U.S. COMMODITY FUTURES TRADING COMMISSION

Office of the Inspector General

Office of Audits

REVIEW OF CFTC’S DATA GOVERNANCE PROGRAM: 

INTEGRATED SURVEILLANCE SYSTEM

 REPORT NUMBER: 18-AU-07 

May 7, 2019
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

1 

TABLE OF CONTENTS

EXECUTIVE SUMMARY........................................................................................... 2

ABBREVIATIONS ..................................................................................................... 7

APPENDIX A............................................................................................................. 8

DATA GOVERNANCE FRAMEWORK DEVELOPMENT AND STATUS

APPENDIX B........................................................................................................... 12

ISS DATA REQUIREMENTS AND STAKEHOLDER VALUE

APPENDIX C........................................................................................................... 20

ETL PROCESS FOR DATA STAGING

APPENDIX D........................................................................................................... 24

CHANGE MANAGEMENT POLICY AND PROCEDURES

APPENDIX E........................................................................................................... 25

SECURITY AND 

APPENDIX F ........................................................................................................... 28

SECURITY CONCERN FOR SIMILAR LEGACY APPLICATIONS

APPENDIX G........................................................................................................... 30

BACKGROUND, OBJECTIVE, SCOPE AND METHODOLOGY

APPENDIX H........................................................................................................... 34

ISS BACKGROUND AND HISTORY

APPENDIX I ............................................................................................................ 37

NOTICE OF FINDINGS AND RECOMMENDATIONS

APPENDIX J ........................................................................................................... 38

MANAGEMENT’S COMMENTS
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

2 

TO: J. Christopher Giancarlo, Chairman 

Brian D. Quintenz, Commissioner 

Rostin Behnam, Commissioner

Dawn Stump, Commissioner

Dan Berkovitz, Commissioner 

FROM: Miguel A. Castillo, CPA, CRMA 

Assistant Inspector General for Audits

DATE: May 7, 2019

SUBJECT: Review of CFTC’s Data Governance Program

Information Surveillance System (ISS)

Executive Summary

Why We Conducted the Audit

The Office of the Inspector General (OIG) reviewed CFTC’s Data Governance1

program maturity and selected practices pertaining to the Integrated Surveillance 

System (ISS). This system, developed in the late 1990s, hosts confidential and 

sensitive market data collected pursuant to CFTC regulations.

2 ISS supports CFTC 

market surveillance, market research, public reports (including the CFTC 

Commitment of Traders (COT) Reports), and other CFTC mission critical activities. 

See Appendix H for a timeline description and history of ISS.

The objective of our audit was to assess the maturity of CFTC’s Data Governance

program and corresponding practices as applied to facilitate the maintenance of ISS. 

Specifically, we evaluated ISS Data Governance program practices for (1) defining 

business requirements, (2) extracting, transferring, and loading data (ETL), (3) 

managing changes, (4) maintaining stakeholder value, and (5) securing data. 

Appendix G provides details of our general audit background, objective, scope, and 

methodology. 

 

1 Data Governance is the specification of decision rights and an accountability framework to 

encourage desirable behavior in the valuation, creation, storage, use, archiving and deletion of 

information. It includes the processes, roles, standards and metrics that ensure the effective and 

efficient use of information in enabling an organization to achieve its goals.

2 17 CFR Parts 16 and 17. We did not evaluate whether CFTC Part 16 and 17 regulations could be 

improved. The OIG may consider this matter in the future.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

3 

What We Found

We performed a SWOT (strengths, 

weaknesses, opportunities, and 

threats) analysis to assess CFTC’s 

Data Governance program. As 

presented in Illustration 1, CFTC’s 

program exhibited a low maturity 

level, displaying numerous 

weaknesses, opportunities, and 

threats. We note CFTC is currently 

working towards an improved Data 

Governance framework with 

benchmark attributes. See 

Appendix A for further detail. 

Since ISS represents a baseline for 

improvement to the CFTC’s Data 

Governance program, our analysis, 

as detailed below, provides insight

for selected data management 

practices: 

Strengths: The ISS database 

team followed CFTC Office of Data 

and Technology (ODT) policies and procedures for ISS change management 

processes, including obtaining required approvals and conducting security impact 

assessments. As noted in our prior FISMA review, this capability is a consistent 

strength for ODT management and no issues came to our attention. See Appendix D

for further detail. 

 

Illustration 1: SWOT Analysis of Data Governance

Program Capabilities.

STRENGTHS 

• Change Management Practices 

WEAKNESSES 

• Current Data Governance 

Framework Showing Low 

Capabilities 

• Archaic Integrated Surveillance 

System (ISS) Business 

Requirements 

• Manual Intensive and Error Prone 

Extract, Transfom,, Load (ETL) ISS 

Process 

OPPORTUNITIES 

• Future Data Governance 

Framework Follow Key Practices 

• Delivery of ISS Information on 

Modern Platform 

• ISS ETL Efficiency 

• Mitigating the Exfiltration of 

Confidential Market and Privacy 

Data 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

4 

Weaknesses: ISS data is considered a valuable resource across CFTC mission 

divisions and offices,3 but shows declining usefulness to CFTC operations. See 

Appendix B for details of our analysis. Additionally, the collection and maintenance 

procedures for ISS data are resource intensive and subject to errors. Thus, CFTC

may need to consider the current cost, effectiveness, and reliability of ISS data 

cleansing as used internally, and as the basis for CFTC’s external market reports.

See Appendix C for more details. 

Opportunities: Our analysis in its entirety supports either updating the existing ISS 

platform or, following a consideration of costs and benefits, migrating to an updated

platform to enhance operational efficiencies while minimizing security threats. 

Threats: Our analysis shows that the ISS database application does not comply 

with federal requirements for securing federal systems. We found 

this issue especially concerning given the risk of exfiltration of confidential market 

and privacy information. We note that CFTC maintains other legacy applications on 

the same archaic platform, and this may pose similar risks. See 

Appendix E and Appendix F for our detailed analyses. 

We conclude that ISS is less useful today than it was twenty years ago. Given that 

ISS was developed in the late 1990s, and that CFTC’s markets have grown 

exponentially since that time, some degree of obsolescence may be expected. 

However, we believe adherence to an effective Data Governance program 

throughout its lifespan would have guarded against ISS obsolescence impacting 

CFTC operations, as well as the security concerns we noted. Given 

the issues currently existing with ISS, any inability to update and adapt ISS with 

regard to substance, format, usability, and appropriate data security safeguards (all 

through appropriate Data Governance processes) may support a decision to migrate 

to a more modern and efficient technical solution. We realize a thorough analysis of 

the associated costs and benefits for each option will be necessary.

 

3 ISS is used by the CFTC Division of Clearing and Risk, the Division of Market Oversight, the 

Division of Enforcement, the Office of Chief Economist, and the Division of Swap Dealer and 

Intermediary Oversight. 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

5 

What We Recommend

We recommend that CFTC: 

1. Set a timeframe to fully implement plans for its Data Governance framework and, 

if not already, synchronize with the goals outlined in the Federal Data Strategy

and Open Data Government Act requirements; 

2. Update business requirements for ISS and incorporate stakeholder expectations 

in future ISS versions as a part of an Enterprise Architecture that aligns with 

mission operations;4

3. Modernize the ISS to enhance the traceability, efficiency, and error handling of 

ETL processes, which will require a determination whether to update the ISS 

platform to achieve these goals or, based on a consideration of costs and 

benefits, to migrate to an updated platform;

4. Given current federal security standards, re-evaluate 

requirements for ISS; and 

5. Review security risks of other legacy applications and assure compliance with 

federal information security standards. 

How Management Responded

CFTC conveyed its commitment to address all recommendations with appropriate 

stakeholders. Specifically, CFTC plans to:

• Formulate a data governance framework;

• Address stakeholder business requirements for ISS; 

• Upgrade data transmission standards and enhance ETL practices; and

• Ensure security compliance for legacy systems such as ISS. 

 

4 In December 2018, we published an audit report addressing issues with CFTC’s Enterprise 

Architecture program.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

6 

Management’s planned actions are responsive to the recommendations. 

Management’s concurrence and detailed response are presented in Appendix I and 

Appendix J, respectively. If you have any further questions, please contact me at 

(202) 418-5084, or Branco Garcia, lead auditor, at (202) 418-5013.

Cc: Michael Gill, Chief of Staff 

Kevin S. Webb, Chief of Staff

John Dunfee, Chief of Staff

Daniel J. Bucsa, Chief of Staff

Erik F. Remmler, Chief of Staff

Anthony C. Thompson, Executive Director 

Daniel Davis, General Counsel

John L. Rogers, Chief Information Officer 

Srinivas Bangarbale, Chief Data Officer

Naeem Musa, Chief Information Security Officer

Melissa Jurgens, Acting Chief Privacy Officer

A. Roy Lavik, Inspector General 

Judith A. Ringle, Deputy Inspector General and Chief Counsel
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

7 

Abbreviations

CCB Change Control Board

CI Configuration Items

CME Chicago Mercantile Exchange

COT Commitment of Traders

DCMs Designated Contract Markets

DMB Data Management Branch 

ETL Extract, Transform, and Load

FCMs Futures Commission Merchants

FILAC Filings and Actio3wwns

FIXML Financial Information Exchange Markup Language

GAO US Government Accountability Office

ICE Intercontinental Exchange

ISACA Information Systems Audit and Control Association

ISS Integrated Surveillance System

IT Information Technology

ODT Office of Data and Technology

OIG The Office of the Inspector General

OMB Office of Management and Budget

SWOT Strengths, Weaknesses, Opportunities, and Threats 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

8 

Appendix A

Data Governance Framework Development and Status 

In March of 2018, the President set “Leveraging Data as a Strategic Asset” as a 

“Cross-Agency Priority goal.”5 The Federal Data Strategy consists of principles, 

practices, and action steps to deliver a consistent and strategic approach to federal 

data stewardship, access, and use.6 The principles are considered a timeless and

enduring framework for agencies. While the practices are actionable, action steps 

will be strategically selected for agencies to implement in any given year. 

Illustration 2: Federal Data Strategy Goals.

As a primary challenge, the Federal Data Strategy cites robust, integrated 

approaches to using data to deliver on mission, serve customers, and steward 

 

5 https://www.whitehouse.gov/wp-content/uploads/2018/03/Presidents-Management-Agenda.pdf. 6 https://strategy.data.gov/.

The four Federal Data Strategy areas for exploration 

] .11\<'rJlf"i'-,(' ]),JI,\ (;()\'('!"ILlllCt' 

Set priorities for managing government data as a strategic 

asset, including establishing data policies, specifying roles 

and responsibilities for data privacy, security, and 

confidentia lity protection, and monitoring compliance 

with standards and policies throughout the information 

lifecycle. 

I><'< isio11 \1,1ki11:·. ,-.:, ,\,, o,1111,il,ili1\' 

Improve the use of data assets for decision-making and 

accountability for the Federal Government, including both 

internal and external uses. This includes: (1) provid ing high 

quality and timely information to inform evidence-based 

decision-making and learning; (2) facilitating external 

research on the effectiveness of government programs and 

policies which will inform future policymaking; and (3) 

fostering public accountability and transparency by 

providing accurate and timely spending information, 

performance metrics, and other administrative data. 

i\n !''"', l 1'-.t', .111d i\tq',lllt'lll ,11 iu11 

Develop policies and procedures that e nable stakeholders 

to effectively and efficiently access a nd use data assets by: 

(1) making data available more quickly and in more useful 

formats; (2) maximizing the amount of non-sensit ive data 

shared with the public; (3) leveraging new technologies 

and best practices to increase access to sensitive or 

restricted data while protecting privacy, security, and 

confidentiality, as well as the interests of data providers. 

( : ( 1111111 (, r c i, ii i 1., 11 i o, 11 I 1111 o \', 11 i 1 ,i 1 1 , 11 id 

I'111,l i, I ", 

Facilitate the use of Federal Government data assets by 

external stakeholders at the forefront of making 

government data accessible and useful t hrough 

commercial vent ures, innovation, or for other public uses. 

This includes use by the private sector and scientific and 

research communities, by state and local governments for 

public policy purposes, for education, and in enabling civic 

engagement. Enabling external users to access and use 

government data for commercial and other public 

purposes spurs innovative technological solutions and fills 

gaps in government capacity and knowledge. Supporting 

the production and dissemination of comprehensive, 

accurate, and objective statistics on t he state of the nation 

helps businesses and markets operate more efficiently. 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

9

resources while respecting privacy and confidentiality. As an opportunity recognized, 

enterprise-wide Data Governance strategies have the ability to enable government 

data to be accessible and useful for the American public, businesses, and 

researchers; and to improve the use of data for decision-making and accountability 

for the Federal Government, including for policy-making, innovation, oversight, and 

learning. 

In January 2019, the Foundations for Evidence-Based Policymaking Act7 called for 

CFO Act agencies to submit annually to the Office of Management and Budget 

(OMB) and Congress a plan for identifying and addressing policy questions relevant 

to agency-specific programs, policies, and regulations. The plan must include: (1) a 

list of policy-relevant questions for developing evidence to support policymaking, and 

(2) a list of data for facilitating the use of evidence in policymaking, among other

requirements. While CFTC is not a CFO Act agency, it may wish to develop a similar

plan as a best practice. Included within the Foundations for Evidence-Based

Policymaking Act is the Open Government Data Act, which requires agencies

(including CFTC) to: (1) develop and maintain a comprehensive data inventory

(metadata8

) for all data assets created by or collected by the agency, and (2)

designate a Chief Data Officer who shall be responsible for lifecycle data

management and other specified functions.9

Data Governance Key Practices Compared to CFTC Practices

Although a government-wide federal Data Governance framework is in progress, the 

U.S. Government Accountability Office previously identified common key practices 

for establishing effective Data Governance structures.10 Using private organizations 

and government governance models,

11 GAO noted many of these models promote a 

7 Public Law No: 115-435, Foundations for Evidence-Based Policymaking Act of 2018, 

Title II - Open Government Data Act (Jan. 14, 2019). 8 The term ‘metadata’ means structural or descriptive information about data such as content, format, 

source, rights, accuracy, provenance, frequency, periodicity, granularity, publisher or responsible 

party, contact information, method of collection, and other descriptions.

9 PL No. 115-435, sec. 202, amends 44 U.S.C. § 3504(b) to “make data open by default” and amends 

44 U.S.C. § 3520 to require the designation of Chief Data Officers. Both provisions apply to CFTC by 

application of 44 U.S.C. § 3502(1). 

10 US GAO, Data Act: OMB and Treasury Have Issued Additional Guidance and Have Improved Pilot 

Design but Implementation Challenges Remain, GAO-17-156 (Dec 8, 2016). 11 Id. GAO used organizations that endorsed establishing and using a governance structure to 

oversee how data standards, digital content, and other data assets are developed, managed and 

implemented. Based on these selection factors, they drew on work from the following organizations to 

help them identify data governance key practices: American Institute of Certified Public Accountants, 

American National Standards Institute, Carnegie-Mellon University-Software Engineering Institute, 

Data Governance Institute, Data Management Association International, Oracle, National Association 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

10

common set of key practices that include establishing clear policies and procedures 

for developing, managing, and enforcing data standards. A common set of key 

practices, endorsed by standards setting organizations, recommend that Data 

Governance structures should include the key practices shown below. We compared 

these key practices with practices in ODT’s Master Data Governance document and 

applicable CFTC procedures and noted distinct differences in Data Governance

enterprise framework approaches (see Illustration 3). 

 

Illustration 3: Comparative Data Governance Attributes Between Federal Government Data 

Maturity Model and CFTC ODT Management.

Key Practices for Data Governance

Structures

Current CFTC Governance 

Policy/Procedures

1. Developing and approving data standards. 

Master Data Governance states governance 

[evidenced] in Microsoft Master Data Services 

and is the responsibility of the Data 

Management Branch (DMB). DMB governs 

which entities are considered master data and 

review the data stewardship of the master data. 

DMB coordinates with the entity data stewards 

to ensure the data itself is maintained. DMB will 

also review applications for new entities and for 

alterations to the schemata for existing entities. 

DMB acts as the gatekeepers to MDS and 

reviews applications to create new entities.

CFTC Procedure: Evaluate Information 

Governance Questionnaires for

Proposed New Systems, System Changes or 

Data Collections provides for intra-CFTC 

collaboration for new data collections. Its focus 

is the privacy and security of data.

As a matter of practice, CFTC’s DMB leads, 

develops, and implements guidebooks, and 

validation rules for its internal governance. 

Additionally, DMB seeks stakeholder/industry

feedback for setting data standards.

2. Managing, controlling, monitoring, and 

enforcing consistent application of data 

standards. 

3. Making decisions about changes to existing 

data standards and resolving conflicts related 

to the application of data standards. 

4. Obtaining input from stakeholders and 

involving them in key decisions, as 

appropriate. 

5. Delineating roles and responsibilities for 

decision-making and accountability, including 

roles and responsibilities for stakeholder 

input on key decisions. 

of State Chief Information Officers, National Institute of Standards and Technology, Digital Services 

Advisory Group and the Department of Education-Privacy Technical Assistance Center. 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

11

ODT is working towards a Data Governance enterprise framework that includes 

each of the key GAO cited practices described above (see Illustration 4).

Illustration 4: CFTC ODT Data Framework.

• Metrics, 

Tracking & 

Reports 

• Guidance & 

Examples 

• Templates 

executive 

Stewards 

(SteerCo) 

Chairman COS, CIO & Chief Data Officer • Executive leadership 

<c, • Establish Strategy & Direction 

~~ • Approve policies and standards 

"~~ Prioritize actions & projects (' 

-6-,,,, Division & Department Managers 

Collaborative Stewards 

(DOTWG) 

·% • Plan, define and share data in the best 

=<>'o interest of the enterprise 

• Inventory Data 

~..... • Resolve discrepancies 

~.,~ Suggest changes 

Operational Stewards 

(Business, SMEs and Technical) 

~- -~ .... (. . ... ·~~' ... ,' .~~· I I\. ~ , \. .!._ j\.. ~ tr, 

:: ::;_ ~. t~~~ ~i~~ p -~tr~f~,-.iD.1 t}I.G~.r -:~:~: .. !I.:1f:;~~i~~1!~~~e~I ~~rking Groups 

-: 1~-.-__iY:.,.~~:1,~1 ~-;·-~-{:_;-~7 ~f::~ 7fi?~1 ·;:-~\ _ .:=:~·•>· ;··':'.·_><--;-:-,:--r-;:-;:,_-;r1~-::i ;- ----

Division SMEs • Provide depth of subject matter, 

data knowledge and operational 

perspective 

• Implement policies 

• Identify need for change 

< :£,_; .;;; ;-~ I·;\ ; -: . ·.:-:_~~1_;:;;_ I!-.;; ;_1,: '·; •: ! i j_ ;:.i.r";:: j";":! i_ '-~-:!:_i ,:;: .-~:.1.<~~--~L - •-,~.;~:.1 ,,~ •\:•;: _•;-;:.·;· ~:_· '.( 1f:: '>: ~ _.- ~ ~: "i) I 

According to ODT, some parts are functional, such as the Data Steering Committee 

and the Data Officers Technical Working Group. ODT also is working with the 

Chairman’s office to lay out a renewed data plan for the agency as shown in 

Illustration 4. Given ongoing resource constraints, ODT anticipates the release of

data-specific policies to follow. 

Recommendation

1. We recommend that CFTC set a timeframe to fully implement plans for its Data 

Governance framework and, if not already, synchronize with goals outlined in the 

Federal Data Strategy and Open Data Government Act requirements. 

We believe that fully implementing a recognized framework as shown in Illustration 4 

would also enhance the efficiency and effectiveness of back-end operations to 

deliver value to ISS stakeholders. The sections that follow provide insight into 

current operations for managing ISS data.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

12

Appendix B 

ISS Data Requirements and Stakeholder Value 

As previously highlighted, GAO’s Key Practices on Data Governance structures

stresses obtaining input from stakeholders and involving them in key decisions as a 

key Data Governance practice.12 Additionally, information governance and 

management knowledge organizations, such as the Information Systems Audit and 

Control Association,13 place emphasis on delivering value to stakeholders from an 

enterprise perspective. 

The ODT does not maintain a policy for re-evaluating historical requirements for 

legacy systems. In order to gain an understanding whether ISS meets current

business requirements and offers data accuracy and use-ability, and in order to 

report user value, we researched public comments on CFTC regulations and outside 

inquiries to CFTC regarding ISS; conducted an internal ISS user survey; and 

evaluated Google analytics for published CFTC reports that use ISS data.

Requirements and Comments

We note that CFTC regulations (Part 17) require large trader reporting14 to be in a 

single file with each record in an 80 character format.

15 For Part 16 data, CFTC 

requires a FIXML format;

16 a widely adopted format for derivatives post trade 

 

12 See fn.9.

13 COBIT framework, Enabling Information, www.ISACA.org 14https://www.cftc.gov/IndustryOversight/MarketSurveillance/LargeTraderReportingProgram/ltrp.html

https://www.cftc.gov/IndustryOversight/MarketSurveillance/LargeTraderReportingProgram/ltrformat.ht

ml

https://www.cftc.gov/LawRegulation/DoddFrankAct/Rulemakings/XXXII.LargeSwapsTraderReporting/i

ndex.htm

15 In the beginning of computer technology, a line of an IBM punched card could consist of only 80 

characters. The widespread computer terminals such as IBM 3270 followed this limitation, their 

monitors could show only 80 characters per line (CPL) (but with the various number of lines), though 

with some terminals this number was either reduced by half to 40 CPL, limited to 64 CPL (SWTP CT64, with 16 lines), or optionally increased to 132 CPL (DEC VT100 family, with 14 lines). Such line 

lengths have been carried over into text modes of personal computers.

16 FIXML (Financial Information Exchange Mark-up Language) is the XML encoding used within FIX. 

FIXML is widely adopted for derivatives post trade clearing and settlement globally. FIXML is also 

used for reporting.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

13

clearing and settlement globally. A search of public comments17 relating to “data” 

revealed intensity towards the use and availability of data. While we did not find 

comments related to “Part 16 and 17 data” specifically, we note relevant excerpts 

from 2 comments associated with “large trader data”. They are as follows: 

• ...we have 145 employees, including dedicated developers for regulatory 

systems, who work on Market Regulation duties. We have 40 staffers dedicated 

to market surveillance. The annual direct cost of maintaining this self-regulatory 

program is over $30 million, with an additional $5-7 million in regulatory 

technology support as well as indirect support from other departments... 

• Data has not kept pace in reporting on the profound changes in 

market...supplementation and refinement of Commission data are 

necessary...Reports is produced once a week and provides only a very summary 

view of the market...the COT Report data has additional inherent 

limitations...primarily classification scheme in use.

 

17 https://comments.cftc.gov/PublicComments/CommentList.aspx
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

14

Google Analytics for CFTC External 

Reports

Static reports display data that is 

relevant to a specific point in time, are 

shared easily, and provide consistent 

information for a defined period, creating 

a unified perspective. Time-based 

reports such as CFTC’s weekly and 

monthly reports generated from Part 16 

and 17 submissions are static. We 

studied Google analytics statistics of 

CFTC’s reports that contained part 16 

and 17 data. Between October 1, 2015, 

and June 30, 2018 (1003 days), 

CFTC.gov market reports containing part

Q

C<ttononC• II ,.,.,.., 0. ityUwrs 

0.0 

0.1 

• 0.01 

Commitrneflt of T •

. -·-·· • 0.0 

e 0.01 

~nk~rticip,Mion 

•

on; --•g,O•iy 

0.22 

• 0.00 

• 0.01 

16 and 17 data were viewed both 

domestically and internationally. COT

(Large Trader) report viewership 

averaged .3 daily with a maximum 

average of 31. Cotton on Call reports 

were viewed on average .11 times daily

with a maximum average of .56. Bank 

participation reports were viewed the 

least time averaging .09 views daily with 

a maximum average of .22 views.

As presented in illustration 5, we noted 

that viewers in the United States were 

more so interested in the COT reports. 

There was much less interest in Cotton 

on Call reports and Bank Participation 

reports were viewed primarily in New 

York.

Illustration 6 shows interest in CFTC reports 

by other countries. International viewers were 

more interested in the COT reports. While 

Illustration 5: Google Analytics CFTC Reports:

Summary Views within the US Domestic Boundaries.

Illustration 6: Google Analytics CFTC Reports:

Summary International Views.

• ·t .... • 

0-, :' ••• . . . ... c • 

. . ~: 0 

... -: 

w_o 

• • 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

15

there was less interest in Cotton on Call reports domestically, international interest 

was more frequent and Bank Participation report interest was not apparent.

Google Trends for 

the COT reports

As shown on 

Illustration 7, 

available Google 

Trends data shows 

declining direct 

access to COT 

reports. While the 

numbers merely 

represents search 

interest relative to 

the highest point on the chart, it 

provides context for the one CFTC 

Market reports most viewed by 

external audiences. However, we realize that third party vendors separately post 

data taken from the COT reports; we do not estimate third-party distribution here.

We also note that in the event of a government shutdown, cessation of the COT 

reports can generate interest and concern,

18 which indicates there is still some value 

in the COT reports (or the information contained in them). Declining direct access on 

the www.cftc.gov website may indicate that individuals do not find direct access to 

the COT reports as useful as in the past (because they are static), or simply prefer 

third party19 availability/packaging of the same information (because it is interactive). 

• cftc commitment of traders 

Search term 

Worldwide ... 2004 • present '"' 

Interest over time 

+ Compare 

Atl categories ,.. WebSearch ,.. 

!. <> < 

 

Illustration 7: Commitment of Traders Searches From

FY 2004 to November 2018

18 See, e.g., Bird, D. (2013, Oct. 4). Shutdown Shuts Down Commitment of Traders Reports From 

CFTC. Wall Street Journal, https://blogs.wsj.com/moneybeat/2013/10/04/shutdown-shuts-downcommitment-of-traders-reports-from-cftc/. 19 CME Group – Commitment of Traders Tool and ICE Report Center.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

16

Comments on CFTC.gov Large 

Trader and Cotton Reports

Between October 1, 2018 and 

July 30, 2018, CFTC received 

248 inquiries related to either 

Large Trader (COT) or Cotton 

on Call reports. 78% of these 

comments were associated with 

report value.

COT Report Public Comments

Text analysis of 107 randomly 

selected emails to marketreports.cftc.gov 

showed most interest in the categorization 

or/classification and compilation of report data. 

To a lesser extent commenters also expressed concerns regarding the quality of

reports.20 

COT Report 

Value

60 

54 

50 

., ., .. 

30 

22 

,. 17 

14 

10 

~ p Findir« Poltnli.11 CI.VityonCOT COT'""" & As.kin& Fol Ntw ReleHe COiton On 0 1 Hdp Wilh Bink 

COT O.i,t,1 Problem s with Cl.1ntfatioos Oefflitioos & Fe,u ure Or Schedule ukul.1tiom P1rticip;ltion 

COT [Kl)l,1n,1tory Rel.1ted °'t,1 

""'" 

Illustration 8: Cotton on Call Report: 

Public Use Requests by Category.

Illustration 9: Word Analysis for Most Frequent COT Report Words Used by Stakeholders.

 

~ - Ted botorer for !:malt. 

4 T•••" ••'ldrtn•••Lla\• 

:.:-... ..,.... 

.... .._... 

--· ....,, =' 

:'.!..-. 

:~ ,..,__ .. 

·-

-

, __ _ .... 

-· ~-

~-

=~ ·~-

c:- •"l>-..d•...,_.,,...... ..i---~ 

=- , __ __.,......._. ... __. ...... -.... --~ -~-..._.. .... -... •~O<K..........,_ ln,_ 

,

-o,po,--.......- ,.,__~,-----.. -·- ==c:~::.=..~-.. =:.::=:~~ • ........,.c-... ==-=~-:.........,,..,. ..-.

-..-U __ 

~-.-.- --.... 

---wg,t'ly U<_-

~<""""' ~ ,.j ---<~ ~~::_ 

ate o commercial 

traders report cot disclosures 

q u esti on m o n ey email group oil c rude 

d isaggregated entities participants merchant t rader confidential cpos etas important information intended 

recip i ent spec1f1c status managed producer futures 

attac-hme nt guaranlc-e In corpora t io n 1n1e9ri1y meso;a9e n f;e ,e4i~tt_.,·et..f rcyuldtc l.f <.u 1111nU<Jity 4 0 (pl ea rv 1111 fv,u.J~ 41,,1~::.liv11::. ev1o~~:'!~:~ dMJo c l:u.iitic.:uion CPO d e al Cf' ticct9c posl1 ion s , o,carch phys.lc:11 

1'-c-1/Mf' F,ik [d<t T..a.t.o OOf An.._ G,._., T ... , Add·...,• '¥Mw W...- H•lp 1...'il ~ .J _. 1111,l "' COTSCOMTXT .. , • fi. 

...... , __ .... ·····---

t;'ll rJ..S W ~ -i ~ (coTSCOMT)('l'm •l 'k ,.. ...... J•I•- I" lhe T,, . ........ •h")' -,•• ..... I•--)' -.1•"•''"'"'''"" .... , -..-••• 1• 1 ...,,J ,. __ .._,__, ~I.,.\ -• '•~r ... ,,. 1~, .. i ...... 1r1 ... ,1 .... .,. ,~ .... u .. ~•••• fl'>&) 

, ... )'Ou Pl••··_,,. ... ,,_,,_ <e••··- 1.1.• .. , ,._ .... - ... I•• "-_._r._1.1 , , . .......... - ... .. , ·•-1 

• """•' I• , .... cl lffe.-•n<• "t--•"' _, -• .,.,.... •o.lth•"• ,_ O•e 1.,.....,, • •"" • ~ ,.,.._,. ,. (f1•1d I~ 'loo IH l,o ltha li"k •b-) 1 l1ll _____________________ ~ 

~ e .J., _, ,-- lconc0Mnn11, - 1-.. 

Q,,f' q ...... I - I• , .... , ....... ...-. ... ,_ V•• ·---•l _.,_ -., u,. IIO•ltlo,,1 ... , .... , ... <•t•ao..-J.es . .... ..,i •• _ . ,.. •••LIi• ~- --•--•· J-"' c:--•"• c,12J 

s...t.Je<t •t• Cot ~-•ll.,.. ,.,. ,_e,-,Cl•l O•'"'tl<l-t• <ete•ol'y 

t:11- ... Ro,_ 

~;:,::::i 1~0 l~h~~. \~~~!I ';=1;;~ :~:--r .:!pp;::-;~~:~~::.:~~~::~:::9;~w:~ • :..~ u!;'-~..::::~ i "''._J ""'"'•"'"'•• _,...,•" • ,..._ v•• ..... •••<•O ,,,. ,..,,..r, ,_ ,...)'tl<•I c-•Ulot• .,...,.. ,,.. -"•c:-•..-c t•t· cat•e-" ., it- 1••.c" ,._,;,. '""• --,. .... _ _,,. -• -.,,..,. ... ,...,-1 ••. - r-• ,_ l•pl-•tor)' HOt•• ,_ ,,.., OIMN"" .. '"• -..u1 f o r• -r• <-Pl••• {l•ll 

20 We note that these emails were not solicited. In 2006, CFTC solicited comment on the COT 

reports. 71 FR 35627 (June 21, 2006). In response, CFTC received 4,659 comments from the U.S. 

and from 22 additional countries. At the time this set a record; the previous record was 1,062 

comments received. CFTC, Commission Actions in Response to the “Comprehensive Review of the 

Commitment of Traders Reporting Program” (June 21, 2006) 

(https://www.cftc.gov/sites/default/files/files/foia/comment06/foicf0603b002.pdf). 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

17

Internal User Survey Results

We conducted a survey of ISS users. Respondents generally believed that ISS met 

division mission needs more so than not. However, functionality did not fully meet 

user expectations. While 23% of current users rated ease of use below average at 

2.6 in a scale of one to five (1-5), 39% of current users rated data reliability and 

accuracy above average (3.3 out of 5), 39% of current users rated queries and 

reports just at average (3.0), and 42% of current users rated system performance 

above average (3.5). A clear majority of current users (70%) wanted both menu and 

self-service data access not currently available from the application. 

Illustration 10: Internal Survey Results – Questions 1, 2, 3, and 4.

Average Score - 1 (Low) to 5 (High) Percent Respondants

Question 

1. How 

would you 

rate the 

ISS 

application

in helping 

meet 

these 

division 

mission 

goals?

Question 

3. Does the 

current ISS 

system 

functionality 

meet your 

user 

needs?

Question 

2. Rate 

the 

following 

ISS data 

elements 

and 

functions.

Question 

4. What is 

your user 

access 

preference 

to the data 

in ISS?

,.o 60.096 4.S 

4.0 ,., 50.096 48.196 ,., H ).4 --a.2 

,.o 40.096 

2.S 

2.0 30.096 

1., 20.096 1.0 

o., 10.096 

0.0 

la. Promote lb. 0Yer5te l e. Understand Id. Understand (l(l,I; 

OYe r-..ll ma1lcet nu,toet regislr.anls. brgiet~erd.tl.a other p.1rtltlpants Neutral Yes No lnteg.rity. sets. d.at.1siets. 

4.0 ,., 80.0% 70.4% H ~.3 70.0% ,.o 

,.o 60.0% 2.6 

B 

J 50.0% 

,.o 40.0% 

30.0% 1., 

20.0% 

1.0 10.0% 

o., 0 0% 

0.0 Hybrid of both? tv1em driven pre·set Self Se rvice data 

Ja. (.>Se of use and lb. O.at.a reli.;lbility Jc. Menu d•~n 3d. Svstem speed reports? mining a ccess? 

navi,g.llion. and accuracy. qut1yand ,eporls. and ~1101 ~nee. 

Users also conveyed their desire for: 

• A refresh or update to ISS’ “clunky interface;” 

• The ability to generate reports across traders; 

• Access to trend trader information; and 

• Access to metadata information (that we noted earlier is specifically addressed

under the Open Government Data Act). 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

18

Illustration 11: Internal Survey Results – Question 5: Suggested Improvements. 

Report Substitutions Can Lessen Cost

Research of public reports using COT data identified commercial entities offering 

similar but more dynamic reports. For example, both CME Group (CME) and the 

Intercontinental Exchange (ICE) provide dynamic reporting of their respective COT 

data using queries and dashboards. In contrast to the static CFTC COT reports, ICE 

and CME users query data from a database. At CFTC, creating a customized static

COT report can be costly because it must be done manually; a CFTC IT team cleans 

and prepares requested data for analysis in each instance. In contrast, the ICE and 

CME self-service tools already allow this functionality online. After an analyst 

connects to a raw data source, he or she can specify cleaning procedures and 

transformations that the data needs to go through before being presented in a CME 

or ICE dashboard. 

Given the expense of creating static reports, the relatively low viewership of reports, 

declining COT report interest, and the desire for more report value, we note CFTC 

has an opportunity to reevaluate whether it is cost-effective to generate reports in its 

present form or to offer the technology advances of self-service tools that enhance 

customer experiences. 

.. Text Explorer for 5. What funtionality improvements would you prefer/suggest for JSS? 

Numbff Numbff Tot~ TOMN Number of Non• Portion Non• 

ofTffffls of Cnn: Totr;cm perCne empty Cnn emptyperCne 

309 27 1010 37.4074 19 0.7037 

.,Term and Phrase lists 

Term Count 

da1a- ~ ~~~,;;;;;-i 

lradf'r• 9 

Uset• 9 

-

prog 7 ,.am- 7 

quf'fl• 7 

w rrenl• 6 systf'm• 6 

1ndud- 5 futur• 5 tlmf'· 5 

U~· 5 ~ ar, 5 

hel~ function, intf'ffac, 

largpo<,t• 

tabl• 

-•· "'""' accessdon•· 111,e- anyth• 

"'"'" 

.,, .... 1iar9t"1raa-~,-

f\(r~~l~"&ata 

ii :~Z,~; ~ uced :i$sapplication :tradf'f O'Nflf'f 

[underlying tables ;years ago 

Count N 

3 2 2 • 

2~ 

2 2 

2 2 2 2 2 2 2 2 

ltl Phrase Tf'xt -JMP 

u1 e .. H d ~ lid ,- !.-~, •ls Text for Phrases: large trader 

The software was develoPed aany yeo\rS ego, so a refresh would be nice . The interface is clunky, but functional. I do use it periodically to pull large tr;,der positions and to f'-:dract sf'-ttle«nt 

prices, however, I soaeti.e just poll the data directly fron the underlying tables. I do think an interfacf' is helpful for users that aren't savvy enough to access the underlyi ng tables though. [21] 

It would be very helpful if the ' Large Trader Coosolidated Market Report' could be done across all 

}~~~ers, si11ilar ly to a ' Large Trader Query'. Currently I ..,st know whoa I a11 looking for. Thank you! 

0 Ptw'aseleKt-JMP = lei 

Text or Phrases: piece'!, of the data 

1) IS.S currently lacks the proper structure of an archival date which is fundaaental to sound econoat'tric analyses of Utt' data and propt'r t'conoaic f'valuatioo. Specifically, it is highly iaportant 

to be ablt' to t rack a t rader/owner ovt'r tillt' in the databast' with proPf'r linking tablt's for various changes in the status of the trader/owner. 

2) A reloted issue i s that there is no identifier included in the data (e.g .• ticker and cusip for owner) that could be used to linlc to other publicly availablt' date (e.g., financial data froa BlOOlbt'rg) 

3) There is no readily available docU111entatioo/11anual on t ht' data structure and tht' variablf' definition'!.. In ordf'r to find out thf' relt'vant pit'Ct'S of thf' data filf''!. Ont!: .ust conduct detf'-Ctive 

work i n reachinc the infonaation source. Solle of the sources include power points slides. Oiffert"nt groups across CFTC know differt'nt pieces o f the data and it t akes real effort to piece all the inforw;ation together. ( 18) 

B Phrase Tm - JMP 

I ul i:! 3 W -.. ext for Phrases: business IIIOdel 

rt"pres ent todoy·s industry business 111odel. SOM dote cannot be fully defined to the databse because 

of thi'!.. [BJ 

I 

he databasf' rt'presf':nts tht' business IIIOdel of industry 20 yf!ars ago and needs to be upcradf'd to 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

19

Recommendation

2. We recommend CFTC update business requirements for ISS and incorporate 

user and customer expectations in future ISS versions, if any, and as a part of an 

Enterprise-wide future-state roadmap that aligns with mission operations.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

20

Appendix C 

ETL Process for Data Staging 

An ETL (Extract, Transform, and Load) process enables ODT to load data from 

source systems into the ISS database.

21 An ETL tool is a means of taking data from 

one or many formats, transforming it and loading it into the database. 

ETL Best Practices

Researching best ETL practices, we noted several common attributes across 

various platforms. Specifically:

• Modularity, that is, creating reusable code for ETL processes. ETL 

modularization helps avoid writing the same difficult code over and over, and 

reduces the total effort required to maintain the ETL architecture.

• Using ETL Staging Tables. Often, the use of interim staging tables can improve 

the performance and reduce the complexity of ETL processes.

• Error Handling - When suspect data is discovered, there needs to be a system 

for cleansing or otherwise managing nonconforming rows of data. 

• Auditing & monitoring ETL jobs to ensure that the ETL jobs are performed as 

intended. Key attributes for these competencies includes, (1) logging, (2) 

checking for errors that also support auditing of row counts, financial amounts, 

and other metrics, and (3) data lineage, that is, documenting data source(s), 

when it was loaded, and how it was transformed.

• Using the appropriate ETL tool(s). There is a proper tool for every platform. 

However, email notifications in ETL processes add unnecessary complexity and 

potential failure points.

 

21 For background please see: 

http://www.dbta.com/Columns/SQL-Server-Drill-Down/Powerful-ETL-Technologies-in-the-MicrosoftData-Platform-109419.aspx

https://aws.amazon.com/blogs/big-data/top-8-best-practices-for-high-performance-etl-processingusing-amazon-redshift/

https://www.timmitchell.net/etl-best-practices/

https://www.computerweekly.com/tip/Six-ETL-best-practices-followed-by-Shoppers-Stop

https://www.timmitchell.net/post/2017/06/14/etl-staging-tables/.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

21

According to these practices, the current way of dealing with a failing ETL is to 

remedy any architectural and design mistakes by purchasing licenses and hardware. 

This approach may be merely disguising the symptoms, rather than tackling the root 

cause. Thus, CFTC may need to consider the current cost, effectiveness, and 

reliability of ISS data cleansing as used internally, and as the basis for CFTC’s 

external market reports.

ISS ETL Process Can be Enhanced

When evaluating the ISS ETL process, we noted ODT employs certain best 

practices such as modularity, but could enhance ETL security, reliability, and

efficiency by migrating to an updated platform. 

As depicted in Illustration 12, ISS data is received from numerous traders via FTP; a 

30 year old transfer protocol where security is not a chief benefit. In addition, FTP 

offers no traceability, that is, no way to see who accessed what information. This 

loophole has made it easy for cyber criminals to hack into FTP servers, retrieve 

shared information and leave without a trace.

Illustration 12: ISS Data ETL Process as Performed by CFTC.

Unit 2 Chicago

3FTEs

Unit 3 Chicago

4 FTEs

Unit 1 NY

4 FTEs

Part 16 validated at transaction level. Automated. 

Part 17 validated at the the file level. Manual.

CFTC teams correct record/files with errors. 

Corrective follow-up via email with reporters.

$

FCMs

$

Clearinghouses

Part 16

FIXML Format

Part 17

80 Character Format

External Reports:

Commitment of Traders

Cotton on Call

Bank Participation

Strike Price

5 Contractors

Supervisor

ISS Application

D 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

22

As it relates to reliability, error handling is manually intensive because staff relies on 

email communication to correct submission errors. In our attempts to quantify errors 

in context of basic metrics such as row counts and financial amounts, we noted that 

logs for data load metrics have remained offline since 2017. The database manager 

explained that, due to the structure of the current data CFTC receives and the ISS 

system itself, the only way to determine rejected and unprocessed records and files 

is to forensically research each submission. There is a table that tracks errors on 

processed data, but it does not provide an accounting of whether or not the record 

that created the error condition was replaced. The system does not notify the 

reporter when a problem has occurred; it merely logs the fact that there was an 

error, and moves on. In other instances, if there is an error condition, the entire file is 

rejected, and the reporter is notified. The reporters know and understand that when 

this happens they are non-compliant with the rule until they re-submit. Thus, 

presently, ODT cannot easily determine whether the error conditions were corrected, 

or whether they still exist.

As it relates to efficiency, we noted from ISS logs that the current ETL configuration 

requires support from ODT personnel, contractors, and other CFTC staff in mission 

operations. More specifically, to service 55 front-end users, 33 support personnel22

(21 ODT) interfaced with ISS during the first half of calendar year 2018. This 

indicates that, for every 3 active ISS users, 2 support personnel are necessary to 

complete the ETL cycle and maintain the ISS. While we recognize this situation 

exists because the current configuration uses stored procedures to facilitate the 

transformation of files submitted, more modern platforms use staging areas and fully 

automate routines for bulk loading. 

The current version of the ISS and databases are hosted on a Microsoft SQL Server 

2008 platform. In April 2018, a change request was proposed to migrate the current 

platform to a 2014 cloud platform. We are encouraged by this step but note that 

Microsoft has since introduced powerful ETL features to the cloud via the Azure 

Data Factory.

23 Other vendors such as Amazon have similarly fielded solutions that 

facilitate and track ETL processes end-to-end securely. CFTC may wish to consider 

these options.

 

22 Defined as active users with Create, Read, Update, and Delete privileges. 23 https://docs.microsoft.com/en-us/azure/data-factory/introduction.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

23

Recommendation

3. Modernize the ISS to enhance the traceability, efficiency, and error handling of 

ETL processes, which will require a determination whether to update the ISS 

platform to achieve these goals or, based on a consideration of costs and 

benefits, to migrate to an updated platform. 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

24

Appendix D 

Change Management Policy and Procedures 

CFTC has implemented a Change Request Process24 that requires approval from 

the change management board prior to making any system changes. This includes a 

security impact assessment.

The Change Control Board (CCB) is responsible for administering changes to 

configuration items (CI) in the enterprise Information Technology (IT) infrastructure 

of the CFTC. The CCB represents the interests of various CFTC divisions, offices 

and programs by enabling change decisions to be based on knowledge of change 

impact and benefits. It provides a clear and orderly process for tracking changes and 

for communicating information about change information to the various divisions and 

offices within the CFTC. 

The CCB performs these tasks to:

• Ensure that proposed changes will not negatively impact current operations; 

• Evaluate and approve, disapprove, or defer proposed changes; 

• Review and authorize the establishment or changes to program baselines; 

• Approve updated baselines and documentation; and

• Ensure the implementation of approved changes. 

When analyzing the change management process for ISS 8.12.1,

25 we found the

database team followed the ODT policy and procedures by submitting a standard 

change request with a security impact assessment for approval. Changes were 

tested for quality, a back out plan was documented, and the code changes were 

placed in production thereafter. Following the CCB process allowed ISS database 

managers to reduce the overall negative impact of system changes and to avoid 

compromising the CFTC IT enterprise infrastructure with harmful code.

Recommendation: None

 

24 Change Control Board Guidelines and Process Revision 1.1.2, Apr. 06, 2017. 25 The following changes are contained in this release: Users can cancel a trader and successfully 

move associated files. The requested changes are considered low risk.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

25

Appendix E 

Security and 

The CFTC operates a comprehensive system to collect information on market 

participants. Under CFTC’s regulations, the Commission collects market data and 

position information from exchanges, clearing members, futures commission 

merchants (FCMs), foreign brokers, and traders. To ensure privacy of the 

information they provide, the CFTC has assigned confidential reporting numbers to 

reporting firms and traders. The Commission is prohibited under Section 8 of the 

Commodity Exchange Act, 7 USC 12, from publicly disclosing any person’s 

positions, transactions, or trade secrets, except under limited circumstances. Under 

its large trader data program, the CFTC stores data collected in the ISS and has 

classified its contents as confidential information; including highly confidential trading 

information and sensitive personally identifiable information. 

 

12

13

37

4 6 DCR

DMO

DOE

DISO

OCE

• 

• 

• 

• 

• 

 

Illustration 13: ISS Users by CFTC 

Division.

I 

I 

I 

I 

• 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

26

Illustration 14: ISS Users Categorized by Roles. 

0

2

4

6

8

10

12

14

DCR DMO DOE DSIO OCE

i -

] • I JI J II I llllill Ill I Ill Ill I .Ill Ill Ill 

liiil Iii a Iii Iii 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

System Limitation

ISS, as a legacy system, was designed prior to current security requirements and is 

not readily able to comply with the above requirements. Unless brought into 

compliance, the CFTC maintains the risk that confidential and sensitive market and 

PII data could be exfiltrated without authorization. 

Recommendation

4. Given current federal security standards, we recommend CFTC re-evaluate

 requirements for ISS. 

We previously reported 2 other findings27 related to the – ISS 

We recommended that management improve 

 Management agreed with our recommendation and is taking steps to 

remediate associated risks.

 

27 CFTC’S Compliance with FISMA for Fiscal Year 2018, Report Number: 18-AU-08, October 30, 

2018.

• 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

28

Appendix F 

Security Concern for Similar Legacy Applications 

“PowerBuilder” is a rapid application development tool for building and maintaining 

Windows applications, and provides core database functions. It has been in use 

since 1991, peaking around 1998. While PowerBuilder's market share has declined 

over the years, several CFTC applications, including the ISS, still use it today.

Specifically, in addition to ISS, Master Data Services lists the following CFTC 

systems were built in PowerBuilder and still in use:

• ADD Content Manager - ADD Content Manager allows CFTC staff to review and 

approve content for CFTC.gov and manage the Content Refresh Notification 

Schedules. It has been identified as a low risk system.

• Commission and Staff Letters - Commission and Staff Letters (CSL) has been 

developed for the Division of Market Oversight to capture, manage, report, and 

publish No-Action, Exemption, and Interpretation actions initiated by both the 

Commission and by external registered and non-registered entities. The risk level 

is unknown. 

• Filings and Actions – Filings and Actions (FILAC) allows CFTC staff to enter, 

modify, query, and publish submissions associated with organization, product, 

rules and foreign filings and actions. The risk level is unknown.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

29

 Illustration 15: Legacy Applications Built on the PowerBuilder Platform.

28

While there are cybersecurity features for modern applications that allow compliance 

with federal security requirements, for these other legacy 

applications may also pre-date current requirements for securing federal systems. 

Revaluating risk and security requirements for these legacy applications would 

reduce the opportunity for hackers to use old, trusted exploits. Many legacy 

applications also fail to document the changes made over time, leaving them 

vulnerable to systemic weaknesses, and gaps for malware. We recognize that 

legacy applications such as ISS remain in use because they are considered 

irreplaceable mission-critical systems with highly sensitive data; we believe this may 

result in a larger risk factor and tempting target for exfiltration. 

Recommendation

5. We recommend CFTC review security risks of other legacy applications and 

assure compliance federal information security standards. 

 

28 Correspondence Tracking System – May have been retired with the deployment of CSL.

Microsolt SOL $ef"IE( 2014 lilt er Oi11 SeM<es 

bfltft')KJeJd'H! •01C1lffu:ourn1uotll'\l 

fiatrs Col~r:ns 

Systtfl-5 

t,ul ~D<fo<t ~ ) Sci« • 1)11" fr,11actiw f ff1lJ •1a,1hi; wl ,,_ 

th· [P'.lf..,J 11<1>'1~-lb i.1[,...,;J """'~O 

(11,ll Attributts) 

-

kJOCu1ztPYliffl 

CormFQ:dtlKt Ndiq S(,.':tlll 

:ru1p:fdSt.twibn<t 9t'ltT 

~M'ld.<tt.tiM 

..,,,.. 

"' 

.l(IOC'IICC' 

""'""' 

l<DC'IICII 

"' 

RU< 

..... .,.. 

"" 

"" 

low 

"" 

Corr~~SU!fLtQtrs.{C'9.)t.s*!"IU\~b'l!ht ~lll'ldNid:EtO,ri;t -t-><ip(l.Jt, tUM~, N!J»I\ ir.~~N)-.1,~,n. !xempi),\~ ~ 08(l\ft~ 

.&.ro CWtn! Cm:~ [AOOCWC'C) ,C{4"!:,ift, pendi~ «rte!'«b ('l:rmt corttntM CHC.-JO" n 1~6ttt m co,tw,,, fflTM1 «r•~ i'1dc(lllirt 11'-it *<>• .'O'~l:let rJ'Jl".l9(13 

.l.!J!>Cinf!'ltila'rtst{AOO(XR} n.m1ii SCbtdl~ti'!ktilC'lti,/t ttrt~Curtn:tfprbhbtdrot.e.-.i:lli:b,~)l«Clt.Ttthathisooriiwm<'~ n,~ 11Sf'J9{U 

tltr CCtr~ T1.):.\i"'9 Sr.tell i..xk:. 11"1! Cinr.6w.l'~C'Xl'.rab! n J UKOl'h'JeJ «fl~1rbcii,;l.a:D\t itcorilt1' c.t.1Y«tr(.'$,nbxt ::.td- ~;t 1':!Mlailb 05/:)1/15 

llt"IJfllfG~SystEm(lSS)~filure,;lrd~e,.dd~rl)[8!Ktlditi1lcr\J"g,,rnM'l,.ud<c:«0b.tertl, Y'Me.,~(J'~~Of~i.~rnf:.'ll ;,o~ D7/llfl!I 

R"l"J'lmd~(ruc).-,,,crcSQ'lrc,c,nr,lltdiy,~llff'p,UlllpiJ;'!Slbt:!wtll'Y.J-:sod¥(6-«bll'9ri1.i!«l,ptflllltt,r<M$;1'dkr'e'.91ilr9'iJIIC }Ir~ QQ/21fl~ 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

30

Appendix G 

Background, Objective, Scope and Methodology 

BACKGROUND

In recent years, Data Governance practices have become more defined within 

federal agencies, and requirements for effective information security programs have 

evolved. For example, the President’s Management Agenda lays out a cross-agency 

goal to leverage data as a strategic asset. Achieving this goal requires data, 

accountability, and transparency initiatives to provide the tools to deliver visibly 

better results to the public, while improving accountability to taxpayers for sound 

fiscal stewardship and mission results. Investments in policy, people, and processes 

are key elements of this transformation and encompass all relevant governance, 

standards, and infrastructure and challenges of operating in a data-driven world.

Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and 

Critical Infrastructure (May 11, 2017), also emphasizes safeguarding high-risk and 

value assets (including data). The Information Systems Audit and Control 

Association Enabling Information framework states that information or data, in 

context, should deliver value for its stakeholders, translating to achieving enterprise 

goals.

29

Data exists throughout enterprises; almost all stakeholders, processes and business 

activities rely on data at some level and to some degree. If data cannot be kept 

accurate, up to date, reliable, and secure, risk may increase across business, 

operational, and compliance domains. We note that a Data Governance program 

should ensure the following: 

• Stakeholder needs, conditions and options are evaluated to determine balanced, 

mutually agreed enterprise objectives to be achieved through the acquisition and 

management of data/information resources; 

• Direction is set for data/information management capabilities through 

prioritization and decision making; and 

• Performance and compliance of data/information resources are monitored and 

evaluated relative to mutually agreed-upon (by all stakeholders) direction and 

objectives.

 

29 https://m.isaca.org/COBIT/Documents/COBIT-5-Enabling-Information-Preview_res_Eng_0214.pdf. 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

31

In summary, a Data Governance program reflects the practice of evaluating 

requirements and bringing direction and control over data and information so that

users have access to that data and can trust and rely on it. 

At the CFTC, four groups are responsible for enabling information as a strategic 

asset; three are highlighted that have ISS responsibilities. As depict in Illustration 16, 

the Data Management Branch performs back-end database services, System and 

Services acts as a front-end bridge to stakeholders, and Policy and Planning 

ensures information security through a Chief Information Security Officer.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

32

Illustration 16: Office of Data Technology (ODT) Organization by Branch.
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

33

OBJECTIVE, SCOPE, METHODOLOGY

The OIG reviewed CFTC’s Data Governance program. Our objective was to assess 

the maturity CFTC’s Data Governance practices using the Information Surveillance 

System (ISS); a system that hosts confidential and sensitive market data. Our scope 

evaluated practices for (1) defining business requirements, (2) extracting, 

transferring, and loading data, (3) managing changes, (4) maintaining stakeholder 

value, and (5) securing data.

To assess CFTC’s Data Governance program maturity, we reviewed available 

documentation and methodologies, researched federal requirements and standards, 

and private organizations best practices. Relevant federal requirements reviewed 

included:

• The Clinger-Cohen Act, Pub. L. 104-106, Division E (Feb. 10, 1996). 

• Executive Order 13800, Strengthening the Cybersecurity of Federal Networks 

and Critical Infrastructure (May 11, 2017). 

• Federal Information Technology Acquisition Reform Act, Pub.L. 113-291 

(Dec. 19, 2014). 

• OMB Circular A-11, Preparation, Submission and Execution of the Budget. 

• OMB Circular A-130, Management of Federal Information Resources. 

• E-Government Act of 2002, Pub. L. 107-347 (Dec. 17, 2002). 

• Applicable NIST Guidance on Data Security and Access.

To evaluate practices, we analyzed business requirements for ISS focusing on 

required data formats, submission processes, and reported challenges, if any. To 

evaluate CFTC’s extracting, transferring, and loading data (ETL) process, we 

evaluated schemas and procedures, applicable contracts, and interviewed 

responsible staff. Our review of change management practices covered policies and 

procedures, change requests, and approvals. We surveyed active CFTC business 

users to evaluate stakeholder use and perceived system value. We analyzed Google 

analytic statistics to assess external stakeholder value. Given ISS hosts high value 

assets, we evaluated system user activity logs, focusing on . We 

examined ISS activity logs and inquired about their reliability. The system logs used 

were considered sufficiently reliable for the purpose of this review. We conducted 

our audit in accordance with Generally Accepted Government Auditing Standards

(GAGAS).
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

34

Appendix H

ISS Background and History 

BACKGROUND

ISS organizes and stores end-of-day position reports electronically filed with the 

Commission by exchange clearing members, FCMs, Designated Contract Markets,

30

and foreign brokers (collectively called “reporting firms”). ISS allows the agency to 

monitor the daily activities of large traders, key price relationships, and relevant 

supply and demand factors. 

ISS data enables the agency to analyze the composition of the market, such as the 

participation in the market by commercial versus non-commercial traders and the 

open interest held by certain occupational categories. ISS collects and processes 

daily futures and options position data for large traders from reporting firms and daily 

open interest, volume, price and clearing member data from exchanges. This data is 

supplemented by related cash market price data from a variety of sources. In 

addition, ISS receives and stores identifying information concerning each large 

trader and reportable account. ISS data is also used to provide public reports, such 

as the COT report and the Cotton on Call report.31

 

30 CFTC states: Designated contract markets (DCMs) are exchanges that may list for trading futures 

or option contracts based on all types of commodities and that may allow access to their facilities by 

all types of traders, including retail customers. 

https://www.cftc.gov/IndustryOversight/TradingOrganizations/index.htm. 31 CFTC Privacy Impact Assessment, Integrated Surveillance System (ISS), Sept. 30, 2014. 

https://www.cftc.gov/sites/default/files/idc/groups/public/@privacyoffice/documents/file/integratedsurv

eillancesystem.pdf. 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

35

TIMELINE OF MAJOR EVENTS32

Illustration 17: ISS Timeline

Fiscal Year (FY) 1996: CFTC awarded a contract and commenced work on the 

development of a new Integrated Market Surveillance System. The system is 

designed using client-server architecture. 

FY 1997: CFTC deployed ISS for the processing of futures and large trader data. 

FY1998: Deployed capabilities to obtain large trader option position data on a daily 

basis. 

FY 1999: Modified the market surveillance system to use information from FCMs on 

the option positions of large traders. 

FY 2000: Reengineered the market surveillance system based upon client-server 

architecture.

FY 2001: Contracted to provide software development support and enhancements 

to stabilize the ISS. 

FY 2003: Transferred all Large Trader Reports into the ISS. 

 

32 Source: Historic CFTC Annual Reports, Performance and Accountability Reports, and Presidents 

Budget. All reports are available here: https://www.cftc.gov/About/CFTCReports/index.htm. 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

36

FY 2004: Enhanced ISS to address changes and growth in the futures industry. 

Those changes included accepting markedly different contract markets.

FY 2005: Enhanced ISS to address changes and growth in the futures industry. 

Those changes included the automation of the collection and review of data from 

exempt commercial markets. 

FY 2008: Enhanced ISS to better display positions in futures months. 

FY 2009: Standardized data submission in the Financial Information Exchange 

Mark-up Language (FIXML). 

FY 2010: Invested in automated alerting and workflow and position limit monitoring 

changes to adapt to market changes.

FY 2011-2015: Communicated plans to modernize this mission critical system, 

which was originally developed when manual detection methods were sufficient to 

monitor market conditions. The intent was to enable focus on greater market 

manipulation detection and reporting, increased internal and external data 

transparency enhanced reports, improved case management to track market 

surveillance activities, integration of large trader data with intraday trading activity, 

improving the automated collection of data from industry participants, and enhancing 

capabilities to manage position limits. 

FY 2016 – 2017: CFTC did not specifically discuss ISS in its President’s Budget & 

Performance Plan. However, CFTC requested funding to enhance surveillance 

capabilities to keep pace with the increasing technological sophistication of the 

markets—in particular, the increasing use of automated trading.

FY 2018: CFTC stated that information technology services support data acquisition 

and analysis that are crucial to conducting effective surveillance and oversight of an 

increasingly diverse electronic marketplace, detecting/investigating illegal activities, 

and conducting regulatory oversight of Commission registrants. In support of the 

surveillance function, the Commission planned to improve the quality of data 

ingested using a multifaceted approach, including development of detailed data 

quality, acceptance specifications/standards, data validation checks, and data 

quality monitoring and reporting. 

CFTC recognized that in the modern marketplace, where automated trading 

dominates, many manipulation strategies cannot be determined by using legacy 

data already filed with the Commission by market participants or available in the 

market. 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

37

Appendix I

Notice of Findings and Recommendations 

FY 2019

Finding(s):

FY 2019 Recommendation(s): Management 

Concurrence

(Y/N)

NFR-DGA-ISS-01-2019

Deficiency in maturing 

an enterprise Data 

Governance Program.

NFR-NGA-ISS-02-2019 

Deficiency in data 

management controls

for ISS. 

We recommend CFTC: 

1. Set a timeframe to fully implement 

plans for its Data Governance

framework and, if not already, 

synchronize with goals outlined in 

the Federal Data Strategy and 

Open Data Government Act 

requirements. 

2. Update business requirements for 

ISS and incorporate stakeholder 

expectations in future ISS 

versions as a part of an 

Enterprise Architecture program 

plan that aligns with mission 

operations. 

3. Modernize the ISS to enhance the 

traceability, efficiency, and error 

handling of ETL processes, which 

will require a determination 

whether to update the ISS 

platform to achieve these goals 

or, based on a consideration of 

costs and benefits, to migrate to 

an updated platform. 

4. Given current federal security 

standards, re-evaluate 

 requirements for ISS. 

5. Review security risks of other 

legacy systems and assure 

compliance with information 

security standards.

Yes

Yes

Yes

Yes

Yes

- -
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

38

Appendix J 

Management’s Comments 

.S. COMMODITY I; TURES TRADI '(; COMMISSION 

Three Lafayette Centre 

115521st5treet, NW, Washington, DC20581 

Telephone: (202) 418-5000 

Facsimile: (202) 418-5521 

www.cftc.gov 

o mcc of Datri & Technology 

TO: Miguel A Castillo. C PA, CRMA. 

Assistant Inspector General for Audits 

FROM: John L. Rogers. Chief I nlb mrnt ion Officer 

DATE: May2.201 9 

SUB.m e r : Commodity Futures Trading Commission Mnnngement Reponscs to 

the Review of'CFTC's Data Oovenrnnce Program: Integrated 

Surveillance System 

MEMORANDUM 

We appreciate the opportunity to respond to the subject <Iran report. 'l11c Office of Datu and 

Technology (OIYI) within the C FTC concurs with the audit ·s recommendations. ODT is 

committed to working with the appropriate stakeholders to address the issues and concems 

mentioned in the referenced report. ODT's management responses and actions taken arc listed 

below for each recommendat ion: 

I. Set a rimeframe to ful{p implemellf pltms for its Dau, Govemance fra111e11•ork flllfl, if 11or 

alrem{11, sy11chro11ize ..,;,1, the goals omli11ed i11 rite Federal Daw Srmregy and Open Daw 

Gover11mem Act req11irem e111s; 

'l11e Office of Data nnd Technology (ODT) concurs with the Office of' the Inspector General's 

assessment and their recommendation. 

ODT is working on fonnulnting n Dntn Govcmn.nce frnmcwork that aligns with the goals 

outlined in the Federal Dntn Strategy and Open Data Oovemment Act requirements. Subj ect to 

funding. n full implementntion plan will be developed and executed to implement the first level 

of policies, procedures, nnd govcming bodies based on the framework . 

2. Uptime b11si11ess req11ire111e111s for ISS a11d i11corporare stal,ellfJltler e,.11ecmriom i11 f 11111re 

ISS 1•ersions as fl part of an Enterprise Architeeture that flligns with mission operfltions; 

ODT concurs with the Office of the Inspector General's nsses~mcnt nnd their recommendat ion.

ODT is working on a plan to address the conccm s and recommendations in the OIG report. l 11c 

plnn will include new requirements gmhcring efforts, meeting with users of the Integrated 
U.S. Commodity Futures Trading Commission

Office of the Inspector General

Three Lafayette Centre

1155 21st Street, NW, Washington, DC 20581

39

Surveill.mce Sy.-:tem (ISS) from the Division of Market Oversight, the Division of Enforcement, 

the Division of Clearing and Risk. the Division of Swaps and lntenn ediary Oversight, the omce 

of the Chief Economist, and the Market Data Operations section of ODT. ODT will ensure 

changes will align with mission operations and federal infonnation security standards. 

3. lv/odem ite the JSS to e11/11111ce the rraceabilily , effu:i.en<-_y, and error lwndling of ETL 

processes, wl,id, will require " determi11atio11 w/,et/,er to upd(l(e the JSS platform to 

ad 1ie1•e these goals or, bflsed 011 a co11sideratio11 of costs mid benefits, to m igrate to an 

11pd(l(ed platform; 

ODT concurs with the finding that it is appropriate to modernize the ETL processes that support 

ISS data loading. 

ODT has developed and is promulgating an upgraded standard for data transmission of ISS data. 

Along with the updated data standard, ODT will be upgrading the ETL process for ISS data. 1l1e 

new ETL process will meet all of the ETL best practices as recommended in the report. A main 

principle of the improved ETL process would be to automate the data validation and verification 

process such that data reporters will be notified of issues with the data without the intervention of 

a CFTC staff member. 

4. Given c11rre111 f ederal sec11rily standards, re-e11al11are I eq11ireme111sfor JSS; 

ODT concurs with the Office of the Inspector General's assessment and their recommendation. 

As part of the requirements update and validation of ISS, ODT will ensure compliance with the 

current federal security standards. 

5. Review sec11rily risks of other legflcy applications mu{ assure compliance wi1l1 f ederal 

information securily 5·wndards. 

ODT concurs with the Omcc of the Inspector General's assessment and their recommendation. 

ODT will continue to enhance their compliance with the FISMA based on the !ST Risk 

Management Framework (RMF) process and Cybersecurity Framework a.~ directed by 0MB and 

Congress. Continuous monitoring efforts are underway and subject to resource constraints. 

ODT will continue to work to ensure full compliance with Federal infonnation security 

standards. 

If you require further assistance, plea~e contact Naeem Musa, Deputy Director of Policy and

Planning, at (202) 4 18-5485. 

2 
1155 21st Street N.W. 

Washington, DC 20581 

202 418-5100