The Canadian Securities Administrators (CSA) published Staff Notice 33-322 – Review of Registered Firms’ Cybersecurity Practices and Additional Guidance (the Staff Notice) on July 15, 2026, following a focused review of 73 registered firms’ cybersecurity practices. The message is not especially surprising: cybersecurity is a core business risk, and registered firms are expected to have practical, documented and regularly refreshed controls that fit their size, complexity and operations.
Practical takeaways
- Right-size your cyber security program. Smaller and mid-sized firms may not need bank-sized machinery, but they do need to cover the key risks and be able to show their work.
- Make cybersecurity part of the compliance calendar: policy review, training, risk assessment, vendor review, incident response testing and backup testing should all be on the list.
- Keep evidence. The CSA repeatedly focuses on documentation, including reviews, training records, risk assessments, vendor due diligence, testing and follow-up.
- Treat third-party incidents as your problem too. If a provider holds either firm or client data, its breach may quickly become your own regulatory, contractual and client-communications issue.
- Do not wait for a breach to find out who is supposed to do what. Test the incident response plan while everyone is calm and the phones are not ringing.
As set out in the Staff Notice, cybersecurity incidents are both a business risk to firms and a risk to the confidential client data held by firms. In other words, “we thought IT had it covered” is unlikely to be an acceptable response.
Five expected cybersecurity practices
1. Policies that match reality. Firms should have written cybersecurity policies and procedures that cover the obvious trouble spots: electronic communications, firm and personal devices, remote access, data security and encryption, software updates, vendor oversight, employee training, accountability and incident reporting. As with many other policies, the CSA expects those pertaining to cybersecurity to be reviewed at least annually and to align with the firm’s actual procedures. In our experience, policies, controls, governance and reporting must be assessed against real-world expectations, and work with the firm’s crisis communication, business continuity, disaster recovery and escalation procedures. In addition, incident playbooks need to have practical decision trees, notification triggers, evidence preservation and documentation protocols. About those passwords…
2. Training that sticks. Tailored cybersecurity training should happen at the time of onboarding a new employee, and at least annually after that, with more frequent refreshers where the firm’s risk profile calls for it. Training should cover phishing and social engineering, confidential information, passwords, device security, and when and how to escalate. Firms should keep records of who attended and when, and what was covered. Documented phishing simulations are all but expected, with repeat clickers subject to targeted follow-up.
3. Risk assessments with actual controls. Firms should conduct and document cybersecurity risk assessments at least annually. The assessment should identify critical assets and confidential data, vulnerabilities (both internal and external), likely threats, potential consequences and whether the firm’s controls are sufficient. CSA staff expect that these risk assessments are not only documented, but that they evidence that a firm has considered all of the specified areas. Firms should not forget about risks and controls related to access rights: role-based access controls, the principle of least privilege, timely removal of access and periodic reviews are squarely on the CSA’s radar. Firms that use third-parties to conduct these risk assessments are expected to address any missing elements set out in the assessment and how any concerns will be addressed. Baseline controls to consider for areas of risk include multi-factor authorization, VPNs, encryption, scheduled systems backups, email filtering, software patching and updating, suspicious cyber activity logs and secure data disposal. Staff note that cybersecurity audits and penetration testing, while not mandatory, are effective practices.
4. Vendor oversight that is more than “they’re big, so are probably fine.” Every firm that was part of the review used third-party service providers with access to systems or data. The CSA expects meaningful due diligence before onboarding all third-party service providers, and periodically afterward, with documentation supporting those efforts. Firms should understand how providers protect data, where data is stored, how access is controlled, how incidents are reported, and how responsibilities are divided in cloud environments. We often advise firms to strengthen contractual requirements and update items such as cybersecurity controls, breach notification, audit rights, sub-contracting and data handling. System and Organization Controls (SOC) 2 or similar reports are useful, where available, but they still need to be reviewed.
5. An incident plan that has been tested before the incident. Firms should have a written incident response plan with a clear definition of a cybersecurity incident, a description of the different types of cyber attacks a firm might face, procedures for attacks on third-party service providers holding firm data, and specifics on roles and responsibilities for notifications, escalations and so on. Firms are expected to regularly test this plan, whether through tabletop exercises or simulations. Well thought-out tabletop exercises entail designing a realistic ransomware or cyber incident scenario that unfolds across technical, executive and board-level decision points. Backup recovery testing should also be documented. While cyber insurance is not required, the CSA notes it can be helpful, both financially and by providing operational assistance when faced with a security breach.
How we can help
By Borden Ladner Gervais LLP “BLG” >>
“As Canada’s law firm, BLG provides high-value advice and advocacy to address our clients’ business challenges and problems. We go beyond legal to anticipate, consult and advise in a rapidly changing digital world.
We have extensive experience acting in specialized and complex deals and disputes. Vigilant, curious and collaborative, we harness technology and innovation to offer our clients exceptional service and value.
With 800+ lawyers across Canada, we serve clients throughout North America, Europe, and Asia. Offering expertise in intellectual property, disputes and corporate transactional matters, our connectivity gives our clients the next-level service required to achieve success in complex and international matters.”
Please visit the firm link to site