The Office of the Superintendent of Financial Institutions
Canada (OSFI) recently issued the Technology and Cyber Security Incident
Reporting Advisory, which comes into
effect on March 31, 2019 (Advisory).1
The Advisory sets out OSFI's expectations for federally
regulated financial institutions (FRFIs) with respect to the
reporting of technology and cyber security incidents affecting FRFI
operations. The Advisory defines a technology or cyber security
incident as one that materially impacts, or could potentially
materially impact, the normal operations of an FRFI, including
confidentiality, integrity or availability of its systems or
information (Incident). The Advisory further indicates that the
FRFI must report the Incident to OSFI (by notifying its Lead
Supervisor as well as [email protected]), in writing and as
promptly as possible, but no later than 72 hours, after determining
an Incident meets the incident characteristics. These are
listed in the Advisory as:
