IIROC Mandatory Cybersecurity Breach Reporting

In response to the significant increase in sophisticated cybersecurity breaches, the Investment Industry Regulatory Organization of Canada ("IIROC") has imposed mandatory reporting requirements on investment firms that suffer a cybersecurity incident or breach.

First proposed on April 5, 2018, the new rules require investment firms regulated by IIROC to submit two separate reports:

1. Within three days of the cybersecurity incident, firms must submit a preliminary report describing the incident.
2. Firms are given 30 days to provide a more in-depth report that details the cause and magnitude of the issue and subsequent steps that the firm is taking to protect against similar breaches.