Self-Regulatory Organizations; The Options Clearing Corporation; Notice of Filing of Partial Amendments No. 1, 2, 3, and 4 and Notice of No Objection to Advance Notice, as Modified by Partial Amendments No. 1, 2, 3, and 4 Relating to OCC's Adoption of Cloud Infrastructure for New Clearing, Risk Management, and Data Management Applications

I. Introduction

On October 8, 2021, the Options Clearing Corporation (“OCC”) filed with the Securities and Exchange Commission (“Commission”) advance notice SR-OCC-2021-802 (“Advance Notice”) pursuant to Section 806(e)(1) of Title VIII of the Dodd-Frank Wall Street Reform and Consumer Protection Act, entitled Payment, Clearing and Settlement Supervision Act of 2010 (“Clearing Supervision Act”), and Rule 19b-4(n)(1)(i) under the Securities Exchange Act of 1934 (“Exchange Act”), in connection with a proposed adoption of third-party-hosted cloud infrastructure (also generally referred to as the “Cloud”) for OCC's new clearing, risk management, and data management applications. On November 2, 2021, the Commission published notice of the Advance Notice in the Federal Register to solicit public comment and to extend the review period for the Advance Notice. The Commission has received no comments regarding the changes proposed in the Advance Notice.

On November 16, 2021, OCC filed Partial Amendment No. 1 to the Advance Notice. On December 13, 2021, OCC filed Partial Amendment No. 2 to the Advance Notice. On July 1, 2022, OCC filed Partial Amendment No. 3 to the Advance Notice. On September 12, 2022, OCC filed Partial Amendment No. 4 to the Advance Notice.

On January 27, 2022, the Commission requested that OCC provide it with additional information regarding the Advance Notice, pursuant to Section 806(e)(1)(D) of the Clearing Supervision Act, which tolled the Commission's period of review of the Advance Notice until 120 days from the date the requested information was received by the Commission. The Commission received OCC's response to the Commission's request for additional information on March 3, 2022. On June 14, 2022, the Commission made a second request for OCC to provide additional information regarding the Advance Notice, which tolled the Commission's period of review of the Advance Notice until 120 days from the date the requested information was received by the Commission. OCC responded to the request, and the Commission received the information on June 22, 2022.

The Commission is publishing this notice to solicit comments on Partial Amendments No. 1, 2, 3, and 4 from interested persons and, for the reasons discussed below, is hereby providing notice of no objection to the Advance Notice.

II. Background ¹⁷

OCC is the only clearing agency for standardized U.S. securities options listed on Commission-registered national securities exchanges (“listed options”). In addition to clearing and settling listed options, OCC serves other financial markets, including the commodity futures, commodity options, security futures, securities lending, and the over-the-counter options markets. Further, OCC provides central counterparty (“CCP”) clearing services for all of these markets and performs critical functions in the clearance and settlement process. OCC's role as the sole CCP for these markets is operationally complex and makes OCC an integral part of the national system for clearance and settlement.

The current iterations of OCC's core clearing, risk management, and data management applications (“ENCORE”) were launched in 2000 and designed to operate in on-premises data centers. As part of a larger technology initiative it calls “Renaissance,” OCC now proposes essentially to migrate ENCORE's functions to the virtual equivalent of a traditional on-premises data center (a “Virtual Private Cloud”) hosted by a third party CSP by utilizing Cloud-based hardware and systems software instead of its current on-premises hardware and systems software. OCC refers to the migration of ENCORE's functionality to a Virtual Private Cloud as the adoption of a “Cloud Infrastructure.” OCC's proposed adoption of a Cloud Infrastructure would offer more resiliency, security, and scalability than OCC's current on-premises infrastructure, in part, because the on-premises data centers require the acquisition and installation of additional hardware and systems software to accommodate scaled resources or new applications, while the Virtual Private Cloud does not. Although OCC is not proposing changes to ENCORE's functionality at this time (only to migrate that functionality to a Virtual Private Cloud, utilizing cloud-based hardware and systems software), OCC's goal is to eventually retire ENCORE and implement new, improved clearing, risk management, and data management applications to replace ENCORE. In part because of the improved resiliency, security, and scalability noted above, the adoption of Cloud Infrastructure is a necessary building block for that goal.

The proposed migration of ENCORE's functions to a Virtual Private Cloud would include scalable resources that would: (i) handle various computationally intensive applications with load-balancing and resource management (“Compute”); (ii) provide configurable storage (“Storage”); and (iii) host network resources and services (“Network”). At the same time, reliance on a single CSP for OCC's core clearing, risk management, and data management applications also introduces certain risks. To mitigate those risks, OCC also proposes to retain a physical on-premises data center as a backup to the primary Cloud system, which would be utilized in the unlikely event of a multi-region outage of the Compute, Storage, and Network services at the CSP that affect OCC operations. Taken together, the move to a Cloud Infrastructure combined with the proposed backup on-premises data center would affect various aspects of OCC's operations including (i) resiliency, (ii) security, and (iii) scalability while mitigating one of the primary risks associated with relying on a single CSP. The move to a Cloud Infrastructure also would introduce additional risks associated with a migration to a Cloud Infrastructure, which OCC has identified and addressed through various controls, mitigation efforts, and policies and procedures. A summary of each of these aspects of OCC's operations, as well as the primary attendant risks associated with the proposed migration to a Cloud Infrastructure, is provided below.

A. Resiliency

OCC currently operates ENCORE in two on-premises data centers located in Texas and Illinois. OCC proposes to provision Compute, Storage, and Network resources in two separate, logically isolated Virtual Private Clouds that are capable of operating autonomously from each other and are located in geographically diverse regions. Specifically, OCC would operate in three availability zones within each region, effectively providing for six levels of redundancy within a Cloud Infrastructure. The two Virtual Private Clouds would run in a “hot/warm” configuration. The “hot” Virtual Private Cloud would be operational and accept data traffic, while the “warm” Virtual Private Cloud would have applications on stand-by while simultaneously receiving the same incoming data and receiving replicated data from the “hot” Virtual Private Cloud. OCC believes that this proposed systems architecture would significantly reduce operational complexity, mitigate the risk of human error, and provide increased resiliency and assured capacity.

In addition to the Virtual Private Clouds, OCC would operate an on-premises backup data center that would be separate from the Cloud Infrastructure. Like the “warm” Virtual Private Cloud, the on-premises data center would receive the same incoming data and replicated data from the “hot” Virtual Private Cloud. The on-premises data center would provide continuity of operations in the event that OCC loses access to its Cloud Infrastructure. For example, OCC might rely on the on-premises data center to maintain continuity of services in response to either a brief operational disruption of OCC's Virtual Private Clouds or a longer outage resulting from termination of OCC's relationship with the CSP.

B. Security

OCC has developed a Cloud security program to allow OCC to manage the security of the core applications that would run on the Cloud Infrastructure. OCC's Cloud security program also would provide OCC with tools to assess and monitor the CSP's management of the Cloud Infrastructure's security. As described below, the proposed Cloud security program focuses on four elements: (i) access controls; (ii) data governance; (iii) configuration management; and (iv) testing.

OCC is also proposing to implement tools provided by the CSP and selected third parties that are not currently available for use in OCC's on-premises data centers.

1. Access Controls

OCC proposes to enforce a strict separation of duties and least-privileged access for infrastructure, applications, and data to protect the confidentiality, availability, and integrity of the data. Using third-party tools, OCC would automate appropriate role-based access to the core applications running in the Cloud. For the on-premises data center, OCC would implement additional risk management measures. Specifically, OCC would explicitly set up the infrastructure for all connectivity to and from the on-premises data center and rely on heavily monitored “jump hosts” ( e.g., data feeds in and out, mechanisms for the delivery of the software, and a minimum management interface that requires multi-factor authentication for access). OCC would also limit access to approved users of the on-premises data center via dedicated private circuits.

2. Data Governance

OCC's Enterprise Security Standards describe the data governance framework applicable to OCC's proposed Cloud Infrastructure, such as data moving between systems within the Cloud. For example, the Enterprise Security Standards require any system related to the Cloud Infrastructure to: (i) store data and information in the United States throughout its lifecycle; (ii) be able to retrieve and access the data and information throughout its lifecycle; (iii) encrypt data in the Cloud with key pairs kept and owned by OCC; (iv) comply with United States federal and applicable state data regulations regarding data location; and (v) enable secure disposition of non-records. Other OCC policies, such as its existing Information Classification and Handling Policy, establish the overall data governance framework applied to the management, use, and governance of OCC information accessed, stored, or transmitted through the Cloud Infrastructure.

3. Configuration Management

To improve configuration management, OCC proposes to rely on pre-established system configurations, specifically the use of automated delivery of business and security capability via “Infrastructure as Code,” to consistently and transparently deploy security controls on demand. OCC would also employ continuous configuration monitoring and periodic vulnerability scanning. Further, OCC would perform regular reviews and testing of its systems running in the Cloud while also relying on regular reviews and testing reports provided by the CSP. OCC also proposes to use third-party solutions and CSP tools to track metrics, monitor log files, set alarms, and act on changes to OCC's core applications and the environment in which they operate.

4. Testing

OCC proposes the use of various security testing techniques for the Cloud Infrastructure. Through a risk-based analysis, an OCC team dedicated to security testing would determine what types of security testing techniques are appropriate for new assets and applications. Such techniques include automated security testing; manual penetration testing; and Blue Team testing. OCC would employ processes for managing and remediating the results of its security testing.

Moving to a third-party-hosted Cloud infrastructure does present the risk that OCC would be overly reliant on the CSP to provide test results reliably and consistently. However, as indicated in confidential information provided by OCC, the CSP agreement provides assurances that the CSP would provide OCC with test cases, test planning, and auditable evidence of testing execution, including test results. These test results would allow OCC to work with the CSP to make any changes, as needed, to rectify any technical issues that arise. Additionally, the CSP agreement includes provisions related to business continuity testing and intrusion reporting to facilitate the flow of security information to OCC.

C. Scalability

OCC's proposal to migrate from their current on-premises infrastructure to the Cloud represents a tradeoff in risk management. Accommodating scaled resources or new applications in OCC's current on-premises data centers would require OCC to acquire and install additional hardware and software. The availability of on-demand scaling in a Virtual Private Cloud could present a risk if OCC were not to receive resources from the CSP when requested. However, based on the confidential information provided by OCC in connection with the Advance Notice, OCC will contract with the CSP for at least as much capacity as it maintains in its current on-premises facilities, as well as for a plan to provide additional capacity.

Increasing the capability of OCC's current on-premises data centers, which are designed to handle a capacity in excess of prior peak transaction volumes, would require the acquisition and installation of additional hardware and software. In contrast, operating in a Cloud Infrastructure would allow OCC to quickly provision or de-provision Compute, Storage, or Network resources to meet demands, including elevated trade volumes. Moving to a third-party-hosted Cloud Infrastructure does present a novel risk: that the CSP does not deliver the additional capacity that OCC might need at a moment's notice. However, OCC asserts that the fact that it will contract with the CSP for at least as much capacity as OCC currently maintains in its current on-premises facilities, combined with the CSP's contractual obligation to provide additional capacity to OCC on demand, would mitigate this risk significantly.

The Cloud Infrastructure would also provide more flexibility for OCC to model and create development and test environments for backtesting and stress testing, as well as other systems development needs because of OCC's ability to increase capacity on demand under the express terms of the contract with the CSP. OCC also states that the increased scalability of the Cloud Infrastructure would allow OCC to run certain backtesting processes at a fraction of the time currently required.

III. Discussion and Notice of No Objection

Although the Clearing Supervision Act does not specify a standard of review for an advance notice, the stated purpose of the Clearing Supervision Act is instructive: to mitigate systemic risk in the financial system and promote financial stability by, among other things, promoting uniform risk management standards for systemically important financial market utilities (“SIFMUs”) and strengthening the liquidity of SIFMUs.

Section 805(a)(2) of the Clearing Supervision Act authorizes the Commission to prescribe regulations containing risk management standards for the payment, clearing, and settlement activities of designated clearing entities engaged in designated activities for which the Commission is the supervisory agency. Section 805(b) of the Clearing Supervision Act provides the following objectives and principles for the Commission's risk management standards prescribed under Section 805(a):

• to promote robust risk management;
• to promote safety and soundness;
• to reduce systemic risks; and
• to support the stability of the broader financial system.

Section 805(c) provides, in addition, that the Commission's risk management standards may address such areas as risk management and default policies and procedures, among other areas.

The Commission has adopted risk management standards under Section 805(a)(2) of the Clearing Supervision Act and Section 17A of the Exchange Act (the “Clearing Agency Rules”). The Clearing Agency Rules require, among other things, each covered clearing agency to establish, implement, maintain, and enforce written policies and procedures that are reasonably designed to meet certain minimum requirements for its operations and risk management practices on an ongoing basis. As such, it is appropriate for the Commission to review advance notices against the Clearing Agency Rules and the objectives and principles of these risk management standards as described in Section 805(b) of the Clearing Supervision Act. As discussed below, the Commission believes the changes proposed in the Advance Notice are consistent with the objectives and principles described in Section 805(b) of the Clearing Supervision Act, and in the Clearing Agency Rules, in particular Rule 17Ad-22(e)(17)(ii).

A. Consistency With Section 805(b) of the Clearing Supervision Act

The Commission believes that the proposal contained in OCC's Advance Notice is consistent with the stated objectives and principles of Section 805(b) of the Clearing Supervision Act. Specifically, as discussed below, the Commission believes that the changes proposed in the Advance Notice are consistent with promoting robust risk management, promoting safety and soundness, reducing systemic risks, and supporting the stability of the broader financial system.

The Commission believes that OCC's proposal to host its core clearing, risk management, and data management applications in a Cloud Infrastructure is consistent with robust risk management, specifically operational risk management, and the promotion of safety and soundness. The Commission believes that, when supported by the appropriate legal agreements and system configurations, OCC's proposed Cloud Infrastructure may provide opportunities for improvements in resiliency, security, and scalability compared to infrastructures in traditional, on-premises data centers. Based on a careful review of the complete record, including the confidential information provided by OCC, the Commission believes the proposed systems architecture—comprising of a virtual multi-zone Cloud Infrastructure, with an on-premises data center as a physical backup—would provide a level of security and resiliency to the OCC's applications beyond that provided by OCC's current on-premises-only infrastructure. The Commission further believes that the legal agreements underlying the relationship between OCC and the CSP are designed to support OCC's ability to comply with its regulatory obligations related to the management of operational risk. Additionally, the inclusion of an on-premises backup provides an additional layer of redundancy to mitigate the low-probability risk of a multi-region outage at a single CSP.

Moreover, the Commission believes that, to the extent the proposed changes are consistent with promoting OCC's robust risk management as well as safety and soundness, they are also consistent with supporting the stability of the broader financial system. OCC has been designated as a SIFMU, in part, because its failure or disruption could increase the risk of significant liquidity or credit problems spreading among financial institutions or markets. The Commission believes that the proposed changes would support OCC's ability to continue providing services to the U.S. options markets by establishing multiple backup systems across the proposed Cloud Infrastructure and an on-premises backup while also allowing OCC to quickly set up additional capacity or applications as necessary. OCC's continued operations would, in turn, help support the stability of the financial system by reducing the risk of significant operational problems spreading among market participants that rely on OCC's central role in the options market.

Accordingly, and for the reasons stated above, the Commission believes the changes proposed in the Advance Notice are consistent with Section 805(b) of the Clearing Supervision Act.

B. Consistency With Rule 17Ad-22(e)(17)(ii) Under the Exchange Act

Rule 17Ad-22(e)(17)(ii) under the Exchange Act requires that a covered clearing agency establish, implement, maintain, and enforce written policies and procedures reasonably designed to manage the covered clearing agency's operational risks by ensuring that systems have a high degree of security, resiliency, operational reliability, and adequate, scalable capacity.

As described in Section II.A. above, OCC proposes to increase the resiliency of its systems by migrating from two on-premises data centers to two separate, logically isolated Virtual Private Clouds with an on-premises backup data center. As described in Section II.B. above, OCC proposes to expand its existing physical and cyber security program with a focus on: (i) access controls; (ii) data governance; (iii) configuration management; and (iv) testing, as well as the implementation of additional tools not currently available for use in OCC's on-premises data centers. As described in Section II.C. above, operating in a Cloud Infrastructure would allow OCC to quickly scale resources to meet elevated trade volumes as well as run risk management processes, such as backtesting, more quickly than is currently possible.

Accordingly, the Commission believes that the changes proposed in the Advance Notice are consistent with Rule 17Ad-22(e)(17)(ii) under the Exchange Act.

IV. Conclusion

It is therefore noticed, pursuant to Section 806(e)(1)(I) of the Clearing Supervision Act, that the Commission does not object to Advance Notice (SR-OCC-2021-802), as modified by Partial Amendments No. 1, 2, 3, and 4 and that OCC is authorized to implement the proposed change as of the date of this notice.