When examining the complexity in today’s applications and environments, and why APM technologies are becoming more critical by the day, those responsible for an application’s lifecycle must understand what an application does. Aside from providing application visibility, APM tools help troubleshoot issues. The failure to see and troubleshoot is a constant struggle for those supporting applications. When I speak publicly I’m always able to point to specific instances of failure which affect each of us; this month the hot button items were travel issues regarding airline IT systems, stock market failures, and others.
Within the securities market, the SEC has adopted regulations that attempt to improve US securities markets’ ability to handle systems compliance and maintain integrity. To that effect, on November 19th, 2014, the SEC approved the adoption of the Regulation Systems Compliance and Integrity (Reg SCI) under the Securities Exchange Act of 1934. The regulation requires compliance by November 2015, in a few short months. This new regulation was specifically created to prevent or better handle issues and incidents related to flash traffic crashing exchanges, security breaches, and other areas of system resilience. The financial markets are increasingly interconnected, making cascading issues a reality. These regulated entities include FINRA, trading systems, plan processors, and clearing houses. The requirements of Reg SCI include creating procedures, executing testing, monitoring effectively and reporting data and status to the SEC. The reporting must be done on a regular basis, and when major systems changes occur. The entities covered by the new reg SCI mandates must also perform annual reviews including the testing of disaster recovery procedures of secondary sites, and their ability to handle the same volume of transactions with the same responsiveness as the primary sites. The focus is primarily on production systems, but also includes development and testing processes.
When outages do occur, there are specific provisions as to what must be reported, including the root cause of these outages. This helps share the reason for issues which affect the technology that powers the financial markets.
In regards to what APM focuses on, the regulation requires that capacity planning must be accomplished, but interestingly the capacity planning must be focused on transaction accuracy and timeliness to ensure market integrity. Most IT Operations professionals focus on infrastructure capacity planning, but this regulation clearly shifts that focus to the application layer. Stress testing must also be accomplished with major changes, once again requiring measurements. Reg SCI specifically notes that the monitoring of any 3rd party provided software or services, and how those systems perform is a requirement. Capabilities around monitoring availability and performance of these services is an APM technology capability, as 3rd party performance often affects application performance and proper execution.
AppDynamics is a trusted APM provider in many of the world’s largest banks and exchanges, and many more globally. We are also used within several companies which fall under Reg SCI. As a result, many of our customers are reaching out to us in order to comply with this new regulation. We’re pleased to discuss how we can help, and how AppDynamics is evolving to handle new types of capacity planning models in the future.
The actual regulation can be found here http://www.sec.gov/rules/final/2014/34-73639.pdf with commentary here http://www.sec.gov/rules/final/2014/staff-guidance-current-sci-industry-standards.pdf
Comments