How does the firm test its systems resilience?

A: DTCC's Business Continuity Program oversees operational and technical walkthroughs, tabletops, and simulations, including Disaster Recovery exercises, Work Area Recovery exercises, loss of critical or key third-party service provider exercises, and crisis management tabletops.

What is the firm’s approach to cyber response planning?

A: The firm has worked to assess and enhance its ability to respond and recover from a wide range of events, including those with a large impact on the integrity and availability of data. This approach is built on scenario impact, timely and appropriate communication, as well as a rapid and safe recovery.

What tools does DTCC have in place to ensure continuity of its critical services?

A: Resiliency is first and foremost for DTCC in respect to ensuring business continuity for its critical processes. These tools include automated system health alerting and monitoring, recovery playbooks, cross regional system rotation and failover and fallback capabilities. In the event that a critical process were not able to be resolved in a timely fashion, DTCC has a suite of ad hoc functional capabilities designed to direct the firm and clients to the most optimal outcome, such as Response Capabilities.

How does DTCC plan to restore its business data in the event it was either corrupted or destroyed across multiple regions?

A: In the event of an incident with a large-scale data impact, the firm has developed capabilities to resume services in an efficient and secure manner by restoring business data to an earlier point-in-time. The firm along with client input determined the industry would be best served by reverting to a defined point in time within the same business day, where the data is known to be accurate.

Do clients and other external parties have a role to play in DTCC’s response and recovery from an incident with a large-scale data impact?

A: Such an event could create significant business impacts, including the possibility of discrepancies with clients’ books and records due to corruption or destruction of data. In such scenarios, help from clients will be needed in order to reconcile books and records as well as validate and replay data. In order to prepare for these types of events, DTCC has defined external tools to allow clients to help with this reconciliation and is detailed in DTCC's Disaster Recovery Guide.

Given DTCC’s unique position in the industry, what key assumption(s) has the firm defined in its resumption of service following an impactful event?

A: DTCC’s primary goal is to minimize impact to members in the event of an outage, and with that in mind, the firm established that once settlement has occurred and the day is complete, the position record for that business day is considered final. In order to allow the industry to continue to operate, the firm established a “fall forward” procedure, where any prior settlement day’s activity remains unchanged, and errors would be corrected through adjustments in future settlement cycles.

Why does DTCC have a Disconnect and Reconnect rule?

A: DTCC’s Disconnect and Reconnect rule is designed to protect DTC, NSCC, and FICC, three Systemically Important Financial Market Utilities (SIFMUs) and, more broadly, the financial services ecosystem from the risks posed by cyber threats. In our interconnected environment, a cybersecurity incident at one firm can quickly impact others. This rule lets us act quickly to contain threats, keeping both DTCC systems and our clients safe.

What triggers a potential disconnect?

A: We may disconnect a firm's access to our services when we have concerns that a client or third party have been impacted by a cybersecurity threat that may pose risk to our SIMFUs’ infrastructure or other clients. For instance, if a firm is experiencing an active cyberattack or has suffered a security breach without knowing its full impact. These measures are not meant to be punitive; rather, they are designed to protect the SIMFUs, their members, and the securities industry from broader risks such as a compromise of sensitive information, invalid trades, inaccurate reconciliations, etc. It is recognized that many organizations have made significant investments in compensating controls and monitoring capabilities. These may be considered in assessing the scenario and recommended decisions.

What should firms do if they detect a security incident?

A: If a firm detects a security incident, immediate action and proactive communication with DTCC is vital. Begin by containing the incident, then notify us as soon as possible. Firms are required to report a security incident to DTCC immediately, but in any case, no longer than 2 hours from the discovery of the event. Next, assess the scope and potential impact the incident might have on your connectivity to our systems and data integrity and thoroughly document your response and remediation efforts. During the notification process, be prepared to share all relevant details so we can quickly assess what’s happening and respond effectively. Throughout the process, coordinate closely with DTCC on any protective measures that need to be taken. Being transparent about security incidents and providing timely updates helps us work together to safeguard the entire ecosystem and may even prevent the need for disconnection.

What is the preferred method to report a cyber event or outage to DTCC?

A: You can report a cyber event or outage to DTCC through several channels: the Cyber Event Hotline: +1 (212) 855-1086, or via MyDTCC Portal submissions (portal.dtcc.com).

How does disconnection help protect the industry?

A: There are several reasons DTCC may or may not choose to disconnect from an impacted firm. Disconnection serves as a tool to help protect the industry from cyber threats, acting much like a circuit breaker. It doesn’t always require the complete severing of all connections; instead, it allows for selective isolation based on risk levels. By disconnecting only those links that may pose the highest risk, a impacted firm can be effectively contained without disrupting all operations. This approach helps prevent the spread of security threats, safeguards sensitive market information, and maintains the stability of vital clearing and settlement functions. By containing issues before they escalate, disconnection reinforces the overall safety and resilience of the financial services network and the broader market.

What are the steps DTCC takes to evaluate an impacted entity?

A: Here’s what happens:

• Notice, Investigate and Assess: DTCC learns of a major system event and initiates its incident management processes.
• Evaluate Risk: DTCC gathers information and develops an impact analysis.
• Decide and Authorize: If a decision is made to disconnect an impacted firm, the DTCC Executive Committee can authorize it with approval from at least two voting members. If sufficient and robust information from the client is not provided, and DTCC is unable to make an informed decision regarding the risk, DTCC may proceed with disconnecting the impacted firm based on the lack of necessary information.
• Entity Notification and Isolation: DTCC sends a notice to the impacted firm and access to SIMFU services is suspended immediately to contain any threat.

What is required to reconnect to DTCC services?

A: The impacted firm has restored affected networks to a known trusted state that is appropriately protected and can demonstrate the integrity of remediated systems, data, and other components as required. The impacted firm should provide detailed testing information to validate integrity at every stage of the process. DTCC would expect that a third-party assessment is completed to verify at a minimum:

• Industry best practice protections are deployed, tested and in place to minimise a recurrence of the compromise.
• Patching is updated across systems to minimize chance of reoccurrence.
• Implement additional cybersecurity controls where appropriate.
• Enable enhanced monitoring to detect whether the issue might occur elsewhere in the network.

Prior to recommending a reconnection, the impacted firm must first confirm in writing that any immediate threats have been fully contained and eliminated. The attestion should state that the impacted firm is, to the best of their knowledge, ready to resume normal operations. The attestation should include that assurance and integrity tests have been performed on the services, applications, systems, back-up systems and network to validate and certify all systems as operational and functioning normally. If applicable, the impacted firm should include information on any issues the firm has not completely recovered from as well as an outline of lessons learned and planned enhancements made to prevent similar incidents in the future. We also expect a commitment to ongoing monitoring and compliance moving forward in the attestation.

Once a recommendation is made to reconnect a firm and DTCC’s Executive Committee approves, DTCC and the firm will work together to begin reconnection, send test messages or transactions to ensure everything is working properly, then begin restoration of connections and services.

How can my firm avoid being disconnected?

A: Prevention starts with strong cyber hygiene: maintain robust endpoint and network protection; keep systems patched and up to date; and conduct regular security assessments and penetration tests. Monitor for anomalies, develop and test incident response plans, train staff on cybersecurity, use multi-factor authentication and access controls and have secure backup and recovery capabilities. Respond promptly to our security advisories, report incidents immediately, participate in industry-wide security initiatives and, above all, stay vigilant and prioritize cybersecurity.

If my firm is impacted, what information does DTCC need immediately?

A: We’ll ask for:

• Legal Entity Name information for all affected entities and affiliates.
• Details on business impact, including size, market implications, outstanding positions, liquidity, counterparties and DTCC services used.
• Infrastructure impact, including network connection points, DTCC portal access and types of data exchanged.
• Major System Event details, including type and scale of issue, when it was identified and actions already taken.
• Contact Information, so we can remain in contact in the event there’s a loss of phone or email in your environment.

How does DTCC work with my firm’s CISO during a cyber incident?

A: DTCC’s CISO (or their delegate) will communicate directly with your CISO to fully understand the incident’s scope and containment status. This technical discussion helps DTCC assess the current risk and informs the recommendation for any necessary disconnection.

If my firm is disconnected, can DTCC assist in helping to process outstanding transactions?

A: Following a disconnect decision, DTCC will look to minimize the impact to the broader industry by working with the impacted firm on any outstanding transactions or obligations. Prior to processing any transactions on behalf of the impacted firm, DTCC will require an indemnification letter signed by the firm’s senior leadership. This document acknowledges the situation and authorizes our support teams to proceed, ensuring clarity and alignment for all parties.

Who should my firm contact with questions about DTCC’s Disconnect and Reconnect policies?

A: If you have any questions, please reach out to your DTCC relationship manager or the DTCC Client Services team.