Digital Brain
digital brain
digital brain

CSA Staff Notice 11-326 – Cyber Security

October 2013 Securities Bulletin 2 minute read


On September 26, 2013, the Canadian Securities Administrators (“CSA”) issued Staff Notice  11-326 Cyber Security (“Staff Notice”). The Staff Notice highlights the importance of strong and individually-tailored cyber security measures for issuers, registrants and regulated entities, as such controls promote the reliability of their operations and the security of their confidential information. The Staff Notice identifies two major types of cyber threats in particular that have increased in sophistication and frequency: Denial of Service attacks and Advanced Persistent Threats.

CSA Recommendations for Issuers

The CSA notes that issuers, registrants and regulated entities should be aware of the risks and challenges posed by cyber crime and should take appropriate measures to protect themselves. In particular, the CSA provides the following guidance:

  • Those issuers, registrants and regulated entities that have not yet addressed the issue should consider how to best address the risks of cyber crime, including:
    • Educating staff regarding security of information and computer systems,
    • Following guidance and best practices from industry and security associations, and
    • Conducting appropriate third-party vulnerability and security assessments;
  • Those issuers, registrants and regulated entities that have already taken steps to address the issue should review their cyber security risk control measures on a regular basis;
  • Issuers should consider whether any issues with respect to cyber crime are such that they need to be disclosed in a prospectus or continuous disclosure filing;
  • Registrants should consider whether they are able to manage cyber crime risk in accordance with prudent business practices; and
  • Regulated entities should consider the measures necessary to address the risks of cyber crime.

The Staff Notice further notes that the CSA will consider these issues in its reviews of issuer disclosure and in its oversight of registrants and regulated entities going forward.

by Alexis Marach

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2013

Insights (5 Posts)

Featured Insight

Greening Procurement in Canada: New Implications for the Construction Industry and Beyond

Two new standards under Canada's Policy on Green Procurement impose greenhouse gas emissions disclosure obligations on federal departments and contractors.

Read More
Feb 1, 2023
Featured Insight

New Obligations in Terms of Corporate Transparency

Details Québec's new measures and improvements made to the information available in the registre des entreprises in order to improve companies' transparency.

Read More
Feb 1, 2023
Featured Insight

Display of Trademark on Stickers Affixed to Goods Constitutes Trademark Use

Displaying a retailer’s trademark on stickers affixed to goods already branded with a third party’s mark constitutes "use" of a trademark in Canada.

Read More
Jan 31, 2023
Featured Insight

Term CORRA Officially Under Development

1- and 3- month Term CORRA under development; targeted publication date is at end of Q3 2023; Term CORRA administrator will be CanDeal Innovations Inc.

Read More
Jan 30, 2023
Featured Insight

The State of Play in Shareholder Activism: Issues, Concerns and Trends

Join us for a series of engaging discussions on shareholder activism in Canada. Industry experts will share valuable insights into regulatory and market issues, concerns and trends.

Tuesday, February 28, 2023