Federal Register #SR-OCC-2026-010

SEC Notice on OCC Proposed Cybersecurity Rule Changes

The SEC notice concerns proposed cybersecurity rule changes by The Options Clearing Corporation, not a request to buy products or services. - Government agency: U.S. Securities and Exchange Commission (SEC), which published the notice. - Organization proposing the changes: The Options Clearing Corporation (OCC), which proposes revisions to Rule 213, Cybersecurity Obligations. - Proposed changes: - Define a Major Clearing Member System Event and strengthen member incident-reporting requirements. - Clarify OCC’s authority to assess incidents and disconnect members or their third-party service providers. - Allow OCC to notify third-party providers or require members to notify them. - Add reporting, testing, approval, and governance requirements before reconnection. - Procurement scope: No products, services, quantities, part numbers, OEMs, or commercial vendors are identified.

Description

The Options Clearing Corporation proposes to amend OCC Rule 213—Cybersecurity Obligations to enhance security protocols and strengthen its approach to cybersecurity risk management. The changes include establishing a Major Clearing Member System Event, updating incident notification and OCC response authority, and enabling OCC to notify or require notification of a member’s third-party service provider. The proposal also adds requirements and processes for reporting, testing, approval, and reconnection after a cybersecurity-related disconnection. The Securities and Exchange Commission is soliciting comments on the proposed rule change.

View original listing