Insights Header image
Insights Header image
Insights Header image

CSA Staff Notice 11-326 – Cyber Security

October 2013 Securities Bulletin 2 minute read

Introduction

On September 26, 2013, the Canadian Securities Administrators (“CSA”) issued Staff Notice  11-326 Cyber Security (“Staff Notice”). The Staff Notice highlights the importance of strong and individually-tailored cyber security measures for issuers, registrants and regulated entities, as such controls promote the reliability of their operations and the security of their confidential information. The Staff Notice identifies two major types of cyber threats in particular that have increased in sophistication and frequency: Denial of Service attacks and Advanced Persistent Threats.

CSA Recommendations for Issuers

The CSA notes that issuers, registrants and regulated entities should be aware of the risks and challenges posed by cyber crime and should take appropriate measures to protect themselves. In particular, the CSA provides the following guidance:

  • Those issuers, registrants and regulated entities that have not yet addressed the issue should consider how to best address the risks of cyber crime, including:
    • Educating staff regarding security of information and computer systems,
    • Following guidance and best practices from industry and security associations, and
    • Conducting appropriate third-party vulnerability and security assessments;
  • Those issuers, registrants and regulated entities that have already taken steps to address the issue should review their cyber security risk control measures on a regular basis;
  • Issuers should consider whether any issues with respect to cyber crime are such that they need to be disclosed in a prospectus or continuous disclosure filing;
  • Registrants should consider whether they are able to manage cyber crime risk in accordance with prudent business practices; and
  • Regulated entities should consider the measures necessary to address the risks of cyber crime.

The Staff Notice further notes that the CSA will consider these issues in its reviews of issuer disclosure and in its oversight of registrants and regulated entities going forward.

by Alexis Marach

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2013

Insights (5 Posts)View More

Featured Insight

Another Thumbs Up? Leave to Appeal to the Supreme Court of Canada Filed in Relation to Emoji Contract Interpretation Decision

We discuss a recent application for leave to appeal the decision in Achter Land & Cattle Ltd. v South West Terminal Ltd. to the Supreme Court of Canada

Read More
Feb 19, 2025
Featured Insight

Navigating Economic Uncertainty: What Companies Need to Know About Force Majeure Clauses Under Quebec Law

This bulletin explores what constitutes a force majeure clause and how it is applied in B2B commercial agreements.

Read More
Feb 18, 2025
Featured Insight

Double the Trouble: The BCCA Refuses to Strike Duplicative Class Actions Before Certification

Class action bulletin. Summary of InvestorCOM Inc. v. L'Anton, 2025 BCCA 40, a recent decision of the BCCA on the issue of duplicative class actions.

Read More
Feb 12, 2025
Featured Insight

Recent Developments in the Canadian Psychedelics Industry

This bulletin provides an update on recent developments in Canada's psychedelics industry.

Read More
Feb 12, 2025
Featured Insight

Company Ordered to Cease Using Facial Recognition Technology to Monitor Access to its Facilities: Overview of Quebec Privacy Regulator’s Decision

In this bulletin, we provide an overview of the Quebec privacy regulator's decision in ordering the Company to cease using its facial recognition technology.

Read More
Feb 11, 2025