Pursuant to Section 806(e)(1) of Title VIII of the Dodd-Frank Wall Street Reform and Consumer Protection Act, entitled Payment, Clearing and Settlement Supervision Act of 2010 (“Clearing Supervision Act”) ^[1] and Rule 19b-4(n)(1)(i) ^[2] under the Securities Exchange Act of 1934 (“Act”),^[3] notice is hereby given that on August 14, 2024, National Securities Clearing Corporation (“NSCC”) filed with the Securities and Exchange Commission (“Commission”) an advance notice as described in Items I, II and III below, which Items have been prepared primarily by the clearing agency. The Commission is publishing this notice to solicit comments on the advance notice from interested persons and to extend the review period of the advance notice.

I. Clearing Agency's Statement of the Terms of Substance of the Advance Notice

NSCC files this advance notice seeking no objection to host a specified set of core clearance, settlement, and risk applications, including any Regulation Systems Compliance and Integrity (“Reg. SCI”) systems and Critical SCI systems,^[4] (“Core C&S Systems”) on an on-demand network of configurable information technology resources running on a public cloud infrastructure (“Cloud” or “Cloud Infrastructure”) hosted by a single, third-party service provider (“Cloud Service Provider” or “CSP”) (altogether, the “Cloud Proposal”), as described in greater detail below.

II. Clearing Agency's Statement of the Purpose of, and Statutory Basis for, the Advance Notice

In its filing with the Commission, the clearing agency included statements concerning the purpose of and basis for the advance notice and discussed any comments it received on the advance notice. The text of these statements may ( printed page 71992) be examined at the places specified in Item IV below. The clearing agency has prepared summaries, set forth in sections A and B below, of the most significant aspects of such statements.

(A) Clearing Agency's Statement on Comments on the Advance Notice Received From Members, Participants or Others

NSCC has not received or solicited any written comments relating to this proposal. If any written comments are received, NSCC will amend this filing to publicly file such comments as an Exhibit 2 to this filing, as required by Form 19b-4 and the General Instructions thereto.

Persons submitting written comments are cautioned that, according to Section IV (Solicitation of Comments) of the Exhibit 1A in the General Instructions to Form 19b-4, the Securities and Exchange Commission (“Commission”) does not edit personal identifying information from comment submissions. Commenters should submit only information that they wish to make available publicly, including their name, email address, and any other identifying information.

All prospective commenters should follow the Commission's instructions on How to Submit Comments, available at www.sec.gov/​regulatory-actions/​how-to-submitcomments. General questions regarding the rule filing process or logistical questions regarding this filing should be directed to the Main Office of the Commission's Division of Trading and Markets at tradingandmarkets@sec.gov or 202-551-5777.

NSCC reserves the right to not respond to any comments received.

(B) Advance Notices Filed Pursuant to Section 806(e) of the Clearing, and Settlement Supervision Act

I. Description of the Proposal

Pursuant to the Clearing Supervision Act and Rule 19b-4(n)(1)(i) under the Exchange Act,^[5] NSCC files this advance notice seeking no objection to the Cloud Proposal, as described herein.

The specified set of Core C&S Systems that the Clearing Agencies intend to host in the Cloud, and the transition schedule for such hosting, are listed in Exhibit 3 to this advance notice filing.^[6] However, the Clearing Agencies recognize that it may become necessary to deviate from the proposed transition schedule as risks change over time and the proposed implementation would occur over several years. The Clearing Agencies' process for monitoring, assessing, and escalating such risks, which may result in a deviation, is described in Section I.D, below. If the Clearing Agencies would need to deviate from that schedule, they would provide Commission staff notice of such deviation, the reason for the deviation, and how the implementation schedule would be updated to account for the deviation. Further, the Clearing Agencies recognize that deviating from the proposed transition schedule would necessitate a separate analysis to determine whether such deviation could materially affect the nature or level of risk posed by each of the Clearing Agencies.

NSCC's two affiliate clearing agencies, Fixed Income Clearing Corporation (“FICC”) and The Depository Trust Company (“DTC” and together with NSCC and FICC, the “Clearing Agencies”) ^[7] have each filed with the Commission advance notices to adopt the same Cloud Proposal. Accordingly, each respective advance notice filing is written from the perspective of the Clearing Agencies, collectively, instead of NSCC, FICC, and DTC individually.^[8]

A. The Current System and Summary of Proposed Change

Today, the Clearing Agencies' Core C&S Systems are hosted using Compute,^[9] Storage and Networking, as defined below, running in private data centers ( i.e., on-premises). The current data-center footprint consists of a single data center in each of two regions. Each regional data center has a corresponding data bunker used for synchronous data protection and restoration.^[10]

The Clearing Agencies view the proposed transition to using a Cloud Infrastructure to host the specified set of Core C&S Systems as a natural progression of the Clearing Agencies' information technology strategy that aligns with their overall corporate strategy—to deliver on modernization and maximize the value of their platforms for stakeholders and continue to invest in risk management excellence.

For over 11 years, the Clearing Agencies have honed their expertise in operating non-Core C&S Systems within the Cloud.^[11] Throughout that time, the Clearing Agencies have continually refined their capabilities across technical, risk, legal, and compliance dimensions, in tandem with the Cloud's own evolution and the industry's increasing adoption of it. Given this extensive maturity and development over the past decade, the Clearing Agencies believe that hosting Core C&S Systems in the Cloud, via a single CSP, is now appropriate and essential. By consolidating resources under a single CSP, the Clearing Agencies can optimize efficiency, reduce costs, mitigate risks, and maintain a cohesive environment for seamless collaboration and operation.

As described in greater detail in this advance notice, the Clearing Agencies propose to provision, within a single CSP, logically segregated sections of the Cloud Infrastructure that would provide the Clearing Agencies with the virtual equivalent of physical data center resources, including scalable resources that can (i) handle various computationally intensive applications with load-balancing and resource management (“Compute”); (ii) provide configurable storage (“Storage”); and (iii) provide network resources and services (“Network”). These resources would be logically segregated from other customers of the CSP. The Clearing Agencies would leverage the CSP's IaaS ( i.e., infrastructure as a service) and PaaS ( i.e., platform as a service) services for building and running Core C&S Systems.

The Clearing Agencies do not propose to transition all Core C&S Systems entirely out of their regional data centers at this time, but rather, to host a specified set of Core C&S Systems in ( printed page 71993) a Cloud Infrastructure while maintaining the remaining applications in the Clearing Agencies' regional data centers for the near term. The proposed transition would be achieved incrementally over a course of several years and would result in the Clearing Agencies hosting some Core C&S Systems on-premises and others in a Cloud Infrastructure.^[12]

This phased approach to transitioning to Cloud is to reduce risk. The Clearing Agencies believe that a “big-bang” approach of moving all applications at once introduces significant execution risk, primarily driven by the sheer scale and scope of such an effort. Moreover, many clearance and settlement applications on the Clearing Agencies' mainframe are still tightly coupled together. Even after such applications are modernized, many could experience latency dependencies with other applications that have not yet been modernized, hence the need to keep some applications in the Clearing Agencies' existing data centers for the near term. However, applications with little to no coupling, particularly those applications that have already been modernized, are ripe for Cloud transition and the subject of this Cloud Proposal. As for the remaining clearance and settlement applications that are not part of this proposal and would continue to be hosted on-premises, the Clearing Agencies have not thoroughly assessed when those applications would transition to Cloud, which may take several years, or whether such transition would be the subject of a later, separate advance notice proposal.

Integration between on-premises and Cloud-based Core C&S Systems would, as it is for non-Core C&S Systems that are already hosted in private and public cloud, leverage existing patterns and processes. The primary methods of application integration are application program interfaces (a/k/a APIs), messaging queues (a/k/a MQ messaging), and file transfer. All three are used to integrate internal and client applications, and all three methods provide interoperability between applications running on mainframe, private cloud, and public cloud.

For these reasons, the Clearing Agencies strongly believe that the phased approach enables the Clearing Agencies to best approach the transition to Cloud, safely and confidently.

B. Why Use Cloud

The Clearing Agencies believe there are very strong and compelling reasons to use Cloud as part of their diverse, platform strategy, including, as discussed below, the waning of the on-premises industry, improved resilience, expanded security capabilities, and increased scalability.

1. Waning On-Premises Industry

Although on-premises mainframes have been a stalwart for hosting critical applications for many years, it is the Clearing Agencies' experience that industry investment and development in on-premises platforms is waning, and the ability to source skilled and experienced staff to operate such platforms is increasingly challenging. Meanwhile, vendor consolidations are beginning to negatively affect investment and innovation in the private cloud space.^[13] As investment dollars are increasingly allocated to Cloud, vendor choice, innovation, and support will continue to diminish for on-premises platforms. This poses a growing risk to the Clearing Agencies, who today continue to rely primarily upon on-premises mainframes and private cloud solutions from a resiliency perspective.^[14] The Clearing Agencies believe the best way to manage against this risk at this time is to leverage a diverse platform strategy that will increase the use of and reliance upon Cloud. The use of Cloud, as part of a broader platform strategy, serves as an important tool in enabling the Clearing Agencies to anticipate and manage these and other risks more effectively.

2. Improved Resilience

The Clearing Agencies must ensure that any Core C&S Systems in the Cloud have resiliency and recovery capabilities commensurate with the Clearing Agencies' importance to the functioning of the U.S. financial markets. As explained in detail below, the Clearing Agencies believe that Cloud will enhance the resiliency of their Core C&S Systems by virtue of the Clearing Agencies' architectural design decisions, and the Cloud's redundancy, availability, and the Clearing Agencies' disciplined approach to deployment of Core C&S Systems to Cloud. In particular, the Clearing Agencies believe that Cloud will enhance their ability to withstand and recover from adverse conditions by provisioning redundant Compute, Storage, and Network resources in three availability zones, in each of two autonomous and geographically diverse regions, for a total of six availability zones that are comprised of many data centers.

The primary/hot region would be operational and accepting traffic, while the secondary/warm region would receive replicated data from the hot region with applications on stand-by. This solution significantly reduces operational complexity, mitigates the risk of human error by providing tools for automating routine tasks and orchestrating complex workflows, thereby reducing the need for manual intervention,^[15] and provides resiliency and assured capacity (although, the Clearing Agencies would continue to periodically review the CSP's capacity planning process through quarterly reviews).^[16]

The Clearing Agencies are assured of adequate capacity with the proposed hot/warm architecture because the Compute resources of the warm, “recovery” region would be already running with needed capacity. Additionally, the Clearing Agencies have reviewed the effect of a large, regional outage with the CSP, which indicated that a vast majority of the CSP's customers are not configured to use the secondary region as a failover region; thus, they would not be using capacity in that region. Moreover, a review of data from two large outages in the primary region did not show a change in capacity availability in the secondary region.

The Clearing Agencies also believe that Cloud reduces capacity-management risks when compared with on-premises platforms in three important ways: (1) capacity in Cloud can be added almost instantly; (2) such capacity can be added at magnitudes greater than what is possible with traditional, on-premises platforms; and ( printed page 71994) (3) the risk of a supply chain effect on capacity realization ( i.e., the risks associated with receiving and deploying servers necessary to create more capacity) is greatly reduced.

The proposed hot/warm configuration also enables application rotation between regions. The Clearing Agencies would have the ability to operationally rotate either a single application, groups of applications, or all applications to the warm region for both planned and unplanned events. Collectively, the proposed design of the Cloud Infrastructure helps ensure that the Clearing Agencies can meet any applicable two-hour recovery time objective.

Each availability zone, in each of the two regions, would be comprised of multiple physical data centers. Each data center would have its own distinct physical infrastructure with separate staff and dedicated connections to utility power, standalone backup power sources, independent mechanical services, and independent network connectivity.

Although not dependent on each other, availability zones of a region are connected to each other with private, fiber-optic networking, enabling Core C&S Systems to automatically failover between a region's availability zones without interruption. Since each availability zone can operate independently, but failover capability is nearly instantaneous, a loss of one availability zone would not affect operation in another; therefore, no Core C&S System would be reliant on the functioning of a single availability zone.^[17]

Altogether, the proposed Cloud Infrastructure would afford the Clearing Agencies six levels of redundancy ( i.e., three availability zones, made up of many data centers, in each of the two regions), with primary/secondary regions running in a hot/warm configuration, respectively, in geographically separate and segregated locations, and with each region containing multiple copies of the data. Thus, even if an availability zone is lost in the primary region, the Cloud can continue to seamlessly operate Core C&S Systems in the primary region, thereby significantly reducing availability risk and any attendant consequences for the Clearing Agencies' participants and customers. As a result, the Cloud Infrastructure offers the Clearing Agencies multiple redundancies within which to run Core C&S Systems, limits the effect of an incident at the CSP to the smallest footprint possible, and mitigates the possibility of the Clearing Agencies suffering an intra-, inter-, or multi-region outage.

By comparison, the Clearing Agencies' current on-premises hosting capabilities, both mainframe and private cloud, are operating on one primary data center in one region, with a second, recovery data center in a second region (excluding data bunkers, which do not have Compute capabilities). In other words, it is many times less likely that an unplanned, out of region failover would be needed for Core C&S Systems hosted in Cloud than currently hosted on-premises. (Even in the unlikely event that the Clearing Agencies needed to fail over to the secondary Cloud region, the decision and process of doing so would continue to be in the sole discretion of the Clearing Agencies.) This increased redundancy represents a material improvement in resiliency for the Clearing Agencies and a material reduction in risk for the industry.

Additionally, transitioning to Cloud offers the Clearing Agencies a more effective strategy for avoiding technical debt and system degradation because the CSP, in its role as such, would be performing regular system upgrades and maintenance, helping to ensure the Cloud's resiliency. Unlike on-premises solutions that may struggle to keep pace with evolving technology, due in part to the waning demand for on-premises infrastructure, CSPs take on the responsibility of regularly updating and maintaining their cloud infrastructure, which they do in a competitive environment. This approach helps ensure that the CSP's cloud infrastructure remains up to date, secure, and performs at its best, minimizing the likelihood of accumulating technical debt and preventing the decline of system capabilities and resiliency over time. This is not to say that on-premises infrastructures are not updated or maintained today but, instead, that the CSP does it better and faster. CSPs excel in ensuring that systems remain up to date, secure, and perform at their best by leveraging automation, scalability, built-in security measures, service level agreements (“SLAs”), economies of scale, and continuous monitoring and improvement processes. These advantages collectively enable CSPs to provide more reliable, resilient, and high-performance services compared to traditional on-premises environments.

3. Expanded Security Capabilities

Hosting Core C&S Systems in Cloud would not change the physical and cybersecurity standards to which the Clearing Agencies currently align—the National Institute of Standards and Technology (“NIST”) ^[18] and Center for internet Security (“CIS”).^[19] Application of NIST is considered a best practice for financial services use of cloud.^[20] Moreover, as discussed further below, the Clearing Agencies would continue to apply existing security processes and standards to include network and identity and access management (“IAM”) controls, security governance and controls for sensitive data, security configuration, provisioning, logging and monitoring, and security testing and validations.

By hosting in Cloud through the CSP that the Clearing Agencies have engaged, the Clearing Agencies would be able to add cloud-specific security capabilities and measures provided by the CSP, as well as third-party tools. For example, such capabilities and measures would include automation, monitoring, and security incident response capabilities, as well as default separation between Reg. SCI and non-Reg. SCI operating domains, and ubiquitous encryption, all of which are not available in the current on-premises data centers. Similarly, micro-segmentation of applications and infrastructure provided by the CSP, which also is not available in the Clearing Agencies data centers, limits the effect of a security incident and reduces the time to detection and recovery.^[21]

4. Increased Scalability

Cloud implementation would allow for greater scalability of Compute, Storage, and Network resources that support Core C&S Systems.^[22] With a Cloud Infrastructure, the Clearing Agencies could quickly provision or de-provision Compute, Storage, or Network resources to meet demands, including elevated trade volumes, and provide more flexibility to create development and test environments, as well as other system development needs.^[23] For example, the CSP could support elastic workloads and scale dynamically without the need for the Clearing Agencies to procure, test, and install additional servers, storage, or other hardware.

The Clearing Agencies would pre-provision Compute and Storage resources proactively, in addition to scaling resources on-demand. This means that the Clearing Agencies would be able to increase Compute capacity in one or both regions via manual or automated processes for Core C&S Systems. The rapid deployment of Compute capacity would allow the Clearing Agencies to obtain access to resources far more quickly than with on-premises data centers. The Clearing Agencies would combine the pre-provisioning of primary capacity with regular capacity stress testing to verify that the underlying Compute can sustain required business volumes. The stress testing data would be used to determine the base levels of pre-provisioned capacity.

The ability to quickly scale workloads materially improves the Clearing Agencies ability to respond to unexpected market events and external scenarios, such as a global pandemic.^[24] This capability also enables the Clearing Agencies to run risk calculations more frequently, at greater speeds, and with more compute-intensive models than is economically feasible compared to the Clearing Agencies' on-premises infrastructure.

In sum, transitioning to Cloud not only enhances scalability but also significantly improves agility beyond the Clearing Agencies' on-premises capabilities. The on-demand resources provided by the CSP enable dynamic scalability, helping to ensure optimal performance during peak times, efficient resource allocation during periods of lower demand, and the ability to innovate faster to meet evolving business requirements.

C. Why a Single CSP is Appropriate

The Clearing Agencies strongly believe that hosting Core C&S Systems with a single CSP is appropriate. The Clearing Agencies have assessed the capabilities of the CSP in adherence with the Clearing Agency Risk Management Framework,^[25] which requires the respective Board of Directors of the Clearing Agencies to approve policies governing relationships with service providers, such as the CSP, thus helping to ensure alignment with the Clearing Agencies' risk management principles.

Beyond simply being a well-known, reputable, industry-leading, and capable CSP, the Clearing Agencies and the CSP have spent several years discussing the Clearing Agencies' needs, including operational, legal, and regulatory obligations; what-if scenarios; and commercial implications. That extensive effort led to a number of benefits, including the CSP introducing new products ^[26] and the establishment of an exhaustive contractual agreement between the Clearing Agencies and the CSP that addresses the Clearing Agencies' needs for hosting Core C&S Systems in Cloud (“Cloud Agreement”).^[27 28]

Meanwhile, it is generally understood that in the present environment adding a secondary CSP or an on-premises backup introduces significant complexity, costs, and risks that outweigh expected benefits.^[29] An on-premises or secondary CSP backup would require the Clearing Agencies to engineer their primary Cloud Infrastructure to the lowest common denominator, so that the systems operating on the primary infrastructure also could run on a completely separate and distinct secondary, backup infrastructure. This approach would severely reduce the value that Cloud provides, introduce significant cost with little benefit, and greatly increase operational complexity, all of which would result in negative consequences for the efficiency and resiliency of the Clearing Agencies, their participants, and the industry.

Notwithstanding the extensive benefits from moving to Cloud, the Clearing Agencies fully appreciate and are committed to managing the risks presented in relying on a single CSP, as identified and discussed in Section II.A, further below.

D. Transition Timeframe

The Clearing Agencies believe that transitioning certain Core C&S Systems to the Cloud is critical to managing the risks that are inherent in technology and vendor selection. However, as stated above in Section I.A, the intent of the ( printed page 71996) Cloud Proposal is not to move all Core C&S Systems to Cloud at one time. The Clearing Agencies believe that a “big-bang” transition would introduce unnecessary execution risk, primarily driven by the sheer scale and scope of such an effort. Moreover, many applications on the mainframe are still tightly coupled together and not ready to be moved to public cloud. Rather, at this time, the Clearing Agencies are proposing to move only a subset of the Core C&S Systems to the Cloud and to do so on an incremental basis, in consideration of the specifics of each application and the needs of the Clearing Agencies.^[30] This approach helps enable the hosting of Core C&S Systems on the most appropriate platform, at the most appropriate time, in an efficient and secure manner.

The subset of Core C&S Systems selected for this proposal have been initially identified based on several preliminary criteria, including, but not limited to, whether:

• the application would benefit from the presence of data sets already present in Cloud;
• the application would benefit from elasticity enabled by Cloud (e.g., user interfaces); and
• the application already meets certain architectural patterns for Cloud (e.g., the application has already been modernized and currently hosted in private cloud and/or is a siloed application—little to no coupling with other applications).

Assuming the Clearing Agencies would receive no regulatory objection to this advance notice, each application of the proposed subset of Core C&S Systems then would undergo an in-depth, architectural review that would follow the Clearing Agencies' governance process, governed by the System Delivery Process.^[31] The governance process includes, where applicable, a detailed review and approval by the Information Technology Architecture Review Board (“ARB”),^[32] the New Initiatives process,^[33] to include the Business Case Council and the Risk Assessment Council that vet the financials and risks of the proposed move, and the Investment Management Committee.^[34] Further escalations would be made to the Executive Committee and applicable Board of Directors of the Clearing Agencies, as needed. Re-platforming efforts also would be communicated to regulators in accordance with the change reporting requirements of Section 1003(a)(1) of Reg. SCI, as applicable.^[35]

The above-described governance process does not include a specific set of criteria or thresholds for the ultimate determination on whether an application should or should not be moved to Cloud—it is not a formulaic decision. Rather, the Clearing Agencies employ a more qualitative evaluation process that involves various reviews and considers high-level architectural principles that may be applicable to more than one application. However, at this time, none of the Core C&S Systems that have been initially identified as part of the Cloud Proposal, based on the preliminary criteria listed above, have completed that more detailed governance review process. Given the extensiveness of the process, it would not begin until after the Clearing Agencies would receive no regulatory objection to this advance notice.

Although the Clearing Agencies do not anticipate needing to deviate from the proposed transition schedule for the selected Core C&S Systems, the Clearing Agencies recognize that deviation may be necessary, given that the more in-depth governance review process has not completed and because risks could change over the proposed, multiyear implementation period. For example, a deviation may be necessary to address a business need or a change in industry or regulatory requirements or standards. Regardless, any deviation would follow the same detailed governance process, and the Clearing Agencies would provide notice of such deviation to Commission staff, the reason for the deviation, and how the proposed implementation schedule would be updated to account for the deviation. Further, the Clearing Agencies recognize that deviating from the proposed transition schedule would necessitate a separate analysis to determine whether such deviation could materially affect the nature or level of risk posed by each of the Clearing Agencies.

Even though certain on-premises infrastructure components would be decommissioned after applications are moved to Cloud, the Clearing Agencies' private cloud, mainframe services, and data-center facilities would remain available for no less than five more years to help facilitate exit plans from Cloud that rely on an on-premises option. However, to be clear, the on-premises option would not be available to address short-term disruptions, where the Cloud is temporarily unavailable. Management of such disruptions is discussed in Section II.B, further below.

II. Expected Effects on Risks to the Clearing Agencies, Their Participants, or the Market

Although the Clearing Agencies are not proposing to transition all Core C&S Systems to Cloud for the reasons described in Sections I.A and D, above, transitioning the proposed subset of Core C&S Systems from an on-premises infrastructure supported by a consolidating industry, as described in Section I.B.1, above, to a new Cloud Infrastructure maintained by an industry-leading CSP provides numerous advantages, as described in Sections I.B.2-4 and C, above. However, such transition is not without risk, as discussed below.

A. Risks Presented by the Cloud Proposal

1. Concentration Risk

The Clearing Agencies appreciate that reliance on a single CSP for hosting the subset of Core C&S Systems that are the subject of this proposal creates concentration risk, particularly in the event of the CSP choosing to terminate its services ( i.e., commercial risk) or is unexpectedly unavailable ( i.e., operational risk). The Clearing Agencies also appreciate that they would have some reliance on the CSP to help meet certain regulatory obligations of the Clearing Agencies ( i.e., regulatory risk), thus introducing the familiar concept of concentration risk in a relatively new ( printed page 71997) context. However, concentration risk exists today as the Clearing Agencies are dependent on a single mainframe provider, a single database provider for the mainframe, and a single virtualization provider for private cloud. Moreover, the Clearing Agencies believe that they have adequately addressed these risks, as discussed throughout Sections II.B.1-4., below.

2. Cloud Management Risk

Managing the applicable subset of Core C&S Systems hosted on a Cloud Infrastructure presents different risks and challenges than managing such systems hosted on-premises because many activities and services previously provided by the Clearing Agencies would now be provided by the CSP. For example, the Clearing Agencies would be dependent upon the CSP for fulfilling all of its contractual obligations, including security of the Cloud, proper capacity planning, and protection of Cloud services from prolonged operational outages. As such, overseeing the CSP becomes a critical activity to ensure the CSP is delivering services that meet or exceed the Clearing Agencies' requirements for operating those select Core C&S Systems. As discussed in Sections II.B.1-4, below, the Clearing Agencies believe that they have adequately addressed this risk.

B. Management and Mitigation of Identified Risks

1. Cloud Agreement

The Clearing Agencies believe that the Cloud Agreement, including all its amendments and addendums, is a strong tool in helping to effectively mitigate the commercial and regulatory risks borne from the concentration risk, as described in Section II.A.1, above, as well as risks in managing the CSP that would host the subset of selected Core C&S Systems in the Cloud, as described in Section II.A.2, above. Following is a summary of some of the key terms and conditions covered in the agreement and how they help mitigate these risks.

i. Adequate Notice

Under the Cloud Agreement, the CSP may not unilaterally terminate the relationship with the Clearing Agencies absent good cause or without sufficient notice to allow the Clearing Agencies to transition their applications elsewhere. Specifically, the CSP must provide an extensive notice if it wishes to terminate the Cloud Agreement for convenience or if it wishes to terminate an individual CSP service offering or lower an existing SLA on which the Clearing Agencies rely.^[36]

The CSP is permitted to terminate the Cloud Agreement with shorter notice periods in the event of a critical breach ^[37] or an uncured material breach ^[38 39] of the Cloud Agreement. In the highly unlikely event that a critical breach or uncured material breach occurs, the Clearing Agencies would have sufficient notice to shift their operations away from the CSP. Contract provisions that allow a party to terminate for uncured material breaches are designed to limit the types of actions that could lead to contract termination and to establish a period of time to resolve an aggrieved party's claim (often 30 days) followed by an additional extended period in which to remediate the claim. This gives the parties time and incentive to address the problem without having to resort to termination. In other words, even if the CSP notifies the Clearing Agencies of an alleged breach (material or critical), termination of services is not immediate. Additionally, regardless of the need to shift operations elsewhere—convenience or breach—the Cloud Agreement provides for the parties to work together and for the CSP to provide professional services to assist with such a shift.^[40]

The Clearing Agencies believe the risk of termination under the above-discussed shorter notice period is minimal. In all cases of an alleged breach, the CSP must notify the Clearing Agencies in writing and provide time for them to cure the alleged breach (“Notice Period”).^[41] With respect to an alleged material breach, which requires the CSP to extend the Notice Period if the Clearing Agencies demonstrate a good faith effort to cure the alleged material breach, the Clearing Agencies would use the Notice Period to attempt to cure the alleged material breach while also preparing to transition elsewhere. As a result, it is highly unlikely that a critical breach or a material breach would remain uncured beyond the Notice Period. If one does remain uncured, however, the CSP can only terminate the rights or accounts associated with the breach, not the entire Cloud Agreement; ^[42] meanwhile, and the Clearing Agencies would have ample notice to shift operations to avoid a disruption to Core C&S Systems, if needed.

As explained above, adequate notice under the Cloud Agreement plays an important role in managing concentration risk by providing the Clearing Agencies with advance warning of potential disruptions or changes in the agreement or services thereunder, which would allow the Clearing Agencies to take proactive measures in mitigating the potential impact of commercial and regulatory risk, thereby reducing concentration risk.

ii. Regulatory Compliance and CSP Oversight

The Clearing Agencies' transition to Cloud does not alter their responsibility to maintain compliance with applicable regulations. Consistent with FFIEC Guidance (as defined and discussed further below), the Clearing Agencies' will continue to fully comply with all applicable regulatory obligations, particularly Reg. SCI.^[43]

The Clearing Agencies believe the combination of the following would provide them with reasonable assurance that the proposed transition to Cloud ( printed page 71998) would enable them to continue to fully satisfy their regulatory obligations, including Reg. SCI, thus helping to mitigate the regulatory risk highlighted in Section II.A.1, above: (i) the Cloud Agreement; (ii) the CSP's compliance programs as described in its whitepapers ^[44] and publicly available policies ( e.g., its Penetration Testing Policy),^{[45 46 47 48]} and user guides; (iii) the CSP's SLAs; ^{[49 50 51]} (iv) the CSP's Systems Organization Controls reports ( e.g., SOC 1, SOC 2, SOC 3) ^[52] and International Organization for Standardization (“ISO”) certifications ( e.g., ISO 27001); ^[53] (v) the CSP's size, scale, and ability to deploy extensive resources to protect and secure its facilities and services; and (vi) the CSP's commercial incentive to perform.

Moreover, as noted in Section II.B.ii., above, oversight of the CSP relationship and services has become a standing practice of the Clearing Agencies to ensure that the CSP is meeting or exceeding its contractual obligations, including helping the Clearing Agencies demonstrate their regulatory compliance. Such oversight, which also helps mitigate the cloud management risk raised in Section II.A.2, above, would include a strong relationship between the CSP and the Clearing Agencies, including between their senior management. Within the Cloud Agreement itself, there are established obligations on the CSP to provide the Clearing Agencies' information necessary for the Clearing Agencies to satisfy certain compliance and regulatory requirements, particularly Reg. SCI. For example, the Cloud Agreement obligates the CSP to provide the Clearing Agencies with immediate notification where a systems intrusion by an unauthorized party or a systems disruption is suspected.^[54] The agreement also provides for detailed quarterly briefing meetings between the Clearing Agencies and the CSP, during which the Clearing Agencies would be provided information on and could review service level performance, material systems changes, capacity management, SLA updates, and important security notices.^[55]

The Cloud Agreement permits the Clearing Agencies to perform an annual review of the CSP's documentation and services to gain comfort that the CSP is meeting its contractual requirements and that the notification procedures are in place to allow the Clearing Agencies to meet their regulatory requirements, particularly Reg. SCI. The agreement also allows a regulator of the Clearing Agencies to receive information about the Clearing Agencies' usage of the CSP services, and it allows the regulator to perform its own on-site review, if requested.^[56]

2. Cloud Architecture

To mitigate operational risk associated with the concentration risk from relying on a single CSP, the Clearing Agencies would architect the Cloud Infrastructure hosting their Core C&S Systems to be highly resilient, improving the availability of such systems and related Clearing Agency services during any degradation in CSP services:

• Use of multiple availability zones per region. The Clearing Agencies would use at least three availability zones, in each of the two CSP regions, with each availability zone made up of multiple data centers.
• Multi-regions. In the event of a primary region outage, the Clearing Agencies would recover in the secondary region. Out-of-region recovery would be tested annually by the Clearing Agencies, and a primary/secondary ( i.e., hot/warm) model would be used to ensure continuous data replication and recovery is achieved.^[57] Recovery exercises of non-Core C&S Systems currently hosted in cloud demonstrate the ability to recover applications within required recovery time objectives, including meeting a 2-hour recovery time objective for relevant applications in the event of an out-of-region recovery.

• Multi-node, high availability clusters across availability zones. Clusters ( i.e., three or more servers or nodes) protect against local hardware and service failures providing uninterrupted operations. Each cluster would be distributed across three availability zones. Clusters synchronously replicate data across all nodes to protect against data loss and provide continuous availability.
• Static stability and static capacity models. Static capacity would be pre-provisioned for compute, storage, and memory for applications based on capacity stress testing results and capacity requirements. The Clearing Agencies would pre-provision capacity ( printed page 71999) needed for applications and services and would not rely on capacity on-demand models, thus reducing the risk of running out of capacity.
• Exit plans. The Clearing Agencies' existing policies require that all applications hosted in Cloud have documented exit plans, with each plan updated annually.^[58] The Clearing Agencies' Cloud architecture also reduces “vendor lock-in” by using capabilities such as “containers” ^[59] that can exist in both the public and private cloud, where appropriate and applicable. For the foreseeable future, the Clearing Agencies plan to continue to own or lease private data center space to host private cloud and mainframe capabilities. The Clearing Agencies private, on-premises data centers help enable a long-term exit plan from Cloud, if needed. However, such data centers would not be a means to address a short-term incident at the CSP. Additionally, for the second CSP that the Clearing Agencies already have contracted and connected with for hosting non-Core C&S Systems, they are now working on the contractual and operational requirements that would be necessary to possibly host Core C&S Systems in its Cloud to further enable exit plans from the primary CSP.

• Regional Isolation Architecture. A cross-regional outage is highly unlikely at the CSP, as the CSP has designed and implemented a series of controls to ensure that defects cannot be introduced to more than a single region at a time.^[60] Services are regionally isolated with a single exception—the IAM service. The IAM service is not regionally isolated and depends on a single region. If the primary region for the IAM service fails, the service will continue to operate but as read-only. To mitigate this risk, the Clearing Agencies would architect applications and infrastructure services in such a manner that they would not require updates ( i.e., writes) to the IAM service in order to rotate out of region.

In summary, cloud architecture helps mitigate operational risk borne from concentration risk, as raised in Section II.A.1, above, by providing resilient infrastructure, scalable resources, robust security measures, and disaster recovery capabilities, all of which assist in minimizing the impact of disruptions.

3. Standing Risk Management Practices

The Clearing Agencies' standing risk management practices also help minimize operational risk by systemically identifying, assessing, mitigating, monitoring, and responding to risk. For example, the Clearing Agencies have considered the possibility of the CSP being completely and unexpectedly unavailable, whether due to technical issues or other reasons. The parallel risk exists today with respect to the Clearing Agencies' existing infrastructure. Just like with the CSP, it is possible that the Clearing Agencies' two existing data centers—one primary and one backup—become completely and unexpectedly unavailable. In fact, it is more likely that those two data centers become unavailable than the CSP's data centers because the CSP has so many more data centers for each availability zone, in both its primary and secondary regions, with each data center, not just the associated region or availability zone, having its own physical infrastructure, staff, power, backup power, mechanical services, and network connectivity, as discussed in Section I.B.2, above. Even for the CSP's IAM service that runs cross regions, the applications in each region operate off read-only versions of the IAM roles and responsibilities, such that loss of the primary would not affect operation of those applications. Nevertheless, to help manage a crisis event, such as the Clearing Agencies' or the CSP's data centers becoming unavailable, the Clearing Agencies have standing risk management plans and practices already in place, as described below.^[61]

In the very unlikely event of an unexpected single- or multi-region outage in which the Clearing Agencies operate, or a complete and unexpected CSP outage, the Clearing Agencies would initiate the existing Major Incident Management (“MIM”) process, which is an existing process that involves evaluating the technical impact of the event, and if the event is deemed to have a material impact to the business, the Business Incident Management System (“BIMS”) ^[62] would be activated. Depending on the severity of the event, the DTCC Global Business Continuity and Resilience (“BCR”) Policy would provide a predictable structure to be utilized during crises and could be leveraged to address, respond to, and manage an outage.^[63] In addition to internal risk management practices, the Clearing Agencies have plans to help address various outage scenarios and the potential effects of an outage.^[64]

The BCR Policy and Standards is structured to employ existing DTCC and Clearing Agency teams and committees, which become the tactical leadership to react, respond, and manage a crisis situation.^[65] The teams are comprised of the following:

• Crisis Management Team. Comprised of the Management Committee, site General Managers, Head of the Board Risk Committee,^[66] and other SMEs, as needed.

• Crisis Response Teams. ( printed page 72000)

○  Business Continuity Coordinators and Plan Approvers —These are individuals who manage business continuity at a plan level.

• Fair and Orderly Markets Groups —These are crisis teams comprised of internal stakeholders and top executives from external firms deemed necessary to ensure a fair and orderly market. They would be activated (based on impact to the legal entity) to gather information during a large systemic event when operational coordination is required with clients and the sector.
• IT Management Team —Comprised of Information Technology managing directors and SMEs.
• Management Risk Committee —Comprised of senior members across the enterprise.
• Senior Site Management Team (“SSMT”) —Each DTCC office with a facility level resilience plan (“FLRP”) has an SSMT, that is comprised of senior leadership from the site.
• Site Assessment Team (“SAT”) —Sites with an FLRP have a SAT that responds to site-specific events. This team is comprised of a primary/back-up site General Manager and representatives from BCR, IT, Workplace Design and Service, Global Security Management, and Human Resources. A Data Center Services representative also is added for sites that have a data center.
• MIM and BIMS Teams —Part of the IT organization that manages technology specific and are typically resolved at the application or hardware level with support from the appropriate SMEs.
• Crisis Communication Team. The Crisis Communication Team is comprised of officer-level members from Marketing and Communication, Human Resources, General Counsel's Office, and Regulatory Relations, as well as members of their staffs, as applicable.

The Clearing Agencies believe that these standing risk management practices are key to managing the operational risk borne from concentration risk outlined in Section II.A.1, above, by helping to promote proactive risk management culture, enhancing operational resilience, and enabling the Clearing Agencies to better navigate uncertainties and maintain business continuity.

4. Industry Standards for Cloud Management

i. Cloud Management: Federal Financial Institutions Examination Council Cloud Computing Guidance (“FFIEC”)

On April 30, 2020, FFIEC ^[67] issued a joint statement to address the use of Cloud computing services and security risk management principles in the financial services sector (“FFIEC Guidance”).^[68] While the FFIEC Guidance does not contain regulatory obligations, it highlights risk management practices that financial institutions should adopt for the safe and sound use of Cloud computing services in five broad areas (“FFIEC Risk Management Categories”): Governance, Cloud Security Management, Change Management, Resilience and Recovery, and Audit and Control Assessment. As discussed below, the Clearing Agencies would implement practices consistent with the FFIEC Risk Management Categories for Core C&S Systems operated in Cloud to help address cloud management risk, as highlighted in Section II.A.2, above, by providing frameworks, guidelines, and best practices, that enhance transparency, reliability, and security.

(a) Governance

The Clearing Agencies and the CSP rely on a shared responsibility model that differentiates between security “of” the Cloud and security “in” the Cloud.^[69] This model is not specific to the agreement between the Clearing Agencies and the CSP; rather, it is a more universally followed model for public cloud services. Under the model, the CSP maintains sole responsibility and control over the security and resiliency “of” the Cloud, and their customers are responsible for the security and resiliency “in” the Cloud ( i.e., security and resiliency of hosted applications and data). This means that the Clearing Agencies must manage their own application architectures, data backups, change management controls, network configurations within applications, and response to application failures. In addition, the Clearing Agencies must manage their own data usage and data-at-rest encryption configuration, IAM access policies and roles, operating system upkeep, security group configurations, and network traffic encryption in transit configurations. The Clearing Agencies also manage how they place workloads onto the CSP's platform.

Meanwhile, the CSP must manage backend hardware services for Compute, Storage, Networking, database, and global architectures such as regions, availability zones, data centers, power, and HVAC, as well as backend security services that protect core infrastructures. The CSP manages the underlying infrastructure and upkeep, so that the Clearing Agencies (and other customers) can place workloads on the CSP platform with proper security and separation without having to manage these traditional data center tasks. The Clearing Agencies review the CSP's policies and procedures for these functions during the quarterly reviews and during annual risk assessments.

When looking more closely at hardware management, the Clearing Agencies believe there are benefits in how the CSP manages hardware for Cloud compared to how the Clearing Agencies manage hardware for their own data centers. For example, with on-premises data centers, the Clearing Agencies must oversee a multifaceted supply chain, involving many vendors to obtain and administer physical Compute, Storage, and Network capacity. Delivery times may fluctuate, and scarcities can affect project outcomes, as seen during the Covid-19 pandemic. In contrast, with the proposed Cloud Infrastructure, the CSP controls the hardware supply chain and even partakes in key areas of the manufacturing process to circumvent typical problems such as chip shortages. Moreover, the Clearing Agencies get to review the CSP's equipment forecast for each upcoming quarter, affording the Clearing Agencies the opportunity to address potential supply chain difficulties, if any, without jeopardizing their access to adequate capacity, by leveraging capabilities such as reserved capacity. Altogether, the Clearing Agencies believe the CSP's management of Cloud hardware will be a benefit to them.

The CSP would perform its own risk and vulnerability assessments of the CSP infrastructure on which the Clearing Agencies would run their Core C&S Systems. In published ( printed page 72001) documentation and in meetings conducted with the CSP, the CSP asserts that it maintains an industry-leading automated test system, with strong executive oversight, and conducts full-scope assessments of its hardware, infrastructure, internal threats, and application software. The CSP asserts that it has an aggressive program for conducting internal adversarial assessments (“Red Team”) designed not only to evaluate system security but also the processes used to monitor and defend its infrastructure. The CSP also uses external, third-party assessments as a cross-check against its own results and to ensure that testing is conducted in an independent fashion. Pursuant to the CSP's documentation, results of these processes are reviewed weekly by the CSP's Chief Information Security Officer and the Chief Executive Officer with senior CSP leaders to discuss security and action plans.^[70]

The Clearing Agencies have the responsibility to perform risk assessments and technical security testing, including control validation, penetration testing, and adversarial testing of their applications running on the Cloud Infrastructure. This includes testing of the application interface layer of some CSP provided services such as storage and key management.

As mentioned, the Clearing Agencies' testing includes assessing the configuration of the CSP provided services. The Clearing Agencies' Technology Risk Management staff would work with the Clearing Agencies' Information Technology staff to ensure that the CSP tools are configured to appropriately manage and mitigate potential sources of risk and will assess the effectiveness of those configurations.^[71] The Technology Risk Management staff has developed an application, Cloud Governance Insights (“CGI”), to continuously monitor all Cloud Infrastructure for alignment to security baselines and configurations best practices.^[72] The CGI dashboard allows Information Technology and Technology Risk Management staff to understand the environment risk posture and reporting of key risk indicators (“KRIs”). The Clearing Agencies' Red Team would operate freely “in the Cloud,” attempting to subvert or circumvent controls.^[73] The testing would include probing of the CSP provided services to look for weaknesses in the Clearing Agencies' deployment of those tools.

Technology Risk Management staff would routinely report test results to the Technology Risk Management Steering Committee and the Management Risk Committee, appropriate functional Operations and Information Technology management, senior management, and the Board of Directors of the Clearing Agencies.^[74 75] Automated vulnerability scanning reports, source code analysis, and results of specific assessments would be risk-rated and assigned a priority for remediation in accordance with Clearing Agency Information Security Program requirements.^[76 77]

Management and oversight of the Cloud implementation follows the Clearing Agencies' standard governing principles for large information technology projects.^[78] To maintain accountability over the CSP's performance, regular reporting to the Boards of the Clearing Agencies by senior management is essential and required, pursuant to the DTCC Third Party Risk Procedures.^[79] Such reporting helps ensure that senior management takes appropriate actions to address significant performance deterioration, changing risks, or material issues identified through ongoing monitoring, thereby helping to ensure proactive risk management and continuous improvement.^[80] The Clearing Agencies' Board of Directors has established a Technology and Cyber Committee to assist the Board of Directors in overseeing information technology and cybersecurity strategy and capabilities.

Information Technology and the Enterprise Program Management Office (“EPMO”) are responsible for the identification, management, monitoring, and reporting on the risks associated with the modernization and migration of applications to Cloud. To that end, reports on the status and progress of these efforts are reported to applicable Clearing Agency committees based on escalation criteria in the EPMO Procedure.^[81] These reports include overall risk and issue summaries and analysis of key risk indicators for the migration of applications to the public cloud.

Finally, the Clearing Agencies' Internal Audit Department (“IAD”), as the independent third line of defense, is responsible for assessing and challenging the firm's control environment and risk management and control frameworks, which include those related to the Cloud, including, but not limited to, security controls and configurations, and report the results of ( printed page 72002) those assessments to management and the Audit Committee of the Board.^[82]

Ultimately, there is no primary/secondary relationship, as the Clearing Agencies and the CSP each have their own set of responsibilities which, when combined, address the entire risk space.

(b) Cloud Security Management

The Clearing Agencies have established a robust Cloud security program to (i) manage the security of the Core C&S Systems that would be running on the Cloud Infrastructure hosted by the CSP, and (ii) assess and monitor the CSP management of security of the Cloud Infrastructure that it operates. The security program is built upon Clearing Agency Information Security Policies and Control Standards that establish requirements that apply to any technology system as well as any tool that provides technology services.^{[83 84 85 86]} Below describes elements of the Clearing Agencies' Cloud security management in the areas of (i) IAM controls ( i.e., determining who is accessing the systems, granting access to the applications, and then controlling what information they can access); (ii) security governance and controls for sensitive data; (iii) security configuration, provisioning, logging, and monitoring; and (iv) security testing.

(1) Network and IAM Controls

The Clearing Agencies recognize that robust network security configuration and IAM would provide reasonable assurance that users—including Clearing Agency employees, market participants, and service accounts for systems ^[87] —are granted least-privileged access ^[88] to the network, applications, and data in the Cloud. The Clearing Agencies would use third-party tools to automate appropriate role-based access to the Core C&S Systems running in the Cloud. By enforcing strict separation of duties and least-privileged access for infrastructure, applications, and data, the Clearing Agencies would protect the confidentiality, availability, and integrity of the data in the Cloud.

The Clearing Agencies have established IAM requirements that build upon the least-privileged model.^[89] As part of the IAM program, all users must be assigned an appropriate enterprise identification. Additionally, the Clearing Agencies have established Highly Privileged Access Management capabilities and policies to further restrict highly privileged access to be used only in pre-determined scenarios that must be tied to a change, incident, request, or release records.^[90]

Cloud users would be granted access to systems via a standardized and auditable approval process. The user identifications and granted access would be managed through their full lifecycle from a centralized IAM system maintained and administered by the Clearing Agencies. Role-, attribute-, and context-based access controls would be used as defined by internal standards ^[91] consistent with industry recommended practices to promote the principles of least-privileged access and separation of duties.^[92]

The Clearing Agencies would use and manage third-party tools not otherwise provided by nor managed by the CSP for single sign-on and least-privileged access.^[93] The network also would include hardware and software to limit and monitor ingress and egress traffic, encrypt data in transmission, and isolate traffic between the Clearing Agencies and the Cloud.^[94] Since the Clearing Agencies would continue to provide cryptographic services, including key management, the CSP and other network service providers would not be able to decrypt Clearing Agency data either at rest or while in transit.

(2) Security Governance and Controls for Sensitive Data

The Clearing Agencies' data governance framework that would apply to Cloud implementation is identified within the Clearing Agency Information Security Policies and Control Standards.^[95] The Clearing Agency Information Security Policies and Control Standards address data moving between systems within the Cloud as well as data transiting and traversing both trusted and untrusted networks. For example, the Clearing Agencies' Information Security Policies and Control Standards require a system or Software as a Service ( i.e., SaaS) to (i) store data and information, including all copies of data and information in the system, in the U.S., throughout its lifecycle; (ii) be able to retrieve and access the data and information throughout its lifecycle; (iii) for data in the system hosted in the Cloud, encrypt such data with key pairs kept and owned by the Clearing Agencies; (iv) comply with U.S. federal and applicable state data regulations regarding data location; and (v) enable secure disposition of non-records in accordance with the Clearing Agencies' Information Governance Policy.^[96]

Furthermore, the Clearing Agencies' policies establish the overall data governance framework applied to the management, use, and governance of Clearing Agency information to include digital instantiations, storage media, or whether the information is located, processed, stored, or transmitted on the Clearing Agencies' information systems and networks; public, private, or hybrid ( printed page 72003) cloud infrastructures; third-party data centers and data repositories; or SaaS applications.^[97] The Information Classification and Handling Policy ^[98] classifies the Clearing Agencies' information into categories. System owners of technology that enable classification and/or labeling of information are responsible for ensuring the correct classification level is designated in the system of record and the applicable controls are enforced. All information requiring disposal is required to be disposed of securely in accordance with all applicable procedures. Sensitive data must be handled in a manner consistent with requirements in the Information Classification and Handling Policy.

The Clearing Agencies would implement key security components, namely ubiquitous authentication, and encryption via use of an automated public key infrastructure, coupled with responsive, highly available authentication, authorization tools, and key management strategies to ensure appropriate industry standard security controls are in place for sensitive data both in transit to and at rest in Cloud.^[99]

External connectivity to the Clearing Agencies' systems hosted by the CSP would be provided, as it is now, through dedicated private circuits or over encrypted tunnels through the internet. These network links also would have additional security controls, including encryption during transmission and restrictions on network access to and from the Cloud. Additionally, the Clearing Agencies would use dedicated redundant private network connections between the Clearing Agencies data centers and the CSP infrastructure. The Clearing Agencies currently maintains two data centers and will do so in the near term to provide redundant, geographically diverse connectivity for market participants.

All network communications between the Clearing Agencies and the Cloud Infrastructure would rely on industry standard encryption for traffic while in transit. Data at rest would be safeguarded through pervasive encryption. The Clearing Agencies' Encryption Standards ^[100] describe requirements for implementation of the minimum required strengths, encryption at rest, and cryptographic algorithms approved for use in cryptographic technology deployments across the Clearing Agencies. All Clearing Agency identifying data is encrypted in transit using industry standard methods. The Key Management Service (“KMS”) Strategy ^[101] dictates that all CSP endpoints support HTTPS for encrypting data in transit. The Clearing Agencies also secure connections to the endpoint service by using virtual private computer endpoints and ensures client applications are properly configured to ensure encapsulation between minimum and maximum Transport Layer Security versions pursuant to the Clearing Agencies' encryption standard.

The Clearing Agencies would have exclusive control over the encryption keys; only Clearing Agency authorized users and approved third parties would be able to access Clearing Agency data. The CSP systems and staff would not have access to the Clearing Agencies' certificates or keys.^[102] The Clearing Agencies would be responsible for the application architecture, software, configuration, and use of the CSP services, and for the maintenance of the environment, including ongoing monitoring of the application environment to achieve the appropriate security posture. To do this, the Clearing Agencies would follow (i) existing security design and controls; (ii) Cloud-specific information security controls defined in the Clearing Agencies' Information Security Policies and Control Standards; ^[103] and (iii) regulatory compliance requirements detailed in sources or information technology practices that are widely available and issued by an authoritative body that is a U.S. governmental entity or agency including NIST-CSF,^[104] COBIT,^[105] and the FFIEC Guidelines.^[106]

The Clearing Agencies would use third-party and custom developed tools for CSP security compliance monitoring, security scanning, and reporting. Alerts and all API-level actions would be gathered using both CSP provided, Clearing Agency developed, and third-party monitoring tools. The CSP provided monitoring tool would be enabled by default at the organization level to monitor all CSP services activity. Centralized logging provides near real-time analysis of events and contains information about all aspects of user and role management, detection of unauthorized, security relevant configuration changes, and inbound and outbound communication.

As discussed just above, the Clearing Agencies would use a KMS Strategy to encrypt data in transit and at rest in the Cloud. KMS is designed so that no one, including CSP employees, can retrieve customer plaintext keys and use them. The Federal Information Processing Standards 140-2 validated Host Security Modules (“HSMs”) in KMS protect the confidentiality and integrity of Clearing Agency customer keys.^[107] Customer plaintext keys are not written to disk and are only used in protected, volatile memory of the HSMs for the time needed to perform the customer's requested cryptographic operation. KMS keys are not transmitted outside of Cloud regions in which they were created. Updates to the KMS HSM firmware will be controlled by quorum-based access control ^[108] that is audited and reviewed by an independent group within the CSP.

(3) Security Configuration, Provisioning, Logging, and Monitoring

Automated delivery of business and security capability via the use of “Infrastructure as Code” and continuous integration/continuous deployment pipeline methods would permit security controls to be consistently and transparently deployed on-demand. The Clearing Agencies would provision Cloud Infrastructure using pre-established system configurations that are deployed through Infrastructure as Code, then scanned for compliance to secure baseline configuration standards. The Clearing Agencies also would employ continuous configuration monitoring and periodic vulnerability scanning. The Clearing Agencies would perform regular reviews and testing of Clearing Agency systems running in Cloud while relying upon information provided by the CSP through the CSP's SOC2 and Audit Symposiums. Finally, configuration, security incident, and event monitoring would rely on a blend of CSP native and third-party solutions.

The Clearing Agencies also plan to use tools offered by the CSP, developed by the Clearing Agencies, and third parties to monitor the Core C&S Systems ( printed page 72004) running in Cloud. The Clearing Agencies would track metrics, monitor log files, set alarms, and have the ability to act on changes to Core C&S Systems and the environment in which they operate. The CSP would provide a dashboard to reflect-general health ( e.g., up/down status of a region and CSP provided services running in that region) but would not give additional insights into performance of services and applications which run on those services. The Clearing Agencies' centralized logging system would provide for a single frame of reference for log aggregation, access, and workflow management by ingesting the CSP's logs coming from native detective tools and the Clearing Agencies' instrumented controls for logging, monitoring, and vulnerability management. This instrumentation would give the Clearing Agencies a real-time view into the availability of Cloud services as well as the ability to track historical data. By using the enterprise monitoring tools that the Clearing Agencies have in place, the Clearing Agencies would be able to integrate the availability and capacity management of Cloud into the Clearing Agencies' existing processes, hosted in Cloud, to respond to issues in a timely manner.

The Clearing Agencies also would use specialized third-party tools, as discussed just above, to programmatically configure Cloud services and securely deploy infrastructure. This automation of configuration and deployment would help ensure that Cloud services are repeatably and consistently configured securely and validated. Change detection tools providing event logs into the incident management system also are vital for reacting to and investigating unexpected changes to the environment.

The Clearing Agencies would implement tools for the Core C&S Systems and back-office environments that would be hosted on the Cloud Infrastructure, notably, IAM, monitoring and Security Information and Event Management systems, the workflow system of record for incident handling, KMS, and enterprise Data Loss Prevention.

Finally, the CSP prioritizes assurance programs and certifications, underscoring its ability to comply with financial services regulations and standards and to provide the Clearing Agencies with a secure Cloud Infrastructure.^[109]

(4) Security Testing and Verification

Security testing is integrated into business-as-usual processes as outlined in relevant policy and procedures.^[110] These documents define how testing is initiated, executed, and tracked.

For new assets and application (or code) releases, Technology Risk Management determines whether and what type of security testing is required through a risk-based analysis.^[111] If required, testing would be conducted prior to implementation. The different testing techniques are outlined below:

• Automated Security Testing. Using industry standard security testing tools and/or other security engineering techniques specifically configured for each test, the Clearing Agencies would test to identify vulnerabilities and deliver payloads with the intent to break, change, or gain access to unauthorized areas within an application, data, or system.
• Manual Penetration Testing. Using information gathered from automated testing and/or other information sources, the Clearing Agencies would manually test to identify vulnerabilities and deliver payloads with the intent to break, change, or gain access to the unauthorized area within an application or system.
• Blue Team Testing. The Blue Team identifies security threats and risks in the operating environment and analyzes the network, system, and SaaS environments and their current state of security readiness. Blue Team assessment results guide risk mitigation and remediation, validate the effectiveness of controls, and provide evidence to support authorization or approval decisions. Blue Team testing ensures that the Clearing Agencies' networks, systems, and SaaS solutions are as secure as possible before deploying to a production environment.

The results of the Clearing Agencies' security controls testing are risk-rated and managed to remediation via two separate control standards.^[112]

(c) Change Management: Software Development and Release Process

Consistent with FFIEC Guidance, the Clearing Agencies' use of Cloud would have sufficient change management controls in place to effectively transition systems and information assets to Cloud and would help ensure the security and reliability of applications in Cloud.^[113] The Clearing Agencies' enterprise software development lifecycle processes ^[114] would help ensure the same control environment for all Clearing Agency resources. The Clearing Agencies would establish baselines for design inputs and control requirements and enforce workload isolation and segregation through Cloud using existing Cloud native technical controls and added new tools. The Clearing Agencies also would plan to use other specialized platform monitoring tools for logging, scanning of configuration, and systems process scanning. The Clearing Agencies also would have oversight as the code owner and would have final review and approval for related changes and code merges before deployment into production. Finally, the Clearing Agencies would periodically conduct static code scanning and perform vulnerability scanning for external dependencies prior to deployment in production, along with manual penetration testing of the provided application code. In addition, the Clearing Agencies would perform routine scans of Compute resources with the existing enterprise scanning tools. Any identified vulnerabilities would be reviewed for severity, prioritized, and logged for remediation tracking in upcoming development releases.

The Clearing Agencies would create a “user acceptance plan” prior to promoting code to Cloud production. This user acceptance plan would include tests of all major functions, processes, and interfacing systems, as well as security tests. Through acceptance tests, the Clearing Agencies' users would be able to simulate complete application functionality of the live environment. The change would move to the next stage of the Clearing Agencies' delivery model only after satisfying the criteria for this phase.^[115]

The Clearing Agencies would have internal projects that would address change management of the various applications and services. In particular, the Clearing Agencies would run a suite of supporting services that enable building, running, scaling, and monitoring of the Clearing Agencies' business applications in Cloud, in an automated, resilient, and secure manner.^[116] The application platform relies on various CSP and third-party tools for different components, including IaaS, Infrastructure as Code, CI/CD, Container as a Service, ( printed page 72005) Continuous Delivery, and Platform Monitoring.

With respect to software development in Cloud, the Clearing Agencies would establish a closed, non-production Cloud environment that would enable the Clearing Agencies to develop, test, and integrate new capabilities, including those related to security capabilities. This non-production Cloud environment would focus on the foundational security, operations, and infrastructure requirements with the intent to take lessons learned to implement into future production. The Clearing Agencies would maintain a Cloud Reference Architecture that defines necessary capabilities and controls required to securely host Core C&S Systems. The minimum foundational security requirements would be based on the NIST-CSF and CIS benchmarks and include the design and implementation requirements of a secure Cloud account structure within a multi-region Cloud environment. The Clearing Agencies would maintain enterprise security requirements that provide structure for current and future development. As the Cloud environment is further developed and expanded, there would be a comprehensive process to identify any incremental risks and develop and implement controls to manage and mitigate those risks.

(d) Resilience and Recovery

As noted earlier, given the Clearing Agencies' roles as systemically important financial market utilities, it is vital that operations moved to the Cloud have appropriately robust resilience and recovery capabilities. As discussed in Section II.B.ii.2, above, the Cloud Infrastructure would be architected to include (i) two autonomous and geographically diverse regions; (ii) three availability zones per region, with each availability zone comprised of multiple data centers; (iii) multi-node, high availability clusters across each availability zone; (iv) static stability and static capacity models; and (v) regional isolation, all to help ensure the persistent availability of Compute, Storage, and Network capabilities in Cloud.

Additionally, the CSP's practice in deploying service updates to Cloud would help ensure that the consequences of any incidents would be limited to the fullest extent possible.^[117] The CSP achieves this by (i) fully automating the build and deployment process and (ii) deploying services to production in a phased manner.

CSP service updates are first deployed to cells, which minimizes the chance that a disruption from a service update in one cell would disrupt other cells. Following a successful cell-based deployment, service updates are next deployed to a specific availability zone, which limits any potential disruption to that zone. Following a successful availability zone deployment, service updates are then deployed in a staged manner to other availability zones, starting with the same region and later within other regions until the process is complete.

The Clearing Agencies would meet regularly with the CSP, in addition to formal quarterly briefing meetings with the CSP, as described in the Reg. SCI Addendum.^[118] The informal discussions and quarterly briefing meetings would permit the Clearing Agencies to gather information in advance of the quarterly systems change report. Most reportable systems changes would continue to occur based on changes to Compute, Storage, Network, or applications controlled by the Clearing Agencies.

(e) Audit Controls and Assessment

The Clearing Agencies would regularly test security controls and configurations, including by monitoring the CSP's technical, administrative, and physical security controls that support the Clearing Agencies' systems in the Cloud Infrastructure.

(1) Internal Risk Assessments

As part of their existing third-party vendor risk activities, the Clearing Agencies' Third-Party Risk department (“TPR”) would assess the operational risks of the CSP as a critical vendor annually.^{[119 120 121]} Additionally, as a critical vendor, the CSP is subject to heightened risk management requirements, as defined in the DTCC Third Party Risk CriticalPlus Program Procedures,^[122] which include an executive sponsor that must be at the Managing Director level or higher, documented annual meetings, quarterly reporting, and monthly notifications. Issues rated moderate or above, negative news, performance concerns or remediations are directly escalated to the Management Risk Committee monthly.^[123]

(2) Internal Audit Department

As mentioned in Section II.B.ii.4.(a), above, the Clearing Agencies' IAD, as the third line of defense, is independent from the Clearing Agencies' business lines, support areas, and controls functions, and promotes resiliency and security through the assessment of risk management and control frameworks to raise awareness of control risks and changes for improving controls and governance processes.

IAD assesses the risks of the Clearing Agencies, at least annually, as part of the development of the risk-based audit plan, which is reviewed and refreshed, as needed, on a quarterly basis.^[124] The development of the audit plan includes the consideration of IADs risk assessment results, which informs cycle coverage requirements for Cloud. Additional considerations include, but are not limited to, regulatory requirements and expectations, initiatives, and institutional and industry risk trends, including risks associated with technology and cloud-based processes.

IAD's specific reviews of Cloud Infrastructure have not identified any material deficiencies and the scope of the reviews have included, but are not limited to, consideration of governance and oversight, contagion risk and logical separation, access management, security configuration and monitoring, ( printed page 72006) concentration risk, exit strategy, business continuity and disaster recovery. IAD also has assessed the design of controls for a cloud platform scheduled for use in 2024 and is proposing a Cloud Security audit for 2024.^[125]

(3) Key Risk and Key Performance Indicators ^[126]

The Clearing Agencies have established processes to evaluate the Clearing Agencies' management of CSPs. Cloud vendors are rated through a quarterly TPR survey. If a survey results in a poor rating, then it is reported to the Management Risk Committee (“MRC”).^[127] TPR is responsible for the timely reporting and escalation of third-party risks. On a regular basis, TPR will review all active assessments to identify any high risks or potential issues that may require further discussion or escalation to senior management, Corporate Procurement Services (“CPS”), or internal stakeholders. The DTCC Third Party Risk Procedures provide a list of events that must be presented to the MRC.^[128]

The Clearing Agencies have developed key performance indicators (“KPIs”) for Cloud and socialized these KPIs internally. The KRIs already exist for Core C&S Systems and are aligned to overall systems availability, capacity, data integrity, and security.^[129] The CSP KPIs would feed into existing KRIs and would be used to evaluate the CSP's performance after Cloud implementation. KPIs would be added to monitor the performance and risks of the CSP services for which the Clearing Agencies have contracted. These post-Cloud implementation KRIs and KPIs would allow the Clearing Agencies to assess their ongoing use of the CSP against their operational and security requirements and would help demonstrate the effectiveness of risk controls and the CSP's performance against commitments in the SLAs, and will be reported on a regular basis to the Clearing Agencies' Management Committee, Board of Directors, and Technology and Risk Committees of the Board of Directors.

(4) Auditing the CSP and Access Rights ^[130]

The CSP hosts an annual Audit Symposium. The Cloud Agreement gives the Clearing Agencies the right to attend the symposium so that the Clearing Agencies may inspect and verify evidence of the design and effectiveness of the CSP's control environment.^[131] The CSP also hosts an annual Cloud security conference focused on security, governance, risk and compliance, which the Clearing Agencies would attend. Through preparation for and attendance at these events, the Clearing Agencies could provide feedback and make requests of the CSP for future modifications of its control environment.

The Clearing Agencies' Information Technology staff currently meets with CSP representatives weekly to focus on technical issues related to the Clearing Agencies' proposed Cloud environment. As required under the Cloud Agreement, the Clearing Agencies hold quarterly compliance briefings with the CSP, wherein the Clearing Agencies receive information, including any necessary documentation, from the CSP to help assure the Clearing Agencies that the CSP is meeting its obligations.^[132] The information provided includes updates to services and SLAs, CSP performance, and details that help the Clearing Agencies meet their reporting obligations under Section 1003(a)(1) of Reg. SCI. The Clearing Agencies' management, including Security, Information Technology, TPR, and the Internal Audit Department, coordinate to ensure appropriate representation during such briefings. The CSP is required under Cloud Agreement to maintain records showing its compliance with the agreements for a period of five years.^[133]

The CSP would be required to maintain an information security program, including controls and certifications, that is as protective as the program evidenced by the CSP's SOC-2 report. The CSP must make available on demand to the Clearing Agencies its SOC-2 report as well as the CSP's other certifications from accreditation bodies and information on its alignment with various frameworks, including NIST-CSF, and ISO.^[134]

As part of the annual risk assessment of the CSP, TPR collects risk and control related assurance documents from the CSP and coordinates review with the Clearing Agencies' respective subject matters specialists. TPR, Security, and Business Continuity would determine the adequacy and reasonableness of the documentation received to complete the Third-Party Risk Assessment. Finally, the Cloud Agreement provides that the Clearing Agencies' and their regulators may visit the facilities of the CSP under specified conditions. TPR would help coordinate bi-annual visits of the data centers.^[135]

The Clearing Agencies plan to use the CSP's services combined with additional third-party tools to monitor systems deployed by ingesting logs into a security incident and event monitoring tool to provide a “single pane of glass” view into the Cloud Infrastructure. When incidents are detected, the Clearing Agencies would follow their existing incident response governance to identify, detect, contain, eradicate, and recover from incidents.

III. Consistency With the Clearing Supervision Act

The stated purpose of the Clearing Supervision Act is to mitigate systemic risk in the financial system and promote financial stability by, among other things, promoting uniform risk management standards for systemically important financial market utilities and strengthening the liquidity of systemically important financial market utilities.^[136] Section 805(a)(2) of the Clearing Supervision Act ^[137] also authorizes the Commission to prescribe risk management standards for the ( printed page 72007) payment, clearing and settlement activities of designated clearing entities, like the Clearing Agencies, for which the Commission is the supervisory agency. Section 805(b) of the Clearing Supervision Act ^[138] states that the objectives and principles for risk management standards prescribed under Section 805(a) shall be to:

• promote robust risk management;
• promote safety and soundness;
• reduce systemic risks; and
• support the stability of the broader financial system.

The Commission adopted Rule 17ad-22 under Section 805(a)(2) of the Clearing Supervision Act and the Exchange Act in furtherance of these objectives and principles.^[139] Rule 17ad-22 under the Exchange requires covered clearing agencies, like the Clearing Agencies, to establish, implement, maintain, and enforce written policies and procedures that are reasonably designed to meet certain minimum requirements for their operations and risk management practices on an ongoing basis.^[140]

The Clearing Agencies believe that the Cloud Proposal is consistent with Section 805(b)(1) of the Clearing Supervision Act ^[141] and the requirements of Rules 17ad-22(e)(17)(ii) under the Exchange Act.^[142]

A. Consistency With Section 805(b)(1) of the Clearing Supervision Act

Promote Robust Risk Management. As described above, the Clearing Agencies believe that the Cloud Proposal promotes robust risk management, specifically operational risk management, by providing scalable and secure infrastructure for hosting Core C&S Systems. The Cloud Proposal would add additional security capabilities, allow for regular updates and maintenance of applications, and reduce the risk of data breaches while also ensuring compliance with industry standards. Additionally, transitioning to Cloud would offer flexibility in scaling resources, which can enable the Clearing Agencies to adapt quickly to changing security needs and allocate resources more efficiently.

Today, the Clearing Agencies' ability to risk manage extreme market events is directly tied to their ability to scale their on-premises resource during such events, which is directly tied to the Clearing Agencies having previously expended enough capital to build enough capacity based on earlier performance testing of their applications to withstand such extreme market events. Although the Clearing Agencies would continue to performance test their applications regardless of where the applications are hosted, by hosting the applications in Cloud, the number of scalable resources is already available, when needed, without the Clearing Agencies having to pre-purchase it or build it. This level of nearly unbounded, on-demand scalability provides a much-welcomed risk-management feature for extreme events, such as a global pandemic as noted above.

Overall, risk management is inherently strengthened by hosting in Cloud through advanced security features, real-time monitoring, on-demand scalability, and compliance standards implemented by the CSP. By leveraging these capabilities, the Clearing Agencies can better proactively identify and address risks, ensuring data integrity and regulatory compliance.

Promote Safety and Soundness. The Clearing Agencies also believe that the Cloud Proposal promotes safety and soundness. As discussed above, transitioning to Cloud provides centralized management and improved scalability. The CSP provides cloud-specific security capabilities, including encryption, access controls, and regular updates, reducing the risk of security breaches. Centralized monitoring allows for better visibility into potential threats, enabling quick response and mitigation. The agility afforded by Cloud would allow the Clearing Agencies to respond to performance challenges more efficiently and effectively. For instance, as noted above, in the face of unexpected surges in demand, Cloud scalability would allow the Clearing Agencies to seamlessly adjust resources, helping to prevent service disruptions and loss of operations. Such agility not only enhances the effectiveness of operations but also mitigates the risks associated with unexpected fluctuations in workload performance. These benefits improve the Clearing Agencies abilities to maintain operational continuity and resilience, which help promote safety and soundness.

Reduce Systemic Risk. The Clearing Agencies also believe that the Cloud Proposal would reduce systemic risk by improving overall resilience and security. As described above, hosting Core C&S Systems in Cloud would provide distributed infrastructure and data redundancy ( i.e., multiple availability zones, supported by many data centers, across two regions), making the systems less susceptible to single points of failure. Moreover, disaster recovery would be streamlined, minimizing the effect of potential disruptions, while automatic backup systems, geographic redundancy, and faster data recovery mechanisms would all contribute to a more resilient infrastructure. In the event of a localized issue, the distributed nature of Cloud would help prevent widespread disruptions.

Production resiliency also is greatly improved in Cloud compared to the Clearing Agencies' on-premises capabilities, where a single location hosts an application, on a single copy of primary storage. Instead, Cloud would host an application across three primary availability zones, made of up of many data centers, each of which contain actively running instances and synchronous copies of the data. If the Clearing Agencies' primary, on-premises data center fails, an out of region recovery will be necessary and will likely result in approximately two hours of downtime. By comparison, in Cloud, even if an entire availability zone fails (meaning the failure of multiple data centers), Core C&S Systems would continue to operate within the region, thus avoiding an out of region recovery and any downtime.

The Clearing Agencies would employ meaningful security capabilities and measures provided by the CSP and third-party tools to further enhance the security of the Clearing Agencies' Core C&S Systems. This approach to security would help reduce systemic risks associated with operational outages and significantly reduce the risk associated with data loss or downtime. Additionally, the Cloud environment facilitates regular updates and patch management, ensuring that security measures stay current. This proactive maintenance helps mitigate vulnerabilities that could otherwise contribute to systemic risk. Overall, the adoption of Cloud enhances the stability and security of IT infrastructure, contributing to a reduction in systemic risks.

Altogether, the Clearing Agencies believe that the benefits afford from operating in a Cloud Infrastructure would help the Clearing Agencies reduce systemic risk.

Support the Stability of the Broader Financial System. The Clearing Agencies believe that the Cloud Proposal supports the stability of the broader financial system by enhancing efficiency, resilience, and security of the ( printed page 72008) Clearing Agencies' Core C&S Systems. Cloud services would provide the Clearing Agencies with scalable and flexible infrastructure, allowing for more efficient resource allocation and cost management, which supports operational resiliency and stability. With the ability to rapidly deploy new applications and services, the Clearing Agencies would become more agile in adapting to market trends and participant and customer needs.

In terms of resilience, the Cloud Infrastructure offers distributed data storage and failover solutions, reducing the impact of localized disruptions and improving recovery capabilities. This resilience is crucial for the Clearing Agencies' Core C&S Systems to continue functioning even in the face of unforeseen events. Moreover, the CSP's strengthened security capabilities help protect sensitive data, mitigating the risk of cyberattack or data breaches that could undermine the stability of the financial system. Overall, the transition to Cloud fosters improved operational efficiency, resilience, and robust security practices, contributing to the stability of the broader financial system.

Accordingly, the proposed changes provided in this Cloud Proposal are consistent with (i) promoting robust risk management; (ii) promoting safety and soundness; (iii) reducing systemic risks; and (iv) promoting the stability of the broader financial system, all in support of the objectives and principles of Section 805(b) of the Clearing Supervision Act.^[143]

B. Consistency With Rule 17ad-22(e)(17)(ii) Under the Exchange Act

Rule 17ad-22(e)(17)(ii) requires the Clearing Agencies to establish, implement, maintain, and enforce written policies and procedures reasonably designed to manage the Clearing Agencies' operational risk by “ensuring that systems have a high degree of security, resiliency, operational reliability, and adequate, scalable capacity.” ^[144]

Security. As described above and in policies and procedures confidentially filed, the Clearing Agencies have established a robust Cloud security program to manage the security of the Core C&S Systems that would be running in Cloud and to monitor the CSP's management of security of the Cloud Infrastructure that it operates. Processes are formally defined, automated to the fullest extent, repeatable with minimal variation, accessible, adhered to, and timely. The enterprise security program encompasses all of the Clearing Agencies' assets existing in the Clearing Agencies' offices, data centers, and within the Cloud Infrastructure, and IAM controls ensure least-privileged user access to applications in Cloud. The Clearing Agencies have appropriate controls in place to help ensure the security of confidential information in-transit between the Clearing Agencies' data centers and the Cloud Infrastructure, between systems within the Cloud Infrastructure, and at-rest. All network communications between the Clearing Agencies and Cloud would rely on industry standard encryption for traffic while in transit, and data at rest would be safeguarded through pervasive encryption. Finally, automated delivery of business and security capability via the use of the Infrastructure as Code, Cloud agnostic tools, and continuous integration/continuous deployment pipeline methods help ensure security controls are consistently and transparently deployed.

Resiliency and Operational Reliability. As stated above, resiliency and operational reliability of the Cloud Infrastructure is built into the system with functionality for the Clearing Agencies' Core C&S Systems to run in multiple availability zones within multiple regions. Regions are segregated from one another and are designed to minimize the possibility of a multi-region outage. The Clearing Agencies have designed their Cloud Infrastructure to have primary (hot)/secondary (warm) regions, at all times, ensuring Compute, Storage, and Network resources would be available in a new redundant region in the event of a primary region failure. As a result, the Cloud Infrastructure offers the Clearing Agencies multiple redundancies within which to run Core C&S Systems, while simultaneously restricting the effect of an incident at the CSP to the smallest footprint possible.

Scalability. As described above, since additional computing power can be launched on demand, the scalability in a Cloud computing environment is considerable and instantaneous. The Clearing Agencies could provision or de-provision Compute, Storage, and Network resources to meet demand at any given point in time. In the current on-premises environment, immediate scalability is limited by the capacity of the on-premises hardware. Additional physical servers and network equipment would be needed to scale beyond the limits of the on-premises hardware, potentially affecting the ability to quickly adapt to evolving market conditions, including spikes in trading volume.

For these reasons, the Clearing Agencies believe that the Cloud Proposal would help ensure that the Clearing Agencies' systems have a high degree of security, resiliency, operational reliability, and adequate, scalable capacity, consistent with Rule 17ad-22(e)(17)(ii) under the Exchange Act.^[145]

III. Date of Effectiveness of the Advance Notice

The proposed change may be implemented if the Commission does not object to the proposed change within 60 days of the later of (i) the date the proposed change was filed with the Commission or (ii) the date any additional information requested by the Commission is received.^[146] The clearing agency shall not implement the proposed change if the Commission has any objection to the proposed change.^[147]

The clearing agency shall post notice on its website of proposed changes that are implemented. The proposal shall not take effect until all regulatory actions required with respect to the proposal are completed.

IV. Solicitation of Comments

Interested persons are invited to submit written data, views, and arguments concerning the foregoing, including whether the advance notice is consistent with the Clearing Supervision Act. Comments may be submitted by any of the following methods:

Electronic Comments

• Use the Commission's internet comment form (https://www.sec.gov/​rules/​sro.shtml); or
• Send an email torule-comments@sec.gov. Please include file number NSCC-2024-801 on the subject line.

Paper Comments

• Send paper comments in triplicate to Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549-1090.

V. Date of Timing for Commission Action

Section 806(e)(1)(G) of the Clearing Supervision Act provides that NSCC may implement the changes if it has not received an objection to the proposed changes within 60 days of the later of (i) the date that the Commission receives the Advance Notice or (ii) the date that any additional information requested by the Commission is received,^[148] unless extended as described below.

Pursuant to Section 806(e)(1)(H) of the Clearing Supervision Act, the Commission may extend the review period of an advance notice for an additional 60 days, if the changes proposed in the advance notice raise novel or complex issues, subject to the Commission providing the clearing agency with prompt written notice of the extension.^[149]

Here, as the Commission has not requested any additional information, the date that is 60 days after NSCC filed the Advance Notice with the Commission is October 13, 2024. However, the Commission believes that the changes proposed in the Advance Notice raise novel and complex issues. The Commission finds the issues novel because NSCC proposes a gradual migration of a specified set of Core C&S Systems to a public cloud infrastructure hosted by a single, third-party service provider. The Commission also finds the issues raised by the Advance Notice complex because the selection of the subset of applications proposed for migration involves a detailed governance review process that would require careful scrutiny and consideration of its associated risks. Therefore, the Commission finds it appropriate to extend the review period of the Advance Notice for an additional 60 days under Section 806(e)(1)(H) of the Clearing Supervision Act.^[150]

Accordingly, the Commission, pursuant to Section 806(e)(1)(H) of the Clearing Supervision Act,^[151] extends the review period for an additional 60 days so that the Commission shall have until December 12, 2024 to issue an objection or non-objection to advance notice SR-NSCC-2024-801.

All submissions should refer to File Number SR-NSCC-2024-801 and should be submitted on or before September 25, 2024.

All submissions should refer to file number SR-NSCC-2024-801. This file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method. The Commission will ( printed page 72009) post all comments on the Commission's internet website ( https://www.sec.gov/​rules/​sro.shtml). Copies of the submission, all subsequent amendments, all written statements with respect to the advance notice that are filed with the Commission, and all written communications relating to the advance notice between the Commission and any person, other than those that may be withheld from the public in accordance with the provisions of 5 U.S.C. 552, will be available for website viewing and printing in the Commission's Public Reference Room, 100 F Street NE, Washington, DC 20549 on official business days between the hours of 10 a.m. and 3 p.m. Copies of the filing also will be available for inspection and copying at the principal office of NSCC and on DTCC's website ( dtcc.com/legal/sec-rule-filings). Do not include personal identifiable information in submissions; you should submit only information that you wish to make available publicly. We may redact in part or withhold entirely from publication submitted material that is obscene or subject to copyright protection. All submissions should refer to File Number SR-NSCC-2024-801 and should be submitted on or before September 25, 2024.