On November 14, 2019, the Investment Industry Regulatory Organization of Canada (IIROC) – the national self-regulatory organization that oversees investment dealers and their trading activity in Canadian markets – published a notice of amendments to its Rule 3100 and Rule 3703 to require mandatory reporting of cybersecurity incidents by IIROC-regulated investment firms. The amended rules, which came into effect immediately on publication of the notice, require firms to provide IIROC with an initial report within three days of discovering a reportable cybersecurity incident and a comprehensive investigation report within 30 days of discovering the incident.

The IIROC cybersecurity incident reporting obligations apply in a wider range of circumstances than similar reporting obligations under Canadian personal information protection laws. Furthermore, the reporting obligations apply concurrently with other reporting obligations to which IIROC-regulated investment firms might also be subject, such as the technology and cybersecurity incident reporting obligations imposed by the Office of the Superintendent of Financial Institutions. IIROC-regulated investment firms should immediately assess their readiness to comply with these new reporting obligations and make appropriate changes to their systems, policies and procedures, and contracts with information technology service providers.

Previous Cybersecurity Guidance

Over the past few years, Canadian investment and financial industry regulators have emphasized the importance of cybersecurity, and have issued guidance to help regulated firms improve their cybersecurity maturity and manage cyber risks. For example:

For more information, see BLG bulletins Cybersecurity Guidance from Investment Industry Organization (January 2016), Cybersecurity Guidance from Investment Industry Organization (May 2016), Cybersecurity Guidance from Canadian Securities Administrators, OSFI Issues Advisory on Technology and Cybersecurity Incident Reporting, and Investment Funds Institute of Canada Issues Cybersecurity Guide.

IIROC Rules – Mandatory Reporting of Cybersecurity Incidents

Background

IIROC’s amended rules for mandatory reporting of cybersecurity incidents were first proposed by IIROC in an April 2018 notice, which detailed and discussed the proposed amended rules. The notice explained that the purpose of requiring mandatory reporting of cybersecurity incidents by IIROC’s dealer members (dealers) is to allow IIROC to (1) provide immediate support to the dealer responding to a cybersecurity incident; (2) alert other dealers of threats and share best practices for incident preparedness; (3) evaluate trends and develop comprehensive insight regarding cybersecurity; and (4) promote confidence in the dealer and the integrity of the market.

The notice invited public comment on the proposed amended rules. IIROC has summarized the comments it received, and its responses to those comments, in its April 2018 notice and a Response to Public Comments.

As a result of the public comment process, IIROC made minor changes to the proposed amended rules and published a guidance note, Frequently Asked Questions – Mandatory Cybersecurity Incident Response, to provide guidance for compliance with the amended rules.

Details of Amended Rules

Amended Rule 3100 and Rule 3703 came into effect immediately when published on November 14, 2019. Following is a summary of key aspects of the amended rules.

  • Cybersecurity Incident: The rules define “cybersecurity incident” as including any act to gain unauthorized access to, disrupt or misuse a dealer’s information system, or information stored on an information system, that has resulted in, or has a reasonable likelihood of resulting in, any of the following outcomes: (1) substantial harm to any person (which includes a natural person or legal entity); (2) a material impact on any part of the dealer’s normal operations; (3) invoking the dealer’s business continuity plan or disaster recovery plan; or (4) the dealer being required by any applicable law to provide notice to any government body, securities regulatory authority or other self-regulatory organization.
  • Initial Report: The rules require a dealer to provide a written incident report to IIROC within three calendar days after the dealer discovers a cybersecurity incident. The report must include: (1) a description of the cybersecurity incident; (2) the date or period during which the cybersecurity incident occurred and the date it was discovered by the dealer; (3) a preliminary assessment of the cybersecurity incident, including the risk of harm to any person and impact on the operations of the dealer; (4) a description of immediate incident response steps the dealer has taken to mitigate the risk of harm to persons and the impact on the dealer’s operations; and (5) the name of and contact information for an individual who can answer IIROC’s follow-up questions.
  • Comprehensive Investigation Report: The rules require a dealer to provide a comprehensive, written incident investigation report to IIROC within 30 days, or a longer period agreed to by IIROC, after the dealer discovers a cybersecurity incident. The report must include: (1) a description of the cause of the cybersecurity incident; (2) an assessment of the scope of the cybersecurity incident, including the number of persons harmed and the impact on the dealer’s operations; (3) details of the steps the dealer took to mitigate the risk of harm to persons and impact on the dealer’s operations; (4) details of the steps the dealer took to remediate any harm to any persons; and (5) actions the dealer has or will take to improve its cybersecurity incident preparedness.

A dealer’s failure to comply with the cybersecurity incident reporting obligations could result in IIROC imposing potentially significant financial penalties or other sanctions on the dealer.

IIROC’s Guidance Note

IIROC’s guidance note, Frequently Asked Questions – Mandatory Cybersecurity Incident Response, provides important guidance for compliance with the amended rules, including answers to questions asked in comments on the proposed amended rules. Following is a summary of some important aspects of the guidance.

  • Assessment: A dealer must use judgment when assessing whether an incident qualifies as a reportable cybersecurity incident, including whether the incident has resulted in, or is likely to result in, “substantial harm” to a person (including individual or entity) or a “material” impact on the dealer’s normal operations. The probability of substantial harm may include harm to a non-individual client and may relate to more than just the misuse of personal information. Materiality will vary between dealers of different sizes and business models. A dealer that is is uncertain whether an incident constitutes a reportable cybersecurity incident should contact its IIROC relationship manager for guidance.
  • Initial Reports: The initial report of a cybersecurity incident is meant to reflect only a preliminary assessment, or “brief snapshot of core information,” of the incident. IIROC recognizes that a dealer might not have a complete analysis of an incident within three days of discovering it, and expects a dealer to submit the best information available to the dealer at the time of reporting. IIROC also expects a dealer to share with IIROC any additional information the dealer has about an incident.
  • Comprehensive Reports: The comprehensive report of a cybersecurity incident should include (in addition to the information specified in the rules) all relevant and pertinent information regarding the nature, extent, scope, impact and root cause of the incident, and the actions taken by the dealer to recover, respond and remediate the incident.
  • Time for Filing Comprehensive Report: If a dealer needs more than 30 days to deliver its comprehensive investigation report, the dealer may request an extension from IIROC. The request should indicate: (1) why the dealer needs more time; (2) when the dealer expects the report to be completed; and (3) when the dealer will submit the report. Dealers that have been granted extensions should keep IIROC informed about the status of the dealer’s investigation of the incident and the actions taken by the dealer.
  • False Alarms: A dealer who submits an initial report of an incident is not required to submit a comprehensive report if the dealer subsequently determines that the incident does not constitute a reportable cybersecurity incident. IIROC strongly recommends that dealers make that determination after consultation with external legal counsel and cybersecurity professionals.
  • IT Service Providers: The mere fact that a cybersecurity incident takes place at a dealer’s service provider does not exclude the incident from the dealer’s reporting obligations. A dealer’s “information system” or “information stored on such information system,” as those terms are used in the rules, include elements supplied by third-party service providers.
  • External Forensic Auditors: IIROC recommends dealers use an external forensic auditor to investigate a cybersecurity incident, and identify its root cause, if the dealer lacks the specialized knowledge, tools and resources needed to fully investigate the incident, and seeks to manage potential conflicts of interest.
  • IIROC Use of Reported Information: IIROC intends to share with its dealer community general information about cybersecurity incidents and anonymized information about reported cybersecurity incidents. That kind of information sharing, which is intended to enable other dealers to understand the nature of the cybersecurity risks they might be facing, is consistent with the federal Privacy Commissioner’s recent report about mandatory breach reporting trends, which indicates that attackers often re-use the same attacks against multiple organizations in the same industry. (For more information, see BLG bulletin Mandatory Breach Reporting: Lessons from Year One.)

Preparing for Compliance with the IIROC Rules

IIROC’s amended rules for mandatory cybersecurity incident reporting are now in force. Dealers should promptly assess their systems, policies and procedures, and their readiness to respond to cybersecurity incidents, to ensure that they will be able to submit timely initial incident reports and comprehensive investigation reports. Following are suggestions as to how dealers can ensure preparedness:

Authors

Bradley J. Freedman 
BFreedman@blg.com
604.640.4129

Lauren Phizicky 
LPhizicky@blg.com
514.395.3889

Expertise

Cybersecurity
Privacy and Data Protection
Securities, Capital Markets and Public Companies
Investment Management