CFTC Requests Comments on Cybersecurity Proposals (Fed. Reg.)

The CFTC proposed amendments to system safeguards rules for designated contract markets ("DCMs"), swap execution facilities ("SEFs"), swap data repositories ("SDRs") and derivatives clearing organizations ("DCOs"). The proposed amendments affect existing provisions relating to system safeguards risk analysis and oversight and cybersecurity testing, and add provisions concerning certain aspects of security testing. The CFTC also requested comment on potential testing requirements for independent contractors. The proposal and the request for comment were published in the Federal Register.

The proposed amendments specify and define several types of cybersecurity testing required by system safeguards testing obligations, including: (i) vulnerability testing; (ii) penetration testing; (iii) controls testing; (iv) security incident response plan testing; and (v) enterprise technology risk assessment.

The proposal clarifies rule provisions with respect to: (i) the categories of system safeguards-related risk analysis and oversight that statutorily-required programs must address; (ii) system safeguards-related books and records obligations; (iii) the scope of system safeguards testing; (iv) internal reporting and review of testing results; and (v) remediation of vulnerabilities and deficiencies.

The CFTC also requested comment on whether the minimum testing frequency and independent contractor testing requirements should be applied to swap execution facilities.

In a separate action, the CFTC proposed enhanced requirements for DCO testing of system safeguards, as well as additional amendments to reorder and renumber certain paragraphs within the regulations and make other minor changes to improve the clarity of the rule text.

Comments on the proposals must be submitted by February 22, 2016.