Securities Regulators Publish Guidance On Cybersecurity

Cybersecurity is identified as a priority in the 2016-2019 business plan of Canadian securities regulators. Recently, they conducted a review of cybersecurity disclosure of the 240 issuers in the S&P/TSX index. Staff Notice 51-347 Disclosure of Cyber Security Risks and Incidents describes the regulators' findings and provides guidance to issuers on disclosure of material cybersecurity information.

Findings on Cybersecurity Disclosure

The regulators collected the following statistics on cybersecurity disclosure by S&P/TSX index issuers:

• 61% of issuers representing a variety of industries identified cybersecurity as a risk factor.
• Cyber risks identified by issuers included the potential for reputational damage, confidential information to be compromised, destruction or corruption of data, devaluation of intellectual property, remediation costs, and legal and regulatory liability.