For example,  since our 2003 report, all of the seven critical organizations we reviewed  reduced risks by adding physical barriers around their facilities, enhancing  protection from hackers, or establishing geographically diverse backup  facilities. Critical Organizations Improved Their Ability to Recover from Disruptions, but Some Faced Limitations That Increased Risks

All the critical organizations had also further increased their ability to  recover from attacks or other disasters since our 2003 report, but some still  had limitations in their business continuity capabilities that increased their  risk of disruption. The organizations  also took actions to identify and mitigate their respective risks. For example, to address the potential for a region-wide disruption in New  York City, one firm was developing a geographically diverse backup center. However, four of these firms were at greater risk of a disruption to their  trading operations than other firms because of the concentration of key  trading staff in a single location at the same time. New Private Telecommunications Network Created for Financial Market Participants

Responding to the challenges of maintaining diversity, one financial market  participant has acted to improve the resiliency of the telecommunications  services supporting the financial industry. SEC Has Not Fully Analyzed Capabilities of Trading Firms to Resume Operations

Although the actions securities and banking regulators have taken will  likely improve the preparedness of the securities markets to withstand  future disruptions, SEC has not conducted the comprehensive assessments  that would allow it to better ensure that trading in the securities markets  could promptly resume following a wide-scale disaster. Although SEC had taken some steps to assess broker-dealer readiness, it  had not done a systematic analysis to determine whether sufficient  numbers of firms would be capable of resuming trading within regulators’  current expectations. SEC staff also said that a recent reorganization within its Division of  Market Regulation also improved program effectiveness. Conclusions

The securities market organizations we reviewed all had reduced the risk  that their operations would be disrupted by terrorist attacks or other  disasters. However, as of May 2004, a number of the critical financial market  organizations and the broker-dealers and banks that conduct significant  trading activities remained at a greater risk of disruption than others from a  wide-scale event because they lacked certain business continuity  capabilities. Nevertheless, SEC has not fully  assessed whether or not sufficient numbers of firms with staff capable of  trading securities would to be ready to operate after a wide-scale disaster. Such steps  would include assessing whether the placement of the program within  SEC’s organizational structure is optimal for ensuring that it has adequate  resources and staff expertise. In addition, to improve the effectiveness of SEC’s ARP program, which  oversees preparedness of securities trading and clearing organizations for  future disasters, we recommend that the Chairman, SEC, take the following  three steps to enhance the ARP program’s effectiveness:   Establish a definite time frame for the submission of a rule requiring  exchanges and clearing organizations to engage in activities consistent  with the operational practices and other tenets of the ARP program;  Assess the adequacy of ARP staffing in terms of positions and technical  skill levels, including information security expertise, given its mission  and workload; and   Continue to assess the organizational alignment of the ARP program  within SEC. Specifically, we assessed (1) actions that critical  securities market organizations and key market participants undertook to  reduce their vulnerabilities to physical or electronic attacks and to improve  their business continuity capabilities; (2) steps that financial market  participants, telecommunications industry organizations, and others took  to improve the resiliency of telecommunications systems and  infrastructure; (3) financial regulators’ efforts to ensure the resiliency of  the financial markets; and (4) the progress the Securities and Exchange  Commission (SEC) has made in improving its Automation Review Policy  program, which oversees security and operations issues at exchanges,  clearing organizations, and electronic communications networks (ECN). Potential Terrorist Attacks: Additional Actions Needed to Better Prepare  Critical Financial Market Participants.
Why GAO Did This Study

In February 2003 reports, GAO identified actions needed to better prepare critical financial market participants for wide-scale disasters, such as terrorist attacks. To determine progress made since then, GAO assessed (1) actions that critical securities market organizations took to improve their ability to prevent and recover from disruptions, (2) actions that financial market and telecommunications industry participants took to improve telecommunications resiliency, (3) financial regulators' efforts to ensure the resiliency of the financial markets; and (4) SEC's efforts to improve its program for overseeing operations risks at certain market participants.

What GAO Found

The critical securities market organizations and market participants GAO reviewed had taken actions, since GAO's previous reports, to further reduce the risk that their operations would be disrupted by terrorist attacks or other disasters. For example, they had added physical barriers, enhanced protection from hackers, or established geographically diverse backup facilities. Still, some entities had limitations that increased the risk that a wide-scale disaster could disrupt their operations and, in turn, the ability of securities markets to operate. For example, three organizations were at a greater risk of disruption than others because of the proximity of their primary and backup facilities. In addition, four of the eight large trading firms GAO reviewed had all of their critical trading staff in single locations, putting them at greater risk than others of a single event incapacitating their trading operations. Geographic concentration of these firms could leave the markets without adequate liquidity for fair and efficient trading in a potential disaster. Since GAO last reported, actions were taken to improve the resiliency of the telecommunications service critical to the markets, including creating a private network for routing data between broker-dealers and various markets. Maintaining telecommunications redundancy and diversity over time will remain a challenge. Financial market regulators also took steps that should reduce the potential that future disasters would disrupt the financial markets, such as issuing business continuity guidelines for financial market participants designed to reopen trading markets the next business day after a disruption. However, despite the risk posed by the concentration of broker-dealers' trading staffs, and the lack of regulations requiring broker-dealers' to be prepared to operate following a wide-scale disruption, SEC had not fully analyzed the extent to which these organizations would be able to resume trading following such a disruption. Furthermore, while SEC has made some improvements to the voluntary program it uses to oversee the information security and business continuity at certain critical organizations, it has not taken steps to address key long-standing limitations. Despite past difficulties obtaining cooperation with recommendations and a lack of resources to conduct more frequent inspections, SEC had not proposed a rule making this program mandatory or increased the level of the program's resources--as GAO has previously recommended. In addition, SEC appeared to lack sufficient staff with expertise to ensure that the organizations in the program adequately addressed the issues identified in internal or external reviews, or to identify other important opportunities for improvement. Although SEC staff continue to assess the impact of a recent reorganization involving the programs staff, whether the current placement of the program within SEC is adequate for ensuring that the program receives sufficient resources is not yet clear.