CSA Issues Cybersecurity Disclosure Expectations

Increasingly, cybersecurity is a top of mind issue for most organizations. Senior management, board members and investors are particularly concerned given the potential negative impact a major cyber-attack can have on organization from a financial, legal, reputational and operational standpoint.

It is therefore no surprise that the Canadian Securities Administrators (the "CSA") has been active in the area of cybersecurity in recent months. Last week, it issued Staff Notice 51-347 (the "Notice"), an updated notice on cybersecurity expectations for issuers regarding the disclosure of cybersecurity risks and incidents. The Notice also includes a summary of the CSA's review of the most recent annual filings of 240 constituents of the S&P/TSX Composite Index, focusing on whether and how issuers addressed cybersecurity issues in their risk factor disclosure.