Page 1 of 12

Commodity Futures Trading Commission

Privacy Impact Assessment

System Name: Ownership and Control Reporting (OCR) System

Date: February 24, 2015

1. Overview

On November 18, 2013, the Commodity Futures Trading Commission (“Commission” or 

“CFTC”) published new ownership and control rules and related forms (the “OCR final 

rule”) to better identify futures and swap market participants. The OCR final rule is 

available on the Federal Register website (78 FR 69177) and leverages the 

Commission's current position and transaction reporting programs by requiring the 

electronic submission of trader identification and market participant data on amended 

Forms 102 and 40, and on new Form 71.1

The Commission receives end-of-day position reports electronically from exchange 

clearing members, Futures Commission Merchants (FCMs), Designated Contract 

Markets (DCMs), foreign brokers and other reporting firms.

2

 The new and amended 

forms require the reporting of certain trading accounts active on designated contract 

markets or swap execution facilities (SEFs).

Form 102A collects information on all “persons” that own or control position-based 

special accounts and the trading accounts associated with that special account.3 Form 

102B collects information on all persons that own or control trading accounts that meet 

specified volume-based reporting levels. The information collected in these forms will 

allow the Commission to more efficiently link special accounts holding reportable 

positions to the transactions and associated trading accounts identified on daily trade 

capture reports received by the Commission. By illustrating the connections between 

end-of-day position reporting and daily trade capture reports, the OCR final rule will 

enable the Commission to perform a more accurate and timely accounting of market 

position at the level of individual trading accounts. Furthermore, the addition of volumebased reporting on Form 102B will provide the Commission with an efficient means to 

collect the information required to aggregate positions, detect intra-day position limit 

violations, and calculate market share. 

The CFTC designed the Ownership and Control Reporting (OCR) System to:

 

1 Note that a no-action letter (CFTC Staff Letter 15-03) was issued by the Division of Market Oversight (DMO) on 

February 10, 2015 that provides additional time for certain reporting parties to comply with certain reporting requirements 

of the OCR final rule. This privacy impact assessment does not have any effect upon that no-action letter and does not 

modify a reporting party’s reporting obligations under the OCR final rule.

2 Any terms not defined in this document are defined in the OCR final rule.

3

For the purposes of the OCR System, “persons” include individuals, associations, partnerships, corporations, and trusts.
Page 2 of 12

 receive and store ownership and control information concerning each large trader 

and reportable account related to futures, options, swaps and positions;

 automate and update the Forms 40 and 102 (under the legacy system, the CFTC 

received these data via postal mail and email/PDF); better secure those forms

during transmission and receive the new Form 71 through the same secure 

transmission processes;

 link transaction-level data to position-based data (the legacy system included

trading account numbers, but not traders’ names and contained large traders' 

names but not their trading account numbers);

 email a notification to the reporting firm carrying the account if a trader misses

the Form 40 filing deadline; the email will list persons with accounts who have 

missed the deadline for submitting the Form 40;

 collect ownership and control information for market participants’ special (or 

consolidated) accounts and certain trading accounts; 

 correlate trade data with end-of-day position data so that CFTC staff can more 

easily conduct analysis and monitor intraday position limits; and

 aggregate and anonymize OCR System data for use in the Commission’s public 

reports, such as the Commitment of Traders report and the Cotton on Call 

report.

The OCR System also enables the CFTC to load the data into powerful analytical tools 

that perform a variety of functions across the oversight program. CFTC staff in the 

Division of Market Oversight (DMO), Division of Enforcement (DOE), Office of the Chief 

Economist (OCE) and the Division of Clearing and Risk (DCR) rely on the OCR System 

to understand the ownership and control structures of organizations or individuals who 

hold positions in the markets that the CFTC oversees. 

2. Data Collected and Stored Within the System

2.1. What information will be collected, used, disseminated or maintained in the 

system?

Among other information, the OCR System collects data about special accounts and 

underlying trading accounts, volume-based trading accounts, consolidated accounts, the 

owners and controllers of such accounts, and certain traders identified on the reporting 

forms. 

Personally identifiable information (PII) stored by the OCR System includes:

PII Categories

Collected, 

Generated or 

Maintained 

within the 

system

CFTC 

Employees

Members of 

the Public

Other

(e.g.,

Contractors, 

Other 

government 

employees)

Name (for purposes other 

than contacting federal 

employees)

X X

Date of Birth

Social Security Number 

(SSN)
Page 3 of 12

Tax Identification Number 

(TIN)

Photographic Identifiers

Driver’s License

Mother’s Maiden Name

Vehicle Identifiers

Personal Mailing Address X X

Personal E-Mail Address X X

Personal Phone Number X X

Medical Records Number

Medical Notes

Financial Account 

Information, specifically 

includes:

Trader 

Information X X

Trading Account 

Number

X X

Special Account 

Reporting 

Number

X X

Certificates 

Legal Documents

Device Identifiers

Web Uniform Resource 

Locator(s)

Education Records

Military Status

Employment Status (e.g., 

job title) X X

Trader relationship with 

foreign government X X

2.2. What will be the sources of the information in the system?

The sources of the OCR System data are:

 Form 102A – This is an updated version of the legacy 102 form, the Identification 

of “Special Accounts” form, described in Part 17.01 of the Commodity Exchange 

Act (CEA). The new version of the form, Form 102A, captures data about the 

Special Account (including more owner and controller information) as well as 

data about the trade accounts that comprise the Special Account, including 

ownership and control data associated with those trade accounts.

 Form 102S – This is an updated version of the legacy 102S form, the 

Identification of “Consolidated Accounts” form, described in Part 20.4-5 of the 

CEA. This enhanced version of the previous 102S form captures more data 

about the Consolidated Account including more information about the owners 

and controllers of the account.

 Form 102B – This new form, the Identification of Volume Threshold Accounts, is 

described in Part 17.01(b) of the CEA. Form 102B is used to identify trade 

accounts that meet a volume threshold set forth in the OCR final rule within a 
Page 4 of 12

single trading day, regardless of whether positions continue to be held at the end 

of day. The new form captures data about the owners and controllers of the 

trade account.

 Form 40/40S – The Statement of Reporting Trader requires traders to identify 

themselves to the Commission, describe the type of traders that they are (e.g., 

individual, corporation) as well as their registration type (e.g., broker, trader, 

FCM), and describe their trading and related business activities. The updated 

version of the current Form 40 also requires more detailed information about the 

owners and controllers of the trader. The Commission sends Form 40 (described 

in Part 18.04 of the CEA) or Form 40S (described in Part 20.5 of the CEA) to the 

trader via a special call. 

 Form 71 – The Identification of Omnibus Accounts and Sub-Accounts Form is a 

new form described in Part 17.01(c) of the CEA. Form 71 identifies owners and 

controllers of omnibus accounts identified on the Form 102B and other reportable 

sub-accounts. The Commission sends Form 71 via a special call to the 

originating firm of a volume threshold account that is identified as a customer 

omnibus account on Form 102B. 

2.3. Why will the information be collected, used, disseminated or maintained?

As explained above, CFTC staff use the OCR System to stay apprised of market actors 

and their interactions within the market. CFTC staff also use OCR System data in 

conjunction with other systems to closely and actively monitor the futures, options and 

swaps market activity of traders whose positions size is large enough to potentially 

impact orderly market operation. The OCR System further supports enforcement 

litigation by helping CFTC investigators conduct research. Authorized Commission staff

can research anomalies referred to them by CFTC divisions, other government agencies 

or members of the public and check the OCR System to focus their investigative 

activities and independently validate data collected during litigation discovery.

2.4. How will the information be collected by the Commission?

The CFTC collects the information contained in the OCR system in the following ways:

a. Traders submit Statements of Reporting Trader (Form 40/40S) to the CFTC. In

the legacy process, traders submitted the forms as PDFs via email, via fax or via 

the US Mail. The OCR final rule requires traders to submit Form 40 data 

electronically through the CFTC Portal or through Secured File Transfer Protocol

(SFTP).

b. Reporting parties electronically submit “Identification of Special Account” (Form 

102A), “Identification of a Volume Threshold Account” (Form 102B) and 

“Identification of a Consolidated Account” (Form 102S) through the CFTC Portal 

or through SFTP.

c. Reporting parties electronically submit ‘‘The Identification of Omnibus Accounts 

and Sub-Accounts Form’’ (Form 71) through the CFTC Portal or through SFTP.

d. The CFTC collects, in paper form or electronically, correspondence and notes of 

telephone conversations between the Commission and the entity or individual or 

other government agencies dealing with official business concerning the entity or 

individual.
Page 5 of 12

See the OCR Technical Guidance Document for technical specifications for 

transmitting Forms 102A, 102B, 102S, 40, 40S and 71 via SFTP to the CFTC.

2.5. Is the system using technologies in ways that the Commission has not previously 

employed (e.g., monitoring software)?

No. All software and technologies used by the Commission are common to the 

Commission’s current infrastructure. 

2.6. What specific legal authorities authorize the collection of the information?

The Commodity Exchange Act, 7 U.S.C. 1 et seq., including Sections 4g, 4i, and 8 of 

that Act, at 7 U.S.C. 6g, 6i and 12, and the rules and regulations promulgated 

thereunder authorize the collection of this information.

3. Data and Records Retention

3.1. For what period of time will data collected by this system be maintained and in 

what form will the data be retained?

The OCR System maintains in electronic form the Form 40/40S, any supporting 

documentation and trader code numbers and related information. That data is destroyed 

or deleted when position data for a trader has not been received for ten years. The OCR 

System also maintains in electronic form the CFTC Form 102 and 102/A/B/S, any 

supporting documentation and account numbers assigned by an FCM. That data is 

destroyed or deleted when data for an account has not been received for three years.

Paper records created from faxes, emails and regular mail are retained in file folders, 

loose-leaf binders and similar paper filing methods. Records in paper form are 

maintained in lockable offices and filing cabinets. 

3.2. What are the plans for destruction and/or disposition of the information?

Paper files that have been scanned into the OCR System are placed in shredding bins 

after 30 days. Electronic records are deleted if they have exceeded their retention 

period. For additional information, refer to the CFTC’s records disposition schedule, 

record code 511.

4. Access to and Sharing of the Data

4.1. Who will have access to the information in the system (internal and external 

parties), and with whom will the data be shared? If contractors, are the Federal 

Acquisition Regulations clauses included in the contract (24.104 Contract 

clauses; 52.224-1 Privacy Act Notification; and 52.224-2 Privacy Act)?

OCR System security features allow access to information only to those individuals 

whose official duties require access. DMO, DOE, OCE, DCR and Office of Data and 

Technology (ODT) staff designate specific Commission staff who may regularly access 

the information. These individuals will include employees of the Commission, developers 

and administrators, and possibly others with a legitimate and confirmed need to know 

the information to perform their Commission responsibilities. CFTC contractors with 
Page 6 of 12

access to the OCR System are required to comply with the Privacy Act contractually 

through either Federal Acquisition Regulations (FAR) terms or other terms and 

conditions. The Office of the Executive Director’s Financial Management Branch (FMB)

ensures that the contract between the Commission and contractors contains the 

provisions necessary to protect and secure information to which the contractors have

access. 

The information also may be shared in accordance with the applicable Privacy Act 

System of Records Notice, CFTC-15, Enterprise Surveillance, Oversight & Risk 

Monitoring System, 77 Fed. Reg. 58814 (September 24, 2012).

4.2. If the data will be shared outside the Commission’s network, how will the data be 

transferred or shared?

OCR System identifiable data only shared outside of the Commission’s network in 

accordance with the CFTC-15 System of Records Notice, as described above. For 

example, such data may be shared as allowed under the CEA with other US government 

agencies or counterpart regulators outside the United States in specific situations. If 

transferred or shared outside the Commission’s network, the data is transferred in a 

manner designed to prevent the unnecessary and/or unauthorized disclosure of 

sensitive information. Such methods may include encryption of electronic information or 

hand delivery of documentation.

Some data from the OCR System is aggregated and/or de-identified and included in 

CFTC public reports. The weekly Cotton on Call and Commitment of Traders reports 

posted to the Commission’s public website use aggregation or de-identification 

strategies that have been designed to prevent re-identification of such information 

through other publicly available information. 

4.3. If the data will be released to the public, consultants, researchers or other third 

parties, will it be aggregated or otherwise de-identified (i.e. anonymized)? If yes, 

please also explain the steps that the Commission will take to aggregate or deidentify the data.

Information that the CFTC reports publicly is aggregated by the classifications of the 

types of work that the traders perform (e.g., swap dealer, money manager) to decrease 

the likelihood that it can be linked to an individual. For example, the Commitment of 

Traders report does not list positions held by fewer than twenty traders to mitigate the 

chance of re-identification. 

4.4. Do the recipients of the aggregated or de-identified information have another 

dataset, or is there a publicly available dataset that could be used to re-identify 

Commission information?

As described above, the CFTC uses techniques to aggregate or de-identify OCR System

information that is released to the public with the goal of preventing re-identification of 

such information through other publicly available information.

4.5. Describe how the CFTC will track disclosures of information that will be shared 

with outside entities. The Privacy Act requires that the CFTC record the date, 
Page 7 of 12

nature, and purpose of each disclosure of a record to any person or to another 

agency.

The daily and weekly aggregated reports posted to the Commission’s public website are 

each dated and the purpose of each is described on the webpage that features it. The 

CFTC makes other disclosures as authorized by the CFTC-15 System of Records 

Notice, e.g., to other US government agencies or to foreign regulators. These 

disclosures are tracked by the division that discloses the information and/or by ODT in 

its system logs or using other tools.

Additionally, the CFTC’s Office of General Counsel (OGC) handles all Privacy Act and 

Freedom of Information Act (FOIA) requests and OGC tracks any disclosures made 

pursuant to such requests. OGC documents, among other things, which person or 

party/organization made the request, the date and nature of the request, the decision 

made to disclose or not disclose the data and by whom it was made.

4.6. Do other systems share the information or have access to the information in this 

system? If yes, explain who will be responsible for protecting the privacy rights 

of the individuals affected by the interface (e.g., System Administrators, System 

Developers, System Managers)?

The OCR System integrates with CFTC systems ISS, TSS, Stressing Positions at Risk 

(SPARK), and Swaps Position Data Repository. The OCR System displays a Privacy 

Notice to end-users immediately following the log in screen that discusses the 

importance of maintaining the confidentiality and integrity of its contents. End users and 

OCR System Administrators are responsible for protecting the privacy rights of 

individuals whose information may be accessible through these interfaces. In addition, 

general privacy training is mandatory for all CFTC employees on an annual basis.

ODT staff regularly monitor the information travelling to and stored by the CFTC. They 

are responsible for detecting unusual system behavior and raising any privacy concerns 

with the CFTC Privacy Office. 

5. Notice, Consent and Access for Individuals

5.1. What notice will be provided to individuals about the collection, use, sharing and 

other processing of their personal data?

Each form that collects OCR System information has its own Privacy Act Notice. The 

following statement appears to each reporting party at the top of the electronic form 102 

A/B/S:

“The Commission's authority for soliciting this information is granted in 

sections 4a, 4c(b), 4g, 4i and 8 of the CEA and related regulations (see

e.g., 17 CFR § 17.01(b)). The information solicited from entities and 

individuals engaged in activities covered by the CEA is required to be 

provided to the CFTC, and failure to comply may result in the imposition 

of criminal or administrative sanctions (see e.g., 7 U.S.C. sections 9 and 

13a-1, and/or 18 U.S.C. 1001). 
Page 8 of 12

The information requested is most commonly used in the Commission's 

market and trade practice surveillance activities to (a) provide information 

concerning the size and composition of the commodity derivatives 

markets, (b) permit the Commission to monitor and enforce speculative 

position limits and (c) enhance the Commission's trade surveillance data. 

The requested information may be used by the Commission in the 

conduct of investigations and litigation and, in limited circumstances, may 

be made public in accordance with provisions of the CEA and other 

applicable laws. It may also be disclosed to other government agencies 

and to contract markets to meet responsibilities assigned to them by law. 

The information will be maintained in, and any additional disclosures will 

be made in accordance with the CFTC System of Records Notice CFTC15, Enterprise Surveillance, Oversight & Risk Monitoring System.”

This statement appears to each reporting party at the top of the electronic form 71:

“The Commission's authority for soliciting this information is granted in 

sections 4a, 4c(b), 4g, 4i and 8 of the CEA and related regulations (see

e.g., 17 CFR 17.01(c)). The information solicited from entities and 

individuals engaged in activities covered by the CEA is required to be 

provided to the CFTC, and failure to comply may result in the imposition 

of criminal or administrative sanctions (see e.g., 7 U.S.C. sections 9 and 

13a-1, and/or 18 U.S.C. 1001). The information requested is most 

commonly used in the Commission's market and trade practice

surveillance activities to (a) provide information concerning the size and 

composition of the commodity derivatives markets, (b) permit the 

Commission to monitor and enforce speculative position limits and (c) 

enhance the Commission's trade surveillance data. The requested 

information may be used by the Commission in the conduct of 

investigations and litigation and, in limited circumstances, may be made 

public in accordance with provisions of the CEA and other applicable 

laws. It may also be disclosed to other government agencies and to 

reporting markets to meet responsibilities assigned to them by law. The 

information will be maintained in, and any additional disclosures will be 

made in accordance with the CFTC System of Records Notice CFTC-15, 

Enterprise Surveillance, Oversight & Risk Monitoring System.”

This statement appears to each trader at the top of the electronic form 40:

“The Commission's authority for soliciting information from traders with 

large futures, option, swap, or other derivatives market positions is 

granted in sections 4a, 4i, 4t and 8 of the CEA (see 7 U.S.C. sections 6i 

and 12). The Commission's authority for soliciting information from 

volume threshold account controllers, persons who own volume threshold 

accounts, reportable sub-account controllers, and persons who own 

reportable sub-accounts is granted in sections 4i and 8 of the CEA and 

related regulations (see,. 17 CFR 18.04(b)). Such entities and individuals 

are required to provide the information requested, and failure to comply 

may result in the imposition of criminal or administrative sanctions (see

e.g., 7 U.S.C. sections 9 and 13a-1, and/or 18 U.S.C. 1001).
Page 9 of 12

The information requested is most commonly used in the Commission's 

market and trade practice surveillance activities to (a) provide information 

concerning the size and composition of the commodity derivatives 

markets, (b) permit the Commission to monitor and enforce speculative 

position limits and (c) enhance the Commission's trade surveillance data. 

Information contained in these records may be used by the Commission

in the conduct of investigations or litigation and, in limited circumstances, 

may be made public in accordance with provisions of the CEA and other 

applicable laws. It may also be disclosed to other government agencies 

and to contract markets to meet responsibilities assigned to them by law. 

In accordance with the Privacy Act and the Commission's rules 

thereunder (see 17 CFR part 146), the complete listing of uses of the 

information contained in these records is found in the Commission's 

System of Records Notice CFTC-15, Enterprise Surveillance, 

Oversight & Risk Monitoring System.

Information contained in these records may be used by the Commission 

in the conduct of investigations or litigation and, in limited circumstances, 

may be made public in accordance with provisions of the CEA and other 

applicable laws. It may also be disclosed to other government agencies 

and to reporting markets to meet responsibilities assigned to them by 

law.”

This PIA shall also appear on the Privacy Office’s CFTC website.

5.2. What opportunities will exist for an individual to decline to provide information or 

to consent to particular uses of the information? If opportunities exist, how will 

this notice be given to the individual and how will an individual grant consent?

During the online submission process for Forms 40, 40S, 71 and 102A/B/S, the CFTC 

notifies individuals and firms that they must provide the requested information in order to 

participate in the financial markets covered by the CEA.

5.3. What procedures will exist to allow individuals to gain access to their information 

and request amendment/correction, and how will individuals be notified of these 

procedures?

The OCR final rule requires reporting parties to submit updates to Forms 102A/B/S if any 

information on a previously submitted form becomes inaccurate. The OCR final rule

also requires reporting parties to submit refreshed versions of Forms 102A/B/S on an 

annual basis. See Parts 17.02(b) and 20.5 of the CEA.

The instructions on Form 40/40S state that a reporting trader required to complete a 

Form 40 will be under a continuing obligation, per direction in the special call, to update 

and maintain the accuracy of the information it provides. Reporting traders can update 

this information by either visiting the CFTC’s web-based Form 40 portal to review, verify, 

and/or update their information, or by submitting updated information via SFTP. 

The OCR final rule requires reporting parties to electronically submit updates and refresh 

updates of certain reporting forms (see, e.g., Parts 17.02(b), 18.04 and 20.5 of the CEA, 

and the instructions to the reporting forms). 
Page 10 of 12

Pursuant to the Privacy Act of 1974, individuals seeking access to records about 

themselves, or seeking amendment of records about themselves, may also address a 

written inquiry to the Office of General Counsel, Paralegal Specialist, Commodity 

Futures Trading Commission, Three Lafayette Centre, 1155 21st Street, NW, 

Washington, DC 20581. Please note that any such requests pursuant to the Privacy Act 

do not modify or eliminate a reporting party’s reporting obligations under the OCR final 

rule.

6. Maintenance of Controls

6.1. What controls will be in place to prevent the misuse of the information by those 

having authorized access and to prevent unauthorized access, use or disclosure 

of the information?

Commission staff are trained to recognize the sensitive nature of OCR System 

information. Various administrative, technical and physical security measures are

designed to protect CFTC records from unauthorized access and improper use. 

Technical security measures include restrictions on computer access to authorized 

individuals, unique usernames, strong passwords that are frequently changed, use of 

encryption for certain data types and transfers, and regular review of security procedures

and best practices to enhance security. Audit logs record all access to OCR System 

data. 

Remote access to the OCR System is only available via the CFTC’s virtual private 

network (VPN). Physical security measures include restrictions on building access to 

authorized individuals and maintenance of records in lockable offices and filing cabinets.

6.2. While the information is retained in the system, what will the requirements be for 

determining if the information is still sufficiently accurate, relevant, timely, and 

complete to ensure fairness in making determinations?

CFTC uses technical controls to help ensure that OCR System data is not altered during 

transmission to the CFTC or when maintained within CFTC systems. Under CFTC rules, 

reporting firms and individual traders are responsible for ensuring that information 

provided to the CFTC is accurate and, therefore, for updating information as needed. If 

CFTC staff determine that Special Account Information or Trader data submitted by a 

reporting firm or trader is missing or incorrect, they contact the source to request that the 

data be re-submitted.

6.3. Will this system provide the capability to identify, locate and monitor individuals? 

If yes, explain.

No. The information provided does not allow the CFTC to monitor an individual’s 

movement or actions.

6.4. Are all IT security requirements and procedures required by Federal law being 

followed to ensure that information is appropriately secured?

Yes. The CFTC follows the National Institute of Standards and Technology (NIST) 

Special Publication 800-53, ‘Recommended Security Controls for Federal 
Page 11 of 12

Information Systems’ to secure its systems as required by the Federal Information 

Security Management Act (FISMA). 

6.5. Describe the privacy training provided to users either generally or specifically 

relevant to the program or system.

Commission personnel are subject to agency-wide procedures for safeguarding PII and 

receive annual privacy and security training. Many staff receive additional training 

focused on their specific job duties, for example, Division of Enforcement staff regularly 

receive training concerning privacy rights of individuals and the importance of 

safeguarding information, and system administrators receive role-based training.

7. Privacy Act

7.1. Will the data in the system be retrieved by a personal identifier in the normal 

course of business? If yes, explain. If not, can it be retrieved by a personal 

identifier?

Yes. CFTC Form 40/40S, Form 102A/B/S, Form 71, correspondence, and other 

miscellaneous information are maintained in the OCR System directly under the name of 

the reporting trader. The large trader reporting forms are maintained by identifying code 

number and can be retrieved by that unique identifier.

7.2. Is the system covered by an existing Privacy Act System of Records Notice 

(“SORN”)? Provide the name of the system and its SORN number, if applicable.

Yes, CFTC – 15 Enterprise Surveillance, Oversight & Risk Monitoring System.

8. Privacy Policy

8.1. Confirm that the collection, use and disclosure of the information in this system

have been reviewed to ensure consistency with the Commission’s Privacy Policy 

on www.cftc.gov.

Yes, the following sub-headers of the CFTC privacy policy are relevant to the OCR

System:

 If You Choose to Send Us Personal Information

 Sharing of Your Information

9. Privacy Risks and Mitigation

9.1. What privacy risks are associated with the collection, use, dissemination and 

maintenance of the data? How have those risks been mitigated?

The CFTC has adopted the following protections, in addition to those stated above in 

Section 6 and others, to appropriately safeguard OCR System information:

 OCR System data is confidential; the CFTC has limited access strictly to those 

with a need-to-know based upon an individual’s role and responsibility. 
Page 12 of 12

 Whenever OCR System information is accessible through other CFTC internal 

systems (e.g., ISS, TSS), access to that information continues to be role-based. 

ODT has vetted the administrators of the connected systems.

 The OCR System data sent to the CFTC through the CFTC Portal or through the 

Secure FTP are secured in transit and upon receipt. 

o During transmission to the CFTC via the Portal or SFTP, the information 

is secured according to Federal Information Processing Standards 

(FIPS) Publication 140-2 requirements. 

o Once within the CFTC network, the information is secured by, among 

other controls, complex, frequently-changed passwords; sound security 

practices that are integrated into the daily routines of CFTC staff; audits of 

events that are significant and relevant to the security of the OCR System

and the environment in which it operates; only qualified and authorized 

individuals may make changes to the OCR System; and the OCR System 

uniquely identifies and authenticates users. All of the above controls are 

implemented according to FISMA standards.