The CFTC approved unanimously two final rules to enhance requirements for system safeguards testing by a derivatives clearing organization ("DCO") and approved additional conforming amendments. The two sets of rules apply to DCOs, swap execution facilities, swap data repositories and designated contract markets (collectively, the "Final Rules").
The Final Rules specify and define the following five types of cybersecurity testing "essential to a sound system safeguards program":
- vulnerability testing;
- penetration testing;
- controls testing;
- security incident response plan testing; and
- enterprise technology risk assessment.
Additionally, the Final Rules: (i) provide minimum frequency requirements for testing, and requirements for specified registrants to engage independent contractors to conduct some of the required testing; (ii) clarify rule provisions relating to the scope of system safeguards testing, internal reporting and review of testing results, and remediation of identified vulnerabilities and deficiencies; and (iii) add enterprise risk management and governance to the list of required categories of system safeguards-related risk analysis and oversight.
The Final Rules will be effective upon their publication in the Federal Register. The CFTC extended the following compliance dates for DCOs:
- vulnerability testing and security incident response plan testing increased to 180 days after the effective date; and
- external penetration testing, internal penetration testing, controls testing and enterprise technology risk assessment increased to 1 year after the effective date.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
