CSA Reports On Cybersecurity Disclosure Review

On January 19, 2017, the Canadian Securities Administrators (CSA) published Staff Notice 51-347 Disclosure of cyber security risks and incidents (Staff Notice), which reports on their broad-ranging review of the filings of the 240 constituent issuers in the S&P/TSX Composite Index concerning their disclosure of cybersecurity issues. The review focused on how cybersecurity issues have been addressed in risk factor disclosure, as well as disclosure about any previous cybersecurity incidents.

In September 2016, the CSA published Staff Notice 11-332 Cyber Security, which highlighted the importance of cybersecurity risks, for issuers as well as for registrants and other regulated entities. In that 2016 notice, the CSA had said they would examine disclosure with respect to cybersecurity risk and cyber-attacks. The Staff Notice represents the outcome of that review, which covered both periodic disclosure, such as annual information forms and management discussion and