Part Part 8A - ASIC Market Integrity Rules (Securities Markets) 2017 - Market operators—Critical Business Services, Information Security and Business Continuity Plans | Zoe
Chapter 8A: Market operators—Critical Business Services, Information Security and Business Continuity Plans
Part 8A.1 Application and Definitions
8A.1.1 Application of Chapter
This Chapter applies to:
(a) the operator of a Market on or through which offers to acquire or dispose of Equity Market Products are made or accepted; and
(b) the operator of a CGS Market.
8A.1.2 Definitions
In this Chapter:
Business Continuity Plans has the meaning given by Rule 8A.5.1.
Critical Business Services, in relation to an Operator, means functions, infrastructure, processes or systems which in the event of failure to operate effectively, would or would be likely to cause significant disruption to the Operator’s Market Operations or materially impact the Operator’s Market Services.
Note: Critical Business Services referred to in this definition would generally include but are not limited to, functions, infrastructure, processes and systems that deliver or support order entry, routing and matching, trade execution, dissemination of market data, trading risk management, market surveillance, reporting of executed trades to a clearing and settlement facility and regulatory data reporting.
Critical Business Services Arrangements has the meaning given by Rule 8A.3.1.
Incident has the meaning given by subparagraph 8A.5.1(6)(a)(i).
Information Asset means information and information technology, including software, hardware and data (both soft and hard copy).
Major Event has the meaning given by Rule 8A.5.1.
Market Operations, in relation to an Operator, means the operations, activities and conduct of the Operator’s Market or CGS Market (as the case may be) or of the Operator in connection with that Market or CGS Market.
Market Services, in relation to an Operator, means the services, data and associated products provided by the Operator in connection with the Operator’s Market or CGS Market (as the case may be).
Operator means an operator referred to in paragraph 8A.1.1(a) or (b).
Outsourcing Arrangement means an arrangement between an Operator and another person (Service Provider) under which the Service Provider will provide, operate or support one or more of the Operator’s Critical Business Services.
Participant means a Participant of a Market referred to in paragraph 8A.1.1(a) or of a CGS Market.
Service Provider has the meaning given in the definition of Outsourcing Arrangement.
Part 8A.2 Trading controls
8A.2.1 Operator to have trading controls
An Operator must have controls, including automated controls, that enable immediate suspension, limitation or prohibition of the entry by a Participant of Trading Messages where required for the purposes of ensuring the Market or CGS Market (as the case may be) is fair, orderly and transparent.
Part 8A.3 Critical Business Services
8A.3.1 Resilience, reliability, integrity and security
Adequate arrangements
(1) An Operator must have adequate arrangements (Critical Business Services Arrangements) to ensure the resilience, reliability, integrity and security of its Critical Business Services.
Note: Arrangements referred to in subrule (1) would generally include, but are not limited to, policies, procedures and organisational resources including financial, human and technological resources.
(2) Without limiting subrule (1), an Operator’s Critical Business Services Arrangements must include arrangements for:
(a) identifying Critical Business Services; and
(b) identifying, assessing, managing and monitoring for any risks to the resilience, reliability, integrity and security of Critical Business Services; and
(c) ensuring Critical Business Services have sufficient and scalable capacity for ongoing and planned Market Operations and Market Services; and
(d) preventing unauthorised access to or use of Critical Business Services; and
(e) managing the implementation of new Critical Business Services and of changes to existing Critical Business Services in accordance with Rule 8A.3.2; and
(f) dealing with a Major Event in accordance with Part 8A.5 of these Rules; and
(g) managing Outsourcing Arrangements in relation to Critical Business Services in accordance with Rule 8A.3.3.
Review and change of arrangements
(3) An Operator must undertake a review of its Critical Business Services Arrangements:
(a) following each material change to its Critical Business Services; and
(b) at least once every 12 months,
and apply recommended changes to the Critical Business Services Arrangements arising from the review to ensure they comply with subrules (1) and (2).
Documentation of arrangements
(4) An Operator must document:
(a) its Critical Business Services Arrangements; and
(b) the scope and results of each review performed in accordance with subrule (3); and
(c) any changes applied to the Critical Business Services Arrangements as a result of the review or otherwise,
and must maintain that documentation for a period of at least seven years from the later of the date it is created or the date it is last amended.
8A.3.2 Change management for Critical Business Services
(1) An Operator must have adequate arrangements to ensure that its Critical Business Services Arrangements continue to comply with subrule 8A.3.1(1) following the implementation of a new Critical Business Service or of a change to an existing Critical Business Service.
(2) Without limiting subrule (1), the arrangements referred to in that subrule must include arrangements for:
(a) testing new Critical Business Services or material changes to existing Critical Business Services before implementation; and
(b) communicating with persons that may be materially impacted by the implementation for the purposes of ensuring those persons are adequately informed about the nature, timing and impact of the implementation a reasonable time before it occurs; and
(c) ensuring, to the extent reasonably practicable, that persons that may be materially impacted by the implementation are adequately prepared for the implementation before it occurs.
Note: Persons that may be materially impacted by the implementation may include ASIC, Participants, other Operators and the operators of licensed clearing and settlement facilities.
(3) Without limiting paragraph (2)(b), an Operator must give written notice of the proposed implementation to ASIC a reasonable time before the implementation.
8A.3.3 Outsourcing of Critical Business Services
(1) An Operator that enters into an Outsourcing Arrangement must:
before entering into the Outsourcing Arrangement, conduct due diligence enquiries for the purposes of ensuring the Service Provider has the ability and capacity to provide the services covered by the Outsourcing Arrangement effectively; and
ensure that the Outsourcing Arrangement is contained in a documented legally binding agreement between the Operator and the Service Provider that:
sets out the nature, scope and quality of the services to be provided under the Outsourcing Arrangement; and
requires the Service Provider to give written notice to the Operator before the Service Provider:
enters into any arrangement with another person (Sub-Contractor) under which the Sub-Contractor will provide services material to the provision by the Service Provider of the services covered by the Outsourcing Arrangement; and
makes any other material change to the manner in which the services covered by the Outsourcing Arrangement are provided; and
deals with the circumstances and manner in which the Outsourcing Arrangement may be terminated; and
provides for the orderly transfer of services provided under the Outsourcing Arrangement to the Operator or another Service Provider in the event of termination of the Outsourcing Arrangement; and
while the Outsourcing Arrangement is in place, monitor the performance of the Service Provider for the purposes of ensuring the Service Provider is providing the services covered by the Outsourcing Arrangement effectively and has the ability and capacity to continue to provide those services effectively; and
have in place adequate arrangements to:
identify any conflicts of interest between the Operator and the Service Provider, including conflicts involving Sub-Contractors and related entities of the Operator, Service Provider and any Sub-Contractor; and
manage any conflicts of interest which have been identified or could arise; and
have in place adequate arrangements to ensure the Operator is able to comply with its obligations under the Act and these Rules in relation to the Critical Business Services the subject of an Outsourcing Arrangement including, without limitation, arrangements with the Service Provider to:
(i) ensure the resilience, reliability, integrity and security of those Critical Business Services in accordance with Rule 8A.3.1; and
(ii) ensure the confidentiality, integrity and availability of information obtained, held or used by the Operator in relation to those Critical Business Services in accordance with Part 8A.4 of these Rules; and
(iii) deal with a Major Event in accordance with Part 8A.5 of these Rules; and
Note: Such arrangements may include, without limitation, requirements on the Service Provider to:
Note: (a) protect technology from security breaches and cyber-incidents; and
Note: (b) protect proprietary and client-related information and software; and
Note: (c) protect confidential, market-sensitive and personal information from intentional or inadvertent disclosure to unauthorised individuals; and
Note: (d) establish, implement and maintain emergency procedures and a plan for disaster recovery with periodic testing of backup facilities.
ensure that the Operator and its auditors are able to promptly, upon request, access books, records and other information of the Service Provider relating to the Critical Business Services; and
ensure that ASIC has the same access to all books, records and other information relating to the Critical Business Services and maintained by the Service Provider, that ASIC would have if not for the Outsourcing Arrangement; and
ensure that for each Outsourcing Arrangement, the Operator’s Board or a director or senior manager have confirmed that they have complied with the Operator’s obligations in this subrule and made a written attestation to that effect.
(2) The Operator must comply with subrule (1) in a manner that is appropriate to:
the nature, complexity and risks of the Outsourcing Arrangement; and
the materiality of the Outsourcing Arrangement to the Operator’s Market Operations and Market Services.
(3) In determining for the purposes of subrule (1) whether the Service Provider has the ability and capacity to provide the services covered by the Outsourcing Arrangement effectively, the Operator must take into account the extent to which the Service Provider is providing the same or similar services to other Operators and Participants.
(4) An Operator must give written notice to ASIC as soon as practicable after the Operator enters into an Outsourcing Arrangement, and in any event no later than 20 business days after entering into the Outsourcing Arrangement.
Part 8A.4 Information security
8A.4.1 Information security
(1) An Operator must have adequate arrangements to ensure the confidentiality, integrity and availability of information obtained, held or used by the Operator in relation to its Market Operations and Market Services.
(2) Without limiting subrule (1), the arrangements referred to in that subrule must include:
arrangements to identify and document Information Assets that are integral to the provision of the Operator’s Market Operations and Market Services; and
controls, including automated controls, designed to prevent unauthorised access to Information Assets; and
controls for identifying, assessing, managing and monitoring for unauthorised access to Information Assets; and
arrangements designed to protect Information Assets from theft, loss or corruption.
(3) An Operator must have adequate arrangements to ensure the availability of access to data obtained, held or used by the Operator in its Market Operations and Market Services.
(4) Without limiting subrule (3), the arrangements referred to in that subrule must include arrangements designed to provide for the backup of the data and the timely recovery of the data in the event of any theft, corruption or loss of the data.
(5) An Operator must notify ASIC in writing, as soon as possible and, in any case, no later than 72 hours, after becoming aware of any:
unauthorised access to or use of its Critical Business Services that impacts the effective operation or delivery of those services; or
unauthorised access to or use of market-sensitive, confidential or personal information.
Part 8A.5 Business Continuity Plans
8A.5.1 Business continuity
Business Continuity Plans
(1) An Operator must establish, implement and maintain plans (Business Continuity Plans) for effectively responding to an event (Major Event) that would or would be likely to cause significant disruption to the Operator’s Market Operations or materially impact the Operator’s Market Services.
Note: A Major Event may include the failure of or disruption to a Critical Business Service, including one operated by a Service Provider, or an event such as a pandemic or influenza event, natural disaster, cyber-attack or power failure.
(2) An Operator’s Business Continuity Plans must be designed to enable:
(a) continuity of the usual operation of the Operator’s Critical Business Services, Market Operations and Market Services during a Major Event; and
(b) to the extent continuation of the usual operation of the Operator’s Critical Business Services, Market Operations and Market Services during a Major Event is not possible, timely and orderly restoration of those usual operations following the Major Event.
(3) An Operator’s Business Continuity Plans must be appropriate to the nature, scale and complexity of the Operator’s Critical Business Services, Market Operations and Market Services and to the Operator’s structure and location.
(4) Without limiting subrules (1) to (3), the Operator’s Business Continuity Plans must identify and address:
the types of Major Events that may impact the Operator’s Critical Business Services, Market Operations and Market Services; and
activation procedures including trigger conditions for enacting the Operator’s Business Continuity Plans; and
the potential impact Major Events may have on the Operator’s Critical Business Services, Market Operations and Market Services; and
the classification of types of Major Events according to the potential severity of the impacts referred to in paragraph (c); and
escalation procedures that are appropriate to the classification referred to in paragraph (d); and
the actions, arrangements and resources required to achieve the outcomes referred to in subrule (2); and
Note: The actions, arrangements and resources covered by this paragraph would include key operational functions and processes, staff, alternate suppliers/service providers, technology, alternative premises and other physical infrastructure.
specific objectives for the time taken to achieve the outcomes referred to in paragraph (2)(b); and
procedures for communicating during a Major Event with persons that may be impacted by the Major Event, for the purposes of ensuring those persons are adequately informed about:
(i) the nature and impact of the Major Event; and
(ii) the steps that are being taken or will be taken to manage the Major Event; and
(iii) the likely timing of the steps referred to in subparagraph (ii); and
(iv) the likely timing of the resumption of the usual operation of the Operator’s Critical Business Services, Market Operations and Market Services; and
any operational dependencies between the Operator and any other person that may affect the matters referred to in paragraphs (a) to (h).
(5) Without limiting paragraph (4)(i), an Operator must have in place adequate arrangements to ensure that the Operator is able to carry out its Business Continuity Plans with respect to any Critical Business Services the subject of an Outsourcing Arrangement.
Notification of an Incident or Major Event
(6) Without limiting paragraph (4)(h), an Operator must:
notify ASIC immediately upon becoming aware of:
an unexpected disruption to the usual operation of the Operator’s Critical Business Services that may interfere with the fair, orderly or transparent operation of any Market or CGS Market (Incident); or
(ii) a Major Event; and
notify other Operators, operators of Clearing Facilities and Participants that may be impacted by an Incident or a Major Event, as soon as practicable after becoming aware of the Incident or Major Event.
(7) If a notification is made under subrule (6), the Operator must within seven days of the notification provide ASIC with a written report detailing:
the circumstances of the Incident or Major Event; and
the steps taken to manage the Incident or Major Event.
Review, update and testing of plans
(8) An Operator must:
review and test its Business Continuity Plans and the arrangements referred to in subrule (5):
at a frequency and in a manner appropriate to the nature, scale and complexity of the Operator’s Critical Business Services, Market Operations and Market Services and to the Operator’s structure and location; and
at a minimum:
each time there is a material change to the Operator’s Critical Business Services, Market Operations and Market Services or to the Operator’s structure and location; and
as soon as practicable after the occurrence of a Major Event; and
once every 12 months; and
update the Business Continuity Plans as required to ensure they comply with subrules (1) to (4).
Documentation of plans and testing
(9) An Operator must document:
its Business Continuity Plans; and
the scope and results of all reviews and testing performed in accordance with subrule (8),
and must maintain that documentation for a period of at least seven years from the later of the date it is created or the date it is last amended.
Part 8A.6 Governance
8A.6.1 Responsibility for compliance
(1) An Operator must have appropriate governance arrangements and adequate financial, technological and human resources to comply with its obligations under this Chapter 8A.
(2) Without limiting subrule (1), the arrangements referred to in that subrule must include arrangements for the Operator’s Board or senior management to have oversight of the establishment, implementation, maintenance, review, testing and documentation of the Operator’s Business Continuity Plans.