United StatesSEC Regulation SCI: notification of SCI events to the Commission and to members
SEC Regulation SCI SCI event notices, 17 CFR 242.1002(b) and (c)
In force since .
A vulnerability and incident reporting rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it is an SCI entity: a national securities exchange, registered securities association or registered clearing agency (or the Municipal Securities Rulemaking Board), an alternative trading system that meets the volume thresholds, a plan processor, an exempt clearing agency subject to the Commission's Automation Review Policies, or a competing consolidator that meets the revenue threshold. Declare provides_financial_services where that holds; no role names a securities market infrastructure operator more closely.
- Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
- Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
- Until the SCI event is resolved and your investigation is closed, provide updates to the Commission on a regular basis, or at the frequency the Commission reasonably requests, to correct materially incorrect information or when new material information is discovered.
- If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
- For an SCI event with no or a de minimis impact, keep records and submit a quarterly report within 30 calendar days after the end of each calendar quarter summarizing the systems disruptions and systems intrusions.
- Promptly after responsible SCI personnel conclude that an SCI event that is a systems disruption or systems compliance issue has occurred, disseminate the affected systems and a summary description to the members or participants who may have been affected, and to all members or participants for a major SCI event. For a systems intrusion, disseminate a summary description and the corrective action taken unless you determine and document that dissemination would likely compromise security or an investigation.
These lines are LexLint's reading of the law's text, as of .
What this law does
Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, each SCI entity shall notify the Commission of the SCI event immediately. Within 24 hours of any responsible SCI personnel having a reasonable basis to conclude that the SCI event has occurred, the SCI entity shall submit a written notification to the Commission, made on a good faith, best efforts basis.
Until the SCI event is resolved and the investigation is closed, the SCI entity shall provide updates to the Commission on a regular basis, or at such frequency as reasonably requested by a representative of the Commission. If an SCI event is resolved and the investigation closed within 30 calendar days of its occurrence, the SCI entity shall submit a final written notification within five business days after the resolution and closure.
An SCI event that has had, or is reasonably estimated to have, no or a de minimis impact is reported in a summary report within 30 calendar days after the end of each calendar quarter. An SCI event means an event at an SCI entity that constitutes a systems disruption, a systems compliance issue, or a systems intrusion.
Promptly after responsible SCI personnel have a reasonable basis to conclude that an SCI event that is a systems disruption or systems compliance issue has occurred, the SCI entity shall disseminate the system or systems affected and a summary description of the SCI event.
The information disseminated must go promptly to the members or participants of the SCI entity that responsible SCI personnel reasonably estimate may have been affected, and for major SCI events to all of its members or participants. Regulation SCI is effective . The compliance date of Regulation SCI is nine months after the effective date of the regulation, or .
When LexLint raises it
When your app profile says your app provides financial services.