Additional Oversight and Monitoring of the SEC’s CAT Usage Is Needed

Excerpt:  “The consolidated audit trail (CAT) tracks all activity in national market system securities throughout the U.S. markets. The CAT centralizes information about all orders throughout their life cycle and identifies the broker-dealers handling them. The U.S. Securities and Exchange Commission (SEC, agency, or Commission) does not own or operate the CAT, but authorized staff and contractors can access and share CAT data to perform a variety of regulatory functions. Inadequate safeguards would pose a greater risk to the Commission and/or outside parties and could hinder the agency’s ability to meet its regulatory and oversight responsibilities. We conducted this audit to assess whether the SEC’s information security controls for safeguarding CAT data within the SEC’s environment complied with key government-wide standards.”