Key Takeaways
- • On December 16, 2015, the CFTC approved two substantively similar proposed rules requiring regulated entities to conduct specific cybersecurity tests, remediate vulnerabilities, and institute board-level review of testing results.
- • The proposals cover derivative clearing organizations, designated contract markets, swap execution facilities, and swap data repositories.
- • The rules set minimum testing frequencies: vulnerability testing quarterly, penetration testing annually, control testing at least every two years, incident response plan testing annually, and an Enterprise Technology Risk Assessment annually.
- • Independent contractors would be required for at least two of the quarterly vulnerability tests, external penetration tests, and key control tests.
- • Jones Day characterizes the proposals as largely codifying existing best practices and clarifying expectations rather than imposing radical change.
Summary
The Commodity Futures Trading Commission (CFTC) approved two proposed safeguard rules on December 16, 2015 that would require regulated entities to test their cybersecurity capabilities, remediate vulnerabilities, and subject testing results to board-level review. According to Jones Day's analysis, the proposals amend existing rules for derivative clearing organizations, designated contract markets, swap execution facilities, and swap data repositories. The CFTC framed the measures as a response to a "consistent, growing cybersecurity threat to the financial sector," citing that half of the world's exchanges were attacked between July 2012 and July 2013, and that one U.S. bank disclosed facing 30,000 cyber attacks in a single week.
The proposals specify five types of testing. Vulnerability testing must be conducted regularly, with a minimum frequency of quarterly, and at least two of those quarterly tests must be performed by outside independent contractors. Penetration testing, covering both external and internal attempts to breach systems, must occur at least annually, with independent contractors used for external tests. Control testing, focused on "key controls," must occur no less than every two years, with independent contractors testing key controls. Security incident response plan testing must occur at least annually and may be performed by contractors or sufficiently independent employees. An Enterprise Technology Risk Assessment (ETRA), which gives leadership a strategic view of threats relative to existing controls, must also be completed at least annually. The CFTC states that the testing frequency for each category must ultimately be determined by each entity's own risk assessment, with the listed figures serving as minimums.
Beyond testing, the proposals strengthen governance requirements. Current rules for derivative clearing organizations already require senior management review of testing; the proposals extend senior management review to designated contract markets, swap execution facilities, and swap data repositories, and require board of directors review of testing reports for all these entities. The CFTC describes cybersecurity as an "enterprise-wide risk management issue" rather than solely an IT matter.
Jones Day notes that the proposals, on their own, are not dramatically new, since the CFTC views them as reflecting well-known best practices that many firms already follow and as largely implicit in existing law. The firm reads the proposals as a signal that cybersecurity is a top CFTC priority, placing the agency alongside the Federal Financial Institutions Examination Council and the New York Department of Financial Services. Jones Day also highlights the CFTC's concern that attacks compromising data integrity or operational capacity could propagate through interconnected markets, affecting even firms with strong security protocols.
The proposals specify five types of testing. Vulnerability testing must be conducted regularly, with a minimum frequency of quarterly, and at least two of those quarterly tests must be performed by outside independent contractors. Penetration testing, covering both external and internal attempts to breach systems, must occur at least annually, with independent contractors used for external tests. Control testing, focused on "key controls," must occur no less than every two years, with independent contractors testing key controls. Security incident response plan testing must occur at least annually and may be performed by contractors or sufficiently independent employees. An Enterprise Technology Risk Assessment (ETRA), which gives leadership a strategic view of threats relative to existing controls, must also be completed at least annually. The CFTC states that the testing frequency for each category must ultimately be determined by each entity's own risk assessment, with the listed figures serving as minimums.
Beyond testing, the proposals strengthen governance requirements. Current rules for derivative clearing organizations already require senior management review of testing; the proposals extend senior management review to designated contract markets, swap execution facilities, and swap data repositories, and require board of directors review of testing reports for all these entities. The CFTC describes cybersecurity as an "enterprise-wide risk management issue" rather than solely an IT matter.
Jones Day notes that the proposals, on their own, are not dramatically new, since the CFTC views them as reflecting well-known best practices that many firms already follow and as largely implicit in existing law. The firm reads the proposals as a signal that cybersecurity is a top CFTC priority, placing the agency alongside the Federal Financial Institutions Examination Council and the New York Department of Financial Services. Jones Day also highlights the CFTC's concern that attacks compromising data integrity or operational capacity could propagate through interconnected markets, affecting even firms with strong security protocols.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.