OSFI issues update to technology and cybersecurity incident reporting requirements

Ottawa, ON, August 13, 2021 / CNW / – Office of the Supervisor of Financial Institutions

The Office of the Superintendent of Financial Institutions (OSFI) today released an update to the requirements that govern how federally regulated financial institutions (FRFIs) are required to report technology and cybersecurity incidents to OSFI.

The updated version of the notice entitled Report technology and cyber security incidents It aims to facilitate a coordinated and integrated response to technology and cybersecurity incidents affecting Government Financial Institutions (FRFIs).

According to the revised advisory, FRFI must notify OSFI’s Technology Risk Division and its supervisor as soon as possible, and no later than 24 hours after the incident. In addition, the notice contains a new section titled Not reporting It is stated that an FRFI that fails to report a technology or cybersecurity incident is at risk of, among other things, increased monitoring, being placed on a watch list or classified as a response stage in accordance with ‘Intervention approach to monitoring du BSIF.

OSFI also released a file self-assessment questionnaire A revised cybersecurity policy that helps FRFIs assess and strengthen their current preparedness for new and expanding cyber threats. The questionnaire focuses on FRFI’s ability to respond to a cyber incident in relation to the organization and resources, among other things, and how it manages threats, risks and incidents, and allows FRFI organizations to score each component. On a scale from non-existent to continuous improvement.

For more details, please refer to prior notice and the self-assessment form.

the quote

“Technology and cybersecurity incidents such as ransomware and data breaches are on the rise. Canadian financial institutions are the backbone of our economy – this new edition of OSFI’s self-assessment and counseling questionnaire will help protect their operations and the stability of the financial sector.”

Peter RoutledgeSupervisor of financial institutions

quick Facts

• The revised version of the notice supersedes the original titled

Report technology and cyber security incidents which was published in january
2019 and It entered into force in March 2019.

• Technology and cybersecurity incidents can include, but are not limited to, cyber attacks, extortion threats, contractor outages, and data breaches.
• OSFI has published its latest Cyber ​​Security Self-Assessment Questionnaire, which replaces the Cyber ​​Security Assessment Questionnaire released in October 2013, to help FRFIs assess their current level of preparedness and develop and maintain effective cybersecurity practices.

Related documents

About OSFI

the Office of the Supervisor of Financial Institutions (OSFI) is an independent federal agency founded in 1987. Its mission is to protect depositors, policyholders, creditors of financial institutions, and participants in retirement plans, while allowing financial institutions to compete against competition and take reasonable risks. OSFI monitors more than 400 federally regulated financial institutions (FRFIs) and more than 1,200 federally regulated pension plans to determine if they are in good financial standing and whether they meet the regulatory requirements applicable to them.

Al-Masdar Office for the Supervision of Financial Institutions

For more information: Press Relations, OSFI – Public Affairs, [email protected], 343-550-9373

Related links

http://www.osfi-bsif.gc.ca/