How do you report a cyber incident to OSFI?
By Nick Jang, founder of MINERVA Studio ·
The short answer
A bank, insurer or trust company that OSFI regulates must report a technology or cyber security incident to OSFI within 24 hours, or sooner if possible. The report goes in writing to OSFI’s Technology Risk Division and to the institution’s Lead Supervisor, on OSFI’s incident reporting form. An incident is reportable if it meets any one of the criteria in OSFI’s advisory, for example if you rated it high or critical yourself. After the first report, OSFI expects regular updates until it’s resolved, then a post-incident review.
Where the rule comes from
The rule is OSFI’s Technology and Cyber Security Incident Reporting advisory, dated 13 August 2021. It replaced an earlier version from January 2019 and applies to every federally regulated financial institution: banks, foreign bank branches, life insurance and fraternal companies, property and casualty companies, and trust and loan companies.
OSFI defines an incident broadly: anything that affects, or could affect, the institution’s operations, including the confidentiality, integrity or availability of its systems and information. It doesn’t have to be an attack. A data centre outage counts.
What makes an incident reportable
One criterion is enough. The advisory lists them, and they fall into a few groups:
| Group | The incident… |
|---|---|
| Wider impact | could affect other institutions or the Canadian financial system; affects settlement, confirmations or payments. |
| Your operations | hits operations, infrastructure, data or systems, including customer information; disrupts business systems (a utility or data centre outage, lost connectivity); affects key or critical systems. |
| Recovery | triggers your disaster recovery plan, or a third-party vendor declares a disaster that affects you. |
| Customers and reputation | spreads to external customers; the number of affected customers is growing; media or public disclosure is imminent. |
| Third parties | starts at a third party and affects you. |
| Your own escalation | activates your incident team or protocols; is reported to the board or senior management; is reported to the Privacy Commissioner, another federal department such as the Canadian Centre for Cyber Security, another regulator or the police; brings in counsel; leads to a cyber insurance claim. |
| Your own rating | is rated high or critical, or priority, severity or tier 1 or 2, on your internal scale; breaches your risk appetite or thresholds. |
If you’re not sure, OSFI encourages you to report anyway, as a precaution, or to ask your Lead Supervisor. In practice, the last two groups do most of the work: if your own escalation process fired, you probably owe OSFI a report.
The timeline
| When | What |
|---|---|
| Within 24 hours of the incident, or sooner | A written report on OSFI’s Technology and Cyber Incident Reporting Form. Where you don’t know a detail yet, say "information not yet available", give your best estimate and say when you’ll know more. |
| Regularly after that, for example daily | Updates as new information comes in, until every detail is provided. OSFI can change how often it wants them. |
| Until contained or resolved | Situation updates, including short- and long-term remediation plans. |
| After containment, recovery and closure | A post-incident review with lessons learned. |
The report goes to OSFI’s Technology Risk Division (TRD-DRT@osfi-bsif.gc.ca) and your Lead Supervisor. If email is down, which is possible in a serious incident, OSFI accepts a phone report followed by paper.
If you don’t report
The advisory says plainly that failing to report can lead to more supervisory oversight: closer monitoring, being put on a watch list, or being staged (moved up OSFI’s intervention ladder). Late reporting tends to be noticed, because the same incident often reaches OSFI another way: through the media, a vendor or another institution.
Getting ready before it happens
- Write OSFI’s criteria into your severity scale, so the person rating an incident at 2 a.m. knows a rating of high triggers a report.
- Name who sends the report, and a backup, with the form saved where they can reach it during an outage.
- Count vendor incidents. A cloud provider or software vendor’s outage or disaster declaration that affects you is reportable. Know which of your systems depend on which suppliers, before you need to.
- Keep a timeline as you go: detection, rating, escalation, report sent. The post-incident review asks for it.
- Rehearse it in your tabletop exercises, including the 24-hour clock.
This sits beside OSFI’s Guideline B-13, which expects institutions to detect, manage and report technology incidents, and OSFI’s cyber self-assessment, which asks how mature that process is. For the vendor side, see OSFI B-10. MINERVA keeps each supplier with the systems and models that depend on it, so when a vendor has an incident you can see what it touches in one place. See AI vendor risk.
Related questions
How long do you have to report a cyber incident to OSFI?
Within 24 hours, or sooner if possible, followed by regular updates (for example daily) until the incident is resolved, and a post-incident review afterwards.
Who do you send an OSFI incident report to?
In writing to OSFI’s Technology Risk Division and to the institution’s Lead Supervisor at OSFI, using OSFI’s Technology and Cyber Incident Reporting Form.
Does a vendor’s outage have to be reported to OSFI?
Yes, if it affects the institution. The advisory’s criteria include an incident at a third party that affects the institution and a disaster declared by a third-party vendor.
Is a cyber incident reported to OSFI also reported to the Privacy Commissioner?
They are separate duties. A breach involving personal information may also have to be reported to the Office of the Privacy Commissioner of Canada; reporting to the Commissioner is itself one of OSFI’s criteria for reporting to OSFI.
What happens if a bank doesn’t report a cyber incident to OSFI?
OSFI says failure to report may lead to increased supervisory oversight, including enhanced monitoring, watch-listing or staging.
Sources
- OSFI — Technology and Cyber Security Incident Reporting (advisory, 13 August 2021)
- OSFI — Technology and cyber incident report: detailed instructions
- OSFI — Guideline B-13, Technology and Cyber Risk Management
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.