In November 2019, the Investment Industry Regulatory
Organization of Canada (IIROC)
announced amendments to its Dealer Member Rules and IIROC
Dealer Member Plain Language Rule Book to require that dealers
report any cybersecurity incidents to IIROC within three days of
discovery.
Under the amendments, a "cybersecurity incident" is
defined to include "any act to gain unauthorized access to,
disrupt or misuse a Dealer Member's information
system, or information stored on such information system, that has
resulted in, or has a reasonable likelihood of resulting in:
- substantial harm to any person,
- a material impact on any part of the normal operations of the
Dealer Member,
- invoking the Dealer Member's business continuity
plan or disaster recovery plan, or
