Enhancing Digital Security and Trust Act, 2024, report of a critical cyber security incident by prescribed public sector entities
O. Reg. 51/26, s. 7; S.O. 2024, c. 24, Sched. 1, s. 2 (1) (c)
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- It binds the public sector entities listed in section 2 of Ontario Regulation 51/26: educational institutions as defined in the Freedom of Information and Protection of Privacy Act, Group A, B and C public hospitals, the University of Ottawa Heart Institute, children's aid societies and school boards.
- Report a critical cyber security incident to the Chief Information Security Officer of the Ministry of Public and Business Service Delivery and Procurement as soon as reasonably practical, and no later than 72 hours after you confirm that it occurred (section 7 (3)).
- Decide whether an incident is a critical cyber security incident under the definition and the four criteria in section 7 (1) and (2).
- Include in the report the names of the primary point of contact and alternate, your name, the ministry responsible for overseeing you, the date and time of the incident and of its confirmation, a general description of the incident and, if applicable, of the type of information impacted or stolen (section 7 (4)).
- Keep meeting any other legal obligation that applies to the incident, including those under the Freedom of Information and Protection of Privacy Act (section 7 (5)).
These lines are LexLint's reading of the law's text, as of .
What this law does
A critical cyber security incident is, with respect to a prescribed public sector entity, an incident that has impacted the security, continuity, confidentiality, integrity or availability of digital information the entity collects, uses, retains or discloses, or the infrastructure housing or transmitting that information, and that satisfies at least one of the criteria in the Regulation.
The criteria are a significant adverse impact to the delivery of public services by the entity, a risk to public safety, significant efforts to recover digital information or related infrastructure or activation of cyber security incident response plans, and a significant risk of harm to the reputation of and public confidence in the entity.
The entity shall report a critical cyber security incident to the Chief Information Security Officer of the Ministry as soon as reasonably practical but no later than 72 hours after the entity has confirmed that it occurred.
A report shall include, but is not limited to, the names of the primary point of contact and alternate, the name of the entity, the name of the ministry responsible for overseeing it, the date and time the incident occurred, the date and time of confirmation and a general description of the incident.
Nothing in the reporting section affects other legal obligations the entity may have in respect of a critical cyber security incident, including any obligations under the Freedom of Information and Protection of Privacy Act. The Lieutenant Governor in Council may make regulations governing cyber security at prescribed public sector entities, including regulations requiring them to submit reports to the Minister or a specified individual in respect of incidents relating to cyber security. Ontario Regulation 51/26 comes into force on .