The Office of the Superintendent of Financial Institutions
(OSFI) just published an advisory letter for federally regulated
financial institutions (FRFI). The advisory sets out OSFI's
expectations for FRFI cybersecurity incident reporting, gives
examples of incidents that should be reported to OSFI, and sets out
reporting requirements. It will become effective March 31,
2019.
What Is a Technology or Cybersecurity Incident?
For the purpose of the advisory, a technology or cybersecurity
incident is defined "to have the potential to, or has been
assessed to, materially impact the normal operations of a FRFI,
including confidentiality, integrity or availability of its systems
and information."
