Amendments to the National Market System Plan Governing the Consolidated Audit Trail to Enhance Data Security

Forms and Documents

Document	Type	Status	Availability
Supporting Statement CAT Data Security (New Request-- Proposed Rule).pdf	Supporting Statement A	Uploaded 2020-10-19	Available

IC Document Collections

IC ID	Collection	Type	Status	Form
243625	Breach Management - Breach Notifications		New
243624	Breach Management - Policies and Procedures		New
243623	Secure Connectivity - Allow Listing		New
243622	Data Confidentiality Policies - Examination Report		New
243621	Data Confidentiality Policies - Procedures and Usage Restrictions		New
243620	Data Confidentiality Policies - Identical Policies		New
243619	Customer Identifying Systems Workflow - Audit Trail Report		New
243618	Customer Identifying Systems Workflow - Preparation of Programmatic Access Application		New
243617	Customer and Account Attributes - Regular Written Assessment		New
243616	Customer and Account Attributes - Transformed Value(s)		New
243615	Online Targeted Query Tool and Logging of Access and Extraction - Additional Logging		New
243614	Online Targeted Query Tool and Logging of Access and Extraction - Review Monthly Reports		New
243613	Non-SAW Environments - Operational Requirements (Notification)		New
243612	Non-SAW Environments - Operational Requirements (Material Changes)		New
243611	Non-SAW Environments - Implementation Requirements		New
243610	Non-SAW Environments - Revocations		New
243609	Non-SAW Environments - Determinations (Ongoing)		New
243608	Non-SAW Environments - Determinations (Initial)		New
243607	Non-SAW Environments - Application Materials (Ongoing)		New
243606	Non-SAW Environments - Application Materials (Initial)		New
243605	SAWs - Operational Requirements (Notification)		New
243604	SAWs - Operational Requirements (Maintenance)		New
243603	SAWs - Operational Requirements (Initial)		New
243602	SAWs - Implementation Requirements		New
243601	SAWs - Design Specifications (Ongoing)		New
243600	SAWs - Design Specifications (Initial)		New
243599	SAWs - Policies & Procedures (Ongoing)		New
243598	SAWs - Policies and Procedures (Initial)		New
243597	Security Working Group - Updates		New
243596	Security Working Group - Attendance		New
243595	Evaluation of the CISP		New

ICR Details

OMB Control No: 3235-0781	ICR Reference No: 202009-3235-001
Status: Historical Inactive	Previous ICR Reference No:
Agency/Subagency: SEC	Agency Tracking No: 270-825
Title: Amendments to the National Market System Plan Governing the Consolidated Audit Trail to Enhance Data Security
Type of Information Collection: New collection (Request for a new OMB Control Number)	Common Form ICR:  No
Type of Review Request: Regular
OIRA Conclusion Action: Comment filed on proposed rule	Conclusion Date: 12/14/2020
	Date Received in OIRA: 10/19/2020
Terms of Clearance: OMB files this comment in accordance with 5 CFR 1320.11( c ). This OMB action is not an approval to conduct or sponsor an information collection under the Paperwork Reduction Act of 1995. This action has no effect on any current approvals. If OMB has assigned this ICR a new OMB Control Number, the OMB Control Number will not appear in the active inventory. For future submissions of this information collection, reference the OMB Control Number provided. Pursuant to 5 CFR 1320.11(c), OMB files this comment on this information collection request (ICR). The agency shall examine public comment in response to the NPRM and will describe in the supporting statement of its next collection any public comments received regarding the collection as well as why (or why it did not) incorporate the commenter’s recommendation. The next submission to OMB must include the draft final rule.

	Inventory as of this Action	Requested	Previously Approved
Expiration Date		36 Months From Approved
Responses	0	0	0
Time Burden (Hours)	0	0	0
Cost Burden (Dollars)	0	0	0

---

Abstract: The Securities and Exchange Commission recently proposed amendments to the national market system plan governing the consolidated audit trail to comply with the requirements of Rule 613, which directed each national securities exchange and national securities association (who are collectively, along with certain broker-dealers, the respondents) to create a national market system plan to adopt a consolidated audit trail (the “CAT”). This amendment includes new information collections to enhance the security of the CAT and the protections afforded to CAT data.

---

Authorizing Statute(s): US Code: 15 USC 78k-1 Name of Law: National market system for securities; securities information processors
  

Citations for New Statutory Requirements: None

---

Associated Rulemaking Information
RIN:	Stage of Rulemaking:	Federal Register Citation:	Date:
3235-AM62	Proposed rulemaking	85 FR 65990	10/16/2020

---

Federal Register Notices & Comments

Did the Agency receive public comments on this ICR? No

---

Number of Information Collection (IC) in this ICR: 31

IC Title	Form No.	Form Name
Data Confidentiality Policies - Examination Report
Secure Connectivity - Allow Listing
Breach Management - Policies and Procedures
Breach Management - Breach Notifications
Evaluation of the CISP
Security Working Group - Attendance
Security Working Group - Updates
SAWs - Policies and Procedures (Initial)
SAWs - Policies & Procedures (Ongoing)
SAWs - Design Specifications (Initial)
SAWs - Design Specifications (Ongoing)
SAWs - Implementation Requirements
SAWs - Operational Requirements (Initial)
SAWs - Operational Requirements (Maintenance)
SAWs - Operational Requirements (Notification)
Non-SAW Environments - Application Materials (Initial)
Non-SAW Environments - Revocations
Non-SAW Environments - Application Materials (Ongoing)
Non-SAW Environments - Determinations (Initial)
Non-SAW Environments - Determinations (Ongoing)
Non-SAW Environments - Implementation Requirements
Non-SAW Environments - Operational Requirements (Material Changes)
Non-SAW Environments - Operational Requirements (Notification)
Online Targeted Query Tool and Logging of Access and Extraction - Review Monthly Reports
Online Targeted Query Tool and Logging of Access and Extraction - Additional Logging
Customer and Account Attributes - Transformed Value(s)
Customer and Account Attributes - Regular Written Assessment
Customer Identifying Systems Workflow - Preparation of Programmatic Access Application
Customer Identifying Systems Workflow - Audit Trail Report
Data Confidentiality Policies - Identical Policies
Data Confidentiality Policies - Procedures and Usage Restrictions

---

Burden increases because of Program Change due to Agency Discretion: Yes

Burden Increase Due to: Changing Regulations

Burden decreases because of Program Change due to Agency Discretion: No

Burden Reduction Due to:

Short Statement: The Commission has proposed additional requirements for the national market system plan governing the consolidated audit trail ("CAT") in order to further protect the security and confidentiality of CAT data.

---

Annual Cost to Federal Government:

Does this IC contain surveys, censuses, or employ statistical methods? No

Does this ICR request any personally identifiable information (see OMB Circular No. A-130 for an explanation of this term)? Please consult with your agency's privacy program when making this determination.     Yes

Does this ICR include a form that requires a Privacy Act Statement (see 5 U.S.C. §552a(e)(3))? Please consult with your agency's privacy program when making this determination.     No

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? No

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? No

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? No

Is this ICR related to the Pandemic Response? No

---

Common Form ICR:  No

---

On behalf of this Federal agency, I certify that the collection of information encompassed by this request complies with 5 CFR 1320.9 and the related provisions of 5 CFR 1320.8(b)(3).

The following is a summary of the topics, regarding the proposed collection of information, that the certification covers:

(a) It is necessary for the proper performance of agency functions;

(b) It avoids unnecessary duplication;

(c) It reduces burden on small entities;

(d) It uses plain, coherent, and unambiguous language that is understandable to respondents;

(e) Its implementation will be consistent and compatible with current reporting and recordkeeping practices;

(f) It indicates the retention periods for recordkeeping requirements;

(g) It informs respondents of the information called for under 5 CFR 1320.8 (b)(3) about:

(i) Why the information is being collected;

(ii) Use of information;

(iii) Burden estimate;

(iv) Nature of response (voluntary, required for a benefit, or mandatory);

(v) Nature and extent of confidentiality; and

(vi) Need to display currently valid OMB control number;

(h) It was developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected.

(i) It uses effective and efficient statistical survey methodology (if applicable); and

(j) It makes appropriate use of information technology.

If you are unable to certify compliance with any of these provisions, identify the item by leaving the box unchecked and explain the reason in the Supporting Statement.

Certification Date: 10/19/2020

---