OSFI Advisory Tightens Technology And Cyber Security Incident Reporting Requirements

The Office of the Superintendent of Financial Institutions (OSFI) just released updated requirements governing how federally regulated financial institutions (FRFIs) should disclose and report technology and cyber security incidents to OSFI. The Advisory, which affects federally regulated banks, insurance companies, and credit unions, replaces the January 2019 Cyber Security Incident Reporting Advisory, which came into effect in March 2019. With the simultaneous release of OSFI's updated Cyber Security Self-Assessment, OSFI has considerably tightened its requirements demonstrating an increasing concern with the potential impacts of cybersecurity on the financial system and on individual financial institutions.