Financial Market Preparedness: Improvements Made, but More Action Needed to Prepare for Wide-Scale Disasters
Released: 2004-10-27T00:00:00

Letter

Background

Customer orders for stocks and options, including those from individual investors and from institutions such as mutual funds, are generally routed through a broker-dealer and executed at one of the many exchanges located in the United States. After a securities trade is executed, the ownership of the security must be transferred and payment must be exchanged between the buyer and the seller. This process is known as clearance and settlement and is performed by separate clearing organizations for stocks and for options. A depository maintains records of institutional ownership for the bulk of the securities traded in the United States. Banks also participate in the U.S. securities markets by acting as clearing banks that maintain accounts for broker-dealers to accept and make payments for these firms’ securities activities. Payments for corporate and government securities transactions, as well as for business and consumer transactions, are transferred by payment system processors, including those operated by the Board of Governors of the Federal Reserve (Federal Reserve) and private organizations. Virtually all of the information processed is transferred between parties via telecommunications systems; and as a result, the securities markets depend heavily on its supporting telecommunications infrastructure.

Although thousands of entities are active in the U.S. securities markets, certain key participants are critical to the ability of the markets to function. Some are more important than others because they offer unique products or perform vital services. For example, markets cannot function without the activities performed by clearing organizations; and in some cases, only one clearing organization exists for particular products. In addition, other market participants are critical to the overall market functioning because they consolidate and distribute price quotations or information on executed trades. Other participants may be critical to the overall functioning of the markets only in the aggregate. For example, if one of the thousands of broker-dealers in the United States is unable to operate, its customers may be inconvenienced or unable to trade, but the impact on the markets as a whole may just be a lower level of liquidity or reduced price competitiveness. However, a small number of large broker-dealers account for sizeable portions of the daily trading volume on many exchanges. If several of these large firms were unable or unwilling to operate, the markets might not have sufficient trading volume to function in an orderly or fair way.

Several federal organizations oversee the various securities market participants. SEC regulates the stock and options exchanges and the clearing organizations for those products. In addition, SEC regulates the broker-dealers that trade on those markets and other participants, such as mutual funds, which are active investors. The exchanges also have responsibilities as self-regulatory organizations for ensuring that their participants comply with the securities laws and the exchanges’ own rules. SEC or one of the depository institution regulators oversees participants in the government securities market, but the Department of the Treasury (Treasury) also plays a role. Treasury issues rules pertaining to securities market, but SEC or the bank regulators are responsible for conducting examinations to ensure that these rules are followed. Additionally, several federal organizations have regulatory responsibilities over banks and other depository institutions, including those active in the securities markets. The Federal Reserve oversees bank holding companies and state-chartered banks that are members of the Federal Reserve System. The Office of the Comptroller of the Currency (OCC) examines nationally chartered banks.

Critical Organizations Reduced Risks from Physical or Electronic Attacks, but Some Organizations Still Had Limitations That Increased Potential for Disruptions

Critical organizations and other trading and clearing firms improved their readiness for future terrorist attacks or other disasters in several ways, but some still remained at greater risk of disruption than others. For example, since our 2003 report, all of the seven critical organizations we reviewed reduced risks by adding physical barriers around their facilities, enhancing protection from hackers, or establishing geographically diverse backup facilities. However, several organizations still faced an increased risk of disruption from potential future attacks, either because of the location of their backup facilities or because they have not taken steps to better ensure the availability of critical staff. The key broker-dealers and banks that conduct significant trading and clearing activities that we reviewed had also improved their business continuity capabilities, but some were still at greater risk of disruption than others due to the concentration of key trading staff in single locations. Working together through industry associations, market participants also improved their ability to withstand future disasters by, for example, establishing crisis command centers.

Critical Organizations Further Improved Physical and Electronic Security

Since our previous report, almost all of the critical organizations took steps to improve their physical and electronic security. Physical security encompasses measures such as installing physical barriers around buildings, screening people and objects, and using employee and visitor identification systems. We assessed the organizations’ physical security using standards and best practices developed by the Department of Justice. For example, as a deterrent to potential attacks, one organization increased the number of armed security officers that protect the perimeter of its facility. These security personnel are also now clad in military-style uniforms and possess greater firepower than they did previously. In addition, this organization installed additional video cameras to allow it to monitor more locations around its facility. Another organization we reviewed had installed new perimeter barriers and X-ray equipment outside of its facility to better protect its lobby and other interior spaces. Four of the critical organizations we reviewed still faced increased risks in their physical security, such as an inability to control vehicular traffic around their primary facility, which put them at greater risk of disruption from potential physical attacks than other organizations. However, each of these four organizations also had geographically diverse backup facilities capable of conducting some or all of the organization’s critical operations, mitigating the effect of a disruption at the primary facility.

All seven organizations had also implemented countermeasures to mitigate chemical, biological, and radiological (CBR) threats. For example, each organization had identified its facilities’ outdoor air intakes, which can be highly vulnerable to CBR attacks, and took steps to prevent access to them. Such steps included installing locks, video cameras, security lighting, and intrusion detection sensors in order to establish a security zone around the air intakes. The organizations also took actions to prevent public or unauthorized access to areas that provide access to centralized mechanical systems, including heating, ventilation, and air conditioning equipment. Finally, some organizations also isolated their lobbies, mail processing areas, and loading docks.

An effective physical security program includes periodic testing of controls such as reviews of security guard performance outside of normal business hours, attempts to bring in prohibited items (such as weapons), and review of employees’ use of access to restricted and sensitive areas. Periodic monitoring of such controls not only provides a valuable means of identifying areas of noncompliance or previously undetected vulnerabilities, but can also serve to remind employees of their security responsibilities and demonstrate management’s commitment to security. Each of the organizations we visited performed these types of tests on a periodic basis.

The critical organizations also continued to invest in information security measures to reduce the risk that their operations would be disrupted by electronic attacks. Electronic attacks can come in different forms and include attacks in which persons (such as hackers) attempt to gain unauthorized access to a specific organization or system or attacks by computer programs or codes, such as viruses or worms. We applied criteria from the Federal Information System Controls Audit Manual, as well as other federal guidelines and industry best practices, to assess the organizations’ information security. For more information on the scope of our assessment, please see appendix I. All of the organizations we reviewed enhanced protections against unauthorized outside access to their computer systems. For example, one organization increased the coverage of its intrusion detection and prevention systems to better monitor and address attacks by outsiders. Some of the organizations we reviewed also had invested in more secure technologies. For example, one organization put in place a new multitiered external network, which provides multiple layers of security. During our reviews, we also identified and discussed with these organizations additional actions they could take to further improve their information security.

Critical Organizations Improved Their Ability to Recover from Disruptions, but Some Faced Limitations That Increased Risks

All the critical organizations had also further increased their ability to recover from attacks or other disasters since our 2003 report, but some still had limitations in their business continuity capabilities that increased their risk of disruption. Since our report, these organizations also have more specific standards against which to measure their capabilities because federal financial regulators have issued business continuity guidelines and principles that set expectations for these organizations. These regulatory guidelines direct the organizations to establish geographically diverse backup capabilities and state that the operation of a backup site should not be impaired by a wide-scale evacuation at the primary site or the inaccessibility of the staff. Although the guidance does not specify a minimum distance between primary and backup facilities, regulators state that such facilities should not rely on the same infrastructure components, such as transportation, telecommunications, water supply, and power supply.

As of May 2004, four of the seven critical organizations had geographically dispersed backup sites that their officials indicated were capable of conducting the organizations’ critical operations. Each backup site was located at a considerable distance from the organizations’ primary sites—ranging from almost 300 miles to over 1,100 miles. However, as of June 2004, the remaining three critical organizations that we noted in our previous report as lacking geographic separation between their primary and backup facilities did not have geographically diverse backup facilities capable of assuming all critical operations. Instead, these three organizations’ current backup facilities were located within the same geographic area as their primary sites (although, as discussed below, one organization had a geographically diverse facility that it could use to run some of its critical applications). Officials at one organization said that these facilities do not depend on the same infrastructure components as their primary facilities; although, in some cases, they would depend on the same transportation system. Although having backup sites does reduce the risk that these organizations’ operations would be disrupted in future attacks, both primary and backup facilities could be affected by wide-scale events, and thus, these organizations faced an increased level of risk of operational disruptions.

However, officials at the three critical organizations that lacked geographically dispersed backup sites were reducing the risks resulting from the proximity of their primary and backup facilities. One organization established a geographically diverse backup site, and as of June 2004, had the ability to run some of its critical operations from that site. Officials at this organization anticipated being able to conduct all of its critical operations from the new site by the end of 2005. To reduce the risk arising from certain types of events, the other two organizations had begun work to establish management systems that would allow them to operate the hardware and systems at their primary sites from geographically remote locations. Federal financial regulators have stated that having a backup site that is fully capable of operating all critical functions is necessary for organizations to ensure that they can meet regulators’ recovery objectives. (We discuss recovery objectives more fully later in this report.) However, these organizations’ remote management capabilities, which both intended to have in place by the end of 2004, would allow them to continue operating under disaster scenarios in which their facilities were not damaged but were rendered physically inaccessible for public safety or other reasons. As of August 2004, one of these two organizations had a plan to implement a geographically diverse backup site by April 2005. The other organization was considering alternatives for being able to recover its operations in geographically dispersed locations but had not developed any definite plans.

Additionally, at the time we conducted this review, six of the seven organizations had arrangements in place that appear to ensure the availability of critical staff. Organizations also can enhance business continuity capabilities following a disaster by implementing plans to ensure the availability of key staff, if staff who perform critical activities at a primary facility become incapacitated. For example, one organization rotated its critical staff among multiple locations, ensuring that all such staff were never in the same location at the same time. However, one of the seven organizations had not developed a formal plan for ensuring the availability of key staff. Officials at this organization said they believed that a sufficient number staff necessary to conduct critical operations were not at the primary facility at any one time for a variety of reasons, including vacations and business travel. However, they had no formal plan to ensure that sufficient numbers of trained staff would be available should staff at the primary facility be lost. In July 2004, officials from this organization said they were seeking to have such a plan in place in the near future. This particular organization already has faced an increased risk of disruption because it was also one of the three organizations that did not yet have a geographically diverse backup facility. While this organization had improved its physical security, which can help protect an organization’s primary facility as well as its critical staff, it was still at greater risk of disruption than other critical organizations.

Further, all seven organizations that we reviewed appeared to be following sound practices for ensuring the continuity and recoverability of their critical telecommunications services. Business continuity guidelines identify five telecommunications-related practices that organizations can follow to improve the continuity of their critical telecommunications services: developing and maintaining an inventory of existing telecommunications services, identifying those services critical to continued operations, identifying the risks to those services, developing strategies and solutions to mitigate those risks, and testing those risk mitigation and continuity strategies. Specifically, the critical organizations we reviewed inventoried their voice and data telecommunications services and identified those services critical to their operations. The organizations also took actions to identify and mitigate their respective risks. For example, to mitigate the risk that a single failure point in their internal networks might disrupt their operations, all organizations linked their facilities to public networks at two diverse points on their premises and distributed those connections throughout their facilities through redundant cabling. To limit their exposure to disruptions in public network facilities, some organizations also subscribed to services that linked their facilities to the public network at multiple points and also linked them to services that would reroute their connections around failure points that might occur in the public networks. To improve service recoverability, six of the seven organizations were also taking advantage of a federal telecommunications priority program that would provide increased priority for restoration of the key telecommunications circuits in their inventories in the event of a disruption. These critical organizations were also testing their own abilities to recover their communications operations during a disaster and to communicate with key customers and organizations. Further, within their overall continuity strategies, most critical organizations were either establishing or continuing to operate out-of-region telecommunications facilities that would, among other things, reduce the risk that a failure in local telecommunications services at any one location would pose a risk to their continuing operations.

Finally, given that most organizations had limited resources, effectively managing operations risks involved balancing additional protections for facilities, personnel, and systems with enhancing business continuity capabilities. As part of this process, organizations take into consideration that enhancing capabilities in one area can help mitigate vulnerabilities in another area. For example, as noted previously, four of the critical organizations we reviewed had weaknesses in their physical security but also had geographically diverse backup facilities capable of conducting some or all of the organization’s critical operations, mitigating the effect of a disruption at the primary facility. That is, if a physical security weakness allowed a disruption to occur at the organization’s primary facility, operations could be transferred to a backup facility. Similarly, one organization that had not yet implemented a geographically diverse backup facility had made significant improvements to the physical security protections in place at its primary facility, which can help reduce the likelihood of that facility becoming incapacitated by potential physical attacks.

Broker-Dealers and Banks Also Reduced Their Risk of Disruption, but Some Faced Increased Risk Because of Concentration of Key Staff

The trading firms with whom we spoke—eight trading firms, including five large broker-dealers and three banks whose activities represent a significant portion of the total trading and clearing volume on U.S. markets—also took steps to improve their recovery capabilities, but some still faced increased risk of disruption. The smooth functioning of U.S. securities markets also depends on the ability of trading firms to conduct trading and clear and settle their transactions. In our 2003 report, we noted that because of the considerable efforts required for broker-dealers to restore operations, insufficient liquidity existed to open the markets during the week of the September 2001 attacks. For example, several large broker-dealers had not invested in backup facilities and had to recreate their trading operations at new locations; others needed to improve their business continuity capabilities for telecommunications. All of the firms we spoke with during this review said they had backup data centers capable of running critical applications and also had alternate locations out of which key staff could operate if the primary facilities should become unusable. For example, to address the potential for a region-wide disruption in New York City, one firm was developing a geographically diverse backup center. Another firm improved its ability to ensure the availability of critical staff by dividing key technical and business staff between two separate locations. All of the firms also took steps to improve their ability to retain telecommunications capabilities in the event of a disruption. For example, all five of the broker-dealers with whom we spoke had begun using the Secure Financial Transaction Infrastructure, a private telecommunications network linking financial market participants. Four of the broker-dealers and all three of the banks also said they were required to meet federal regulatory goals for the recovery of their clearing and settlement operations and that they were taking steps that would allow them to meet those goals within the recommended time frames.

However, four of these firms were at greater risk of a disruption to their trading operations than other firms because of the concentration of key trading staff in a single location at the same time. Each of these firms did have alternate locations out of which key trading staff could work, which would allow them to recover their trading activities if their primary site were damaged or inaccessible. However, officials at these firms said that if the trading staff at the primary site were incapacitated, they would either not be able to resume trading quickly enough to meet regulators’ goal of recovering trading activity on a next-day basis, or if able to resume trading, they would not be able to trade at normal capacity. For example, officials at two firms said that if they were to lose their trading operations staff, it would likely take several weeks to reconstitute their trading operations, even using staff from other locations. Officials at one of these firms said that replacing highly skilled trading staff with inexperienced staff could put the firm’s capital at risk and that while they might eventually reconstitute their trading operations, they would likely exit the market for an indefinite period of time. Although officials at both of these firms said they recognized that they faced increased risk, they said at this point, the decreased efficiency and increased costs that would be associated with splitting or rotating these staff were viewed as too great, compared with the potential risk of disruption.

Securities Industry Organizations Undertook Testing and Crisis Coordination Efforts

In addition to taking actions individually, securities market participants also have worked jointly to improve the readiness of the financial sector for potential future attacks. One of the weaknesses we noted in our 2003 report was that some organizations had not completely tested their business continuity capabilities, and some also lacked sufficient connectivity to the backup sites of other organizations. To increase the industry’s overall readiness, the Securities Industry Association (SIA), which represents over 600 of the broker-dealers active in U.S. markets, has been coordinating an industry-wide testing project since September 2002. The first phase of the project had broker-dealers testing connections from their backup facilities to the core clearing and settlement organizations and correctly sending and receiving information. The second phase of the project will involve broker-dealers, exchanges, and other securities market participants in exercises that will simulate regional power and telecommunications outages. During the exercises, participants will be expected to conduct critical operations from an alternative location as well as test connectivity and communications capabilities.

Although testing took longer than originally envisioned, SIA substantially completed the first phase by June 2004. According to SIA officials, smaller firms that are not testing as quickly as others contributed to the delay. Also according to SIA staff, the more than 110 firms that completed at least part of the first phase of testing represented over 80 percent of broker-dealer trading activity, and nearly all of the 25 largest firms have completed most or all parts of this testing. Further, SIA conducted a disaster simulation exercise—involving key industry participants as well as SEC—in May 2004 to help better prepare for the second phase of testing, which was scheduled to begin in the third quarter of 2004.

To address another concern revealed by the 2001 attacks, securities market associations established crisis command centers or other coordination procedures. Just after the September 2001 attacks, some market participants encountered difficulties in communicating and coordinating with other market participants, regulators, and governmental bodies that responded to the disaster. More specifically, to coordinate the industry’s response and the dissemination of information during a crisis, in June 2002 SIA created a crisis command center. SIA also placed a representative at the New York City Office of Emergency Management, an office that acts as an interagency coordinator in partnership with local, state, federal, and private entities to provide comprehensive emergency response, hazard planning and disaster mitigation to New York City. According to SIA officials, they activated the SIA command center during the August 2003 blackout and during Hurricane Isabel in September 2003, allowing them to test and validate the functioning of the command center.

In addition, the trade association that represents firms active in bond trading, the Bond Market Association, also took action to improve its members’ response to future crises. According to organization officials, this association created a structure for coordinating the response of participants in the fixed-income securities markets. The association would communicate with its members through one of its standing committees regarding the condition of the fixed-income securities markets and the potential opening and closing of those markets. In addition, the association’s committee would share information and coordinate its actions with the SIA command center.

Finally, information regarding business continuity practices and potential threats to the industry has been shared with market participants. For example, SIA collected and distributed business continuity best practices to its members, established subcommittees to study business continuity-related issues, and conducted conferences to share and foster discussion of these issues in the securities industry. Also, Treasury designated another organization, the Financial Services Sector Coordinating Council (which comprises representatives from private firms in the financial industry) as the private-sector coordinator for critical infrastructure protection for the banking and finance sector. In particular this council, along with SIA and the American Bankers Association, has supported and promoted use by the financial sector of the Financial Services Information Sharing and Analysis Center (FS/ISAC), a mechanism to gather, analyze, and share information on threats, incidents, and vulnerabilities faced by the financial sector. The council also has been participating in educational and outreach efforts in conjunction with the Financial and Banking Information Infrastructure Committee, which coordinates critical infrastructure protection among federal financial regulators.

Steps Are Under Way to Meet Challenge of Improving the Resiliency of Telecommunications

The September 2001 terrorist attacks highlighted the critical importance of resilient telecommunications services for the continued operation of U.S. financial markets. The resulting damage disrupted telecommunications service to thousands of businesses and residences, and some firms learned that their services were not as robust as they believed prior to that event. Since 2001 terrorist attacks, telecommunications groups and carriers and financial market participants have worked to improve the resiliency and the recoverability of telecommunications services in the event of future disruptions.

September 2001 Attacks Highlighted Financial Sector Dependence on Telecommunications Services and Challenges of Maintaining Diverse Systems

As we described in our 2003 report, the 2001 terrorist attacks resulted in significant damage to telecommunications facilities, lines, and equipment. The loss of telecommunications service as well as damage to power and transportation infrastructure delayed the reopening of the markets. Much of the disruption to voice and data communications services throughout lower Manhattan—including the financial district—occurred when one of the buildings in the World Trade Center complex collapsed into an adjacent Verizon communications center at 140 West Street, which served as a major local communications hub within the public network. Approximately 34,000 businesses and residences in the surrounding area lost services. The loss of this facility also resulted in disruptions to customers in other service areas because other telecommunications carriers had equipment colocated in 140 West Street that linked their networks to Verizon and considerable amounts of telecommunications traffic that originated and terminated in other areas also passed through this location. AT&T’s local network service in lower Manhattan was also significantly disrupted following the attacks.

The attacks also highlighted the difficulties of ensuring that the telecommunications services required to support critical financial market operations could withstand the effects of network disruptions. One of the primary ways that users of telecommunications services try to ensure that their services will not be disrupted is to use diverse telecommunications facilities to support their needs, including diversely routed lines and circuits. These steps are necessary to ensure that damage to any single point in one communications path does not cause all services to fail. However, ensuring that telecommunication service carriers actually maintain diverse telecommunications services is a long-standing financial industry concern. For example, a December 1997 report prepared by the President’s National Security Telecommunications Advisory Committee (NSTAC) noted, “despite assurances about diverse networks from the carriers, a consistent concern among the financial services industry was the trustworthiness of their telecommunications diversity arrangements.”

The ongoing operation and maintenance of network facilities can itself pose a challenge to ensuring diversity of services. To improve the reliability and efficiency of their networks, telecommunications carriers can change the physical network facilities they use to route circuits in a process they call “grooming.” This process can result in a loss of diversity over time, however, if diverse services are rerouted onto or through the same facilities. For example, as our 2003 report noted, many financial firms that thought they had achieved telecommunications service diversity still experienced service disruptions as a result of the September 2001 attacks. Some of these firms indicated that although they were assured that their communications circuits flowed through physically diverse paths, at the time they first acquired those services, their service providers rerouted some circuits over time without their knowledge, eliminating the assurance of diversity and leaving the firms more vulnerable to disruption.

However, an NSTAC 2004 report noted that carriers would have to follow labor-intensive, manual processes to ensure route diversity and monitor that condition on an ongoing basis. NSTAC also reported that guaranteeing that circuit routes would not be changed could actually make an organization’s service less reliable because their circuits could lose the benefit of networking technologies that automatically reroute circuits in the event of facility failures.

New Private Telecommunications Network Created for Financial Market Participants

Responding to the challenges of maintaining diversity, one financial market participant has acted to improve the resiliency of the telecommunications services supporting the financial industry. In January 2003, the Securities Industry Automation Corporation (SIAC) began operating its own private network, known as the Secure Financial Transaction Infrastructure (SFTI), to provide more reliable and “survivable” private communications services linking exchanges, clearing organizations, and other financial market participants. The information that travels on this network includes orders to buy and sell stocks on the New York and American stock exchanges as well as information needed to clear and settle these transactions.

SFTI was designed to overcome several of the challenges in attaining continual resiliency in telecommunications services. For example, to ensure redundancy and eliminate single points of failure, SFTI employs redundant equipment throughout, and carries data traffic over redundant fiber-optic rings whose routes are geographically and physically diverse. To access the network, users are required to connect to two or more of the eight SFTI access nodes located in Boston, Chicago, and the New York City metropolitan area. Therefore, if service is disrupted at one access node, service can still be obtained through an alternate node. Further, users can access SFTI in various ways, including obtaining a direct connection to the SFTI access nodes or connecting to one of four financial “extranet” service providers that operate their own telecommunications networks and also link to the SFTI access nodes. Some customers may choose to use a combination of both approaches.

To further enhance diversity throughout this private network, SIAC has contracted for auditable route diversity for the SFTI network. Because SIAC manages all SFTI facilities, it can also control all the grooming that takes place among the lines within the New York regional segment of this network. In addition, SIAC established a remote out-of-region network operations center that can manage network operations in the event of any disruption to its own New York area-based operations.

The financial industry has responded positively to SFTI since its implementation. For example, according to SIAC, financial industry associations, including SIA, the Bond Market Association, and the Investment Company Institute, which represents mutual funds, have all supported use of SFTI for their respective members. Moreover, NYSE, the American Stock Exchange, and the Consolidated Tape Authority, which oversees the systems that distribute stock quotes and completed trade information for the stock exchanges, expect that all of their participating member firms will be using SFTI to connect to its trading services, as of December 2004. As of June 2004, SIAC has signed up more than 600 customers for this network.

Federal and Local Actions Are Under Way to Improve Telecommunications Resiliency

Federal and local government entities have also taken steps to help the financial industry in preparing for and recovering from possible future disruptions to the telecommunications infrastructure. First, two presidential advisory committees have taken steps that may enhance the security and continuity of telecommunications services supporting the financial industry. The National Reliability and Interoperability Council (NRIC), which is a group of telecommunications carrier executives that advises the Federal Communications Commission, has identified existing and new best practices that, if implemented, could help carriers improve the security of their facilities, and improve recovery of services after attack or disruptions. NRIC addressed such matters as business continuity planning, physical security, emergency operations and response, and other operational procedures. Further, NSTAC, which had also studied diversity issues, recommended that the federal government support research and development activities on resiliency, diversity, and alternative technologies.

Additionally, the federal government sought to increase financial industry participation in federal programs that could enhance the recoverability of disrupted services. Specifically, the Department of Homeland Security’s (DHS) National Communications System (NCS) promoted participation in its Telecommunications Service Priority (TSP) program. TSP allows financial market participants to register their key telecommunications circuits for priority restoration in the event of a crisis. Financial market participants are sponsored for registration in this program by their regulatory agency. According to NCS officials, the financial industry has made greater use of the TSP program, as there are now about 4,100 financial organization circuits registered in TSP for priority restoration; more than 3,500 of those were registered since June 2002. Further, to improve the recoverability of SFTI, the Federal Reserve worked with SIAC to ensure that all SFTI access lines were registered for TSP priority restoration as those circuits were installed.

Federal financial regulators also have been working with carriers to more closely examine the diversity challenge and identify potential management solutions. In a recently initiated pilot project, the Federal Reserve has been working with the Alliance for Telecommunications Industry Solutions to examine the diversity of circuits supporting Federal Reserve networks. The project’s goal is to develop an efficient, affordable way to document and maintain routing diversity using those circuits as a baseline. According to Federal Reserve and Treasury officials, this exercise could yield a model approach for achieving assured diversity, improve the processes required to do so, and provide a better understanding of the associated costs.

Finally, New York City officials have enhanced their ability to monitor and coordinate infrastructure recovery efforts with local carriers. City officials recently revised their Mutual Aid Restoration Consortium (MARC) agreement, which governs monitoring and coordination of restoration actions between telecommunications carriers and city officials in the event of service outages. City officials invoked this agreement in the aftermath of the September 2001 attacks to ensure that essential city government offices and operations would have adequate telecommunications service and to aid coordination of infrastructure recovery efforts by carriers operating in the city. More recently, the MARC agreement proved effective during the August 2003 blackout, in which teleconferences were used to identify and communicate urgent diesel fuel needs of carriers and to coordinate other critical assistance to share power generators and network facilities. Lessons learned from such incidents have been addressed in the revised MARC agreement.

Telecommunications Carriers Are Also Taking Action to Improve Infrastructure Resiliency

Telecommunications carriers are also acting to improve the resiliency of their networks. First, those carriers rebuilding facilities that were damaged or lost in the attacks have been replacing these facilities with designs that provide greater diversity to their infrastructure in lower Manhattan. For example, to avoid single points of failure in its network, Verizon redesigned its network to minimize circuits that only pass through a switching facility on their way to other termination points. This should reduce the potential for service in one area to be lost when damage occurs to facilities in other areas. In addition, Verizon has also used more resilient and physically diverse fiber optic systems within lower Manhattan, which also may provide alternate network access capabilities at strategic locations. Similarly, as part of its own restoration effort, AT&T officials said they rebuilt two central office facilities at more geographically diverse locations and upgraded their fiber-optic networks.

Telecommunication carriers also reported that they were improving their own business continuity plans to better ensure their ability to recover after a disaster. For example, officials at both Verizon and MCI said they had reexamined their continuity plans and developed new recovery strategies to improve their continuity capabilities. In addition, officials at AT&T informed us that they were continuing to conduct quarterly network disaster recovery tests at different locations throughout the United States that simulate the recovery of damaged switching facilities.

Finally, telecommunications carriers have tried to increase telecommunications resiliency by offering additional services to their customers, including financial market participants. As we described in our 2003 report, carriers offer various services that can improve the reliability and recoverability of existing telecommunications. For example, carriers offer fiber-optic networks to provide more reliable access to public networks; services to redirect their switched telecommunications services, such as voice calls, to another business location; and alterative network connectivity solutions such as high bandwidth, point-to-point radio connectivity to another location or network node.

Federal Financial Regulators Took Actions to Improve the Readiness of Securities Markets, but Further Actions Needed

Since our 2003 report, federal financial regulators, including SEC, have identified vulnerabilities, participated in tests and exercises, and developed recovery goals and business continuity guidelines to improve the preparedness of securities markets for terrorist attacks and other disasters. For example, banking and securities regulators have issued joint guidance providing recovery goals for market participants that perform critical clearance and settlement activities. Partly in response to a recommendation in our 2003 report, SEC also has issued guidance providing goals for trading activities to resume on securities exchanges. However, SEC has not developed a complete assessment of securities markets readiness to resume trading after major disruptions, which increases the risk that the reopening of the markets could be delayed.

Financial Regulators Participated in Exercises, Information Sharing, and Conducting Examinations of Financial Sector Readiness

Since our 2003 report, federal financial regulators have participated in exercises that assess readiness for potential disasters. For example, Treasury, the Federal Reserve, SEC, and the Commodity Futures Trading Commission have taken part in several disaster recovery exercises sponsored by DHS, including the TOPOFF exercises, which simulated physical attacks, and the Livewire exercise, which simulated a cyber attack. In addition, as part of the Financial and Banking Information Infrastructure Committee, the federal financial regulators have conducted an analysis of financial sector vulnerabilities, including those involving dependencies on other critical infrastructures, such as telecommunications and power.

Financial regulators have also been involved in various information sharing efforts. For example, Treasury has also supported and promoted the FS/ISAC, which as described earlier gathers, analyzes, and shares information on threats, incidents, and vulnerabilities faced by the financial sector. In 2004, Treasury provided additional funding to FS/ISAC to allow it, among other things, to expand its membership and services to even the smallest financial institutions, such as community banks. Treasury has also been involved, along with the Federal Deposit Insurance Corporation, in conducting educational outreach events in various cities on sound business continuity practices. Treasury is also working with DHS to continue developing “Chicago First,” an emergency preparedness program designed to coordinate activities among financial sector participants and federal, state, and local government officials. Treasury is promoting this program as a model for other cities to implement.

Banking and securities regulators have also taken steps since our 2003 report to assess the efforts of banks and securities firms to withstand and recover from disasters. For instance, in March 2003 the Federal Financial Institutions Examination Council (FFIEC), which issues joint regulatory and examination guidance used by financial regulators in overseeing financial institution such as banks and credit unions, issued a Business Continuity Planning Booklet that provided updated guidance and examination procedures on this topic. In the booklet, FFIEC requires depository institutions to develop business continuity plans that will effectively minimize service disruptions and financial loss, test the plans at least annually, and subject the plans to independent audit and review. In addition, it asks institutions to consider in their planning the potential for wide-area disasters and the resulting loss or inaccessibility of staff, as well as the extent to which their institution is dependent upon other financial system participants and service providers. According to one financial regulator responsible for conducting examinations based on these guidelines, an informal analysis showed that larger financial institutions were doing better than smaller ones in meeting the guidelines. As a result, officials at that regulator said they had begun developing guidance to help smaller institutions better meet the business continuity guidelines.

SEC has also conducted examinations of broker-dealers that included reviews of information security and business continuity efforts. For example, SEC’s Office of Compliance Inspections and Examinations (OCIE) administers SEC’s inspection program for broker-dealers, including monitoring broker-dealers’ compliance with Regulation SP, which deals with the privacy of consumer financial information. As part of their review of broker-dealers’ ability to protect consumer information, OCIE staff review those organizations’ information security capabilities. In addition, since our 2003 report, OCIE has begun incorporating into its broker-dealer examinations the business continuity practices presented by federal financial regulators in an interagency paper (described in the following paragraph).

Financial Regulators Developed Business Continuity Guidelines for Clearing and Settlement

Federal financial regulators also have jointly focused on continuity issues to reduce the risk of disruption for the financial markets from terrorist attacks or other disasters. In April of 2003, securities and banking regulators issued the Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System. Issued by SEC, the Federal Reserve, and the OCC, this interagency paper identifies business continuity practices that core clearing and settlement organizations and firms that play a significant clearing or settlement role in critical financial markets are expected to follow. Core organizations include clearing organizations responsible for securities and other financial products and payment system processors. In addition to these organizations, the interagency paper also applies to financial institutions, including banks and broker-dealers, which conduct significant amounts of trading and clearing activities. If these firms were unable clear and settle the outstanding trades that they or their customers conducted, they could create payment problems for other participants in the markets. By proposing that these organizations and firms follow the practices identified in the interagency paper, regulators expect to minimize the immediate systemic effects of a wide-scale disruption—by setting goals for key payment and settlement systems to resume operation promptly following a wide-scale disaster, and for major participants in those systems to recover sufficiently to complete pending transactions.

In the interagency paper, the regulators outline various practices for organizations and firms to follow and set goals related to resumption of their clearing and settlement activities. First, these organizations and firms are expected to identify the clearing and settlement activities that they perform in support of critical financial markets. They are also expected to determine appropriate recovery and resumption objectives for those activities. The regulators state that, at minimum, the organizations and firms are expected to be able to recover within the same business day. To realistically achieve this, the regulators expect that these organizations and firms would maintain geographically dispersed resources to meet their recovery and resumption objectives. Specifically to be consistent with best practices, backup facilities for clearing functions should be as far away from the primary facility as necessary to avoid being subject to the same set of risks as the primary facility. The backup facilities also should not rely on the same infrastructure—such as power and telecommunications—as the primary facility, and the operation of the backup facility should not be impaired by a wide-scale evacuation at, or the inaccessibility of staff that service, the primary site. In addition, the regulators expect that the organizations and firms would engage in routine use or testing of their recovery and resumption arrangements.

The regulators also included deadlines for achieving continuity goals in the interagency paper. For example, core clearing and settlement organizations are expected to implement the practices the paper advocates, by the end of 2004. Significant banks and broker-dealers are expected to have implemented such practices by April 2006. According to banking and securities regulatory officials, they are monitoring the progress that organizations and firms are making in meeting these deadlines.

SEC Set Business Continuity Goals for Securities Trading

SEC also has provided recovery goals and business continuity best practices to exchanges and ECNs that conduct securities trading in the United States. In our 2003 report, we recommended that SEC work with the industry to develop such goals and sound business continuity practices and identify organizations that should follow them. In September 2003, SEC issued a policy statement that establishes business continuity principles to be followed by the organizations that execute trades in securities, including the NYSE, the Nasdaq Stock Market, Inc. (NASDAQ), the regional stock exchanges, the options exchanges, and ECNs, which match buy and sell orders for securities. The business continuity principles SEC published include establishing a business continuity plan that anticipates the resumption of trading no later than the next business day following a wide-scale disruption; maintaining geographic diversity between primary and backup sites; ensuring the full resiliency of important shared information systems, such as market data collection and dissemination systems; and testing the effectiveness of backup arrangements in recovering from wide-scale disruptions.

SEC expects the securities markets and ECNs to implement business continuity plans reflecting these principles, no later than the end of 2004. According to SEC staff, they are monitoring the progress of the exchanges and ECNs in implementing the policy statement through their examinations of these organizations.

In addition to establishing recovery goals, SEC has taken additional actions to ensure that sufficient venues for trading would likely be available after a major disaster. As we noted in our 2003 report, SEC staff have asked NYSE and NASDAQ to be prepared to trade the other’s securities should one trading floor go down. Officials at both of these markets said they have made the necessary system changes and have tested their members’ ability to trade the other markets’ securities. SEC officials said that they assessed had the ability of these two organizations to provide such backup and were confident that these markets had the necessary capacity and systems to do so. If neither NYSE nor NASDAQ is able to resume trading, ECNs and regional exchanges would have to assume the trading of the stocks that are normally traded on those markets. SEC staff said that, based on discussions with ECN officials and information obtained from inspections of these entities, collectively, the ECNs and regional exchanges have sufficient capacity to take on significant additional amounts of trading volume that would result from such an event. Although none of the organizations involved—NYSE, NASDAQ, ECNs, and regional exchanges—are required to assume such additional trading activity, according to SEC staff these organizations all have a strong business incentive and competitive motivation to do so.

Finally, SEC approved business continuity goals for the broker-dealers that conduct trading in U.S. securities markets. In April 2004, SEC approved essentially identical rules from NASD and NYSE that require their members to develop business continuity plans. According to these rules, the broker-dealer members of these organizations must develop business continuity plans that address various elements, including data backup and recovery, alternate means of communication with customers, alternate physical locations for employees, and consideration of the impacts to critical customers and counterparties.

These rules do not require trading firms to actually have plans to resume operating or trading activities after a disaster. Instead, if a disaster occured and broker-dealers were unable to continue operating, the rules require broker-dealers to develop procedures to ensure that they promptly could provide customers with access to their funds and securities if the broker-dealers were unable to continue business operations. These rules appear to respond to our 2003 recommendation that SEC work with the securities industry to develop business continuity guidelines that, at a minimum, require broker-dealers to allow customers to readily access their cash and securities. NYSE expected its members to implement its rule by August 5, 2004, and NASD expected implementation by September 10, 2004.

SEC Has Not Fully Analyzed Capabilities of Trading Firms to Resume Operations

Although the actions securities and banking regulators have taken will likely improve the preparedness of the securities markets to withstand future disruptions, SEC has not conducted the comprehensive assessments that would allow it to better ensure that trading in the securities markets could promptly resume following a wide-scale disaster. Preparing for trading activities to resume in a smooth and timely manner would appear to be a regulatory goal for SEC, which is specifically charged with maintaining fair and orderly markets. Furthermore, as previously noted, financial regulators expect markets to resume both clearing and trading activities within 1 business day or less. In addition, according to Treasury staff responsible for its critical infrastructure protection program, ensuring that markets are not closed for lengthy periods is important to maintaining investor confidence during the uncertainty that accompanies major disasters.

SEC officials said that if the organizations and firms expected to adhere to the guidance and best practices in the interagency paper and SEC’s policy statement did so, U.S. securities markets would be able to recover even from an attack or disaster that resulted in wide-scale damage or disruption. However, SEC officials explained that they do not have specific authority to require broker-dealers to participate in the markets to any degree and neither the interagency paper on clearing and settlement, the SEC policy statement, nor the NYSE and NASD business continuity rules currently require individual broker-dealers to be prepared to resume their trading operations following a disaster.

Although the ability to resume trading will also depend on whether sufficient numbers of trading firms are willing and able to resume operations, concerns persist over the potential readiness and the threat of disruption to these firms. As we discussed in our 2003 report, part of the delay in reopening the trading markets after the September 2001 attacks was attributable to the difficulties that some broker-dealers faced in recovering their trading operations. As we noted previously in this report, some of the key trading firms continue to face increase risk that their operations would be disrupted and acknowledged that they may not be able to resume trading in some cases. Furthermore, in August 2004, DHS announced that intelligence had been received that terrorists may have targeted the facilities of individual U.S. banks and broker-dealers as well as other financial related entities for potential attacks.

Although SEC had taken some steps to assess broker-dealer readiness, it had not done a systematic analysis to determine whether sufficient numbers of firms would be capable of resuming trading within regulators’ current expectations. SEC staff said they were aware of this risk and had done some informal assessments of where major broker-dealer facilities are located. The staff also noted that some firms could likely use staff located elsewhere in the country or in foreign locations to trade on U.S. markets. However, officials at some of the key firms we contacted indicated that they did not always have sufficient numbers of trained staff elsewhere who could assume their U.S. trading activities. One of the officials told us in June 2004 that SEC would begin evaluating broker-dealers’ trading staff arrangements and, where appropriate, ask firms to voluntarily address the risk posed by having their trading staff in single locations in the same geographic area as other such organizations. One of the officials said that SEC did not yet have a time frame in which firms would complete such actions and acknowledged that such organizations could have valid business reasons for not taking those actions. For example, relocating trading staff or spreading them across more than one location can be expensive and reduce the efficiency of a firm’s operations.

SEC officials also told us that if a wide-scale disaster disrupted trading at a number of broker-dealers in one geographic area, firms outside that area could step in and conduct trading. Such firms could include the regional broker-dealers located around the country. However, SEC staff had not conducted a full analysis of the number of firms, where they are located, or the amount of trading volume they normally handle. These firms also would need sufficient staffing and financial resources to support increased trading volumes.

SEC Took Some Actions to Enhance Its ARP Program but Has Not Addressed Other Limitation to Its Effectiveness

Since our 2003 report, SEC has acted to improve the ARP program, but has not addressed other long-standing issues that hamper the effectiveness of the program and hinder SEC’s oversight. These issues include insufficient resources with the appropriate expertise to increase the frequency, depth, and comprehensiveness of its examinations and the lack of a rule that mandates compliance with the ARP program’s tenets and examination recommendations. The ARP program also appears to have limitations in its ability to oversee information security issues. Given the limitations that affected the ARP program over time, continued assessment of whether the ARP program’s placement within SEC’s organizational structure might identify options that could better assure that it receives the appropriate resources to perform its important mission.

SEC Created ARP to Oversee How Exchanges, Clearing Organizations, and ECNs Addressed Operations Risks

SEC created the ARP program in 1989 in response to operational problems that markets experienced during the 1980s at exchanges, and clearing organizations, and later, ECNs. The program addresses operations risk issues at these entities, including physical and information security and business continuity. SEC did not create rules for these entities to follow but instead issued two ARP statements that provided best practices in various information technology and operational areas with which the exchanges and clearing organizations would be expected to comply voluntarily. As part of the ARP program, these entities (among them, some of the critical organizations we reviewed for this report) are expected to have the relevant aspects of their operations reviewed periodically by independent reviewers, which can include the entities’ own internal auditors or external organizations, such as accounting firms or information security consultants. In addition, SEC’s ARP staff conduct periodic on-site reviews of these organizations to assess selected information technology or operational issues and make recommendations for improvements when necessary. During any examination, ARP program staff analyze the risks faced by each entity to determine which are the most important to review. As a result, ARP staff are not expected to review every issue specific to an entity during each examination.

SEC Has Taken Steps to Improve ARP Program

SEC staff said they have made improvements to the ARP program. SEC officials said they have placed more emphasis on monitoring the status of the recommendations made as result of ARP reviews, with the result that they can better determine whether entities within the program implement the recommendations. ARP staff meet quarterly with ARP management to review the status of and progress on any outstanding ARP recommendations. As a result, ARP staff have more frequent contact with the entities they examine to obtain information about the status of recommended actions. According to these officials, this more frequent follow-up lets the exchanges, clearing organizations, and ECNs know that they cannot let action on recommendations wait until the next ARP review, which can be several years away. ARP officials said that as a result of these efforts, they have been able to close outstanding recommendations and indicated that the level of cooperation they receive from the entities has improved.

SEC staff also said that a recent reorganization within its Division of Market Regulation also improved program effectiveness. According to SEC staff, in November 2003, SEC merged ARP program staff with other Division of Market Regulation staff that conducted surveillance of trading in the markets using information systems. While remaining within the Division of Market Regulation, this combined group is now called the Office of Market Continuity. Although the merger only marginally increased the number of staff allocated to the ARP program (from 10 to 11 staff and a new Assistant Director), SEC staff said the merger gave them access to some additional staff resources and also increased the visibility of the ARP program within SEC. These additional staff are not examiners but can be used to draft letters and research legal issues.

SEC Has Not Addressed Long-standing ARP Program Limitations

Although it has taken some actions to improve the ARP program, SEC still has not addressed weaknesses that have hampered the effectiveness of the program, such as making ARP a rule-based program and improving ARP’s staffing resources and expertise. As we reported in 2001 and 2003, the entities subject to the ARP program had not always implemented or addressed significant ARP staff recommendations, including some related to inadequate backup facilities, security weaknesses, and inadequate information system processing capacity. Some of these unaddressed weaknesses later led to problems. For example, one organization experienced problems related to ensuring adequate processing capacity that delayed the implementation of decimal pricing by all securities markets for 3 months. In another instance, SEC staff raised concerns about the lack of a backup operating facility at an entity that had its primary facility in the area that would later be affected by the 2001 terrorist attacks. In some cases, organizations subject to ARP were also not providing the reports of system changes and other events that SEC expects to receive under the program. To address this issue, we recommended in our 2003 reports that SEC issue a rule that would make adherence to tenets of the ARP program and the recommendations of its staff mandatory for exchanges and clearing organizations. In contrast, ECNs have had to comply with ARP recommendations since 1998, when SEC adopted a rule increasing regulatory scrutiny of alternative trading systems. SEC’s Inspector General has also expressed similar concerns about compliance with ARP program recommendations. SEC officials said they drafted a rule making exchange and clearing organization compliance with ARP tenets mandatory but had not yet submitted it for review by the SEC Commissioners. SEC staff told us that the level of cooperation with recommendations and other expectations that they have received from the entities subject to the ARP program has improved since the 2001 terrorist attacks. However, they acknowledged that without a rule SEC lacks greater assurance that these organizations will continue to comply with ARP recommendations, particularly key recommendations that could be costly for the entities.

SEC also has not fully addressed the adequacy of resources dedicated to the ARP program, another long-standing issue. Our 2001 and 2003 reports described how a lack of resources hampered the ability of the ARP program to oversee the operations of the entities it reviews. For example we reported that these resource constraints affected the ARP program’s ability to conduct frequent examinations. In our 2003 report, we reported that the intervals between ARP examinations had exceeded 3 years for five of the seven critical financial market organizations that we reviewed, with the other two organizations not being reviewed for 6 years or more. According to SEC staff, they have developed a tiered examination schedule for the organizations subject to ARP. Under this schedule, first-tier organizations, including the clearing organizations and most active markets, are to be reviewed annually. Second-tier organizations are reviewed based on their risk assessment profile under a 3-year inspection cycle, and third-tier firms, such as small ECNs are inspected for cause. The SEC staff said they have met this schedule thus far.

As a result of these concerns, we recommended in 2003 that SEC expand the level of staffing and resources devoted to ARP if sufficient funds were available. Although in recent years, SEC’s overall resources have significantly increased—its funding increased 45 percent in 2003—as of May 2004, no significant additional resources had been allocated to the ARP program. SEC staff said the recent creation of the Office of Market Continuity provided them with access to some additional staff resources, as noted earlier, but demands on ARP staff also have grown. For example, in our 2003 report, we noted that ARP staff workload had expanded to cover entities with more complex technology and communications networks. As entities continue to implement new technologies and networks, ARP staff workload is likely to increase further. In August 2004, staff in SEC’s Market Regulation Division said they will ask for additional staffing for the ARP program.

The ARP program’s ability to obtain and retain staff with sufficient technical skills has also been an issue in the past and may have affected its ability to effectively oversee information security issues at the entities it oversees. In previous reports, we have described difficulties SEC has had in retaining qualified and experienced staff in its ARP program, as well as concerns of industry officials over ARP staff expertise. During this review we identified examples where ARP staff could benefit from additional technical expertise. For example, reviews by internal and external reviewers are a key component of the ARP program and SEC officials said they attempt to track all significant issues and recommendations to ensure they are addressed. However, we found that internal and external reviewers at some of the critical organizations we reviewed had identified important actions to improve the security of their information systems, but that the organizations had not implemented them. In addition, at some of the critical organizations, we identified important additional opportunities for improvements in information security that had not been previously identified by internal or external reviewers or by SEC’s ARP staff.

One way organizations can help ensure that their various functions receive the appropriate level of resources, including staff and expertise, is to ensure that those functions are properly aligned within the organization’s overall structure. Currently, the ARP program is located within the Division of Market Regulation and, as such, is a small part of a larger division whose primary responsibility is to establish and maintain standards for the operation of fair, orderly, and efficient markets. As noted previously, SEC recently relocated the ARP program within the Division of Market Regulation, and SEC officials told us that this move has been beneficial and that they continue to assess the impact of the reorganization on the program’s effectiveness. However this move has not yet resulted in significant additional staffing or additional technical expertise specifically dedicated to the ARP program. Other possible placements that might prove beneficial for the ARP program from a resource and expertise standpoint could include placing the ARP program with the other examination staff within SEC’s Office of Compliance Inspections and Examinations, or combining its staff with those having similar technical expertise within SEC’s Office of Information Technology. Realigning the ARP program within SEC could, however, have potential disadvantages. For example, having ARP staff within the Division of Market Regulation, as it is now, provides valuable expertise and information gathering abilities and allows this examination function to be linked with the related policy-making function.

Conclusions

The securities market organizations we reviewed all had reduced the risk that their operations would be disrupted by terrorist attacks or other disasters. In addition, financial market participants and telecommunications organizations increased the resiliency of the critical telecommunications services necessary for the functioning of the markets. Further, financial regulators have issued guidance to these organizations that, if implemented, should greatly increase the ability of the markets to recover. However, as of May 2004, a number of the critical financial market organizations and the broker-dealers and banks that conduct significant trading activities remained at a greater risk of disruption than others from a wide-scale event because they lacked certain business continuity capabilities. The ability of U.S. financial markets to recover and resume operating in the wake of any future attacks or disasters depends upon the extent to which these critical market participants augment their business continuity capabilities or mitigate existing weaknesses.

One of the lessons learned from the September 2001 attacks was that without key broker-dealers able to trade, the markets could not reopen. As we noted in our 2003 report, insufficient liquidity existed to open the markets during the week of the September 2001 attacks because of the considerable efforts required for broker-dealers to restore operations. However, SEC currently lacks adequate assurance that the actions of organizations that trade in the markets will be sufficient to ensure that this important activity can also resume. Although joint regulatory guidance addresses organizations’ clearing and settlement activities, and SEC’s own policy statement directs exchanges and ECNs to implement sound business continuity practices, the firms that conduct trading activities in U.S. markets are not similarly required to implement such practices, and SEC officials said they do not have specific authority to require broker-dealers to participate in the markets to any degree. Nevertheless, SEC has not fully assessed whether or not sufficient numbers of firms with staff capable of trading securities would to be ready to operate after a wide-scale disaster. Similarly, although many other trading firms exist, including regional firms with sizeable operations located throughout the United States, SEC has not sufficiently analyzed the willingness and capabilities of these firms to step up and become the significant providers of liquidity necessary for fair and orderly trading to occur in the aftermath of a disaster. Once it conducts a more complete analysis of the likely readiness of trading firms to resume trading, SEC could use the results to identify actions that specific exchanges, clearing organizations, or trading firms could take to increase the likelihood that trading in the markets could resume when appropriate. Given that some disaster and damage impact scenarios are more or less likely than others, having SEC weigh the feasibility and costliness of any actions that it identifies against the potential benefits and likelihood of such scenarios occurring appears warranted.

While SEC has made some enhancements to the ARP program, it has also not made key improvements, including those we recommended in our 2003 report, that could better ensure that it is as credible and as effective as possible. Given the importance of the work with which SEC’s ARP staff are tasked, ensuring that they have a specific rule to mandate compliance with ARP program tenets and sufficient staff to conduct their oversight appears justified. While SEC has made progress in ensuring that exchanges and clearing organizations implement ARP staff recommendations, such current voluntary cooperation may not always exist in the future, especially when ARP-recommended actions would be costly to an organization. The limited resources that SEC has devoted to ARP thus far have generally prevented it from conducting more frequent examinations and do not appear to have provided it with sufficient technical expertise to address important information security issues.

While the ARP program was realigned within the Division of Market Regulation in November 2003 and SEC staff indicated that they are assessing the impact on the program’s effectiveness, it is not yet clear whether this change will improve the program’s ability to obtain sufficient additional resources and staff with the necessary expertise. Given that the functioning of the markets is critical to our nation’s economy, taking steps to better ensure that the program used to oversee operational and information security issues at these entities has sound legal authority and adequate resources and expertise is warranted at this time. Such steps would include assessing whether the placement of the program within SEC’s organizational structure is optimal for ensuring that it has adequate resources and staff expertise.

Recommendations for Executive Action

To provide greater assurance that the critical trading that is conducted in U.S. financial markets can resume, in as timely a manner as appropriate, after disruptions, we recommend that the Chairman, SEC, fully analyze the readiness of the securities markets to recover from major disruptions and work with industry and other federal agencies, as appropriate, to determine reasonable actions that would increase the likelihood that trading in the markets could resume when appropriate.

In addition, to improve the effectiveness of SEC’s ARP program, which oversees preparedness of securities trading and clearing organizations for future disasters, we recommend that the Chairman, SEC, take the following three steps to enhance the ARP program’s effectiveness: Establish a definite time frame for the submission of a rule requiring exchanges and clearing organizations to engage in activities consistent with the operational practices and other tenets of the ARP program; Assess the adequacy of ARP staffing in terms of positions and technical skill levels, including information security expertise, given its mission and workload; and Continue to assess the organizational alignment of the ARP program within SEC.

Agency Comments and Our Evaluation

We requested comments on a draft of this report from the heads, or their designees, of the Federal Reserve, OCC, Treasury, and SEC. The Federal Reserve and SEC provided written comments, which appear in appendixes II and III, respectively. The Federal Reserve, OCC, and SEC also provided technical comments, which we incorporated in the report as appropriate.

SEC generally agreed with the report and its recommendations. The letter from SEC’s Chairman noted that SEC has been working actively with the trading markets, core clearing organizations, and major market participants to strengthen the resiliency of the financial markets. In addition, SEC’s letter noted that it would be taking specific actions in response to our recommendations, including conducting an assessment of key broker-dealers’ trading staff arrangements and the preparations of these firms to resume trading operations following a disaster. SEC also indicated that its Market Regulation Division is developing a proposed rule that would require exchanges and clearing organizations to engage in activities consistent with the operational practices and other tenets of the ARP program and that this should be submitted to the Commission during the first half of 2005. SEC stated that it is also currently assessing the adequacy of staffing and technical skill levels within the ARP program and that increased education for its staff, hiring new staff, and engaging consultants are all ways that it could use to address its needs in this area. Finally, SEC noted that as part of the agency’s routine strategic planning effort, it will continue to assess the organizational alignment of the ARP program within SEC. In its letter, the Federal Reserve noted that addressing the risks posed by the September 11 attacks continues to be a priority for the organization and that it is continuing efforts to improve the resiliency of the financial system.

As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the appropriate congressional committees; the Secretary, Treasury; the Chairman, SEC; the Chairman, Federal Reserve; and the Comptroller of the Currency; and others who request them. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov.

Objectives, Scope, and Methodology

The objective of this report is to describe the progress that financial markets participants and regulators have made since our 2003 report in reducing the likelihood that terrorist attacks and other disasters would disrupt market operations. Specifically, we assessed (1) actions that critical securities market organizations and key market participants undertook to reduce their vulnerabilities to physical or electronic attacks and to improve their business continuity capabilities; (2) steps that financial market participants, telecommunications industry organizations, and others took to improve the resiliency of telecommunications systems and infrastructure; (3) financial regulators’ efforts to ensure the resiliency of the financial markets; and (4) the progress the Securities and Exchange Commission (SEC) has made in improving its Automation Review Policy program, which oversees security and operations issues at exchanges, clearing organizations, and electronic communications networks (ECN). As in our previous report, for purposes of our analysis we selected seven organizations whose ability to operate is critical to the overall functioning of the financial markets. We made these categorizations by determining whether viable immediate substitutes existed for the products or services the organizations offer or whether the functions they perform were critical to the overall markets ability to function. To maintain the security and the confidentiality of their proprietary information, we agreed with these organizations that we would not discuss their efforts to address physical and information security risks and ensure business continuity in a way that could identify them.

To assess actions that critical securities market organizations took to reduce their vulnerabilities to physical or electronic attacks and to improve their business continuity capabilities, we visited their facilities, reviewed relevant business continuity policies, and interviewed officials at the organizations. Specifically, to determine what steps these seven organizations were taking to reduce the risks to their operations from physical attacks, we conducted on-site “walkthroughs” of their facilities, reviewed their security policies and procedures, and met with key officials responsible for physical security to discuss these policies and procedures. We compared these policies and procedures with 52 standards developed by the Department of Justice for federal buildings. Based on these standards, we evaluated the physical security efforts across several key operational elements, including measures taken to secure perimeters, entryways, and interior areas and whether organizations had conducted various security planning activities. To identify types of tests an organization can perform to monitor the effectiveness of physical security measures in place, we reviewed publications and guidance, such as that contained in our Executive Guide on Information Security Management and obtained information from security experts within our office, including Office of Special Investigations. We obtained information on the types and extent of physical security testing performed by the organizations at their primary locations and compared it with the information we collected. We also reviewed publications and guidance, such as those issued by the Centers for Disease Control and Prevention, Federal Emergency Management Administration, and Lawrence Berkeley National Laboratory, to identify high-level countermeasures that an organization could take to mitigate the CBR threat. For each primary facility, through interviews with the organizations’ security officials, we identified and compared their actions against our listing of countermeasures.

To determine what steps these seven organizations were taking to reduce the risks to their operations from electronic attacks, we reviewed the security policies of the organizations we visited and reviewed documentation of their system and network architectures and configurations. We also compared their information security measures with those recommended for federal organizations in the Federal Information System Controls Audit Manual, other federal guidelines and standards, and various industry electronic security best practice principles. Using these standards, we attempted to determine, through discussions and document reviews, how these organizations had addressed various key operational elements for information security, including how they controlled access to their systems and how they detected intrusions, what responses they made when such intrusions occurred, and what assessments of their systems’ vulnerabilities they had performed.

To determine what steps these seven organizations had taken to ensure they could resume operations after an attack or other disaster, we discussed their business continuity plans (BCP) with staff and visited their facilities. We reviewed their BCPs and assessed them against practices recommended for financial organizations, including bank regulatory guidance. Among the operational elements we considered were the existence and capabilities of backup facilities, whether the organizations had procedures to ensure the availability of critical personnel and telecommunications, and whether they completely tested their plans. In evaluating these organizations’ backup facilities, we attempted to determine whether these organizations had backup facilities that would allow them to recover from damage to their primary sites or from damage or inaccessibility, resulting from a wide-scale disaster. We did not directly observe the operation of these backup sites, but relied on documentation, including backup facility test results, provided by the organizations. We also discussed the business continuity capabilities and improvements made by eight large broker dealers and banks that collectively represented a significant portion of trading and clearing volume on U.S. securities markets.

To determine the extent to which critical financial market organizations reduced the likelihood that their operations might be disrupted by future disasters, we also examined the telecommunications continuity practices they were following. To identify sound telecommunications-related continuity practices, we first reviewed business continuity planning guidance published by the Business Continuity Institute, the Federal Financial Institutions Examination Council, and other continuity planning guidance. Based on our review of those materials, we identified five principal practices that organizations should follow to plan for the availability of telecommunications services that are important to their continuing operations. We also discussed our selection of practices for use as criteria with a private-sector business continuity expert to affirm that our selection of these five practices was an appropriate judgment. We then examined the extent to which the critical organizations followed these practices by reviewing network documentation, continuity plans, and testing reports where available, and discussed with organization telecommunications managers their network continuity strategies and the practices they followed to mitigate perceived continuity risks. We assessed those strategies, practices, and related documentation against the five practices we identified.

To determine how financial and telecommunications industry organizations, federal and local government entities, and supporting telecommunications service providers further improved telecommunications service resiliency, including improved infrastructure diversity and recoverability, we reviewed reports and related documentation prepared by three Presidential Advisory Committees—the National Infrastructure Advisory Council, the National Security Telecommunications Advisory Council, and the Network Reliability and Interoperability Council. These reports and documentation evaluated infrastructure interdependencies and network diversity challenges, and they identified practices that telecommunications carriers and large organizations might follow to better prepare for and recover from future network disruptions. We also reviewed plans and documentation developed by a critical financial organization to implement and operate a private network for the benefit of financial market participants. In addition, we met with managers at the Board of Governors of the Federal Reserve (the Federal Reserve) and the federal National Communications System to obtain data on the use of federal national security/emergency preparedness programs by the financial industry to improve the recoverability of important telecommunications services. We also met with New York City officials to review the status of their efforts to reestablish an agreement to coordinate and monitor the recovery of local infrastructure in the event of future service outages. Finally, we met with managers at three large telecommunications carriers to review how they were rebuilding local infrastructure in New York City, and steps taken to review and revise their own continuity plans.

To assess financial regulators’ efforts to ensure the resiliency of the financial markets, including the progress SEC has made in improving its program for overseeing security and operations issues at exchanges, clearing organizations, and ECNs, we reviewed relevant regulations and interviewed officials at SEC, the Federal Reserve, Office of the Comptroller of the Currency, and the Department of Treasury. We also discussed initiatives to improve responses to future crises and improve the resiliency of the financial sector and its critical telecommunications services with representatives of industry trade groups, including the Bond Market Association and the Securities Industry Association.

For our reviews, we relied on documentation and descriptions provided by market participants and regulators and reviews conducted by other organizations. When feasible, we also directly observed controls in place for physical security, electronic security, and business continuity at the organizations assessed. We did not test these controls by attempting to gain unauthorized entry or access to facilities or information systems, or directly observe testing of business continuity capabilities.

We performed our work from September 2003 through August 2004 in accordance with generally accepted government auditing standards.

Role of the Department of Homeland Security

The Department of Homeland Security (DHS), created to help coordinate the efforts of organizations and institutions involved in protecting the nation against terrorist attacks, has essentially delegated to Treasury this coordinating role within the banking and finance sector. In 2002, the Homeland Security Act created DHS, which was given responsibility for developing a national plan to protect the nation’s critical infrastructure. Homeland Security Presidential Directive 7 (HSPD-7), issued in December 2003, further stated that the Secretary of DHS, would be responsible for coordinating the overall national effort to enhance the protection of the critical infrastructure of the United States. HSPD-7 also stated that it is U.S. policy to enhance the protection of these critical infrastructures against terrorist attacks that could, among other things, damage the private sector’s capability to ensure the orderly functioning of the economy.

To fulfill these objectives, HSPD-7 directs the Secretary of DHS to work closely with other federal departments and agencies, and designates specific agencies to coordinate efforts within certain sectors. Within the banking and finance sector, Treasury was given responsibility for collaborating with all relevant federal, state, and local officials, as well as the private sector. To fulfill this responsibility, Treasury coordinates with other federal financial regulators through the Financial and Banking Information Infrastructure Committee (FBIIC), whose members include representatives of the various regulators of banks, broker-dealers, futures commission merchants, and housing government sponsored enterprises, as well as other related organizations. Treasury coordinates its collaboration with the private sector through the Financial Services Sector Coordinating Council (FSSCC), whose members include representatives from exchanges, clearing organizations, and banking and securities trade associations.

According to Treasury officials, they coordinate with DHS in several ways. For example, a FBIIC member attends weekly meetings of DHS’s Directorate of Information Analysis and Infrastructure Protection (IAIP), which identifies and assesses threats and issuing timely warnings on those threats. According to Treasury, the FBIIC member at those meetings provides input on the needs of the financial sector as well as the relevancy for that sector of any identified threats. In addition, Treasury has worked with DHS to plan disaster recovery exercises, such as the TOPOFF exercises, which simulate physical attacks. Treasury is also working with DHS to continue developing “Chicago First,” an emergency preparedness program designed to coordinate activities among financial sector participants and federal, state, and local government officials. Treasury is promoting this program as a model for other cities to implement. Finally, the Secretary of the Treasury, along with the Director of the Office of Homeland Security is a member of the Homeland Security Council, which ensures the coordination of homeland security activities among executive departments and agencies. Representatives of the Homeland Security Council, in turn, are members of FBIIC.

According to FSSCC officials, they are interacting with DHS in at least two ways. First, DHS has asked FSSCC to prepare an updated version of the banking and finance sector’s portion of the national strategy for critical infrastructure assurance, the first version of which was completed in May 2002. FSSCC expected to complete the updated version in June 2004. Second, FSSCC representatives have taken part in quarterly meetings between DHS and other sector coordinators. According to FSSCC officials, this group has produced a matrix outlining the responsibilities of the different sectors.

Comments from the Federal Reserve

Comments from the Securities and Exchange Commission

GAO Contacts and Staff Acknowledgments

GAO Contacts

Acknowledgments

In addition to the individuals named above, Edward Alexander, Gerald Barnes, Lon Chin, West Coile, Kevin E. Conway, Kirk Daubenspeck, Ramnik Dhaliwal, Patrick Dugan, Edward Glagola, Harold Lewis, Thomas Payne, Barbara Roesmann, Eugene Stevens, Patrick Ward, Christopher Warweg, and Anita Zagraniczny made key contributions to this report.

Related GAO Products

Critical Infrastructure Protection: Establishing Effective Information Sharing with Infrastructure Sectors. GAO-04-699T. Washington, D.C.: April 21, 2004.

Securities and Exchange Commission: Preliminary Observations on SEC's Spending and Strategic Planning. GAO-03-969T. Washington, D.C.: July 23, 2003.

Potential Terrorist Attacks: Additional Actions Needed to Better Prepare Critical Financial Market Participants. GAO-03-251. Washington, D.C.: February 12, 2003.

Potential Terrorist Attacks: Additional Actions Needed to Better Prepare Critical Financial Market Participants. GAO-03-414. Washington, D.C.: February 12, 2003.

Critical Infrastructure Protection: Effort of the Financial Services Sector to Address Cyber Threats. GAO-03-173. Washington, D.C.: January 30, 2003.

SEC Operations: Increased Workload Creates Challenges. GAO-02-302. Washington, D.C.: March 5, 2002.

A Model of Strategic Human Capital Management. GAO-02-373SP. Washington, D.C.: March 15, 2002.

Information Systems: Opportunities Exist to Strengthen SEC's Oversight of Capacity and Security. GAO-01-863. Washington, D.C.: July 25, 2001.

Homeland Security: Efforts to Improve Information Sharing Need To Be Strengthened. GAO-03-760. Washington, D.C.: June 29, 2001.

Human Capital: A Self-Assessment Checklist for Agency Leaders, Version 1. GAO/OCG-00-14G. Washington, D.C.: September 2000.

Federal Information System Controls Audit Manual, Volume I: Financial Statement Audits. GAO/AIMD-12.19.6. Washington, D.C.: January 1999.

Executive Guide on Information Security Management: Learning from Leading Organizations. GAO/AIMD-98-68. Washington, D.C.: May 1, 1998.

GAO’s Mission

The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to www.gao.gov and select “Subscribe to Updates.”

Order by Mail or Phone

To Report Fraud, Waste, and Abuse in Federal Programs

Congressional Relations

Public Affairs