On January 24, 2019, the Office of the Superintendent of
Financial Institutions (OSFI) issued an Advisory on Technology and
Cyber Security Incident Reporting.
The Advisory sets out OSFI's expectations for reporting
technological and cyber security incidents. These expectations
apply to all federally regulated financial institutions (FRFIs)
– including banks, federal trust companies and insurance
companies.
The Advisory reflects the fact that OSFI is very focussed on
technological and cyber security issues. Advancements in
information technology and digitization make this an increasingly
significant area of risk. OSFI clearly wants to be kept very
informed of material incidents. OSFI expects to receive an initial
notification, including significant details, within 72 hours, and
to receive frequent updates after that until the incident is
resolved. Note that while the Advisory addresses reporting
requirements, it does not address OSFI's expectations for an
incident
