CFTC System Safeguards (17 CFR 37, 38, 39, 49)

United States (CFTC)

v2023 (final rule amendments to Parts 37, 38, 39, and 49)

4 domains

21 controls

The Commodity Futures Trading Commission (CFTC) System Safeguards rules (17 CFR Parts 37, 38, 39, and 49) establish comprehensive cybersecurity, business continuity, incident reporting, system integrity, and risk management requirements for designated contract markets (DCMs), swap execution facilities (SEFs), derivatives clearing organizations (DCOs), and swap data repositories (SDRs).

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (4)

CFTC System Safeguards: Business Continuity and Disaster Recovery

4 controls

Controls in the CFTC System Safeguards: Business Continuity and Disaster Recovery domain of CFTC System Safeguards (17 CFR 37, 38, 39, 49) — 4 controls
Code	Title	Description
CFTC-SS-10	Geographically Separate Backup Resources	38.1051(c): backup resources/facilities must be sufficiently geographically separate to enable recovery from a wide-scal...
CFTC-SS-11	Business Continuity-Disaster Recovery Testing	38.1051: regular, periodic testing and review of BC-DR capabilities, including coordination with members/participants an...
CFTC-SS-8	Business Continuity-Disaster Recovery Plan and Resources	38.1051(c): maintain a BC-DR plan, resources, emergency procedures and backup facilities sufficient to enable timely rec...
CFTC-SS-9	Recovery Time Objective	38.1051(c): the BC-DR plan must have the goal of enabling resumption of operations by the next business day following a...

CFTC System Safeguards: Cybersecurity Testing

6 controls

Controls in the CFTC System Safeguards: Cybersecurity Testing domain of CFTC System Safeguards (17 CFR 37, 38, 39, 49) — 6 controls
Code	Title	Description
CFTC-SS-13	Vulnerability Testing	38.1051 cybersecurity testing: conduct vulnerability testing of automated systems at a frequency determined by an approp...
CFTC-SS-14	Penetration Testing	38.1051 cybersecurity testing: conduct external and internal penetration testing at a frequency determined by risk analy...
CFTC-SS-15	Controls Testing	38.1051 cybersecurity testing: conduct controls testing (assessment of the system safeguards-related controls) at a freq...
CFTC-SS-16	Security Incident Response Plan Testing	38.1051 cybersecurity testing: maintain and test a security incident response plan at a frequency determined by risk ana...
CFTC-SS-17	Enterprise Technology Risk Assessment	38.1051 cybersecurity testing: conduct an enterprise technology risk assessment at a frequency determined by risk analys...
CFTC-SS-18	Testing by Independent Professionals	38.1051: certain required tests (penetration testing, key controls testing) must be performed by independent contractors...

CFTC System Safeguards: Notification, Records and Remediation

3 controls

Controls in the CFTC System Safeguards: Notification, Records and Remediation domain of CFTC System Safeguards (17 CFR 37, 38, 39, 49) — 3 controls
Code	Title	Description
CFTC-SS-19	Notification to the Commission	38.1051: promptly notify the Commission of any cyber security incident or targeted threat that actually or potentially j...
CFTC-SS-20	Recordkeeping of System Safeguards	38.1051: keep records of the program of risk analysis and oversight, testing, and assessments, and provide them to the C...
CFTC-SS-21	Remediation of Deficiencies	38.1051: identify and remediate deficiencies identified through testing, assessments and reviews in a timely manner.

CFTC System Safeguards: Risk Analysis and Oversight Program

8 controls

Controls in the CFTC System Safeguards: Risk Analysis and Oversight Program domain of CFTC System Safeguards (17 CFR 37, 38, 39, 49) — 8 controls
Code	Title	Description
CFTC-SS-1	Program of Risk Analysis and Oversight	17 CFR 38.1051(a) (and 37.1401(a)/39.18(a)/49.24(a)): a registrant must establish and maintain a program of risk analysi...
CFTC-SS-12	Capacity and Performance Planning	38.1051(a)(4)/(d): controls to monitor systems for adequate scalable capacity, including testing, monitoring and analysi...
CFTC-SS-2	Enterprise Risk Management and Governance	38.1051(a)(1): assessment, mitigation and monitoring of security and technology risk; capital planning; board and manage...
CFTC-SS-3	Information Security	38.1051(a)(2): controls for access to systems and data (least privilege, separation of duties, account monitoring), iden...
CFTC-SS-4	Systems Operations	38.1051(a)(5): system maintenance, configuration management (baseline configuration, change and patch management, least...
CFTC-SS-5	Systems Development and Quality Assurance	38.1051(a)(6): requirements development, pre-production and regression testing, change-management procedures and approva...
CFTC-SS-6	Physical Security and Environmental Controls	38.1051(a)(7): physical access and monitoring; power, telecommunication and environmental controls; fire protection.
CFTC-SS-7	Generally Accepted Standards and Best Practices	38.1051(b): in addressing the risk categories, the registrant must follow generally accepted standards and best practice...

Your Compliance Coverage

If you comply with CFTC System Safeguards (17 CFR 37, 38, 39, 49), you already cover:

NIST Cybersecurity Framework 2.0

43%

9 controls mapped

Compare →

SOC 2

38%

8 controls mapped

Compare →

NIST SP 800-53 Rev 5

38%

8 controls mapped

Compare →

+ 6 more: ISO 27701:2019 (10%), ISO 27017:2015 (5%)

See all 9 mapped frameworks ↓

Maps to 9 other frameworks

21 total controls

NIST Cybersecurity Framework 2.0

9 source controls mapped|5 target controls covered

43%

SOC 2

8 source controls mapped|8 target controls covered

38%

NIST SP 800-53 Rev 5

8 source controls mapped|8 target controls covered

38%

ISO 27701:2019

2 source controls mapped|8 target controls covered

10%

ISO 27017:2015

1 source controls mapped|3 target controls covered

ISO 27005:2022

1 source controls mapped|3 target controls covered

ISO 27018:2019

1 source controls mapped|2 target controls covered

ISO 27002:2022

1 source controls mapped|6 target controls covered

ISO 27001:2022

1 source controls mapped|8 target controls covered

Compare CFTC System Safeguards (17 CFR 37, 38, 39, 49) with NIST Cybersecurity Framework 2.0

Frequently Asked Questions

What is CFTC System Safeguards (17 CFR 37, 38, 39, 49)?

CFTC System Safeguards (17 CFR 37, 38, 39, 49) is a compliance framework from United States (CFTC) with 4 domains and 21 controls. The Commodity Futures Trading Commission (CFTC) System Safeguards rules (17 CFR Parts 37, 38, 39, and 49) establish comprehensive cybersecurity, business continuity, incident reporting, system integrity, and risk management requirements for designated contract markets (DCMs), swap execution facilities (SEFs), derivatives clearing organizations (DCOs), and swap data repositories (SDRs). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does CFTC System Safeguards (17 CFR 37, 38, 39, 49) have?

CFTC System Safeguards (17 CFR 37, 38, 39, 49) has 21 controls organised across 4 domains. The largest domains are CFTC System Safeguards: Risk Analysis and Oversight Program (8 controls), CFTC System Safeguards: Cybersecurity Testing (6 controls), CFTC System Safeguards: Business Continuity and Disaster Recovery (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does CFTC System Safeguards (17 CFR 37, 38, 39, 49) map to?

CFTC System Safeguards (17 CFR 37, 38, 39, 49) maps to 9 other compliance frameworks. The top mapping partners are NIST Cybersecurity Framework 2.0 (43% coverage), SOC 2 (38% coverage), NIST SP 800-53 Rev 5 (38% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with CFTC System Safeguards (17 CFR 37, 38, 39, 49) compliance?

Start your CFTC System Safeguards (17 CFR 37, 38, 39, 49) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CFTC System Safeguards (17 CFR 37, 38, 39, 49) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 21 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 718 frameworks.

Get Started Free →

Free forever — no credit card required