Updated Requirements For Federally Regulated Financial Institutions' Technology And Cyber Incident Reporting Obligations

On August 13, 2021, the Office of the Superintendent of Financial Institutions ("OSFI") released an updated Technology and Cyber Security Incident Reporting Advisory (the "New Advisory") for federally regulated financial institutions ("FRFIs") which replaces the Technology and Cyber Security Incident Reporting Advisory previously published in January 2019 (the "2019 Advisory").

The New Advisory potentially lowers the threshold for reporting and expands the scope of reportable incidents. Under the New Advisory, FRFIs who fail to comply with the new reporting requirements could be subject to increased supervisory oversight by OSFI. In connection with the New Advisory, OSFI also released an updated Cyber Security Self-Assessment Tool to assist FRFIs in reviewing their ability to manage technology and cyber risks and to respond to incidents.