United StatesCFTC system safeguards for derivatives clearing organizations, designated contract markets and swap execution facilities
CFTC system safeguards, 17 CFR 39.18, 38.1051 and 37.1401
In force since .
A sector security regimes rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it is a derivatives clearing organization, a designated contract market or a swap execution facility registered with the Commodity Futures Trading Commission. Declare provides_financial_services where that holds; no role names a registered derivatives market more closely.
- If your organization is a derivatives clearing organization, establish and maintain a program of risk analysis and oversight with respect to your operations and automated systems that identifies and minimizes sources of operational risk, and that addresses information security, business continuity and disaster recovery, capacity and performance planning, systems operations, systems development and quality assurance, and physical security and environmental controls.
- If your organization is a derivatives clearing organization, follow generally accepted standards and industry best practices with respect to the development, operation, reliability, security, and capacity of automated systems, and maintain a business continuity and disaster recovery plan with a recovery time objective of no later than the next business day following a disruption.
- If your organization is a designated contract market or a swap execution facility, maintain a program of risk analysis and oversight with respect to your operations and automated systems that addresses each category of risk analysis and oversight the rule lists, beginning with enterprise risk management and governance and information security.
- If your organization is a designated contract market or a swap execution facility, conduct regular, periodic, objective testing and review of your automated systems to ensure that they are reliable, secure, and have adequate scalable capacity, and regular, periodic testing and review of your business continuity-disaster recovery capabilities.
These lines are LexLint's reading of the law's text, as of .
What this law does
A derivatives clearing organization shall establish and maintain a program of risk analysis and oversight with respect to its operations and automated systems to identify and minimize sources of operational risk through the development of appropriate controls and procedures and of automated systems that are reliable, secure, and have adequate scalable capacity.
That program must address information security, including controls relating to access to systems and data, vulnerability management, penetration testing, and security incident response and management. A derivatives clearing organization shall follow generally accepted standards and industry best practices with respect to the development, operation, reliability, security, and capacity of automated systems.
A designated contract market's program of risk analysis and oversight with respect to its operations and automated systems shall address each of the following categories of risk analysis and oversight, beginning with enterprise risk management and governance.
A swap execution facility's program of risk analysis and oversight with respect to its operations and automated systems shall address each of the following categories of risk analysis and oversight, beginning with enterprise risk management and governance. A swap execution facility shall conduct regular, periodic, objective testing and review of its automated systems to ensure that they are reliable, secure, and have adequate scalable capacity.
The Commission's system safeguards testing requirements rule at 81 FR 64272 is effective . The Commission's system safeguards testing requirements rule for derivatives clearing organizations at 81 FR 64322 is effective .
When LexLint raises it
When your app profile says your app provides financial services.