These capabilities  include having backup operating sites that have staff capable of  performing the organizations’ critical tasks and that are geographically  distant from their primary operating locations. In addition, two organizations have increased  their recovery capabilities by establishing sites hundreds of miles from the  primary site that are capable of monitoring and operating critical networks  at the primary location. Although Some Challenges Remain, Organizations also Have Acted to Reduce Physical Security and Information Security Vulnerabilities

The seven critical market organizations have continued to implement  physical security measures to reduce the potential for physical attacks on  their facilities. Broker-Dealers and Banks Have Reduced Risk of Disruption in Clearing Activities and Continue to Address Risks to Trading Activities

Since our 2004 report, the banks and broker-dealers that are key  participants in the U.S. securities markets have made considerable  progress in improving their resiliency, but certain wide-scale disasters  could significantly disrupt their ability to conduct trading activities. In response to expectations by financial regulators, since the 2001 attacks  these broker-dealers and banks have improved the resiliency of their  clearing and settling operations by increasing the geographic distance  between the primary and backup sites that conduct such operations. Financial regulators also have been promoting regional coalitions to  improve information sharing and response during disasters. SEC staff also plan to do more  focused reviews of broker-dealer trading readiness. SEC also has taken  actions to improve the ARP program that it uses to oversee systems  operations issues at the markets and clearing organizations, including  increasing staffing levels and expertise and preparing a rule mandating  compliance with the ARP program’s tenets for which it expects to seek  approval during 2007. Regulators Are Actively Addressing Pandemic Planning, but Additional Actions Could Improve Readiness

Banking and securities regulators have been working to assist market  participants’ pandemic planning efforts, but have not taken other actions  that could better assure that market participants adequately prepare for a  pandemic. Regulators Have Worked to Ensure That Trading Activities Will Resume After a Disaster, and Plan to Examine Broker-Dealer Readiness More Fully

Although broker-dealers are not required to be able to resume operations  after disasters, securities regulators have issued some guidance and  conducted some assessments of firms’ readiness to trade. Recommendation for Executive Action

To increase the likelihood that the securities markets will be able to  function during a pandemic, we recommend that the Chairman, Federal  Reserve; the Comptroller of the Currency; and the Chairman, SEC,  consider taking additional actions to ensure that market participants  adequately prepare for an outbreak, including issuing formal expectations  that business continuity plans for a pandemic should include measures  likely to be effective even during severe outbreaks, and setting a date by  which market participants should have such plans. Appendix I: Objectives, Scope, and Methodology

The objective of this report is to describe the progress that financial  markets participants and regulators have made since our 2004 report in  ensuring the security and resiliency of our securities markets. Specifically,  we assessed (1) actions critical securities market organizations and key  market participants have taken to improve their business continuity  capabilities for recovering from physical or electronic attacks and the  security measures they use to reduce their vulnerabilities to such events;  (2) actions taken by financial market participants, telecommunications  industry organizations, and others to improve the ability of participants to  respond to future disasters and increase the resiliency of the  telecommunications on which the markets depend; and (3) financial  regulators’ efforts to ensure the resiliency of the financial markets,  including SEC’s progress in improving its securities market organization  oversight program.
Why GAO Did This Study

This is GAO's third report since the September 11 terrorist attacks that assesses progress that market participants and regulators have made to ensure the security and resiliency of our securities markets. This report examined (1) actions taken to improve the markets' capabilities to prevent and recover from attacks; (2) actions taken to improve disaster response and increase telecommunications resiliency; and (3) financial regulators' efforts to ensure market resiliency. GAO inspected physical and electronic security measures and business continuity capabilities using regulatory, government, and industry-established criteria and discussed improvement efforts with broker dealers, banks, regulators, telecommunications carriers, and trade associations.

What GAO Found

The critical securities markets organizations GAO reviewed have acted to significantly reduce the likelihood of physical disasters disrupting the functioning of U.S. securities markets. As of January 2007, the seven critical exchanges, markets, clearing organizations, and payment processors GAO reviewed have the capability of performing their critical functions at sites that are geographically dispersed from their primary sites. These organizations were also preparing plans to reduce the likelihood that a disease pandemic will disrupt their critical operations, although not all had fully completed such efforts. They also improved their physical and information security measures, including by taking actions that GAO identified during this review. Although key securities trading staff remain concentrated in single locations, the broker-dealers and clearing services banks that account for significant trading volumes and that GAO reviewed have increased the distances between their sites for primary and backup operations for clearance and settlement activities and established dispersed backup trading locations. Various private and public sector groups continued to enhance the preparedness of the financial sector, although resolving vulnerabilities in the telecommunications infrastructure remains a challenge. Securities industry organizations have continued to conduct annual industrywide tests of financial market participants' backup site operating capabilities, and key trading and clearing organizations are increasingly using communications networks that are less vulnerable to disruption to transmit information. After attempts to assist individual financial market participants to determine whether their own telecommunications lines were routed through single paths or switches proved difficult, regulators are assisting efforts to develop automated systems for identifying circuit paths. In response to concerns over whether the telecommunications infrastructure can absorb the increased demand likely to result from large numbers of organizations and individuals seeking to telecommute during a pandemic, financial regulators and market participants are assisting government efforts to model such events and develop potential solutions. To improve market resiliency, financial regulators established goals for prompt recovery of critical clearing activities after disasters and have been conducting examinations to ensure market participants' compliance. Securities regulators also set goals and are examining securities markets' readiness to resume trading and plan to do more focused reviews of individual broker-dealer capabilities. The Securities and Exchange Commission (SEC) also has improved its program for overseeing operations issues at market and clearing organizations, including increasing its staffing levels and expertise. Securities and banking regulators have been actively addressing pandemic issues, but could better ensure that market participants prepare complete plans and have sufficient time to train employees and test these plans, by providing formal expectations that plans address even severe outbreaks and set dates for completing such plans.