Cybersecurity for Canadian Insurance Companies

OSFI's Technology and Cyber Risk Management Guideline B-13, which came into full force for federally regulated financial institutions and insurance companies in January 2024, establishes a principles-based but substantive set of expectations for technology risk governance. B-13 requires federally regulated insurers to maintain a technology risk appetite statement, designate a Chief Information Security Officer or equivalent, implement a technology risk management framework, conduct annual security assessments of critical systems, and maintain a cyber incident response capability with defined escalation paths to senior management and the board. OSFI's technology risk examination process — conducted through its formal Supervisory Framework — evaluates whether an insurer's technology controls are commensurate with its size, complexity, and risk profile. Examiners review documentation, conduct interviews with IT leadership, and test controls including access provisioning and deprovisioning procedures, patch management cycle data, and backup recovery testing records.

The Financial Services Regulatory Authority of Ontario (FSRA) supervises Ontario-licensed insurers, credit unions, pension plans, and mortgage brokers. FSRA has issued guidance on technology risk management for credit unions and has signalled increasing focus on cyber risk for Ontario-regulated property and casualty insurers that fall outside OSFI's federal jurisdiction. For Ontario-regulated insurers, the absence of a B-13 equivalent does not mean the absence of an obligation — FSRA can examine technology risk management under its general supervisory authority, and inadequate cyber controls would be treated as a prudential risk issue. FSRA's expectations align closely with B-13 principles, and insurers subject to FSRA supervision should treat B-13 as the practical benchmark even if not legally required to comply with it.

RIBO (Registered Insurance Brokers of Ontario) regulates approximately 27,000 brokers and 1,200 brokerage firms in Ontario. RIBO's rules require brokers to maintain safeguards over client records, but the specific cybersecurity controls required are less prescriptive than those governing insurers. In practice, RIBO's conduct-based framework means that a broker who suffers a data breach due to inadequate security may face professional conduct proceedings in addition to PIPEDA obligations. The OPC has investigated broker data breaches and found PIPEDA violations where brokers failed to encrypt client files, maintained passwords in spreadsheets, or allowed former employee accounts to remain active. The combination of professional discipline and regulatory privacy enforcement creates dual exposure for brokers that experience preventable breaches.

PIPEDA's 72-hour breach notification expectation — while PIPEDA itself specifies reporting 'as soon as feasible' rather than a strict 72-hour window — has been interpreted by the OPC in practice to mean that notification to the Commissioner should occur within 72 hours of an organization determining that a breach has occurred that poses a real risk of significant harm. For insurers managing a ransomware incident, the 72-hour clock starts running from the moment internal investigation confirms that personal information was likely accessed or exfiltrated — not from the moment the incident is fully contained. This means notification and investigation must run in parallel, which requires pre-built breach notification templates, a pre-designated privacy breach coordinator, and relationships with external legal counsel familiar with OPC expectations established before an incident occurs.