CFTC System Safeguards (17 CFR 37, 38, 39, 49)

United States (CFTC)

v17 CFR 37.1401, 38.1051, 39.18 and 49.24 as in force 2026-08-17

5 domains

39 controls

The Commodity Futures Trading Commission (CFTC) System Safeguards rules (17 CFR Parts 37, 38, 39, and 49) establish comprehensive cybersecurity, business continuity, incident reporting, system integrity, and risk management requirements for designated contract markets (DCMs), swap execution facilities (SEFs), derivatives clearing organizations (DCOs), and swap data repositories (SDRs).

Verified

CFTC System Safeguards (17 CFR 37, 38, 39, 49) is a compliance framework from United States (CFTC) with 5 domains and 39 controls that map to 27 other frameworks. The largest domains are CFTC System Safeguards: Business Continuity and Disaster Recovery (12 controls), CFTC System Safeguards: Cybersecurity Testing (10 controls), CFTC System Safeguards: Risk Analysis and Oversight Program (10 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (5)

CFTC System Safeguards: Business Continuity and Disaster Recovery

12 controls

Controls in the CFTC System Safeguards: Business Continuity and Disaster Recovery domain of CFTC System Safeguards (17 CFR 37, 38, 39, 49) — 12 controls
Code	Title	Description
CFTC-SS-10	Geographic Dispersal of Backup Infrastructure and Personnel	Where subject to the critical entity requirements, maintain infrastructure and personnel sufficient to meet the same day...
CFTC-SS-11	Testing and Review of Business Continuity and Disaster Recovery Capabilities	Conduct regular periodic testing and review of business continuity and disaster recovery capabilities, using protocols a...
CFTC-SS-24	Periodic Update of the Recovery Plan and Emergency Procedures	Update the business continuity and disaster recovery plan and emergency procedures at a frequency determined by an appro...
CFTC-SS-25	Same Day Recovery Time Objective for Critical Entities	Where determined by the Commission to be a critical financial market or a critical swap data repository, maintain a reco...
CFTC-SS-26	Own Resources or Contractual Arrangements to Meet the Recovery Objective	Satisfy the recovery requirement either through infrastructure and personnel resources of the registrant own, or through...
CFTC-SS-27	Coordination of the Recovery Plan with Members and Market Participants	To the extent practicable, coordinate the business continuity and disaster recovery plan with those of the members, clea...
CFTC-SS-28	Synchronised Testing with Members and Market Participants	To the extent practicable, initiate and coordinate periodic synchronised testing of the business continuity and disaster...
CFTC-SS-29	Recovery Plan Accounts for Essential Service Providers	To the extent practicable, ensure the business continuity and disaster recovery plan takes into account the plans of tel...
CFTC-SS-30	Outsourcing with Retention of Complete Responsibility	Where required resources are maintained through a contractual outsourcing arrangement, retain complete responsibility fo...
CFTC-SS-31	Testing Covers Outsourced Resources and Tester Independence from Providers	Apply the required testing to all resources whether owned or outsourced, verify that they work together effectively, and...
CFTC-SS-8	Business Continuity and Disaster Recovery Plan and Resources	Maintain a business continuity and disaster recovery plan, emergency procedures, backup facilities and physical, technol...
CFTC-SS-9	Next Business Day Recovery Time Objective	Maintain the capability to resume operations and the ongoing fulfilment of responsibilities and obligations during the n...

CFTC System Safeguards: Cybersecurity Testing

10 controls

Controls in the CFTC System Safeguards: Cybersecurity Testing domain of CFTC System Safeguards (17 CFR 37, 38, 39, 49) — 10 controls
Code	Title	Description
CFTC-SS-13	Vulnerability Testing	Conduct vulnerability testing of a scope sufficient to satisfy the scope requirement, at a frequency determined by an ap...
CFTC-SS-14	External Penetration Testing	Conduct external penetration testing of a scope sufficient to satisfy the scope requirement, at a frequency determined b...
CFTC-SS-15	Controls Testing	Conduct controls testing covering each control included in the program of risk analysis and oversight, at a frequency de...
CFTC-SS-16	Security Incident Response Plan and Testing	Maintain a written security incident response plan covering the definition and classification of security incidents, rep...
CFTC-SS-17	Enterprise Technology Risk Assessment	Conduct a written enterprise technology risk assessment analysing threats and vulnerabilities in the context of mitigati...
CFTC-SS-18	Independence of Testers	Perform the required testing either by engaging independent contractors or by using employees who are not responsible fo...
CFTC-SS-33	Regular Periodic Objective Testing and Review of Automated Systems	Conduct regular, periodic and objective testing and review of automated systems to establish that they are reliable, sec...
CFTC-SS-34	Internal Penetration Testing	Conduct internal penetration testing of a scope sufficient to satisfy the scope requirement, at a frequency determined b...
CFTC-SS-35	Scope of Testing and Assessment	Set the scope of all system safeguards testing and assessment broadly enough to include the automated systems and contro...
CFTC-SS-36	Internal Reporting and Review by Senior Management and the Board	Ensure that both senior management and the board receive and review reports setting out the results of the required test...

CFTC System Safeguards: Notification, Records and Remediation

4 controls

Controls in the CFTC System Safeguards: Notification, Records and Remediation domain of CFTC System Safeguards (17 CFR 37, 38, 39, 49) — 4 controls
Code	Title	Description
CFTC-SS-19	Prompt Notification to the Commission	Notify Commission staff promptly of electronic trading halts and significant systems malfunctions, hardware or software...
CFTC-SS-20	Production of System Safeguards Books and Records	Provide to the Commission promptly on request the current business continuity and disaster recovery plans and other emer...
CFTC-SS-21	Remediation of Vulnerabilities and Deficiencies	Identify and document the vulnerabilities and deficiencies revealed by the required testing and assessment, analyse and...
CFTC-SS-32	Timely Advance Notice of Material Planned Changes	Give Commission staff timely advance notice of all material planned changes to automated systems that may affect their r...

CFTC System Safeguards: Registrant Specific Requirements

3 controls

Controls in the CFTC System Safeguards: Registrant Specific Requirements domain of CFTC System Safeguards (17 CFR 37, 38, 39, 49) — 3 controls
Code	Title	Description
CFTC-SS-37	Protection of Swap Data Repository Data	A swap data repository must, with respect to all data in its custody, maintain the program of risk analysis and oversigh...
CFTC-SS-38	Production of Annual Total Trading Volume	A designated contract market must provide its annual total trading volume to the Commission for each calendar year by th...
CFTC-SS-39	Critical Financial Market Designation Obligations	Where the Commission has determined the registered entity to be a critical financial market, comply with the additional...

CFTC System Safeguards: Risk Analysis and Oversight Program

10 controls

Controls in the CFTC System Safeguards: Risk Analysis and Oversight Program domain of CFTC System Safeguards (17 CFR 37, 38, 39, 49) — 10 controls
Code	Title	Description
CFTC-SS-1	Program of Risk Analysis and Oversight	Establish and maintain a program of risk analysis and oversight covering operations and automated systems, to identify a...
CFTC-SS-12	Capacity and Performance Planning Category	Address capacity and performance planning within the program, including controls for monitoring systems to ensure adequa...
CFTC-SS-2	Enterprise Risk Management and Governance Category	Address enterprise risk management and governance within the program, covering assessment, mitigation and monitoring of...
CFTC-SS-22	Business Continuity and Disaster Recovery Planning Category	Address business continuity and disaster recovery planning and resources within the program, including regular periodic...
CFTC-SS-23	Resources Sufficient to Fulfil Obligations	Establish and maintain resources that allow each obligation and responsibility to be fulfilled, including daily processi...
CFTC-SS-3	Information Security Category	Address information security within the program, covering access to systems and data with least privilege, separation of...
CFTC-SS-4	Systems Operations Category	Address systems operations within the program, covering system maintenance, configuration management including baseline...
CFTC-SS-5	Systems Development and Quality Assurance Category	Address systems development and quality assurance within the program, covering requirements development, pre production...
CFTC-SS-6	Physical Security and Environmental Controls Category	Address physical security and environmental controls within the program, covering physical access and monitoring, power,...
CFTC-SS-7	Generally Accepted Standards and Best Practices	In addressing the prescribed categories, follow generally accepted standards and best practices with respect to the deve...

Your Compliance Coverage

If you comply with CFTC System Safeguards (17 CFR 37, 38, 39, 49), you already cover:

FedRAMP High

100%

39 controls mapped

Compare →

FedRAMP Moderate

100%

39 controls mapped

Compare →

NIST SP 800-53 Revision 5.1 HIGH

97%

38 controls mapped

Compare →

+ 24 more: C5 (Germany) (97%), NIST SP 800-161 Rev 1 (97%)

See all 27 mapped frameworks ↓

Maps to 27 other frameworks

39 total controls

FedRAMP High

39 source controls mapped|98 target controls covered

100%

FedRAMP Moderate

39 source controls mapped|99 target controls covered

100%

NIST SP 800-53 Revision 5.1 HIGH

38 source controls mapped|92 target controls covered

97%

C5 (Germany)

38 source controls mapped|38 target controls covered

97%

NIST SP 800-161 Rev 1

38 source controls mapped|55 target controls covered

97%

NIST Cybersecurity Framework 2.0

38 source controls mapped|82 target controls covered

97%

NIST SP 800-53 Rev 5 MODERATE

36 source controls mapped|91 target controls covered

92%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

36 source controls mapped|85 target controls covered

92%

NIST SP 800-53 Rev 5

35 source controls mapped|91 target controls covered

90%

DORA

35 source controls mapped|17 target controls covered

90%

SOC 2

33 source controls mapped|34 target controls covered

85%

HIPAA Security Rule

31 source controls mapped|44 target controls covered

79%

NIST SP 800-53 Rev 5 LOW

30 source controls mapped|64 target controls covered

77%

NIST SP 800-66 Rev 2

29 source controls mapped|38 target controls covered

74%

PCI DSS 4.0

26 source controls mapped|60 target controls covered

67%

APRA CPS 230 Operational Risk Management

26 source controls mapped|40 target controls covered

67%

ISO 22301:2019

23 source controls mapped|39 target controls covered

59%

ISO 27002:2022

23 source controls mapped|59 target controls covered

59%

ISO 27001:2022

23 source controls mapped|59 target controls covered

59%

NIST SP 800-171 Rev 3

22 source controls mapped|48 target controls covered

56%

Azure Security Benchmark

21 source controls mapped|46 target controls covered

54%

CIS Controls v8

21 source controls mapped|52 target controls covered

54%

CMMC 2.0

14 source controls mapped|39 target controls covered

36%

ISO 27005:2022

1 source controls mapped|3 target controls covered

ISO 27018:2019

1 source controls mapped|2 target controls covered

ISO 27017:2015

1 source controls mapped|3 target controls covered

ISO 27701:2019

1 source controls mapped|5 target controls covered

Compare CFTC System Safeguards (17 CFR 37, 38, 39, 49) with FedRAMP High

What is CFTC System Safeguards (17 CFR 37, 38, 39, 49) and who does it apply to?

CFTC System Safeguards (17 CFR 37, 38, 39, 49) is a compliance framework from United States (CFTC) with 5 domains and 39 controls. The Commodity Futures Trading Commission (CFTC) System Safeguards rules (17 CFR Parts 37, 38, 39, and 49) establish comprehensive cybersecurity, business continuity, incident reporting, system integrity, and risk management requirements for designated contract markets (DCMs), swap execution facilities (SEFs), derivatives clearing organizations (DCOs), and swap data repositories (SDRs). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does CFTC System Safeguards (17 CFR 37, 38, 39, 49) actually require?

CFTC System Safeguards (17 CFR 37, 38, 39, 49) has 39 controls organised across 5 domains. The largest domains are CFTC System Safeguards: Business Continuity and Disaster Recovery (12 controls), CFTC System Safeguards: Cybersecurity Testing (10 controls), CFTC System Safeguards: Risk Analysis and Oversight Program (10 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of CFTC System Safeguards (17 CFR 37, 38, 39, 49) do I already cover?

CFTC System Safeguards (17 CFR 37, 38, 39, 49) maps to 27 other compliance frameworks. The top mapping partners are FedRAMP High (100% coverage), FedRAMP Moderate (100% coverage), NIST SP 800-53 Revision 5.1 HIGH (97% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement CFTC System Safeguards (17 CFR 37, 38, 39, 49)?

Start your CFTC System Safeguards (17 CFR 37, 38, 39, 49) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CFTC System Safeguards (17 CFR 37, 38, 39, 49) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 39 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required