On January 24, 2019, the Office of the Superintendent of
Financial Institutions (OSFI) issued a new advisory on Technology
and Cyber Security Incident Reporting (the Advisory). The purpose
of the Advisory is to set out the obligations for Federally
Regulated Financial Institutions (FRFIs) to report technology and
cyber security incidents to OSFI. The Advisory came into effect on
March 31, 2019.
Prior to the introduction of the Advisory, OSFI released the
Cyber Security Assessment Guideline for FRFIs in late 2013, which
allowed FRFIs to assess their level of preparedness and to assist
in the implementation of useful cybersecurity practices. The
completion of the Cyber Security Assessment was not made a
mandatory requirement by OSFI. The Advisory is intended to
complement the Cyber Security Assessment Guideline.