The Office of the Superintendent of Financial Institutions
("OSFI") today issued an
advisory1 setting out new guidelines for how
federally regulated financial institutions
("FRFI") report technology or cyber
security breaches. The Advisory references and complements
the cyber security self-assessment guidance OSFI
released in 2013.2
The advisory affects a wide swath of financial entities, as
OSFI
has oversight over all banks, federally incorporated or registered
trust and loan companies, cooperative credit associations,
insurance companies, fraternal benefit societies, private pension
plans, and federal cooperatives.
Under the new guidelines, which will go into effect on March 31,
2019, FRFIs are
expected to report cyber security or technology-related incident
that are of a "high or critical severity level" to OSFI.
These are defined as incidents that materially impact the normal
operations of an FRFI,
including incidents affecting the confidentiality,
