CFTC System Safeguards (17 CFR 37, 38, 39, 49): every control, and what you already have

39 controls 27 frameworks share controls with it United States (CFTC) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
FedRAMP High	39	measure it →
FedRAMP Moderate	39	measure it →
C5 (Germany)	38	measure it →
NIST Cybersecurity Framework 2.0	38	measure it →
NIST SP 800-161 Rev 1	38	measure it →
NIST SP 800-53 Revision 5.1 HIGH	38	measure it →
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1	36	measure it →
NIST SP 800-53 Rev 5 MODERATE	36	measure it →
DORA	35	measure it →
NIST SP 800-53 Rev 5	35	measure it →
SOC 2	33	measure it →
HIPAA Security Rule	31	measure it →

Every control

Code	Control	Also in
`CFTC-SS-1`	Program of Risk Analysis and Oversight	22
`CFTC-SS-10`	Geographic Dispersal of Backup Infrastructure and Personnel	16
`CFTC-SS-11`	Testing and Review of Business Continuity and Disaster Recovery Capabilities	20
`CFTC-SS-12`	Capacity and Performance Planning Category	16
`CFTC-SS-13`	Vulnerability Testing	21
`CFTC-SS-14`	External Penetration Testing	15
`CFTC-SS-15`	Controls Testing	23
`CFTC-SS-16`	Security Incident Response Plan and Testing	23
`CFTC-SS-17`	Enterprise Technology Risk Assessment	19
`CFTC-SS-18`	Independence of Testers	17
`CFTC-SS-19`	Prompt Notification to the Commission	23
`CFTC-SS-2`	Enterprise Risk Management and Governance Category	21
`CFTC-SS-20`	Production of System Safeguards Books and Records	21
`CFTC-SS-21`	Remediation of Vulnerabilities and Deficiencies	23
`CFTC-SS-22`	Business Continuity and Disaster Recovery Planning Category	16
`CFTC-SS-23`	Resources Sufficient to Fulfil Obligations	15
`CFTC-SS-24`	Periodic Update of the Recovery Plan and Emergency Procedures	16
`CFTC-SS-25`	Same Day Recovery Time Objective for Critical Entities	10
`CFTC-SS-26`	Own Resources or Contractual Arrangements to Meet the Recovery Objective	21
`CFTC-SS-27`	Coordination of the Recovery Plan with Members and Market Participants	11
`CFTC-SS-28`	Synchronised Testing with Members and Market Participants	10
`CFTC-SS-29`	Recovery Plan Accounts for Essential Service Providers	17
`CFTC-SS-3`	Information Security Category	26
`CFTC-SS-30`	Outsourcing with Retention of Complete Responsibility	22
`CFTC-SS-31`	Testing Covers Outsourced Resources and Tester Independence from Providers	17
`CFTC-SS-32`	Timely Advance Notice of Material Planned Changes	16
`CFTC-SS-33`	Regular Periodic Objective Testing and Review of Automated Systems	20
`CFTC-SS-34`	Internal Penetration Testing	15
`CFTC-SS-35`	Scope of Testing and Assessment	16
`CFTC-SS-36`	Internal Reporting and Review by Senior Management and the Board	18
`CFTC-SS-37`	Protection of Swap Data Repository Data	21
`CFTC-SS-38`	Production of Annual Total Trading Volume	5
`CFTC-SS-39`	Critical Financial Market Designation Obligations	8
`CFTC-SS-4`	Systems Operations Category	22
`CFTC-SS-5`	Systems Development and Quality Assurance Category	22
`CFTC-SS-6`	Physical Security and Environmental Controls Category	20
`CFTC-SS-7`	Generally Accepted Standards and Best Practices	15
`CFTC-SS-8`	Business Continuity and Disaster Recovery Plan and Resources	21
`CFTC-SS-9`	Next Business Day Recovery Time Objective	19

Tell me when CFTC System Safeguards (17 CFR 37, 38, 39, 49) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Control testing plan
Test results
Effectiveness metrics
Remediation plan
internal audit plan and schedule
internal audit reports of the ISMS
list of controls in scope with the basis for inclusion
reference to the system security and privacy plans
record of controls excluded and why
evidence scope matches the purpose of the assessment

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

findings not remediated named by 14 frameworks
exclusions undocumented named by 5 frameworks
Sensitive data unencrypted named by 4 frameworks
No independent assessment named by 4 frameworks
No penetration testing named by 3 frameworks
No configuration baselines named by 3 frameworks

What this page is

A control-level reference for CFTC System Safeguards (17 CFR 37, 38, 39, 49), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition