OSFI Issues Stricter Reporting Requirements For Technology And Cybersecurity Incidents

On August 13, 2021, the Office of the Superintendent of Financial Institutions (OSFI) issued a new advisory on Technology and Cyber Security Incident Reporting (2021 Advisory). The 2021 Advisory replaces OSFI's guidance from 2019 (2019 Advisory) on how and when federally regulated financial institutions (FRFIs) are required to notify OSFI about technology or cybersecurity incidents.

The 2021 Advisory defines a technology or cybersecurity incident as an incident that has an impact, or the potential to have an impact on the operations of a FRFI, including its confidentiality, integrity or the availability of its systems and information. Whether a technology or cybersecurity incident must be reported to OSFI depends on the FRFI's determination of whether the incident meets OSFI's criteria for reporting.