That is the problem Regulation SCI (Systems Compliance and Integrity) exists to prevent. It sets technology resilience, security, and incident-reporting duties for the entities that run critical U.S. securities-market infrastructure.
This guide is for executives and directors at those entities. It covers scope, controls, incident response, reporting, governance, and a readiness roadmap. Rule details reflect the SEC sources checked through October 2026. Confirm the current text before you rely on it.
Key Takeaways
- Regulation SCI covers defined SCI entities and systems, not every company.
- Compliance spans the whole technology lifecycle, from change management to recovery testing.
- Responsible SCI personnel must spot, escalate, and report events fast.
- Boards should oversee decision rights and evidence, not run the response.
What Regulation SCI Covers and Who Must Comply
Regulation SCI in plain English
The SEC adopted the rule on November 19, 2014, as Release 34-73639, to strengthen the technology infrastructure of U.S. securities markets. It took effect February 3, 2015, with general compliance required by November 3, 2015.
The trigger was a run of failures. Nasdaq's Facebook IPO cross fell 19 minutes behind incoming orders in 2012, and a software bug made BATS shut down its own IPO. Knight Capital's 2012 runaway orders cost over $460 million, though that was a broker-dealer failure, not an SCI case.
Who is an SCI entity?
Under current Rule 1000, an SCI entity is one of:
- An SCI self-regulatory organization (national securities exchanges, registered securities associations and clearing agencies, and the MSRB)
- An SCI alternative trading system (ATS)
- A plan processor
- An exempt clearing agency subject to the SEC's Automation Review Policy
- An SCI competing consolidator
Role matters. An exchange runs a market, an ATS matches orders, a clearing agency settles trades, and a plan processor or consolidator distributes market data. Each has different systems, so the analysis starts with function.
ATS thresholds are specific. An ATS qualifies if, in at least four of the preceding six months, it met one of these volume tests:
- 5% of any single NMS stock and 0.25% of all NMS stocks
- 1% of all NMS stocks
A non-NMS equity ATS qualifies at 5% of average daily dollar volume. A competing consolidator qualifies at 5% or more of consolidated market-data revenue for a listing group.
Broker-dealers are not categorically covered. Only their qualifying SCI ATS operations are.
SCI systems, critical SCI systems, and indirect SCI systems
- SCI systems directly support trading, clearance and settlement, order routing, market data, market regulation, or market surveillance. This includes systems operated on the entity's behalf.
- Critical SCI systems include those supporting clearing and settlement, openings, reopenings and closings, trading halts, IPOs, plan-processor market data, and exclusively listed securities.
- Indirect SCI systems are not SCI systems, but a breach of them would reasonably threaten SCI-system security.
Indirect systems are the quiet risk. A corporate network that shares credentials or connectivity with a matching engine is an attack path, so segmentation evidence matters. So do vendor-run components.
Current rule status
The 2020 market data infrastructure amendments (34-90610) are adopted. They added SCI competing consolidators. The 2023 expansion proposal (34-97143), which targeted certain broker-dealers, security-based swap data repositories, and more clearing agencies, was withdrawn effective June 17, 2025. It is neither pending nor law.
What Cybersecurity and Resilience Controls Does Regulation SCI Require?
Written policies and procedures
Rule 1001(a)(1) requires each SCI entity to establish, maintain, and enforce written policies reasonably designed to ensure its SCI systems (and indirect systems, for security standards) have:
levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.
Policies are deemed reasonably designed if consistent with current SCI industry standards. That safe harbor is not exclusive, and SEC staff guidance offers examples rather than a mandatory checklist.
Security of SCI and indirect SCI systems
Rule 1001 sets minimums rather than a prescriptive control list. Assess these areas against it and against the SEC's staff guidance on industry standards:
- Privileged-access and identity management
- Vulnerability and patch management
- Monitoring and threat detection
- Segmentation between SCI and indirect systems
- Secure configuration and physical protection
- Backup security
- Controls over vendor-operated systems
Document which requirement each control satisfies. A generic checklist won't survive an exam.
Capacity, resilience, and disaster recovery
Policies must include capacity planning and stress testing. Business continuity and disaster recovery plans must keep backup and recovery capabilities:
sufficiently resilient and geographically diverse and that are reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption.
Note the scope. Next-day resumption applies to trading, not every system, and both objectives assume a wide-scale disruption.
Plans should address dependencies between exchange functions, communications, alternate processing, and staff availability. Most important, tests should prove the recovery assumptions.
Systems compliance and secure change management
Rule 1001(b) requires policies ensuring SCI systems operate in line with the Exchange Act and the entity's own rules. Minimums include pre-implementation testing, change controls, compliance assessment, and coordination between technology and regulatory staff.
Keep a change inventory linking each material change to its risk assessment, test evidence, approval, rollback plan, and quarterly SEC reporting.
How SCI Entities Must Respond to Cybersecurity Events
What counts as an SCI event?
An SCI event is a systems disruption, a systems compliance issue, or a systems intrusion.
- Systems disruption: an event that disrupts or significantly degrades normal operation of an SCI system.
- Systems compliance issue: an event causing noncompliance with securities law or the entity's own rules.
- Systems intrusion: any unauthorized entry into SCI or indirect SCI systems.
An outage is not an intrusion, and a system working as designed but outside a rule is a compliance issue. Classification drives the duties that follow.
A major SCI event involves any impact on a critical SCI system, or significant operational or market-participant impact. Events with no or de minimis impact get lighter treatment.
Corrective action and internal escalation
Once responsible SCI personnel have a reasonable basis to conclude an event occurred, the entity must begin corrective action, mitigate harm to investors and markets, and resource remediation as soon as reasonably practicable. The trigger is a reasonable basis, not a finished investigation.
Your escalation path should define:
- Severity criteria and who declares an event
- Decision rights, including shutdown authority
- Legal and compliance involvement
- Evidence preservation
- Documented handoffs between teams
SEC notification, Form SCI, and records
| Step | Timing |
|---|---|
| Initial notice to SEC | Immediately on the reasonable-basis trigger |
| Written notice | Within 24 hours |
| Updates | Regularly or on request, until resolved and investigation closed |
| Final report (resolved within 30 days) | Within five business days after resolution and closure |
| Interim report (still open) | Within 30 calendar days of occurrence; final within five business days after closure |
| No or de minimis impact | Record the event; summary of disruptions and intrusions due 30 days after quarter-end |
Filings go through Form SCI electronically, though immediate notices may use phone or email. Rule 1005 requires records for at least five years, with the first two readily accessible.
Prepare to document affected systems, participant impact, corrective actions, resolution status, losses, communications, root cause, and remediation.
Communications with members and participants
For disruptions and compliance issues, entities must promptly notify affected members or participants, including those later identified. A major event requires notice to all members. Intrusions have a documented security or investigation exception. Systems with no or de minimis impact are also exempt. Messages should be clear and updated as remediation progresses.
Board and executive oversight during an event
Executives need a concise, decision-ready brief: market impact, containment, recovery status, resource needs, and unresolved risk. Give the board decisions to make, not packet-sized logs. Responders keep control of the technical work.
How Governance, Testing, Reporting and Vendors Fit Together
Responsible SCI personnel and accountability
Rule 1001(c)(1) requires written criteria for identifying responsible SCI personnel, their designation and documentation, and escalation procedures to inform them quickly of potential events. These are senior managers for each affected system, plus designees. Name backups and define what happens when they're unreachable.
Recurring reviews, testing, and change reporting
The clocks differ by duty, so track them separately.
| Duty | Cadence |
|---|---|
| Material systems changes report | 30 days after quarter-end |
| SCI review | Annual |
| Penetration test reviews (network, firewalls, production systems) | At least every three years |
| Review delivery | To management within 30 days; to board and SEC within 60 days of management submission |
| BC/DR testing with designated members | At least every 12 months |
Third-party and service-provider oversight
The 2014 adopting release does not carve out third-party SCI systems. Outsourcing does not transfer accountability, and entities that cannot manage vendors to SCI standards must reassess the arrangement.
Vendor oversight should cover:
- Due diligence
- Contract access to records
- Incident escalation timelines
- Test participation
- Service levels
Service bureaus must give the SEC a written access undertaking under Rule 1007. The SEC's FY2027 examination priorities flag cloud and third-party vendor risk, including identifying vendor systems that qualify as SCI or indirect SCI systems.
Enforcement shows the stakes. In September 2026 the SEC censured OTC Link with a $575,000 penalty for security, access, and vulnerability-management deficiencies and repeated failure to remediate examination findings.
A Practical Regulation SCI Readiness Roadmap for Boards and Executives
Establish scope, ownership, and evidence
Build a current inventory covering:
- SCI, critical, and indirect systems
- Interfaces, vendors, and recovery dependencies
- Responsible personnel and applicable obligations
Assign an accountable owner to each item.
Then collect evidence:
- Policies and system diagrams
- Test results and change approvals
- Incident records and vendor assessments
- Board materials and corrective-action logs
Turn requirements into an inspectable governance program
Run a gap assessment against Rules 1001 through 1007. Prioritize high-consequence dependencies, and record owners, target dates, risk acceptance, and validation evidence.
A workable 90-day plan lists the top 10 risks, each with an owner, due date, cost range, dependencies, and closure proof such as logs or access-review evidence. Pair a weekly working session with a monthly executive review that approves spend and accepts risk explicitly.
For the board and audit or risk committee, a one-page dashboard showing trend beats a thick deck. Include:
- Open findings and material changes
- Testing outcomes
- Unresolved decisions
- Whether remediation is on track
Test, improve, and communicate
Two tests matter:
- Tabletop: rehearses event declaration, shutdown authority, external communications, and legal alignment
- Recovery test: restores critical systems and data, is timed and documented, and repeats until results match tolerance
Add industry exercises. SIFMA's Quantum Dawn VIII in November 2025 drew nearly 1,000 participants across 100-plus institutions. Review every real event afterward.
Tyson Martin advises boards and executives on cyber oversight, and serves as an interim or fractional CISO during transitions. That work helps translate Regulation SCI requirements into clear decision rights, credible reporting, and an executable readiness plan. This is advisory support, not legal advice, attestation, or hands-on technical testing.
Frequently Asked Questions
What is regulatory compliance in cybersecurity?
Regulatory compliance means following applicable laws and rules, keeping evidence of controls, assigning accountability, and reporting or fixing qualifying events. Security best practices are voluntary; compliance is enforceable.
What does the SEC require companies to disclose?
SCI entities file notices and Form SCI reports for SCI events. Public companies file Form 8-K Item 1.05 within four business days of a materiality determination.
What are the top 5 compliance regulations?
No universal five exists. Applicable frameworks depend on your entity type, industry, data, and market role. Regulation SCI applies only to SCI entities.
Who must comply with Regulation SCI?
SCI SROs, SCI ATSs, plan processors, certain exempt clearing agencies, and SCI competing consolidators. Status depends on current definitions, system functions, registration, and thresholds.
What is an SCI event?
A systems disruption, systems compliance issue, or systems intrusion at an SCI entity. The classification drives corrective action, notification, recordkeeping, and communication duties.
Does Regulation SCI apply to broker-dealers?
Not categorically. Qualifying SCI ATS operations are covered, but the 2023 proposal to extend coverage to certain broker-dealers was withdrawn in June 2025. Separate duties such as Regulation S-P may still apply.
