Your browser is unsupported

Please visit this URL to review a list of supported browsers.

ESG at ICE

Managing Risk & Ensuring Business Continuity

Our Board of Directors is responsible for overseeing ICE's risk management process, which includes management of general operational risks, as well as particular risks facing our various businesses. With the assistance of our Audit and Risk Committees and our Subsidiary Boards, the Board oversees that our assets are properly safeguarded, that appropriate financial and other controls are maintained, and that our business is conducted prudently and in compliance with applicable laws, regulations and our corporate governance guidelines.

We have an Enterprise Risk Management team, led by the Chief Corporate Risk Officer. The team includes regional Chief Risk Officers that oversee each business unit: clearing houses, exchanges, trade repositories and the data and benchmark services.

We employ a three-lines model to enterprise risk management, a concept endorsed by the Institute of Internal Auditors. This framework helps ensure strong redundancies and preparation.

  • The first line is comprised of management and is responsible for the day-to-day operation of the business and the associated risks
  • The second line serves an oversight and challenge function from a risk perspective and includes our Enterprise Risk Management, Legal & Compliance, Financial Controls, Human Resources and Information Security Assurance teams
  • Internal Audit is the third line and serves to provide an independent check and additional assurances that risks are anticipated and mitigated

Cybersecurity and data protection


ICE ensures both the physical and digital security of our markets, clearing houses, data and mortgage software through industry-leading security technology and processes. Our Information Security Department consists of diverse and skilled teams that work to protect confidential data and systems from unauthorized access, misuse, disclosure, destruction, modification or disruption.

  • A formal cybersecurity strategy is maintained by management and approved by the Risk Committee
  • Detailed cybersecurity policies are reviewed at least annually
  • Board oversight is led by the Risk Committee with at least quarterly security briefings from senior management
  • Service Organization Control (SOC2, type II) assessments are performed annually to produce independent verification and testing of ICE controls for external parties and auditors that rely on ICE. The scope of these reports is evaluated each year and tailored in response to customer feedback and business developments. These reports are available to any customer via the Customer Third-Party Risk Management Portal
  • Periodic third-party assessments are conducted using the NIST Cybersecurity Framework to measure program maturity and completeness
  • We maintain insurance coverage that may, subject to the terms and conditions of the policy and payment of deductibles, cover certain aspects of cybersecurity issues
  • Reporting a security concern can be done easily from our website here

Business Continuity Planning


Our crisis management team handles our end-to-end response to any potential issues and regularly conducts global drills to ensure our processes are ready to be implemented. Our operations team maintains an incident management program to handle any incident with operational impact - security or otherwise. The goal of the incident management program is to provide a cohesive framework for the communication, resolution and recording of incidents and to ensure incidents are resolved in a planned and controlled manner so that any interruption is resolved quickly and normal operations are restored.

System resiliency and business continuity management is a core tenant of our system design process and redundancies are purpose-built into our applications, network infrastructure and across primary and backup data centers.

Such design resiliency may include “hot/hot” system components with real-time failure capabilities, readily available back-up components, robust recovery and/or failover procedures, and geographically-diverse backup data centers. These geographically-diverse “like for like” disaster recovery data centers are maintained and governed by an enterprise wide policy. Per policy, all ICE core procedures, systems and operational tasks are duplicable in recovery facilities, exercised at least annually and documented comprehensively.

Following each acquisition of a new company, this process is reviewed to ensure crisis management procedures are in place across our entire organization.

Board oversight includes quarterly reports to the Risk Committee on technology operations and governance. Employees are trained annually on our business continuity procedures to ensure readiness and understanding.