Information Security Incident Management: A New Regulatory Framework For Financial Institutions And Credit Assessment Agents

Introduction

On October 23, 2024, the Regulation respecting the management and reporting of information security incidents by certain financial institutions and by credit assessment agents ("Regulation") was published in the Gazette officielle du Québec. The Regulation will come into force in six months and is intended to provide a framework for the management and reporting of information security incidents by certain provincial financial institutions. In the event of non-compliance, the Regulation also provides for administrative penalties.

Information Security Incident

Under the Regulation, an information security incident means "an attack on the availability, integrity or confidentiality of information systems or the information they contain." This definition is distinct from the definition of "confidentiality incident" in the Act respecting the protection of personal information in the private sector ("Private Sector Act"), which covers incidents