CFTC Creates Insider Risk Records System
AI-generated summary for informational purposes only. Not legal advice. See the original source for the authoritative text.
The CFTC is creating a new records system for its Insider Risk Program. It will store information used to detect and respond to risks from people who have or had access to CFTC facilities, systems, networks, or sensitive information. The system may cover employees, contractors, and others with CFTC access. Records can include identity details, personnel history, access logs, network monitoring data, CCTV footage, incident reports, and investigative material. The system takes effect on June 15, 2026, with comments due by June 5, 2026.
AI-generated summary. May contain errors. Refer to official sources for legal decisions.
Key Changes
- Creates a new CFTC Privacy Act records system called CFTC-59, Insider Risk Program Records.
- Allows the CFTC to collect and use monitoring, access, personnel, security, and investigation records for insider risk inquiries.
- Limits outside disclosures mainly to litigation, law enforcement, breach response, audits, contractors, congressional inquiries, and relevant third parties.
Obligations
What this law requires
CFTC must operate the CFTC-59 Insider Risk Program Records system only for detecting, deterring, responding to, and mitigating insider risks affecting CFTC individuals, facilities, information, equipment, networks, and systems.
CFTC must limit access to Insider Risk Program records to individuals with a legitimate business need to know, using role-based permissions for electronic records.
CFTC must protect Insider Risk Program records from unauthorized access, improper use, and improper disclosure through administrative, technical, and physical safeguards, including written policies, training, periodic audits, strong passwords, multi-factor authentication, encryption for certain data types and transfers, firewalls, intrusion detection, restricted building access, guard services, and video surveillance.
CFTC must retain and dispose of Insider Risk Program records in accordance with NARA General Records Schedule 5.6, including items 210, 220, and 230 for insider threat administrative, operations, inquiry, and information records.
CFTC must destroy electronic Insider Risk Program records by physical destruction of electronic storage media or by erasure of the data, and must dispose of paper records by shredding.