OSFI Releases Advisory On Technology And Cybersecurity Incident Reporting Obligations

On January 24, 2019, the Office of the Superintendent of Financial Institutions (OSFI) published the Technology and Cybersecurity Incident Reporting Advisory (Advisory) applicable to all federally regulated financial institutions (FRFIs). The Advisory creates new incident reporting obligations for FRFIs and is effective as of March 31, 2019. Service providers to FRFIs should also familiarize themselves with FRFIs' obligations under the Advisory, as they may be contractually required by FRFIs to assist with those obligations.

BACKGROUND

OSFI has identified cybersecurity as a key risk that is increasing as FRFIs continue to rely on technology. OSFI completed a cybersecurity cross sector review at select FRFIs during the 2017-18 fiscal year, assessing responses to a severe but plausible scenario involving a cyber breach at a third party. OSFI has also been assessing their own ability to respond to cybersecurity risks, noting in its 2017-18 Departmental Results Report