In addition to ensuring their compliance with Canada's new
federal mandatory data breach and breach-of-security-safeguards
reporting requirements under the private sector Personal
Information Protection and Electronic Documents Act,
federally regulated financial institutions will soon have
additional regulatory reporting requirements regarding technology
and cybersecurity incidents, thanks to a recent advisory
promulgated by the Office of the Superintendent of Financial
Institutions.
Issued on Jan. 24, the Advisory on Technology and Cybersecurity
Incident Reporting confirms the obligation of federally regulated
financial institutions to report high or critical severity
technology or cybersecurity incidents to the OSFI. For the purpose
of the advisory, a technology or cyber-incident is defined to have
the potential to — or has been assessed to —
"materially impact the normal operations of an FRFI,"
including confidentiality, integrity or availability of its
