CSA Provides Cybersecurity Risk Disclosure Guidance and Best Practices for Reporting Issuers

In a recent bulletin, we discussed the Canadian Securities Administrators' (CSA) Staff Notice 11-332 Cyber Security published on September 27, 2016, in which the CSA noted recent trends in the cybersecurity landscape and proposed policy initiatives to help market participants reduce their exposure to cybersecurity risk. The CSA also indicated that CSA members would examine the filings of some larger issuers to analyze their risk disclosure with respect to cybersecurity attacks.

On January 19, 2017, the CSA published Multilateral Staff Notice 51-347 Disclosure of cyber security risks and incidents (the 2017 Notice) to report the findings of the CSA's review of the 240 constituents of the S&P/TSX Composite Index and provide disclosure expectations for reporting issuers. The 2017 Notice indicates that 61% of the reviewed issuers addressed cybersecurity risk in their risk factor disclosure and that issuers in a wide variety of industries acknowledged cybersecurity as