced CFTC oversight of covered entities with respect to 
operational resilience would help improve outcomes following 
operational disruptions by giving the Commission the ability to ensure 
that covered entities have actionable plans in place to address key 
operational risks.
---------------------------------------------------------------------------

    \28\ Existing CFTC requirements for covered entities relating to 
operational risk or information security are more general in nature 
or limited in application. See, e.g., 17 CFR 1.11(e)(3)(ii) 
(providing, with respect to operational risk, that FCMs have 
automated financial risk management controls reasonably designed to 
prevent the placing of erroneous orders); Enhancing Protections 
Afforded Customers and Customer Funds Held by Futures Commission 
Merchants and Derivatives Clearing Organizations, 77 FR 67866, 67906 
(Nov. 14, 2012) (describing Commission regulation 1.11(e)(3)(ii) as 
requiring an FCM's RMP to include automated financial risk 
management controls in order to reduce operational risk that could 
result from ``fat finger'' errors when submitting trades, or from 
technological ``glitches'' using automated trading); 17 CFR 
23.600(c)(4)(vi) (requiring swap entities to take into account, 
among other things, secure and reliable operating and information 
systems with adequate, scalable capacity, and independence from the 
business trading unit; safeguards to detect, identify, and promptly 
correct deficiencies in operating and information systems; and 
reconciliation of all data and information in operating and 
information systems); 17 CFR 162.21 and 17 CFR 160.30 (requiring 
covered entities to adopt written policies and procedures addressing 
administrative, technical, and physical safeguards with respect to 
the information of consumers).
    \29\ See 7 U.S.C. 5 (establishing among the purposes of the 
Commodity Exchange Act to deter disruptions to market integrity, to 
ensure the financial integrity of covered transactions and the 
avoidance of systemic risk, and to promote responsible innovation 
and fair competition among market participants).
---------------------------------------------------------------------------

II. Proposal

    Section 4s(j)(2) of the Commodity Exchange Act (CEA or Act) 
expressly requires swap entities to establish robust and professional 
risk management systems adequate for managing their day-to-day 
business.\30\ Section 4s(j)(7) further directs the Commission to 
prescribe rules governing the duties of swap entities, including the 
duty to establish risk management systems, which would include the 
management of operational risk.\31\ The Commission is authorized to 
promulgate operational risk management requirements for FCMs pursuant 
to section 8a(5) of the CEA, which authorizes the Commission to make 
and promulgate such rules and regulations as, in the judgment of the 
Commission, are reasonably necessary to effectuate any of the 
provisions of, or to accomplish any of the purposes of, the CEA.\32\ 
This general rulemaking authority may be used to prevent problems 
before they arise in the agency's blind spots,\33\ and may be exercised 
to regulate circumstances or parties beyond those explicated in a 
statute.\34\ Accordingly, the Commission has broad authority to 
promulgate regulations provided that such regulations are supported by 
a sufficient nexus to the CFTC's delegated authority. Specifically, 
Congress expressly empowered the Commission to prescribe certain 
requirements with respect to FCMs, namely, to require FCMs to register 
(sections 8a(1), 4d(a)(1), and 4f(a)(1) of the CEA \35\); to segregate 
customer funds (section 4d of the CEA \36\); to establish safeguards to 
minimize conflicts of interest (section 4d of the CEA \37\); to meet 
minimum financial requirements (section 4f of the CEA \38\); to manage 
and maintain records and reporting on the financial and operational 
risks of affiliates (section 4f of the CEA \39\); and to establish 
administrative, technical, and physical safeguards to protect the 
security and confidentiality of certain nonpublic personal information 
(section 5g of the CEA \40\), among other requirements.
---------------------------------------------------------------------------

    \30\ See 7 U.S.C. 6s(j)(2).
    \31\ See 7 U.S.C. 6s(j)(7).
    \32\ 7 U.S.C. 12a(5).
    \33\ Inv. Co. Inst. v. CFTC, 891 F. Supp. 2d 162, 193 (D.D.C. 
2012), as amended (Jan. 2, 2013) (citing Stilwell v. Office of 
Thrift Supervision, 569 F.3d 514, 519 (D.C. Cir. 2009)).
    \34\ Nat'l Ass'n of Mfrs. v. SEC, 748 F.3d 359, 366 (D.C. Cir. 
2014), overruled on other grounds by Am. Meat Inst. v. U.S. Dept. of 
Agric., 760 F.3d 18 (D.C. Cir. 2014) (en banc).
    \35\ 7 U.S.C. 12a(1); 7 U.S.C. 6d(a)(1); 7 U.S.C. 6f(a)(1).
    \36\ 7 U.S.C. 6d.
    \37\ Id.
    \38\ 7 U.S.C. 6f.
    \39\ Id.
    \40\ See 7 U.S.C. 7b-2; 15 U.S.C. 6801.
---------------------------------------------------------------------------

    The Commission believes that more particularized operational risk 
management requirements are reasonably necessary to help effectuate 
these statutory requirements for FCMs and to accomplish the purposes of 
the CEA. FCMs play an important role in the derivatives markets, 
serving as both the primary point of access to the cleared commodity 
interest markets for customers and the custodian of the funds used to 
maintain their positions. Given their position at the center of the 
derivatives market ecosystem, FCMs' operational resilience is essential 
to well-functioning derivatives markets and to ensuring that customers 
receive the protections provided by the CEA. However, as discussed 
above, operational risks, notably cyber and third-party risks, have 
become an increasing threat to financial institutions, including FCMs. 
These risks can cause major disruptions to FCMs' operations, and 
consequently impact the ability of FCMs to fulfill their obligations as 
Commission registrants. In particular, information security threats and 
operational disruptions can place an FCM's financial resources at risk; 
disrupt an FCM's ability to segregate and protect customer funds; 
impede accurate recordkeeping, including records related to customer 
funds; and cause a host of other issues for FCMs, which ultimately 
inure to the detriment of their customers and the derivatives markets. 
Accordingly, the Commission believes a comprehensive operational 
resilience regime is reasonably necessary to ensure that an FCM 
adequately addresses and mitigates risks that could adversely impact 
its ability to operate and fulfill its statutory obligations and duties 
as an FCM.
    As discussed in detail in subsequent sections of this release, the 
Commission is proposing to require that FCMs and swap entities 
establish an Operational Resilience Framework (ORF) that is reasonably 
designed to identify, monitor, manage, and assess risks relating to 
information and technology security, third-party relationships, and 
emergencies or other significant disruptions to normal business 
operations. At its core, the ORF would have three key components: an

[[Page 4710]]

information and technology security program, a third-party relationship 
program, and a business continuity and disaster recovery plan. The 
proposed ORF rule reflects a principles-based approach buttressed by 
certain minimum requirements specific to each of the component programs 
or plans, such as requiring an annual risk assessment and controls 
relating to information and technology security, and due diligence and 
monitoring requirements for third-party service providers. Proposed 
requirements relating to governance, training, testing, and 
recordkeeping would apply broadly and support the ORF as a whole. The 
proposed rule would further require covered entities to notify the 
Commission (and, in certain instances, customers or counterparties) of 
certain ORF-related events. Detailed guidance intended to assist 
covered entities in designing and implementing their third-party 
relationship program would be included in appendices to the rule.
    In developing the proposed rule, the Commission endeavored to 
incorporate general directives to federal agencies articulated in the 
White House's March 2023 National Cybersecurity Strategy: Leverage 
existing standards and guidance, harmonize where sensible and 
appropriate to achieve better outcomes, and demonstrate an approach 
that is sufficiently nimble to meet the challenges of the ever-evolving 
technological threat landscape and fit the unique business and risk 
profile of each covered entity.\41\ To that end, the proposal builds on 
the Commission's experience establishing system safeguard requirements 
for registered entities, as well as the approaches adopted by self-
regulatory organizations and other regulatory authorities.\42\ Notably, 
the proposal draws on approaches adopted by NFA, whose rules and 
interpretative notices relating to information systems security, third-
party risk, and business continuity and disaster recovery planning 
apply to covered entities by virtue of being NFA members, and 
prudential regulators, who also regulate many covered entities, and 
have recently issued interagency positions on operational resilience 
and third-party relationship management.\43\
---------------------------------------------------------------------------

    \41\ The White House, National Cybersecurity Strategy at 8-9 
(Mar. 2023) (National Cyber Strategy) (``Our strategic environment 
requires modern and nimble regulatory frameworks for cybersecurity 
tailored for each sector's risk profile, harmonized to reduce 
duplication, complementary to public-private collaboration, and 
cognizant of the cost of implementation.''). See also FIA Taskforce 
Report, supra note 27, at 9 (``[T]he Taskforce encourages regulators 
and legislators to take a principles-based approach to cyber risk 
and operational resilience. That approach may not be sufficient in 
all areas, but such a flexible approach is well suited to a threat 
landscape that is likely to continue evolving at a rapid rate.'').
    \42\ See 17 CFR 37.1400 and 17 CFR 37.1401 (system safeguard 
requirements for swap execution facilities (SEFs)); 17 CFR 38.1050 
and 17 CFR 38.1051 (designated contract markets (DCMs)); 17 CFR 
39.18 (derivatives clearing organizations (DCOs)); 17 CFR 49.24 
(swap data repositories (SDRs)). See also 17 CFR 1.3 (defining 
``registered entity'' to include DCMs, DCOs, SEFs, and SDRs). For a 
summary of international regulatory efforts related to operational 
resilience, see FIA Taskforce Report, supra note 27, at 7-8.
    \43\ See NFA Interpretive Notice 9070, NFA Compliance Rules 2-9, 
2-36 and 2-49: Information Systems Security (rev. Sept. 30, 2019) 
(NFA ISSP Notice); NFA Interpretive Notice 9079, NFA Compliance 
Rules 2-9 and 2-36: Members' Use of Third-Party Service Providers 
(NFA Third-Party Notice) (effective Sept. 30, 2021); NFA Rule 2-38: 
Business Continuity and Disaster Recovery Plan (rev. July 1, 2019); 
NFA Interpretive Notice 9052, NFA Compliance Rule 2-38: Business 
Continuity and Disaster Recovery Plan (NFA BCDR Notice) (April 7, 
2003); Prudential Operational Resilience Paper, supra note 11; 
Interagency Guidance on Third-Party Relationships: Risk Management, 
88 FR 37920 (Jun. 9, 2023) (Prudential Third-Party Guidance). See 
also Computer-Security Incident Notification Requirements for 
Banking Organizations and their Bank Service Providers, 86 FR 66424 
(Nov. 23, 2021); 12 CFR part 30, app. A (Interagency Guidelines 
Establishing Standards for Safety and Soundness), 12 CFR part 30, 
app. B (Interagency Guidelines Establishing Information Security 
Standards).
---------------------------------------------------------------------------

    The Commission also surveyed the work of international standard-
setting bodies, notably the BCBS Principles for Operational 
Resilience.\44\ The Commission also conferred with, and reviewed the 
standards published by the National Institute of Standards and 
Technology (NIST), a part of the U.S. Department of Commerce charged by 
Executive Order 13636 in 2013 with developing a framework to reduce 
cyber risks to critical infrastructure that incorporates voluntary 
consensus standards and industry best practices.\45\ Standards 
developed in response to this charge and reviewed by the Commission 
include the Framework for Improving Critical Infrastructure 
Cybersecurity and the Security and Privacy Controls for Information 
Systems and Organizations, among others.\46\ The Commission and other 
financial regulators have previously adapted NIST's standards in 
regulation and guidance related to operational resilience. The 
Commission's system safeguards requirements treat NIST's CSF as a 
source for well-established best practices for cybersecurity.\47\ In 
Appendix A of the Interagency Sound Resilience Paper, the prudential 
regulators presented ``a collection of sound practices for cyber risk 
management, aligned to NIST and augmented to emphasize governance and 
third-party risk management.'' \48\ The Commission also considered 
standards published by equivalent standard setting bodies like the 
International Standards Organization (ISO).\49\
---------------------------------------------------------------------------

    \44\ See BCBS Operational Resilience Principles, supra note 11. 
See also International Organization of Securities Commissions 
(IOSCO), Cyber Task Force: Final Report (2019) (identifying 
different but comparable core standards or frameworks, including 
both NIST and ISO standards); Financial Stability Board (FSB), Final 
report on Enhancing Third-Party Risk Management and Oversight--a 
toolkit for financial institutions and financial authorities (Dec. 
4, 2023) (FSB Third-Party Report). Materials related to the FSB's 
work on cyber resilience are available at https://www.fsb.org/work-of-the-fsb/financial-innovation-and-structural-change/cyber-resilience/.
    \45\ See The White House, Office of the Press Secretary, 
Executive Order--Improving Critical Infrastructure Cybersecurity, 
E.O. 13636 (Feb. 12, 2013).
    \46\ See NIST, Framework for Improving Critical Infrastructure 
Cybersecurity (Version 1.1) at 2 (Apr. 16, 2018) (NIST CSF); NIST, 
SP 800-53, Security and Privacy Controls for Information Systems and 
Organizations (Sept. 2020, rev. Dec. 10, 2020) (NIST SP 800-53). See 
also Cybersecurity & Infrastructure Security Agency (CISA), 
Financial Services Sector-Specific Plan--2015 at 16 (rev. Dec. 17, 
2020) (``While the [NIST cybersecurity framework] is designed to 
manage cybersecurity risks, its core functions of Identify, Protect, 
Detect, Respond, and Recover provide a model for considering 
physical risks as well. This methodology is increasingly central to 
the sector's thinking on security and resilience, and the concept 
aligns with existing [Federal Financial Institutions Examination 
Council (FFIEC)] guidance.'').
    \47\ System Safeguards Testing Requirements for Derivatives 
Clearing Organizations, 81 FR 64322, 64329 (Sept. 19, 2016).
    \48\ Board of Governors of the Federal Reserve System, the 
Office of the Comptroller of the Currency, and the Federal Deposit 
Insurance Corporation, Sound Practices to Strengthen Operational 
Resilience (Nov. 2, 2020), available at https://www.federalreserve.gov/supervisionreg/srletters/SR2024.html.
    \49\ See, e.g., ISO/IEC 27001:2022, Information security, 
cybersecurity and privacy protection: Information security controls 
(Oct. 2022) (ISO/IEC 27001:2022).
---------------------------------------------------------------------------

    Finally, in putting together the proposal, Commission staff engaged 
with staff at NFA and various federal agencies, including prudential 
regulators, and the SEC.\50\ Based on these efforts, the Commission 
preliminarily believes that, if adopted, the proposed rule would strike 
an

[[Page 4711]]

appropriate balance between supporting technological and market 
innovation and fair competition, ensuring covered entities devote the 
necessary thought, planning, and resources to their operational 
resilience so as to support the resilience of the U.S. derivatives 
markets and the financial sector as a whole.\51\
---------------------------------------------------------------------------

    \50\ In accordance with section 712(a) of the Dodd-Frank Act (15 
U.S.C. 8302), the Commission has consulted and coordinated, to the 
extent possible, with the SEC and the prudential regulators, 
including with the FRB, the OCC, and the FDIC, for purposes of 
assuring regulatory consistency and comparability. The Securities 
Exchange Act of 1934 and existing and proposed SEC regulations 
include requirements relating to risk management including 
cybersecurity, including requirements for SEC-regulated broker-
dealers and security-based swap dealers. See, e.g. Cybersecurity 
Risk Management Rule for Broker-Dealers, Clearing Agencies, Major 
Security-Based Swap Participants, the Municipal Securities 
Rulemaking Board, National Securities Associations, National 
Securities Exchanges, Security-Based Swap Data Repositories, 
Security-Based Swap Dealers, and Transfer Agents, 88 FR 20212, 
sections IV.C.1.b.i and IV.C.1.b.iii (Apr. 5, 2023).
    \51\ See 7 U.S.C. 5.
---------------------------------------------------------------------------

    The Commission is proposing to codify the ORF rule for swap 
entities in existing Commission regulation 23.603, which currently 
contains the Commission's business continuity and disaster recovery 
requirements for swap entities.\52\ As discussed in greater detail 
below, the Commission is proposing to retain the substance of the 
existing business continuity and disaster recovery requirements in 
current Commission regulation 23.603 as part of the ORF rule for swap 
entities, with certain modifications. Similar requirements would also 
be imposed on FCMs. The proposed ORF rule for FCMs would be codified in 
new Commission regulation 1.13. The proposed guidance on third-party 
relationships would be included in the appendices to parts 1 and 23 for 
FCMs and swap entities, respectively.
---------------------------------------------------------------------------

    \52\ 17 CFR 23.603.
---------------------------------------------------------------------------

    As proposed, the regulatory text of the ORF rule for swap entities 
is nearly identical in structure and substance to the ORF rule for 
FCMs. Accordingly, to promote readability, when referencing sections of 
the regulatory text, this notice generally refers to the relevant 
paragraph of the proposed regulations (i.e., ``proposed paragraph (b)'' 
would refer to paragraph (b) of both proposed Commission regulations 
1.13 and proposed Commission regulation 23.603).
    The Commission invites comment on all aspects of the proposed rule, 
as further detailed below.

A. Generally--Proposed Paragraph (b) 53
---------------------------------------------------------------------------

    \53\ Paragraph (a) of proposed Commission regulations 1.13 and 
23.603 provides definitions for terms used within the ORF rule. Each 
proposed definition is discussed in the context of the relevant 
substantive regulatory requirement throughout the remainder of this 
notice.
---------------------------------------------------------------------------

1. Purpose and Scope; Components--Proposed Paragraphs (b)(1) and (b)(2)
    As previously mentioned, the proposed rule would require covered 
entities to establish, document, implement, and maintain an Operational 
Resilience Framework, or ORF.\54\ The ORF would need to be reasonably 
designed to identify, monitor, manage, and assess risks relating to 
three key risk areas that challenge operational resilience: (i) 
information and technology security, as defined in the proposed rule 
and discussed further below; (ii) third-party relationships; and (iii) 
emergencies or other significant disruptions to the continuity of 
normal business operations as a covered entity.\55\ Although these risk 
areas are often viewed distinctly, as the introduction to this notice 
illustrates, they are significantly interrelated, as the relative 
strength of information and technology security and third-party risk 
management can directly affect recovery activities and improve outcomes 
following an emergency or other significant disruption.\56\ Together, 
the Commission believes they represent important sources of potential 
operational risk, the effective management of which is key to 
operational resilience.
---------------------------------------------------------------------------

    \54\ See paragraph (b)(1) of proposed Commission regulations 
1.13 and 23.603.
    \55\ See paragraphs (b)(1)(i)-(iii) of proposed Commission 
regulations 1.13 and 23.603.
    \56\ See, e.g., ISO/IEC 27031:2011, Information technology--
Security techniques--Guidelines for information and communication 
technology readiness for business continuity (Mar. 2011) (``Failures 
of [information and communication technology (ICT)] services, 
including the occurrence of security issues such as systems 
intrusion and malware infections, will impact the continuity of 
business operations. Thus, managing ICT and related continuity and 
other security aspects form a key part of business continuity 
requirements. Furthermore, in the majority of cases, the critical 
business functions that require business continuity are usually 
dependent upon ICT. This dependence means that disruptions to ICT 
can constitute strategic risks to the reputation of the organization 
and its ability to operate . . . As a result, effective [business 
continuity management] is frequently dependent upon effective ICT 
readiness to ensure that the organization's objectives can continue 
to be met in times of disruptions.''). See Prudential Operational 
Resilience Paper, supra note 11, at 8 (``Secure and resilient 
information systems underpin the operational resilience of a firm's 
critical operations and core business lines.''); see also Prudential 
Third-Party Guidance, 88 FR 37920 (discussing the interplay of 
third-party risks and operational resilience).
---------------------------------------------------------------------------

    The proposed rule would require covered entities to establish three 
written component programs or plans, each dedicated to addressing one 
of the three enumerated risks within the ORF. The three component 
programs or plans would be: (i) an information and technology security 
program, (ii) a third-party relationship program, and (iii) a business 
continuity and disaster recovery plan.\57\ Each component program or 
plan would need to be supported by written policies and procedures and 
meet the requirements set forth in the rule, as discussed in subsequent 
sections of this notice.\58\ The definitions and specific requirements 
for the information and technology security program, the third-party 
relationship program, and the business continuity and disaster recovery 
plan are discussed in detail in subsequent sections of this notice 
specifically dedicated to discussing each of the three components.\59\
---------------------------------------------------------------------------

    \57\ See paragraph (b)(2) of proposed Commission regulations 
1.13 and 23.603; see also paragraph (a) of proposed Commission 
regulations 1.13 and 23.603 (defining ``information and technology 
security program,'' ``third-party relationship program,'' and 
``business continuity and disaster recovery plan'').
    \58\ See paragraph (b)(2) of proposed Commission regulations 
1.13 and 23.603. See paragraphs (d) (information and technology 
security program), (e) (third-party relationship program), and (f) 
(business continuity and disaster recovery plan) of proposed 
Commission regulations 1.13 and 23.603 (describing the requirements 
for each program, respectively).
    \59\ See sections II.C (information and technology security 
program), II.D (third-party relationship program), II.E (business 
continuity and disaster recovery plan) of this notice, infra.
---------------------------------------------------------------------------

    Although they may go by different names, the Commission understands 
that written programs or plans of these types are generally recognized 
as common ways to address these risks and are even currently required 
of covered entities. NFA, for instance, currently requires members to 
adopt a written information systems security program (ISSP), a written 
supervisory framework to address outsourcing to third-party service 
providers, and a written business continuity and disaster recovery 
plan.\60\ The Commission itself requires swap entities to have a 
written business continuity and disaster recovery plan.\61\ 
Accordingly, to the extent that covered entities have existing programs 
or plans and policies and procedures that address the requirements of 
the ORF rule, by virtue of other regulatory requirements or otherwise, 
the Commission would not expect such covered entities to adopt entirely 
new component programs or plans. The Commission would only expect that 
covered entities review their existing programs and plans to ensure 
they meet the minimum requirements of the ORF rule and make any 
necessary amendments.
---------------------------------------------------------------------------

    \60\ See NFA ISSP Notice, supra note 43; NFA Third-Party Notice, 
supra note 43; and NFA BCDR Notice, supra note 43. NFA's requirement 
to establish a business continuity and disaster recovery plan does 
not currently apply to swap entities, see NFA Rule 2-38, paragraph 
(a), supra note 43.
    \61\ See 17 CFR 23.603.
---------------------------------------------------------------------------

    The Commission appreciates that covered entities may assign 
responsibility for the establishment, implementation, and maintenance 
of each ORF component program or plan to distinct functions within 
their organizations. By structuring the proposed rule to require a 
``framework'' directed at operational resilience,

[[Page 4712]]

however, the Commission intends for executive leadership at covered 
entities to address the risk areas covered by the ORF as a cohesive and 
interrelated whole, breaking down any unnecessary internal silos, and 
to consider all aspects of operational resilience in determining their 
operational strategies, risk appetite, and risk tolerance limits.\62\
---------------------------------------------------------------------------

    \62\ The specific governance requirements of the proposed rule, 
which include the requirement to establish risk appetite and risk 
tolerance limits with respect to the ORF, further support this view. 
See paragraph (c) of proposed Commission regulations 1.13 and 
23.603.
---------------------------------------------------------------------------

2. Standard--Proposed Paragraph (b)(3)
    The Commission is proposing to require that each covered entity 
implement the requirements of the proposed ORF rule in a manner that is 
appropriate and proportionate to the nature, scope, complexity, and 
risk profile of its business activities as a covered entity, following 
generally accepted standards and best practices (the (b)(3) 
standard).\63\ The proposed (b)(3) standard reflects the general 
principles-based approach underpinning the proposed rule, which the 
Commission believes would be appropriate given the increased reliance 
on and rapid evolution of technology within the financial industry and 
its attendant risks.\64\ This standard incorporates two themes that 
have broad support from other governmental and international standard-
setting bodies when addressing matters related to operational 
resilience: (i) proportionality; and (ii) reliance on established 
standards and best practices.\65\
---------------------------------------------------------------------------

    \63\ See paragraph (b)(3) of proposed Commission regulations 
1.13 and 23.603.
    \64\ See BCBS Operational Resilience Principles, supra note 11, 
at 1 (``Recognising that a range of potential hazards cannot be 
prevented, the Committee believes that a pragmatic, flexible 
approach to operational resilience can enhance the ability of banks 
to withstand, adapt to and recover from potential hazards and 
thereby mitigate potentially severe adverse impacts.''); see also 
Prudential Operational Resilience Paper, supra note 11, at 9 
(providing as a sound practice of operational resilience that firms 
review information systems ``on a regular basis against common 
industry standards and best practices.'').
    \65\ See, e.g., BCBS Operational Resilience Principles at 2-3 
(``The principles for operational resilience set forth in this 
document are largely derived and adapted from existing guidance that 
has been issued by the Committee or national supervisors over a 
number of years. The Committee recognizes that many banks have well 
established risk management processes that are appropriate for their 
individual risk profile, operational structure, corporate governance 
and culture, and conform to the specific risk management 
requirements of their jurisdictions. By building upon existing 
guidance and current practices, the Committee is issuing a 
principles-based approach to operational resilience that will help 
to ensure proportional implementation across banks of various size, 
complexity and geographical location.''); FSB Third-Party Report, 
supra note 44, at 10-11; IOSCO, Principles on Outsourcing: Final 
Report at 10 (IOSCO Outsourcing Report) (Oct. 2021) (providing that 
``[t]he application and implementation of these Principles should be 
proportional to the size, complexity and risk posed by the 
outsourcing'' of tasks, functions, processes, services, or 
activities to a service provider that would otherwise be undertaken 
by the regulated entity itself).
---------------------------------------------------------------------------

    Broadly speaking, the principle of proportionality recognizes that 
operational resilience, and information and technology security, in 
particular, cannot be addressed with a one-size-fits-all approach.\66\ 
On the contrary, differences in operational structures and business 
strategies among covered entities necessitate a more flexible and 
adaptive approach that would allow individual covered entities to best 
address their specific risks and evolve to address emerging challenges 
as they arise. Covered entities vary widely in terms of their business 
structure and risk profiles, such that a covered entity operating 
within a large bank holding company group structure and involved in a 
broad array of asset classes would likely have a different risk profile 
and different resources than an entity that is solely registered with 
the CFTC or that has a narrower scope to its CFTC-regulated business. 
The Commission would therefore expect that covered entities facing 
different operational risks may take different approaches to managing 
and monitoring those risks. Designing an operational resilience 
framework that would apply uniformly across all covered entities would 
not only pose significant challenges, it would likely be ineffective, 
imposing operational costs where no risks demand it. Accordingly, the 
Commission preliminarily believes that a proportional, risk-based 
approach would help ensure that firms, customers, counterparties, and 
the financial system at large can appropriately respond to and recover 
from operational shocks in context.
---------------------------------------------------------------------------

    \66\ See e.g., FINRA, 2018 Report on Selected Cybersecurity 
Practices at 1 (Dec. 2018) (FINRA Cybersecurity Report) (``[T]here 
is no one-size-fits-all approach to cybersecurity.''); NIST CSF, 
supra note 46, at 2 (``The [NIST CSF] is not a one-size-fits-all 
approach to managing cybersecurity risk for critical infrastructure. 
Organizations will continue to have unique risks--different threats, 
different vulnerabilities, different risk tolerances.'').
---------------------------------------------------------------------------

    Interpretive notices adopted by NFA reflect a comparable approach. 
Specifically, NFA's notices on ISSPs and the use of third-party service 
providers establish general, baseline requirements (e.g., assess risks 
associated with the use of information technology systems or with 
reliance on third-party service providers) and then direct NFA members, 
including covered entities, to tailor the specifics to their 
businesses.\67\ This approach is also consistent with the CFTC's own 
approach with respect to system safeguard requirements for registered 
entities,\68\ as well as those of the prudential regulators.\69\ 
Generally accepted standards and best practices themselves also 
generally support a proportional approach.\70\
---------------------------------------------------------------------------

    \67\ See NFA ISSP Notice, supra note 43 (requiring each NFA 
member to adopt an ISSP appropriate to the its ``size, complexity of 
operations, type of customers and counterparties, the sensitivity of 
the data accessible within its systems, and its electronic 
interconnectivity with other entities''); NFA Third-Party Notice, 
supra note 43 (``NFA recognizes that a Member must have flexibility 
to adopt a written supervisory framework relating to outsourcing 
functions to a [third-party service provider] that is tailored to a 
Member's specific needs and business . . .'').
    \68\ See, e.g., 17 CFR 37.1401(b) (SEFs); 17 CFR 38.1051(b) 
(DCMs); 17 CFR 39.18(b)(3) (DCOs); 17 CFR 49.24(c) (SDRs) (requiring 
registered entities to follow generally accepted standards and best 
practices with respect to the development, operation, reliability, 
security, and capacity of automated systems); see also System 
Safeguards Testing Requirements for Derivatives Clearing 
Organizations, 81 FR 64322, 64329 (Sept. 19, 2016) (DCO System 
Safeguards Testing Requirements) (describing the CFTC's approach to 
system safeguards for DCOs as providing DCOs with ``flexibility to 
design systems and testing procedures based on the best practices 
that are most appropriate for that DCO's risks'').
    \69\ 12 CFR part 30, app. B (Interagency Guidelines Establishing 
Information Security Standards); id. at II.A. (Information Security 
Program) (``Each [financial institution] shall implement a 
comprehensive written information security program that includes 
administrative, technical, and physical safeguards appropriate to 
the size and complexity of the [financial institution] and the 
nature and scope of its activities.''); FFIEC Information Technology 
Examination Handbook, Information Security at 2 (Sept. 2016) (FFIEC 
Information Security Booklet) (``Institutions should maintain 
effective information security programs commensurate with their 
operational complexities.'').
    \70\ The NIST CSF, for example, identifies activities designed 
to achieve specific cybersecurity outcomes and tiers practices by 
increasing degree of rigor and sophistication. In selecting a tier, 
NIST directs entities to consider their ``current risk management 
practices, threat environment, legal and regulatory requirements, 
information sharing practices, business/mission objectives, supply 
chain cybersecurity requirements, and organizational constraints.'' 
See NIST CSF, supra note 46, at 8.
---------------------------------------------------------------------------

    The Commission emphasizes, however, that ``proportional'' does not 
mean ``permissive.'' The Commission's proposed standard for the ORF 
rule would not support a ``race to the bottom,'' where covered entities 
default to the minimum requirements of the proposed rule. On the 
contrary, covered entities would be required to implement an ORF that 
is reasonably designed to reflect and address their unique risk profile 
and activities, consistent with the proposed (b)(3) standard. 
Accordingly, the Commission would expect larger, more complex entities 
that operate more varied business lines, rely on more technological 
platforms, or

[[Page 4713]]

have more complicated agreements with third-party service providers to 
arrive at an ORF that is appropriate to their likely increased level of 
operational risk.\71\
---------------------------------------------------------------------------

    \71\ See National Cyber Strategy, supra note 41, at 4 (``The 
most capable and best-positioned actors in cyberspace must be better 
stewards of the digital ecosystem.''); see also IOSCO Outsourcing 
Report, supra note 65, at 10.
---------------------------------------------------------------------------

    The requirement for covered entities to follow generally accepted 
standards and best practices serves to ground covered entities' 
approaches to operational resilience in practices that are widely 
recognized as effective in aiding financial institutions to mitigate 
and recover from operational shocks. In adopting system safeguard 
requirements for registered entities, which require registered entities 
to follow generally accepted standards and best practices, the 
Commission identified several sources of standards and best 
practices.\72\ NFA and other bodies have compiled similar lists.\73\ 
Among perhaps the most commonly relied on by financial institutions are 
the NIST CSF, ISO, the Center for internet Security (CIS), and FFIEC, 
whose examination booklets and Cyber Assessment Tool (CAT) are 
specifically designed to guide financial institutions.\74\ The 
Commission would expect covered entities to use generally accepted 
standards and industry best practices that are appropriate and 
proportionate to the nature, size, scope, complexities, and risk 
profile of their business activities, in designing or updating an ORF 
that would comply with the proposed rule. For instance, in conducting 
the risk assessment required under proposed paragraph (c)(1), a covered 
entity would need to identify risks to its information and technology 
security with reference to risks discussed in an appropriate standard 
or based on industry best practices, and then assess and prioritize 
those risks using frameworks and metrics recommended by those standards 
or practices. Requiring covered entities to follow generally accepted 
standards and industry best practices in developing and implementing 
the ORF would help ensure that covered entities establish, document, 
implement, and maintain ORFs reasonably designed to address their 
particular operational resilience-related risks.
---------------------------------------------------------------------------

    \72\ See, e.g., DCO System Safeguards Testing Requirements, 81 
FR 64322-23; 17 CFR 39.18(b)(3) (requiring DCOs to follow generally 
accepted standards and best practices with respect to the 
development, operation, reliability, security, and capacity of 
automated systems); see also 17 CFR 37.1401(b) (SEFs) (requiring the 
same); 17 CFR 38.1051(b) (DCMs) (same); 17 CFR 49.24(c) (SDRs) 
(same).
    \73\ See, e.g., NFA, Cybersecurity FAQs, ``Does NFA recommend 
any particular consultants that can help a Member draft an ISSP or 
perform penetration testing?''; see also FFIEC, Cybersecurity 
Resource Guide for Financial Institutions (Sept. 2022) (rev. Nov. 
2022).
    \74\ The Financial Services Sector Coordinating Council (FSSC) 
has also developed a NIST CSF profile specifically designed for 
financial institutions. The profile is now maintained, updated, and 
managed by the Cyber Risk Institute (CRI) and was last updated in 
January 2023. See CRI Profile v1.2 (Dec. 14, 2021), available at 
https://cyberriskinstitute.org/the-profile/.
---------------------------------------------------------------------------

    The proposed rule leverages these standards not only by directing 
covered entities to consider them in developing their approaches but by 
incorporating common themes contained within them into the substance of 
the proposed rule. In the Commission's view, reliance on such standards 
supports the use of a common lexicon, facilitating the development of 
understandable and transposable practices on a cross-border basis. The 
Commission further recognizes that generally accepted standards and 
best practices are likely to evolve over time, and the applicability of 
any particular standard may vary based on the unique circumstances and 
risk profile of each covered entity. Accordingly, the Commission 
preliminarily believes requiring covered entities to follow generally 
accepted standards and best practices supports the goal of an adaptive 
approach that can respond nimbly to rapid changes in emerging 
threats.\75\
---------------------------------------------------------------------------

    \75\ See National Cyber Strategy, supra note 41, at 9 (``By 
leveraging existing international standards in a manner consistent 
with current policy and law, regulatory agencies can minimize the 
burden of unique requirements and reduce the need for regulatory 
harmonization.'').
---------------------------------------------------------------------------

3. Request for Comment
    The Commission invites comment on all aspects of proposed paragraph 
(b), including the following questions:
    1. Applicability to FCMs. In adopting the RMP rule for FCMs in 
2013, the Commission determined to limit the rule's applicability to 
FCMs that hold or accept customer funds.\76\ The CEA and Commission 
regulations define a ``futures commission merchant'' as an entity that 
solicits or accepts orders to buy or sell futures contracts, options on 
futures, retail off-exchange forex contracts or swaps, and accepts 
money or other assets from customers to support such orders.\77\ 
Although some entities are, for various reasons, currently registered 
as FCMs despite not accepting customer funds, as the Commission 
explained in the adopting release for the FCM RMP rule, FCMs that do 
not accept or hold customer funds to margin, guarantee, or security 
commodity interests are generally not operating as FCMs.\78\ With 
respect to the proposed ORF rule, the Commission has preliminarily 
determined to apply the proposed requirements to all registered FCMs. 
Although the customer protection concerns may be mitigated for FCMs 
that do not handle customer assets, the Commission preliminarily 
believes that the potential systemic risk that can result from failures 
to manage information and technology risk, third-party relationships, 
emergencies, or other significant disruptions persist for all FCMs, 
given their access to customer information and their potential 
relationships with and/or connectivity to other regulated entities, 
including exchanges and clearinghouses.\79\
---------------------------------------------------------------------------

    \76\ See 17 CFR 1.11(a) (Nothing in this section shall apply to 
a futures commission merchant that does not accept any money, 
securities, or property (or extend credit in lieu thereof) to 
margin, guarantee, or secure any trades or contracts that result 
from soliciting or accepting orders for the purchase or sale of any 
commodity interest.).
    \77\ See 7 U.S.C. 1a(28)(A); 17 CFR 1.3 (defining ``futures 
commission merchant'') (emphasis added).
    \78\ As of July 31, 2023, twelve (12) entities were registered 
as FCMs but were not required to segregate any funds on behalf of 
customers. See CFTC, Financial Data for FCMs (July 31, 2023), 
available at https://www.cftc.gov/MarketReports/financialfcmdata/index.htm. The Commission made clear in the adopting notice for the 
FCM RMP rule that it would expect that, prior to changing their 
business model to begin accepting customer funds, any registered FCM 
that does not currently accept customer funds would need to 
establish a risk management program that complies with Commission 
regulation 1.11 and file such program with the Commission and with 
the FCM's designated self-regulatory organization (DSRO). See Final 
FCM RMP Rule, 78 FR 68517.
    \79\ The Final FCM RMP rule, by contrast, could be viewed as 
more directly targeting the management of specific risks associated 
with operating as an FCM.
---------------------------------------------------------------------------

    a. Are the risks associated with information and technology 
security, third-party relationships, and emergencies or other 
significant disruptions substantially different or reduced for FCMs 
that do not hold customer funds? If yes, please explain.
    b. Should the Commission consider limiting the ORF rule to FCMs 
that do not hold customer funds, consistent with the FCM RMP rule? Why 
or why not? Please explain.
    2. Standard. The proposed rule would require covered entities to 
follow ``generally accepted standards and best practices'' in 
establishing, implementing, and maintaining their ORFs. Although this 
notice identifies various sources of such standards and practices, 
including NIST, ISO, CIS, and FFIEC, the proposed rule does not further 
define or otherwise limit the scope of ``generally accepted standards 
and best practices,'' acknowledging that there are several sources of 
recognized standards currently relied on by covered entities and that 
standards and practices

[[Page 4714]]

are likely to evolve over time in response to changes in technology or 
emerging threats. Nevertheless, the Commission understands that, 
particularly in the United States, NIST and ISO standards are heavily 
relied on by covered entities and referenced by other regulators, 
making them widely recognized as the leading industry standards for 
cybersecurity and operational risk management.
    a. Should the Commission further define or otherwise limit what 
constitutes ``generally accepted standards and best practices''? 
Specifically, should the Commission require covered entities to follow 
NIST or ISO standards, as some commenters on the RMP ANPRM recommended? 
\80\ Why or why not? Please explain.
---------------------------------------------------------------------------

    \80\ See, e.g., R.J. O'Brien Letter, supra note 13, at 6 (``The 
Commission should also seek to implement the [NIST CSF] as a part of 
its standard for managing and mitigating this area of risk. The NIST 
CSF is widely accepted throughout many different industries and 
would set a universal standard and best practices for registrants to 
follow.'').
---------------------------------------------------------------------------

    b. Are there any other standards or practices commonly relied on by 
covered entities that the Commission did not identify, directly or 
indirectly, in this notice? If so, please identify them and specify how 
they are currently relied on by covered entities.

B. Governance--Proposed Paragraph (c)

    The topic of governance has gained increased attention within the 
context of operational resilience, particularly with respect to the 
area of information and technology security. As of the date of this 
notice, NIST is undergoing a process to update the NIST CSF, and new 
governance outcomes are expected to feature prominently.\81\ Prudential 
regulators have also emphasized the role of effective governance to 
operational resilience.\82\ In the Commission's view, the overall 
objective of an effective governance regime for an ORF should be the 
integration of operational resilience topics into existing reporting 
lines and operational structures, including the entity's overall 
operational strategy, to ensure active executive engagement and 
oversight in the management of operational risk that could challenge a 
covered entity's operational resilience.\83\
---------------------------------------------------------------------------

    \81\ See NIST, NIST Cybersecurity Framework 2.0 Concept Paper: 
Potential Significant Updates to the Cybersecurity Framework at 10-
11 (Jan. 19, 2023) (discussing how the update ``will emphasize the 
importance of cybersecurity governance'' by adding a new govern 
function); see also CRI, The Profile Workbook: Guidance for 
Implementing the CRI Profile v1.2.1 and Responding to its Diagnostic 
Statements at 16 (rev. Jan. 2023) (CRI Profile Workbook) (providing 
guidance on governance outcomes that have already been incorporated 
into the NIST CSF financial services sector profile).
    \82\ See Prudential Operational Resilience Paper, supra note 11, 
at 3.
    \83\ See BCBS Operational Resilience Principles, supra note 11, 
at 4 (``Principle 1: Banks should utilise their existing governance 
structure to establish, oversee and implement an effective 
operational resilience approach that enables them to respond and 
adapt to, as well as recover and learn from, disruptive events in 
order to minimise their impact on delivering critical operations 
through disruption.'') (internal citation omitted).
---------------------------------------------------------------------------

1. Approval of Components--Proposed Paragraph (c)(1)
    Accordingly, to ensure that a covered entity's senior leadership is 
involved in key decision-making around operational resilience, and is 
ultimately held accountable for implementation of the ORF, the proposed 
rule would require covered entities to have their senior leadership 
annually approve the ORF.\84\ In recognition of the wide variety of 
corporate structures represented among covered entities, however, the 
proposed rule would give covered entities broad flexibility and 
discretion to identify the appropriate senior-level individual or body 
to provide such approval.
---------------------------------------------------------------------------

    \84\ See paragraph (c)(1) of proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

    Specifically, paragraph (c)(1) of the proposed rule would require 
that each ORF component program or plan required by paragraph (b)(2) of 
the proposed rule is approved in writing, on at least an annual basis, 
by either the senior officer, an oversight body, or a senior-level 
official of the covered entity.\85\ The term ``oversight body'' itself 
would be broadly defined to encompass any board, body, or committee of 
a board or body of the covered entity specifically granted the 
authority and responsibility for making strategic decisions, setting 
objectives and overall direction, implementing policies and procedures, 
or overseeing the management of operations for the covered entity.\86\ 
Consistent with Commission regulation 3.1(j), ``senior officer'' would 
mean the chief executive officer or other equivalent officer of the 
covered entity.\87\ As an example, under the proposed rule, a covered 
entity could elect to have its information and technology security 
program annually approved by its chief executive officer, its chief 
information security officer, or a committee with oversight authority 
over information and technology security.\88\ Again, the intention 
behind offering this flexibility is to ensure that covered entities 
would be able to rely on and incorporate operational resilience into 
their existing governance structures when complying with the proposed 
ORF rule, while ensuring that each component program or plan would be 
approved by an individual or group of individuals with senior-level 
responsibilities and authority.
---------------------------------------------------------------------------

    \85\ Id.
    \86\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``oversight body'').
    \87\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``senior officer''). See also 17 CFR 3.1(j) 
(defining ``senior officer'').
    \88\ Other possible senior-level officials could be the covered 
entity's chief risk officer or chief operating officer, as 
appropriate.
---------------------------------------------------------------------------

2. Risk Appetite and Risk Tolerance Limits--Proposed Paragraph (c)(2)
    The proposed rule would further require covered entities to 
establish and implement appropriate risk appetite and risk tolerance 
limits with respect to the three risk areas enumerated in paragraph 
(b)(1) (information and technology security, third-party relationships, 
and emergencies or other significant disruptions to the continuity of 
normal business operations).\89\ Although the terms ``risk appetite'' 
and ``risk tolerance'' are sometimes used interchangeably, the 
Commission intends the terms to have distinct meanings within the 
context of the proposed rule. Specifically, in the context of the 
proposed rule, ``risk appetite'' would mean the aggregate amount of 
risk a covered entity is willing to assume to achieve its strategic 
objectives.\90\ Risk appetite is typically documented through a risk 
appetite statement, which establishes qualitative and quantitative 
measures designed to help identify when risk appetite has been exceeded 
and what appropriate mitigating strategies that can be taken.\91\

[[Page 4715]]

With its proposed definition of ``risk tolerance limit,'' the 
Commission intends to capture a more focused measure of acceptable 
risk. Specifically, ``risk tolerance limit'' would mean the amount of 
risk, beyond its risk appetite, that a covered entity is prepared to 
tolerate through mitigating actions.\92\ Thus, risk tolerance limits 
assume a particular type of risk has materialized (e.g., an operational 
disruption has occurred) and identify the amount of disruption a firm 
is prepared to tolerate beyond its risk appetite.\93\ Risk tolerance 
limits are also more likely to be measured in quantitative terms (e.g., 
number of hours a particular system or application is down).\94\
---------------------------------------------------------------------------

    \89\ See paragraph (c)(2)(i) of proposed Commission regulations 
1.13 and 23.603. See also paragraph (b)(1) of proposed Commission 
regulations 1.11 and 23.603 (identifying the risk areas proposed to 
be covered by the ORF).
    \90\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``risk appetite''). See also 12 CFR part 30, 
app. D, I.E.10 (Definitions) (defining ``risk appetite'' as the 
aggregate level and types of risk the board of directors and 
management are willing to assume to achieve a covered bank's 
strategic objectives and business program, consistent with 
applicable capital, liquidity, and other regulatory requirements); 
Prudential Operational Resilience Paper, supra note 11, at 14 
(defining ``risk appetite'' as ``[t]he aggregate level and types of 
risk the board and senior management are willing to assume to 
achieve a firm's strategic business objectives, consistent with 
applicable capital, liquidity, and other requirements and 
constraints''); BCBS Operational Resilience Principles, supra note 
11, at 3, n.7 (defining ``risk appetite'' as ``the aggregate level 
and types of risk a bank is willing to assume, decided in advance 
and within its risk capacity, to achieve its strategic objectives 
and business program'').
    \91\ See 12 CFR part 30, app. D (requiring covered financial 
institutions to have a comprehensive written risk appetite 
statement). See also CRI Profile Workbook, supra note 78, at 16 
(``Risk appetite statements define certain risk tolerance metrics 
that help describe systems and services that the organization may 
consider high-risk.'').
    \92\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``risk tolerance limit''). See also Prudential 
Operational Resilience Paper, at 3, n. 11; 14 (defining ``tolerance 
for disruption'' as ``determined by a firm's risk appetite for 
weathering disruption from operational risks considering its risk 
profile and the capabilities of its supporting operational 
environment'' and ``informed by existing regulations and guidance 
and by the analysis of a range of severe but plausible scenarios 
that would affect its critical operations and core business 
lines.''); CRI Profile Workbook at 291 (stating that ``risk 
tolerance'' ``reflects the acceptable variation in outcomes related 
to specific performance measures linked to objectives the entity 
seeks to achieve''). ISACA, Risk IT Framework, 2nd Ed. (July 27, 
2020) (defining ``risk tolerance'' as ``the acceptable deviation 
from the level set by the risk appetite and business objectives'').
    \93\ The Commission recognizes that Commission regulations 1.11 
and 23.600 incorporate the term ``risk tolerance limits.'' See 17 
CFR 1.11(e)(1), 17 CFR 23.600(c)(1). As proposed to be defined in 
the ORF rule, however, ``risk tolerance limits'' would be limited to 
the context of the risks identified in paragraph (b)(1) of the 
proposed rule and associated disruptions. Accordingly, if adopted, 
the defined use of the term ``risk tolerance limit'' in the proposed 
rule would not be intended to affect how covered entities use or 
interpret the term in the context of the Commission's RMP rules.
    \94\ The Commission believes its proposed definitions are in 
line with proposed definitions of ``risk appetite'' and ``risk 
tolerance'' used by NIST. For example, in NIST Interagency or 
Internal Report 8286 (NIST IR 8286), NIST explains that a statement 
of risk appetite might be that ``[e]mail shall be available during 
the large majority of a 24-hour period,'' while the associated risk 
tolerance would be narrower, stating something like ``[e]mail 
services shall not be interrupted more than five minutes during core 
hours.'' See NIST IR 8286 at 5-6 (Oct. 2020). Accordingly, any 
existing risk appetite and risk tolerance limits established by 
covered entities pursuant to NIST or prudential regulator standards 
would be considered consistent with the proposed rule.
---------------------------------------------------------------------------

    As with each component ORF program or plan, the proposed rule would 
require that a covered entity's risk appetite and risk tolerance limits 
be reviewed and approved in writing on at least an annual basis by 
either the senior officer, an oversight body, or a senior-level 
official of the covered entity.\95\ This proposed requirement is 
intended to ensure that the risk appetite and risk tolerance limits are 
consistent with the covered entity's operational strategy and 
objectives, as established by senior leadership, and that senior 
leadership is involved in, and ultimately held accountable for, how 
operational risks faced by the covered entity are internalized by the 
covered entity.
---------------------------------------------------------------------------

    \95\ See paragraph (c)(2)(ii) of proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

    The setting and approval of risk appetite and risk tolerance limits 
for operational risk is a well-recognized key component of effective 
governance and oversight.\96\ The Commission therefore preliminarily 
believes the setting and approval of risk appetite and risk tolerance 
limits for operational risks captured by the ORF would be helpful to 
ensuring effective governance and oversight of the ORF. Specifically, 
the Commission believes that the process of identifying appropriate 
risk appetite and risk tolerance limits would have a disciplining 
effect, encouraging covered entities to think critically about the 
risks they face and their ability to comfortably manage them without 
incurring intolerable harm to themselves or their customers or 
counterparties. The Commission further believes that operating within 
set risk appetite and risk tolerance limits would help support a 
culture where senior leaders at covered entities can make more informed 
decisions about the risks they are willing to take and the mitigation 
measures they would need to employ to manage these risks, which would 
further support operational resilience.
---------------------------------------------------------------------------

    \96\ See, e.g., BCBS Operational Resilience Principles, supra 
note 11, at 4 (``The board of directors should review and approve 
the bank's operational resilience approach considering the bank's 
risk appetite and tolerance for disruption to its critical 
operations. In formulating the bank's tolerance for disruption, the 
board of directors should consider the bank's operational 
capabilities given a broad range of severe but plausible scenarios 
that would affect its critical operations. The board of directors 
should ensure that the bank's policies effectively address instances 
where the bank's capabilities are insufficient to meet its stated 
tolerance for disruption.''); CRI Profile v1.2, supra note 74.
---------------------------------------------------------------------------

3. Internal Escalations--Proposed Paragraph (c)(3)
    To further ensure that senior leadership remains involved in and 
accountable for the ORF as it is implemented, the proposed rule would 
require either the senior officer, an oversight body, or a senior-level 
official of the covered entity to be notified of: (i) circumstances 
that exceed the risk tolerance limits established pursuant to paragraph 
(c)(2)(i) of the proposed rule; and (ii) incidents that require 
notification to the Commission, customers, or counterparties under the 
proposed rule, as further discussed in subsequent sections of this 
notice.\97\
---------------------------------------------------------------------------

    \97\ See paragraph (c)(3) of proposed Commission regulations 
1.13 and 23.603. See also paragraphs (i) and (j) of proposed 
Commission regulations 1.13 and 23.603, discussed in section II.G of 
this notice, infra.
---------------------------------------------------------------------------

    The Commission believes that circumstances that would push a 
covered entity outside of its risk tolerance limits or trigger a 
Commission notification requirement would be extraordinary, non-
business-as-usual events, and would likely require the involvement of 
senior leadership to direct responsive actions to preserve or mitigate 
damage to operational resilience and prevent situations of intolerable 
harm. Ensuring that appropriate senior leadership, as determined by the 
covered entity, is apprised of instances where expected risk tolerance 
limits have been exceeded would further help senior leadership 
determine whether the risk appetite and risk tolerance limits are 
appropriately calibrated and whether identified mitigation strategies 
are working, creating opportunities to update either as necessary.
4. Consolidated Program or Plan--Proposed Paragraph (c)(4)
    The Commission is aware that many covered entities function as a 
division or affiliate of a larger entity or holding company structure; 
and that, in such instances, operational risks stemming from 
information and technology security, third-party relationships, and 
emergencies or other significant disruptions are generally monitored 
and managed at the enterprise level to address the risks holistically 
and to achieve economies of scale.\98\ The proposed rule recognizes the 
benefits of such a consolidated approach and is not intended to 
interfere with covered entities' operational structures. Accordingly, 
the proposed rule would allow covered entities to satisfy the component 
program or plan requirement in paragraph (b)(2) through its 
participation in a consolidated program or plan, provided the 
consolidated program or plan meets the

[[Page 4716]]

requirements of the proposed rule.\99\ As defined in the proposed rule, 
a ``consolidated program or plan'' would mean any information and 
technology security program, third-party relationship program, or 
business continuity and disaster recovery plan in which a covered 
entity participates with one or more affiliates and is managed and 
approved at the enterprise level.\100\
---------------------------------------------------------------------------

    \98\ In responding to the RMP ANPRM, several commenters noted 
how cybersecurity risk is generally managed at the enterprise level 
and should not be managed at the level of the entity regulated by 
the Commission. See FIA Letter at 11 (Sept. 18, 2023); International 
Swaps and Derivatives Association, Inc. (``ISDA'') and the 
Securities Industry and Financial Markets Association (``SIFMA'') 
Letter at 9 (Sept. 18, 2023).
    \99\ See paragraph (c)(4)(i) of proposed Commission regulations 
1.13 and 23.603.
    \100\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``consolidated program''). Again, the specific 
definitions and minimum requirements of each program are discussed 
in sections II.C, II.D, and II.E of this notice, infra.
---------------------------------------------------------------------------

    Nevertheless, the Commission does have a strong regulatory interest 
in ensuring that operational shocks, such as cyber incidents or 
technological failures, having an impact on the discrete interests and 
operations of the covered entity are appropriately considered through 
the unique lens of the covered entity, which is regulated by the 
Commission. Accordingly, for a covered entity to satisfy the component 
program or plan requirement through its participation in a consolidated 
program or plan, the consolidated program or plan would need to meet 
the requirements of the proposed rule, as discussed in this notice. 
Those requirements include the establishment of appropriate risk 
appetite and risk tolerance limits that address the covered entity, as 
well as testing and other requirements, as discussed further below.
    With respect to the requirements in proposed paragraphs (c)(1) and 
(c)(2)(i) that senior leadership of the covered entity approve, 
respectively, the component program or plan and the risk appetite and 
risk tolerance limits at least annually, the Commission recognizes that 
such a requirement might be challenging in the context of a 
consolidated program or plan, which is likely to address matters 
related to affiliates that are not within the scope of knowledge or 
responsibility of the covered entity. Accordingly, the proposed rule 
would allow covered entities relying on a consolidated program or plan 
to satisfy the approval requirements in paragraphs (c)(1) and (c)(2)(i) 
of the proposed rule, provided that either the senior officer, an 
oversight body, or a senior-level official of the covered entity 
attests in writing, on at least an annual basis, that the consolidated 
program or plan meets the requirements of this section and reflects the 
risk appetite and risk tolerance limits appropriate to the covered 
entity.\101\ Notably, the senior officer, an oversight body, or a 
senior-level official at the covered entity would still need to be 
notified when the risk appetite and risk tolerance limits related to 
the covered entity are exceeded.\102\ The Commission believes that such 
an attestation requirement would promote efficiency by allowing covered 
entities to continue to rely on an enterprise-level ORF and governance 
structures that have acknowledged benefits while also ensuring that 
such enterprise-level ORF appropriately addresses the risks specific to 
the covered entity, and would ensure that the requirements of the 
Commission's proposed rule are addressed for those covered entities in 
the same way as they would for a covered entity that is not a part of a 
larger enterprise.\103\
---------------------------------------------------------------------------

    \101\ See paragraph (c)(4)(ii) of proposed Commission 
regulations 1.13 and 23.603.
    \102\ See paragraph (c)(3)(i) of proposed Commission regulations 
1.13 and 23.603.
    \103\ The Commission also believes this approach would be 
consistent with NFA's current interpretive notice on ISSPs. See NFA 
ISSP Notice, supra note 43 (``[T]o the extent a Member firm is part 
of a holding company that has adopted and implemented privacy and 
security safeguards organization-wide, then the Member firm can meet 
its supervisory responsibilities imposed by Compliance Rules 2-9, 2-
36 and 2-49 to address the risks associated with information systems 
through its participation in a consolidated entity ISSP.'').
---------------------------------------------------------------------------

5. Request for Comment
    The Commission invites comment on all aspects of the proposed 
governance requirements for the ORF, including the following questions:
    1. Governance structures. The proposed rule is intended to provide 
covered entities sufficient flexibility to integrate the proposed 
operational resilience requirements into existing reporting lines and 
operational structures, as well as to select the individual or body 
with senior-level responsibilities and authority to approve the 
component programs or plans of the ORF. Does the proposed rule 
accomplish this goal? If not, what other governance structure(s) should 
the Commission consider? Alternatively, should the Commission consider 
a more prescriptive, bright-line approach where only the senior officer 
or board of directors of the covered entity may provide any approvals 
required under the proposed rule? Please explain.
    2. Internal escalations. The proposed rule would require that the 
senior officer, an oversight body, or other senior-level official(s) of 
the covered entity be notified of circumstances that exceed risk 
tolerance limits or that require reporting to the Commission or 
counterparties or customers under the proposed rule. Should the 
Commission require internal escalation to any other specific personnel 
or under any other circumstances? Please identify and explain why.
    3. Consolidated program or plan. The proposed rule would allow 
covered entities relying on a consolidated program or plan to satisfy 
certain governance requirements by requiring the senior officer, an 
oversight body, or another senior-level official of the covered entity 
to attest in writing, on at least an annual basis, that the 
consolidated program or plan meets the requirements of the rule and 
reflects a risk appetite and risk tolerance limits appropriate to the 
covered entity. Is this standard workable for covered entities that 
function as a division or affiliate of a larger entity or holding 
company? Why or why not? Do such covered entities typically set their 
own risk appetite and risk tolerance limits, or are setting such limits 
conducted at the enterprise level? If they are set at the enterprise 
level, how is senior leadership of the covered entity typically 
involved in setting risk appetite and risk tolerance limits?

C. Information and Technology Security Program--Proposed Paragraph (d)

    As mentioned above, the proposed rule would require each covered 
entity's ORF to include an information and technology security program, 
defined as a written program reasonably designed to identify, monitor, 
manage, and assess risks relating to information and technology 
security and that meets the minimum requirements for the program, as 
set forth in the proposed rule and discussed below.\104\ The proposed 
rule would define ``information and technology security'' as the 
preservation of (a) the confidentiality, integrity, and availability of 
covered information and (b) the reliability, security, capacity, and 
resilience of covered technology.\105\ ``Covered information'' would be 
defined to mean any sensitive or confidential data or information 
maintained by a covered entity in connection with its business 
activities as a covered entity.\106\ ``Covered technology'' would be 
defined to mean any application, device, information technology asset, 
network service,

[[Page 4717]]

system, and other information-handling component, including the 
operating environment, that is used by a covered entity to conduct its 
business activities, or to meet its regulatory obligations, as a 
covered entity.\107\
---------------------------------------------------------------------------

    \104\ See paragraph (d) of proposed Commission regulations 1.13 
and 23.603. See also paragraph (a) of proposed Commission 
regulations 1.13 and 23.603 (defining ``information and technology 
security program'').
    \105\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``information and technology security'').
    \106\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``covered information'').
    \107\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``covered technology'').
---------------------------------------------------------------------------

    The proposed definition of ``covered information'' is intended to 
focus the requirements of the ORF on protecting data and information 
that are sensitive or otherwise intended to be kept confidential, 
whether by law or for business purposes. Notably, such data and 
information would include position, order, and account information, all 
of which covered entities have an obligation to keep confidential and 
which if made public could result in harm to customers, counterparties, 
or the markets more broadly. Often referred to as the ``CIA triad,'' 
confidentiality, integrity, and availability represent the three 
pillars of information security: preserving authorized restrictions on 
information access and disclosure, including means for protecting 
personal privacy and proprietary information; guarding against the 
improper modification or destruction of data and information, ensuring 
its authenticity; and ensuring the timely and reliable access to and 
use of information.\108\ The Commission therefore believes that 
compromising any aspect of the CIA triad with respect to covered 
information would have meaningful consequences for customers, 
counterparties, the covered entity, or even the market.
---------------------------------------------------------------------------

    \108\ See NIST, SP 1800-26, Data Integrity: Detecting and 
Responding to Ransomware and Other Destructive Events (Dec. 2020) 
(discussing the CIA triad).
---------------------------------------------------------------------------

    The proposed definition of ``information and technology security'' 
is likewise intended to ensure that the ORF is designed to address 
risks to two key facets of a covered entities' business for which they 
are registered with the Commission: the technology they use to conduct 
their regulated business activities and the sensitive information 
stored or transmitted therein. The proposed definition of ``covered 
technology'' is sufficiently broad to capture all types of technology 
(and related components) but is tailored to focus on the technology 
that is used by covered entities in the context of their regulated 
business activities, such that its disruption would have an impact on 
regulated business activities. The Commission preliminarily believes 
that reliability, security, capacity, and resilience are all key 
attributes of covered technology that must be preserved for it to 
function as intended without posing a disruption to operations. 
Accordingly, the Commission believes that having a program designed to 
preserve the confidentiality, integrity, and availability of covered 
information and the reliability, security, capacity, and resilience of 
covered technology is key to ensuring operational resilience.
    Under the proposed rule, each covered entity's information and 
technology security program would need to meet the (b)(3) standard, 
i.e., be appropriate and proportionate to the nature, size, scope, 
complexities and risk profiles of the covered entity's business 
activities, following generally accepted standards and best 
practices.\109\ The proposed rule would nevertheless establish certain 
minimum requirements for the information and technology security 
program, including a periodic risk assessment, effective controls, and 
an incident response plan. Each proposed minimum requirement is 
discussed in turn below.
---------------------------------------------------------------------------

    \109\ See paragraph (b)(3) of proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

1. Risk Assessment--Proposed Paragraph (d)(1)
    As part of the information and technology security program, covered 
entities would be required to conduct and document the results of a 
periodic and comprehensive risk assessment reasonably designed to 
identify, assess, and prioritize risks to information and technology 
security.\110\ Risk assessments are widely recognized as a necessary 
and effective first step to monitoring and managing risks to 
information and technology security.\111\ According to NIST, the 
purpose of a risk assessment is to inform decision makers and support 
risk responses by identifying: (i) relevant threats to organizations or 
threats directed through organizations against other organizations; 
(ii) vulnerabilities both internal and external to organizations; (iii) 
impact (i.e., harm) to organizations that may occur given the potential 
for threats exploiting vulnerabilities; and (iv) the likelihood that 
harm will occur.\112\ Given this broad and important purpose, the 
Commission believes conducting a comprehensive risk assessment would be 
reasonably necessary for covered entities to have a thorough 
understanding of their information and technology security risks, 
including the types of threats the covered entities face, internal and 
external vulnerabilities, the impact of such risks, and their relative 
priorities, to guide mitigation efforts.
---------------------------------------------------------------------------

    \110\ See paragraph (d)(1)(i) proposed Commission regulations 
1.13 and 23.603.
    \111\ See, e.g., ISO/IEC 27001:2022, supra note 48 (requiring a 
risk assessment to help organizations identify, analyze, and 
evaluate weaknesses in their information systems); ISO/IEC 
31010:2019, Risk management: Risk assessment techniques (July 2, 
2019); NIST, SP 800-39, Managing Information Security Risk: 
Organization, Mission, and Information System View at 37 (Mar. 2011) 
(NIST SP 800-39) (``Risk assessment identifies, prioritizes, and 
estimates risk to organizational operations (i.e., mission, 
functions, image, and reputation), organizational assets, 
individuals, other organizations, and the Nation, resulting from the 
operation and use of information systems. Risk assessments use the 
results of threat and vulnerability assessments to identify and 
evaluate risk in terms of likelihood of occurrence and potential 
adverse impact (i.e., magnitude of harm) to organizations, assets, 
and individuals.''); NIST, SP 800-30, Guide for Conducting Risk 
Assessments, Rev. 1, at ix (Sept. 2012) (NIST SP 800-30) (``Risk 
assessments are a key part of effective risk management and 
facilitate decision making . . .''). See also 12 CFR part 30, app. B 
(establishing a requirement to assess risk by identifying reasonably 
foreseeable threats, assessing the likelihood and potential damage 
of the threats, and assessing the sufficiency of arrangements to 
control risks); Prudential Operational Resilience Paper, supra note 
11, at 4 (``The firm's operational risk management function 
implements and maintains risk identification and assessment 
approaches that adequately capture business processes and their 
associated operational risks, including technology and third-party 
risks.'').
    \112\ See NIST SP 800-30 at 1.
---------------------------------------------------------------------------

    As stated, the risk assessment would need to identify, assess, and 
prioritize risks to information and technology security.\113\ In broad 
terms, the Commission anticipates that conducting the assessment could 
first involve taking an inventory of covered technology and then 
identifying and assessing the likelihood and potential impact of 
reasonably foreseeable threats and vulnerabilities to information and 
technology security (i.e., to the confidentiality, integrity, and 
availability of covered information, or to the reliability, security, 
capacity or resilience of covered technology) in light of the existing 
operational environment. Identified threats and vulnerabilities could 
derive from a wide array of sources, including both external cyber 
threats and internal gaps in existing systems or controls.
---------------------------------------------------------------------------

    \113\ See paragraph (d)(1)(i) proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

    The Commission would then expect the risks to be prioritized in 
light of the covered entity's stated risk appetite and risk tolerance 
limits to help direct resources and other activities in order to best 
support information and technology security. If the proposal is adopted 
as final, the Commission would expect covered entities to use the 
results of each risk assessment as a basis for designing, implementing, 
and refining other elements of its information and technology security 
program, including

[[Page 4718]]

but not limited to, the development of controls, testing protocols, and 
the incident response plan, as discussed further below.\114\ In this 
way, a well-conducted risk assessment should support the development of 
a more rational, effective, and valuable information and technology 
security framework, especially as the assessment is repeated and built 
upon over time.
---------------------------------------------------------------------------

    \114\ See NIST SP 800-39 at 34 (``Information generated during 
the risk assessment may influence the original assumptions, change 
the constraints regarding appropriate risk responses, identify 
additional tradeoffs, or shift priorities.'').
---------------------------------------------------------------------------

    The proposed rule would not prescribe a specific process or 
methodology for the risk assessment, but the risk assessment would need 
to be consistent with the proposed (b)(3) standard.\115\ Following 
generally accepted standards and best practices, covered entities would 
need to implement processes and methodologies that ensure the risk 
assessment reflects the nature, size, scope, complexities, and risk 
profile of its business activities as a covered entity. Any such 
processes or methodologies should also be sufficient to identify, 
assess, and prioritize risks to information and technology security and 
to evaluate their potential impact on covered technology and covered 
information.\116\
---------------------------------------------------------------------------

    \115\ See paragraph (b)(3) of proposed Commission regulations 
1.13 and 23.603, discussed supra. The Commission is aware of several 
sources for industry standards and best practices regarding 
information security risk assessments. See, e.g., NIST SP 800-39; 
see also FFIEC Information Security Booklet, supra note 69.
    \116\ See paragraph (d)(1)(i) of proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

    To ensure that the risk assessment is conducted objectively, the 
proposal would require that the personnel involved in conducting the 
assessment are not responsible for the development or implementation of 
the covered technology or related controls.\117\ Such personnel could 
be employees of the covered entity, an affiliated entity, or a third-
party service provider. To ensure that senior leadership is aware of 
risks to information security, and can appropriately prioritize them 
within the covered entity's broader strategy and risk management 
framework, the proposed rule would expressly require that the results 
of the risk assessment be provided to the senior officer, oversight 
body, or other senior-level official who approves the information and 
technology security program upon the risk assessment's completion.\118\ 
The Commission believes the results of the risk assessment would be key 
information for senior leadership in determining whether to approve an 
information and technology security program.
---------------------------------------------------------------------------

    \117\ See paragraph (d)(1)(ii) of proposed Commission 
regulations 1.13 and 23.603.
    \118\ See paragraph (d)(1)(iii) of proposed Commission 
regulations 1.13 and 23.603. See also NIST SP 800-30, supra note 
111, at 1 (``The purpose of risk assessments is to inform decision 
makers and support risk responses . . .'').
---------------------------------------------------------------------------

    The proposed rule would require that the covered entity conduct the 
risk assessment at a frequency consistent with the (b)(3) standard 
(i.e., a frequency appropriate and proportionate to the nature, scope, 
and complexities of its business activities as a covered entity, 
following generally accepted standards and best practices) but, in any 
case, no less frequently than annually.\119\ Given the rapidly evolving 
nature of technological developments and related threats, the 
Commission preliminarily believes that a uniform requirement to conduct 
a risk assessment on at least an annual basis would support the 
development of a strong, foundational level of information and 
technology security across the industry, thereby mitigating the overall 
threat of systemic risk. However, the Commission understands that 
generally accepted standards and best practices may encourage more 
frequent risk assessments for covered entities that engage in broader 
or more complex business activities and would expect covered entities 
to conduct risk assessments more frequently if the circumstances so 
require.
---------------------------------------------------------------------------

    \119\ See paragraph (d)(1)(ii) of proposed Commission 
regulations 1.13 and 23.603.
---------------------------------------------------------------------------

    As mentioned above, the proposed rule would allow covered entities 
to satisfy the requirement to have an information and technology 
security program through its participation in a consolidated 
information and technology security program.\120\ Accordingly, such 
covered entities would be allowed to rely on a risk assessment that is 
conducted at an enterprise level. In such cases, the Commission would 
expect that the covered entities review the program and supporting 
policies and procedures for conducting the risk assessment to ensure it 
captures and assesses the risks to the covered entity consistent with 
the proposed rule so as to support the related attestation 
requirement.\121\
---------------------------------------------------------------------------

    \120\ See paragraph (c)(4)(i) of proposed Commission regulations 
1.13 and 23.603.
    \121\ See paragraph (c)(4)(ii) of proposed Commission 
regulations 1.13 and 23.603.
---------------------------------------------------------------------------

2. Effective Controls--Proposed Paragraph (d)(2)
    The proposed rule would require that the information and technology 
security program establish, document, implement, and maintain controls 
reasonably designed to prevent, detect, and mitigate identified risks 
to information and technology security.\122\ An essential component of 
any information and technology security program, and a critical 
component of a covered entity's overall ORF, controls (also referred to 
as ``countermeasures'' or ``safeguards'') include any measures 
(actions, devices, procedures, techniques) designed to promote 
information and technology security.\123\ The selection, design, and 
implementation of controls can therefore have significant implications 
for a covered entity's information and technology security and overall 
operational resilience.\124\ Accordingly, the Commission believes 
effective controls would be a critical component of a covered entity's 
overall ORF.
---------------------------------------------------------------------------

    \122\ See paragraph (d)(2) of proposed Commission regulations 
1.13 and 23.603.
    \123\ See Committee on Payments and Market Infrastructures 
(CPMI), IOSCO, Guidance on cyber resilience for financial market 
infrastructures at 7 (Jun. 2016) (CPMI IOSCO Cyber Resilience 
Guidance) (noting that a strong information and communications 
technologies control environment is a fundamental and critical 
component of overall cyber resilience). See also NIST SP 800-53, 
supra note 46, at 8 (``Controls can be viewed as descriptions of the 
safeguards and protection capabilities appropriate for achieving the 
particular security and privacy objectives of the organization and 
reflecting the protection needs of organizational stakeholders. 
Controls are selected and implemented by the organization in order 
to satisfy the system requirements. Controls can include 
administrative, technical, and physical aspects.''); ISO/IEC 
27001:2022, supra note 48, Annex A (Information security management 
systems) (providing guidelines for 93 objectives and controls).
    \124\ See Prudential Operational Resilience Paper, supra note 
11, at 8 (identifying as a sound practice for operational resilience 
routinely applying and evaluating the effectiveness of processes and 
controls to protect confidentiality, integrity, availability, and 
overall security of data and information systems).
---------------------------------------------------------------------------

    Although the proposed rule would not mandate that covered entities 
implement specific controls, it would require covered entities to 
consider, at a minimum, certain categories of controls, discussed 
below, and adopt those consistent with the (b)(3) standard.\125\ If the 
proposal is adopted as final, the Commission would further expect that 
a particular covered entity's determination of which controls to 
implement would be guided by the results of its risk assessment, 
considering the covered entity's risk appetite and risk tolerance 
limits.\126\

[[Page 4719]]

Adopted controls would also need to address risks to information and 
technology security identified through other means, including outcomes 
of continuous monitoring of threats and vulnerabilities, actual and 
attempted cyber-attacks, threat intelligence, scenario analysis, and 
the likelihood and realistic impact of such attacks. In other words, 
the controls would need to be linked to and address the identified and 
prioritized risks to information and technology security. The 
Commission would advise covered entities to document their 
consideration of controls within each of the enumerated categories and 
their reasoning for adopting specific controls within any given 
category, or for declining to adopt any controls within a particular 
category. Further, the Commission would expect those controls to be 
reviewed and revised as needed to reflect the results of the covered 
entity's most recent risk assessment.
---------------------------------------------------------------------------

    \125\ See paragraphs (d)(2)(i)-(xii) of proposed Commission 
regulations 1.13 and 23.603 (identifying categories of controls for 
covered entities to consider). See also paragraph (b)(3) of proposed 
Commission regulations 1.13 and 23.603.
    \126\ See paragraph (c)(2) of proposed Commission regulations 
1.13 and 23.603 (requiring covered entities to establish and 
implement risk appetite and risk tolerance limits).
---------------------------------------------------------------------------

    The specific categories of controls the Commission would require 
covered entities to consider under the proposed rule include: access 
controls; access restrictions; encryption; dual control 
procedures,\127\ segregation of duties, and background checks; change 
management practices; system development and configuration management 
practices; flaw remediation; measures to protect against destruction, 
loss, or damage to covered information; monitoring systems and 
procedures to detect attacks or intrusions; response programs; and 
measures to promptly recover and secure any compromised covered 
information.\128\
---------------------------------------------------------------------------

    \127\ Dual control procedures refer to a technique that requires 
two or more separate persons, operating together, to protect 
sensitive data and information. Both persons are equally responsible 
for protecting the information and neither can access the 
information alone. See Interagency Guidelines Establishing Standards 
for Safeguarding Customer Information and Rescission of Year 2000 
Standards for Safety and Soundness, 66 FR 8616, 8622 (Feb. 1, 2001) 
(Interagency Guidelines Safeguarding Customer Information).
    \128\ See paragraphs (d)(2)(i)-(xi) of proposed Commission 
regulations 1.13 and 23.600.
---------------------------------------------------------------------------

    The Commission preliminarily believes that these categories of 
controls collectively represent a comprehensive array of controls for 
ensuring the information and technology security. Access controls, 
access restrictions, encryption, and background checks would limit 
access to covered technology and covered information to individuals 
with a legitimate business need in both physical and digital 
environments. Dual control procedures, segregation of duties, 
procedures relating to modifications to covered technology, and 
measures to protect against destruction, loss, or damage to covered 
information, would support the integrity and availability of covered 
information from accidental or intentional damage or disclosure to 
unauthorized recipients. Change management practices would ensure that 
the information and technology security program, and associated 
controls, continue to operate as intended over time as systems and 
processes are updated. Systems development, configuration management, 
and flaw remediation practices would operate to ensure the integrity 
and availability of covered technology throughout any updates to 
covered technology or following a vulnerability analysis.\129\ Measures 
to protect against destruction of covered information due to 
environmental hazards would further ensure that covered information 
remains available even following a physical disruption. Monitoring 
systems and procedures, response programs, and measures to promptly 
recover and secure any compromised covered information would serve to 
detect unauthorized access to covered information and to recover it if 
the covered entity's access to the covered information were impaired 
(e.g., through a ransomware attack).
---------------------------------------------------------------------------

    \129\ Based on its experience, the Commission further believes 
that that failures in change management, systems development, and 
vulnerability patching practices are common sources of disruption 
among financial institutions and are often neglected control areas.
---------------------------------------------------------------------------

    The proposed rule is modeled after an approach adopted by 
prudential regulators. Since the early 2000s, prudential regulators 
have required financial institutions to consider a similar list of 
categories of controls when designing their information security 
programs.\130\ In adopting their list of categories, prudential 
regulators described them as designed to control identified risks and 
to achieve the overall objective of ensuring the security and 
confidentiality of customer information.\131\ Prudential regulators 
further emphasized that the categories were broad enough to be adapted 
by institutions of varying sizes, scope of operations, and risk 
management structures, such that the manner of implementing the 
guidelines would vary from institution to institution.\132\ Given that 
the list of control categories developed by prudential regulators, many 
of which are included in the Commission's proposed rule, has a 
longstanding history of being effective and adaptable to the financial 
industry at large, the Commission preliminarily believes that 
incorporating a similar approach with respect to covered entities would 
also further the Commission's intent to adopt a flexible rule that can 
be tailored to each individual covered entity and adapted over time to 
respond to changing threat environments and risk profiles.\133\
---------------------------------------------------------------------------

    \130\ See Interagency Guidelines Safeguarding Customer 
Information, 66 FR 8616; see also 12 CFR part 30, app. B. The 
guidelines were expanded and retitled, ``Interagency Guidelines 
Establishing Information Security Standards'' in 2004, see Proper 
Disposal of Consumer Information Under the Fair and Accurate Credit 
Transactions Act of 2003, 69 FR 77610 (Dec. 28, 2004).
    \131\ See Interagency Guidelines Safeguarding Customer 
Information, 66 FR 8621.
    \132\ Commenters further supported the level of detail, see id. 
at 8622.
    \133\ NIST has compiled a comprehensive catalog of security and 
privacy controls for all types of computing platforms, including 
general purpose computing systems, cyber-physical systems, cloud 
systems, mobile systems, and Internet of Things (IoT) devices. See 
NIST SP 800-53, supra note 123.
---------------------------------------------------------------------------

3. Incident Response Plan--Proposed Paragraph (d)(3)
    The proposed rule would require that the information and technology 
security program include a written incident response plan that is 
reasonably designed to detect, assess, contain, mitigate the impact of, 
and recover from an incident.\134\ A hallmark of operational resilience 
is the recognition that although meaningful steps can be taken to 
prevent and deter risks to information and technology security, such 
risks may never be entirely eliminated.\135\ As the ION incident 
illustrated, quick and complete recovery of covered technology and 
operations may be key to mitigating the potential systemic impact to 
the financial markets. Accordingly, a crucial aspect of any information 
and technology security program, and therefore any ORF, is having a 
plan to respond to and recover from events that may create risks to 
information and technology security.\136\

[[Page 4720]]

The Commission believes, therefore, that an effective incident response 
plan would help covered entities minimize the potential impact to their 
operations and customers or counterparties when negative events occur, 
facilitating their recovery as swiftly and successfully as 
possible.\137\ It can also assist in securing against the destruction 
or theft of sensitive and important confidential customer or 
counterparty information, which could have a very real impact on their 
business and assets.
---------------------------------------------------------------------------

    \134\ See paragraph (d)(3) of proposed Commission regulations 
1.13 and 23.603. The Commission is aware that some covered entities 
may have established an incident response plan as a separate 
document or as an attachment to another plan, such as a BCDR plan. 
If the proposed rule is adopted, the Commission would be agnostic as 
to where a covered entity elects to house its incident response plan 
provided it otherwise meets the requirements of the proposed rule, 
including recordkeeping, furnishing it to the Commission upon 
request, and distributing it to personnel.
    \135\ See BCBS Operational Resilience Principles, supra note 12, 
at 1 (stating that, in recognition that ``the range of potential 
hazards cannot be prevented,'' the focus should be on ``the ability 
of banks to withstand, adapt to and recover from potential hazards 
and thereby mitigate potentially severe adverse impacts'').
    \136\ See, e.g., BCBS Operational Resilience Principles at 7, 
n.18 (``The goal of incident management is to limit the disruption 
and restore critical operations in line with the bank's risk 
tolerance for disruption.''). See also FFIEC Information Security 
Booklet, supra note 69, 50-51 (``containing the incident, 
coordinating with law enforcement and third parties, restoring 
systems, preserving data and evidence, providing assistance to 
customers, and otherwise facilitating operational resilience''); 
NIST, SP 800-184, Guide for Cybersecurity Event Recovery (Dec. 2016) 
(NIST SP 800-184) (``evaluate the potential impact, planned response 
activities, and resulting recovery processes long before an actual 
cyber event takes place''); CIS, Incident Response Policy Template: 
Critical Security Controls (Mar. 8, 2023) at 4 (``The primary goal 
of incident response is to identify threats on the enterprise, 
respond to them before they can spread, and remediate them before 
they can cause harm.'') (CIS Incident Response Template).
    \137\ See FFIEC, CAT at 52 (May 2017) (``The incident response 
plan is designed to ensure recovery from disruption of services, 
assurance of data integrity, and recovery of lost or corrupted data 
following a cybersecurity incident''); CPMI IOSCO Cyber Resilience 
Guidance, supra note 123, at 16 (recognizing the incident response 
plan enables the business ``to resume critical operations rapidly, 
safely and with accurate data'').
---------------------------------------------------------------------------

    For purposes of the proposed rule, ``incident'' would be defined as 
any event, occurrence, or circumstance that could jeopardize 
information and technology security, including if it occurs at a third-
party service provider.\138\ The purpose of the incident response plan 
is to identify and classify foreseeable types of incidents and to 
establish steps to detect, assess, contain, mitigate the impact of, and 
recover from incidents. The Commission's proposed definition of 
``incident'' is intentionally broad to ensure that the incident 
response plan would address any event that could reasonably jeopardize 
(i.e., endanger or put at risk) information and technology security, 
even if that danger never materializes or the incident response plan is 
otherwise successful at preventing or reversing the danger. As defined 
in the proposed rule, ``incident'' is broad enough to cover various 
types of risks to covered technology (e.g., disruption or modification) 
or covered information (e.g., disclosure or destruction), regardless of 
the source (e.g., external threat actor or internal staff, physical or 
electronic) or whether the event was accidental or malicious in nature, 
since intent may not be readily determined at the outset of an 
incident. Common examples of incidents would include unauthorized 
access to a system or data; unauthorized changes to system hardware, 
software, or data; or a failure of controls that could, if not 
addressed, endanger information and technology security.
---------------------------------------------------------------------------

    \138\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``incident'').
---------------------------------------------------------------------------

    Consistent with the general framework for the ORF as a whole, the 
proposal would require the incident response plan to meet certain 
minimum requirements.\139\ In broad terms, these requirements focus on 
identifying persons relevant to an incident response (i.e., personnel 
involved in responding to the incident and persons who should be 
notified of such incidents) and how and when they should be involved; 
documenting the nature of the covered entity's response; and 
remediating any weaknesses that lead to the incident.\140\ The 
Commission believes that clearly identifying parties who would be 
involved in incident response, including external parties like third-
party service providers and law enforcement, and establishing 
associated roles and responsibilities would help ensure that incidents 
are: (1) resolved in a timely manner and by appropriate personnel; (2) 
adequately resourced financially, operationally, and staffing-wise; and 
(3) disclosed to appropriate persons either within senior leadership of 
the covered entity or externally, where required.\141\ The process of 
documenting incidents and management's response, as well as any 
subsequent remediation efforts, would assist with any related reporting 
obligations and required information sharing, as well as with 
subsequent testing of the incident response plan or post-mortem 
analysis, which would potentially lead to adjustments in subsequent 
risk assessments and provide lessons learned that could serve to help 
prevent the occurrence of incidents in the future.\142\
---------------------------------------------------------------------------

    \139\ See paragraphs (d)(3)(i)-(vi) of proposed Commission 
regulations 1.13 and 23.603.
    \140\ See id.
    \141\ See also NIST SP 800-61 (``It is important to identify 
other groups within the organization that may need to participate in 
incident handling so that their cooperation can be solicited before 
it is needed. Every incident response team relies on the expertise, 
judgment, and abilities of others . . .'').
    \142\ See NIST SP 800-184, supra note 132; CIS Incident Response 
Template, supra note 136, at 4 (``Without understanding the full 
scope of an incident, how it happened, and what can be done to 
prevent it from happening again, defenders will just be in a 
perpetual `whack-a-mole' pattern.'').
---------------------------------------------------------------------------

    Among these minimum requirements for the incident response plan is 
the need for it to include escalation protocols, i.e., a process of 
identifying when to involve or alert specific personnel, including 
senior leadership, of an incident.\143\ Specifically, the proposed rule 
would require that the senior officer, oversight body, or other senior-
level official that has primary responsibility for overseeing the 
information and technology security program; the Chief Compliance 
Officer (CCO); \144\ and any other relevant personnel be timely 
informed of incidents that may significantly impact the covered 
entity's regulatory obligations or require notification to the 
Commission.\145\ This provision is designed to ensure that every 
individual who has a role in responding to an incident at a covered 
entity would be appropriately notified. CCOs of covered entities in 
particular have a duty to take reasonable steps to ensure compliance 
with Commission regulations relating to the covered entities' business 
as a covered entity.\146\ Timely disclosure of incidents to the CCO 
that could impact a covered entity's regulatory obligations or require 
disclosure to the Commission would therefore be crucial for a covered 
entity CCO to fulfill the duty to take reasonable steps to ensure 
compliance. As previously discussed above in the section addressing 
governance, the Commission believes that involving senior leadership in 
incident response would be particularly important to ensure that they 
are apprised of and held accountable for the ultimate effectiveness of 
the ORF, and that incidents receive proper attention and are swiftly 
addressed.
---------------------------------------------------------------------------

    \143\ See paragraph (d)(3)(ii) of proposed Commission 
regulations 1.13 and 23.603.
    \144\ See 17 CFR 3.3 (establishing the qualifications and duties 
of covered entity CCOs).
    \145\ See paragraph (d)(3)(ii) of proposed Commission 
regulations 1.13 and 23.603. See also paragraph (i) of proposed 
Commission regulations 1.13 and 23.603 (requiring notification of 
certain incidents to the Commission), discussed in section II.H of 
this release, infra.
    \146\ See 17 CFR 3.3(d)(3).
---------------------------------------------------------------------------

4. Request for Comment
    The Commission invites comment on all aspects of the proposed 
information and technology security program requirement, including the 
following questions:
    1. Risk Assessment.
    a. The proposed rule would require that the risk assessment be 
provided to relevant senior leadership of the covered entity upon its 
completion but would not require that such senior leadership certify in 
writing that they have received the results of the risk assessment or 
approve the results of the risk assessment. Such approvals and 
certifications may be required in other contexts to ensure that senior 
leadership

[[Page 4721]]

is aware of risk assessments and consider them in establishing 
strategic goals, risk appetite, and risk tolerance limits. Should the 
Commission require such a certification or approval? Why or why not? 
Please explain.
    b. Given the rapidly evolving technological and threat landscape, 
the proposed rule would require risk assessments to be performed on at 
least an annual basis to support the mitigation of systemic risk and 
develop a strong baseline standard across covered entities. The 
Commission is aware of standards imposing risk assessments as 
frequently as every six months and as infrequently as every two years. 
Should the Commission consider a shorter or longer baseline frequency 
for risk assessments? Why or why not? Please explain.
    2. Effective controls. The proposed rule would require covered 
entities to consider broad categories of controls and determine which 
to adopt consistent with the proposed (b)(3) standard. The Commission 
is also aware that certain controls, including firewalls, antivirus, 
and multifactor authentication (MFA) are commonly recommended within 
the industry. With respect to MFA, which requires users to present two 
or more authentication factors at login to verify their identity before 
they are granted access, CISA advises that implementing MFA is 
important because it makes it more difficult for threat actors to gain 
access to information systems, even if passwords or PINs are 
compromised through phishing attacks or other means.\147\ In 2021, 
FFIEC issued guidance advising financial institutions that MFA or 
controls of equivalent strength, including for those employees, could 
help more effectively mitigate risks when a financial institution's 
risk assessment indicates that single-factor authentication with 
layered security is inadequate.\148\ The guidance added that MFA 
factors, which may include memorized secrets, look-up secrets, out-of-
band devices, one-time-password devices, biometrics identifiers, and 
cryptographic keys, can vary in terms of usability, convenience, and 
strength and their ability to be exploited.\149\ That same year, the 
Federal Trade Commission updated its rule for safeguarding customer 
information to mandate financial institutions to adopt MFA for all 
users.\150\ The Commission preliminarily believes that requiring 
covered entities to implement such widely recommended controls, such as 
and including MFA, would help reduce cyber security risks and clarify 
expectations. Should the Commission mandate the use of any specific 
controls, including firewalls, antivirus, and/or MFA? Why or why not? 
Please explain.
---------------------------------------------------------------------------

    \147\ CISA, Multi-Factor Authentication Fact Sheet (Jan. 2022), 
available at https://www.cisa.gov/sites/default/files/publications/MFA-Fact-Sheet-Jan22-508.pdf. NIST defines MFA as ``[a]n 
authentication system that requires more than one distinct 
authentication factor for successful authentication. Multi-factor 
authentication can be performed using a multi-factor authenticator 
or by a combination of authenticators that provide different 
factors. The three authentication factors are something you know, 
something you have, and something you are.'' NIST, SP 800-63-3, 
Digital Identity Guidelines at 49 (June 2017).
    \148\ FFIEC, Authentication and Access to Financial Institution 
Services and Systems at 7 (rev. Jan. 5, 2022).
    \149\ Id.
    \150\ See Standards for Safeguarding Customer Information, 86 FR 
70272 (Dec. 9, 2021); see also 16 CFR 314.4(c)(5) (requiring 
financial intuitions to ``[i]mplement multi-factor authentication 
for any individual accessing any information system unless [a 
qualified individual, as defined in the rule] has approved in 
writing the use of reasonably equivalent or more secure access 
controls.'').
---------------------------------------------------------------------------

    3. Incident response plan. As proposed, covered entities would be 
required to notify their CCOs of incidents that they have determined 
may significantly impact regulatory obligations or require notification 
to the Commission. Commission staff are aware of instances where 
covered entity CCOs have not been notified of incidents sufficiently 
early to play a meaningful role in determining whether the incident 
implicates any CFTC requirements and in developing an appropriate 
remediation plan. Should covered entities be required to notify their 
CCOs of all incidents, only incidents that may require notification 
under the proposed rule, or incidents that may require notification 
under the proposed rule to other financial regulatory authorities? Why 
or why not?

D. Third-Party Relationship Program--Proposed Paragraph (e)

    The second program required to be included as part of the proposed 
ORF would be a third-party relationship program, defined as a written 
program reasonably designed to identify, monitor, manage, and assess 
risks relating to third-party relationships that meets the requirements 
of the proposed rule.\151\ The Commission understands that covered 
entities currently routinely rely upon third parties for a wide variety 
of products, services, and activities, including, for example, 
information technology, counterparty or customer relationship 
management, accounting, compliance, human resources, margin processing, 
trading, and risk management. Reliance on third-party service providers 
carries many potential benefits, including a reduction in operating 
costs and access to technological advancements that can improve 
operations and regulatory compliance.\152\
---------------------------------------------------------------------------

    \151\ See paragraph (e) of proposed Commission regulations 1.13 
and 23.603. See also paragraph (a) of proposed regulations 1.13 and 
23.603 (defining ``third-party relationship program'').
    \152\ See Prudential Third-Party Guidance, 88 FR 37927 (``The 
use of third parties can offer banking organizations significant 
benefits, such as access to new technologies, human capital, 
delivery channels, products, services, and markets.''); IOSCO 
Outsourcing Report, supra note 65, at 4 (``The benefits of 
outsourcing include lowering costs, increasing automation to speed 
up tasks and reduce the need for manual intervention, and providing 
flexibility to allow regulated entities to rapidly adjust both to 
the scope and scale of their activities.''); FFIEC, Information 
Technology Examination Handbook, Outsourcing Technology Services 
Booklet at 1 (June 2004) (``The ability to contract for technology 
services typically enables an institution to offer its customers 
enhanced services without the various expenses involved in owning 
the required technology or maintaining the human capital required to 
deploy and operate it.'').
---------------------------------------------------------------------------

    But that reliance is not riskless.\153\ As the ION incident 
illustrated, operational disruptions of third-party services, 
particularly of those important to a firm's operations or regulatory 
obligations, can present challenges for individual firms and even the 
financial system as a whole.\154\ The risks may vary from minor to 
significant, depending on the nature of the provider or the service 
being rendered, but they are inherent in the nature of a third-party 
service provider relationship, in which a firm relies on the 
performance of another entity and the quality and reliability of that 
performance is not in the direct control of the firm.\155\ The 
Commission accordingly believes that, in order to support their 
operational resilience, covered entities should have a plan in place to 
identify, monitor, manage, and assess the risks associated with third-
party relationships.\156\
---------------------------------------------------------------------------

    \153\ See Prudential Third-Party Guidance, 88 FR 37927 (``[T]he 
use of third parties can reduce a banking organization's direct 
control over activities and may introduce new risks or increase 
existing risks, such as operational, compliance, and strategic 
risks.'').
    \154\ See supra note 20 and accompanying text.
    \155\ See Prudential Third-Party Guidance, 88 FR 37927 
(``Increased risk often arises from greater operational or 
technological complexity, newer or different types of relationships, 
or potential inferior performance by the third party. A banking 
organization can be exposed to adverse impacts, including 
substantial financial loss and operational disruption, if it fails 
to appropriately manage the risks associated with third-party 
relationships.'').
    \156\ For purposes of the proposed rule, the Commission would 
construe ``third-party service provider'' broadly and consistently 
with the terms ``third-party'' and ``business arrangement'' as used 
in the Prudential Third-Party Relationship Guidance. See id. 
(``Third-party relationships can include, but are not limited to, 
outsourced services, use of independent consultants, referral 
arrangements, merchant payment processing services, services 
provided by affiliates and subsidiaries, and joint ventures. Some 
banking organizations may form third-party relationships with new or 
novel structures and features--such as those observed in 
relationships with some financial technology (fintech) 
companies.'').

---------------------------------------------------------------------------

[[Page 4722]]

    As mentioned above, the Commission appreciates that the risks 
presented by individual third-party relationships may vary depending on 
the firm, the provider, or service. For instance, risks may be more 
elevated if the service provider is a new entrant to the marketplace or 
the service relates to a new, untested technology, and covered entities 
with more numerous or intricate third-party relationships may 
experience greater overall risk from third parties by virtue of the 
number and complexity of their relationships. Accordingly, the proposed 
rule would not require third-party relationship programs to apply an 
identical degree of scrutiny and oversight to all third-party 
relationships. Instead, consistent with the principles-based focus of 
the proposed rule, and the proposed (b)(3) standard, the Commission 
would expect covered entities to adopt a third-party relationship 
program that helps them identify and assess the risks of their existing 
and future third-party relationships and adapt their risk management 
practices consistent with those risks, their risk appetite and risk 
tolerance limits, and the nature, size, scope, complexity, and risk 
profile of their business activities, following generally accepted 
standards and best practices.\157\
---------------------------------------------------------------------------

    \157\ See paragraph (b)(3) of proposed Commission regulations 
1.13 and 23.603. See also NFA Third-Party Notice, supra note 43 
(``NFA recognizes that a Member must have flexibility to adopt a 
written supervisory framework relating to outsourcing functions to a 
Third-Party Service Provider that is tailored to a Member's specific 
needs and business . . .''); Prudential Third-Party Guidance, 88 FR 
37924 (``[I]t is the responsibility of the banking organization to 
identify and evaluate the risks associated with each third-party 
relationship and to tailor its risk management practices, 
commensurate with the banking organization's size, complexity, and 
risk profile, as well as with the nature of its third-party 
relationships.'').
---------------------------------------------------------------------------

1. Third-Party Relationship Lifecyle Stages--Proposed Paragraph (e)(1)
    To guide covered entities in developing their third-party 
relationship programs, and to ensure that the programs address the full 
scope of risks that third-party relationships can present, the proposed 
rule would require the third-party relationship program to describe how 
the covered entity would address the risks attendant to each stage of 
the third-party relationship lifecycle.\158\ Specifically, the proposed 
rule would require the program to address: (i) pre-selection risk 
assessment; (ii) the due diligence process for prospective third-party 
relationships; \159\ (iii) contractual negotiations; (iv) ongoing 
monitoring during the course of the relationship; and (v) termination 
of the relationship, including preparations for planned and unplanned 
terminations.\160\
---------------------------------------------------------------------------

    \158\ See paragraph (e)(1) of proposed Commission regulations 
1.13 and 23.603.
    \159\ The proposed rule is not intended to interfere with the 
obligation in Commission regulation 1.11(e) for FCMs to conduct 
onboarding and ongoing due diligence on depositories carrying 
customer funds. See 17 CFR 1.11(e)(3)(i)(A)-(B).
    \160\ See paragraphs (e)(1)(i)-(v) of proposed Commission 
regulations 1.13 and 23.603. See also NFA Third-Party Notice 
(requiring NFA members to establish a written supervisory framework 
that includes an initial risk assessment, onboarding due diligence, 
ongoing monitoring, termination, and recordkeeping); 12 CFR part 30, 
app. B, III.D. (Oversee Service Provider Arrangements) (requiring 
financial institutions to exercise appropriate due diligence in 
selecting service providers, contract with service providers to 
implement ``appropriate measures designed to meet the objectives 
of'' prudential guidelines for information security; and, where 
indicated by its risk assessment, monitor service providers to 
confirm they have satisfied their obligations).
---------------------------------------------------------------------------

    Each of these stages offers covered entities opportunities to 
assess and take steps to mitigate the potential risks associated with 
reliance on third-party service providers. At the outset, covered 
entities should determine whether it is appropriate for a third-party 
service provider to perform a particular service and evaluate the 
associated risks.\161\ For instance, the determination to secure a 
third-party service provider may carry greater risks where the service 
directly impacts a regulatory requirement, where the third-party 
service provider would be given direct access to covered information, 
or where a disruption of services could impact regulatory compliance or 
have a negative impact on customers or counterparties. Due diligence 
provides covered entities with information to assess whether a 
prospective third-party service provider is equipped, operationally and 
otherwise, to perform as expected.\162\ Contractual negotiations offer 
a possibility to mitigate potential risks by including provisions to 
assign specific responsibilities or liabilities, but may also 
contribute to risks, especially where a covered entity may have more 
limited negotiating power.\163\ Ongoing monitoring of a third-party 
service provider's performance likewise aids covered entities in 
identifying whether selected third-party service providers remain able 
to perform as expected throughout the duration of the 
relationship.\164\ Finally, the manner in which the relationship ends 
can have a major impact on the covered entity, particularly if it ends 
due to a breach of performance. Plans to address the termination, 
through contingencies or otherwise, could therefore prove important to 
ensuring the covered entity's ongoing operations.\165\ The Commission 
therefore preliminarily believes that effective management of third-
party risks would require covered entities to have a program that 
establishes methodologies and practices to assess and manage the risks 
of third-party relationships throughout each of these five stages of 
the third-party relationship lifecycle.\166\
---------------------------------------------------------------------------

    \161\ See NFA Third-Party Notice (``At the outset, a Member 
should determine whether a particular regulatory function is 
appropriate to outsource and evaluate the risks associated with 
outsourcing the function.''); Prudential Third-Party Guidance, 88 FR 
37928 (``As part of sound risk management, effective planning allows 
a banking organization to evaluate and consider how to manage risks 
before entering into a third-party relationship.'').
    \162\ See IOSCO Outsourcing Report, supra note 65, at 18 (``It 
is important that regulated entities exercise due care, skill, and 
diligence in the selection of service providers. The regulated 
entity should be satisfied that the service provider has the ability 
and capacity to undertake the provision of the outsourced task 
effectively at all times.''); Prudential Third-Party Guidance, 88 FR 
37929 (``Conducting due diligence on third parties before selecting 
and entering into third-party relationships is an important part of 
sound risk management. It provides management with the information 
needed about potential third parties to determine if a relationship 
would help achieve a banking organization's strategic and financial 
goals. The due diligence process also provides a banking 
organization with the information needed to evaluate whether it can 
appropriately identify, monitor, and control risks associated with 
the particular third-party relationship.'').
    \163\ See IOSCO Outsourcing Report at 21 (``Contractual 
provisions can reduce the risks of non-performance or aid the 
resolution of disagreements about the scope, nature, and quality of 
the service to be provided.'').
    \164\ See id. at 18 (``The regulated entity should also 
establish appropriate processes and procedures for monitoring the 
performance of the service provider on an ongoing basis to ensure 
that it retains the ability and capacity to continue to provide the 
outsourced task.'').
    \165\ See id. at 33 (``Where a task is outsourced, there is an 
increased risk that the continuity of the particular task in terms 
of daily management and control of that task, related information 
and data, staff training, and knowledge management, is dependent on 
the service provider continuing in that role and performing that 
task.'').
    \166\ See Prudential Third-Party Guidance, 88 FR 37928 
(``Effective third-party risk management generally follows a 
continuous life cycle for third-party relationships.'').
---------------------------------------------------------------------------

2. Heightened Requirements for Critical Third-Party Service Providers--
Proposed Paragraph (e)(2)
    Although the Commission appreciates that third-party risks are not 
uniform, it nevertheless believes that certain circumstances warrant 
enhanced risk management practices across all covered entities. 
Specifically, the proposed rule would require that the third-party 
relationship program establish heightened due diligence and ongoing

[[Page 4723]]

monitoring practices with respect to third-party service providers 
deemed critical third-party service providers.\167\ The proposed rule 
would define ``critical third-party service provider'' to mean a third-
party service provider, the disruption of whose performance would be 
reasonably likely to either (a) significantly disrupt a covered 
entity's businesses operations or (b) significantly and adversely 
impact the covered entity's counterparties or customers.\168\ The 
Commission understands that it is common practice for financial 
institutions, whether by regulatory mandate or otherwise, to identify a 
subset of services or providers more central to their operations and 
apply greater scrutiny and oversight to them to ensure the services are 
provided without disruption. The proposed rule's definition of 
``critical third-party service provider'' focuses on the potential 
impact a disruption to performance would have on the covered entity's 
regulated business operations, customers, or counterparties. Where such 
an impact would be significant, as assessed in light of the covered 
entity's business activities, risk appetite, and risk tolerance limits, 
the Commission believes heightened due diligence for potential critical 
third-party service providers and ongoing monitoring for onboarded 
critical third-party service providers are warranted to both mitigate 
the potential for such an occurrence and to promote the ability for 
covered entities to take early and effective action if a critical 
third-party service provider's performance is disrupted to mitigate the 
impact and effectively recover.\169\
---------------------------------------------------------------------------

    \167\ See paragraph (e)(2) of proposed Commission regulations 
1.13 and 23.603.
    \168\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``critical third-party service provider'').
    \169\ See NFA Third-Party Notice, supra note 43 (``Additionally, 
a Member's onboarding due diligence process should be heightened for 
Third-Party Service Providers that obtain or have access to a 
Member's critical and/or confidential data and those that support a 
Member's critical regulatory-related systems (e.g., handling 
customer segregated funds, keeping required records, filing 
financial reports, etc.).'').
---------------------------------------------------------------------------

3. Third-Party Service Provider Inventory--Proposed Paragraph (e)(3)
    To help ensure that covered entities implement a comprehensive and 
consistent approach to identifying their critical third-party service 
providers, covered entities would be required to create, maintain, and 
regularly update an inventory of third-party service providers they 
have engaged to support their activities as a covered entity, 
identifying whether each third-party service provider in the inventory 
is a critical third-party service provider.\170\ The Commission 
preliminarily believes that the process of creating an inventory of 
service providers, particularly the deliberative process involved in 
designating certain providers as critical third-party service 
providers, would help covered entities assess and evaluate the risks 
they face from their third-party service providers, and determine when 
to apply heightened monitoring. Maintaining such an inventory would 
also reflect that not all third-party service providers present the 
same level and types of risks to a covered entity, and would help 
covered entities assess and evaluate who is providing services and the 
attendant risk that any disruption of those services would have on a 
covered entity's business. The inventory would also provide covered 
entities a holistic view of their third-party service providers, which 
would help them better understand how risks identified during due 
diligence and ongoing monitoring may interact or require additional 
management. Having a clear understanding of who is providing services, 
particularly those services identified as critical, would further 
assist covered entities in identifying potential interconnections that 
may not be readily apparent if the entities are not assembled and 
reviewed collectively.\171\
---------------------------------------------------------------------------

    \170\ See paragraph (e)(3) of proposed Commission regulations 
1.13 and 23.603.
    \171\ Prudential Third-Party Guidance, 88 FR 37927 
(``Maintaining a complete inventory of its third-party relationships 
and periodically conducting risk assessments for each third-party 
relationship supports a banking organization's determination of 
whether risks have changed over time and to update risk management 
practices accordingly.'').
---------------------------------------------------------------------------

    Covered entities relying on a consolidated third-party relationship 
program would be able to rely on an enterprise-wide third-party service 
provider inventory provided that the inventory meets the requirements 
of the proposed rule, including identifying critical third-party 
service providers specific to the covered entity.\172\
---------------------------------------------------------------------------

    \172\ See paragraph (c)(4)(i) of proposed Commission regulations 
1.13 and 23.603 (allowing covered entities to rely on consolidated 
programs).
---------------------------------------------------------------------------

4. Retention of Responsibility--Proposed Paragraph (e)(3)
    For the avoidance of doubt, the proposed rule would make clear 
that, notwithstanding their determination to rely on a third-party 
service provider, covered entities remain responsible for meeting their 
obligations under the CEA and Commission regulations.\173\ This 
provision reflects the principle, widely recognized among financial 
regulatory authorities, including the Commission, that while financial 
institutions may be able to delegate functions to third-party service 
providers, they cannot delegate their responsibility to comply with 
applicable laws and regulations.\174\ This provision is intended to 
ensure that covered entities are aware that they remain responsible for 
the performance of all applicable regulatory functions, whether 
performed by the covered entity or by a third-party service provider, 
and are accordingly fully subject to the Commission's jurisdiction, 
including its examination and enforcement authorities.
---------------------------------------------------------------------------

    \173\ See paragraph (e)(3) of proposed Commission regulations 
1.13 and 23.603.
    \174\ See NFA Third-Party Notice, supra note 43 (``If a Member 
outsources a regulatory function, however, it remains responsible 
for complying with NFA and/or CFTC Requirements and may be subject 
to discipline if a Third-Party Service Provider's performance causes 
the Member to fail to comply with those Requirements.''); Prudential 
Third-Party Guidance, 88 FR 37927 (``A banking organization's use of 
third parties does not diminish its responsibility to meet these 
requirements to the same extent as if its activities were performed 
by the banking organization in-house.''); IOSCO Outsourcing Report, 
supra note 65, at 12 (``The regulated entity retains full 
responsibility, legal liability, and accountability to the regulator 
for all tasks that it may outsource to a service provider to the 
same extent as if the service were provided in-house.''). See also 
17 CFR 37.204 (SEFs); 17 CFR 38.154 (DCMs); 17 CFR 39.18(d) (DCOs) 
(providing that such registered entities retain responsibility for 
meeting relevant regulatory requirements when entering into 
contractual outsourcing arrangements).
---------------------------------------------------------------------------

5. Application to Existing Third-Party Relationships
    Should the proposed rule be adopted as final, the Commission would 
expect covered entities to apply their third-party relationship 
programs across all stages of the relationship lifecycle on a going-
forward basis. Although the Commission would not require covered 
entities to renegotiate or terminate existing agreements, it would 
expect covered entities to conduct ongoing monitoring of existing 
third-party service providers consistent with the program and this 
regulation and, to the extent possible, to rely on its program with 
respect to termination. For any third-party service providers 
contemplated or onboarded after the effective date of the proposed 
rule, or for any contracts renegotiated or renewed after the effective 
date of the rule, however, the Commission would expect covered entities 
to apply the entirety of the third-party relationship program from pre-
selection through termination.

[[Page 4724]]

6. Guidance on Third-Party Relationship Programs--Proposed Paragraph 
(e)(4); Appendix A to Part 1; Appendix A to Subpart J of Part 23
    To assist covered entities in developing third-party relationship 
programs that adequately address risks from third-party relationships, 
the Commission is proposing guidance outlining potential risks, 
considerations, and strategies for covered entities to consider.\175\ 
The proposed guidance addresses all five stages of the relationship 
lifecycle and, if adopted, would be codified as appendices to parts 1 
and 23 of the Commission's regulations for FCMs and swap entities, 
respectively.\176\ Designed to be broadly applicable to all covered 
entities, the proposed guidance identifies actions and factors for 
covered entities to consider. The factors and actions identified are 
not exhaustive, nor should they be viewed as a required checklist. The 
nonbinding guidance would merely be intended to aid covered entities as 
they design third-party relationship programs tailored to their own 
unique circumstances, consistent with the general ORF ``appropriate and 
proportionate standard'' discussed above.
---------------------------------------------------------------------------

    \175\ See paragraph (e)(4) of proposed Commission regulations 
1.13 and 23.603.
    \176\ See proposed Appendix A to part 1 and proposed Appendix A 
to Subpart J of part 23.
---------------------------------------------------------------------------

    In developing the proposed guidance, the Commission considered the 
recommendations of international standard-setting bodies, including 
IOSCO and FSB, in light of observations and lessons derived from its 
own oversight activities.\177\ In an effort to incorporate as much 
consensus as possible, the Commission also gave special consideration 
to existing guidance from NFA and the guidance on third-party 
relationships recently adopted by prudential regulators, both of which 
currently apply to at least some covered entities.\178\
---------------------------------------------------------------------------

    \177\ See IOSCO Outsourcing Report, supra note 65; FSB Third-
Party Report, supra note 44.
    \178\ See NFA Third-Party Notice; Prudential Third-Party 
Guidance, 88 FR 37920.
---------------------------------------------------------------------------

    The full text of the guidance is included at the end of this notice 
as proposed appendix A to part 1 for FCMs and proposed appendix A to 
subpart J of part 23. The guidance is identical in substance for FCMs 
and swap entities.
7. Request for Comment
    The Commission invites comment on all aspects of the proposed 
third-party relationship program requirement and associated guidance, 
including the following questions:
    1. Scope of Application. NFA's interpretive notice on third-party 
relationships is limited in scope to ``outsourcing,'' which NFA defines 
as third-party relationships in which an NFA member has a third-party 
service provider or vendor perform certain functions that would 
otherwise by undertaken by the member itself to comply with NFA and 
CFTC requirements.\179\ The proposed rule would follow the approach 
taken by prudential regulators in their third-party guidance, which 
more broadly addresses any circumstances where banking organizations 
rely on third parties for products, services, or activities to 
``capture[ ] the full range of third-party relationships that may pose 
risk to banking organizations.'' \180\ Should the Commission consider 
limiting the scope of its guidance to outsourcing of CFTC regulatory 
obligations? Why or why not? Please explain.
---------------------------------------------------------------------------

    \179\ See NFA Third-Party Notice, supra note 43.
    \180\ See Prudential Third-Party Guidance, 88 FR 37921-22.
---------------------------------------------------------------------------

    2. Critical third-party service provider. The proposed rule 
includes a definition of ``critical third-party service provider.'' The 
Commission understands it is common practice for financial institutions 
to identify and apply heightened oversight of third-party service 
providers they deem critical. NFA's interpretive notice related to 
third-party relationships, for instance, advises members to tailor the 
frequency and scope of ongoing monitoring reviews to the criticality of 
and risk associated with the outsourced function but does not define 
``criticality'' for covered entities. Is the Commission's proposed 
definition consistent with existing standards or definitions of 
``criticality'' applied by covered entities? If not, how is it 
different? Should the Commission consider allowing covered entities to 
generate and apply their own definition of ``critical third-party 
service provider''? Why or why not? Please explain.
    3. Guidance--Affiliated Third-Party Service Providers. The proposed 
third-party relationship program requirement would apply to all third-
party relationships, including where the third-party is an affiliate of 
the covered entity. This position is consistent with both NFA and 
prudential guidance related to third-party relationships.\181\ 
Nevertheless, the Commission recognizes that arrangements with 
affiliates may present different or lower risks than with unaffiliated 
third parties. Should the Commission consider including any additional 
guidance with respect to the management of third-party service 
providers that are affiliated entities? If so, what factors should 
covered entities consider when evaluating relationships with affiliated 
third-party service providers?
---------------------------------------------------------------------------

    \181\ See NFA Third-Party Notice at n.1 (``Further, even if a 
Member outsources a regulatory obligation to an affiliate, . . . a 
Member should comply with this Notice's requirements.''); Prudential 
Third-Party Guidance, 88 FR 37927 (``Third-party relationships can 
include, but are not limited to, . . . services provided by 
affiliates and subsidiaries. . .'').
---------------------------------------------------------------------------

    4. Guidance--Due Diligence. The proposed guidance recommends that 
covered entities perform due diligence on prospective third-party 
service providers to assess their ability to deliver contracted 
services to an acceptable standard (i.e., consistent with risk appetite 
and risk tolerance limits) and provides examples of information that 
covered entities should review and sources for obtaining that 
information.
    a. Are there any additional due diligence tasks that should be 
conducted by the covered entity beyond reviewing information about the 
potential third-party service provider? Are there additional risks that 
should be included in the guidance for the covered entity to inquire 
into? If yes, please identify and explain.
    b. Are there additional sources of due diligence information beyond 
those listed in the guidance (see section B of the guidance) that 
should be included in the guidance? If yes, please identify and 
explain.
    c. Should covered entities be advised to periodically refresh their 
due diligence, or upon the occurrence of specific triggers (e.g., a 
material change to the service outsourced)? Why or why not? Would such 
a recommendation be duplicative of the covered entity's ongoing 
monitoring activities, or would the subsequent due diligence provide 
additional valuable information to the covered entity beyond that 
provided by ongoing monitoring? Why or why not? Please explain.
    d. The proposed guidance does not recommend that covered entities 
perform due diligence directly on any subcontractors secured by third-
party service providers. Rather, the Commission's guidance suggests 
that covered entities review the operational risk management practices 
of the potential third-party service provider with respect to their 
subcontractors. Should the Commission recommend more enhanced due 
diligence of subcontractors? Why or why not? What

[[Page 4725]]

means are practicable for covered entities to conduct due diligence on 
subcontractors to their third-party service providers? Please identify 
and explain.

E. Business Continuity and Disaster Recovery Plan--Proposed Paragraph 
(f)

    The third component of the ORF would be a business continuity and 
disaster recovery (BCDR) plan, defined as a written plan outlining the 
procedures to be followed in the event of an emergency or other 
significant disruption to the continuity of a covered entity's normal 
business operations and that meets the requirements of the proposed 
rule.\182\ Similar to the incident response plan (and, in extreme 
cases, possibly triggered by an incident covered by the incident 
response plan), the proposed BCDR plan requirement recognizes the 
operational reality that not all operational disruptions can be 
prevented or immediately mitigated and asks covered entities to 
strategize and implement plans for how to minimize the impact to 
operations, customers, and counterparties when such adverse events 
occur.
---------------------------------------------------------------------------

    \182\ See paragraph (f) proposed Commission regulations 1.13 and 
23.603. See also paragraph (a) of proposed Commission regulations 
1.13 and 23.603 (defining ``business continuity and disaster 
recovery plan'').
---------------------------------------------------------------------------

    Although NFA requires FCMs to establish and maintain a BCDR plan, 
if adopted, the proposed rule would create a new CFTC BCDR plan 
requirement for FCMs.\183\ Current Commission regulation 23.603 
contains an active BCDR plan requirement for swap entities.\184\ In 
essence, the proposal would make certain amendments to the CFTC BCDR 
plan requirement for swap entities and expand the requirement to 
include FCMs. The proposed amendments to the swap entity BCDR plan 
requirement have two general purposes. For the most part, the proposal 
would streamline and simplify some of the language to help it further 
conform to the proposed ORF rule more broadly, in ways the Commission 
intends to be non-substantive. The proposal would also make a few 
substantive changes, informed either by the Commission's review of 
NFA's and CME's current BCDR requirements for their members or by its 
decade of experience applying current Commission regulation 23.603 to 
swap entities.\185\ The proposed substantive changes, each subsequently 
discussed in this notice, relate to either the defined scope of and 
recovery objective for the BCDR plan or the testing and audit 
requirements for the plan.
---------------------------------------------------------------------------

    \183\ See NFA Rule 2-38, supra note 43.
    \184\ See 17 CFR 23.603.
    \185\ See NFA Rule 2-38; CME Rule 983 (Disaster Recovery and 
Business Continuity).
---------------------------------------------------------------------------

    Current Commission regulation 23.603 includes requirements that the 
proposed rule would apply to the entirety of the proposed ORF more 
broadly. Those requirements include requirements to: distribute the 
BCDR plan to relevant employees (current Commission regulation 
23.603(c)); notify the Commission of emergencies or disruptions 
(current Commission regulation 23.603(d)); identify emergency contacts 
(current Commission regulation 23.603(e)); review, test, and update the 
BCDR plan (current Commission regulation 23.603(f) and (g)); and 
recordkeeping (current Commission regulation 23.603(i)). Each of these 
requirements is discussed in the relevant sections of this notice that 
follow.\186\ Accordingly, the Commission's proposed amendment to the 
current BCDR audit requirement is discussed in the context of the ORF's 
broader proposed review and testing requirements.\187\
---------------------------------------------------------------------------

    \186\ See sections II.F (Training), G (Review and Testing), H 
(Required Notifications), and I (Emergency Contacts, Recordkeeping) 
of this notice, infra. The proposed rule would not retain Commission 
regulation 23.603(h), which merely articulates the fact that swap 
entities are required to comply with Commission's BCDR requirements 
in addition to any other applicable BCDR requirements from other 
regulatory bodies. See 17 CFR 23.603(h). The Commission accordingly 
views this amendment as non-substantive.
    \187\ See paragraph (h) of proposed Commission regulations 1.13 
and 23.603 and section II.G, infra.
---------------------------------------------------------------------------

1. Definition of ``Business Continuity and Disaster Recovery Plan''
    The proposed definition of ``business continuity and disaster 
recovery plan'' is slightly modified from the language in the current 
BCDR plan requirement for swap entities. Current Commission regulation 
23.603 requires swap entities to establish and maintain a BCDR plan 
that ``outlines the procedures to be followed in the event of an 
emergency or other disruption of its normal business activities.'' 
\188\ As stated above, the proposed rule would specify that the BCDR 
plan would need to address ``significant'' disruptions to the 
continuity of a covered entity's normal business operations, which the 
Commission preliminarily believes is more in line with what would 
constitute an ``emergency'' that would result in activation of a BCDR 
plan and how Commission regulation 23.603 has operated in 
practice.\189\
---------------------------------------------------------------------------

    \188\ See 17 CFR 23.603(a).
    \189\ See also NFA Rule 2-38, supra note 43 (requiring certain 
members, including FCMs, to establish a BCDR plan to be followed in 
the event of a ``significant business disruption''). The proposed 
language change from ``normal business activities'' to ``the 
continuity of normal business operations'' is intended only to bring 
the language more in line with the focus of the proposed ORF rule on 
the resiliency of operations and is not intended to have substantive 
effect. See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``business continuity and disaster recovery 
plan''); 17 CFR 23.603(a).
---------------------------------------------------------------------------

2. Purpose--Proposed Paragraph (f)(1)
    Under the proposed rule, the BCDR plan would need to be reasonably 
designed to enable covered entities to: (i) continue or resume normal 
business operations with minimal disruption to customers or 
counterparties and the markets and (ii) recover and make use of all 
covered information, as well as any other data, information, or 
documentation required to be maintained by law and regulation.\190\ The 
Commission preliminarily believes that this standard, which emphasizes 
the need to quickly resume regulated activities and to recover all 
information kept and required to be kept in connection with those 
activities, supports the overall regulatory objectives of the ORF rule 
of enhancing the operational resilience of covered entities to promote 
the protection of customers and the mitigation of system risk.
---------------------------------------------------------------------------

    \190\ See paragraphs (f)(1)(i)-(ii) of proposed Commission 
regulations 1.13 and 23.603. See also 17 CFR 23.603(a).
---------------------------------------------------------------------------

    Current Commission regulation 23.603 requires swap entities' BCDR 
plans to ``be designed to enable the [swap entity] to continue or to 
resume any operations by the next business day with minimal disturbance 
to its counterparties and the market.'' The proposed rule would modify 
this language by requiring that the BCDR plan be ``reasonably'' 
designed to continue or resume operations with minimal disruption and 
by removing the requirement that such operations be resumed ``by the 
next business day.'' \191\ The Commission views the qualification that 
the BCDR plan be ``reasonably'' designed as simply a more concrete 
expression of the Commission's current expectations, in recognition 
that what might be necessary to achieve recovery is not an absolute 
fact and may vary depending on the circumstances, including the nature, 
size, scope, complexity, and risk profile of a covered entity's 
business activities.\192\ The

[[Page 4726]]

reasonableness of the plan would thus be viewed in light of the 
proposed (b)(3) standard (i.e., what is appropriate and proportional to 
the covered entity, following generally accepted standards and best 
practices).
---------------------------------------------------------------------------

    \191\ The Commission views the use of the phrase ``minimal 
disturbance'' in current Commission regulation 23.603 as equivalent 
to the phrase ``minimal disruption'' in the proposed rule and 
therefore views this change in language with respect to swap 
entities to be non-substantive. Compare 17 CFR 23.603(a) with 
paragraph (f)(1) of proposed Commission regulations 1.13 and 23.603.
    \192\ See also NFA Rule 2-38 (requiring BCDR plans be 
``reasonably designed'') (emphasis added).
---------------------------------------------------------------------------

    The proposal not to include a next business day recovery time 
objective is based in the Commission's preliminary view that, depending 
on the circumstances, a next business day recovery standard could be 
either too short or too long, to the point where it may be misdirecting 
the focus of the rule. The Commission understands that the ``next 
business day'' standard has been common for businesses to employ for 
BCDR purposes in the context of purely physical disasters, such as 
power outages or natural disasters. Based on its experience in recent 
years, however, the Commission believes a next-day standard may in some 
cases be impractical in an era where rapid innovation has deepened and 
expanded reliance on technology among financial institutions, and 
pandemics and cyberattacks have become more prevalent or alarming forms 
of disruption. With the ION incident, for instance, it took weeks 
before back office operations were back to normal. Nevertheless, the 
impact to customers and the markets during that time was manageable. 
Were even one business day to stretch between FCMs paying and 
collecting margin, for example, the Commission does not believe the 
impact to customers or the markets could be characterized as minimal.
    Accordingly, the Commission preliminarily believes that by not 
including a precise recovery time objective, such as next business day, 
the emphasis of the proposed BCDR plan standard appropriately lies on 
ensuring that any disruption to customers, counterparties, and the 
markets is ``minimal.'' \193\ For that standard to be met, however, the 
Commission would still expect covered entities to plan for a recovery 
that is expeditious. The longer a covered entity is not operating as 
usual, the more likely it is that customers and counterparties may be 
affected and that a crisis in confidence could develop, potentially 
affecting the industry more broadly.
---------------------------------------------------------------------------

    \193\ The Commission notes that neither NFA nor CME includes a 
specific recovery time objective in its BCDR plan requirements. See 
NFA Rule 2-38; CME Rule 938.
---------------------------------------------------------------------------

    Current Commission regulation 23.603 requires swap entities' BCDR 
plans to be designed ``to recover all documentation and data required 
to be maintained by applicable law and regulation.'' The proposal to 
require covered entities to reasonably design their BCDR plans to 
``recover and make use of all covered information, as well as any other 
data, information, or documentation required to be maintained by law 
and regulation'' is intended to both incorporate the proposed defined 
term ``covered information,'' and make clear the need to also preserve 
the availability of the recovered data and information (i.e., reliable 
access to and use of information), which the Commission believes is an 
integral component of information and technology security.\194\ The 
Commission believes that making plans to ensure covered information--
sensitive or confidential information and data the proposed ORF rule is 
designed, at its core, to ensure covered entities protect--as well as 
any other information covered entities are legally required to 
maintain, is recovered and accessible following an emergency is key to 
ensuring the protection of customers and counterparties and the ongoing 
orderly functioning of the commodity interest markets, as this 
information is vital to a covered entity's ability to assess its 
ongoing compliance with the Commission's regulations governing the 
requirements for covered entities.\195\
---------------------------------------------------------------------------

    \194\ See supra note 108 and accompanying text (discussing the 
``CIA triad'' of confidentiality, integrity, and availability).
    \195\ In designing a BCDR plan that would meet this recovery 
standard, the Commission would advise covered entities to identify a 
broad range of events that could constitute emergencies or pose 
significant disruptions, including natural events (e.g., hurricanes, 
wildfires), technical events (e.g., power failures, system 
failures), malicious activity (e.g., fraud, cyberattacks), failures 
of controls, and low likelihood but high impact events (e.g., 
terrorist attacks, pandemics), and consider potential impact on 
business operations and data and information.
---------------------------------------------------------------------------

3. Minimum Contents--Proposed Paragraph (f)(2)
    Consistent with the proposed (b)(3) standard for the ORF as a 
whole, the BCDR plan would need to be appropriate and proportionate to 
the covered entity, following generally accepted standards and best 
practices.\196\ Accordingly, should the proposal be adopted as final, 
the Commission would expect each BCDR plan to be highly tailored to 
each specific covered entity. However, the proposed rule would also 
require the BCDR plan to include certain minimum contents, which are 
generally comparable to the current requirements in Commission 
regulation 23.603.\197\
---------------------------------------------------------------------------

    \196\ See paragraph (b)(3) of proposed Commission regulations 
1.13 and 23.603.
    \197\ See paragraph (f)(2) of proposed Commission regulations 
1.13 and 23.603. See also 17 CFR 23.603(b). Although the exact 
language of the proposed minimum contents in paragraph (f)(2) may 
diverge somewhat from that of current Commission regulation 
23.603(b), the modifications were intended to streamline language 
and incorporate the proposed terms ``covered information'' and 
``covered technology.'' The Commission does not intend any of the 
changes to have a substantive impact on compliance with the 
Commission's BCDR plan requirement for swap entities.
---------------------------------------------------------------------------

    First, the proposed rule would require the BCDR plan to identify 
its covered information, as well as any other data or information 
required to be maintained by law or regulation, and to establish and 
implement procedures to backup or copy it with sufficient frequency and 
to store it offsite in either hard-copy or electronic format.\198\ The 
BCDR plan would also need to identify any resources, including covered 
technology, facilities, infrastructure, personnel, and competencies, 
essential to the operations of the swap entity or to fulfill the 
regulatory obligations of the swap entity, and establish and maintain 
procedures and arrangements to provide for their backup in a manner 
that is sufficient to meet the requirements of the rule (i.e., to 
continue or resume operations with minimal disruption, to recover and 
make use of information).\199\ These minimum requirements are intended 
to ensure that the BCDR plan meets the proposed recovery standard by 
ensuring covered entities have gone through the process of cataloging 
everything they need (information, technology, infrastructure, human 
capital, etc.) to operate as a covered entity, and have established 
ways to recover them and to continue or resume operations with minimal 
disruption to customers, counterparties, or the markets. Furthermore, 
in establishing arrangements for backup resources, the Commission would 
want covered entities to consider diversification to the greatest 
extent possible to reduce the likelihood that an emergency that affects 
a primary operating resource affects any planned backups. Accordingly, 
the proposed rule would require covered entities to establish backup 
arrangements for resources that are in one or more areas geographically 
separate from the covered entity's primary resources (e.g., a different 
power grid than the primary facility).\200\ The proposed rule would 
make clear those resources could be

[[Page 4727]]

provided by third-party service providers.\201\
---------------------------------------------------------------------------

    \198\ See paragraph (f)(2)(i) of proposed Commission regulations 
1.13 and 23.603. See also 17 CFR 23.603(b)(1), (b)(6).
    \199\ See paragraph (f)(2)(ii) of proposed Commission 
regulations 1.13 and 23.603. See also 17 CFR 23.603(b)(2), (b)(4), 
(b)(5).
    \200\ See paragraph (f)(2)(ii) of proposed Commission 
regulations 1.13 and 23.603. See also 17 CFR 23.603(b)(5).
    \201\ See id.
---------------------------------------------------------------------------

    To ensure that critical third-party service providers are given 
particular consideration when planning for disruptions, the proposed 
rule would specifically require the BCDR plan to identify potential 
disruptions to critical third-party service providers and establish a 
plan to minimize the impact of such potential disruptions.\202\ 
Additionally, given the importance of internal and external 
communication in times of crisis, and for duties and responsibilities 
to be well established, the proposed rule would require the BCDR plan 
to identify supervisory personnel responsible for implementing the BCDR 
plan, along with the covered entity's required ORF emergency contacts, 
and establish a procedure for communicating with relevant persons in 
the event of an emergency or significant disruption.\203\
---------------------------------------------------------------------------

    \202\ See paragraph (f)(2)(iii) of proposed Commission 
regulations 1.13 and 23.603. See also 17 CFR 23.603(b)(7) (identify 
``potential business interruptions encountered by third parties that 
are necessary to the continued operations of the swap dealer or 
major swap participant and a plan to minimize the impact of such 
disruptions'').
    \203\ See paragraphs (f)(2)(iv)-(v) of proposed Commission 
regulations 1.13 and 23.603. See also paragraph (k) of proposed 
Commission regulations 1.13 and 23.603 (requiring emergency 
contacts), discussed in section II.I.1 of this notice, infra; 17 CFR 
23.603(b)(3).
---------------------------------------------------------------------------

    The minimum contents of the proposed BCDR plan requirement were 
designed to align with the substance of the ``essential components'' of 
a BCDR plan identified in current Commission regulation 23.603(b), with 
certain modifications.\204\ The changes are intended to streamline 
language, incorporate the proposed BCDR plan standard and defined terms 
(e.g., covered information, covered technology, critical third-party 
service provider), and reorder and combine elements to improve 
readability and application. Key changes include:
---------------------------------------------------------------------------

    \204\ See 17 CFR 23.603(b).
---------------------------------------------------------------------------

     Replacing the identification or backup of documents and 
information essential to the continued operations of the swap entity 
and/or to fulfill the regulatory obligations of the swap dealer or 
major swap participant with covered information, as well as any other 
data or information required to be maintained by law and 
regulation.\205\ This change is intended to align the information 
required to be identified in the proposed BCDR plan with its purpose 
(recover and make use of all covered information, as well as any other 
data, information, or documentation required to be maintained by law 
and regulation).
---------------------------------------------------------------------------

    \205\ See proposed paragraph (f)(2)(i) of Commission regulations 
1.13 and 23.603; 17 CFR 23.603(b)(1) (Identification of the 
documents and data essential to the continued operations of the swap 
entity and to fulfill the obligations of the swap entity); (b)(6) 
(Back-up or copying of documents and data essential to the 
operations of the swap entity or to fulfill the regulatory 
obligations of the swap entity'').
---------------------------------------------------------------------------

     Specifying that data and information must be backed up or 
copied with sufficient frequency ``to meet the requirements of this 
section,'' to make clear that the backup frequency should be linked to 
the broader purpose of the BCDR plan (i.e., to continue or resume 
operations with minimal disruption and to recover and make use of in-
scope information).\206\
---------------------------------------------------------------------------

    \206\ Cf. 17 CFR 23.603(b)(6) (Back-up or copying, with 
sufficient frequency, of documents and data).
---------------------------------------------------------------------------

     Removing the qualification that resource backups be 
designed to achieve the timely recovery of data and documentation and 
to resume operations as soon as reasonably possible and generally 
within the next business day.\207\ This language could be viewed as in 
contradiction with the overall proposed purpose of the BCDR plan, which 
would not include a ``next business day'' recovery time objective.
---------------------------------------------------------------------------

    \207\ See 17 CFR 23.603(b)(4) (Procedures for, and the 
maintenance of, back-up facilities, systems, infrastructure, 
alternative staffing and other resources to achieve the timely 
recovery of data and documentation and to resume operations as soon 
as reasonably possible and generally within the next business day.).
---------------------------------------------------------------------------

     Replacing third parties that are necessary to the 
continued operations of the swap dealer or major swap participant with 
critical third-party service provider, as defined in the proposed rule, 
as the Commission believes these terms are intended to capture similar 
concepts.\208\
---------------------------------------------------------------------------

    \208\ See 17 CFR 23.603(b)(7) (Identification of potential 
business interruptions encountered by third parties that are 
necessary to the continued operations of the swap dealer or major 
swap participant and a plan to minimize the impact of such 
disruptions.).
---------------------------------------------------------------------------

4. Accessibility--Proposed Paragraph (f)(3)
    Finally, to ensure that the BCDR plan is available in the event of 
an emergency or other significant disruption that prevents a covered 
entity from accessing its primary office location, the proposed rule 
would require each covered entity to maintain copies of its BCDR plan 
at one or more accessible off-site locations.\209\
---------------------------------------------------------------------------

    \209\ See paragraph (e)(3) of proposed Commission regulations 
1.13 and 23.603. See also 17 CFR 23.603(c).
---------------------------------------------------------------------------

5. Request for Comment
    The Commission invites comment on all aspects of the proposed 
business continuity and disaster recovery plan requirement, including 
the following question:
    1. Recovery time objective. Under current Commission regulation 
23.603, the Commission requires swap entities to establish and maintain 
a BCDR plan that is designed to enable the swap entity to continue or 
resume any operations ``by the next business day'' with minimal 
disturbance to is counterparties.\210\ Noting that such a standard may 
pose some challenges, the Commission has proposed to not include a 
recovery time objective, relying on covered entities to establish a 
BCDR plan that allows for sufficiently exigent recovery so as to impose 
``minimal disruption'' to customers, counterparties, or the markets.
---------------------------------------------------------------------------

    \210\ See 17 CFR 23.603(a).
---------------------------------------------------------------------------

    a. Has a next business day standard posed challenges for swap 
entities to implement? Would such a standard be achievable for FCMs? 
Why or why not? Please explain.
    b. Should the Commission consider including additional language to 
ensure covered entities design BCDR plans that enable quick recovery 
(e.g., ``as soon as possible'' or ``as soon as practicable'')? Why or 
why not? Please explain.
    2. Transfer of business to another entity. NFA and CME rules allow 
for BCDR plans to include the possibility of transferring their 
business to another regulated entity in the event of an emergency or 
disruption. NFA Rule 2-38 provides that a BCDR plan ``shall be 
reasonably designed to . . . transfer its business to another Member 
with minimal disruption to its customers, other members, and the 
commodity futures markets.'' \211\ CME Rule 983 provides that clearing 
members must have procedures in place to allow them to continue to 
operate during periods of stress ``or to transfer accounts to another 
fully operational clearing member with minimal disruption to either 
[CME] or their customers.'' \212\ Do any covered entities currently 
have arrangements with other covered entities to transfer business or 
accounts in the event of an emergency or disruption? Should the 
Commission consider adding the option to transfer business to another 
regulated entity into its proposed BCDR rule? Why or why not? How would 
such a transfer function in practice? Please explain.
---------------------------------------------------------------------------

    \211\ See NFA Rule 2-38, supra note 43.
    \212\ See CME Rule 983, supra note 185.
---------------------------------------------------------------------------

F. Training and Plan Distribution--Proposed Paragraph (g)

    To support the effectiveness of the ORF by ensuring personnel are 
aware of relevant policies, procedures, and

[[Page 4728]]

practices, the proposed rule would require that each covered entity 
establish, implement, and maintain training with respect to all aspects 
of the ORF.\213\ Relevant training is important to ensuring the ORF 
operates as intended, and to supporting a firm culture that promotes 
and prioritizes operational resilience.\214\ The training would 
therefore need to include, at a minimum, (i) cybersecurity awareness 
training for all personnel and (ii) role-specific training for 
personnel involved in establishing, documenting, implementing, and 
maintaining the ORF.\215\ The importance of cybersecurity training is 
widely recognized, as incidents commonly occur because well-intentioned 
employees or other users make preventable mistakes.\216\ The Commission 
would further expect that role-specific training would include not only 
training on relevant policies and procedures but additional relevant 
threat and vulnerability response training for personnel involved in 
the development and maintenance of the information and technology 
security program (e.g., system administration courses for IT 
professionals, secure coding training for web developers).\217\
---------------------------------------------------------------------------

    \213\ See paragraph (g) of proposed Commission regulations 1.13 
and 23.603.
    \214\ See FFIEC Information Security Booklet, supra note 69, at 
17 (``Training ensures personnel have the necessary knowledge and 
skills to perform their job functions.''); CIS Critical Security 
Controls v.8., Control no. 14 (Security Awareness and Skills 
Training) at 43 (May 2021) (CIS Control 14) (training helps 
``influence behavior among the workforce to be security conscious 
and properly skilled to reduce cybersecurity risks to the 
enterprise'').
    \215\ See paragraphs (g)(1)(i)-(ii) of proposed Commission 
regulations 1.13 and 23.603. Proposed paragraph (g)(1)(ii) would 
supplant the current requirement in Commission regulation 23.603 for 
swap entities to train relevant employees on applicable components 
of the BCDR plan. See 17 CFR 23.603(c). The Commission does not 
intend any substantive difference in the BCDR plan training for swap 
entities.
    \216\ The FSB found that most successful cyberattacks involved 
human error, which is why training is important for all personnel. 
See FSB, Summary Report on Financial Sector Cybersecurity 
Regulations, Guidance and Supervisory Practices at 7 (Oct. 13, 
2017), available at https://www.fsb.org/wp-content/uploads/P131017-1.pdf. See also CIS Control 14 (``Users themselves, both 
intentionally and unintentionally, can cause incidents as a result 
of mishandling sensitive data, sending an email with sensitive data 
to the wrong recipient, losing a portable end-user device, using 
weak passwords, or using the same password they use on public site . 
. .); Prudential Operational Resilience Paper, supra note 11, at 11 
(``The firm provides cybersecurity awareness education especially to 
personnel engaged in the operations of critical operations and core 
business lines, . . . and adequately trains them to perform their 
information security-related duties and responsibilities consistent 
with related processes and agreements.'').
    \217\ See CISA, Incident Response Plan (IRP) Basics (advising 
that all staff need to understand their role in maintaining and 
improving the security of the organization), available at https://www.cisa.gov/sites/default/files/publications/Incident-Response-Plan-Basics_508c.pdf.
---------------------------------------------------------------------------

    As with all aspects of the ORF, if the proposal is adopted as 
final, the Commission would expect each covered entity's ORF training 
to meet the (b)(3) standard (i.e., be appropriate and proportionate to 
the nature, scope, and complexities of its business activities as a 
covered entity, following generally accepted standards and best 
practices).\218\ To ensure the training remains relevant overtime and 
that personnel are adequately informed with respect to the ORF, covered 
entities would also be required to provide and update their ORF 
training as necessary, but no less frequently than annually.\219\ 
Requiring that the training occur annually would be a new CFTC 
requirement with respect to the BCDR plan training requirement for swap 
entities.\220\ The Commission nevertheless believes an annual training 
requirement is necessary for staff involved in BCDR planning to ensure 
they remain up-to-date on changes to the BCDR plan following the annual 
reviews and testing of the plan.\221\
---------------------------------------------------------------------------

    \218\ See paragraph (b)(3) of proposed Commission regulations 
1.13 and 23.603; supra note 63 and accompanying text.
    \219\ See paragraph (g)(2) of proposed Commission regulations 
1.13 and 23.603.
    \220\ See 17 CFR 23.603(c).
    \221\ See paragraph (h) of proposed Commission regulations 1.13 
and 23.603, discussed in section II.G, infra.
---------------------------------------------------------------------------

    To further support the proposed training requirement and ensure 
relevant personnel have access to and are aware of the current 
information and technology security, third-party relationships, and 
BCDR plans that form the ORF, the proposed rule would require that 
covered entities distribute copies of those plans to relevant personnel 
and promptly provide any significant revisions thereto.\222\ This 
proposed plan distribution requirement is consistent with the current 
BCDR plan distribution requirement for swap entities in current 
Commission regulation 23.603.\223\
---------------------------------------------------------------------------

    \222\ See paragraph (g)(3) of proposed Commission regulations 
1.13 and 23.603.
    \223\ See 17 CFR 23.603(c) (Each swap entity shall distribute a 
copy of its business continuity and disaster recovery plan to 
relevant employees and promptly provide any significant revision 
thereto.).
---------------------------------------------------------------------------

Request for Comment
    The Commission invites comment on all aspects of the proposed 
training requirement.

G. Reviews and Testing--Proposed Paragraph (h)

    To ensure the ORF remains viable and effective over time, the 
proposed rule would require covered entities to establish, implement, 
and maintain a plan reasonably designed to assess its adherence to, and 
the effectiveness of, the ORF through regular reviews and risk-based 
testing.\224\ As discussed above, the purpose of the proposed ORF would 
be to identify, monitor, manage, assess, and report on risks relating 
to information and technology security, third-party relationships, and 
emergencies or other significant business disruptions.\225\ Monitoring 
and managing these risks is a dynamic, ever-evolving process, 
especially given the increased reliance on and rapid evolution of 
technological advancements and related cyber risks.\226\ The Commission 
believes regular reviews and testing are an important tool needed to 
confirm that systems and information remain protected, controls are 
working as expected, and policies and procedures are being 
followed.\227\ Accordingly, the Commission preliminarily believes that 
regular reviews and testing would provide covered entities with 
essential information about the actual quality, performance, and 
reliability of the ORF in relation to its objectives and regulatory 
requirements. The Commission further expects that reviews and testing 
would be key to revealing unknown gaps or weaknesses in systems or 
controls that could then be analyzed to identify corrective actions 
designed to improve overall operational resilience over time.\228\ The 
results of the reviews and testing should be used to support sound 
decision-making at the covered entity regarding prioritization and 
funding of resources in a manner

[[Page 4729]]

that furthers operational resilience.\229\ Without such regular reviews 
and testing, the Commission is concerned that the ORF would quickly 
grow stale and ineffective, allowing unseen vulnerabilities to go 
unaddressed and potentially weaken the stability of the covered entity 
or the financial system at large.
---------------------------------------------------------------------------

    \224\ See paragraph (h) of proposed Commission regulations 1.13 
and 23.603.
    \225\ See paragraph (b)(1) of proposed Commission regulations 
1.13 and 23.603, supra note 55 and accompanying text.
    \226\ See Prudential Operational Resilience Paper, supra note 
11, at 9 (``The firm also regularly reviews and updates its systems 
and controls for security against evolving threats including cyber 
threats and emerging or new technologies.'').
    \227\ See, e.g., 17 CFR 37.1401 (SEFs); 17 CFR 38.1051 (DCMs); 
17 CFR 39.18 (DCOs); 17 CFR 49.24 (SDRs) (requiring system safeguard 
testing). See also FFIEC Information Security Booklet, supra note 69 
(providing that entities should have a documented testing and 
evaluation plan).
    \228\ See also CPMI IOSCO Cyber Resilience Guidance, supra note 
123, at 18 (``Sound testing regimes produce findings that are used 
to identify gaps in stated resilience objectives and provide 
credible and meaningful inputs to the [entity's] cyber risk 
management process. Analysis of testing results provides direction 
on how to correct weaknesses or deficiencies in the cyber resilience 
posture and reduce or eliminate identified gaps.'').
    \229\ See id. at 18 (``The results of the testing programme 
should be used by the [entity] to support the ongoing improvement of 
its cyber resilience.'').
---------------------------------------------------------------------------

1. Reviews--Proposed Paragraph (h)(1)
    Under the proposed rule, reviews would need to include an analysis 
of the adherence to, and the effectiveness of, the ORF, as well as any 
recommendations for modifications or improvements that address root 
causes of issues identified by the review.\230\ Again, the Commission 
believes that the process of reviewing the ORF to evaluate both its 
current effectiveness and make recommendations for prospective 
improvements that relate to deficiencies found through the review would 
help ensure that the ORF remains effective at managing operational 
resilience as circumstances change over time.
---------------------------------------------------------------------------

    \230\ See paragraph (h)(1) of proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

    The proposed rule would require covered entities to conduct such 
reviews at least annually and in connection with any material change to 
the activities or operations of the covered entity that is reasonably 
likely to affect the risks addressed by the ORF.\231\ An annual review 
standard is consistent with the Commission's existing review 
requirement for the RMP for covered entities, the BCDR plan for swap 
entities, and NFA's ISSP Interpretive Notice.\232\ Although the 
Commission would expect the ORF to be reviewed at least annually in its 
entirety, including not only the required plans but training and 
governance, the reviews could be broken into phases, staged over the 
course of the year. The Commission preliminarily believes that 
requiring the ORF to be reviewed on at least an annual basis and in 
connection with any relevant, material business change is sufficiently 
frequent to help ensure that the ORF remains effective and continues to 
meet its objectives over time.
---------------------------------------------------------------------------

    \231\ Id.
    \232\ See 17 CFR 1.11(f)(1); 17 CFR 23.600(e)(1) (requiring 
covered entities to review their RMPs on an annual basis or upon any 
material change in the business reasonably likely to alter their 
risk profile); 17 CFR 23.603(f) (requiring an annual review of swap 
entities' BCDR plan); NFA ISSP Notice, supra note 43 (providing that 
members should perform a regular review of their information systems 
security program at least once every twelve months).
---------------------------------------------------------------------------

    The proposed review requirement for the ORF would replace the 
similar annual review requirement for swap entities' BCDR plans 
contained in current Commission regulation 23.603. Current Commission 
regulation 23.603(f) requires that a member of senior management for a 
swap entity review the BCDR plan annually or upon any material change 
to the business and to document any deficiencies found or corrective 
action taken.\233\ The Commission preliminarily believes that the 
proposed annual review of the ORF, which would encompass a review of 
the BCDR plan, is sufficient to ensure the ORF's effectiveness and that 
it would no longer be necessary for a separate review of the BCDR plan 
to be conducted by senior management.
---------------------------------------------------------------------------

    \233\ See 17 CFR 23.603(f).
---------------------------------------------------------------------------

2. Testing--Proposed Paragraph (h)(2)
    With respect to risk-based testing of the ORF, the proposed rule 
would generally provide that covered entities determine the frequency, 
nature, and scope of the testing consistent with the proposed (b)(3) 
standard.\234\ Covered entities have available to them a wide range of 
testing tools, techniques, and methodologies, particularly with respect 
to information and technology security. Those tools and techniques 
include open source analysis, network security assessments, physical 
security reviews, source code reviews, compatibility testing, 
performance testing, and end-to-end testing, just to name a few.\235\ 
Such testing methods can vary significantly in terms of what they test 
and how, and in the degree of sophistication and sensitivity they need 
to run them correctly and reliably.\236\ Covered technology among 
covered entities varies, both in terms of the sensitivity of the data 
and information it contains and transmits, as well as its operational 
importance and risk profile.
---------------------------------------------------------------------------

    \234\ See paragraph (h)(2) of proposed Commission regulations 
1.13 and 23.603. See also paragraph (b)(3) of proposed Commission 
regulations 1.13 and 23.603; supra note 63 and accompanying text.
    \235\ See NIST, SP 800-115, Technical Guide to Information 
Security Testing and Assessment (Sept. 2008).
    \236\ Id.
---------------------------------------------------------------------------

    The Commission therefore preliminarily believes that leaving the 
specifics of the design and implementation of ORF testing to the 
reasonable judgment of each covered entity would help ensure that such 
testing protocols remain nimble as operations and recommended testing 
techniques change progressively over time.\237\ Covered entities would, 
however, need to ensure that the testing is reasonably designed to test 
the effectiveness of the function or system being tested.\238\ Covered 
entities should determine which particular tests to incorporate, 
consistent with the (b)(3) standard and their risk assessments, to 
ensure the testing effectively targets their particular business lines, 
activities, operations, and risk profile. Covered entities would 
accordingly be encouraged to document the decision-making regarding how 
it determined the nature, scope, and frequency of testing.
---------------------------------------------------------------------------

    \237\ See also Interagency Guidelines Safeguarding Customer 
Information, 66 FR 8623 (``The Agencies believe that a variety of 
tests may be used to ensure the controls, systems, and procedures of 
the information security program work properly and also recognize 
that such tests will progressively change over time''); FINRA 
Cybersecurity Report, supra note 66, at 13 (``Many firms determined 
the systems to be tested and the frequency with which they should be 
tested based on a risk assessment where higher risk systems were 
tested more frequently.'').
    \238\ See paragraph (h) of proposed Commission regulations 1.13 
and 23.603 (requiring that the testing plan be reasonably designed 
to assess the adherence to, and the effectiveness of, the ORF).
---------------------------------------------------------------------------

    Although the proposed rule would generally not mandate the use of 
any specific techniques, it would establish certain minimum testing 
frequencies with respect to a few testing categories that have broad 
consensus. With respect to testing of the information and technology 
security program, the proposed rule would require testing of key 
controls and the incident response plan at least annually.\239\ 
Consistent with the definition in the Commission's system safeguard 
rules for registered entities, the proposal would define ``key 
controls'' as those controls that an appropriate risk analysis 
determines are either critically important for effective information 
and technology security, or are intended to address risks that evolve 
or change more frequently and therefore require more frequent review to 
ensure their continuing effectiveness in addressing such risks.\240\ 
Given their importance to preserving information and technology 
security and recovering from incidents, the Commission believes that 
regular testing of the incident response plan and key controls on at 
least an annual basis is an important baseline requirement to ensure 
the continued effectiveness of

[[Page 4730]]

the information and technology security program.\241\
---------------------------------------------------------------------------

    \239\ See paragraph (h)(2)(i)(A) of proposed Commission 
regulations 1.13 and 23.603.
    \240\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``key controls''). See also 17 CFR 
37.1401(h)(1) (SEFs); 17 CFR 38.1051(h)(1) (DCMs); 17 CFR 39.18(a) 
(DCOs); 17 CFR 49.24(j)(1) (SDRs) (defining ``key controls'' for 
purposes of system safeguard requirements).
    \241\ See 17 CFR 37.1401(h)(5) (SEFs); 17 CFR 38.1051(h)(5) 
(DCMs); 17 CFR 39.18(e)(5) (DCOs); 17 CFR 49.24(j)(5) (SDRs) (annual 
testing of incident response plans and key controls); see also 
FFIEC, Information Technology Handbook, Audit Booklet at A-15 (Apr. 
2012) (including testing of key controls at least annually as an 
examination point
---------------------------------------------------------------------------

    The proposed rule would also require that testing of the 
information and technology security program include vulnerability 
assessments and penetration testing.\242\ Vulnerability assessments 
include methods and techniques to identify, diagnose, and prioritize 
vulnerabilities in the security of covered technology.\243\ Technical 
vulnerabilities can be identified through scanner tools, which can be 
run continuously or periodically, often daily, and may include checking 
servers for security patches to ensure they are current.\244\ 
Penetration testing (or ``pen testing''), meanwhile, attempts to 
identify ways to exploit vulnerabilities and circumvent or defeat 
security features, mimicking potential real-world attacks. Experts have 
developed a wide variety of penetration tests (e.g., wireless, network, 
web application, cloud, client side, social engineering, physical, 
threat-led) and approaches to or modes of completing them (e.g., black 
box, white box, gray box).\245\ Some tests go further by using cyber-
threat intelligence in designing these simulated attacks, a testing 
referred to as threat-led penetration testing or ``red teaming.'' \246\
---------------------------------------------------------------------------

    \242\ See paragraphs (h)(2)(i)(B)-(C) of proposed Commission 
regulations 1.13 and 23.603.
    \243\ See FFIEC Information Security Booklet, supra note 69, at 
8.
    \244\ Id.
    \245\ See FINRA Cybersecurity Report, supra note 66, at 13.
    \246\ See FSI, FSI Insights on policy implementation No. 21, 
Varying shades of red: how red team testing frameworks can enhance 
the cyber resilience of financial institutions (Nov. 2019).
---------------------------------------------------------------------------

    With respect to vulnerability assessments, the proposed rule would 
require covered entities to test their information and technology 
security programs using vulnerability assessments, including daily or 
continuous automated vulnerability scans.\247\ The Commission 
preliminarily believes that some degree of vulnerability assessment is 
considered standard cybersecurity hygiene in order to monitor systems 
and controls for vulnerabilities, and that the availability of 
automated vulnerability scanning tools help provide a base level of 
monitoring that is easily accessible to all covered entities.\248\
---------------------------------------------------------------------------

    \247\ See paragraph (h)(2)(i)(B) of proposed Commission 
regulations 1.13 and 23.603. See also 17 CFR 37.1401(h)(2) (SEFs); 
17 CFR 38.1051(h)(2) (DCMs); 17 CFR 39.18(e)(2) (DCOs); 17 CFR 
49.24(j)(2) (SDRs) (requiring automated vulnerability scanning).
    \248\ For instance, CISA makes available a free vulnerability 
scanner. See CISA, Cyber Hygiene Services, available at https://www.cisa.gov/cyber-hygiene-services.
---------------------------------------------------------------------------

    With respect to penetration testing, the proposed rule would not 
require covered entities to undertake specific types of testing. Given 
the diverse nature of entities registered as FCMs and swap entities, 
the Commission believes that determination of the type and method of 
penetration testing would be best left to the reasoned judgement of 
each covered entity after conducting its own assessment. The Commission 
would, however, require that covered entities conduct some penetration 
testing at least annually.\249\ The Commission preliminarily believes 
that annual penetration testing of some type, determined consistent 
with the proposed (b)(3) standard, would be important for covered 
entities to have knowledge and awareness of the actual vulnerability of 
their covered technology to internal or external threats. According to 
FINRA's 2018 cyber risk report, firms with strong cybersecurity 
programs conducted penetration tests at least annually and more 
frequently for mission critical, high risk systems such as for an 
online trading system.\250\ Covered entities would also be encouraged 
to consider additional risk-based penetration testing after key events, 
such as any time a significant change is made to important elements of 
the firm's applications and systems infrastructure, in addition to any 
other regular compliance testing.
---------------------------------------------------------------------------

    \249\ See paragraph (h)(2)(i)(C) of proposed Commission 
regulations 1.13 and 23.603.
    \250\ FINRA Cybersecurity Report, supra note 66, at 13-14. 
FFIEC's exam book also appears to contemplate at least some degree 
of penetration testing among financial institutions. See FFIEC 
Information Security Booklet, supra note 69, at 55 (noting that 
independent testing, including penetration testing and vulnerability 
scanning, is conducted according to the risk assessment for 
external-facing systems and the internal network).
---------------------------------------------------------------------------

    Current Commission regulation 23.603 includes a testing requirement 
for the BCDR plan for swap entities.\251\ The proposed ORF testing 
provision would replace that requirement in current Commission 
regulation 23.603 and specify that, as part of the testing, covered 
entities would need to conduct a walk-through or tabletop exercise 
designed to test the effectiveness of backup facilities and 
capabilities at least annually.\252\ The Commission preliminarily 
believes that swap entities currently test their BCDR plans through 
such exercises and that they are an important way to test the 
effectiveness of a BCDR plan in practice. Unlike current Commission 
regulation 23.603, however, the proposed rule would not require that 
covered entities' BCDR plans be audited every three years by a 
qualified third-party service provider.\253\ Based on the Commission's 
experience, this audit requirement has proven redundant and unnecessary 
in light of the requirements to review and test the plan annually.
---------------------------------------------------------------------------

    \251\ See 17 CFR 23.603(g) (requiring the BCDR plan to tested 
annually by qualified, independent internal personnel or a qualified 
third-party service).
    \252\ Current Commission regulation 23.603 does not specify the 
nature of the BCDR testing, see id.
    \253\ See id. (``Each business continuity and disaster recovery 
plan shall be audited at least once every three years by a qualified 
third party service. The date the audit was performed shall be 
documented, together with the nature and scope of the audit, any 
deficiencies found, any corrective action taken, and the date that 
corrective action was taken.'').
---------------------------------------------------------------------------

3. Independence--Proposed Paragraph (h)(3)
    To support the reliability and objectivity of the review and 
testing results, the proposed rule would require the reviews and 
testing to be conducted by qualified personnel who are independent of 
the aspect of the ORF being reviewed or tested.\254\ The personnel 
conducting the testing could be employees of the covered entity itself, 
an affiliate, or of a third-party service provider, provided that such 
personnel are sufficiently trained and not responsible for the 
development, installation, operation, or maintenance of the ``object'' 
of the testing (e.g., covered technology, key controls, training, 
etc.). For example, a covered entity's internal audit department may be 
sufficiently trained and independent to test certain key controls but 
may need to secure a third-party to test certain systems or program 
installations if it does not have sufficient capabilities in-house. 
Covered entities would therefore be permitted under the proposal to 
determine whether a particular test should be conducted in-house or by 
a third-party service provider, provided that the qualification and 
independence requirements are met.\255\
---------------------------------------------------------------------------

    \254\ See paragraph (h)(3) of proposed Commission regulations 
1.13 and 23.603.
    \255\ If a covered entity determines to use a third-party 
service provider, the proposed requirements and guidance with 
respect to the management of third-party relationships would apply. 
See supra note 153 and accompanying text.
---------------------------------------------------------------------------

    This proposed independence requirement is consistent with the 
testing requirement for swap entity

[[Page 4731]]

BCDR plans in current Commission regulation 23.603.\256\
---------------------------------------------------------------------------

    \256\ See 17 CFR 23.603(g) (requiring the BCDR plan to tested 
annually by qualified, independent internal personnel or a qualified 
third-party service).
---------------------------------------------------------------------------

4. Documentation--Proposed Paragraph (h)(4)
    The proposed rule would require covered entities to document all 
reviews and testing of the ORF. The documentation would need to 
include, at a minimum: (i) the date the review or testing was 
conducted; (ii) the nature and scope of the review or testing, 
including methodologies employed; (iii) the results of the review or 
testing, including any assessment of effectiveness; (iv) any identified 
deficiencies and recommendations for remediation; and (v) any 
corrective action(s) taken, including the date(s) such actions were 
taken.\257\ The Commission primarily believes documenting these key 
aspects of the testing and related results would not only assist in 
ensuring accountability for the testing, but would help covered 
entities take full advantage of any insights the testing may provide 
and to build upon their resiliency from lessons learned. Such 
documentation would also assist the Commission in performing its 
oversight duties with respect to covered entities and their 
implementation of their ORF.
---------------------------------------------------------------------------

    \257\ See paragraph (h)(4)(i)-(v) of proposed Commission 
regulations 1.13 and 23.603.
---------------------------------------------------------------------------

    This proposed documentation requirement is consistent with the 
requirement for swap entity BCDR plans in current Commission regulation 
23.603.\258\
---------------------------------------------------------------------------

    \258\ See 17 CFR 23.603(g) (``The date the testing was performed 
shall be documented, together with the nature and scope of the 
testing, any deficiencies found, any corrective action taken, and 
the date that corrective action was taken.'').
---------------------------------------------------------------------------

5. Internal Reporting--Proposed Paragraph (h)(5)
    To support covered entities' compliance with the ORF rule and 
ensure that senior leadership is apprised of and held accountable for 
the effectiveness of the ORF, the proposed rule would expressly require 
covered entities to report on the results of their reviews and testing 
to the CCO and any other relevant senior-level official(s) and 
oversight body(ies).\259\ The proposed rule would not mandate the form, 
method, or frequency of such reporting, but the Commission would 
encourage the reporting to be provided in a sufficiently timely manner 
so as to allow the CCO and senior leadership to act upon the 
information to take steps to improve compliance and the overall 
effectiveness of the ORF.
---------------------------------------------------------------------------

    \259\ See paragraph (h)(5) of proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

    This requirement does not exist with respect to the swap entity 
BCDR plan requirement in current Commission regulation 23.603 and would 
therefore be a new requirement.
6. Request for Comment
    The Commission invites comment on all aspects of the proposed 
review and testing requirements, including the following question:
    1. Key Controls. The proposed rule would require covered entities 
to test key controls on at least an annual basis and includes a 
definition of ``key controls'' that is comparable to how the term is 
defined for purposes of the Commission's system safeguard requirements 
for registered entities.\260\ Are covered entities currently testing 
key controls? How are they determining what controls should be 
regularly tested? Should the Commission consider allowing covered 
entities to define ``key controls'' for themselves consistent with the 
proposed (b)(3) standard?
---------------------------------------------------------------------------

    \260\ See, e.g., 17 CFR 37.1401(h)(1) (SEFs); 17 CFR 
38.1051(h)(1) (DCMs); 17 CFR 39.18(a) (DCOs); 17 CFR 49.24(j)(1) 
(SDRs) (defining ``key controls'' for purposes of system safeguard 
requirements).
---------------------------------------------------------------------------

H. Required Notifications--Proposed Paragraphs (i) and (j)

    The proposed rule would require covered entities to notify the 
Commission, customers, or counterparties of certain events within the 
scope of the ORF. Notifications to the Commission would relate to 
incidents that have an adverse impact, or a covered entity's decision 
to activate its BCDR plan.\261\ Notifications to customers or 
counterparties would relate to incidents that adversely impact their 
interests.\262\ These notification provisions are discussed in turn 
below.
---------------------------------------------------------------------------

    \261\ See paragraph (i) of proposed Commission regulations 1.13 
and 23.603.
    \262\ See paragraph (j) of proposed Commission regulations 1.13 
and 23.603.
---------------------------------------------------------------------------

1. Commission Notification of Incidents--Proposed Paragraph (i)(1)
    The proposed rule would require covered entities to notify the 
Commission of any incident that adversely impacts, or is reasonably 
likely to adversely impact, (A) information and technology security, 
(B) the ability of the covered entity to continue its business 
activities as a covered entity, or (C) the assets or positions of a 
customer or counterparty.\263\ The notification would need to include 
any information available to the covered entity at the time of the 
notification that could assist the Commission in assessing and 
responding to the incident, including the date the incident was 
detected, possible cause(s) of the incident, its apparent or likely 
impacts, and any actions the covered entity has taken or is taking to 
mitigate or recover from the incident, including measures to protect 
customers or counterparties.\264\ Covered entities would need to 
provide the notification as soon as possible, but no later than 24 
hours after such incident has been detected.\265\
---------------------------------------------------------------------------

    \263\ See paragraph (i)(1)(A)-(C) of proposed Commission 
regulations 1.13 and 23.603.
    \264\ See paragraph (i)(1)(ii) of proposed Commission 
regulations 1.13 and 23.603.
    \265\ See paragraph (i)(1)(iii) of proposed Commission 
regulations 1.13 and 23.603.
---------------------------------------------------------------------------

    The purpose of this proposed notification provision is multifold. 
At a fundamental level, the proposed rule would allow the Commission to 
exercise its oversight function with respect to the ORF, offering the 
Commission a real-world, real-time insight into the effectiveness of a 
particular covered entity's ORF and whether it is operating as 
intended. Early warning of impactful incidents would also enable the 
Commission to be more responsive, providing guidance or appropriate 
relief to help the covered entity withstand and recover from the 
incident. The Commission would also expect such early warnings to aid 
it in identifying and reacting to events that could pose a more 
systemic threat, either to the markets due to the severity of the 
impact of the incident or to other covered entities due to the nature 
of the incident (e.g., a ransomware attack against multiple covered 
entities or a third-party service provider engaged by more than one 
covered entity). In such potentially systemic circumstances, early 
awareness of the incident is expected to facilitate the Commission's 
role in coordinating industry efforts and information sharing, allowing 
it to help forestall the impact of potential broad-scale threats by 
sharing information with other regulators through its involvement in 
Financial and Banking Information Infrastructure Committee (FBIIC), 
issue timely statements to stabilize public confidence, and potentially 
take emergency regulatory action. Over time, the Commission 
preliminarily believes that the knowledge and experience gained from 
these incident reports could provide the Commission a vantage point 
from which to identify trends and lessons learned that could improve 
its supervisory guidance supporting industry efforts to

[[Page 4732]]

enhance their ORF practices, or lead to other regulatory improvements.
    As discussed above, the proposed rule would define ``incident'' as 
any event, occurrence or circumstance that could jeopardize (i.e., put 
into danger) information and technology security.\266\ This standard 
would include events that have the potential to harm information and 
technology security regardless of whether a harm actually materializes. 
The proposed notification standard, by contrast, would limit the scope 
of incidents required to be reported to the Commission to those where 
there is an observable negative impact or harm, or such negative impact 
or harm is reasonably likely. Covered entities would not, for instance, 
need to notify the Commission of unsuccessful attempts at unauthorized 
access, as the detection and deterrence of such an attempt would not 
require Commission action and would appear to be suggestive of an ORF 
that is operating as expected. If, however, a covered entity determines 
that an unauthorized person did access covered information, the 
Commission would need to be notified, regardless of how much 
information was accessed or whether the covered entity believes it has 
been used. The Commission would similarly want to know of any 
successful distributed denial-of-service attack that disrupts business 
operations, regardless of the length of time of that disruption.\267\
---------------------------------------------------------------------------

    \266\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``incident'').
    \267\ Covered entities would not need to notify the Commission 
of routine testing or planned maintenance.
---------------------------------------------------------------------------

    The Commission appreciates that, at the outset, information 
regarding an incident is likely to be incomplete and in flux, and the 
full impact and root cause of an incident may take some time to reveal 
itself. Covered entities may also not be able to detect incidents 
immediately after their occurrence, and with sophisticated malicious 
attacks, culprits often take steps to hide their intrusions. 
Nevertheless, the Commission preliminarily believes that delays in 
reporting an incident to the Commission could impede its ability to 
make timely assessments and take appropriate action. The Commission is 
concerned that such delays could have broad implications, especially 
when there are potential sector-wide ramifications or spill-over 
effects to other regulated entities that the Commission could assist in 
managing.
    Accordingly, the proposed rule would not prescribe a specific form 
or content for the notification or include a materiality limiter. The 
proposed rule would only require that covered entities provide whatever 
information they have on hand at the time that could assist the 
Commission in its assessment and response activities.\268\ If the 
proposed rule is adopted, the Commission would simply expect that as an 
incident progresses, covered entities would continue to engage with the 
Commission and provide updates as needed.\269\
---------------------------------------------------------------------------

    \268\ See paragraph (i)(1)(ii) of proposed Commission 
regulations 1.13 and 23.603.
    \269\ For avoidance of doubt, the proposed rule would not have 
any impact on covered entities' obligations to notify criminal 
authorities as appropriate or required by other law or regulation.
---------------------------------------------------------------------------

    The proposed rule would not prescribe a particular form for the 
notification but would require notification via email.\270\
---------------------------------------------------------------------------

    \270\ See paragraph (i)(2)(iii) of proposed Commission 
regulations 1.13 and 23.603.
---------------------------------------------------------------------------

2. Commission Notification of BCDR Plan Activation--Proposed Paragraph 
(i)(2)
    For similar reasons, the proposed rule would also require covered 
entities to notify the Commission of any determination to activate its 
BCDR plan.\271\ Consistent with the proposed incident notification, 
covered entities would need to notify the Commission of its 
determination to activate their BCDR plan within 24 hours of making 
that determination.\272\ Current Commission regulation 23.603 requires 
swap entities to notify the Commission ``promptly'' of any emergency or 
other disruption that may affect the ability of a swap entity to 
fulfill its regulatory obligations or would have a significant adverse 
effect on the swap entity, its counterparties, or the market.\273\ 
Based on the Commission's experience with this provision, which became 
particularly relevant during the onset of the COVID-19 pandemic, the 
Commission believes this standard has been open to wide interpretation 
among swap entities, leading to broad variations in the timeliness of 
the notifications to the Commission regarding their decisions to 
implement their BCDR plans and employ a remote work posture. The 
Commission therefore preliminarily believes that a more bright-line 
test that centers on the decision to activate the BCDR plan, an action 
that presumably would not occur absent an emergency or significant 
disruption impacting the covered entity, would be easier to apply. The 
Commission also believes such a standard would facilitate the prompt 
delivery of information to the Commission so that it may consider 
whether any action to support the continued integrity of the markets 
during the course of the emergency is necessary to continue to fulfill 
its oversight obligations. For that purpose, the Commission believes 
that 24 hours from activation of the BCDR plan would both encourage 
covered entities to inform the Commission with sufficient time for it 
to take any needed action and encourage covered entities to focus 
initial efforts on resuming or continuing operations.
---------------------------------------------------------------------------

    \271\ See paragraph (i)(2)(i) of proposed Commission regulations 
1.13 and 23.603.
    \272\ See paragraph (i)(2)(iii) of proposed Commission 
regulations 1.13 and 23.603.
    \273\ See 17 CFR 23.603(d) (``Each swap dealer and major swap 
participant shall promptly notify the Commission of any emergency or 
other disruption that may affect the ability of the swap dealer or 
major swap participant to fulfill its regulatory obligations or 
would have a significant adverse effect on the swap dealer or major 
swap participant, its counterparties, or the market.'').
---------------------------------------------------------------------------

    Under the proposed rule, the notification would need to include all 
information available to the covered entity at that time, including the 
date of the emergency or disruption, a brief description thereof, its 
apparent impact, and any actions the covered entity has taken or is 
taking to mitigate or recover from the incident, including measures to 
protect customers and counterparties, as the Commission believes this 
information would be necessary for it to perform its oversight 
obligations and take responsive action if needed.\274\ The proposed 
rule would not prescribe a particular form for the notification but 
would require notification via email.\275\
---------------------------------------------------------------------------

    \274\ See paragraph (i)(2)(ii) of proposed Commission 
regulations 1.13 and 23.603.
    \275\ See paragraph (i)(2)(iii) of proposed Commission 
regulations 1.13 and 23.603. Current Commission regulation 23.603 
does not prescribe the contents of the notification or the method of 
notification, so these would be new requirements for swap entities. 
See 17 CFR 23.603(d) (``Each swap dealer and major swap participant 
shall promptly notify the Commission of any emergency or other 
disruption that may affect the ability of the swap dealer or major 
swap participant to fulfill its regulatory obligations or would have 
a significant adverse effect on the swap dealer or major swap 
participant, its counterparties, or the market.'').
---------------------------------------------------------------------------

3. Notifications to Customers or Counterparties--Proposed Paragraph (j)
    Finally, the proposed rule would require covered entities to notify 
customers or counterparties as soon as possible of any incident that 
could have adversely affected the confidentiality or integrity of such 
customer or counterparty's covered information or their assets or 
positions.\276\ Such incidents could include the identification of a 
longstanding vulnerability that left exposed covered information, 
regardless of whether the covered entity has determined that a

[[Page 4733]]

bad actor has obtained access to that information. The Commission 
preliminarily believes that covered entities owe an enhanced duty to 
protect the covered information provided to them by their customers and 
counterparties in order to ensure market integrity and support customer 
protections. The proposed notification standard therefore encompasses 
incidents where an impact on customers or counterparties may not be 
definite so that they may have an opportunity to take whatever actions 
they deem necessary to protect their interests.
---------------------------------------------------------------------------

    \276\ See paragraph (j)(1) of proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

    Unlike with the proposed notifications to the Commission, however, 
the Commission preliminarily believes that the accuracy of information 
provided to customers and counterparties should be prioritized over 
early delivery to avoid causing unnecessary panic that could have 
potentially negative and irreversible spill-over effects. Accordingly, 
the proposed customer/counterparty notification provision does not 
include a specific minimum timing requirement for the notification 
other than to require the notification to be provided to customers and 
counterparties as soon as possible.\277\ The proposed rule would 
further require covered entities to disclose to customers and 
counterparties information necessary for them to understand and assess 
the potential impact of the incident on their information, assets, or 
positions and take any necessary actions (e.g., closing accounts, 
changing passwords).\278\ Such information would include, at a minimum, 
a description of the incident, the particular way in which the customer 
or counterparty may have been adversely impacted, measures taken by the 
covered entity to protect against further harm, and contact information 
for the covered entity where the customer or counterparty may learn 
more or ask questions.\279\
---------------------------------------------------------------------------

    \277\ See id.
    \278\ See paragraphs (j)(2)(i)-(iv) of proposed Commission 
regulations 1.13 and 23.603.
    \279\ See id.
---------------------------------------------------------------------------

4. Request for Comment
    The Commission invites comment on all aspects of its proposed ORF 
notification provisions, including the following questions:
    1. Incident notification to Commission. The proposed rule would 
require covered entities to notify the Commission of any incident that 
``adversely impacts, or is reasonably likely to adversely impact,'' 
information and technology security, the ability of the covered entity 
to continue its business activities as a covered entity, or the assets 
or positions of a customer or counterparty. As discussed above, the 
Commission believes this standard would give the Commission an early 
warning of incidents that do result in an observable negative impact or 
harm, or such negative impact or harm is reasonably likely, i.e., where 
information and technology security, business operations, or customers/
counterparties is harmed or compromised. Given the purpose of the 
proposed rule as providing the Commission an early warning so that it 
may act to help mitigate the potential impacts of the event, the 
proposed rule does not include a materiality limiter. Should the 
Commission consider including changing the requirement to further limit 
the incident notice to the incidents with a ``material'' or 
``significant'' adverse impact, or where such a material or significant 
adverse impact would be reasonably likely? If yes, how would including 
such a materiality limiter change the scope of incidents that would be 
reported to the Commission? In other words, what types of incidents 
would not be reported to the Commission under a standard that includes 
a materiality limiter, and why should the Commission not receive an 
early warning of those types of incidents? Please explain and provide 
examples.
    2. BCDR notification to Commission. The Commission is proposing to 
change the notification requirement in Commission regulation 23.603 to 
trigger upon a covered entity's determination to activate its BCDR 
plan, rather than ``promptly'' after an emergency or other disruption. 
Do covered entities typically make a specific determination before 
activating the BCDR plan? What is the process for making that 
determination and who makes it? Are there aspects of the BCDR plan that 
may become active before any formal determination is made? Should the 
Commission instead require notification ``when'' or ``as soon as'' a 
BCDR plan is activated? Why or why not? Please explain.
    3. Notifications to customers or counterparties. The proposed rule 
would require covered entities to provide affected customers and 
counterparties information necessary for the affected customer/
counterparty to understand and assess the potential impact of the 
incident on its information, assets, or positions and to take any 
necessary action. Does the proposed rule provide sufficient information 
for covered entities to assess and comply with that standard?

I. Amendment and Expansion of Other Provisions in Current Commission 
Regulation 23.603

    As mentioned in previous sections of this notice, the proposed rule 
would expand and apply the substance of existing provisions in current 
Commission regulation 23.603 to all covered entities and the ORF in its 
entirety. Such provisions not yet addressed include (1) the 
establishment of emergency contacts for the Commission and (2) 
recordkeeping obligations.\280\
---------------------------------------------------------------------------

    \280\ See 17 CFR 23.603(e) and (i). The Commission would not 
retain Commission regulation 23.603(h) (business continuity and 
disaster recovery plans required by other regulatory authorities) as 
superfluous, see supra note 198.
---------------------------------------------------------------------------

1. Emergency Contacts--Proposed Paragraph (k)
    To assist the Commission in responding to a reported incident, or 
an emergency or other significant disruption causing a covered entity 
to activate its BCDR plan, the proposed rule would require each covered 
entity to provide the Commission the name and contact information for 
two employees with knowledge of the covered entity's incident response 
plan and two employees with knowledge of the covered entity's BCDR 
plan.\281\ Each identified employee would need to be authorized to make 
key decisions on behalf of the covered entity in the event of either an 
incident or the BCDR plan activation, as applicable, as the Commission 
would want to be sure to be contacting personnel with appropriate 
knowledge and authority.\282\ Any updates to the ORF contacts would 
need to be made to the Commission as necessary to ensure the 
Commission's contact information remains accurate and up to date.\283\
---------------------------------------------------------------------------

    \281\ See paragraph (k)(1) of proposed Commission regulations 
1.13 and 23.603. See also 17 CFR 23.603(e) (requiring the 
designation of two emergency contacts with respect to the BCDR plan 
for swap entities).
    \282\ See paragraph (k)(2) of proposed Commission regulations 
1.13 and 23.603. The two employee contacts identified with respect 
to the information and technology security program could be the same 
as the employee contacts for the BCDR plan, provided that they have 
the requisite authority. See id.
    \283\ See paragraph (k)(3) of proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

    This provision is consistent with the existing emergency contacts 
requirement in the swap entity BCDR plan requirement in current 
Commission regulation 23.603.\284\
---------------------------------------------------------------------------

    \284\ See 17 CFR 23.603(e) (``Each swap dealer and major swap 
participant shall provide to the Commission the name and contact 
information of two employees who the Commission can contact in the 
event of an emergency or other disruption. The individuals 
identified shall be authorized to make key decisions on behalf of 
the swap dealer or major swap participant and have knowledge of the 
firm's business continuity and disaster recovery plan. The swap 
dealer or major swap participant shall provide the Commission with 
any updates to this information promptly.'').

---------------------------------------------------------------------------

[[Page 4734]]

2. Recordkeeping--Proposed Paragraph (l)
    To aid the Commission in fulfilling its oversight responsibilities, 
the proposed rule would require each covered entity to maintain all 
records required pursuant to the proposed ORF rule, including the 
information and technology security program, the third-party 
relationship program, and the BCDR plan, in accordance with Commission 
regulation 1.31 and to make them available promptly upon request to 
representatives of the Commission and to representations of applicable 
prudential regulators as defined in section 1a(39) of the CEA.\285\ 
This provision is consistent with the existing recordkeeping 
requirement in the swap entity BCDR plan requirement in current 
Commission regulation 23.603.\286\
---------------------------------------------------------------------------

    \285\ See paragraph (l) of proposed Commission regulations 1.13 
and 23.603. See 7 U.S.C. 1(a)(39).
    \286\ See 17 CFR 23.603(i) (``The business continuity and 
disaster recovery plan of the swap dealer and major swap participant 
and all other records required to be maintained pursuant to this 
section shall be maintained in accordance with Commission Regulation 
Sec.  1.31 and shall be made available promptly upon request to 
representatives of the Commission and to representatives of 
applicable prudential regulators.'').
---------------------------------------------------------------------------

3. Request for Comment
    The Commission invites comment on all aspects of the proposed 
emergency contacts and recordkeeping requirements.

J. Cross-Border Application for Swap Entities

    In September 2020, the Commission published a final rule addressing 
the cross-border application of certain provisions of the CEA 
applicable to swap entities.\287\ The rule addresses the application of 
the registration thresholds and certain requirements applicable to swap 
entities and establishes a formal process for requesting comparability 
determinations for such requirements from the Commission.\288\ Therein, 
the Commission classified current Commission regulation 23.603 (BCDR 
requirements for swap entities) as a group A requirement.\289\ The 
Commission described the group A requirements as helping swap entities 
``implement and maintain a comprehensive and robust system of internal 
controls to ensure the financial integrity of the firm, and, in turn, 
the protection of the financial system'' and as ``constitut[ing] an 
important line of defense against financial, operational, and 
compliance risks that could lead to a firm's default.'' \290\ Pursuant 
to Commission regulation 23.23(f)(1), a non-U.S. swap entity may 
satisfy any applicable group A requirement on an entity-wide basis by 
complying with the applicable standards of a foreign jurisdiction to 
the extent permitted by, and subject to any conditions specified in, a 
comparability determination issued by the Commission.\291\ In 
determining to offer substituted compliance for group A requirements 
broadly to all non-U.S. swap entities, the Commission explained its 
belief that group A requirements cannot be effectively applied on a 
fragmented jurisdictional basis, such that it would not be practical to 
limit substituted compliance for group A requirements to transactions 
involving only non-U.S. persons.\292\
---------------------------------------------------------------------------

    \287\ See Cross-Border Application of the Registration 
Thresholds and Certain Requirements Applicable to Swap Dealers and 
Major Swap Participants, 85 FR 56924 (Sept. 14, 2020) (Final Cross 
Border Rule); 17 CFR 23.23.
    \288\ Id.
    \289\ Id. at 56964-65; 17 CFR 23.23(a)(6) (defining ``group A 
requirements'').
    \290\ Final Cross-Border Rule, 85 FR 56964 (providing that 
``requiring swap entities to rigorously monitor and address the 
risks they incur as part of their day-to-day businesses lowers the 
registrants' risk of default--and ultimately protects the public and 
the financial system.'').
    \291\ See 17 CFR 23.23(f)(1). See also 17 CFR 23.23(a)(11) 
(defining ``non-U.S. swap entity''); 17 CFR 23.23(g) (describing the 
process for the issuance of comparability determinations).
    \292\ See Final Cross-Border Rule, 85 FR 56977.
---------------------------------------------------------------------------

    As discussed above, the proposed rule would amend current 
Commission regulation 23.603 to contain the entirety of the ORF 
requirements applicable to swap entities, which would include 
requirements not only relating to BCDR but also those relating to 
information and technology security and third-party relationships. The 
Commission preliminarily believes that the same rationale for 
classifying BCDR requirements as a group A requirement would apply to 
the ORF rule more broadly. As discussed in detail above, the Commission 
preliminarily believes that the proposed information and technology 
security and third-party risk relationship requirements would also 
serve to help swap entities implement and maintain a comprehensive and 
robust system of internal controls, serving as an important line of 
defense against the threat of failure at the firm level and of the 
financial system more broadly. Accordingly, should the ORF rule be 
adopted, the Commission would continue to classify Commission 
regulation 23.603 in its entirety as a group A requirement, for which 
substituted compliance would broadly be available pursuant to the 
requirements of Commission regulation 23.23(f)(1).
    As mentioned above, Commission regulation 23.23(f)(1) only allows 
substituted compliance ``to the extent permitted by, and subject to any 
conditions specified in, a comparability determination issued by the 
Commission under [Commission regulation 23.23(g)].'' \293\ Current 
Commission comparability determinations do not address the entirety of 
the proposed ORF rule, as it has yet to be adopted. Rather, they only 
address the requirements in current Commission regulation 23.603, which 
are limited to the BCDR plan requirement.
---------------------------------------------------------------------------

    \293\ See 17 CFR 23.23(f)(1).
---------------------------------------------------------------------------

    The Commission appreciates that non-U.S. swap entities have come to 
rely on existing comparability determinations with respect to the 
current BCDR requirements in Commission regulation 23.603. Accordingly, 
in the interest of comity and good governance, should the proposed rule 
be adopted, the Commission has preliminarily determined to permit non-
U.S. swap entities to continue to rely on current comparability 
determinations with respect to the Commission's BCDR requirements, even 
as amended. However, for substituted compliance to be available for the 
ORF rule in its entirety, an eligible swap entity or foreign regulatory 
authority would need to submit a request for a comparability 
determination pursuant to Commission regulation 23.23(g). The 
submission would need to address the full complement of the provisions 
of the ORF rule, however codified in amended Commission regulation 
23.603, including the BCDR requirements. The Commission would then 
evaluate the request, considering amended Commission regulation 23.603 
in its entirety, and, if the Commission were to conclude it appropriate 
to do so, issue updated comparability determinations that would 
supersede any pre-existing comparability determinations with respect to 
BCDR requirements for swap entities.
Request for Comment
    The Commission invites comment on all aspects of the cross-border 
implications of the proposed rule.

[[Page 4735]]

K. Implementation Period

    Should the proposed rule be adopted, the Commission recognizes that 
covered entities may need time to establish an ORF or review and update 
existing plans and procedures for compliance with the proposed ORF 
rule. The Commission preliminarily believes that, given existing and 
applicable NFA, prudential, and foreign requirements, six months from 
the rule's adoption would be a sufficient amount of time for covered 
entities to achieve compliance with the ORF rule.
    The Commission invites comment on the Commission's proposed 
implementation period for the proposed ORF rule, including the 
following questions:
    1. Would six months be as sufficient amount of time for covered 
entities to develop compliant ORFs? If not, why not? Please explain.
    2. If covered entities would need more than six months to implement 
the ORF as proposed, how much more time would they estimate to need, 
and what would they be doing with that time? Please be as detailed as 
possible.

III. Related Matters

A. Regulatory Flexibility Act

    The Regulatory Flexibility Act (RFA) requires Federal agencies, in 
promulgating regulations, to consider the impact of those regulations 
on small entities--whether the rules will have a significant economic 
impact on a substantial number of small entities--and if so, to provide 
a regulatory flexibility analysis reflecting the impact.\294\ The 
Commission has established certain definitions of ``small entities'' to 
be used by the Commission in evaluating the impact of its rules on 
small entities in accordance with the RFA.\295\ The proposed 
regulations would affect FCMs, SDs, and MSPs. The Commission has 
previously determined that FCMs, SDs, and MSPs are not small entities 
for purposes of the RFA.\296\ Accordingly, the Chairman, on behalf of 
the Commission, hereby certifies pursuant to 5 U.S.C. 506(b) that the 
proposed rule and rule amendments would not have a significant economic 
impact on a substantial number of small entities.
---------------------------------------------------------------------------

    \294\ 5 U.S.C. 601 et seq.
    \295\ See Policy Statement and Establishment of Definitions of 
``Small Entities'' for Purposes of the Regulatory Flexibility Act, 
47 FR 18618 (Apr. 30, 1982) (RFA Definitions of ``Small Entities'').
    \296\ See RFA Definitions of ``Small Entities,'' 47 FR 18619 
(FCMs); Final Swap Entities RMP Rule, 77 FR 20193-94 (SDs and MSPs).
---------------------------------------------------------------------------

B. Paperwork Reduction Act

    The Paperwork Reduction Act (PRA) imposes certain requirements on 
federal agencies, including the Commission, in connection with 
conducting or sponsoring any ``collection of information,'' as defined 
by the PRA.\297\ The PRA is intended, in part, to minimize the 
paperwork burden created for individuals, businesses, and other persons 
as a result of the collection of information by federal agencies, and 
to ensure the greatest possible benefit and utility of information 
created, collected, maintained, used, shared, and disseminated by or 
for the Federal Government.\298\ The PRA applies to all information, 
regardless of form or format, whenever the Federal Government is 
obtaining, causing to be obtained, or soliciting information, and 
includes required disclosure to third parties or the public, of facts 
or opinions, when the information collection calls for answers to 
identical questions posed to, or identical reporting or recordkeeping 
requirements imposed on, ten or more persons.\299\
---------------------------------------------------------------------------

    \297\ 44 U.S.C. 3501 et seq.
    \298\ Id.
    \299\ See 44 U.S.C. 3502(3).
---------------------------------------------------------------------------

    This proposed rulemaking would result in new collection of 
information requirements within the meaning of the PRA. The Commission 
is therefore submitting this proposal to the Office of Management and 
Budget (OMB) for review.\300\ The title for this collection of 
information is ``Operational Resilience Framework for Futures 
Commission Merchants, Swap Dealers, and Major Swap Participants.'' The 
OMB has not yet assigned this collection a control number. An agency 
may not conduct or sponsor, and a person is not required to respond to, 
a collection of information unless it displays a currently valid 
control number.\301\
---------------------------------------------------------------------------

    \300\ See 44 U.S.C. 3507(d); 5 CFR 1320.11.
    \301\ See 44 U.S.C. 3507(a)(3); 5 CFR 1320.5(a)(3).
---------------------------------------------------------------------------

    If the proposed regulations are adopted, responses to this 
collection of information would be mandatory. The Commission will 
protect proprietary information according to the Freedom of Information 
Act and part 145 of the Commission's regulations, ``Commission Records 
and Information.'' \302\ In addition, section 8(a)(1) of the CEA 
strictly prohibits the Commission, unless specifically authorized by 
the CEA, from making public ``data and information that would 
separately disclose the business transactions or market positions of 
any person and trade secrets or names of customers.'' \303\ The 
Commission is also required to protect certain information contained in 
a government system of records according to the Privacy Act of 
1974.\304\
---------------------------------------------------------------------------

    \302\ See 5 U.S.C. 552. See also 17 CFR part 145.
    \303\ 7 U.S.C. 12(a)(1).
    \304\ See 5 U.S.C. 552a.
---------------------------------------------------------------------------

1. Information Provided by Reporting Entities/Persons
    The proposed regulations would require each covered entity to 
establish, document, implement, and maintain an ORF that includes an 
information and technology security program, a third-party relationship 
program, and a BCDR plan, each of which would need to be supported by 
written policies and procedures. In addition, the proposed regulations 
would impose the following reporting, recordkeeping, and disclosure 
obligations on each covered entity: (1) on an annual basis, written 
approval of each component program or plan of the ORF and of risk 
appetite and risk tolerance limits, or in the case of covered entities 
relying on a consolidated program or plan, written attestation; (2) on 
an annual basis, documenting review and testing of the ORF; (3) as 
applicable, notifying the Commission of certain ``incidents,'' as 
defined in the proposed rule; (4) as applicable, notifying the 
Commission upon activation of the BCDR plan; (5) as applicable, 
notifying customers or counterparties of certain ``incidents,'' as 
defined in the proposed rule; and (6) providing emergency contact 
information to the Commission in connection with the information and 
technology security program and the BCDR plan. These requirements will 
result in new PRA burdens for covered entities.
    For purposes of the PRA, the term ``burden'' means the ``time, 
effort, or financial resources expended by persons to generate, 
maintain, or provide information to or for a Federal Agency.'' \305\ 
This total includes the anticipated burden associated with the 
development of the required written policies and procedures, 
satisfaction of various reporting, recordkeeping, and disclosure 
obligations, the documentation of required ORF testing and review, and 
the documentation of risk appetite and risk tolerance limits approval.
---------------------------------------------------------------------------

    \305\ 44 U.S.C. 3502(2).
---------------------------------------------------------------------------

    As of October 31, 2023, there are 160 covered entities that would 
become subject to the proposed rule (100 registered swaps dealers, 54 
registered futures commission merchants, and 6 dually-registered swap 
dealers/futures commission merchants). The estimated burden associated 
with the proposed

[[Page 4736]]

information collections is calculated as follows:
a. Recordkeeping Requirements
    The proposed regulation contains recordkeeping requirements that 
would result in a collection of information from ten or more persons 
over a 12-month period.
    Establishing, documenting, implementing, and maintaining 
information and technology security program: As part of an overall ORF, 
proposed Commission regulations 1.13(d) and 23.603(d) would require 
covered entities to establish an information and technology security 
program reasonably designed to identify, monitor, manage, and assess 
risks relating to information and technology security, including 
through conducting and documenting risk assessments at least annually. 
Upon the risk assessment's completion, the results would need to be 
provided to the oversight body, senior officer, or other senior-level 
official who approves the information and technology security program. 
As part of the information and technology security program, the 
proposed rule would require the covered entity to establish, document, 
implement, and maintain controls to prevent, detect, and mitigate 
identified risks to information and technology security. In addition, 
the proposed rule would require that the information and technology 
security program include a written incident response plan reasonably 
designed to detect, assess, contain, mitigate the impact of, and 
recover from an incident.
    The Commission anticipates that a covered entity would require an 
estimated 200 hours to develop their information and technology 
security program, including conducting and documenting an annual risk 
assessment and developing an incident response plan. This yields a 
total annual burden of 32,000 burden hours (160 respondents x 200 hours 
= 32,000 hours).
    Accordingly, the aggregate annual estimate for the recordkeeping 
burden associated with this proposal would be as follows:\306\
---------------------------------------------------------------------------

    \306\ This estimate reflects the aggregate information 
collection burden estimate associated with the proposed 
recordkeeping requirement for the first annual period following 
implementation of the proposed regulations. Because proposed 
Commission regulations 1.13(d) and 23.603(d) would require the one-
time recordkeeping requirement as to developing the information and 
technology security program, Commission staff estimates that for 
each subsequent annual period, the number of burden hours would be 
reduced accordingly.
---------------------------------------------------------------------------

    Number of registrants: 160.
    Estimated number of responses: 1.
    Estimated total annual burden per registrant: 200 hours.
    Frequency of collection: Annually.
    Total annual burden: 32,000 burden hours [160 registrants x 200 
hours].
    Establishing, documenting, implementing, and maintaining third-
party relationship program: Proposed Commission regulations 1.13(e) and 
23.603(e) would require covered entities to develop a program 
reasonably designed to identify, monitor, manage, and assess risks 
relating to third-party relationships. The program would be required to 
address the risks attendant to each stage of the third-party 
relationship lifecycle and would be required to include an inventory of 
third-party service providers the covered entity has engaged to support 
its activities as a covered entity.
    The Commission anticipates that a covered entity would require an 
estimated 160 hours annually to develop their third-party relationship 
program, including creating and maintaining a third-party service 
provider inventory. This yields a total annual burden of 25,600 hours 
(160 respondents x 160 hours = 25,600 burden hours). The aggregate 
annual estimate for the recordkeeping burden associated with this 
proposal would be as follows: \307\
---------------------------------------------------------------------------

    \307\ This estimate reflects the aggregate information 
collection burden estimate associated with the proposed 
recordkeeping requirement for the first annual period following 
implementation of the proposed regulations. Because proposed 
Commission regulations 1.13(e) and 23.603(e) would require the one-
time recordkeeping requirement as to developing the third-party 
relationship program, Commission staff estimates that for each 
subsequent annual period, the number of burden hours would be 
reduced accordingly.
---------------------------------------------------------------------------

    Number of registrants: 160.
    Estimated number of responses: 1.
    Estimated total annual burden per registrant: 160 hours.
    Frequency of collection: Annually.
    Total annual burden: 25,600 burden hours [160 registrants x 160 
hours].
    Establishing, documenting, implementing, and maintaining BCDR plan: 
Proposed Commission regulations 1.13(f) and 23.603(f) would require 
covered entities to establish a written BCDR plan reasonably designed 
to identify, monitor, manage, and assess risks relating to emergencies 
or other significant disruptions to the continuity of normal business 
operations as a covered entity.\308\ The proposed rule would require 
the BCDR plan be reasonably designed to enable the covered entity to: 
(1) continue or resume any activities as a covered entity with minimal 
disruption to customers, counterparties, and markets; and (2) recover 
and make use of covered information, in addition to any other data, 
information, or documentation required to be maintained by law and 
regulation. These plans would be required to, among other things, 
establish procedures for data backup and establish and maintain 
arrangements to provide for redundancies or their backup for covered 
technology, facilities, infrastructure, personnel, and competencies.
---------------------------------------------------------------------------

    \308\ As discussed in section II.E (Continuity and Disaster 
Recovery Plan) of this notice, swap entities are already required to 
establish a written BCDR plan pursuant to current Commission 
regulation 23.603. The existing burdens for current Commission 
regulation 23.603 are found in the following information collection, 
Regulations Establishing and Governing the Duties of Swap Dealers 
and Major Swap Participants (OMB Control No. 3038-0084). The burden 
of swap entities updating their BCDR plan is included in the new 
collection of information established by the proposed rule, but the 
Commission is retaining its existing burden estimates under Control 
No. 3038-0084 at this time to avoid undercounting. The Commission 
will adjust its burden estimates associated with OMB Control No. 
3038-0084 at a later date, as necessary.
---------------------------------------------------------------------------

    The Commission anticipates that a covered entity would require an 
estimated 50 hours annually to develop or to update their existing 
written BCDR plan. This yields a total annual burden of 8,000 burden 
hours (160 respondents x 50 hours = 8,000 hours).
    Accordingly, the aggregate annual estimate for the recordkeeping 
burden associated with this proposal would be as follows:\309\
---------------------------------------------------------------------------

    \309\ This estimate reflects the aggregate information 
collection burden estimate associated with the proposed 
recordkeeping requirement for the first annual period following 
implementation of the proposed regulations. Because proposed 
Commission regulations 1.13(f) and 23.603(f) would require the one-
time recordkeeping requirement, as to developing the BCDR plan, 
Commission staff estimates that for each subsequent annual period, 
the number of burden hours would be reduced accordingly.
---------------------------------------------------------------------------

    Number of registrants: 160.
    Estimated number of responses: 1.
    Estimated total annual burden per registrant: 50 hours.
    Frequency of collection: Annually.
    Total annual burden: 8,000 burden hours [160 registrants x 50 
hours].
    Documentation of ORF review: Proposed Commission regulations 
1.13(h) and 23.603(h) would require covered entities to establish, 
implement, and maintain plans reasonably designed to assess their 
adherence to, and the effectiveness of, their ORF through regular 
reviews and risk-based testing.
    The proposed rule would require that reviews be conducted at least 
annually and when any material change to covered entities' activities 
or operations occurs that is reasonably likely to affect

[[Page 4737]]

the risks identified in the ORF. With regard to testing, the proposed 
rule would require that the testing of information and technology 
security program include, at a minimum, the testing of key controls and 
the incident response plan at least annually; daily or continuous 
automated vulnerability scans; and penetration testing at least 
annually. Additionally, the proposed rule would require that testing of 
the BCDR plan must include, at a minimum, a walk-through or tabletop 
exercise designed to test the effectiveness of backup facilities and 
capabilities at least annually.
    The proposed rule would also require covered entities to document 
all reviews and testing of their ORFs. The proposed rule would require 
that documentation to include, at a minimum, (i) the date the review or 
testing was conducted; (ii) the nature and scope of the review or 
testing, including methodologies employed; (iii) the results of the 
review or testing, including any assessment of effectiveness; (iv) any 
identified deficiencies and recommendations for remediation; and (v) 
any corrective action(s) taken or initiated, including the date(s) of 
such action(s).
    The Commission anticipates that covered entities would require an 
estimated 80 hours annually to establish a plan to assess adherence to, 
and the effectiveness of, its ORF, as well as documenting all reviews 
and testing of the ORF. This yields a total annual burden of 12,800 
hours (160 respondents x 80 hours = 12,800 burden hours).
    The aggregate annual estimate for the recordkeeping burden 
associated with this proposal would be as follows: \310\
---------------------------------------------------------------------------

    \310\ This estimate reflects the aggregate information 
collection burden estimate associated with the proposed 
recordkeeping requirement for the first annual period following 
implementation of the proposed regulations. Because proposed 
Commission regulations 1.13(h) and 23.603(h) would require the one-
time recordkeeping requirement as to developing a plan to assess the 
effectiveness of the ORF, Commission staff estimates that for each 
subsequent annual period, the number of burden hours would be 
reduced accordingly.
---------------------------------------------------------------------------

    Number of registrants: 160.
    Estimated number of responses: 1.
    Estimated total annual burden per registrant: 80 hours.
    Frequency of collection: Annually.
    Total annual burden: 12,800 burden hours [160 registrants x 80 
hours].
    Documentation of approval of the component programs or plan, risk 
appetite, and risk tolerance limits: Proposed Commission regulations 
1.13(c)(1) and 23.603(c)(1) would require covered entities to ensure 
that the information and technology security program, third-party 
relationship program, and BCDR plan are approved in writing on at least 
an annual basis by either the senior officer, an oversight body, or a 
senior-level official with primary responsibility for the component 
programs or plan. Proposed Commission regulations 1.13(c)(2) and 
23.603(c)(2) would require the risk appetite and risk tolerance limits 
established by covered entities be approved in writing at least 
annually by either the senior officer, an oversight body, or a senior-
level official. Proposed Commission regulations 1.13(c)(4)(ii) and 
23.603(c)(4)(ii) would allow covered entities that rely on a 
consolidated program or plan for its ORF to meet the annual approval 
requirement for the component programs or plan of the ORF, risk 
appetite, and risk tolerance limits through an annual written 
attestation by either the senior officer, an oversight body, or a 
senior-level official.
    The Commission anticipates that covered entities would require an 
estimated 20 hours annually to document approval of the ORF, risk 
appetite, and risk tolerance limits or to prepare the written 
attestation. This yields a total annual burden of 3,200 hours (160 
respondents x 20 hours = 3,200 burden hours).
    The aggregate annual estimate for the recordkeeping burden 
associated with this proposal would be as follows:
    Number of registrants: 160.
    Estimated number of responses: 1.
    Estimated total annual burden per registrant: 20 hours.
    Frequency of collection: Annually.
    Total annual burden: 3,200 burden hours [160 registrants x 20 
hours].
b. Reporting Requirements
    The proposed regulation contains reporting requirements that would 
result in a collection of information from ten or more persons over a 
12-month period.
    Notification of incidents to the Commission: Proposed Commission 
regulations 1.13(i)(1) and 23.603(i)(1) would require covered entities 
to notify the Commission regarding incidents that adversely impact or 
are reasonably likely to adversely impact: (1) information technology 
and security; (2) the covered entity's ability to continue its business 
activities; or (3) the assets or positions of a customer or 
counterparty. These notifications would be required to include 
information that may assist the Commission in assessing and responding 
to the incident, including the date the incident was detected, possible 
cause(s) of the incident, its apparent or likely impacts, and any 
actions the covered entity has taken or is taking to mitigate or 
recover from the incident. Notifications would be required to be 
submitted via email as soon as possible, but no later than 24 hours 
after an incident is detected.
    The Commission anticipates that covered entities may experience one 
reportable incident per year and that covered entities would expend 
approximately 10 hours to gather the information required and provide 
the required notification to the Commission. This would result in an 
estimated total annual burden of 1,600 hours (160 respondents x 1 
reportable incident per year x 10 hours per reportable incident = 1,600 
hours).
    The aggregate annual estimate for the reporting burden associated 
with this proposal would be as follows:
    Number of registrants: 160.
    Estimated number of responses: 1.
    Estimated total annual burden per registrant: 10 hours.
    Frequency of collection: As needed.
    Total annual burden: 1,600 burden hours [160 registrants x 10 
hours].
    Notification of BCDR plan activation: Proposed Commission 
regulations 1.13(i)(2) and 23.603(i)(2) would require covered entities 
to notify the Commission of any determination to activate the BCDR 
plan. Covered entities would be required to provide such notices via 
email and include any information available at the time of the 
notification that may assist the Commission in assessing or responding 
to the emergency or disruption, including the date of the emergency or 
disruption, a description thereof, the possible cause(s), its apparent 
or likely impacts, and any actions the covered entity has taken or is 
taking to mitigate or recover from the emergency or disruption, 
including measures taken or being taken to protect customers.
    The Commission anticipates that approximately 3 covered entities 
may activate their BCDR plan per year and that such covered entities 
would expend approximately 10 hours to gather the information required 
and to provide the required notification to the Commission. This would 
result in an estimated total annual burden of 30 burden hours (3 BCDR 
activations per year x 10 hours per BCDR activation = 30 hours).
    The aggregate annual estimate for the reporting burden associated 
with this proposal would be as follows:
    Number of registrants: 3.
    Estimated number of responses per respondent: 1.
    Estimated total annual burden per registrant: 10 hours.
    Frequency of collection: As needed.

[[Page 4738]]

    Total annual burden: 30 burden hours [3 BCDR activations per year x 
10 hours].
    Filing emergency contact information: Proposed Commission 
regulations 1.13(k) and 23.603(k) would require covered entities to 
provide the Commission with emergency contact information for employees 
to serve as contacts in connection with required incident notifications 
under the ORF and the activation of the covered entity's BCDR plan.
    The Commission anticipates that covered entities would require an 
estimated 1 hour annually to provide the Commission with emergency 
contact information. This yields a total annual burden of 160 burden 
hours (160 respondents x 1 hour = 160 burden hours).
    The aggregate annual estimate for the reporting burden associated 
with this proposal would be as follows: \311\
---------------------------------------------------------------------------

    \311\ This estimate reflects the aggregate information 
collection burden estimate associated with the proposed reporting 
requirement for the first annual period following implementation of 
the proposed regulations. Because proposed Commission regulations 
1.13(k) and 23.603(k) would require the emergency contact 
information provided to the Commission to be updated only as 
necessary, Commission staff estimates that for each subsequent 
annual period, the number of burden hours would be reduced 
accordingly.
---------------------------------------------------------------------------

    Number of registrants: 160.
    Estimated number of responses: 1.
    Estimated total annual burden per registrant: 1 hour.
    Frequency of collection: As needed.
    Total annual burden: 160 burden hours [160 registrants x 1 hour].
c. Disclosure Requirements
    The proposed regulation contains disclosure requirements that would 
result in a collection of information from ten or more persons over a 
12-month period.
    Notification of incidents to affected customers and counterparties: 
Proposed Commission regulations 1.13(j) and 23.603(j) would require 
covered entities to notify their customers and counterparties as soon 
as possible of any incident that is reasonably likely to have adversely 
affected the confidentiality or integrity of the customer's or 
counterparty's covered information, assets, or positions. The proposed 
rule would require that notifications include information necessary for 
the affected customer or counterparty to understand and assess the 
potential impact of the incident on its information, assets, or 
positions and to take any necessary action. Such notifications shall 
include, at a minimum, a description of the incident; the way the 
customer or counterparty, or its covered information, may have been 
adversely impacted; measures being taken by the covered entity to 
protect against further harm; and contact information for the covered 
entity where the customer or counterparty may learn more about the 
incident or ask questions.
    The Commission anticipates that covered entities may experience 17 
reportable incidents per year and that covered entities would expend 
approximately 50 hours to gather the required information necessary to 
provide notice of an incident and to prepare and deliver the required 
notification. This would result in an estimated total annual burden of 
850 burden hours (17 reportable incidents per year x 50 hours per 
reportable incident = 850 burden hours).
    The aggregate annual estimate for the disclosure burden associated 
with this proposal would be as follows:
    Number of registrants: 17.
    Estimated number of responses per respondent: 1.
    Estimated total annual burden per registrant: 50 hours.
    Frequency of collection: As needed.
    Total annual burden: 850 burden hours [17 reportable incidents per 
year x 50 hours].
d. Total Burden
    Based upon the estimates above, the aggregate annual cost for all 
covered entities is 84,240 burden hours.
    It is expected that covered entities will utilize existing 
software, information technology and systems. Thus, the Commission 
believes any additional capital/startup costs or operational/
maintenance costs incurred by respondents to report the information 
required by the proposed regulations to the Commission would be 
negligible, if any.
2. Request for Comment
    The Commission invites the public and other federal agencies to 
comment on any aspect of the reporting, recordkeeping, and disclosure 
burdens discussed above. Pursuant to 44 U.S.C. 3506(c)(2)(B), the 
Commission will consider public comments on this proposed collection of 
information in:
    (1) Evaluating whether the proposed collection of information is 
necessary for the proper performance of the functions of the 
Commission, including whether the information will have practical 
utility;
    (2) Evaluating the accuracy of the Commission's estimate of the 
burden of the proposed collection of information, including the degree 
to which the methodology and the assumptions that the Commission 
employed were valid;
    (3) Enhancing the quality, utility, and clarity of the information 
proposed to be collected; and
    (4) Minimizing the burden of the collection of information on 
covered entities, including through the use of appropriate automated, 
electronic, mechanical, or other technological information collection 
techniques, e.g., permitting electronic submission of responses.
    A copy of the supporting statements for the collections of 
information discussed above are available from the CFTC Clearance 
Officer, 1155 21st Street NW, Washington, DC 20581, 202-418-5714, or 
from https://www.RegInfo.gov. Organizations and individuals desiring to 
submit comments on the proposed information collection requirements 
should send those comments to:
     The Office of Information and Regulatory Affairs, Office 
of Management and Building, Room 10235, New Executive Office Building, 
Washington, DC 20503, Attn: Desk Officer of the Commodity Futures 
Trading Commission;
     202-395-6566 (fax);
     [email protected] (email).
    Please provide the Commission with a copy of submitted comments so 
that all comments can be summarized and addressed in the final 
rulemaking. Please refer to the ADDRESSES section of this notice of 
proposed rulemaking for comment submission instructions to the 
Commission. OMB is required to decide concerning the collection of 
information between 30 and 60 days after publication of this document 
in the Federal Register. Therefore, a comment is best assured of 
receiving full consideration if OMB (and the Commission) receives it 
within 30 calendar days of publication of this notice. Nothing in the 
foregoing affects the deadline enumerated above for public comment to 
the Commission on the proposed rule.

C. Cost-Benefit Considerations

    Section 15(a) of the CEA requires the Commission to consider the 
costs and benefits of its discretionary actions before promulgating a 
regulation under the CEA or issuing certain orders.\312\ Section 15(a) 
further specifies that the costs and benefits shall be evaluated in 
light of five broad areas of market and public concern: (1) Protection 
of market participants and the public; (2) efficiency, competitiveness, 
and financial integrity of swaps markets; (3) price discovery; (4) 
sound risk

[[Page 4739]]

management practices; and (5) other public interest 
considerations.\313\ In conducting its analysis, the Commission may, in 
its discretion, give greater weight to any one of the five enumerated 
areas of concern. The Commission considers the costs and benefits 
resulting from its discretionary determinations with respect to the 
considerations of section 15(a) of the CEA.
---------------------------------------------------------------------------

    \312\ See 7 U.S.C. 19(a).
    \313\ Id.
---------------------------------------------------------------------------

    As detailed above, the proposed rule would require covered entities 
(FCMs, SDs, and MSPs) to establish, document, implement, and maintain 
an ORF reasonably designed to identify, monitor, manage, and assess 
risks relating to (i) information and technology security, (ii) third-
party service providers, and (iii) emergencies or other significant 
disruptions to the continuity of their normal business operations.\314\ 
The ORF would accordingly need to include a program or plan directed at 
each of these three risk areas (an information and technology security 
program, a third-party relationship program, and a business continuity 
and disaster recovery plan), as well as a plan for the review and 
testing of the ORF, each of which would need to meet certain specified 
minimum requirements.\315\ The proposed rule would further establish 
governance, training, and recordkeeping requirements related to the 
ORF, as well as require notification of certain ORF-related events to 
the Commission and customers or counterparties.\316\ The main purpose 
of the proposed ORF, as discussed above, is to promote sound practices 
for managing risks relating to information and technology security, 
third-party relationships, and emergencies or other significant 
disruptions, so as to support covered entity operational resilience, to 
the benefit of customers, counterparties, and the derivatives markets 
more broadly.
---------------------------------------------------------------------------

    \314\ See paragraph (b)(1) of proposed Commission regulations 
1.13 and 23.603.
    \315\ See paragraphs (b)(2) (components), (d) (information and 
technology security program), (e) (third-party relationship 
program), (f) (business continuity and disaster recovery plan), and 
(h) (reviews and testing) of proposed Commission regulations 1.13 
and 23.603.
    \316\ See paragraphs (c) (governance), (g) (training), (i) 
(notifications to the Commission), (j) (notification of incidents to 
affected customers or counterparties), (k) (emergency contacts), and 
(l) (recordkeeping) of proposed Commission regulations 1.13 and 
23.603.
---------------------------------------------------------------------------

    The Commission identifies and considers the benefits and costs of 
the proposed amendments relative to the baseline of the current status 
quo. As discussed above, all of the proposed requirements would be new 
CFTC requirements for covered entities, with the exception of the BCDR 
plan requirement for swap entities, which the proposed rule would amend 
in certain respects.\317\ Nevertheless, the Commission preliminarily 
believes that many, if not all, covered entities currently registered 
with the Commission have likely adopted documents, policies, and 
practices consistent with the proposed ORF rule. Current NFA rules and 
interpretive notices, for instance, address the core risks at the 
center of the ORF--information and technology security, third-party 
risks, and BCDR planning--and establish related requirements that apply 
to covered entities, including a BCDR plan requirement for FCMs.\318\ 
Additionally, many covered entities are subject to prudential 
regulation, which includes requirements relating to information 
security and notifications of related incidents.\319\ Prudential 
regulators have also provided guidance relating to operational 
resilience and third-party relationships.\320\ Furthermore, based on 
its oversight activities, the Commission preliminarily believes that 
certain aspects of the proposed rule requirements are already employed 
by many covered entities as recommended best practices.
---------------------------------------------------------------------------

    \317\ See 17 CFR 23.603.
    \318\ See supra note 43; see also supra note 60 (noting that 
NFA's requirement to establish a business continuity and disaster 
recovery plan does not apply to swap entities).
    \319\ See Computer-Security Incident Notification Requirements 
for Banking Organizations and their Bank Service Providers, 86 FR 
66424 (Nov. 23, 2021); 12 CFR part 30, app. A (Interagency 
Guidelines Establishing Standards for Safety and Soundness); 12 CFR 
part 30, app. B (Interagency Guidelines Establishing Information 
Security Standards).
    \320\ See supra note 43. See also supra note 50. The Commission 
notes that the Prudential Operational Resilience Paper was ``written 
for use by the largest and most complex domestic firms,'' including 
financial institutions with average total consolidated assets 
greater than or equal to (a) $250 billion or (b) $100 billion and 
have $75 billion or more in average weighted short-term wholesale 
funding, average nonbank assets, or average off-balance-sheet 
exposure. See Prudential Operational Resilience Paper, supra note 
11, at 1.
---------------------------------------------------------------------------

    The Commission acknowledges that, no matter the degree to which a 
covered entity currently operates in a manner consistent with the 
requirements of the proposed rule, covered entities would all incur 
some level of costs in reviewing the proposed rule and comparing their 
existing practices and procedures against it to ensure they meet the 
minimum requirements and make any necessary updates. Nevertheless, the 
Commission preliminarily believes that the actual costs and benefits of 
the proposed rule as realized by most current covered entities may not 
be as significant as they would be for entities not already subject to 
NFA or prudential authority or that have not already adopted 
operational resilience practices in line with general standards and 
best practices. The Commission also preliminarily believes that 
leveraging existing standards and guidance and aligning with other 
applicable authorities to the degree sensible and appropriate, as 
recommended by the National Cyber Strategy, in itself is a benefit to 
covered entities and the markets more broadly, by reducing compliance 
burdens while promoting practices that have proven to support 
operational resilience and positive regulatory outcomes. Customers, 
counterparties, and the public more generally would likely benefit as 
well, as the proposed rule would allow the Commission to exercise its 
oversight authority to foster compliance with the ORF requirements that 
are currently absent from its regulations.
    By its terms, section 15(a) does not specifically require the 
Commission to quantify the costs and benefits of a new rule or to 
determine whether the benefits of the adopted rule outweigh its costs. 
Rather, section 15(a) requires the Commission to ``consider the costs 
and benefits'' of a subject rule.\321\ The Commission has endeavored to 
assess the expected costs and benefits of the proposed amendments in 
quantitative terms, including PRA related costs, where possible. In 
situations where the Commission is unable to quantify the costs and 
benefits, the Commission identifies and considers the costs and 
benefits of the applicable proposed amendments in qualitative terms. 
However, the Commission lacks the data necessary to reasonably quantify 
all of the costs and benefits considered below. Additionally, any 
initial and recurring compliance costs for any particular covered 
entity would depend on its size, existing infrastructure, practices, 
and cost structures, as well as the nature, size, scope, complexity, 
and risk profile of its operations as a covered entity. It is 
impossible to place a reliable dollar figure on potential future 
incidents that might be prevented through this rulemaking because the 
threats are too varied. The constantly changing nature of technology 
exacerbates this difficulty.\322\
---------------------------------------------------------------------------

    \321\ See 7 U.S.C. 19(a).
    \322\ FSI Cybersecurity Paper, supra note 15, at 1 (``The cyber 
threat landscape is also characterised by a significant and 
continuous rise in the cost of cyber incidents. Statista (2023) 
estimated the global cost of cyber crime in 2022 at $8.4 trillion 
and expects this to go beyond $11 trillion in 2023. This reflects an 
annual increase of 30% in the cost of cyber crime during the 2021-23 
period. Moreover, the average cost of a data breach between 2020 and 
2022 increased by 13%, with the financial industry scoring the 
second highest average cost after healthcare at $6 million. 
According to Chainalysis (202[3]), 2022 was the biggest year ever 
for crypto hacking, with $3.8 billion stolen from cryptocurrency 
businesses. Cyber insurance demand continues to outweigh supply and 
that the cyber protection gap appears to be widening amid a market 
characterised by rising premiums, narrowing coverage and tighter 
underwriting standards.'').

---------------------------------------------------------------------------

[[Page 4740]]

    Regarding covered entities' costs, while the Commission generally 
believes--based on anecdotal information and its general 
understanding--that covered entities have already instituted, to a 
large degree, the practices called for in the proposed rule, the 
Commission lacks empirical evidence or data to verify that belief 
(including the number of covered entities whose practices currently 
meet the requirements being proposed) and quantify what, if any, 
material costs covered entities would incur to comply with the proposed 
regulations. To the extent covered entities would need to make 
operational changes to comply with the proposed amendments, the 
Commission expects they would be proportionate to the nature, size, 
scope, complexity, and risk profile of their operations as covered 
entities. The Commission therefore invites comments providing data and 
other empirical information to allow it to quantify the degree to 
which: (1) covered entities currently have implemented (or independent 
of the proposed amendments, otherwise plan to implement) practices that 
are compliant with the Commission's proposed regulations and (2) the 
expected additional costs for any covered entities that, to date, have 
not completely done so or are otherwise moving independently towards 
doing so.
    The Commission notes that this cost-benefit consideration is based 
on its understanding that the derivatives markets regulated by the 
Commission function internationally with: (1) transactions that involve 
U.S. entities occurring across different international jurisdictions; 
(2) some entities organized outside of the United States that are 
registered with the Commission; and (3) some entities that typically 
operate both within and outside the United States and that follow 
substantially similar business practices wherever they are located. 
Where the Commission does not specifically refer to matters of 
location, the discussion of costs and benefits below refers to the 
effects of the proposed regulations on all relevant derivatives 
activity, whether based on their actual occurrence in the United 
States, or on their connection with, or effect on, U.S. commerce.
    In the sections that follow, the Commission discusses the costs and 
benefits associated with the proposed rule, as well as reasonable 
alternatives, relative to the baseline. The Commission generally 
requests comment on all aspects of its cost-benefit consideration, 
including the baseline; assumptions and methodology employed; the 
identification and measurement of costs and benefits relative to the 
baseline; the identification, measurement, and assessment of any costs 
and benefits not discussed herein; data and any other information to 
assist or otherwise inform the Commission's ability to better quantify 
or qualitatively understand and describe the costs and benefits of the 
proposed amendments; whether and what specific alternatives would be 
more reasonable in terms of their costs and benefits and why; and 
substantiating data, statistics, and any other information to support 
positions posited by commenters with respect to the Commission's 
discussion and/or requests for comments.
1. Costs and Benefits
    The following sections discuss the costs and benefits that the 
Commission preliminarily expects to result from the requirements in the 
proposed rule.
e. Generally--Proposed Paragraph (b)
    The proposed rule would require covered entities to establish, 
document, implement, and maintain an ORF reasonably designed to 
identify, monitor, manage, and assess risks relating to: (i) 
information and technology security; (ii) third-party relationships; 
and (iii) emergencies or other significant disruptions to the 
continuity of normal business operations as covered entities.\323\ The 
ORF would need to, at a minimum, include an information and technology 
security program, a third-party relationship program, and a business 
continuity and disaster recovery plan, and each component program or 
plan would need to be supported by written policies and 
procedures.\324\ Covered entities would further need to ensure that 
their ORF is appropriate and proportionate to the nature, size, scope, 
complexity, and risk profile of their business activities as covered 
entities, following generally accepted standards and best 
practices.\325\
---------------------------------------------------------------------------

    \323\ See paragraph (b)(1) of proposed Commission regulations 
1.13 and 23.603.
    \324\ See paragraph (b)(2) of proposed Commission regulations 
1.13 and 23.603.
    \325\ See paragraph (b)(3) of proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

    The Commission anticipates that the main source of costs associated 
with establishing, documenting, implementing, and maintaining the ORF, 
as required, would derive from creating and implementing the necessary 
core component programs and plan, the detailed requirements and costs 
and benefits of which are discussed in greater detail in the sections 
that follow. As discussed above, although the Commission expects that 
most covered entities have already established at least some of 
elements of the ORF in place by virtue of NFA or other requirements, 
covered entities would, at minimum, need to devote time and resources 
to reviewing their existing programs to ensure they meet the 
requirements of the proposed rule and making any necessary amendments. 
Accordingly, the Commission anticipates all covered entities would 
incur at least a one-time fixed cost associated with reviewing their 
existing programs to ensure compliance, and to identify and make any 
potential required updates. Specifically, the Commission expects 
covered entities would incur a one-time initial cost of $41,000 (410 
hours \326\ x $100/hour) to review their existing programs and identify 
and make any necessary changes, or an estimated aggregate dollar cost 
of $6,560,000 (160 covered entities x $41,000).\327\
---------------------------------------------------------------------------

    \326\ This hour estimate reflects the aggregate amount of time 
the Commission estimates covered entities will expend establishing, 
documenting, implementing and maintaining the core component 
programs and plan of their ORF (i.e., information and technology 
security program, third-party relationship program, and business 
continuity and disaster recovery plan). See section III.B (Paperwork 
Reduction Act) of this notice, supra.
    \327\ The cost estimates in this section were determined using 
an average salary of $100.00 per hour. The Commission believes that 
this is an appropriate salary estimate for purposes of the proposed 
rule based upon the May 2022 Bureau of Labor Statistics' average 
hourly rate for the following positions: (1) $63.08 for management 
occupations; (2) $41.39 for business and financial operations 
occupations; (3) $51.99 for computer and mathematical occupations; 
(4) $67.71 for computer engineering occupations; (5) $59.87 for 
legal occupations; and (6) $21.90 for office and administrative 
support occupations. Based on this data, the Commission took the 
mean hourly wage for these positions and increased it to $100 in 
recognition that some covered entities are large financial 
institutions whose employees' salaries may exceed the mean wage. See 
U.S. Bureau of Labor Statistics, May 2022 National Occupational 
Employment and Wage Estimates (last updated Apr. 25, 2023), 
available at https://www.bls.gov/oes/current/oes_nat.htm#43-0000.
---------------------------------------------------------------------------

    To the extent that covered entities' current operational resilience 
practices do not meet the minimum requirements

[[Page 4741]]

of the proposed rule, they may incur more and other forms of costs in 
updating the programs. Such costs could include fixed costs associated 
with securing new technology or other services (e.g., upgrading 
technology, incorporating penetration testing), or even adding new 
staffing to support new required functions, as well as new ongoing 
costs related to monitoring and training. By requiring that the ORF, 
and consequently the associated programs and plan, are appropriate and 
proportionate to the covered entity, the Commission expects that the 
extent of those costs should be reasonably mitigated, such that covered 
entities should be able to tailor their ORFs to their unique 
circumstances and not incur costs to adopt practices or technologies 
that would not be recommended or necessary for them.
    Additionally, to the extent costs in updating programs are 
unavoidable, the Commission believes the proposed ORF rule is 
reasonably designed to ensure that the costs would support covered 
entities' operational resilience, and the broader security of the 
derivatives markets as a whole, as discussed in greater detail below. 
More specifically, the Commission believes the proposed ORF rule is 
reasonably designed to ensure customer and counterparty information and 
assets remain protected, and that the derivatives markets remain stable 
and functioning, particularly as covered entities become ever more 
reliant on rapidly evolving technology and/or third-party service 
providers to support their operations. Requiring all covered entities 
to have a framework directed at operational resilience that meets 
certain minimum requirements, including governance, training, and 
testing requirements, would give the CFTC, customers, counterparties, 
and covered entities themselves confidence that there exists among all 
covered entities a certain foundational level of security and 
resilience. Requiring covered entities to base their ORFs on generally 
accepted standards and best practices further buttresses that assurance 
by making sure adopted practices are grounded in standards that are 
commonly known and accepted, widely recognized as effective, and 
require adaptation as risk profiles change. Relying on existing known 
standards should also help mitigate implementation costs compared to 
complying with specific and detailed requirements created by the 
Commission and applied more uniformly. Furthermore, as the Commission 
engages in oversight of ORFs, it would expect to be able to identify 
additional recommended best practices unique to covered entities that 
it could share through guidance or future rulemakings, which would 
operate to further support the stability of the derivatives markets.
f. Governance--Proposed Paragraph (c)
    The proposed rule would require that each of the three required 
component programs and plan (the information and technology security 
program, the third-party relationship program, and the business 
continuity and disaster recovery plan) be approved in writing, on at 
least an annual basis, by either the senior officer, an oversight body, 
or a senior-level official of the covered entity.\328\ Covered entities 
would likely experience some costs associated with selecting the 
responsible official or body to provide the approval and associated 
costs to obtain their approval, including the time and resources needed 
to develop any explanatory materials, making amendments in light of any 
comments from leadership, and ministerial costs associated with 
obtaining signatures. More specifically, the Commission estimates that 
covered entities would incur an initial cost of $4,000 (40 hours x 
$100/hour) to select the responsible official or body to approve the 
component programs and plan of the ORF,\329\ or an estimated aggregate 
dollar cost of $640,000 (160 covered entities x $4,000). Additionally, 
the Commission estimates that covered entities will incur an ongoing 
annual cost of $1,000 for the approval of the component programs or 
plan of the ORF (10 hours x $100/hour),\330\ or an estimated aggregate 
dollar cost of $160,000 (160 covered entities x $1,000).
---------------------------------------------------------------------------

    \328\ See paragraph (c)(1) of proposed Commission regulations 
1.13 and 23.603.
    \329\ Covered entities may also incur subsequent costs in the 
event there is a change in official or body responsible for the 
approval of the ORF component programs or plan.
    \330\ As discussed supra in section III.B (Paperwork Reduction 
Act) of this notice, the Commission expects covered entities will 
expend a total of 20 burden hours to approve the component programs 
and plan of the ORF, risk appetite, and risk tolerance limits, or to 
prepare a written attestation.
---------------------------------------------------------------------------

    However, the Commission anticipates that providing a covered entity 
broad discretion to select whomever it deems appropriate to provide the 
approval would serve to mitigate some of those costs by allowing the 
covered entity to embed the approval process within its existing 
operational structures. The Commission further believes that requiring 
regular and formal approval of the ORF component programs and plan by 
senior leadership would help ensure that the ORF is in line with 
operational strategy and risk capacity, improving the chances that the 
covered entity would be adequately prepared for, and able to withstand 
and recover from operational shocks, that could otherwise significantly 
harm customers, counterparties, or even have spillover effects into the 
derivatives market as a whole.
    The proposed rule would further require covered entities to 
establish risk appetite and risk tolerance limits with respect to the 
risk areas underlying the ORF (information and technology security, 
third-party relationships, and emergencies or other significant 
disruptions to the continuity of normal business operations).\331\ The 
Commission believes that establishing and operating within established 
risk appetite and risk tolerance limits would help ensure that covered 
entities do not engage in activities that would present risks beyond 
those they can comfortably manage, helping to mitigate the potential 
for covered entities to take on risk that could lead to intolerable 
harm to customers or disruption to the financial system at large.
---------------------------------------------------------------------------

    \331\ See paragraph (c)(2)(i) of proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

    Covered entities that do not currently have a practice of creating 
a risk appetite statement and establishing and monitoring metrics for 
risk tolerance limits would likely incur costs associated with 
establishing a methodology to identify them, which would involve time 
and staffing resources, or perhaps even the use of consultants, but the 
Commission anticipates such costs should be reduced year over year as 
such covered entities gain experience and streamline processes. 
Nevertheless, the Commission understands that establishing risk 
appetite and tolerance limits is common practice in the financial 
industry, and is included as a recommended part of governance in the 
NIST financial sector profile.\332\ To the extent that covered entities 
already follow this practice, such covered entities would incur general 
costs associated with reviewing their risk appetite and risk tolerance 
limits against the rule requirements to ensure they cover the full 
scope of the rule, but they would avoid the heavier resource burdens of 
developing risk appetite and risk tolerance limits from whole cloth.
---------------------------------------------------------------------------

    \332\ See CRI Profile Workbook, supra note 81, at 16 (``An 
appropriate governing authority . . . endorses and periodically 
reviews the cyber risk appetite and is regularly informed about the 
status of and material changes in the organization's inherent cyber 
risk profile).
---------------------------------------------------------------------------

    The risk appetite and risk tolerance limits would further need to 
be

[[Page 4742]]

reviewed and approved in writing on at least an annual basis by the 
oversight body, senior officer, or other senior-level official with 
primary responsibility for the relevant risk area.\333\ Similar to the 
broad approval of the ORF component programs and plan in general, 
covered entities would likely incur some costs preparing information 
for approval, making amendments in response to comments, and obtaining 
signatures. Specifically, the Commission estimates covered entities 
would incur an ongoing annual cost of $1,000 for the approval of risk 
appetite and risk tolerance limits (10 hours x $1,000),\334\ or an 
estimated aggregate dollar cost of $160,000 (160 covered entities x 
$1,000). The Commission believes that the process of securing formal 
approval would encourage covered entities to think critically about the 
risk appetite and risk tolerance limits they establish and to justify 
them in light of operational strategy. This exercise should bring more 
awareness to activities that create operational risk and lead to better 
outcomes from an operational resilience standpoint, with attendant 
benefits to customers, counterparties, and the market more broadly.
---------------------------------------------------------------------------

    \333\ See paragraph (c)(2)(ii) of proposed Commission 
regulations 1.13 and 23.603.
    \334\ As discussed in section III.B (Paperwork Reduction Act) of 
this notice, the Commission expects covered entities will expend a 
total of 20 burden hours annually to document approval of the 
component plans of the ORF, risk appetite, and risk tolerance 
limits, or to prepare a written attestation.
---------------------------------------------------------------------------

    Relatedly, the proposed rule would require covered entities to 
notify selected senior leadership of circumstances that exceed risk 
tolerance limits and incidents requiring notification to either the 
Commission or customers and counterparties.\335\ The Commission 
understands that such an internal escalation requirement would require 
covered entities to incur some costs in developing policies and 
procedures that reflect this requirement, or reviewing existing 
escalation protocols to ensure they meet the terms of the rule, but the 
Commission believes the requirement is sufficiently flexible to allow 
covered entities to rely on existing operational structures and 
reporting lines, and does not anticipate that any organizational 
changes, or attendant costs, would be necessary. Additionally, the 
Commission views the involvement and awareness of senior leadership in 
cases where risk tolerance limits are exceeded, or where significant 
incidents have occurred that clearly threaten operational resilience, 
as critical to ensuring recovery efforts are coordinated and thus more 
likely to be successful.
---------------------------------------------------------------------------

    \335\ See paragraphs (c)(3)(i)-(ii) of proposed Commission 
regulations 1.13 and 23.603.
---------------------------------------------------------------------------

    The proposed rule would allow covered entities that form a part of 
a larger enterprise to satisfy the requirements of the proposed rule 
through their participation in a consolidated program or plan that 
meets the requirements of the proposed rule.\336\ Additionally, a 
covered entity relying on a consolidated program or plan would be able 
to satisfy the requirements for senior leadership to approve both the 
component program or plan and risk appetite and risk tolerance limits 
by having senior leadership attest on an annual basis that the 
consolidated program or plan meet the requirements of the proposed ORF 
rule, and reflects risk appetite and risk tolerance limits appropriate 
to the covered entity.\337\ The Commission estimates that covered 
entities would incur an ongoing annual cost of $2,000 (20 hours x $100/
hour) to prepare an written attestation,\338\ or an estimated aggregate 
dollar cost of $320,000 (160 covered entities x $2,000). The Commission 
believes allowing covered entities to rely on a consolidated program or 
plan would mitigate costs for such entities, specifically by benefiting 
from economies of scale present in relying on shared corporate 
infrastructure and a larger parent company's resources to manage 
operational risk at a broader enterprise level, and through using 
existing practices that meet the requirements of the proposed rule.
---------------------------------------------------------------------------

    \336\ See paragraph (c)(4)(i) of proposed Commission regulations 
1.13 and 23.603.
    \337\ See paragraph (c)(4)(ii) of proposed Commission 
regulations 1.13 and 23.603.
    \338\ As discussed supra in section III.B (Paperwork Reduction 
Act) of this notice, the Commission expects covered entities will 
expend a total of 20 burden hours annually to document approval of 
the component programs or plans of the ORF, risk appetite, and risk 
tolerance limits, or to prepare a written attestation.
---------------------------------------------------------------------------

    Nevertheless, the Commission expects that such covered entities 
would incur at least some costs associated with reviewing the 
consolidated program or plan to ensure it meets the requirements of the 
proposed rule and reflect risk appetite and risk tolerance limits 
appropriate to the covered entities. Such covered entities may face 
challenges in ensuring that their consolidated programs or plans, which 
may be written with the parent corporate entity as the primary focus, 
appropriately address the risks as they relate more specifically to the 
business and operations of the covered entity, which may be a 
relatively small line of business for the parent. Accordingly, a 
covered entity may incur some costs, in terms of time and staffing 
resources, associated with amending any consolidated program or plan to 
ensure it reflects the proposed rule's requirements and risk appetite 
and risk tolerance limits appropriate to the covered entity. The 
Commission cannot accurately quantify such costs, as these costs could 
range from minimal to more substantial depending on the complexity of 
the organization and how closely the current consolidated program or 
plan meets the requirements of the proposed rule, including how 
particularized they are with respect to identifying and managing the 
risks specific to the covered entity. The Commission believes that such 
requirements are important to ensuring that all covered entities, 
regardless of their operational structure, have a baseline level of 
operational risk management that is tailored to the entity itself, 
helping reduce risk to the overall financial system and the commodity 
derivatives markets in particular. The Commission also preliminarily 
believes that the overall costs of the proposed rule are reduced, 
without any loss of benefit, by allowing covered entities to rely on 
consolidated programs or plans over requiring them to duplicate 
existing larger corporate entity efforts to produce programs or plans 
that are independent and unique to the covered entity.
g. Information and Technology Security Program--Proposed Paragraph (d)
    The proposed rule would require covered entities to have an 
information and technology security program, defined as a written 
program reasonably designed to identify, monitor, manage, and assess 
risks relating to information and technology security and that meets 
certain requirements.\339\ Specifically, the information and technology 
security program would need to include (1) a risk assessment, conducted 
at least annually; (2) effective controls; and (3) an incident response 
plan.\340\ The proposed risk assessment requirement would require 
covered entities to identify and devote resources to planning and 
performing the risk assessment and then analyzing its results. These 
resources would need to include reliance on personnel not responsible 
for the development or implementation of covered technology or related 
controls, which could impose additional staffing needs on some

[[Page 4743]]

covered entities.\341\ The amount of time and resources expended would 
likely vary depending on the size, complexity, and risk profile of the 
covered entity and its degree of reliance on covered technology. The 
Commission believes that larger covered entities with more complex 
business operations and broader risk profiles would likely need to 
devote more permanent and extensive resources, staffing and otherwise, 
to performing and analyzing their risk assessments. Presenting the 
results of the assessment to selected senior leadership would also 
require the devotion of time and staffing resources to prepare for and 
respond to leadership feedback.
---------------------------------------------------------------------------

    \339\ See paragraphs (a) (defining ``information and technology 
security program'') and (b)(2) (components) of proposed Commission 
regulations 1.13 and 23.603.
    \340\ See paragraph (d) of proposed Commission regulations 1.13 
and 23.603.
    \341\ See paragraph (d)(1)(ii) of proposed Commission 
regulations 1.13 and 23.603.
---------------------------------------------------------------------------

    In establishing effective controls, covered entities would be 
required to consider a broad range of categories of controls, determine 
which to implement in line with identified risks, implement them, and 
then review and revise the controls as needed over time in response to 
continued risk assessments. Depending on the types of controls they 
would need to implement, covered entities may take on additional costs 
to acquire new security technology and/or hire additional staff or 
third-party service providers to oversee and implement the controls. 
Again, the Commission would expect any outlays to be appropriate and 
proportionate to the covered entity and its risk profile, so the exact 
costs would vary by covered entity. Nevertheless, given that the 
approach of the proposed rule, and list of required categories, closely 
aligns with the longstanding approach adopted by prudential regulators 
with respect to information and technology security controls, the 
Commission believes that costs for at least prudentially regulated 
covered entities may be reduced compared to other covered entities that 
have not been required to apply and consider such categories of 
controls.\342\
---------------------------------------------------------------------------

    \342\ See supra note 130 and accompanying text.
---------------------------------------------------------------------------

    Development of an incident response plan would likely require a 
noticeable devotion of resources at the outset, as staff would need to 
dedicate time and effort to forming and documenting the plan, including 
creating policies and procedures for identifying the types of incidents 
that need to be reported and to whom. Should an incident occur, the 
plan would require staff at the covered entity to devote time to 
documenting and responding to the incident, as well as identifying and 
taking on remediation efforts.
    Nevertheless, the Commission expects that, given the NFA's ISSP 
Notice, covered entities would likely not need to expend resources to 
develop an information and technology security program from scratch. 
Notably, NFA requires its members to adopt and enforce a written ISSP, 
assess and prioritize the risks associated with its use of information 
technology systems, document and describe in their ISSPs safeguards 
deployed in light of identified and prioritized threats and 
vulnerabilities, and create an incident response plan.\343\ 
Accordingly, some of the compliance burdens associated with 
implementing an information and technology security program should be 
reduced. Covered entities overseen by prudential regulators are also 
required to consider similar categories of controls to those in the 
proposed rule, so compliance costs as realized by prudentially 
regulated covered entities may be even further reduced.\344\ Notably, 
however, NFA does not mandate that a risk assessment be conducted at 
least annually by personnel not responsible for the development or 
implementation of covered technology or related controls. Although the 
Commission believes these requirements to be consistent with generally 
accepted standards and best practices, such that covered entities may 
be following them anyway, some covered entities may nevertheless 
experience some additional costs associated with ensuring or otherwise 
acquiring staff sufficiently independent to conduct the risk assessment 
and in potentially conducting the risk assessment more frequently than 
they currently do. The Commission also recognizes that, if adopted, the 
proposed rule would at minimum require covered entities to expend 
resources to review the ISSPs they established pursuant to NFA rules to 
ensure they meet the requirements of the information and technology 
security program.
---------------------------------------------------------------------------

    \343\ See NFA ISSP Notice, supra note 43.
    \344\ See 12 CFR part 30, app. B.
---------------------------------------------------------------------------

    Notwithstanding the potential operational and staffing costs to 
covered entities associated with the proposed rule, the Commission 
believes the benefits of the requirements of the proposed information 
and technology security program are well established. Risk assessments 
are crucial to identifying threats and vulnerabilities, which is key to 
directing resources to mitigate those risks in a way that increases the 
effectiveness of security efforts. The Commission likewise believes the 
benefits of an independent risk assessment (a more unbiased and 
reliable assessment) and conducting it at least annually (ensuring the 
information and technology security program is up-to-date and 
responsive in light of current threat landscape and vulnerabilities at 
the covered entity) are important to supporting covered entity 
operational resilience. Likewise, controls are the methods or 
techniques for monitoring and managing those risks and safeguarding 
information, operations, and assets. Without them, the potential for a 
system weakness to be exploited, and for customers and counterparties, 
covered entities, or the market at large to be harmed is increased, as 
the interconnected nature of the commodity derivatives markets enhances 
the possibility for spillover effects. Incident response plans operate 
to reduce the potential magnitude of the harm should a safeguard fail 
by creating a concrete plan, known in advance, for how the covered 
entity should respond, thereby shortening response times following an 
incident. Accordingly, the Commission believes the proposed minimum 
requirements of the information and technology security program, in 
combination with the Commission's oversight, would further support the 
development of a foundational level of operational risk management 
practices with respect to information and technology security that 
would benefit customers, counterparties, and the market at large.
h. Third-Party Relationship Program--Proposed Paragraph (e)
    The proposed rule would require covered entities to have a third-
party relationship program, defined as a written program reasonably 
designed to identify, monitor, manage, and assess risks relating to 
third-party relationships.\345\ The program would need to describe how 
covered entities address the risks attendant to each of the five 
identified stages of the third-party relationship lifestyle, ranging 
from pre-selection to termination, with heightened due diligence and 
monitoring required for critical third-party service providers.\346\ 
The proposed rule would further require covered entities to create, 
maintain, and regularly update an inventory of third-party service 
providers engaged to support their activities as covered entities, 
identifying whether each is a critical third-party service 
provider.\347\
---------------------------------------------------------------------------

    \345\ See paragraphs (a) (defining ``third-party relationship 
program'') and (e) (third-party relationship program) of proposed 
Commission regulations 1.13 and 23.603.
    \346\ See paragraphs (e)(1)(i)-(v) and (e)(2) of proposed 
Commission regulations 1.13 and 23.603.
    \347\ See paragraph (e)(3) of proposed Commission regulations 
1.13 and 23.603.

---------------------------------------------------------------------------

[[Page 4744]]

    As with the information and technology security program, complying 
with this aspect of the proposed rule would require covered entities to 
expend staff resources at the outset to develop the program and put it 
into writing. Although NFA requires its members, including covered 
entities, to have a written supervisory framework for its third-party 
service providers, which could help mitigate these costs, NFA's written 
supervisory framework only extends to outsourcing functions, i.e., 
regulatory functions that would otherwise be undertaken by the NFA 
member itself to comply with NFA and CFTC requirements.\348\ 
Accordingly, covered entities would likely experience at least some 
staffing burdens expanding their NFA frameworks to fit the broader 
scope of third-party relationships covered by the proposed rule and 
implementing it across their third-party service providers more 
broadly. However, applying the proposed (b)(3) standard, covered 
entities should be able to align their third-party risk management 
practices to the risks presented by each individual third-party service 
provider, which would allow covered entities to tailor and fit the 
costs of their third-party practices to their unique circumstances. 
Covered entities following prudential rules and guidance with respect 
to third-party service providers, which applies to all third-party 
relationships, would likely experience reduced costs compared to other 
covered entities with respect to any need to modify their existing 
programs.\349\ Additionally, the proposed rule would not require 
covered entities to perform due diligence or renegotiate contracts with 
existing third-party service providers, which would avoid a potentially 
substantial initial fixed cost from implementing the third-party 
relationship program.
---------------------------------------------------------------------------

    \348\ See NFA Third-Party Notice, supra note 43.
    \349\ See 12 CFR part 30, app. B, III.D. (Oversee Service 
Provider Arrangements); Prudential Third-Party Guidance, supra note 
43.
---------------------------------------------------------------------------

    Creating an initial inventory of third-party service providers, and 
assessing whether they meet the definition of ``critical third-party 
service provider'' would also require a temporary redirection of staff 
resources, with the amount of time and resources required varying 
depending on the extent and complexity of a given covered entity's 
reliance on third-party service providers. With respect to critical 
third-party service providers, the Commission preliminarily believes 
that many, if not all, covered entities currently have in place a 
process to identify and categorize covered entities as ``critical'' or 
otherwise requiring enhanced supervisory activities. Additionally, NFA 
requires its members to have heightened due diligence for third-party 
service providers that obtain or have access to critical and/or 
confidential data and those that support critical regulatory-related 
systems, which could potentially reduce burdens on covered entities in 
designing and implementing heightened due diligence and monitoring with 
respect to critical third-party service providers.\350\ Although the 
Commission preliminarily believes that its proposed definition of 
``critical third-party service provider'' should identify many, if not 
all, of the same providers covered entities would themselves identify 
as ``critical,'' the Commission recognizes that the process of applying 
the proposed definition to an existing process would, at minimum, 
require some initial expenditure of staff resources to ensure existing 
practices and taxonomies align with the proposed rule.\351\ 
Additionally, the process of creating an inventory of third-party 
service providers, which is not currently required by NFA or prudential 
regulators, could be particularly burdensome, especially for covered 
entities with a large number of complex third-party relationships, or 
that rely on an affiliate to secure and coordinate third-party service 
providers as part of a larger enterprise-wide function, potentially 
involving staff from many different departments or the review of 
multiple contracts or contract databases.
---------------------------------------------------------------------------

    \350\ See NFA Third-Party Notice, supra note 43.
    \351\ See paragraph (a) of proposed Commission regulations 1.13 
and 23.603 (defining ``critical third-party service provider'').
---------------------------------------------------------------------------

    Nevertheless, the Commission believes that requiring covered 
entities to have a program to identify, monitor, manage, and assess 
risks relating to third-party relationships, and inventory their third-
party service providers, would have meaningful benefits at the 
individual covered entity-level, as well as for customers and 
counterparties and the derivatives markets at large. Given their roles 
and interconnectedness in the derivatives markets, an operational shock 
at one covered entity can have ripple effects across the markets. 
Requiring covered entities to develop and maintain a program to help 
evaluate and address the risk at each stage of the third-party 
relationship--from before selecting a third-party service provider to 
how such a relationship would be supervised and terminated--may not 
only help covered entities be more fully aware of and manage the risks 
of their third-party relationships, it could also help increase overall 
confidence levels in the derivatives markets by ensuring customers and 
counterparties that there is a foundational level of third-party risk 
management practices across covered entities.
    Additionally, the proposed rule could operate to raise minimum 
standards with regards to how third-party risks are managed, by 
introducing enhanced due diligence or monitoring practices for critical 
third-party service providers, for instance, which could lead to real 
and measurable reduction in risk to the financial system. The act of 
creating an inventory of third-party service providers would also help 
increase the likelihood of identifying interdependencies or 
overdependencies, which could cause covered entities to reevaluate 
particular relationships (i.e., diversify third-party service providers 
to reduce concentration risk) or take on additional activities (e.g., 
insurance) to help mitigate those risks, thereby promoting operational 
resilience. Identifying critical third-party service providers should 
also help enhance operational awareness of those entities and ensure 
they receive the required heightened monitoring to ensure that the risk 
of disruption to critical services, which could have a broader impact 
on the markets or customers and counterparties, is mitigated.
i. Business Continuity and Disaster Recovery Plan--Proposed Paragraph 
(f)
    The proposed rule would require covered entities to have a BCDR 
plan, defined as a written plan outlining the procedures to be followed 
in the event of an emergency or other significant disruption to the 
continuity of normal business operations and that meets certain 
requirements.\352\ This would be a new CFTC requirement for FCMs, but 
current Commission regulation 23.603 imposes a BCDR plan requirement on 
swap entities that is substantially similar to the proposed rule, as 
the proposed rule was modeled after the current BCDR requirement for 
swap entities with certain modifications.\353\ Additionally, although 
the CFTC does not currently impose a BCDR plan requirement on FCMs, NFA 
and CME do, which the Commission believes should help FCMs mitigate the 
costs of establishing a BCDR plan for purposes of complying with the 
proposed rule, particularly since some of the amendments to the current 
BCDR plan requirement for swap entities have the effect of further 
aligning the regulatory

[[Page 4745]]

text with NFA and CME BCDR plan requirements.\354\
---------------------------------------------------------------------------

    \352\ See paragraphs (a) (defining ``business continuity and 
disaster recovery plan'') and (b)(2) (components) of proposed 
Commission regulation 1.13 and 23.603.
    \353\ See 17 CFR 23.603.
    \354\ See NFA Rule 3-38, supra note 43; CME Rule 983, supra note 
185.
---------------------------------------------------------------------------

    The proposed rule would require covered entities' BCDR plans to be 
reasonably designed to enable the covered entities to continue or 
resume any activities as a covered entity with minimal disruption to 
counterparties, customers, and the markets, and to recover and make use 
of covered information, as well as any other data, information, or 
documentation required to be maintained by law and regulation.\355\ The 
proposed rule would further require the BCDR plans to include certain 
minimum contents, including: identifying and backing up required 
information; identifying and developing backups for required resources, 
including technology, facilities, and staff; identifying potential 
disruptions to critical third-party service providers; identifying 
implicated personnel; and establishing a communication plan.\356\
---------------------------------------------------------------------------

    \355\ See paragraph (f)(1) of proposed Commission regulation 
1.13 and 23.603.
    \356\ See paragraph (f)(2) of proposed Commission regulation 
1.13 and 23.603.
---------------------------------------------------------------------------

    To design a BCDR plan that meets that standard, covered entities 
would need to expend resources to establish and preserve backup 
resources (staffing, technology, inputs) for use in the event of the 
BCDR plan's activation, and to create backups of the information the 
BCDR plan would cover. Depending on the size and complexity of a 
particular covered entity's business, those costs could be sizeable, as 
they may require negotiating and entering into new contracts with 
backup resource providers, or other third-party service providers. 
Covered entities would also need to expend resources to establish a 
plan to minimize the impact of disruptions and establish a 
communication plan, which would include identifying implicated persons 
and bodies and establishing potential contacts, methods, modes, and 
priorities of communication. Finally, the resources to document all of 
this work in the plan would likely be more than simply ministerial 
effort, as staff would likely have to spend time working through 
various deliberative points, at least at the outset in first developing 
the BCDR plan. The costs to maintaining the plan would likely be 
reduced compared to the initial fixed costs, however, as the plan put 
into action over time.
    Nevertheless, the Commission expects that most covered entities 
have already incurred at least some of these potential costs by virtue 
of either the existing CFTC BCDR plan requirements for swap entities, 
or the NFA and CME BCDR plan requirements applicable to FCMs. Notably, 
the ``essential elements'' of NFA's BCDR Notice aligns closely with the 
minimum requirements for the Commission's proposed BCDR plan 
requirement, requiring FCMs to establish backups in one more reasonably 
separate geographic areas, to backup or copy essential documents and 
data and store them off-site, to consider the impact of interruptions 
by third-parties and ways to minimize the impact, and to develop a 
communication plan.\357\ Accordingly, although the Commission expects 
FCMs would incur at least some costs reviewing their BCDR plans to 
ensure they meet the proposed CFTC requirements, the Commission 
preliminarily believes most FCMs would be able to avoid the more 
substantial initial costs of developing a BCDR plan from scratch.
---------------------------------------------------------------------------

    \357\ See NFA BCDR Notice, supra note 43.
---------------------------------------------------------------------------

    The Commission further believes that the expenditure of resources 
required to create the proposed plan would help give the derivatives 
markets and customers and/or counterparties confidence that covered 
entities' operations would be able to be quickly reestablished 
following an emergency or significant disruption, improving the overall 
resilience of the market and perhaps lowering customer/counterparty 
risk and its associated costs. Having a plan that centralizes key 
information related to an emergency--including identifying core 
information, personnel, systems, and resources needed to resume 
operations--should also help facilitate covered entities in achieving 
the recovery time objective of being back up and running with minimal 
disruption to counterparties, customers, and the derivatives markets, 
supporting market confidence and reducing overall systemic risk. 
Maintaining copies of the plan in accessible off-site locations should 
impose no more than ministerial costs and would help ensure that 
covered entities can access the plan in a crisis.
    The proposed rule would amend the current BCDR plan requirement for 
swap entities in a few ways, some of which the Commission expects would 
have cost-benefit implications.\358\ For instance, the proposed rule 
would require covered entities to ``recover and make use of all covered 
information, as well as any other data, information, or documentation 
required to be maintained by law and regulation,'' which expands the 
information BCDR plans would be required to cover beyond that required 
to be maintained by applicable law and regulation, and makes clear the 
information should not only be recovered but also accessible and still 
useable.\359\ Depending on current BCDR plan practices by swap 
entities, the proposal could potentially cause covered entities to 
expand the sources of information they need to backup and/or augment 
their backup systems to ensure the information stored there is useable. 
The proposed rule would also no longer require swap entities to ensure 
their BCDR plans are designed to enable swap entities to continue or 
resume operations ``by the next business day.'' \360\ Although the 
Commission does not believe that this change would have an impact on 
the actual recovery time of swap entities following an emergency or 
other significant disruption, given that both current Commission 
regulation 23.603 and the proposed rule require that the BCDR plan be 
designed to ensure recovery with minimal disruption to counterparties 
and the market, swap entities could need to dedicate at least some 
staff time to review their BCDR plans to ensure that they continue to 
meet the rule requirements.
---------------------------------------------------------------------------

    \358\ As with the other sections of this notice, portions of the 
BCDR plan requirement for swap entities in current Commission 
regulation 23.603 that have been expanded in the proposal to apply 
to the ORF more broadly, notably testing, are discussed in the 
context of the discussion of those specific requirements.
    \359\ See 17 CFR 23.603(a).
    \360\ Id.
---------------------------------------------------------------------------

j. Training and Distribution--Proposed Paragraph (g)
    The proposed rule would require covered entities to establish, 
implement, and maintain training with respect to the ORF, including 
general cybersecurity awareness training and role-specific training for 
personnel involved in the ORF.\361\ If the proposed rule is adopted, 
covered entities would need to expend resources to develop and/or 
evaluate and acquire externally sourced training. Those outlays would 
include the costs associated with establishing the training at the 
outset, as well as ongoing costs associated with updating and providing 
the training at least every year.\362\ There would also be 
administrative costs associated with distributing copies of the 
component programs or plan to relevant personnel and providing them 
with any significant revisions.\363\ Nevertheless, the

[[Page 4746]]

Commission believes that establishing, implementing, and maintaining a 
training program is crucial to realizing the benefits of the proposed 
ORF. Not only would it help ensure that employees of covered entities 
are kept aware of good cyber hygiene practices, which should reduce the 
potential for covered information to be compromised and customers and 
counterparties to be negatively impacted, training would help ensure 
that the ORF practices covered entities establish are accurately 
implemented and maintained by the personnel tasked with 
operationalizing the ORF. Although allowing covered entities to provide 
training less frequently than annually would reduce compliance costs 
for covered entities, the Commission believes that annual training is 
needed to preserve its benefits given the rapidly evolving pace of 
technology and the potential for human error to result in actual harm 
to operations or even customers or counterparties.\364\
---------------------------------------------------------------------------

    \361\ See paragraph (g)(1) of proposed Commission regulations 
1.13 and 23.603.
    \362\ See paragraph (g)(2) of proposed Commission regulations 
1.13 and 23.603
    \363\ See paragraph (g)(3) of proposed Commission regulations 
1.13 and 23.603.
    \364\ See supra note 18 and accompanying text.
---------------------------------------------------------------------------

k. Reviews and Testing--Proposed Paragraph (h)
    The proposed rule would require covered entities to establish, 
implement, and maintain a plan reasonably designed to assess adherence 
to, and the effectiveness of, their ORF through regular reviews and 
risk-based testing.\365\ At the outset, covered entities would need to 
dedicate staff resources to develop a review and testing plan for the 
ORF; ongoing staff resources would be needed to conduct reviews at 
least annually and risk-based testing at a frequency that is 
appropriate and proportionate to each covered entity's nature, size, 
scope, complexity, and risk profile, following generally accepted 
standards and best practices.\366\ Covered entities would further 
assume regular costs associated with documenting the reviews and 
testing (e.g., results of testing, assessment of effectiveness, 
recommendations for modifications/improvements/corrective actions) and 
reporting on them to the CCO and any other relevant senior-level 
official(s) and oversight body(ies).\367\ In general, the ongoing costs 
of the required testing and reviews are likely to vary by covered 
entity, with larger, more complicated covered entities likely expending 
significantly more resources to conduct testing consistent with the 
proposed (b)(3) standard.\368\
---------------------------------------------------------------------------

    \365\ See paragraph (h) of proposed Commission regulations 1.13 
and 23.603.
    \366\ See paragraph (b)(3) of proposed Commission regulations 
1.13 and 23.603.
    \367\ See paragraphs (h)(4) and (h)(5) of proposed Commission 
regulations 1.13 and 23.603.
    \368\ The Commission estimates, on average, that covered 
entities will incur an initial annual cost of $8,000 (80 hours x 
$100/hour) to establish a plan to assess adherence to, and the 
effectiveness of, its ORF, and to document all reviews and testing 
of the ORF, or an estimated aggregate dollar cost of $1,280,000 (160 
covered entities x $8,000).
---------------------------------------------------------------------------

    With respect to the reviews of the ORF, the proposed rule would 
require that they be conducted at least annually and in connection with 
any material change that is reasonably likely to affect the risks 
addressed by the ORF. The proposed rule would further require the 
reviews to include an analysis of adherence to, and the effectiveness 
of the ORF, as well as any recommendations for improvements.\369\ This 
standard is generally consistent with, and would replace, the current 
review standard in current Commission regulation 23.603 for swap entity 
BCDR plans, such that associated costs for reviewing the BCDR plan 
should not be affected by the proposal.\370\ NFA's ISSP Notice and BCDR 
Notice also require NFA members to review their ISSPs or BCDR pans on a 
regular or periodic basis.\371\ Accordingly, while covered entities may 
experience some staffing costs in assuring their reviews are at least 
annual, costs associated with establishing a review process more 
broadly should have already been realized by most covered entities.
---------------------------------------------------------------------------

    \369\ See paragraph (h)(1) of proposed Commission regulations 
1.13 and 23.603
    \370\ See 17 CFR 23.603(f) (``A member of the senior management 
of each swap dealer and major swap participant shall review the 
business continuity and disaster recovery plan annually or upon any 
material change to the business. Any deficiencies found or 
corrective action taken shall be documented.'')
    \371\ See NFA BCDR Notice, supra note 43; NFA ISSP Notice, supra 
note 43.
---------------------------------------------------------------------------

    For testing, the proposed rule would generally require that its 
frequency, nature, and scope would be determined consistent with the 
proposed (b)(3) standard.\372\ The Commission believes that such a 
risk-based standard would allow covered entities to tailor testing to 
their unique business and risk profile, focusing testing efforts on 
areas that would be the most impactful or revealing and avoiding 
unnecessary costs. Nevertheless, with respect to testing of the 
information and technology security program, the proposed rule would 
require covered entities to assume costs for some specific testing, 
including testing of key controls and the incident response plan, as 
well as daily or continuous vulnerability assessments and penetration 
testing at least annually.\373\ Although regular testing of key 
controls and the incident response plan is likely to require time and 
staff resources, the Commission believes that without testing, it would 
be impossible for covered entities to know whether the controls are 
functioning to mitigate risk as expected, and for the incident response 
plan to be actionable in times of emergency. Daily or continuous 
vulnerability assessments and penetration testing at least annually 
could require additional staff and technology outlays.\374\ The exact 
cost of testing as realized by each covered entity, however, is likely 
to vary depending on the scope and complexity of its operations, and 
the degree to which it has already incorporated vulnerability 
assessments and penetration testing as part of its ISSP.\375\
---------------------------------------------------------------------------

    \372\ See paragraph (h)(2) of proposed Commission regulations 
1.13 and 23.603.
    \373\ See paragraph (h)(2)(i) of proposed Commission regulations 
1.13 and 23.603.
    \374\ CISA makes available a free vulnerability scanner, see 
supra note 248.
    \375\ The NFA ISSP Notice provides that a member ``may include 
penetration testing of the firm's systems, the scope and timing of 
which is highly dependent upon the Member's size, business, 
technology, its electronic interconnectivity with other entities and 
the potential threats identified in its risk assessment.'' See NFA 
ISSP Notice, supra note 43.
---------------------------------------------------------------------------

    The Commission believes that vulnerability assessments and 
penetration testing are essential for covered entities to know what 
their vulnerabilities are and how they might be exploited, so they can 
take steps to mitigate associated risks, including by adapting internal 
controls, which are a key component of preserving operational 
resilience. Given the dynamic, ever changing nature of technology and 
cybersecurity, the Commission believes that continual and active action 
and engagement are necessary to ensure controls are operating as 
intended, and for covered entities to have an accurate assessment of 
the risks to their covered information and technology. By not mandating 
specific types of penetration testing, however, the Commission believes 
the proposed rule is adapted to allow the wide range of covered 
entities subject to the proposed rule to adopt types of testing that 
are recommended for and best fit their unique circumstances, so as to 
achieve the highest level of improved cybersecurity without incurring 
unnecessary costs. The Commission further believes such testing is 
essential cyber hygiene and their use among covered entities would help 
ensure a base level of monitoring in the derivatives markets that is 
readily accessible.

[[Page 4747]]

    With respect to testing of the BCDR plan, the proposed rule would 
require covered entities to dedicate time and staff resources to 
conduct a walk-through or tabletop exercise designed to test the 
effectiveness of backup facilities and capabilities at least annually, 
which could involve outreach to operators of backup facilities.\376\ 
Such a periodic effort would likely consume staff time and resources to 
put into place, including potentially in designing tabletop exercise 
scenarios. The Commission expects that this aspect of the proposed rule 
would not have any cost impact on swap entities, as current 23.603 
requires annual testing of their BCDR plan, and the Commission does not 
believe the clarification that the testing be a walk-through or 
tabletop exercise would have substantive effect.
---------------------------------------------------------------------------

    \376\ See paragraph (h)(2)(i) of proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

    Because the proposed rule would require the reviews and testing to 
be conducted by qualified personnel who are independent of the aspect 
of the ORF being reviewed or tested, the Commission anticipates this 
work would either be conducted by internal compliance audit staff, 
external independent auditors, or other internal staff, provided they 
were not involved in creating the ORF component being tested.\377\ 
Accordingly, this independence requirement could require covered 
entities to reassign duties or secure additional staffing resources, 
either of which would impose some additional costs.
---------------------------------------------------------------------------

    \377\ See proposed paragraph (h)(3) of proposed Commission 
regulations 1.13 and 23.603.
---------------------------------------------------------------------------

    Nevertheless, the Commission believes that annual reviews and 
testing are essential to ensuring that the ORF is operating as 
intended, and thus to ensuring the intended and expected benefits of 
the ORF with respect to protecting customers and mitigating systemic 
risk are actually realized. Without proper review and testing, 
determining whether the intended benefits of the ORF are being achieved 
would not be possible. Although eliminating the independence 
requirement could alleviate some potential staffing burdens on covered 
entities, the Commission believes that independence in reviews and 
testing is critical to preserving their benefits by helping to ensure 
that the results are reliable and unbiased. The Commission further 
believes that by allowing covered entities to adjust the frequency, 
nature, and scope of their risk-based testing of the ORF in a manner 
that is appropriate and proportionate to the circumstances, following 
generally accepted standards and best practices, the proposed rule 
would ensure that costs of the rule would be as well tailored to the 
covered entity as possible to realize benefits at the least cost.
    With respect to the BCDR plan requirement for swap entities in 
particular, the Commission believes the proposed rule could reduce 
review and testing costs. First, it would eliminate costs associated 
with securing an independent auditor to audit the plan every three 
years.\378\ Although there may be some benefits to having an 
independent audit of a BCDR plan, including having an external party 
with fresh eyes identify issues and potential improvements that might 
not be readily apparent to internal staff, the Commission preliminarily 
believes, based on its experience, that the internal reviews and 
testing of the BCDR plan are sufficient to achieve iterative 
improvements to the BCDR plan, making the costs associated with the 
independent audit unnecessary. Second, the proposed rule would 
eliminate the separate requirement that a member of senior management 
for a swap entity review the BCDR plan annually or upon any material 
change to the business and to document any deficiencies found or 
corrective action taken.\379\ While the proposed rule would retain the 
annual review requirement for the BCDR plan, not requiring the review 
to be undertaken by a member of senior management may result in at 
least some burden reduction for senior management.
---------------------------------------------------------------------------

    \378\ See 17 CFR 23.603(g).
    \379\ See 17 CFR 23.603(f).
---------------------------------------------------------------------------

l. Notification Provisions--Proposed Paragraphs (i) and (j)
    The proposed rule would require covered entities to provide certain 
notifications to either the Commission or affected customers or 
counterparties.\380\ Notifications to the Commission, made 
electronically via email, would relate either to the covered entity's 
determination to activate the BCDR plan, or an ``incident,'' as defined 
in the proposed rule, that adversely impacts, or is reasonably likely 
to adversely impact information and technology security, the covered 
entity's ability to operate, or the assets or positions of a customer 
or counterparty.\381\ In both cases, the notifications to the 
Commission would be intended to function as early warnings and thus 
would not need to be complete or detailed. Understanding that the 
information available to covered entities would be preliminary and 
incomplete at the time of the notification, the Commission would not 
expect covered entities to expend considerable resources to assemble 
notifications that are perfectly accurate and complete. Rather, the 
proposed rule would only require that the information provided to the 
Commission would be whatever the covered entity has available at the 
time that could assist the Commission in its oversight or response, 
with the understanding that resources should predominantly be directed 
at mitigating and recovering from the incident, emergency, or 
significant disruption.\382\ Prioritizing an early warning over 
complete information should not only reduce the costs for covered 
entities in delivering the notification, but also allow the Commission 
the best opportunity to take quick responsive action, if appropriate.
---------------------------------------------------------------------------

    \380\ See paragraphs (i) and (j) of proposed Commission 
regulations 1.13 and 23.603.
    \381\ See paragraph (i) of proposed Commission regulations 1.13 
and 23.603.
    \382\ See paragraphs (i)(1)(ii) and (i)(2)(ii) of proposed 
Commission regulations 1.13 and 23.603.
---------------------------------------------------------------------------

    Accordingly, while the Commission recognizes that there would be at 
least some information gathering and administrative costs associated 
with providing the notice, the Commission does not intend or expect the 
resource burden for providing the notification to be significant.\383\ 
This limited early-warning function for the notice requirement is 
further supported by the relatively brief 24-hour time period for 
providing the notices.\384\
---------------------------------------------------------------------------

    \383\ The Commission estimates that for each ``incident'' 
requiring notification, covered entities will incur a cost of $1,000 
(10 hours x $100/hour) to gather the information required and to 
provide notification to the Commission, or an estimated aggregate 
dollar cost of $160,000 (160 covered entities x $1,000).
    \384\ See paragraphs (i)(1)(iii) and (i)(2)(iii) of proposed 
Commission regulations 1.13 and 23.603.
---------------------------------------------------------------------------

    With respect to the BCDR plan in particular, the Commission does 
not believe covered entities would expend significant resources to 
notify the Commission, since the notification trigger (activation of 
the BCDR plan) is relatively bright-line. The Commission recognizes 
that with respect to the incident notification, however, covered 
entities may need to engage in some deliberation to determine whether 
an incident has or is reasonably likely to have an adverse impact, 
which would consume some staff resources. Preliminarily, the Commission 
estimates that covered entities activating their BCDR plan would incur 
a cost of $1000 (10 hours x $100/hour) to notify the Commission, or an 
estimated aggregate dollar cost of $160,000 (160 covered entities x 
$1,000). The Commission believes, however, that these costs may go down 
over time, as covered entities

[[Page 4748]]

gain familiarity in applying the notification provision. The Commission 
also preliminarily believes that an adverse impact standard would be 
potentially easier to apply than one that included a materiality 
limiter, which could introduce further need for interpretation and 
internal deliberation for covered entities to determine whether the 
impact is ``material'' or ``significant.'' Additionally, scoping 
notifications to incidents with a likely adverse impact and to BCDR 
activation would help focus the Commission's oversight activities and 
responsive efforts on cases where it could act to support the 
derivatives markets and customers and counterparties, potentially 
reducing the potential for ripple effects.
    In addition to notifications to the Commission, the proposed rule 
would require covered entities to notify affected customers or 
counterparties as soon as possible of any incident that is reasonably 
likely to have adversely affected the confidentiality or integrity of 
their covered information, assets, or positions.\385\ Because the rule 
does not contain a specific timing limit for providing this 
notification, the Commission does not expect that this notification 
requirement would cause covered entities to need to divert any 
resources while managing the incident to draft the notification. 
Rather, the Commission expects that most of the costs associated with 
this notification requirement would be in spending the necessary staff 
resources to gather and report facts as accurately as possible to aid 
affected customers and counterparties in understanding and assessing 
the potential impact of the incident on their information, assets, or 
positions and to take any necessary action.\386\ Covered entities may 
also need to dedicate staff resources to interacting with customers or 
counterparties after the notification is given to provide more 
information or answer questions. The Commission estimates that for each 
``incident'' requiring notification, covered entities will incur a cost 
of $5,000 (50 hours x $100/hour) to gather the required information 
necessary to provide notice to customers or counterparties and to 
prepare and deliver the required notification, or an estimated 
aggregate dollar cost of $800,000 (160 covered entities x $5,000). The 
Commission believes that this notification could produce substantial 
benefits to customers and counterparties, especially where state or 
other federal law does not otherwise require such notifications, as 
they would give customers and counterparties the information they would 
need to further protect their information and assets and allow them to 
seek other avenues of redress.
---------------------------------------------------------------------------

    \385\ See paragraph (j)(1) of proposed Commission regulations 
1.13 and 23.603.
    \386\ See paragraph (j)(2) of proposed Commission regulations 
1.13 and 23.603.
---------------------------------------------------------------------------

m. Emergency Contacts and Recordkeeping--Proposed Paragraphs (k) and 
(l)
    The proposed rule would require covered entities to provide the 
Commission with the name and contact information of employees in 
connection with incidents triggering notification to the Commission and 
in connection with the activation of the covered entity's BCDR 
plan.\387\ The identified employees would need to be authorized to make 
key decisions on behalf of the covered entity and have knowledge of the 
covered entity's incident response plan or BCDR plan, as 
appropriate.\388\ Covered entities would also need to update their 
contacts with the Commission, as necessary.\389\ The Commission 
believes that ensuring it has knowledgeable contacts with whom to 
direct communications during a crisis would aid the Commission's 
ability to take any necessary responsive action, and that the costs 
associated with identifying and updating the appropriate contacts would 
be ministerial in nature.\390\ With respect to BCDR plan emergency 
contacts for swap entities, the proposed rule is identical in substance 
to current Commission regulation 23.603, such that it should impose no 
additional costs on swap entities.\391\
---------------------------------------------------------------------------

    \387\ See paragraph (k)(1) of proposed Commission regulations 
1.13 and 23.603.
    \388\ See paragraph (k)(2) of proposed Commission regulations 
1.13 and 23.603.
    \389\ See paragraph (k)(3) of proposed Commission regulations 
1.13 and 23.603.
    \390\ The Commission estimates that covered entities will incur 
a cost of $100 (1 hour x $100/hour) to provide the Commission with 
emergency contact information, or an estimated aggregate dollar cost 
of $16,000 (160 covered entities x $100).
    \391\ See 17 CFR 23.603(3).
---------------------------------------------------------------------------

    The proposed rule would also further require covered entities to 
maintain all records required to be maintained pursuant to this section 
in accordance with Commission regulation 1.31, and make them available 
promptly upon request to representatives of the Commission and to 
representatives of applicable prudential regulators.\392\ Covered 
entities would incur costs associated with maintaining a recordkeeping 
system that allows for easy records retrieval, which would require both 
staff resources and likely reliance on electronic recordkeeping 
systems. The Commission believes these costs are likely mitigated for 
most covered entities, as they would be able to rely on existing 
recordkeeping systems designed to maintain other records in accordance 
with Commission regulation 1.31, and proper recordkeeping would help 
covered entities demonstrate compliance with the ORF rule, and ensure 
their ORFs are operating as expected as they conduct required reviews 
and testing.
---------------------------------------------------------------------------

    \392\ See paragraph (l) of proposed Commission regulations 1.13 
and 23.603.
---------------------------------------------------------------------------

2. Section 15(a) Factors
a. Protection of Market Participants and the Public
    The Commission believes the proposed rule would support protection 
of market participants and the public. The Commission preliminarily 
believes the proposed rule will help protect market participants and 
the public by increasing the operational resiliency of covered entities 
to disruptions caused by natural disasters, cyber-attacks, and failures 
at third-party service providers. As covered entities are responsible 
for safeguarding customers' accounts, executing trades, maintaining 
records, and reporting to relevant agencies, their operational 
resiliency will mitigate the negative impact on customers, clients, and 
counterparties in case of an incident. The proposed rule may also help 
reduce the likelihood of an incident due to proposed proactive measures 
such as penetration and vulnerability testing and cyber security 
training. For market participants and the public more generally, the 
benefits include enhanced market protection against the spread of 
contagion risk to the financial system from operational risks.
b. Efficiency, Competitiveness, and Financial Integrity of Markets
    The Commission believes the proposed rule would enhance the 
financial integrity of CFTC-regulated derivatives markets. SDs, MSPs, 
and FCMs are essential intermediaries in the financial markets 
regulated by the Commission. Due to the interconnectedness of markets, 
disruptions to the business operations of these intermediaries pose 
risks to other markets. The Commission believes that increasing and 
helping to ensure the operational resiliency of these covered entities 
would help improve the financial integrity of the derivatives markets. 
The proposed rule's requirement to report to the Commission incidents 
and BCDR plan

[[Page 4749]]

activation would assist the Commission effectuate a timely response to 
business disruptions, which will help mitigate the impact on other 
market participants and promote financial stability and confidence. 
Additionally, to the degree that the proposed rule aligns with other 
existing applicable requirements, including NFA rules and interpretive 
notices, and incorporates generally accepted standards and best 
practices currently broadly relied on by covered entities, the proposed 
rule would support regulatory convergence and the efficiencies that may 
generate.
c. Price Discovery
    The Commission does not anticipate the proposed rule directly 
impacting the price discovery process. Nevertheless, if a trading 
disruption would be prevented or shortened by this proposed rulemaking, 
then price discovery would be improved.
d. Sound Risk Management Practices
    The Commission believes the proposed rule would promote the 
development of sound risk management practices among covered entities. 
Programs, plans, policies, and procedures are required for operational 
risks, which now explicitly include cybersecurity and third-party risks 
that adhere to current best practices. These processes seek to help 
covered entities identify, protect, detect, respond, and recover from 
such risks. As such, the operational risk management processes of 
covered entities may be improved.
e. Other Public Interest Considerations
    The proposed rule relies on and incorporates aspects of existing 
standards and practices developed by other regulators and standard-
setting bodies, including NFA rules and interpretive notices; 
prudential rules and guidance; and NIST, ISO, FFIEC and other sources 
of cyber and operational resilience standards. Accordingly, the 
proposed rule should support the development of further convergence in 
the area of operational resilience and allow covered entities to 
develop ORFs that are adaptive and responsive to rapidly changing 
circumstances and technology, which the Commission believes could lead 
to better protection of markets against the spread of contagion risks 
to the financial system from operational risks, in general.
3. Request for Comments
    As noted, the Commission invites public comment on all aspects of 
its cost-benefit consideration, including, but not limited to the 
baseline and the identification and measurement of costs and benefits 
relative to it; the identification, measurement, and assessment of any 
costs and benefits not discussed herein; whether the Commission has 
misidentified any costs or benefits; what, if any, alternatives would 
be more reasonable in terms of their costs and benefits; and the 
Section 15(a) factors described above. The Commission asks that 
commenters explain and support the reasons for positions asserted in 
their comment letters and, further, include in them any data or other 
information that they may have to assist the Commission's ability to 
better quantify the costs and benefits of the Proposal.
    1. Has the Commission misidentified any costs or benefits? If so, 
please explain.
    2. Please explain whether compliance costs would increase or 
decrease as a result the proposed rule. Please provide all quantitative 
and qualitative costs, including, but not limited to personnel costs 
and technological costs.
    3. The Commission seeks additional information on the costs and 
benefits of the proposed rule's requirement for covered entities to 
have a governance regime for their ORF, including risk appetite and 
tolerance limits, consolidated programs or plans, and internal 
escalation policies. Specifically, to what extent do covered entities 
already have or plan to have relevant programs or plans, policies, and 
procedures compliant with those prescribed in the proposed rule? To 
what practical extent do NFA's requirements, prudential regulation and/
or best practices currently duplicate or differ from the ORF governance 
regime, including risk appetite limits, consolidated programs or plans, 
and internal escalation policies, being proposed? Will covered entities 
experience additional or lowered costs to comply with the proposed 
rule, and if so, to what degree?
    4. The Commission seeks additional information regarding the costs 
and benefits of establishing an information and technology security 
program. Specifically, to what extent are covered entities already 
conducting comprehensive risk assessments that follow standards 
described in the proposed rule? Are these assessments being conducted 
on at least an annual basis? Do existing effective controls likewise 
meet the standards in the proposed rule? Will covered entities 
experience additional or lowered costs relative to current practice to 
establish, document, and maintain an incident response plan as called 
for in the proposed rule, and if so, to what degree?
    5. The Commission seeks additional information regarding the costs 
and benefits of establishing a business continuity and disaster 
recovery plan. In particular, is the Commission's proposed rule 
different from current practice, and, if so, how? Would covered 
entities experience additional or lowered costs to comply with the 
proposed rule, and, if so, to what degree?
    6. The Commission seeks additional information regarding the costs 
and benefits of the proposed rule's required notice of ORF events to 
the Commission. Will covered entities experience additional or lowered 
costs to comply with the proposed rule, and, if so, to what degree? 
Will compliance with the 24-hour cap for as-soon-as-possible 
notification entail additional costs relative to some shorter or longer 
cap and, if so, why and to what degree?
    7. The Commission seeks additional information on the costs and 
benefits of the proposed rule's requirement that covered entities 
provide notification to customers and counterparties following an 
incident. In particular, is the Commission's proposed rule different 
from current practice, and, if so, how? Would covered entities 
experience additional or lowered costs to comply with the proposed 
rule, and, if so, to what degree?
    8. The Commission seeks additional information regarding the costs 
and benefits of ORF review and testing. In particular, to what extent, 
if any, does the proposed rule differ from existing procedures? How do 
covered entities determine the amount of review and testing that is 
appropriate? Do all covered entities currently undertake penetration 
and vulnerability testing, and at what frequency? Would covered 
entities experience additional or lowered costs to comply with the 
proposed rule, and, if so, to what degree?
    9. The Commission seeks additional information regarding the costs 
and benefits of the cross-border application of the proposed rule. 
Would added specificity in the proposed regulations improve the cost-
benefit calculus for those covered entities impacted by their cost-
benefit application? If so, in what areas would more specificity be 
helpful and how would costs and benefits be impacted?

D. Antitrust Laws

    Section 15(b) of the CEA requires the Commission to ``take into 
consideration the public interest to be protected by the antitrust laws 
and endeavor to take the least anticompetitive means of achieving the 
purposes of the CEA, in

[[Page 4750]]

issuing any order or adopting any Commission rule or regulation 
(including any exemption under CEA section 4(c) or 4c(b)), or in 
requiring or approving any bylaw, rule, or regulation of a contract 
market or registered futures association established pursuant to 
section 17 of this Act.'' \393\
---------------------------------------------------------------------------

    \393\ 7 U.S.C. 19(b).
---------------------------------------------------------------------------

    The Commission preliminarily believes that the public interest to 
be protected by the antitrust laws is generally to protect competition. 
The Commission invites comment on whether the proposed rule implicates 
any other specific public interest to be protected by the antitrust 
laws.
    The Commission has also assessed the proposal for potential 
anticompetitive effects. To the extent that there are substantial fixed 
costs associated with improved operational risk management, there may 
be competitive implications, though likely anticompetitive impacts have 
not been identified. Smaller firms may bear a disproportionate cost 
relative to larger firms in total asset size due to this proposed rule. 
Nevertheless, smaller firms may be able to realize economies of scope 
and scale through outsourcing to third-parties, albeit at the cost of 
raising their third-party risk exposure. In addition, the proposed rule 
allows smaller firms to choose programs or plans, policies, and 
procedures that are appropriate to their businesses, further mitigating 
competitive concerns.
    The Commission invites comment on its CEA section 15(b) assessment, 
including what other means, if any, would be more procompetitive than 
what the Commission now proposes and why.

List of Subjects

17 CFR Part 1

    Brokers, Commodity futures, Consumer protection, Reporting and 
recordkeeping requirements.

17 CFR Part 23

    Banks, Banking, Commodity futures, Reporting and recordkeeping 
requirements, Swaps.

    For the reasons stated in the preamble, the Commodity Futures 
Trading Commission proposes to amend 17 CFR parts 1 and 23 as set forth 
below:

PART 1--GENERAL REGULATIONS UNDER THE COMMODITY EXCHANGE ACT

0
1. The authority citation for part 1 continues to read as follows:

    Authority: 7 U.S.C. 1a, 2, 5, 6, 6a, 6b, 6c, 6d, 6e, 6f, 6g, 6h, 
6i, 6k, 6l, 6m, 6n, 6o, 6p, 6r, 6s, 7, 7a-1, 7a-2, 7b, 7b-3, 8, 9, 
10a, 12, 12a, 12c, 13a, 13a-1, 16, 16a, 19, 21, 23, and 24 (2012).

0
2. Add Sec.  1.13 to read as follows:


Sec.  1.13  Operational Resilience Framework for Futures Commission 
Merchants

    (a) Definitions. For purposes of this section:
    Affiliate means, with respect to any person, a person controlling, 
controlled by, or under common control with, such person.
    Business continuity and disaster recovery plan means a written plan 
outlining the procedures to be followed in the event of an emergency or 
other significant disruption to the continuity of normal business 
operations and that meets the requirements of paragraph (f) of this 
section.
    Consolidated program or plan means any information and technology 
security program, third-party relationship program, or business 
continuity and disaster recovery plan in which the futures commission 
merchant participates with one or more affiliates and that is managed 
and approved at the enterprise level.
    Covered information means any sensitive or confidential data or 
information maintained by a futures commission merchant in connection 
with its business activities as a futures commission merchant.
    Covered technology means any application, device, information 
technology asset, network service, system, and other information-
handling component, including the operating environment, that is used 
by a futures commission merchant to conduct its business activities, or 
to meet its regulatory obligations, as a futures commission merchant.
    Critical third-party service provider means a third-party service 
provider, the disruption of whose performance would be reasonably 
likely to:
    (i) Significantly disrupt a futures commission merchant's business 
operations as a futures commission merchant; or
    (ii) Significantly and adversely impact the futures commission 
merchant's customers.
    Information and technology security means the preservation of:
    (i) The confidentiality, integrity, and availability of covered 
information; and
    (ii) The reliability, security, capacity, and resilience of covered 
technology.
    Incident means any event, occurrence, or circumstance that could 
jeopardize information and technology security, including if it occurs 
at a third-party service provider.
    Information and technology security program means a written program 
reasonably designed to identify, monitor, manage, and assess risks 
relating to information and technology security and that meets the 
requirements of paragraph (d) of this section.
    Key controls mean controls that an appropriate risk analysis 
determines are either critically important for effective information 
and technology security or intended to address risks that evolve or 
change more frequently and therefore require more frequent review to 
ensure their continuing effectiveness in addressing such risks.
    Oversight body means any board, body, or committee of a board or 
body of the futures commission merchant specifically granted the 
authority and responsibility for making strategic decisions, setting 
objectives and overall direction, implementing policies and procedures, 
or overseeing the implementation of operations for the futures 
commission merchant.
    Risk appetite means the aggregate amount of risk a futures 
commission merchant is willing to assume to achieve its strategic 
objectives.
    Risk tolerance limit means the amount of risk, beyond its risk 
appetite, that a futures commission merchant is prepared to tolerate 
through mitigating actions.
    Senior officer means the chief executive officer or other 
equivalent officer of the futures commission merchant.
    Third-party relationship program means a written program reasonably 
designed to identify, monitor, manage, and assess risks relating to 
third-party relationships and that meets the requirements of paragraph 
(e) of this section.
    (b) Generally. (1) Purpose and scope. Each futures commission 
merchant shall establish, document, implement, and maintain an 
Operational Resilience Framework reasonably designed to identify, 
monitor, manage, and assess risks relating to:
    (i) information and technology security;
    (ii) third-party relationships; and
    (iii) emergencies or other significant disruptions to the 
continuity of normal business operations as a futures commission 
merchant.
    (2) Components. The Operational Resilience Framework shall include 
an information and technology security program, a third-party 
relationship program, and a business continuity and disaster recovery 
plan. Each component program or plan shall be supported by written 
policies and procedures.
    (3) Standard. The Operational Resilience Framework shall be

[[Page 4751]]

appropriate and proportionate to the nature, size, scope, complexity, 
and risk profile of its business activities as a futures commission 
merchant, following generally accepted standards and best practices.
    (c) Governance. (1) Approval of components. Each component program 
or plan required by paragraph (b)(2) of this section shall be approved 
in writing, on at least an annual basis, by either the senior officer, 
an oversight body, or a senior-level official of the futures commission 
merchant.
    (2) Risk appetite and risk tolerance limits. (i) Each futures 
commission merchant shall establish and implement appropriate risk 
appetite and risk tolerance limits with respect to the risk areas 
identified in paragraph (b)(1) of this section.
    (ii) The risk appetite and risk tolerance limits established 
pursuant to paragraph (c)(2)(i) of this section shall be reviewed and 
approved in writing on at least an annual basis by either the senior 
officer, an oversight body, or a senior-level official of the futures 
commission merchant.
    (3) Internal escalations. The senior officer, an oversight body, or 
a senior-level official of the futures commission merchant shall be 
notified of:
    (i) circumstances that exceed risk tolerance limits established and 
approved pursuant to paragraph (c)(2)(i) of this section; and
    (ii) incidents that require notification pursuant to paragraphs (i) 
or (j) of this section.
    (4) Futures commission merchants forming part of a larger 
enterprise. (i) Generally. A futures commission merchant may satisfy 
the requirements of paragraph (b)(2) of this section through its 
participation in a consolidated program or plan, provided that each 
consolidated program or plan meets the requirements of this section.
    (ii) Attestation. A futures commission merchant that relies on a 
consolidated program or plan pursuant to paragraph (c)(4)(i) of this 
section may satisfy the requirements in paragraphs (c)(1) and 
(c)(2)(ii) of this section provided that either the senior officer, an 
oversight body, or a senior-level official of the futures commission 
merchant attests in writing, on at least an annual basis, that the 
consolidated program or plan meets the requirements of this section and 
reflects a risk appetite and risk tolerance limits appropriate to the 
futures commission merchant.
    (d) Information and technology security program. (1) Risk 
assessment.
    (i) The information and technology security program shall require 
the futures commission merchant to conduct and document the results of 
a comprehensive risk assessment reasonably designed to identify, 
assess, and prioritize risks to information and technology security.
    (ii) Such risk assessment shall be conducted at a frequency 
consistent with the standard set forth in paragraph (b)(3) of this 
section, but at least annually, and be conducted by personnel not 
responsible for the development or implementation of covered technology 
or related controls.
    (iii) The results of the risk assessment shall be provided to the 
oversight body, senior officer, or other senior-level official who 
approves the information and technology security program upon the risk 
assessment's completion.
    (2) Effective controls. The information and technology security 
program shall require the futures commission merchant to establish, 
document, implement, and maintain controls reasonably designed to 
prevent, detect, and mitigate identified risks to information and 
technology security. Each futures commission merchant shall consider, 
at a minimum, the following types of controls and adopt those 
consistent with the standard set forth in paragraph (b)(3) of this 
section:
    (i) Access controls on covered technology, including controls to 
authenticate and permit access only by authorized individuals and 
controls preventing misappropriation or misuse of covered information 
by employees;
    (ii) Access restrictions designed to permit only authorized 
individuals to access physical locations containing covered 
information, including, but not limited to, buildings, computer 
facilities, and records storage facilities;
    (iii) Encryption of electronic covered information, including while 
in transit or in storage on networks or systems, to which unauthorized 
individuals may have access;
    (iv) Dual control procedures, segregation of duties, and background 
checks for employees or third-party service providers with 
responsibilities for or access to covered information;
    (v) Change management practices, including defined roles and 
responsibilities, logging, and monitoring practices;
    (vi) Systems development and configuration management practices, 
including practices for initializing, changing, testing, and monitoring 
configurations;
    (vii) Flaw remediation, including vulnerability patching practices;
    (viii) Measures to protect against destruction, loss, or damage of 
covered information due to potential environmental hazards, such as 
fire and water damage or technological failures;
    (ix) Monitoring systems and procedures to detect actual and 
attempted attacks on or intrusions into covered technology;
    (x) Response programs that specify actions to be taken when the 
futures commission merchant suspects or detects that unauthorized 
individuals have gained access to covered technology, including 
appropriate reports to regulatory and law enforcement agencies; and
    (xi) Measures to promptly recover and secure any compromised 
covered information.
    (3) Incident response plan. The information and technology security 
program shall include a written incident response plan that is 
reasonably designed to detect, assess, contain, mitigate the impact of, 
and recover from an incident. This incident response plan shall 
include, at a minimum:
    (i) The roles and responsibilities of the futures commission 
merchant's management, staff, and third-party service providers in 
responding to incidents;
    (ii) Escalation protocols, including a requirement to timely inform 
the oversight body, senior officer, or other senior-level official that 
has primary responsibility for overseeing the information and 
technology security program; the chief compliance officer of the 
futures commission merchant; and any other relevant personnel of 
incidents that may significantly impact the futures commission 
merchant's regulatory obligations or require notification to the 
Commission;
    (iii) The points of contact for external coordination of incident 
responses as determined necessary by the futures commission merchant 
based on the severity of incidents;
    (iv) The required reporting of incidents, whether by internal 
policy, contract, or law, including as required in this section;
    (v) Procedures for documenting incidents and managements' response; 
and
    (vi) The remediation of weaknesses in information and technology 
security, controls, and training, if any.
    (e) Third-party relationship program. (1) Third-party relationship 
lifecycle stages. The third-party relationship program shall describe 
how the futures commission merchant addresses the risks attendant to 
each stage of the third-party relationship lifecycle, including:
    (i) Pre-selection risk assessment;
    (ii) Due diligence of prospective third-party service providers;
    (iii) Contractual negotiations;

[[Page 4752]]

    (iv) Ongoing monitoring; and
    (v) Termination, including preparations for planned and unplanned 
terminations.
    (2) Heightened duties for critical third-party service providers. 
The third-party relationship program shall establish heightened due 
diligence practices for potential critical third-party service 
providers and heightened monitoring for critical third-party service 
providers.
    (3) Third-party service provider inventory. As part of its third-
party relationship program, each futures commission merchant shall 
create, maintain, and regularly update an inventory of third-party 
service providers the futures commission merchant has engaged to 
support its activities as a futures commission merchant, identifying 
whether each third-party service provider in the inventory is a 
critical third-party service provider.
    (3) Retention of responsibility. Notwithstanding a futures 
commission merchant's determination to rely on a third-party service 
provider, each futures commission merchant remains responsible for 
meeting its obligations under the Act and Commission regulations.
    (4) Guidance on third-party relationship program. For guidance 
outlining potential risks, considerations, and strategies for 
developing a third-party relationship program consistent with paragraph 
(e), see Appendix A to this part.
    (f) Business continuity and disaster recovery plan. (1) Purpose. 
The business continuity and disaster recovery plan shall be reasonably 
designed to enable the futures commission merchant to:
    (i) Continue or resume normal business operations with minimal 
disruption to customers and the markets; and
    (ii) Recover and make use of covered information, as well as any 
other data, information, or documentation required to be maintained by 
law and regulation.
    (2) Minimum contents. The business continuity and disaster recovery 
plan shall, at a minimum:
    (i) Identify covered information, as well as any other data or 
information required to be maintained by law and regulation, and 
establish and implement procedures to backup or copy all such data and 
information with sufficient frequency to meet the requirements of this 
section, and to store such data and information off-site in either 
hard-copy or electronic format;
    (ii) Identify any resources, including covered technology, 
facilities, infrastructure, personnel, and competencies, essential to 
the operations of the futures commission merchant or to fulfill the 
regulatory obligations of the futures commission merchant, and 
establish and maintain procedures and arrangements to provide for their 
backup in a manner that is sufficient to meet the requirements of this 
section. Such arrangements must provide for backups that are located in 
one or more areas that are geographically separate from the futures 
commission merchant's primary systems, facilities, infrastructure, and 
personnel, and may include the use of resources provided by third-party 
service providers;
    (iii) Identify potential disruptions to critical third-party 
service providers and establish a plan to minimize the impact of such 
disruptions;
    (iv) Identify supervisory personnel responsible for implementing 
each aspect of the business continuity and disaster recovery plan, 
including the emergency contacts required to be provided pursuant to 
paragraph (k) of this section; and
    (v) Establish a plan for communicating with the following persons 
in the event of an emergency or other significant disruption, to the 
extent applicable: employees; customers; swap data repositories; 
execution facilities; trading facilities; clearing facilities; 
regulatory authorities; data, communications and infrastructure 
providers and other vendors; disaster recovery specialists; and other 
persons essential to the recovery of documentation and data, the 
resumption of operations, and compliance with the Act and Commission 
regulations.
    (3) Accessibility. Each futures commission merchant shall maintain 
copies of its business continuity and disaster recovery plan at one or 
more accessible off-site locations.
    (g) Training and distribution. (1) Training. Each futures 
commission merchant shall establish, implement, and maintain training 
with respect to all aspects of the Operational Resilience Framework, 
including, but not limited to:
    (i) Cybersecurity awareness training for all personnel; and
    (ii) Role-specific training for personnel involved in establishing, 
documenting, implementing, and maintaining the Operational Resilience 
Framework.
    (2) Frequency. Each futures commission merchant shall provide and 
update the training required in paragraph (g)(1) as necessary, but no 
less frequently than annually.
    (3) Distribution. Each futures commission merchant shall distribute 
copies of each component program or plan required by paragraph (b)(2) 
of this section to relevant personnel and promptly provide any 
significant revisions thereto.
    (h) Reviews and Testing. Each futures commission merchant shall 
establish, implement, and maintain a plan reasonably designed to assess 
its adherence to, and the effectiveness of, its Operational Resilience 
Framework through regular reviews and risk-based testing.
    (1) Reviews. Reviews of the Operational Resilience Framework shall 
be conducted at least annually and in connection with any material 
change to the activities or operations of the futures commission 
merchant that is reasonably likely to affect the risks identified in 
paragraph (b)(1) of this section. Reviews shall include an analysis of 
adherence to, and the effectiveness of, the Operational Resilience 
Framework and any recommendations for modifications or improvements 
that address root causes of any issues identified by the review.
    (2) Testing. The frequency, nature, and scope of risk-based testing 
of the Operational Resilience Framework shall be determined by the 
futures commission merchant, consistent with the standard in paragraph 
(b)(3) of this section.
    (i) Testing of the information and technology security program 
shall include, at a minimum:
    (A) Testing of key controls and the incident response plan at least 
annually;
    (B) Vulnerability assessments, including daily or continuous 
automated vulnerability scans; and
    (C) Penetration testing at least annually.
    (ii) Testing of the business continuity and disaster recovery plan 
shall include, at a minimum, a walk-through or tabletop exercise 
designed to test the effectiveness of backup facilities and 
capabilities at least annually.
    (3) Independence. The reviews and testing shall be conducted by 
qualified personnel who are independent of the aspect of the 
Operational Resilience Framework being reviewed or tested.
    (4) Documentation. Each futures commission merchant shall document 
all reviews and testing of the Operational Resilience Framework. The 
documentation shall, at a minimum, include:
    (i) The date the review or testing was conducted;
    (ii) The nature and scope of the review or testing, including 
methodologies employed;

[[Page 4753]]

    (iii) The results of the review or testing, including any 
assessment of effectiveness;
    (iv) Any identified deficiencies and recommendations for 
remediation; and
    (v) Any corrective action(s) taken or initiated, including the 
date(s) such action(s) were taken.
    (5) Internal reporting. Each futures commission merchant shall 
report on the results of its reviews and testing to the futures 
commission merchant's chief compliance officer and any other relevant 
senior-level official(s) and oversight body(ies).
    (i) Notifications to the Commission. (1) Incidents. (i) 
Notification trigger. Each futures commission merchant shall notify the 
Commission of any incident that adversely impacts, or is reasonably 
likely to adversely impact:
    (A) information and technology security;
    (B) the ability of the futures commission merchant to continue its 
business activities as a futures commission merchant; or
    (C) the assets or positions of a customer of the futures commission 
merchant.
    (ii) Contents. The notification shall provide any information 
available to the futures commission merchant at the time of 
notification that may assist the Commission in assessing and responding 
to the incident, including the date the incident was detected, possible 
cause(s) of the incident, its apparent or likely impacts, and any 
actions the futures commission merchant has taken or is taking to 
mitigate or recover from the incident, including measures to protect 
customers.
    (iii) Timing and method. Each futures commission merchant shall 
provide the incident notification as soon as possible but in any event 
no later than 24 hours after such incident has been detected. The 
notification shall be provided via email to [email protected].
    (2) Business continuity and disaster recovery plan activation. (i) 
Notification trigger. Each futures commission merchant shall notify the 
Commission of any determination to activate the business continuity and 
disaster recovery plan.
    (ii) Contents. The notification shall provide any information 
available to the futures commission merchant at the time of 
notification that may assist the Commission in assessing or responding 
to the emergency or disruption, including the date of the emergency or 
disruption, a description thereof, the possible cause(s), its apparent 
or likely impacts, and any actions the futures commission merchant has 
taken or is taking to mitigate or recover from the emergency or 
disruption, including measures taken or being taken to protect 
customers.
    (iii) Timing and method. Each futures commission merchant shall 
provide the business continuity and disaster recovery plan activation 
notification within 24 hours of determining to activate the business 
continuity and disaster recovery plan. The notification shall be 
provided via email to [email protected].
    (j) Notification of incidents to affected customers. (1) 
Notification trigger. Each futures commission merchant shall notify a 
customer as soon as possible of any incident that is reasonably likely 
to have adversely affected the confidentiality or integrity of the 
customer's covered information, assets, or positions.
    (2) Contents. The notification to affected customers shall include 
information necessary for the affected customer to understand and 
assess the potential impact of the incident on its information, assets, 
or positions, and to take any necessary action. Such notification shall 
include, at a minimum:
    (i) a description of the incident;
    (ii) the particular way in which the customer, or its covered 
information, may have been adversely impacted;
    (iii) measures being taken by the futures commission merchant to 
protect against further harm; and
    (iv) contact information for the futures commission merchant where 
the customer may learn more about the incident or ask questions.
    (k) Emergency Contacts. (1) Each futures commission merchant shall 
provide the Commission the name and contact information of:
    (i) two employees whom the Commission may contact in connection 
with incidents triggering notification to the Commission under 
paragraph (i)(1) of this section; and
    (ii) two employees whom the Commission may contact in connection 
with the activation of the futures commission merchant's business 
continuity and disaster recovery plan triggering notification to the 
Commission under paragraph (i)(2) of this section.
    (2) The identified employees shall be authorized to make key 
decisions on behalf of the futures commission merchant and have 
knowledge of the futures commission merchant's incident response plan 
or business continuity and disaster recovery plan, as appropriate.
    (3) The futures commission merchant shall update its emergency 
contacts with the Commission as necessary.
    (l) Recordkeeping. Each futures commission merchant shall maintain 
all records required to be maintained pursuant to this section in 
accordance with section 1.31 of this chapter and shall make them 
available promptly upon request to representatives of the Commission 
and to representatives of applicable prudential regulators, as defined 
in section 1a(39) of the Act.
0
3. Add appendix A to part 1 to read as follows:

Appendix A to Part 1--Guidance on Third-Party Relationship Programs

    The following guidance offers factors, actions, and strategies 
for futures commission merchants to consider in preparing and 
implementing third-party relationship programs reasonably designed 
to identify, monitor, manage, and assess risks relating to third-
party relationships, as required by Commission regulation 1.13. The 
guidance is also not intended to reduce or replace the obligation of 
futures commission merchants to comply with the requirements in 
Commission regulation 1.13, including the requirement to ensure that 
each futures commission merchant's Operational Resilience Framework 
is appropriate and proportionate to the nature, size, scope, 
complexity, and risk profile of its business activities as a futures 
commission merchant, following generally accepted standards and best 
practices. The guidance is not exhaustive and is nonbinding.
    The guidance is written to be broadly relevant to all futures 
commission merchants, but it may not be universally applicable. The 
degree to which the guidance would be applicable to a particular 
futures commission merchant would depend on its unique facts and 
circumstances and may vary from relationship to relationship. Each 
futures commission merchant should assess the relevance of the 
guidance as it applies to its particular risk profile and tailor its 
third-party relationship program accordingly.
    Comparable guidance for swap dealers and major swap participants 
is included in Appendix A to subpart J of part 23 of the 
Commission's regulations.

A. Pre-Selection Risk Assessment--Commission Regulation 1.13(e)(1)(i)

    Before entering into a third-party relationship, futures 
commission merchants should determine which services should be 
performed by a third-party and plan for how to manage associated 
risks. The Commission appreciates that reliance on third-party 
service providers may be unavoidable, particularly given the rapid 
pace of technological innovation, which may render it uneconomical 
or even infeasible for financial institutions to meet all of their 
technological needs in-house.
    Nevertheless, given the risks associated with relying on third-
party service providers, and that each additional third-party 
relationship a futures commission merchant

[[Page 4754]]

employs is likely to add further risk and complexity, a futures 
commission merchant's third-party relationship program should 
include a deliberative process for affirmatively determining whether 
to source a particular service from a third-party service provider. 
In determining whether a particular function should be performed by 
a third-party service provider, futures commission merchants should 
consider whether:
     The service would support the futures commission 
merchant's strategic goals and objectives.
     The same goals and objectives could be addressed 
through an alternative means that may not require reliance on a 
third-party service provider.
     The futures commission merchant has or could otherwise 
secure the resources, financial and otherwise, to effectively 
monitor the third-party service provider.
     Relevant and reputable third-party service providers 
are available.
     The provision of the service would implicate 
information and technology security concerns, including by requiring 
the third-party service provider to obtain access to covered 
information or provide covered technology.
     A disruption of the service would have a negative 
impact on customers or regulatory compliance.
     The relationship could be structured to reduce 
associated risks, such as by limiting the third-party service 
provider's access to covered information or covered technology.
     Lack of direct control over performance of the service 
would present unacceptable risk, i.e., risk outside the futures 
commission merchant's risk tolerance limits.
    As the above considerations illustrate, futures commission 
merchants should consider ways in which they might structure their 
third-party relationships to reduce the associated risks. For 
example, where giving a third-party service provider direct access 
to its technology or data may be outside a futures commission 
merchant's risk tolerance, structuring the relationship to provide 
the third-party service provider access on a read-only basis or via 
reports delivered by the futures commission merchants could render 
the relationship more acceptable. Futures commission merchants 
should therefore consider the availability of safer means of 
performing the service as part of their assessment.
    Changes in technology, businesses practices, regulation, market 
structure, market participants (e.g., new entrants to the market), 
or service delivery may change the risk profile of the third-party 
relationship over time. Accordingly, futures commission merchants 
should consider periodically reassessing their selection of services 
to be performed by third-party service providers. Futures commission 
merchants should stay abreast of these changes by monitoring the 
external environment and communicating with current and prospective 
service providers and other participants in industry.

B. Due Diligence in Selecting Third-Party Service Providers--Commission 
Regulation 1.13(e)(1)(ii)

    After a futures commission merchant has determined that a 
service is suitable for a third-party to perform, it should conduct 
due diligence on prospective third-party service providers. Due 
diligence provides futures commission merchants with the information 
they need to assess and conclude, with a reasonable level of 
assurance, that the prospective third-party service provider is 
capable of effectively providing the service as expected, adhering 
to the futures commission merchant's policies, maintaining the 
futures commission merchant's compliance with Commission 
regulations, and protecting covered information. Appropriate due 
diligence should also enable futures commission merchants to 
evaluate whether they would be able to effectively monitor and 
manage the risks associated with a particular third-party 
relationship.
    Due diligence may be conducted before or contemporaneously with 
contractual negotiations with prospective third-party service 
providers but should be concluded prior to executing any agreements. 
Futures commission merchants should conduct due diligence even in 
situations where, for a particular service, there may only be one or 
a small number of providers with a dominant market share whose 
services are used by all or most of the futures commission 
merchants' industry peers, and futures commission merchants should 
not rely solely on those providers' reputations or prior experience 
with them. The depth and rigor of the due diligence should be 
proportionate to the nature of the third-party relationship, with 
the required heightened due diligence for potential critical third-
party service providers pursuant to Commission regulation 
1.13(e)(2). Specifically, when conducting due diligence for a 
potential critical third-party servicer provider, futures commission 
merchants should expand the type and sources of information they 
rely on, the rigor and scrutiny they apply in reviewing the 
information to identify potential risks, and the level of confidence 
in their assessment of the third-party service provider's ability to 
perform.
    When establishing their due diligence protocols, futures 
commission merchants should consider the full range of risks that 
reliance on the third-party service providers could introduce in 
light of the nature of the service they would be performing. 
Relevant considerations with respect to the potential third-party 
service provider include its:
     Financial condition, business experience and 
reputation, and business prospects, particularly the third-party 
service provider's experience providing services to financial 
institutions.
     Background, experience, and qualifications with respect 
to key personnel.
     Information and technology security practices, 
including incident reporting and incident management programs, and 
whether there are clearly documented processes for identifying and 
escalating incidents.
     Risk management practices, including governance, 
controls, testing, and issue management practices, as well as the 
results of any independent risk assessments.
     Regulatory environment, including the legal 
jurisdiction in which it is based and applicable regulatory or 
licensing requirements.
     History of disruptions to operations, including whether 
the third-party service provider has suffered incidents that would 
meet the standard for reporting to the Commission in Commission 
regulation 1.13(i).
     Violations of legal, compliance, or contractual 
obligations, including civil or criminal proceedings or 
administrative enforcement actions, including from self-regulatory 
organizations.
     Understanding of Commission regulatory requirements 
applicable to the futures commission merchant.
     Use of and reliance on subcontractors, including the 
volume and types of subcontracted activities, and the third-party 
service provider's process for identifying, assessing, managing, and 
monitoring associated risks.
     Business continuity and contingency plans.
     Financial protections, such as insurance coverage 
against losses or liabilities from intentional or negligent acts or 
hazards involving physical destruction and data or documentation 
losses.
    Futures commission merchants should memorialize their assessment 
of these factors and identify how the review was heightened for 
critical third-party service providers. Futures commission merchants 
should not rely solely on their prior knowledge of or experience 
with a potential third-party. Potential sources of due diligence 
information include:
     Audit reports, including pooled audit plans and System 
and Organizational Controls (SOC) reports.
     Financial statements and projections and relevant 
accompanying information (e.g., annual or quarterly reports, 
management commentary, auditors' opinions, and investor relations 
materials).
     Incident response plans, including the results of 
recent testing or assessments thereof.
     Business continuity and disaster recovery plans, as 
well as the result of recent testing or assessments thereof.
     Public filings.
     News reports, trade publications, and press releases.
     Reports from market intelligence providers.
     References from current or previous customers, or other 
parties which have had business relationships with the third-party 
service provider.
     Informal industry discussions.
     Information provided directly by the third-party 
service provider, such as internal performance metrics.
    Obtaining and reviewing audit reports, including SOC reports, 
may be of particular value for conducting heightened due diligence 
of critical third-party service providers. In certain circumstances, 
futures commission merchants may not be able to gather all the 
information necessary to reach an informed conclusion that a 
prospective third-party service provider is an adequate provider. 
Examples include instances where the third-party service provider is 
a new entrant into the market and little information exists; where 
information provided by the

[[Page 4755]]

third-party service provider is insufficient or appears unreliable; 
or where the third-party service provider is reluctant to provide 
internal information. In such cases, the futures commission merchant 
should identify and document the limitations of its due diligence, 
the attendant risks, and any available methods for mitigating them 
(e.g., obtaining alternate information, implementing enhanced 
monitoring or controls, negotiating protective contractual 
provisions). Ultimately, such factors could weigh against the use of 
the potential third-party service provider, particularly a potential 
critical third-party service provider. Futures commission merchants 
that proceed with the third-party service arrangements 
notwithstanding the limited due diligence should do so with caution, 
applying heightened scrutiny of the information they do receive, and 
consider the implementation of their own mitigating controls to 
compensate for the uncertainty.

C. Contractual Negotiations--Commission Regulation 1.13(e)(1)(iii)

    After selecting a third-party service provider, futures 
commission merchants should proceed to finalizing the agreement, 
typically through entering into an enforceable written contract. 
Written contracts are an important tool for clarifying the scope of 
services to be delivered, establishing standards or performance 
benchmarks, allocating risks and responsibilities, and facilitating 
resolution of disputes. They can also reduce the risks of non-
performance and assist in monitoring the third-party service 
provider. Because of their importance, the Commission recommends 
that futures commission merchants enter written agreements with 
third-party service providers before services are delivered, 
particularly with critical third-party service providers.
    In negotiating a written contract, futures commission merchants 
should seek to negotiate contractual provisions that would support 
their ability to mitigate, manage, and monitor the risks associated 
with the relationship, as identified through their initial pre-
selection and due diligence activities. The contractual provisions 
should be informed by the nature of the service provided and be 
proportionate to the criticality of the services provided. In 
particular, futures commission merchants should consider negotiating 
for the contract to include the following provisions:
     Timely notification to the futures commission merchant 
of any incidents suffered by third-party service providers, or of 
significant disruptions to the operations of the third-party service 
provider.
     Timely notification to the futures commission merchant 
of any material changes to the services provided.
     Required periodic, independent audits of the third-
party service provider, the results of which would be shared with 
the futures commission merchant.
     Restrictions on the third-party service provider's use 
of the futures commission merchant's covered information, except as 
necessary to deliver the service or meet legal obligations.
     Security measures to protect the futures commission 
merchant's covered information and covered technology to which the 
third-party service provider has access.
     Insurance, guarantees, indemnification, and limitations 
on liability.
     Dispute resolution procedures.
     Performance measures or benchmarks.
     Remediation of identified performance issues.
     Dispute resolution procedures.
     Compliance with regulatory requirements, including 
reasonable assurances that the third-party service provider is 
willing and able to coordinate with the futures commission merchant 
for the purpose of ensuring the futures commission merchant complies 
with its legal and regulatory obligations.
     Use of subcontractors, including notification or 
approval procedures for their use, the extension of contractual 
rights of the futures commission merchant against the third-party 
service provider to its subcontractors, and contractual obligations 
for reporting on or oversight of subcontractors.
     Termination provisions, including rights to terminate 
following breaches of the third-party service provider's 
obligations, notice requirements, obligations of the third-party 
service provider to provide support for a successful transition, and 
the return or destruction of records or covered information, as 
further described in section E of this guidance.
     Information sharing necessary to facilitate other 
provisions of this proposed guidance (for example, reporting 
requirements to support ongoing monitoring, as discussed in section 
D of this guidance, or notice requirements for termination, as 
discussed in section E of this guidance).
    These provisions focus on key risk factors generally associated 
with third-party service provider relationships. They are not 
exhaustive of all contractual provisions futures commission 
merchants should seek to include in their written contracts, 
including ordinary commercial contract terms (e.g., choice of law 
provisions) and terms that may relate only to specific services, 
among other provisions. While third-parties may initially offer a 
standard contract, a futures commission merchant may seek to request 
modifications, additional contractual provisions, or addendums to 
satisfy its needs. Futures commission merchants should work to 
tailor the level of detail and comprehensiveness of the contractual 
provisions based on the risk and complexity posed by the particular 
third-party relationship, contracts with critical third-party 
service providers likely being the most tailored.
    In some circumstances, a futures commission merchant may be at a 
bargaining power disadvantage, which prevents it from negotiating 
optimal contractual provisions. For example, a prospective third-
party service provider may be the sole provider of a service or may 
have such dominant market share that it can offer its services on a 
``take-it-or-leave-it'' basis. In such situations, the futures 
commission merchant should work to understand any resulting 
limitations in the contract and attendant risks and consider whether 
it can achieve outcomes comparable to those provided by contractual 
protections through non-contractual means. Examples could include 
the futures commission merchant implementing additional controls, 
augmenting its monitoring of the third-party service provider using 
public sources or market intelligence services, or purchasing 
insurance. The futures commission merchant should make an 
assessment, however, of whether these alternatives would provide an 
adequate substitute for the unobtained contractual protections and 
document its assessment and mitigation plan, considering its risk 
appetite and risk tolerance limits. Where a third-party service 
provider is unable or unwilling to agree to provisions necessary for 
the futures commission merchant to meet its obligations under 
Commission regulations, particularly a critical third-party service 
provider, the futures commission merchant should consider finding an 
alternative third-party service provider.

D. Ongoing Monitoring--Commission Regulation 1.13(e)(1)(iv)

    After a third-party service provider has initiated performance, 
futures commission merchants should engage in ongoing monitoring. 
Ongoing monitoring is important to ensure the third-party service 
provider is properly carrying out its outsourced function and 
contractual obligations, as well as meeting quality or performance 
expectations. Effective monitoring can aid futures commission 
merchants in the early identification of performance deficits, 
allowing for a quicker response that may then mitigate the impact.
    Ongoing monitoring should occur throughout the duration of a 
third-party relationship, commensurate with the level of risk and 
complexity of the relationship and the activity performed by the 
third-party. Examples of possible monitoring activities include:
     Reviewing reports on performance and effectiveness of 
controls, including independent audit reports and SOC reports.
     Periodic on-site visits or meetings to discuss open 
issues and plans for changes to the relationship.
     Reviewing updated due diligence information.
     Documenting service-level agreements with the third-
party service provider to establish performance targets.
     Establishing measures for the third-party service 
provider to identify, record, and remediate instances of failure to 
meet contractual obligations or unsatisfactory performance and to 
report such instances to the futures commission merchant on a timely 
basis.
     Direct testing of the third-party service provider's 
control environment.
    The frequency and depth of the futures commission merchant's 
monitoring activities should reflect the nature of the third-party 
relationship, including heightened monitoring for critical third-
party service providers, and may change over the duration of the 
relationship. The futures commission merchant should dedicate 
sufficient staffing

[[Page 4756]]

resources to its monitoring activities and be particularly alert to 
any circumstances that could signal that a third-party service 
provider may not be able to perform to an acceptable standard. A 
futures commission merchant should be cognizant that certain events 
may trigger the need for it to take further action, including 
terminating its relationship with the third-party service provider. 
Such events could include cyberattacks, natural disasters, financial 
distress or insolvency, adverse or qualified audit opinions, or 
litigation or enforcement actions.
    In addition to the continuous monitoring described above, 
futures commission merchants should periodically review and 
reevaluate their relationships with third-party service providers 
holistically. Such reviews should be more thorough than routine 
monitoring and may involve additional personnel, such as in-house or 
outside auditors, compliance and risk functions, information 
technology staff, or by a central function or committee whose 
visibility into other third-party relationships could provide 
valuable context for the relationship at issue. Additionally, to the 
extent a futures commission merchant uses enterprise risk management 
techniques, it should seek to integrate the information gathered 
from its ongoing monitoring with those practices. For example, to 
the extent that a futures commission merchant maintains a 
standardized approach across risk types to escalate concerns or 
issues to senior management or governance bodies (e.g., through the 
use of predefined criteria or escalation paths), the futures 
commission merchant should consider using the same protocols for 
escalating concerns identified through its ongoing monitoring of 
third-party service providers. The ongoing monitoring approach 
itself may be subject to enterprise risk management practices, such 
as periodic self-assessment for effectiveness, independent testing, 
and quality assurance.
    To the extent that monitoring activities reveal a change in 
their assessment of the risks associated with the third-party 
relationship, futures commission merchants should adjust the 
frequency and types of monitoring they conduct, including reports, 
regular testing, and on-site visits. One example of information that 
may change the level of monitoring is a notification that a third-
party service provider has suffered or may suffer from a severe 
adverse event that could trigger a material change in the systems or 
process used to carry out an outsourced function.

E. Terminating the Third-Party Relationship--Commission Regulation 
1.13(e)(1)(v)

    Futures commission merchants should ensure that their third-
party service provider relationship programs include advance 
preparation for the termination of the third-party relationship to 
ensure an orderly transition. Futures commission merchants should 
prepare for both planned terminations (i.e., where one or both 
parties elects to end the relationship pursuant to their contract) 
and unplanned terminations (e.g., following a sudden withdrawal of 
the third-party service). The plans should include both the 
contractual provisions for terminating the service (termination 
provisions), and the futures commission merchant's plan to 
facilitate an orderly transition of the function to an alternative 
provider or to bring it in-house (exit strategy). The goal of 
termination planning is to support an efficient transition to 
alternative arrangements for the provision of the service, 
regardless of the circumstances of the termination.
    Termination provisions include all terms needed by the futures 
commission merchant to wind down a third-party service relationship 
while ensuring that the futures commission merchant can continue to 
serve its customers without interruption and to meet its regulatory 
compliance obligations. Because information, data, staff training, 
and knowledge may reside in the third-party service provider, there 
is an increased risk of disruption during the termination phase. 
When negotiating termination provisions, a futures commission 
merchant should ensure that the terms negotiated support its exit 
strategy. For example, a futures commission merchant should ensure 
that termination rights are accompanied by notice periods that leave 
the futures commission merchant enough time to find an alternative 
provider (or to provide the service itself) to ensure an orderly 
transition.
    Similarly, the futures commission merchant should ensure that 
all customer data or other covered information in the third-party 
service provider's possession is promptly returned to the futures 
commission merchant or destroyed, as appropriate. The futures 
commission merchant should also verify that the third-party's access 
to its systems and covered information ceases at termination. 
Futures commission merchants should also consider negotiating more 
stringent terms for third-party service providers that breach their 
obligations under the agreement, other than for ``no-fault'' 
terminations. Such breaches may signal an inability of the third-
party service provider to provide the services contracted for and 
thereby threaten the ability of the futures commission merchant to 
serve its customers and meet its regulatory obligations. (See 
section C of this guidance for examples of termination provisions.)
    Futures commission merchants' exit strategies should include the 
steps needed to end the service provision with the third-party 
service provider and retain a new service provider or begin 
providing the service in-house. Although elements of an exit 
strategy may be reflected in termination provisions, not all 
elements of the exit strategy may be suitable for the contract. 
Examples include approvals, identification of alternative providers, 
description of the roles of staff in the futures commission 
merchant, and other internal matters. These elements may be 
memorialized in a procedure or similar document, such as the third-
party relationship program. The exit strategy should contain the 
internal steps to be taken to ensure notification to the third-party 
service provider, identification of the proposed new provider, or, 
if bringing the function in-house, the hiring and training of 
personnel, development of procedures, and launch of new technology, 
along with the time periods and responsible personnel for each.
    Futures commission merchants should be aware that, in practice, 
implementing an exit strategy may be complex and time-consuming and 
that the exercise of termination arrangements may be difficult. 
Futures commission merchants should also be aware that some third 
parties possess expertise that is not readily available and plan 
accordingly. Futures commission merchants should ensure that their 
plans are flexible enough to account for a range of plausible 
termination scenarios, including situations where the third-party 
service provider rapidly becomes unviable. Futures commission 
merchants may need to design backup or interim procedures sufficient 
to meet regulatory requirements in such situations.

PART 23--SWAP DEALERS AND MAJOR SWAP PARTICIPANTS

0
4. The authority citation for part 23 continues to read as follows:

    Authority: 7 U.S.C. 1a, 2, 6, 6a, 6b, 6b-1, 6c, 6p, 6r, 6s, 6t, 
9, 9a, 12, 12a, 13b, 13c, 16a, 18, 19, 21.
    Section 23.160 also issued under 7 U.S.C. 2(i); Sec. 721(b), 
Pub. L. 111-203, 124 Stat. 1641 (2010).

0
5. Revise Sec.  23.603 to read as follows:


Sec.  23.603  Operational Resilience Framework for Swap Dealers and 
Major Swap Participants.

    (a) Definitions. For purposes of this section:
    Affiliate means, with respect to any person, a person 
controlling, controlled by, or under common control with, such 
person.
    Business continuity and disaster recovery plan means a written 
plan outlining the procedures to be followed in the event of an 
emergency or other significant disruption to the continuity of 
normal business operations and that meets the requirements of 
paragraph (f) of this section.
    Consolidated program or plan means any information and 
technology security program, third-party relationship program, or 
business continuity and disaster recovery plan in which the swap 
entity participates with one or more affiliates and that is managed 
and approved at the enterprise level.
    Covered information means any sensitive or confidential data or 
information maintained by a swap entity in connection with its 
business activities as a swap entity.
    Covered technology means any application, device, information 
technology asset, network service, system, and other information-
handling component, including the operating environment, that is 
used by a swap entity to conduct its business activities, or to meet 
its regulatory obligations, as a swap entity.
    Critical third-party service provider means a third-party 
service provider, the disruption of whose performance would be 
reasonably likely to:

[[Page 4757]]

    (1) Significantly disrupt a swap entity's business operations as 
a swap entity; or
    (2) Significantly and adversely impact the swap entity's 
counterparties.
    Information and technology security means the preservation of:
    (1) The confidentiality, integrity, and availability of covered 
information; and
    (2) The reliability, security, capacity, and resilience of 
covered technology.
    Incident means any event, occurrence, or circumstance that could 
jeopardize information and technology security, including if it 
occurs at a third-party service provider.
    Information and technology security program means a written 
program reasonably designed to identify, monitor, manage, and assess 
risks relating to information and technology security and that meets 
the requirements of paragraph (d) of this section.
    Key controls mean controls that an appropriate risk analysis 
determines are either critically important for effective information 
and technology security or intended to address risks that evolve or 
change more frequently and therefore require more frequent review to 
ensure their continuing effectiveness in addressing such risks.
    Oversight body means any board, body, or committee of a board or 
body of the swap entity specifically granted the authority and 
responsibility for making strategic decisions, setting objectives 
and overall direction, implementing policies and procedures, or 
overseeing the implementation of operations for the swap entity.
    Risk appetite means the aggregate amount of risk a swap entity 
is willing to assume to achieve its strategic objectives.
    Risk tolerance limit means the amount of risk, beyond its risk 
appetite, that a swap entity is prepared to tolerate through 
mitigating actions.
    Senior officer means the chief executive officer or other 
equivalent officer of the swap entity.
    Swap entity means a person that is registered with the 
Commission as a swap dealer or major swap participant pursuant to 
the Act.
    Third-party relationship program means a written program 
reasonably designed to identify, monitor, manage, and assess risks 
relating to third-party relationships and that meets the 
requirements of paragraph (e) of this section.
    (b) Generally. (1) Purpose and scope. Each swap entity shall 
establish, document, implement, and maintain an Operational 
Resilience Framework reasonably designed to identify, monitor, 
manage, and assess risks relating to:
    (i) information and technology security;
    (ii) third-party relationships; and
    (iii) emergencies or other significant disruptions to the 
continuity of normal business operations as a swap entity.
    (2) Components. The Operational Resilience Framework shall 
include an information and technology security program, a third-
party relationship program, and a business continuity and disaster 
recovery plan. Each component program or plan shall be supported by 
written policies and procedures.
    (3) Standard. The Operational Resilience Framework shall be 
appropriate and proportionate to the nature, size, scope, 
complexity, and risk profile of its business activities as a swap 
entity, following generally accepted standards and best practices.
    (c) Governance. (1) Approval of components. Each component 
program or plan required by paragraph (b)(2) of this section shall 
be approved in writing, on at least an annual basis, by either the 
senior officer, an oversight body, or a senior-level official of the 
swap entity.
    (2) Risk appetite and risk tolerance limits. (i) Each swap 
entity shall establish and implement appropriate risk appetite and 
risk tolerance limits with respect to the risk areas identified in 
paragraph (b)(1) of this section.
    (ii) The risk appetite and risk tolerance limits established 
pursuant to paragraph (c)(2)(i) of this section shall be reviewed 
and approved in writing on at least an annual basis by either the 
senior officer, an oversight body, or a senior-level official of the 
swap entity.
    (3) Internal escalations. The senior officer, an oversight body, 
or a senior-level official of the swap entity shall be notified of:
    (i) circumstances that exceed risk tolerance limits established 
and approved pursuant to paragraph (c)(2)(i) of this section; and
    (ii) incidents that require notification pursuant to paragraphs 
(i) or (j) of this section.
    (4) Swap entities forming part of a larger enterprise. (i) 
Generally. A swap entity may satisfy the requirements of paragraph 
(b)(2) of this section through its participation in a consolidated 
program or plan, provided that each consolidated program or plan 
meets the requirements of this section.
    (ii) Attestation. A swap entity that relies on a consolidated 
program or plan pursuant to paragraph (c)(4)(i) of this section may 
satisfy the requirements in paragraphs (c)(1) and (c)(2)(ii) of this 
section provided that either the senior officer, an oversight body, 
or a senior-level official of the swap entity attests in writing, on 
at least an annual basis, that the consolidated program or plan 
meets the requirements of this section and reflects a risk appetite 
and risk tolerance limits appropriate to the swap entity.
    (d) Information and technology security program. (1) Risk 
assessment.
    (i) The information and technology security program shall 
require the swap entity to conduct and document the results of a 
comprehensive risk assessment reasonably designed to identify, 
assess, and prioritize risks to information and technology security.
    (ii) Such risk assessment shall be conducted at a frequency 
consistent with the standard set forth in paragraph (b)(3) of this 
section, but at least annually, and be conducted by personnel not 
responsible for the development or implementation of covered 
technology or related controls.
    (iii) The results of the risk assessment shall be provided to 
the oversight body, senior officer, or other senior-level official 
who approves the information and technology security program upon 
the risk assessment's completion.
    (2) Effective controls. The information and technology security 
program shall require the swap entity to establish, document, 
implement, and maintain controls reasonably designed to prevent, 
detect, and mitigate identified risks to information and technology 
security. Each swap entity shall consider, at a minimum, the 
following types of controls and adopt those consistent with the 
standard set forth in paragraph (b)(3) of this section:
    (i) Access controls on covered technology, including controls to 
authenticate and permit access only by authorized individuals and 
controls preventing misappropriation or misuse of covered 
information by employees;
    (ii) Access restrictions designed to permit only authorized 
individuals to access physical locations containing covered 
information, including, but not limited to, buildings, computer 
facilities, and records storage facilities;
    (iii) Encryption of electronic covered information, including 
while in transit or in storage on networks or systems, to which 
unauthorized individuals may have access;
    (iv) Dual control procedures, segregation of duties, and 
background checks for employees or third-party service providers 
with responsibilities for or access to covered information;
    (v) Change management practices, including defined roles and 
responsibilities, logging, and monitoring practices;
    (vi) Systems development and configuration management practices, 
including practices for initializing, changing, testing, and 
monitoring configurations;
    (vii) Flaw remediation, including vulnerability patching 
practices;
    (viii) Measures to protect against destruction, loss, or damage 
of covered information due to potential environmental hazards, such 
as fire and water damage or technological failures;
    (ix) Monitoring systems and procedures to detect actual and 
attempted attacks on or intrusions into covered technology;
    (x) Response programs that specify actions to be taken when the 
swap entity suspects or detects that unauthorized individuals have 
gained access to covered technology, including appropriate reports 
to regulatory and law enforcement agencies; and
    (xi) Measures to promptly recover and secure any compromised 
covered information.
    (3) Incident response plan. The information and technology 
security program shall include a written incident response plan that 
is reasonably designed to detect, assess, contain, mitigate the 
impact of, and recover from an incident. This incident response plan 
shall include, at a minimum:
    (i) The roles and responsibilities of the swap entity's 
management, staff, and third-party service providers in responding 
to incidents;
    (ii) Escalation protocols, including a requirement to timely 
inform the oversight body, senior officer, or other senior-level 
official that has primary responsibility for overseeing the 
information and technology security program; the chief compliance 
officer of the swap entity; and any other relevant personnel of 
incidents that may

[[Page 4758]]

significantly impact the swap entity's regulatory obligations or 
require notification to the Commission;
    (iii) The points of contact for external coordination of 
incident responses as determined necessary by the swap entity based 
on the severity of incidents;
    (iv) The required reporting of incidents, whether by internal 
policy, contract, or law, including as required in this section;
    (v) Procedures for documenting incidents and managements' 
response; and
    (vi) The remediation of weaknesses in information and technology 
security, controls, and training, if any.
    (e) Third-party relationship program. (1) Third-party 
relationship lifecycle stages. The third-party relationship program 
shall describe how the swap entity addresses the risks attendant to 
each stage of the third-party relationship lifecycle, including:
    (i) Pre-selection risk assessment;
    (ii) Due diligence of prospective third-party service providers;
    (iii) Contractual negotiations;
    (iv) Ongoing monitoring; and
    (v) Termination, including preparations for planned and 
unplanned terminations.
    (2) Heightened duties for critical third-party service 
providers. The third-party relationship program shall establish 
heightened due diligence practices for potential critical third-
party service providers and heightened monitoring for critical 
third-party service providers.
    (3) Third-party service provider inventory. As part of its 
third-party relationship program, each swap entity shall create, 
maintain, and regularly update an inventory of third-party service 
providers the swap entity has engaged to support its activities as a 
swap entity, identifying whether each third-party service provider 
in the inventory is a critical third-party service provider.
    (3) Retention of responsibility. Notwithstanding a swap entity's 
determination to rely on a third-party service provider, each swap 
entity remains responsible for meeting its obligations under the Act 
and Commission regulations.
    (4) Guidance on third-party relationship programs. For guidance 
outlining potential risks, considerations, and strategies for 
developing a third-party relationship program consistent with 
paragraph (e), see Appendix A to Subpart J of this part.
    (f) Business continuity and disaster recovery plan. (1) Purpose. 
The business continuity and disaster recovery plan shall be 
reasonably designed to enable the swap entity to:
    (i) Continue or resume normal business operations with minimal 
disruption to counterparties and the markets; and
    (ii) Recover and make use of covered information, as well as any 
other data, information, or documentation required to be maintained 
by law and regulation.
    (2) Minimum contents. The business continuity and disaster 
recovery plan shall, at a minimum:
    (i) Identify covered information, as well as any other data or 
information required to be maintained by law and regulation, and 
establish and implement procedures to backup or copy all such data 
and information with sufficient frequency to meet the requirements 
of this section and to store such data and information off-site in 
either hard-copy or electronic format;
    (ii) Identify any resources, including covered technology, 
facilities, infrastructure, personnel, and competencies, essential 
to the operations of the swap entity or to fulfill the regulatory 
obligations of the swap entity, and establish and maintain 
procedures and arrangements to provide for their backup in a manner 
that is sufficient to meet the requirements of this section. Such 
arrangements must provide for backups that are located in one or 
more areas that are geographically separate from the swap entity's 
primary systems, facilities, infrastructure, and personnel, and may 
include the use of resources provided by third-party service 
providers;
    (iii) Identify potential disruptions to critical third-party 
service providers and establish a plan to minimize the impact of 
such disruptions;
    (iv) Identify supervisory personnel responsible for implementing 
each aspect of the business continuity and disaster recovery plan, 
including the emergency contacts required to be provided pursuant to 
paragraph (k) of this section; and
    (v) Establish a plan for communicating with the following 
persons in the event of an emergency or other significant 
disruption, to the extent applicable: employees; counterparties; 
swap data repositories; execution facilities; trading facilities; 
clearing facilities; regulatory authorities; data, communications 
and infrastructure providers and other vendors; disaster recovery 
specialists; and other persons essential to the recovery of 
documentation and data, the resumption of operations, and compliance 
with the Act and Commission regulations.
    (3) Accessibility. Each swap entity shall maintain copies of its 
business continuity and disaster recovery plan at one or more 
accessible off-site locations.
    (g) Training and distribution. (1) Training. Each swap entity 
shall establish, implement, and maintain training with respect to 
all aspects of the Operational Resilience Framework, including, but 
not limited to:
    (i) Cybersecurity awareness training for all personnel; and
    (ii) Role-specific training for personnel involved in 
establishing, documenting, implementing, and maintaining the 
Operational Resilience Framework.
    (2) Frequency. Each swap entity shall provide and update the 
training required in paragraph (g)(1) as necessary, but no less 
frequently than annually.
    (3) Distribution. Each swap entity shall distribute copies of 
each component program or plan required by paragraph (b)(2) of this 
section to relevant personnel and promptly provide any significant 
revisions thereto.
    (h) Reviews and Testing. Each swap entity shall establish, 
implement, and maintain a plan reasonably designed to assess its 
adherence to, and the effectiveness of, its Operational Resilience 
Framework through regular reviews and risk-based testing.
    (1) Reviews. Reviews of the Operational Resilience Framework 
shall be conducted at least annually and in connection with any 
material change to the activities or operations of the swap entity 
that is reasonably likely to affect the risks identified in 
paragraph (b)(1) of this section. Reviews shall include an analysis 
of adherence to, and the effectiveness of, the Operational 
Resilience Framework and any recommendations for modifications or 
improvements that address root causes of any issues identified by 
the review.
    (2) Testing. The frequency, nature, and scope of risk-based 
testing of the Operational Resilience Framework shall be determined 
by the swap entity, consistent with the standard in paragraph (b)(3) 
of this section.
    (i) Testing of the information and technology security program 
shall include, at a minimum:
    (A) Testing of key controls and the incident response plan at 
least annually;
    (B) Vulnerability assessments, including daily or continuous 
automated vulnerability scans; and
    (C) Penetration testing at least annually.
    (ii) Testing of the business continuity and disaster recovery 
plan shall include, at a minimum, a walk-through or tabletop 
exercise designed to test the effectiveness of backup facilities and 
capabilities at least annually.
    (3) Independence. The reviews and testing shall be conducted by 
qualified personnel who are independent of the aspect of the 
Operational Resilience Framework being reviewed or tested.
    (4) Documentation. Each swap entity shall document all reviews 
and testing of the Operational Resilience Framework. The 
documentation shall, at a minimum, include:
    (i) The date the review or testing was conducted;
    (ii) The nature and scope of the review or testing, including 
methodologies employed;
    (iii) The results of the review or testing, including any 
assessment of effectiveness;
    (iv) Any identified deficiencies and recommendations for 
remediation; and
    (v) Any corrective action(s) taken or initiated, including the 
date(s) such action(s) were taken.
    (5) Internal reporting. Each swap entity shall report on the 
results of its reviews and testing to the swap entity's chief 
compliance officer and any other relevant senior-level official(s) 
and oversight body(ies).
    (i) Notifications to the Commission. (1) Incidents.
    (i) Notification trigger. Each swap entity shall notify the 
Commission of any incident that adversely impacts, or is reasonably 
likely to adversely impact:
    (A) Information and technology security;
    (B) The ability of the swap entity to continue its business 
activities as a swap entity; or
    (C) The assets or positions of a counterparty of the swap 
entity.
    (ii) Contents. The notification shall provide any information 
available to the swap entity at the time of notification that may 
assist the Commission in assessing and responding to the incident, 
including the date the incident was detected, possible cause(s) of 
the incident, its apparent or likely impacts, and any actions the 
swap entity has taken or is taking to mitigate or recover from the

[[Page 4759]]

incident, including measures to protect counterparties.
    (iii) Timing and method. Each swap entity shall provide the 
incident notification as soon as possible but in any event no later 
than 24 hours after such incident has been detected. The 
notification shall be provided via email to [email protected].
    (2) Business continuity and disaster recovery plan activation. 
(i) Notification trigger. Each swap entity shall notify the 
Commission of any determination to activate the business continuity 
and disaster recovery plan.
    (ii) Contents. The notification shall provide any information 
available to the swap entity at the time of notification that may 
assist the Commission in assessing or responding to the emergency or 
disruption, including the date of the emergency or disruption, a 
description thereof, the possible cause(s), its apparent or likely 
impacts, and any actions the swap entity has taken or is taking to 
mitigate or recover from the emergency or disruption, including 
measures taken or being taken to protect counterparties.
    (iii) Timing and method. Each swap entity shall provide the 
business continuity and disaster recovery plan activation 
notification within 24 hours of determining to activate the business 
continuity and disaster recovery plan. The notification shall be 
provided via email to [email protected].
    (j) Notification of incidents to affected counterparties. (1) 
Notification trigger. Each swap entity shall notify a counterparty 
as soon as possible of any incident that is reasonably likely to 
have adversely affected the confidentiality or integrity of the 
counterparty's covered information, assets, or positions.
    (2) Contents. The notification to affected counterparties shall 
include information necessary for the affected counterparty to 
understand and assess the potential impact of the incident on its 
information, assets, or positions, and to take any necessary action. 
Such notification shall include, at a minimum:
    (i) A description of the incident;
    (ii) The particular way in which the counterparty, or its 
covered information, may have been adversely impacted;
    (iii) Measures being taken by the swap entity to protect against 
further harm; and
    (iv) Contact information for the swap entity where the 
counterparty may learn more about the incident or ask questions.
    (k) Emergency Contacts. (1) Each swap entity shall provide the 
Commission the name and contact information of:
    (i) Two employees whom the Commission may contact in connection 
with incidents triggering notification to the Commission under 
paragraph (i)(1) of this section; and
    (ii) Two employees whom the Commission may contact in connection 
with the activation of the swap entity's business continuity and 
disaster recovery plan triggering notification to the Commission 
under paragraph (i)(2) of this section.
    (2) The identified employees shall be authorized to make key 
decisions on behalf of the swap entity and have knowledge of the 
swap entity's incident response plan or business continuity and 
disaster recovery plan, as appropriate.
    (3) The swap entity shall update its emergency contacts with the 
Commission as necessary.
    (l) Recordkeeping. Each swap entity shall maintain all records 
required to be maintained pursuant to this section in accordance 
with section 1.31 of this chapter and shall make them available 
promptly upon request to representatives of the Commission and to 
representatives of applicable prudential regulators, as defined in 
section 1a(39) of the Act.
0
6. Add appendix A to subpart J of part 23 to read as follows:

Appendix A to Subpart J of Part 23--Guidance on Third-Party 
Relationship Programs

    The following guidance offers factors, actions, and strategies 
for swap entities to consider in preparing and implementing third-
party relationship programs reasonably designed to identify, 
monitor, manage, and assess risks relating to third-party 
relationships, as required by Commission regulation 23.603. The 
guidance is also not intended to reduce or replace the obligation of 
swap entities to comply with the requirements in Commission 
regulation 23.603, including the requirement to ensure that each 
swap entity's Operational Resilience Framework is appropriate and 
proportionate to the nature, size, scope, complexity, and risk 
profile of its business activities as a swap entity, following 
generally accepted standards and best practices. The guidance is not 
exhaustive and is nonbinding.
    The guidance is written to be broadly relevant to all swap 
entities, but it may not be universally applicable. The degree to 
which the guidance would be applicable to a particular swap entity 
would depend on its unique facts and circumstances and may vary from 
relationship to relationship. Each swap entity should assess the 
relevance of the guidance as it applies to its particular risk 
profile and tailor its third-party relationship program accordingly.
    Comparable guidance for futures commission merchants is included 
in Appendix A to part 1 of the Commission's regulations.

A. Pre-Selection Risk Assessment--Commission Regulation 23.603(e)(1)(i)

    Before entering into a third-party relationship, swap entities 
should determine which services should be performed by a third-party 
and plan for how to manage associated risks. The Commission 
appreciates that reliance on third-party service providers may be 
unavoidable, particularly given the rapid pace of technological 
innovation, which may render it uneconomical or even infeasible for 
financial institutions to meet all of their technological needs in-
house.
    Nevertheless, given the risks associated with relying on third-
party service providers, and that each additional third-party 
relationship a swap entity employs is likely to add further risk and 
complexity, a swap entity's third-party relationship program should 
include a deliberative process for affirmatively determining whether 
to source a particular service from a third-party service provider. 
In determining whether a particular function should be performed by 
a third-party service provider, swap entities should consider 
whether:
     The service would support the swap entity's strategic 
goals and objectives.
     The same goals and objectives could be addressed 
through an alternative means that may not require reliance on a 
third-party service provider.
     The swap entity has or could otherwise secure the 
resources, financial and otherwise, to effectively monitor the 
third-party service provider.
     Relevant and reputable third-party service providers 
are available.
     The provision of the service would implicate 
information and technology security concerns, including by requiring 
the third-party service provider to obtain access to covered 
information or provide covered technology.
     A disruption of the service would have a negative 
impact on counterparties or regulatory compliance.
     The relationship could be structured to reduce 
associated risks, such as by limiting the third-party service 
provider's access to covered information or covered technology.
     Lack of direct control over performance of the service 
would present unacceptable risk, i.e., risk outside the swap 
entity's risk tolerance limits.
    As the above considerations illustrate, swap entities should 
consider ways in which they might structure their third-party 
relationships to reduce the associated risks. For example, where 
giving a third-party service provider direct access to its 
technology or data may be outside a swap entity's risk tolerance, 
structuring the relationship to provide the third-party service 
provider access on a read-only basis or via reports delivered by the 
swap entity could render the relationship more acceptable. Swap 
entities should therefore consider the availability of safer means 
of performing the service as part of their assessment.
    Changes in technology, businesses practices, regulation, market 
structure, market participants (e.g., new entrants to the market), 
or service delivery may change the risk profile of the third-party 
relationship over time. Accordingly, swap entities should consider 
periodically reassessing their selection of services to be performed 
by third-party service providers. Swap entities should stay abreast 
of these changes by monitoring the external environment and 
communicating with current and prospective service providers and 
other participants in industry.

B. Due Diligence in Selecting Third-Party Service Providers--Commission 
Regulation 23.603(e)(1)(ii)

    After a swap entity has determined that a service is suitable 
for a third-party to perform, it should conduct due diligence on 
prospective third-party service providers. Due diligence provides 
swap entities with the information they need to assess and conclude, 
with a reasonable level of assurance, that the prospective third-
party service provider is capable of effectively

[[Page 4760]]

providing the service as expected, adhering to the swap entity's 
policies, maintaining the swap entity's compliance with Commission 
regulations, and protecting covered information. Appropriate due 
diligence should also enable swap entities to evaluate whether they 
would be able to effectively monitor and manage the risks associated 
with a particular third-party relationship.
    Due diligence may be conducted before or contemporaneously with 
contractual negotiations with prospective third-party service 
providers but should be concluded prior to executing any agreements. 
Swap entities should conduct due diligence even in situations where, 
for a particular service, there may only be one or a small number of 
providers with a dominant market share whose services are used by 
all or most of the swap entities' industry peers, and swap entities 
should not rely solely on those providers' reputations or prior 
experience with them. The depth and rigor of the due diligence 
should be proportionate to the nature of the third-party 
relationship, with the required heightened due diligence required 
for potential critical third-party service providers pursuant to 
Commission regulation 23.603(e)(2). Specifically, when conducting 
due diligence for a potential critical third-party servicer 
provider, swap entities should expand the type and sources of 
information they rely on, the rigor and scrutiny they apply in 
reviewing the information to identify potential risks, and the level 
of confidence in their assessment of the third-party service 
provider's ability to perform.
    When establishing their due diligence protocols, swap entities 
should consider the full range of risks that reliance on the third-
party service providers could introduce in light of the nature of 
the service they would be performing. Relevant considerations with 
respect to the potential third-party service provider include its:
     Financial condition, business experience and 
reputation, and business prospects, particularly the third-party 
service provider's experience providing services to financial 
institutions.
     Background, experience, and qualifications with respect 
to key personnel.
     Information and technology security practices, 
including incident reporting and incident management programs, and 
whether there are clearly documented processes for identifying and 
escalating incidents.
     Risk management practices, including governance, 
controls, testing, and issue management practices, as well as the 
results of any independent risk assessments.
     Regulatory environment, including the legal 
jurisdiction in which it is based and applicable regulatory or 
licensing requirements.
     History of disruptions to operations, including whether 
the third-party service provider has suffered incidents that would 
meet the standard for reporting to the Commission in Commission 
regulation 23.603(i).
     Violations of legal, compliance, or contractual 
obligations, including civil or criminal proceedings or 
administrative enforcement actions, including from self-regulatory 
organizations.
     Understanding of Commission regulatory requirements 
applicable to the swap entity.
     Use of and reliance on subcontractors, including the 
volume and types of subcontracted activities, and the third-party 
service provider's process for identifying, assessing, managing, and 
monitoring associated risks.
     Business continuity and contingency plans.
     Financial protections, such as insurance coverage 
against losses or liabilities from intentional or negligent acts or 
hazards involving physical destruction and data or documentation 
losses.
    Swap entities should memorialize their assessment of these 
factors and identify how the review was heightened for critical 
third-party service providers. Swap entities should not rely solely 
on their prior knowledge of or experience with a potential third-
party. Potential sources of due diligence information include:
     Audit reports, including pooled audit plans, and System 
and Organizational Controls (SOC) reports.
     Financial statements and projections and relevant 
accompanying information (e.g., annual or quarterly reports, 
management commentary, auditors' opinions, and investor relations 
materials).
     Incident response plans, including the results of 
recent testing or assessments thereof.
     Business continuity and disaster recovery plans, as 
well as the result of recent testing or assessments thereof.
     Public filings.
     News reports, trade publications, and press releases.
     Reports from market intelligence providers.
     References from current or previous customers, or other 
parties which have had business relationships with the third-party 
service provider.
     Informal industry discussions.
     Information provided directly by the third-party 
service provider, such as internal performance metrics.
    Obtaining and reviewing audit reports, including SOC reports, 
may be of particular value for conducting heightened due diligence 
of critical third-party service providers. In certain circumstances, 
swap entities may not be able to gather all the information 
necessary to reach an informed conclusion that a prospective third-
party service provider is an adequate provider. Examples include 
instances where the third-party service provider is a new entrant 
into the market and little information exists; where information 
provided by the third-party service provider is insufficient or 
appears unreliable; or where the third-party service provider is 
reluctant to provide internal information. In such cases, the swap 
entity should identify and document the limitations of its due 
diligence, the attendant risks, and any available methods for 
mitigating them (e.g., obtaining alternate information, implementing 
enhanced monitoring or controls, negotiating protective contractual 
provisions). Ultimately, such factors could weigh against the use of 
the potential third-party service provider, particularly a potential 
critical third-party service provider. Swap entities that proceed 
with the third-party service arrangements notwithstanding the 
limited due diligence should do so with caution, applying heightened 
scrutiny of the information they do receive, and consider the 
implementation of their own mitigating controls to compensate for 
the uncertainty.

C. Contractual Negotiations--Commission Regulation 23.603(e)(1)(iii)

    After selecting a third-party service provider, swap entities 
should proceed to finalizing the agreement, typically through 
entering into an enforceable written contract. Written contracts are 
an important tool for clarifying the scope of services to be 
delivered, establishing standards or performance benchmarks, 
allocating risks and responsibilities, and facilitating resolution 
of disputes. They can also reduce the risks of non-performance and 
assist in monitoring the third-party service provider. Because of 
their importance, the Commission recommends that swap entities enter 
written agreements with third-party service providers before 
services are delivered, particularly with critical third-party 
service providers.
    In negotiating a written contract, swap entities should seek to 
negotiate contractual provisions that would support their ability to 
mitigate, manage, and monitor the risks associated with the 
relationship, as identified through their initial pre-selection and 
due diligence activities. The contractual provisions should be 
informed by the nature of the service provided and be proportionate 
to the criticality of the services provided. In particular, swap 
entities should consider negotiating for the contract to include the 
following provisions:
     Timely notification to the swap entity of any incidents 
suffered by third-party service providers, or of significant 
disruptions to the operations of the third-party service provider.
     Timely notification to the swap entity of any material 
changes to the services provided.
     Required periodic, independent audits of the third-
party service provider, the results of which would be shared with 
the swap entity.
     Restrictions on the third-party service provider's use 
of the swap entity's covered information, except as necessary to 
deliver the service or meet legal obligations.
     Security measures to protect the swap entity's covered 
information and covered technology to which the third-party service 
provider has access.
     Insurance, guarantees, indemnification, and limitations 
on liability.
     Dispute resolution procedures.
     Performance measures or benchmarks.
     Remediation of identified performance issues.
     Compliance with regulatory requirements, including 
reasonable assurances that the third-party service provider is 
willing and able to coordinate with the swap entity for the purpose 
of ensuring the swap entity complies with its legal and regulatory 
obligations.
     Use of subcontractors, including notification or 
approval procedures for their use, the extension of contractual 
rights of the

[[Page 4761]]

swap entity against the third-party service provider to its 
subcontractors, and contractual obligations for reporting on or 
oversight of subcontractors.
     Termination provisions, including rights to terminate 
following breaches of the third-party service provider's 
obligations, notice requirements, obligations of the third-party 
service provider to provide support for a successful transition, and 
the return or destruction of records or covered information, as 
further described in section E of this guidance.
     Information sharing necessary to facilitate other 
provisions of this proposed guidance (for example, reporting 
requirements to support ongoing monitoring, as discussed in section 
D of this guidance, or notice requirements for termination, as 
discussed in section E of this guidance).
    These provisions focus on key risk factors generally associated 
with third-party service provider relationships. They are not 
exhaustive of all contractual provisions swap entities should seek 
to include in their written contracts, including ordinary commercial 
contract terms (e.g., choice of law provisions) and terms that may 
relate only to specific services, among other provisions. While 
third-parties may initially offer a standard contract, a swap entity 
may seek to request modifications, additional contractual 
provisions, or addendums to satisfy its needs. Swap entities should 
work to tailor the level of detail and comprehensiveness of the 
contractual provisions based on the risk and complexity posed by the 
particular third-party relationship, contracts with critical third-
party service providers likely being the most tailored.
    In some circumstances, a swap entity may be at a bargaining 
power disadvantage, which prevents it from negotiating optimal 
contractual provisions. For example, a prospective third-party 
service provider may be the sole provider of a service or may have 
such dominant market share that it can offer its services on a 
``take-it-or-leave-it'' basis. In such situations, the swap entity 
should work to understand any resulting limitations in the contract 
and attendant risks and consider whether it can achieve outcomes 
comparable to those provided by contractual protections through non-
contractual means. Examples could include the swap entity 
implementing additional controls, augmenting its monitoring of the 
third-party service provider using public sources or market 
intelligence services, or purchasing insurance. The swap entity 
should make an assessment, however, of whether these alternatives 
would provide an adequate substitute for the unobtained contractual 
protections and document its assessment and mitigation plan, 
considering its risk appetite and risk tolerance limits. Where a 
third-party service provider is unable or unwilling to agree to 
provisions necessary for the swap entity to meet its obligations 
under Commission regulations, particularly a critical third-party 
service provider, the swap entity should consider finding an 
alternative third-party service provider.

D. Ongoing Monitoring--Commission Regulation 23.603(e)(1)(iv)

    After a third-party service provider has initiated performance, 
swap entities should engage in ongoing monitoring. Ongoing 
monitoring is important to ensure the third-party service provider 
is properly carrying out its outsourced function and contractual 
obligations, as well as meeting quality or performance expectations. 
Effective monitoring can aid swap entities in the early 
identification of performance deficits, allowing for a quicker 
response that may then mitigate the impact.
    Ongoing monitoring should occur throughout the duration of a 
third-party relationship, commensurate with the level of risk and 
complexity of the relationship and the activity performed by the 
third-party. Examples of possible monitoring activities include:
     Reviewing reports on performance and effectiveness of 
controls, including independent audit reports and SOC reports.
     Periodic on-site visits or meetings to discuss open 
issues and plans for changes to the relationship.
     Reviewing updated due diligence information.
     Documenting service-level agreements with the third-
party service provider to establish performance targets.
     Establishing measures for the third-party service 
provider to identify, record, and remediate instances of failure to 
meet contractual obligations or unsatisfactory performance and to 
report such instances to the swap entity on a timely basis.
     Direct testing of the third-party service provider's 
control environment.
    The frequency and depth of the swap entity's monitoring 
activities should reflect the nature of the third-party 
relationship, including heightened monitoring for critical third-
party service providers, and may change over the duration of the 
relationship. The swap entity should dedicate sufficient staffing 
resources to its monitoring activities and be particularly alert to 
any circumstances that could signal that a third-party service 
provider may not be able to perform to an acceptable standard. A 
swap entity should be cognizant that certain events may trigger the 
need for it to take further action, including terminating its 
relationship with the third-party service provider. Such events 
could include cyberattacks, natural disasters, financial distress or 
insolvency, adverse or qualified audit opinions, or litigation or 
enforcement actions.
    In addition to the continuous monitoring described above, swap 
entities should periodically review and reevaluate their 
relationships with third-party service providers holistically. Such 
reviews should be more thorough than routine monitoring and may 
involve additional personnel, such as in-house or outside auditors, 
compliance and risk functions, information technology staff, or by a 
central function or committee whose visibility into other third-
party relationships could provide valuable context for the 
relationship at issue. Additionally, to the extent a swap entity 
uses enterprise risk management techniques, it should seek to 
integrate the information gathered from its ongoing monitoring with 
those practices. For example, to the extent that a swap entity 
maintains a standardized approach across risk types to escalate 
concerns or issues to senior management or governance bodies (e.g., 
through the use of predefined criteria or escalation paths), the 
swap entity should consider using the same protocols for escalating 
concerns identified through its ongoing monitoring of third-party 
service providers. The ongoing monitoring approach itself may be 
subject to enterprise risk management practices, such as periodic 
self-assessment for effectiveness, independent testing, and quality 
assurance.
    To the extent that monitoring activities reveal a change in 
their assessment of the risks associated with the third-party 
relationship, swap entities should adjust the frequency and types of 
monitoring they conduct, including reports, regular testing, and on-
site visits. One example of information that may change the level of 
monitoring is a notification that a third-party service provider has 
suffered or may suffer from a severe adverse event that could 
trigger a material change in the systems or process used to carry 
out an outsourced function.

E. Terminating the Third-Party Relationship--Commission Regulation 
23.603(e)(1)(v)

    Swap entities should ensure that their third-party service 
provider relationship programs include advance preparation for the 
termination of the third-party relationship to ensure an orderly 
transition. Swap entities should prepare for both planned 
terminations (i.e., where one or both parties elects to end the 
relationship pursuant to their contract) and unplanned terminations 
(e.g., following a sudden withdrawal of the third-party service). 
The programs should include both the contractual provisions for 
terminating the service (termination provisions), and the swap 
entity's plan to facilitate an orderly transition of the function to 
an alternative provider or to bring it in-house (exit strategy). The 
goal of termination planning is to support an efficient transition 
to alternative arrangements for the provision of the service, 
regardless of the circumstances of the termination.
    Termination provisions include all terms needed by the swap 
entity to wind down a third-party service relationship while 
ensuring that the swap entity can continue to serve its 
counterparties without interruption and to meet its regulatory 
compliance obligations. Because information, data, staff training, 
and knowledge may reside in the third-party service provider, there 
is an increased risk of disruption during the termination phase. 
When negotiating termination provisions, a swap entity should ensure 
that the terms negotiated support its exit strategy. For example, a 
swap entity should ensure that termination rights are accompanied by 
notice periods that leave the swap entity enough time to find an 
alternative provider (or to provide the service itself) to ensure an 
orderly transition.
    Similarly, the swap entity should ensure that all customer data 
or other covered information in the third-party service provider's 
possession is promptly returned to

[[Page 4762]]

the swap entity or destroyed, as appropriate. The swap entity should 
also verify that the third-party's access to its systems and covered 
information ceases at termination. Swap entities should also 
consider negotiating more stringent terms for third-party service 
providers that breach their obligations under the agreement, other 
than for ``no-fault'' terminations. Such breaches may signal an 
inability of the third-party service provider to provide the 
services contracted for and thereby threaten the ability of the swap 
entity to serve its customers and meet its regulatory obligations. 
(See section C of this guidance for examples of termination 
provisions.)
    Swap entities' exit strategies should include the steps needed 
to end the service provision with the third-party service provider 
and retain a new service provider or begin providing the service in-
house. Although elements of an exit strategy may be reflected in 
termination provisions, not all elements of the exit strategy may be 
suitable for the contract. Examples include approvals, 
identification of alternative providers, description of the roles of 
staff in the swap entity, and other internal matters. These elements 
may be memorialized in a procedure or similar document, such as the 
third-party relationship program. The exit strategy should contain 
the internal steps to be taken to ensure notification to the third-
party service provider, identification of the proposed new provider, 
or, if bringing the function in-house, the hiring and training of 
personnel, development of procedures, and launch of new technology, 
along with the time periods and responsible personnel for each.
    Swap entities should be aware that, in practice, implementing an 
exit strategy may be complex and time-consuming and that the 
exercise of termination arrangements may be difficult. Swap entities 
should also be aware that some third parties possess expertise that 
is not readily available and plan accordingly. Swap entities should 
ensure that their plans are flexible enough to account for a range 
of plausible termination scenarios, including situations where the 
third-party service provider rapidly becomes unviable. Swap entities 
may need to design backup or interim procedures sufficient to meet 
regulatory requirements in such situations.

    Issued in Washington, DC, on December 22, 2023, by the 
Commission.
Robert Sidman,
Deputy Secretary of the Commission.

    NOTE:  The following appendices will not appear in the Code of 
Federal Regulations.

Appendices to Operational Resilience Framework for Futures Commission 
Merchants, Swap Dealers, and Major Swap Participants--Voting Summary 
and Chairman's and Commissioners' Statements

Appendix 1--Voting Summary

    On this matter, Chairman Behnam, Commissioners Johnson, 
Goldsmith Romero, Mersinger and Pham voted in the affirmative. No 
Commissioner voted in the negative.

Appendix 2--Statement of Support of Chairman Rostin Behnam

    I support the Commission's approval of the notice of proposed 
rulemaking to require futures commission merchants (FCMs), swap 
dealers (SDs), and major swap participants (MSPs) to establish an 
operational resilience framework (ORF).
    The proposal recognizes that while FCMs, SDs, and MSPs 
(collectively, ``covered entities'') have generally withstood 
challenging market conditions since the Commission promulgated its 
risk management program requirements over a decade ago, the 
Commission must bolster that foundational framework to promote 
operational resilience in the face of increasingly sophisticated 
cyberattacks and heightened technological disruptions. A strong ORF 
is especially important as the financial sector increasingly relies 
on third-party service providers; the disruption of which can lead 
to major interruptions in--and potential corruption of--FCM and SD 
operations. In addition to market impacts, events like these may 
impact covered entities' ability to comply with the Commission's 
statutory and regulatory requirements.
    FCMs' customers and SDs' counterparties expect covered entities 
to take a 360-degree approach to identify, monitor, manage, and 
assess risks for potential vulnerabilities. Similarly, the 
Commission must identify, monitor, manage, and assess any potential 
gaps in its own risk management requirements that could impede sound 
risk management practices, expose the U.S. financial system to 
unmanaged risk, or weaken customer protection. Operational 
disruptions that place a covered entity's financial resources at 
risk; disrupt the segregation and protection of customer funds; 
hinder recordkeeping; introduce uncertainty or delay; or otherwise 
inject operational risk into the derivatives market must be avoided 
to the extent possible to ensure customers, counterparties, and 
market participants have confidence in the integrity of our markets.
    The operational resilience framework proposal is the product of 
many months of in-depth research regarding operational resilience 
standards and guidance issued by the prudential regulators, the U.S. 
Securities and Exchange Commission, the National Futures 
Association, the International Organization of Securities 
Commissions, the Financial Stability Board, and other subject matter 
experts to avoid those operational disruptions and failures. The 
proposal also reflects staff's own observations and lessons learned 
from its own oversight activities.
    The proposal is a holistic, principles-based approach that is 
calibrated with certain minimum requirements. Specifically, the 
proposed rule would require covered entities to establish, document, 
implement, and maintain an ORF reasonably designed to identify, 
monitor, manage, and assess risks relating to three key risk areas: 
(1) information and technology security, (2) third-party 
relationships, and (3) emergencies and other significant 
disruptions. The ORF would also include requirements related to 
governance, training, testing, and recordkeeping.
    The proposal would require covered entities to establish risk 
appetite and risk tolerance limits and would allow these registrants 
to rely on an information and technology security program, third-
party relationship program, or business continuity and disaster 
recovery plan in which the covered entity participates with one or 
more affiliates and that is managed and approved at the enterprise 
level. Testing would need to be risk-based and include, at a 
minimum, daily or continuous vulnerability assessment and annual 
penetration testing, among others. The proposed rule would also 
require certain notifications to the Commission and customers or 
counterparties. The Commission is also proposing non-binding 
guidance that FCMs and SDs could consider to identify factors, 
actions, and strategies as they design their third-party 
relationship programs.
    The Commission recognizes that covered entities subject to this 
proposal include many different business models. As a result, the 
proposal is tailored to accommodate firms that vary in size and 
complexity, including corporate structures in which operational 
resilience frameworks may be managed at an enterprise level and have 
governance arrangements with different reporting line structures. In 
the same vein, the proposed ORF standard would require covered 
entities to implement an ORF that is appropriate and proportionate 
to the nature, size, scope, complexity, and risk profile of the 
firm's business as an FCM or SD, following generally accepted 
standards and best practices.
    I look forward to reading the public's comments on how the 
proposed operational resilience framework requirements and guidance 
can strengthen the operational resilience of FCMs, SDs, and MSPs as 
well as help protect their respective customers and counterparties 
in the derivatives markets. The 75-day comment period will begin 
upon the Commission's publication of the release on its website.
    I thank staff in the Market Participants Division, Office of the 
General Counsel, and the Office of the Chief Economist for all of 
their work on the proposal.

Appendix 3--Statement of Commissioner Kristin N. Johnson

    Cyberattacks are an ever-increasing threat. The rising cost, 
frequency, and severity of cyber threats represent one of the most 
critical issues facing city, state, and federal government 
authorities, businesses in each sector of our economy, educational 
and philanthropic institutions, and significant energy and 
transportation infrastructure, and national security resources.
    Less than a month before the White House released its National 
Cybersecurity Strategy in March of this year, international media 
headlines reported a ransomware attack that demonstrated that ``big 
financial firms'' are among the most attractive targets of cyber 
threats.\1\ Even for firms that have successfully

[[Page 4763]]

developed business continuity plans to identify, assess, or mitigate 
cyber threats, the networked or interconnected systems that comprise 
our operational market infrastructure may still render 
sophisticated, well-resourced firms vulnerable to the knock-on 
effects of cyberattacks leveled against critical third-party service 
providers.
---------------------------------------------------------------------------

    \1\ James Rundle, Wall Street Journal, Cyberattack on ION 
Derivatives Unit Had Ripple Effects on Financial Markets (Feb. 10, 
2023), https://www.wsj.com/articles/cyberattack-on-ion-derivatives-unit-had-ripple-effects-on-financial-markets-11675979210.
---------------------------------------------------------------------------

    The ransomware attack, carried out on a critical third-party 
service provider, ION Cleared Derivatives,\2\ disrupted trade 
settlement and reconciliation in derivatives markets.
---------------------------------------------------------------------------

    \2\ See Press Release, ION Markets, Cleared Derivatives Cyber 
Event (Jan. 31, 2023), https://iongroup.com/press-release/markets/cleared-derivatives-cyber-event/.
---------------------------------------------------------------------------

    ION provides trading, clearing, analytics, treasury, and risk 
management services for capital markets and futures and derivatives 
markets. A significant number of market participants, including a 
notable number of futures commission merchants (FCMs), rely on ION 
for back-office trade processing and settlement of exchange-traded 
derivatives.
    The cyber-incident that disrupted ION's operations caused a 
ripple effect across markets, halting deal matching, requiring 
affected parties to rely on manual (old school) trade processing, 
and causing delays in reconciliation and information sharing and 
reporting.

MRAC Leads on Cyber Reform Discussions

    I sponsor the Market Risk Advisory Committee (MRAC). On March 8, 
2023, the MRAC held a first-of-its-kind convening focused on the 
interconnectedness of our markets and the potential for 
interconnectedness and correlation to amplify contagion in the event 
of successful cyberattacks against critical infrastructure 
resources.\3\ At the March MRAC meeting, Futures Industry 
Association (FIA) President Walt Lukken announced the creation of a 
Cyber Risk Taskforce, charged with ``recommend[ing] ways to improve 
the ability of the exchange-traded and cleared derivatives industry 
to withstand the disruptive impacts of a cyberattack.'' \4\
---------------------------------------------------------------------------

    \3\ Kristin N. Johnson, Commissioner, CFTC, Opening Statement 
Before the Market Risk Advisory Committee Meeting (Mar. 8, 2023), 
https://www.cftc.gov/PressRoom/SpeechesTestimony/johnsonstatement030823.
    \4\ Futures Industry Association, FIA Taskforce on Cyber Risk, 
After Action Report and Findings, at 3 (Sept. 28, 2023), https://www.fia.org/sites/default/files/2023-09/FIA_Taskforce%20on%20Cyber%20Risk_Recommendations_SEPT2023_Final2.pdf
.
---------------------------------------------------------------------------

    The After Action Report issued by the FIA at the conclusion of 
the Taskforce's work outlines the challenges that both markets and 
regulators faced as a result of the ION cyber-incident. Trade 
reconciliation for affected firms continued to lag. For weeks 
following the ION cyberattack, the Commission continued to work to 
consistently publish the Commitments of Traders (COT) report on a 
timely basis because ``reporting firms continu[ed] to experience . . 
. issues submitting timely and accurate data to the CFTC.'' \5\ The 
COT report is designed to help the public understand the dynamics of 
the futures and options on futures markets.\6\ The COT report is a 
reflection of the effectiveness of the Commission's surveillance of 
markets; it increases transparency and aids in price discovery. 
Thus, indirectly, the ION incident disrupted regulatory functions 
even though the cyberattack was not directed at the Commission nor 
any of the Commission's registrants.
---------------------------------------------------------------------------

    \5\ Press Release No. 8662-23, CFTC, CFTC Announces Postponement 
of Commitments of Traders Report (Feb. 16, 2023), https://www.cftc.gov/PressRoom/PressReleases/8662-23.
    \6\ CFTC, Commitments of Traders Reports Descriptions, https://www.cftc.gov/MarketReports/CommitmentsofTraders/index.htm.
---------------------------------------------------------------------------

    As a consequence, it is imperative to begin to examine the scope 
of our regulations governing cyber-system safeguards not only for 
registered market participants, but for mission-critical third-party 
service providers. There is increasing reliance on third parties for 
the provision of important services, particularly, for example, 
services that facilitate digital connectivity and cloud-based 
services.
    While outsourcing may allow companies to rely on outside 
expertise, reduce operating costs, and enhance operational 
infrastructure necessary for executing business activities, 
reliance, may, in some instances, create vulnerability and risks 
that must be identified, managed, and mitigated.

Operational Resilience Proposed Rulemaking

    Today, the Market Participants Division (MPD) has introduced a 
robust and comprehensive proposed rulemaking that addresses: 
business continuity and disaster planning, cybersecurity, and 
assessment of the risk posed by reliance on third parties. I want to 
commend MPD, in particular Pamela Geraghty, Elise Bruntel, Fern 
Simmons, and Amanda Olear.
    The Commission has the authority to direct swap entities (swap 
dealers and major swap participants) to establish this operational 
resilience framework under Section 4s(j)(2) and (7) of the Commodity 
Exchange Act (CEA), which require swap entities to establish risk 
management systems over their day-to-day business and their 
operational risk.\7\ Likewise, the Commission may require 
operational resilience framework of FCMs (collectively with swap 
entities, ``covered entities'') under Section 8a(5) of the CEA,\8\ 
which authorizes the Commission to promulgate regulations sufficient 
to accomplish the purposes of the CEA, including, for example, the 
need to maintain records of the operational risk of affiliates,\9\ 
and to establish safeguards to protect the confidentiality of 
nonpublic personal information.\10\
---------------------------------------------------------------------------

    \7\ 7 U.S.C. 6s(j)(2), (7).
    \8\ 7 U.S.C. 12a(5).
    \9\ 7 U.S.C. 6f.
    \10\ 7 U.S.C. 7b-2; 15 U.S.C. 6801.
---------------------------------------------------------------------------

    The proposed rulemaking sets out three major pillars of its 
operational resilience framework: (1) information and technology 
security; (2) a third-party relationship program to manage risks 
presented by mission-critical third-party service providers; and (3) 
a business continuity and disaster recovery plan.\11\
---------------------------------------------------------------------------

    \11\ Proposed Sec. Sec.  1.13(b)(2), 23.603(b)(2).
---------------------------------------------------------------------------

    Layered on top of the of the three pillars are corporate 
governance reforms that will dictate how each covered entity will 
incorporate the components of the plan into existing organizational 
structures. Each of the components of the operational resilience 
framework must be reviewed by senior leadership.\12\ Covered 
entities must also establish a risk appetite--the level of risk 
acceptable on an ongoing basis--and risk tolerance limits--the level 
of excess risk the entity is willing to accept should a particular 
risk materialize \13\--and the entities will be required to escalate 
incidents that exceed their risk tolerance limit.\14\ The rule also 
allows for flexibility for entities that function as a division or 
affiliate of a larger organization; such entities will be allowed to 
operate under the umbrella company's operational resilience plan so 
long as that plan meets the rule's requirements and considers the 
covered entity's particular risks.\15\
---------------------------------------------------------------------------

    \12\ Proposed Sec. Sec.  1.13(c)(1), 23.603(c)(1).
    \13\ Proposed Sec. Sec.  1.13(c)(1), 23.603(c)(2).
    \14\ Proposed Sec. Sec.  1.13(c)(3), 23.603(c)(3).
    \15\ Proposed Sec. Sec.  1.13(c)(4), 23.603(c)(4).
---------------------------------------------------------------------------

    The information and technology security program requires the 
covered entities to comprehensively assess, on at least an annual 
basis, the types of threats the entity faces, the entity's internal 
and external vulnerabilities, the likely impact of those threats or 
the exploitation of those vulnerabilities, and appropriate 
priorities for addressing those risks.\16\ With that background, 
covered entities must then implement controls reasonably designed to 
prevent, detect, and mitigate the identified risks, threats, and 
vulnerabilities.\17\ The program then requires the covered entities 
to develop a written incident response plan, reasonably designed to 
detect incidents where risks to information and technology are 
realized, and then provide for how the entity will mitigate the 
impact of and recover from such an incident.\18\
---------------------------------------------------------------------------

    \16\ Proposed Sec. Sec.  1.13(d)(1), 23.603(d)(1).
    \17\ Proposed Sec. Sec.  1.13(d)(2), 23.603(d)(2).
    \18\ Proposed Sec. Sec.  1.13(d)(3), 23.603(d)(3).
---------------------------------------------------------------------------

    The third-party relationship plan requires covered entities to 
understand the risks posed by all third-party service providers at 
each stage of the relationship: pre-selection, diligence, contract 
negotiation, ongoing monitoring, and termination.\19\ The proposed 
rule then imposes a heightened level of required diligence and 
monitoring for ``critical'' third parties, defined as those parties 
for whom disruption of performance on their service contract would 
either ``significantly disrupt'' the covered entity's business 
operations, or ``significantly and adversely impact'' the entity's 
counterparties or customers.\20\ Covered entities will also have to 
maintain an inventory of their critical and non-critical third-party 
service providers.\21\ Finally, regardless of any

[[Page 4764]]

decision to rely on a third-party service provider, each covered 
entity remains responsible for meeting its obligations under the CEA 
and Commission regulations.\22\
---------------------------------------------------------------------------

    \19\ Proposed Sec. Sec.  1.13(e)(1), 23.603(e)(1).
    \20\ Proposed Sec. Sec.  1.13(e)(2), 23.603(e)(2).
    \21\ Proposed Sec. Sec.  1.13(e)(3), 23.603(e)(3).
    \22\ Id.
---------------------------------------------------------------------------

    Each entity's business continuity and disaster recovery plan 
(BCDR plan) must ``outline[ ] the procedures to be followed in the 
event of an emergency or other disruption of its normal business 
activities.'' \23\ The goal of a BCDR plan will be to enable covered 
entities to continue or resume business operations with minimal 
disruption to customers, counterparties, or the markets, and recover 
any affected data or information.\24\ At minimum, the BCDR plan must 
define backup plans for covered information and data; identify 
essential technology, facilities, infrastructure, and personnel; 
identify potential disruptions to critical third-party service 
providers; and identify supervisory personnel responsible for 
carrying out the plan in the event of an emergency.\25\ Covered 
entities must also maintain the plan at one or more off-site 
locations.\26\
---------------------------------------------------------------------------

    \23\ See 17 CFR 23.603(a).
    \24\ Proposed Sec. Sec.  1.13(f)(1)(i)-(ii), 23.603(f)(1)(i)-
(ii).
    \25\ Proposed Sec. Sec.  1.13(f)(2), 23.603(f)(2).
    \26\ Proposed Sec. Sec.  1.13(f)(3), 23.603(f)(3).
---------------------------------------------------------------------------

    To support the pillars of the operational resilience framework, 
the proposed rule also lays out training,\27\ review, and testing 
requirements to ensure the framework evolves with newly generated 
risks. Covered entities must review their framework annually,\28\ 
and engage in regular independent and documented testing, including 
penetration testing, vulnerability assessments, and testing of the 
incident response and BCDR plans.\29\ Results of that testing must 
be reported to the entity's chief compliance officer and other 
relevant senior personnel.\30\ Finally, the proposed rule lays out 
the instances in which the Commission must be notified of incidents 
and of activation of the BCDR plan.\31\
---------------------------------------------------------------------------

    \27\ Proposed Sec. Sec.  1.13(g), 23.603(g).
    \28\ Proposed Sec. Sec.  1.13(h)(1), 23.603(h)(1).
    \29\ Proposed Sec. Sec.  1.13(h)(2)-(3), 23.603(h)(2)-(3).
    \30\ Proposed Sec. Sec.  1.13(h)(5), 23.603(h)(5).
    \31\ Proposed Sec. Sec.  1.13(i)-(j), 23.603(i)-(j).
---------------------------------------------------------------------------

    This proposed rulemaking is both expansive and thoroughly 
considered. It galvanizes much of the preexisting guidance on these 
subjects, recognizing that the vast majority of our market 
participants already have programs in place to address these risks 
and often already are subject to other regulators' rules and 
obligations, both domestically and internationally. The rule also 
recognizes the vast range in the size of the operations of our 
registered market participants--from some of the world's largest 
financial institutions acting as swap dealers to small, independent 
futures commissions merchants--and consequently builds flexibility 
into the proposed rule to allow businesses to tailor their 
operational resilience frameworks to the realities of their business 
needs.

The Need for Operational Resilience for Other Commission Registrants

    This rule is necessarily limited in scope to FCMs and the swap 
entities overseen by MPD. The risks that this rule intends to 
mitigate, however, are not similarly siloed. Designated Contract 
Markets (DCM), Swap Execution Facilities (SEF), and Swap Data 
Repositories (SDR), overseen by the Division of Market Oversight, 
and Derivative Clearing Organizations (DCO), overseen by the 
Division of Clearing and Risk, similarly rely on mission-critical 
third-party service providers, similarly are targeted by 
cyberattacks, and similarly risk business disruption caused by 
unforeseen disaster scenarios.
    Rulemakings completed in 2016 created system safeguard testing 
requirements for each of these entities, currently codified in Parts 
37, 38, 39, and 49 of the CFR.\32\ These rules include obligations 
for business continuity and disaster recovery and cybersecurity. 
Since 2016, however, the core issues surrounding the concept of 
operational resilience have shifted, most importantly around the 
ideas of mission-critical third parties. DCOs are increasingly 
contracting with third parties to manage and conduct aspects of 
their regulatory obligations, and just like with the covered 
entities subject to the rule at issue today, the onboarding of these 
new third parties also onboards new risks. The proposed rulemaking 
today considers the system safeguards provisions already on the 
books; \33\ the Commission now needs to continue to press forward by 
considering this proposed rule for future parallel regulations, for 
DCOs in particular.
---------------------------------------------------------------------------

    \32\ See Final Rule, System Safeguards Testing Requirements, 81 
FR 64272 (Sept. 19, 2016) (covering DCMs, SEFs, and SDRs); Final 
Rule, System Safeguards Testing Requirements for Derivatives 
Clearing Organizations, 81 FR 64322, 64329 (Sept. 19, 2016) 
(``System Safeguards for DCOs'') (describing the CFTC's approach to 
system safeguards for DCOs as providing DCOs with ``flexibility to 
design systems and testing procedures based on the best practices 
that are most appropriate for that DCO's risks'').
    \33\ C.f., e.g., System Safeguards for DCOs, 81 FR 64322-23; 17 
CFR 39.18(b)(3) (requiring DCOs to follow generally accepted 
standards and best practices with respect to the development, 
operation, reliability, security, and capacity of automated 
systems).
---------------------------------------------------------------------------

    The pandemic underscored the importance of business operational 
resilience, namely the ability of our registrants to react to and 
withstand unforeseen disasters. The FIA conducted its annual 
Disaster Recovery Exercise this fall with the stated goal of probing 
participants' ability to ``conduct critical business functions'' in 
the wake of a large-scale disaster.\34\ Last year's exercise saw 
participation from 19 major U.S. and international futures exchanges 
and clearinghouses, who indicated that this type of probing helped 
them to: ``Exercise their business continuance/disaster resilience 
plans[, i]dentify internal and external single points of failure . . 
. [, and t]ighten up and improve the documentation of their business 
continuity procedures.'' \35\
---------------------------------------------------------------------------

    \34\ Presentation, Futures Industry Association, Business 
Continuity Disaster Recovery Test, at 4 (Aug. 23, 2023), https://www.fia.org/sites/default/files/2023-10/FIA_DR_Test_Briefing_2023_1010_0.pptx.
    \35\ Summary Report, Futures Industry Association, 2022 FIA 
Industry-Wide Disaster Recovery Test, at 4 (Dec. 16, 2021), https://www.fia.org/sites/default/files/2023-05/2022_DR_Test_Results_v2.pdf.
---------------------------------------------------------------------------

    In 2021, the International Organization of Securities 
Commissions (IOSCO) initiated a consultation examining business 
continuity planning.\36\ IOSCO's initial recommendations to member 
jurisdictions stated that all regulators should require firms to 
have in place ``mechanisms to help ensure the resiliency, 
reliability and integrity (including security) of critical systems'' 
including an appropriate ``Business Continuity Plan.'' \37\
---------------------------------------------------------------------------

    \36\ The Board of The International Organization of Securities 
Commissions, Thematic Review on Business Continuity Plans with 
respect to Trading Venues and Intermediaries (May 21, 2021), https://www.iosco.org/library/pubdocs/pdf/IOSCOPD675.pdf.
    \37\ Id. at 1.
---------------------------------------------------------------------------

    Every industry advisory board and oversight group to have 
studied cybersecurity has reached the same conclusion: risks to 
financial institutions from cyberattacks continue to grow. The 
Financial Stability Oversight Council noted in its 2022 annual 
report that from 2015 to 2020 the finance and insurance industries 
were subject to the most cyberattacks of any industry, and that the 
current global geopolitical climate has only increased the need for 
vigilance against cyber threats.\38\ In April 2020, the Financial 
Stability Board (FSB) issued a guide on cyber incident response that 
explained that ``[a] significant cyber incident, if not properly 
contained, could seriously disrupt the financial system, including 
critical financial infrastructure, leading to broader financial 
stability implications.'' \39\ Similarly, in its 2019 Cyber Task 
Force report, IOSCO reiterated that cyber risk is one of the top 
threats to financial markets today given the ``economic costs of 
such events can be immense . . . and could potentially undermine the 
integrity of global financial markets.'' \40\ IOSCO went further in 
their recommendations to the crypto industry earlier this year that 
``[r]egulators should require a [crypto-asset service provider] to 
put in place sufficient measures to address cyber and system 
resiliency.'' \41\
---------------------------------------------------------------------------

    \38\ Financial Stability Oversight Council, 2002 Annual Report, 
at 37 (Dec. 16, 2022), https://home.treasury.gov/system/files/261/FSOC2022AnnualReport.pdf.
    \39\ The Financial Stability Board, Effective Practices for 
Cyber Incident Response and Recovery, at 1 (Oct. 19, 2020), https://www.fsb.org/wp-content/uploads/P191020-1.pdf.
    \40\ The Board of The International Organization of Securities 
Commissions, Cyber Task Force: Final Report, at 3 (June 19, 2019), 
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD633.pdf.
    \41\ The Board of The International Organization of Securities 
Commissions, Policy Recommendations for Crypto and Digital Asset 
Markets Consultation Report, at 39 (Nov. 16, 2023), https://www.iosco.org/library/pubdocs/pdf/IOSCOPD747.pdf.
---------------------------------------------------------------------------

Next Steps for Derivatives Clearing Organizations

    At the MRAC meeting this past Monday, I announced a new 
workstream for the CCP Risk and Governance subcommittee that will 
focus on third-party risk for central clearing counterparties. Work 
will begin imminently, with the goal of presenting a proposal for

[[Page 4765]]

vote by the parent committee in the first quarter of 2024. DCOs 
already retain responsibility for meeting regulatory requirements 
when entering into contractual outsourcing arrangements; \42\ the 
question now is how DCOs should be required to assess and monitor 
the risks associated with doing so.
---------------------------------------------------------------------------

    \42\ 17 CFR 39.18(d) (2022) (providing that registered entities 
such as DCOs retain responsibility for meeting relevant regulatory 
requirements when entering into contractual outsourcing 
arrangements).
---------------------------------------------------------------------------

    Such a rule should in my view broadly track the rule for FCMs 
and swap entities proposed today, but deep consideration must be 
given to the ways in which the core DCO business differs. For 
example, DCOs already occupy a quasi-oversight role with respect to 
their clearing members; should a rule on third-party risk require 
DCOs to consider not only the risk posed by their own outsourcing 
contracts, but also require that DCOs consider their clearing 
members' third-party risks, perhaps as an aspect of a DCO's 
assessment of its counterparty risk? How else might the rule differ 
given the disparity between DCOs' and FCMs' relative frequency of 
interaction with end users? How might these rules coordinate with 
prudential regulators?
    A cyberattack on a third party that affected FCMs last winter 
was already disruptive enough, but given their status as SIFMUs some 
DCOs are quite literally systemically important entities. DCOs serve 
irreplaceable market functions, and we need update their operational 
resilience requirements to take into account this new conception of 
third-party risk. I look forward to the new MRAC workstream diving 
into this critical issue, and of course to what Division of Clearing 
and Risk staff might bring forward in an eventual proposed 
rulemaking.
    I once again commend the staff of MPD on their tremendous effort 
bringing forth this proposed rule, and look forward to hearing the 
thoughts of my fellow Commissioners.

Appendix 4--Statement of Commissioner Christy Goldsmith Romero

    Today we have before us our first proposed cyber and operational 
resilience rule that would apply to swap dealers (including banks) 
and futures commission merchants (FCMs). I'm excited to see the 
proposed rule up for vote today. I support the rule and thank the 
staff for their more than one year of hard work. I also thank all 
who engaged with us in an extensive collaborative effort. I also 
thank Chairman Behnam for entrusting me to help with this rule.
    This is a critical rule for the CFTC. FBI Director Christopher 
Wray recently said ``that today's cyber threats are more pervasive, 
hit a wider array of victims, and carry the potential for greater 
damage than ever before'' and we face ``some of our most complex, 
most severe, and most rapidly evolving threats.'' \1\ This rule 
proposes to help advance our markets from a mentality of incident 
response to one of cyber resilience. This would further President 
Biden's White House National Cybersecurity Strategy and Executive 
Order on Improving the Nation's Cybersecurity.\2\
---------------------------------------------------------------------------

    \1\ See FBI, Director Wray's Remarks at the Mandiant/mWISE 2023 
Cybersecurity Conference (Sept. 18, 2023).
    \2\ The E.O.'s policy statement of policy is ``Protecting our 
Nation from malicious cyber actors requires the Federal Government 
to partner with the private sector. The private sector must adapt to 
the continuously changing threat environment, ensure its products 
are built and operate securely, and partner with the Federal 
Government to foster a more secure cyberspace. In the end, the trust 
we place in our digital infrastructure should be proportional to how 
trustworthy and transparent that infrastructure is, and to the 
consequences we will incur if that trust is misplaced.'' The White 
House, Executive Order on Improving the Nation's Cybersecurity (May 
12, 2021).
---------------------------------------------------------------------------

    Cyber resilience is one of my top priorities, and a critical 
issue on which I am engaged. Over the last year, the CFTC staff and 
I have been engaged with the White House, other financial 
regulators, the Department of Commerce's National Institute of 
Standards and Technology (NIST), the National Futures Association 
(NFA), swap dealers, FCMs, trade groups like the Futures Industry 
Association, the International Swaps and Derivatives Association, 
and the Securities Industry and Financial Markets Association, 
public interest groups, and third-party vendors. I also sponsor the 
Technology Advisory Committee that covers cybersecurity, and has a 
dedicated Cybersecurity subcommittee stacked with well-regarded 
cybersecurity experts.\3\
---------------------------------------------------------------------------

    \3\ See CFTC, Commissioner Goldsmith Romero Announces Technology 
Advisory Committee Subcommittee Co-Chairs and Members (July 14, 
2023); see also CFTC Technology Advisory Committee July 18 Meeting 
(July 18, 2023); CFTC Technology Advisory Committee March 22 Meeting 
(March 22, 2023).
---------------------------------------------------------------------------

    It takes this type of collective public and private engagement 
to thwart cybercrime, stay ahead of the continuously changing 
threat, and protect our nation's critical infrastructure. Director 
Wray has spoken about how malicious cyber actors seeking to cause 
destruction are working to hit us somewhere that's going to hurt--
U.S. critical infrastructure sectors.\4\ According to the FBI, in 
2021, there were ransomware incidents against 14 of the 16 U.S. 
critical infrastructure sectors.\5\ That includes an attack on 
Colonial Pipeline that led to gas shortages, and an attack on the 
world's largest meat supplier JBS, that led to meat shortages and 
spiking prices.\6\
---------------------------------------------------------------------------

    \4\ See FBI, Director's Remarks to the Boston Conference on 
Cyber Security 2022 (June 1, 2022).
    \5\ See FBI, FBI Partnering with the Private Sector to Counter 
the Cyber Threat, Remarks at the Detroit Economic Club (Mar. 22, 
2022).
    \6\ See Id. (discussing how an attack led to Colonial shutting 
down pipeline operations and a panic among people in the Southeast 
that led to a run on gas and how an attack on JBS resulted in a 
complete stoppage of meat production, leading to spiking prices and 
less availability of meat).
---------------------------------------------------------------------------

    As Director Wray has said, ``ransomware gangs love to go after 
things we can't do without.'' \7\ Our nation cannot do without the 
commercial agriculture, energy, metals, and financial markets, on 
which derivatives markets are based.
---------------------------------------------------------------------------

    \7\ See FBI, Director's Remarks to the Boston Conference on 
Cyber Security 2022 (June 1, 2022).
---------------------------------------------------------------------------

    In June, I presented five key pillars of cyber resilience, 
pillars that are contained in the proposed rule: \8\
---------------------------------------------------------------------------

    \8\ Commissioner Christy Goldsmith Romero, Advancing from 
Incident Response to Cyber Resilience, (June 20, 2023).
---------------------------------------------------------------------------

    1. A proportionate and appropriate approach;
    2. Following generally accepted standards and best practices;
    3. Elevating responsibility through governance;
    4. Building resilience to third-party risk; and
    5. Leveraging the important work already done in this space, 
including by prudential regulators and NFA.

Taking a Proportionate and Appropriate Approach

    There is no one-size fits all approach. The proposed rule would 
require swap dealers and FCMs to ensure that their operational 
resilience programs are appropriate and proportionate to the nature 
and risk profile of their business. This follows the White House 
National Cybersecurity Strategy.\9\ Our swap dealers include 
Globally Systemically Important Banks (GSIBs). Additionally, some of 
our swap dealers and FCMs are involved in U.S. critical 
infrastructure such as in the energy or agricultural sectors, or in 
supply chains.
---------------------------------------------------------------------------

    \9\ See The White House, National Cybersecurity Strategy (March 
2023) (recommending that organizations ``demonstrate a principles-
based approach that is sufficiently nimble to adapt to meet the 
challenges of the ever-evolving technological threat landscape and 
to fit the unique business and risk profile of each individual 
covered entity.''
---------------------------------------------------------------------------

    FBI Director Wray testified before Congress this month that one 
of the most worrisome facets of state-sponsored adversaries is their 
focus on compromising U.S. critical infrastructure, especially 
during a crisis, and that there is often no bright line that 
separates where nation state activity ends and cybercriminal 
activity begins.\10\ He testified about the disruptive impact of a 
supply chain attack in the SolarWinds attack, conducted by the 
Russian Foreign Intelligence Service.\11\ This summer, Director Wray 
said that the FBI is seeing the effects of Russia's invasion of 
Ukraine here at home, as the FBI has seen Russia conducting 
reconnaissance on the U.S. energy sector.\12\
---------------------------------------------------------------------------

    \10\ See FBI, Statement of Christopher A. Wray Director Federal 
Bureau of Investigation Before the Committee on the Judiciary United 
States Senate (Dec. 5, 2023).
    \11\ See Id.
    \12\ See FBI, Director Wray's Remarks at the FBI Atlanta Cyber 
Threat Summit (July 26, 2023).
---------------------------------------------------------------------------

    Director Wray also has said that, ``China operates on a scale 
Russia doesn't come close to. They've got a bigger hacking program 
than all other major nations combined. They've stolen more American 
personal and corporate data than all nations combined.'' \13\ 
Director Wray has said that ``the Chinese government has hacked more 
than a dozen U.S. oil and gas pipeline operators, not just stealing 
their

[[Page 4766]]

information, but holding them, and all of us, at risk.'' \14\ Swap 
dealers and FCMs involved in critical infrastructure sectors will 
need to build resilience for these cyber threats.
---------------------------------------------------------------------------

    \13\ See FBI, Director's Remarks to the Boston Conference on 
Cyber Security 2022 (June 1, 2022).
    \14\ See FBI, FBI Partnering with the Private Sector to Counter 
the Cyber Threat, Remarks at the Detroit Economic Club (Mar. 22, 
2022).
---------------------------------------------------------------------------

    The proposal also recognizes that cyber resilience requires 
continuous attention. What is appropriate or proportionate may 
change with the changing threat vector. It may also change when a 
swap dealer or FCM enters a new line of business, onboards a new 
vendor, or takes other action that can carry cyber risk.

Following Generally Accepted Standards and Practices

    The proposal, like the CFTC's rules for exchanges and 
clearinghouses, would require swap dealers and FCMs to follow 
generally accepted standards and industry best practices, like NIST 
or ISO (for international companies). The NIST Cybersecurity 
Framework creates a clear set of cybersecurity expectations that are 
risk-and outcome-based rather than prescriptive, and adaptable to 
the size and types of businesses.\15\ These standards are regularly 
updated to reflect the evolving technology and threat landscape. The 
proposed rule also requires at least annual assessment, testing and 
updates to the operational resilience framework.
---------------------------------------------------------------------------

    \15\ See Presentation of Kevin Stine, Chief of the Applied 
Security Division at NIST Information Technology Laboratory, 
``Managing Cybersecurity Risks,'' CFTC Technology Advisory Committee 
Meeting (March 22, 2023).
---------------------------------------------------------------------------

Elevating Responsibility Through Governance

    The vision of the Biden Administration's National Cybersecurity 
Strategy is to rebalance the responsibility to defend cyberspace by 
shifting the burden for cybersecurity away from individuals and 
small businesses, and onto the organizations that are most capable 
and best positioned to reduce risks.\16\ This strategy gets away 
from vulnerability caused by one person in an organization clicking 
on the wrong thing that leads to total disruption. The banks and 
commodity firms this rule would apply to are capable and best 
positioned to reduce cyber risk and cybercrime losses.
---------------------------------------------------------------------------

    \16\ See The White House, National Cybersecurity Strategy (March 
2023).
---------------------------------------------------------------------------

    Building cyber resilience requires elevating responsibility to 
those who make strategic decisions about the business. The stakes 
for businesses are high. There is potential legal risk, reputational 
risk, risk to national security, as well as financial risk. In 2022, 
the FBI reported $10.3 billion in cybercrime losses, shattering the 
record from the prior year.\17\ Tone at the top, including the C-
suite's active participation in cyber resilience programs as well as 
making cyber resilience a top priority, can determine whether an 
organization will successfully be cyber resilient and operationally 
resilient.
---------------------------------------------------------------------------

    \17\ FBI, Internet Crime Report 2022 (March 22, 2023).
---------------------------------------------------------------------------

    The proposed rule would require operational resilience plans to 
be approved annually by a senior leader and for incidents to be 
escalated promptly. It also would require senior leaders to set and 
approve the firm's risk appetite and risk tolerance limit. Leaders 
should make strategic decisions about the risk they are willing to 
take on, as well as the metrics they will monitor. I am interested 
in hearing if the proposal's definitions of these terms set a clear 
expectation and align with generally accepted standards.

Building Resilience to Third-Party Risk

    Swap dealers and FCMs routinely rely upon third party (as well 
as fourth party) service providers to access new technologies and 
expertise, and for efficiencies in business functions. The rule 
requires building resilience to third party risk, an issue brought 
sharply into focus with this year's cyber-attack on third-party 
vendor ION Markets.
    Because third parties create points of entry that need to be 
secured from cyber criminals, the banking regulators released 
updated interagency guidance on third party risk management that 
would apply to many of the swap dealers subject to the proposed 
rule.\18\ The staff and I met with the Federal Reserve, Federal 
Deposit Insurance Corporation, and the Office of the Comptroller of 
the Currency about their guidance and their efforts to promote cyber 
resilience. Like that interagency guidance, the proposed rule 
includes an inventory of all third-party service providers, 
assessments of risk throughout the lifecycle of the third-party 
relationship, the identification of critical third-parties, and 
subjects those critical third parties to heightened due diligence 
and monitoring.
---------------------------------------------------------------------------

    \18\ Board of Governors of the Federal Reserve System, Federal 
Deposit Insurance Corporation, and Office of the Comptroller of the 
Currency, Interagency Guidance on Third Party Relationships: Risk 
Management (Jun. 6, 2023).
---------------------------------------------------------------------------

    The proposed definition of who is a critical third-party service 
provider takes a flexible approach, asking entities to consider the 
impact of a disruption.\19\ At his TAC presentation, Todd Conklin, 
Deputy Assistant Secretary of Treasury's Office of Cybersecurity and 
Critical Infrastructure Protection (OCCIP) and TAC member discussed 
how ION Markets received less scrutiny because it was not treated as 
a critical third-party vendor by most firms.\20\ I look forward to 
comment.
---------------------------------------------------------------------------

    \19\ I heard from many banks and brokers that identifying who is 
a critical third-party service provider is an issue they regularly 
grapple with, and that it often comes down to specific facts and 
circumstances, and not just the products and service they provide.
    \20\ See Presentation of Todd Conklin, Deputy Assistant 
Secretary of Treasury's Office of Cybersecurity and Critical 
Infrastructure Protection (OCCIP), ``The Cyber Threat Landscape for 
Financial Markets: Lessons Learned from ION Markets, Cloud Use in 
Financial Services, and Beyond,'' CFTC Technology Advisory Committee 
Meeting (March 22, 2023) (``many institutions didn't even classify 
[ION Markets] necessarily as a `critical' third-party vendor. So 
many firms who onboarded ION didn't use the highest-level scrutiny 
that they use for their most critical third-party vendors.'').
---------------------------------------------------------------------------

    The CFTC also proposes separate guidance on managing third-party 
risks. I am interested in commenters' views on this guidance, and 
whether we have it right for harmonization.

Leveraging the Important Work of Others, Including Prudential 
Regulators and the NFA

    The White House's 2023 Cybersecurity Strategy recommends 
organizations ``harmonize where sensible and appropriate to achieve 
better outcomes.'' \21\ The proposal recognizes that many of our 
regulated entities are part of a larger enterprise, with cyber and 
operational resilience programs managed at the enterprise level, and 
can use those programs under this rule. I am interested in 
commenters' views on whether we have achieved appropriate 
harmonization or whether we need greater harmonization with bank 
regulators' rules and guidance and NFA guidance.\22\
---------------------------------------------------------------------------

    \21\ See The White House, National Cybersecurity Strategy, 
(March 2023).
    \22\ These requirements and guidance include the prudential 
regulator's Sound Practices to Strengthen Operational Resilience 
paper, the Interagency Guidelines Establishing Standards for 
Safeguard Customer Information, and the recently released 
Interagency Guidance on Third-Party Relationships: Risk Management, 
as well as NFA guidance on information security, third-party service 
provider risk management, and notification of regulators and 
business continuity and disaster recovery.
---------------------------------------------------------------------------

Stronger Together

    We are stronger together. The CFTC is part of coordinated 
government efforts to learn about and disseminate information about 
emerging cyber threats. We want to work with our swap dealers and 
FCMs to help strengthen their operational resilience, especially 
prior to any disruptive event.
    Should a disruptive event occur, resilience requires rapid 
collaboration among the CFTC and all those who are potentially 
affected to contain any potential damage and to keep critical market 
functions running. The proposed rule includes specific requirements 
for notifying the CFTC of an incident as soon as possible, but no 
later than 24 hours after detection. I support immediate 
notification to the CFTC because if we know, we can work with 
regulated entities and markets to assess and minimize damage, 
trigger appropriate regulatory and law enforcement action, help in 
recovery, and protect customers. I note that this time frame and 
reporting standards differs from other regulators, and look forward 
to comment.
    A two-way flow of information can play a significant role in the 
ability to build resilience, which means the ability to recover 
quickly after an attack. According to Deputy Assistant Secretary 
Conklin, collaboration between the government and industry helped 
mitigate the impact of the ION Markets attack.\23\ The proposal 
would also require notification to customers and counterparties as 
soon as possible of attacks that affect them. Early notice helps 
minimize the impact of an

[[Page 4767]]

attack by allowing them to secure their personal data, monitor 
affected accounts, and make alternative arrangements for accessing 
critical funds or markets.
---------------------------------------------------------------------------

    \23\ See Presentation of Todd Conklin, Deputy Assistant 
Secretary of Treasury's Office of Cybersecurity and Critical 
Infrastructure Protection (OCCIP), ``The Cyber Threat Landscape for 
Financial Markets: Lessons Learned from ION Markets, Cloud Use in 
Financial Services, and Beyond,'' CFTC Technology Advisory Committee 
Meeting (Mar. 22, 2023).
---------------------------------------------------------------------------

    If we can all work together, we can harden our defenses, thwart 
cyber criminals, and protect critical U.S. infrastructure and 
national security. Together, we can build a safer and more resilient 
cyberspace.

Appendix 5--Statement of Commissioner Caroline D. Pham

    I support the Notice of Proposed Rulemaking on Operational 
Resilience Framework for Futures Commission Merchants, Swap Dealers, 
and Major Swap Participants (Operational Resilience Proposal) \1\ 
because I believe this approach is largely consistent with 
international standards for operational resilience, as well as U.S. 
prudential regulations and non-U.S. regulations, which have been 
implemented for several years now. I thank the staff of the Market 
Participants Division (MPD), especially Pamela Geraghty, Elise 
Bruntel, and Amanda Olear, as well as Chairman Behnam and 
Commissioner Goldsmith Romero, for working with me over the past 
year to address my concerns.
---------------------------------------------------------------------------

    \1\ Because there are no registered major swap participants, as 
a practical matter, this statement will refer to swap dealers and 
futures commission merchants (FCMs).
---------------------------------------------------------------------------

Background

    My discussions with MPD staff, formerly the Division of Swap 
Dealer and Intermediary Oversight (DSIO), in fact date back to 2016 
when I was in the private sector. MPD staff have been considering 
many of the elements of an operational resilience framework for 
years, including operational risk and cybersecurity risk. I 
appreciate the staff's focus on all of these important issues that 
contribute to ensuring that our registrants have robust risk 
management and compliance programs, and that the CFTC is doing our 
job to uphold financial stability and protect against systemic risk.
    I would like to mention my background and experience, as well as 
familiarity, with the subject areas covered by the Operational 
Resilience Proposal to provide context for my efforts to support the 
development of this Proposal and address my concerns that the CFTC's 
approach should not be overly prescriptive and generally takes a 
principles-based approach in recognition of the extensive years-long 
global implementation of operational resilience requirements by U.S. 
and non-U.S. regulators and banking organizations.
    In my previous roles at a global systemically important bank 
(GSIB), I have been involved with operational resilience since 2019, 
including the oversight and coordination of global regulatory 
advocacy with the Financial Stability Board (FSB) and regulatory 
authorities such as the U.S. prudential regulators,\2\ the Bank of 
England, and European Union (EU) authorities. I also was on the 
enterprise-wide operational resilience program steering committee, 
and I have implemented enterprise-wide programs across a global 
financial institution across all regions and both institutional or 
wholesale and consumer businesses.
---------------------------------------------------------------------------

    \2\ U.S. prudential regulators refers to the Board of Governors 
of the Federal Reserve System (Fed), the Office of the Comptroller 
of the Currency (OCC), and the Federal Deposit Insurance Corporation 
(FDIC).
---------------------------------------------------------------------------

    Among the specific elements encompassed in the Operational 
Resilience Proposal, I have enhanced the swap dealer and futures 
commission merchant (FCM) risk management programs. I have drafted 
an enterprise-wide risk appetite statement. I have implemented the 
National Futures Association's (NFA) update to its information 
systems security programs requirements, which addresses 
cybersecurity risk. I have participated in tabletop exercises, 
drills, and simulations of responses to cyber attacks. I was the 
lead from the Compliance department on the third-party risk 
management program for cross-asset activities or other programmatic 
aspects across the global markets business. I have enhanced the 
business continuity and disaster recovery (BCDR) swap dealer 
policies and procedures and integration with the enterprise-wide 
continuity of business program. I have delivered training for, 
respectively, 9,000 and 17,000 employees across nearly 100 countries 
and multiple languages. I have had a compliance monitoring team that 
reported directly to me. I have advised on the design and 
implementation of the enterprise-wide Volcker Rule independent 
testing program. I was part of global regulatory notification 
protocols for cybersecurity or other incidents. And also, of course, 
I have been subject to regulatory examinations on each one of these 
areas. This practical experience has informed my engagement on this 
significant rulemaking initiative.

The CFTC's Approach to Operational Resilience Must Be Consistent With 
International Standards and Prudential Regulations

    I am pleased that the CFTC is seeking an approach that is 
consistent with international standards and best practices for 
regulators in addressing operational resilience. I will reiterate my 
previous remarks on the many years of work by policymakers such as 
the FSB, the Basel Committee on Banking Supervision (BCBS), the 
International Organization of Securities Commissions (IOSCO), and 
other regulatory authorities around the world to implement laws, 
regulations, and standards for operational resilience. Operational 
resilience, as noted by U.S. prudential regulators in 2020, 
encompasses governance, operational risk management, business 
continuity management, third-party risk management, scenario 
analysis, secure and resilient information system management, 
surveillance and reporting, and cyber risk management. Regulated 
entities, including the vast majority of our swap dealers and FCMs 
that are part of banking organizations, have already implemented 
comprehensive enterprise-wide operational resilience programs.\3\
---------------------------------------------------------------------------

    \3\ Opening Statement of Commissioner Caroline D. Pham before 
the Technology Advisory Committee, U.S. Commodity Futures Trading 
Commission (Jul. 18, 2023), https://www.cftc.gov/PressRoom/SpeechesTestimony/phamstatement071823.
---------------------------------------------------------------------------

    Issuing this Proposal can be beneficial to initiate an open 
process to request information and stimulate dialogue with the 
public. That is why, although there has been some hesitation or 
trepidation around what the Commission might do since we are coming 
onto the tail end of operational resilience implementation globally, 
I do think it is important that we are taking this step today, 
because it is critical that the public has the opportunity to 
provide input on any amendment or expansion of our existing 
programmatic requirements that is informed by actual experience from 
risk management and compliance officers, other control functions, 
and practitioners who have implemented and complied with operational 
resilience requirements pursuant to other regulations.
    Further, as I have noted previously, because the CFTC's rules 
are often only one part of a much broader risk governance framework 
for financial institutions, the Commission must ensure that it has 
the full picture before coming to conclusions to ensure that our 
rules not only address any potential regulatory gaps or changes in 
risk profiles, but also to avoid issuing rules that are conflicting, 
duplicative, or unworkable with other regulatory regimes.\4\
---------------------------------------------------------------------------

    \4\ Statement of Commissioner Caroline D. Pham on Risk 
Management Program for Swap Dealers and Futures Commission Merchants 
Advance Notice of Proposed Rulemaking, U.S. Commodity Futures 
Trading Commission (Jun. 1, 2023), https://www.cftc.gov/PressRoom/SpeechesTestimony/phamstatement060123.
---------------------------------------------------------------------------

    For example, when I last checked earlier this year, the CFTC 
currently has 106 provisionally registered swap dealers. Of these 
106 entities, both U.S. and non-U.S., all but a handful are also 
registered with and supervised by another agency or authority, such 
as a prudential, functional, or market regulator. Most of these swap 
dealers are subject to three or more regulatory regimes.\5\
---------------------------------------------------------------------------

    \5\ Id.
---------------------------------------------------------------------------

    It is imperative that the Commission and the staff consider how 
our rules work in practice together with the rules of other 
regulators, whether foreign or domestic. This key point is easily 
apparent in looking at the CFTC's substituted compliance regime for 
non-U.S. swap dealers, where the Commission has expressly found that 
non-U.S. swap dealers in certain jurisdictions are subject to 
comparable and comprehensive regulation, and therefore, our rules 
permit such non-U.S. swap dealers to, for example, substitute 
compliance with their home jurisdiction risk management regulations 
to satisfy our risk management program rules under CFTC Regulation 
23.600.\6\
---------------------------------------------------------------------------

    \6\ Id.
---------------------------------------------------------------------------

Specific Areas for Public Comment

    As a preliminary matter, regarding discussion of the CFTC's 
approach to system safeguards requirements for designated contract 
markets (DCMs) and derivatives clearing organizations (DCOs) and its 
impact on the development of today's Operational Resilience 
Proposal, I note that swap dealers

[[Page 4768]]

and FCMs are very different from exchanges and clearinghouses. The 
CFTC should not overly rely upon its approach to the system 
safeguards rulesets because it is akin to the difference between, 
for example, the Securities and Exchange Commission's (SEC) 
Regulation SCI and the U.S. prudential regulators' Heightened 
Standards for Risk Governance. I believe that the staff has tried to 
balance these considerations, and I welcome public comment on this 
approach.

Definitions

    Words matter, and it is very important for the Commission to be 
precise in the words that we use for defined terms. I encourage all 
commenters to review the Proposal's definitions and advise whether 
the definitions are appropriate or need to be revised.

Third-Party Relationship Program Guidance

    The Operational Resilience Proposal includes an appendix to the 
rule text with more prescriptive guidance on third-party 
relationships (third-party risk management). This is unusual because 
I do not believe that the CFTC has this level of prescriptiveness 
for any other category of risk, such as credit risk. I question 
whether this heralds a change to the CFTC's approach to setting 
forth risk management requirements, and why would the Commission 
issue prescriptive guidance for third-party risk, but not other 
risks such as operational risk or market risk.
    I also question the approach of issuing Commission guidance, 
which would have to undergo notice-and-comment rulemaking and that 
could take a year or two to update, instead of issuing staff 
guidance, which could be updated more flexibly. I believe that any 
prescriptive guidance would be more appropriate as staff guidance, 
not Commission guidance, because staff guidance can be kept up-to-
date more easily to address changes in best practices or to adapt to 
emerging risks. This is similar to how, for example, U.S. prudential 
regulators update their bank examiners handbook or circulars.
    I am interested in public comment on the CFTC's requirements for 
third-party risk management, and whether it should be issued as 
Commission guidance or staff guidance.

Risk Appetite

    The Operational Resilience Proposal refers to risk appetite, 
which is a new concept to CFTC regulations. I am interested in 
whether commenters believe risk appetite is workable under the 
CFTC's regulatory framework, which is focused on enforcement rather 
than ongoing supervision. Indeed, I have repeatedly noted that the 
CFTC lacks a swap dealer examination program. As a consequence, non-
material operational or technical issues are the subject of 
enforcement actions, rather than addressed more appropriately 
through supervisory findings and exam reports like every other 
regulatory authority in the world. This makes the CFTC an outlier 
amongst U.S. and non-U.S. regulators, and therefore prudential 
concepts like risk appetite may not be workable.

Risk Tolerance Limits

    Risk tolerance limits are a requirement under the CFTC's risk 
management program (RMP) rules for swap dealers and FCMs. The 
Operational Resilience Proposal also requires risk tolerance limits, 
but sets forth a different definition and does not refer to the risk 
tolerance limits under the RMP rules. I am interested in public 
comment on whether the two differing requirements may cause 
confusion or can be implemented without any issues.

Annual Attestation

    The Operational Resilience Proposal requires an annual 
attestation by the senior officer, an oversight body, or a senior-
level official of a swap dealer or FCM that relies on a consolidated 
operational resilience program. Such attestation is to the effect 
that the consolidated program meets CFTC requirements and reflects 
the risk appetite and risk tolerance limits appropriate to the swap 
dealer or FCM. I encourage commenters to discuss the attestation 
requirement and suggest appropriate attestation language.

Substituted Compliance

    Under the Operational Resilience Proposal, substituted 
compliance would be available for non-U.S. swap dealers subject to a 
comparability determination issued by the Commission. I appreciate 
the recognition in the Proposal of the importance of a home-host 
regulator approach to maintaining regulatory cohesion and addressing 
systemic risk and financial stability. I am interested in whether 
commenters believe the Proposal presents any cross-border issues in 
implementation.

Conclusion

    I believe in continuous improvement for not only our market 
participants, but also for the Commission and its regulations, and 
that is why I would like to thank the MPD staff again for being 
proactive in thinking about these issues. I want to particularly 
recognize the leadership of Commissioner Goldsmith Romero in first 
highlighting these risks and exploring ways to address them through 
the work of the CFTC's Technology Advisory Committee, which she 
sponsors.
    As I have stated before, the benefit of the CFTC's principles-
based regulatory framework is that it can quickly anticipate and 
adapt to changes in risk profiles or the operating environment. That 
is why I believe our rules must be broad and flexible enough to be 
forward-looking and evergreen, because it is simply not possible to 
prescribe every last requirement for the unknown future. Consistent 
with international standards, I have discussed the importance of 
utilizing existing risk governance frameworks and risk management 
disciplines to identify, measure, monitor, and control emerging 
risks and new technologies. Swap dealers and FCMs must be vigilant 
and address new and emerging risks through various risk stripes as 
appropriate, whether from changing market conditions, technological 
developments, geopolitical concerns, or any other event, and 
maintain operational resilience.
    With that, I welcome the input from the public comments to 
inform the Commission and the staff regarding the application of the 
Operational Resilience Proposal to swap dealers and FCMs, especially 
those entities that are part of a banking organization and have 
already implemented operational resilience requirements pursuant to 
U.S. or non-U.S. regulations.

[FR Doc. 2023-28745 Filed 1-23-24; 8:45 am]
BILLING CODE 6351-01-P