Various organizations must be able to operate for the U.S. securities markets to function. Individual investors and institutions such as mutual funds send their orders to buy and sell stocks and options to broker- dealers, which route them to be executed at one of the many exchanges or electronic trading venues in the United States. After a securities trade is executed, the process known as clearance and settlement occurs that ensures the accuracy of the trade, transfers ownership of the securities from the seller to the buyer, and exchanges the necessary payment between these two parties. Separate organizations perform this process for stocks and for options, while a single depository maintains records of ownership for the bulk of the securities traded in the United States. Banks participate in the U.S. securities markets by acting as clearing banks that maintain accounts for broker-dealers to accept and make payments for these firms’ securities activities. The payments that are exchanged between the banks of clearing organizations, broker-dealers, and their customers are processed by systems operated by the Federal Reserve or other private payment system processors. Virtually all of the information processed is transferred between parties through telecommunications systems; as a result, the securities markets depend heavily on the telecommunications industry’s supporting infrastructure. Although thousands of entities are active in the U.S. securities markets, certain key participants are critical to the ability of the markets to function. Some are more important than others because they offer unique products or perform vital services. For example, markets cannot function without the activities performed by clearing organizations; and in some cases, only one clearing organization exists for particular products. In addition, other market participants are critical to overall market functioning because they consolidate and distribute price quotations or information on executed trades. Other participants may be critical to the overall functioning of the markets only in the aggregate. For example, if one of the thousands of broker-dealers in the United States is unable to operate, its customers may be inconvenienced or unable to trade, but the impact on the markets as a whole might be limited to a reduced liquidity or less price competitiveness. However, a small number of large broker- dealers account for sizeable portions of the daily trading volume on many exchanges. If several of these large firms were unable or unwilling to operate, the markets might not have sufficient trading volume to function in an orderly or fair way. Several federal organizations oversee the various securities market participants. SEC regulates the stock and options exchanges and the clearing organizations for those products. In addition, SEC regulates the broker-dealers that trade on those markets and other participants, such as mutual funds, which are active investors. The exchanges also have responsibilities as self-regulatory organizations (SRO) for ensuring that their participants comply with the securities laws and these organizations’ own rules. To oversee the operational risks at the securities exchanges and clearing organizations, SEC published its Automation Review Policy in 1989, which advised SROs prospectively of SEC’s expectations on how these organizations should address information dissemination and physical security and business continuity challenges. ARP staff conduct reviews of how these organizations are addressing SEC’s expectations in these areas. Additionally, several federal organizations have regulatory responsibilities over banks and other depository institutions, including those active in the securities markets. The Federal Reserve oversees bank holding companies and state-chartered banks that are members of the Federal Reserve System. The Office of the Comptroller of the Currency (OCC) examines nationally chartered banks. To ensure that the functioning of the financial markets is protected, the financial sector is one of several key infrastructures that the United States has designated as critical to our nation. To protect these infrastructures, the Homeland Security Act of 2002 created the Department of Homeland Security (DHS) and gave it wide-ranging responsibilities for leading and coordinating the overall protection effort for the nation’s critical infrastructure. Homeland Security Presidential Directive 7 further defines these responsibilities for DHS and those federal agencies given responsibility for particular industry sectors such as telecommunications or banking and finance, known as sector-specific agencies. The Department of the Treasury (Treasury) is the federal agency responsible for infrastructure protection activities in the banking and finance sector, which includes coordinating and collaborating with relevant federal agencies, state and local governments, and the private sector. The threats for which organizations in the financial and other critical sectors must be prepared vary. As the events of September 11 illustrated, terrorist activity can pose a significant threat to U.S. entities. Events such as attempts to bomb key facilities can significantly impair the operations of an affected organization and events involving nuclear, radiological, or chemical hazards could cause substantial damage to key facilities or necessary infrastructure over a wide area or render such facilities and infrastructure inaccessible for extended periods. Similarly, major natural disasters such as hurricanes, tornados, or earthquakes also can result in wide-scale damage or make areas inaccessible just about anywhere in the United States. In addition to events that cause physical damage, financial market organizations remain a prime target for individuals or organizations seeking to use cyber attacks to obtain unauthorized access or prevent legitimate users from accessing the key networks and systems upon which the financial markets depend. Moreover, concern has grown about the threat of an influenza pandemic and the impact it could have on the operations of entities in the United States, including those in the financial markets. With individuals in other countries having already have fallen ill and died as a result of the H5N1 strain of avian flu, the U.S. government is urging all businesses to prepare for a pandemic. The pandemic threat is different than those previously envisioned because it could affect large numbers of people simultaneously, with waves of illness occurring for weeks at a time over the course of several months. Since our last report, all seven organizations whose operations we considered critical to the overall functioning of U.S. securities markets have in place business continuity capabilities that reduce their vulnerability to disruption by a wide-scale disaster. These capabilities include having backup operating sites that have staff capable of performing the organizations’ critical tasks and that are geographically distant from their primary operating locations. All seven critical organizations have taken steps to reduce the likelihood that power and telecommunications outages will affect their operations and all have tested their business continuity capabilities by running simulations or performing live processing of their primary activities from backup locations. All seven critical organizations are developing business continuity plans to address the risk of infectious pandemics, although at the time we reviewed these organizations only one had fully developed a plan that incorporates the various elements needed to address such an occurrence. Each of the seven organizations also has continued to enhance the measures it uses to prevent physical attacks from disrupting its operations, with those that still had vulnerabilities using their business continuity capabilities to mitigate those weaknesses. Each organization continued to improve the information security measures intended to mitigate the risk of electronic attacks, including taking or considering additional actions we identified that could further improve their information security. Representing many of the most active market participants, the large broker-dealers and banks that we contacted also have continued to improve their disaster-recovery capabilities. Although by maintaining their trading staff in single locations increases the risk that they will be unable to resume activities promptly after a wide-scale disaster, the major broker-dealers we reviewed have implemented various measures to mitigate such risks, including cross-training staff and establishing dispersed backup trading locations. Since our 2004 report, all the critical organizations have established business continuity capabilities that reduce the likelihood that a wide- scale physical disaster would disrupt their key operations. When we last reported, four of the seven organizations had established backup sites capable of performing the key activities they needed to be operational and located them at considerable distances from their primary sites to reduce the likelihood that a disaster, even a wide-scale event, would render both locations unusable. However, at that time, we also reported that three of the critical organizations lacked business continuity capabilities that likely would have allowed them to resume operations shortly after such disasters. For example, one of these organizations had a backup site that it could use to conduct its key activities, but this site was within a few miles of its primary location and therefore also could have been rendered unusable in a wide-scale disaster. As of September 2006, all seven critical organizations now have geographically distant backup sites or other means of conducting their key operations. For example, one of the organizations previously lacking a geographically dispersed site has completed a new data center that is more than 1000 miles from its primary operating locations and that now is capable of conducting all the key processing that the organization would need to be operational. Because the distance between sites is too great to allow both the primary and the backup site to process identical data simultaneously, the organization has implemented a proprietary hardware based data replication technology that ensures that copies of all production data and processing results from the primary sites are stored and then transmitted to the remote site. Since installing this technology, the organization’s staff indicated that it has significantly reduced the time required to have the remote site take over operations to less than 2 hours with less than a minute of data loss if a disaster were to affect both primary processing sites. Rather than establishing a geographically distant site that exactly duplicates its primary site, another of these three organizations instead acquired the capability to conduct its critical trading activities through an electronic system whose processing location is located more than 700 miles from the organization’s current operating site. Finally, to better ensure that it would be able to operate in the aftermath of a wide-scale disaster, the last of these three organizations installed hardware capable of performing its critical processing operations at a site that is more than 200 miles from its current primary operating location. In addition to these three organizations, the other four have also improved their business continuity capabilities to further reduce their vulnerability to such events. For example, one organization that when we last reported had established a backup data center more than 700 miles from its headquarters and primary operating location changed how it operates so that it now conducts its live critical business processing from the geographically distant site and uses its former primary processing site as its backup location.