On January 24, 2019, the Office of the Superintendent of
Financial Institutions ("OSFI")
published the Technology and Cyber Security Incident
Reporting Advisory1 (the
"Advisory"), which sets out OSFI's
expectations for reporting technology and cyber security
incidents. The Advisory became effective for all federally
regulated financial institutions
("FRFIs") on March 31, 2019.
The Advisory requires FRFIs to report technology or cyber
security incidents that "have the potential to, or have been
assessed to, materially impact the normal operations of a FRFI,
including confidentiality, integrity or availability of its systems
and information". If a FRFI assesses an incident as being of a
"high or critical severity level", the FRFI must notify
OSFI as promptly as possible, but no later than 72 hours after the
FRFI determines that the incident is reportable. For more details
on the reporting process, and how it differs from the breach
reporting requirements under
