Cyber Risk Management Guidance For Canadian Corporate Directors

Cyber risk management is a fundamental issue for organizations of all kinds and sizes. Directors of Canadian corporations have a legal responsibility to ensure their corporations have appropriate cyber risk management policies and practices and are prepared to respond effectively to cybersecurity incidents. Guidance from regulators, industry associations and other organizations can help corporate directors fulfil their cyber risk management duties.

Corporate directors' duties and obligations

General

Under Canadian law, corporate directors are responsible for managing or supervising the management of their corporation's business and affairs, including activities regarding risk identification and management. In exercising their powers and performing their obligations, corporate directors are required to: (1) act honestly and in good faith with a view to the best interests of their corporation (commonly known as the "fiduciary duty" or "duty of loyalty");