pc
nid 94023
Jul 15, 2026
ataylor@vixio.com
British Columbia
The British Columbia Securities Commission
financial services
125% of draft length
draft in Generated
Generated
2317 charsBritish Columbia Securities Commission Publishes Cybersecurity Guidance Following Compliance Examinations
On July 15, 2026, the Canadian Securities Administrators (CSA) published CSA Staff Notice 33-322, which summarizes findings from focused compliance examinations of registered firms' cybersecurity practices and provides updated regulatory guidance on cybersecurity expectations.
The CSA conducted compliance examinations of 73 registered firms—including investment fund managers, portfolio managers, exempt market dealers, and combinations thereof—to assess whether their cybersecurity practices satisfy section 11.1 of National Instrument 31-103 Registration Requirements, Exemptions and Ongoing Registrant Obligations (NI 31-103). This instrument requires registered firms to establish, maintain, and apply policies and procedures that establish a system of controls and supervision sufficient to manage cybersecurity risks in accordance with prudent business practices.
Key findings revealed significant gaps across five critical areas. Eight percent of firms lacked written cybersecurity policies and procedures entirely, while 55 percent had policies requiring enhancement. Twenty-one percent of firms provided no cybersecurity training to employees, and 16 percent maintained inadequate documentation of training. Forty-five percent of firms conducted cybersecurity risk assessments that could have been more robust, with 12 percent providing no assessment documentation. Forty-one percent of firms could strengthen their oversight of third-party service providers, and 62 percent lacked adequate documentation supporting this oversight. Additionally, 15 percent of firms had no written incident response plan, and 63 percent with plans should have tested them more regularly.
The CSA identified effective practices and provided detailed guidance addressing cybersecurity policies and procedures, employee training and awareness, risk assessments and controls, third-party service provider due diligence, and incident response planning. The notice emphasizes that firms should conduct annual cybersecurity risk assessments, provide regular employee training, implement meaningful due diligence on service providers, and test incident response plans regularly. The guidance applies to all registered firms under Canadian securities legislation, with expectations scaled to firm size and operational complexity.
Agent draft
Not run yet.
Published
2895 charsCanadian Securities Administrators Publish Staff Notice on Cybersecurity Practices for Registered Firms
On July 15, 2026, the Canadian Securities Administrators (CSA) published Staff Notice 33-322, which summarizes findings from focused compliance examinations of 73 registered firms' cybersecurity practices and provides updated guidance. The examinations reviewed firms registered as investment fund managers, portfolio managers, restricted portfolio managers, and exempt market dealers. Under section 11.1 of National Instrument 31-103 , registered firms must establish, maintain, and apply policies and procedures to manage business risks, including cyber threats. The notice updates previous CSA cybersecurity guidance from 2013 through 2017.
Key findings and guidance include:
Cybersecurity policies and procedures: While most firms had written policies, 8 percent had none, and 55 percent had policies that could be enhanced. The CSA expect policies to address electronic communications, device usage (firm-issued and personal), loss or disposal of devices, public internet use, third-party oversight, risk assessments, data security and encryption, training, and accountability. Policies should be reviewed annually with documentation maintained.
Cybersecurity training: According to the guidance, training should be provided at least annually (more frequently for firms with greater complexity) and cover recognizing risks, threat types, handling confidential information, password use, device security, and incident escalation.
Cybersecurity risk assessments and controls: The CSA found 45 percent of firms conducted assessments that could be more robust, and 12 percent had no documentation. The guidance states risk assessments should be conducted at least annually and include an inventory of critical assets, identification of vulnerabilities (including employee access rights), how threats are identified, and adequacy of controls. It further highlighted controls including multi-factor authentication, data encryption, regular backups, and logging of suspicious activity.
Third-party service providers: All reviewed firms used third-party providers with access to systems or data. Firms should conduct and document meaningful initial and ongoing due diligence on third-party cybersecurity practices, including requesting System and Organization Controls (SOC) reports or similar attestations, maintaining logs of providers, and updating due diligence questionnaires annually.
Cybersecurity incident response plans: According to the guidance, plans should include a definition of a cybersecurity incident, response procedures (including for incidents at third-party providers), data backup and recovery procedures, and notification protocols.
The notice emphasizes that firms of different sizes and complexities may implement practices proportionately, but relevant risks must be appropriately addressed. The CSA expects firms to stay current on evolving cybersecurity threats.