United StatesCFTC system safeguards: prompt notice to Commission staff of cyber security incidents and targeted threats
CFTC system safeguards notices, 17 CFR 39.18(g), 38.1051(e) and 37.1401(e)
In force since .
A vulnerability and incident reporting rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it is a derivatives clearing organization, a designated contract market or a swap execution facility registered with the Commodity Futures Trading Commission. Declare provides_financial_services where that holds; no role names a registered derivatives market more closely.
- If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
- If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
- If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
- Give timely advance notice of material planned changes to automated systems that may impact their reliability, security, or capacity, and of material planned changes to your program of risk analysis and oversight.
These lines are LexLint's reading of the law's text, as of .
What this law does
A derivatives clearing organization shall notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment, of automated system operation, reliability, security, or capacity.
A designated contract market must notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity. A swap execution facility shall notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity.
A derivatives clearing organization shall provide staff of the Division of Clearing and Risk timely advance notice of all material planned changes to its automated systems that may impact the reliability, security, or capacity of such systems. The Commission's system safeguards testing requirements rule for derivatives clearing organizations at 81 FR 64322 is effective .
When LexLint raises it
When your app profile says your app provides financial services.