Enhancing Digital Security and Trust Act, 2024, cyber security programs of prescribed public sector entities
S.O. 2024, c. 24, Sched. 1, ss. 2-4; O. Reg. 51/26, ss. 2-6
In force since .
A sector security regimes rule binding government bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- It binds the public sector entities listed in section 2 of Ontario Regulation 51/26: educational institutions as defined in the Freedom of Information and Protection of Privacy Act, Group A, B and C public hospitals, the University of Ottawa Heart Institute, children's aid societies and school boards.
- Develop and implement a program for ensuring cyber security that satisfies at least the requirements of Ontario Regulation 51/26 (section 3).
- Designate one senior employee with decision-making authority over cyber security as the primary point of contact and another as the alternate, give their names, titles and contact details to the Chief Information Security Officer of the Ministry of Public and Business Service Delivery and Procurement, and report any change within 10 business days (section 4).
- Complete an initial cyber security maturity assessment within one year after the Regulation first applies to you, and a further one at least once in every two-year period (section 5).
- Submit a summary of each assessment, approved by the primary point of contact, to the Chief Information Security Officer of the Ministry within 30 business days of completing it (section 6).
- Comply with any directive the Minister issues to you on cyber security (Act, section 4 (4)).
These lines are LexLint's reading of the law's text, as of .
What this law does
The Enhancing Digital Security and Trust Act, 2024 was enacted by an Act that was assented to on . The Lieutenant Governor in Council may make regulations governing cyber security at public sector entities as may be prescribed, including regulations requiring them to develop and implement programs for ensuring cyber security. The Minister may issue directives to public sector entities respecting cyber security.
A public sector entity to whom a directive is issued shall comply with the directive. A public sector entity is an institution within the meaning of the Freedom of Information and Protection of Privacy Act other than the Assembly, an institution within the meaning of the Municipal Freedom of Information and Protection of Privacy Act, a children's aid society or a school board.
The Minister is the Minister of Public and Business Service Delivery and Procurement or another member of the Executive Council designated to administer the Act. Failure to comply with the Act or with a regulation made or directive issued under it does not affect the validity of any policy, Act, regulation, directive, instrument or decision. Nothing in the Act or in a regulation made or directive issued under it establishes a private law duty of care owing to any person.
Ontario Regulation 51/26 prescribes as public sector entities an educational institution as defined in the Freedom of Information and Protection of Privacy Act, a public hospital graded as a Group A, B or C hospital under the Public Hospitals Act, the University of Ottawa Heart Institute, a children's aid society and a school board.
Every prescribed public sector entity shall develop and implement a program for ensuring cyber security that satisfies, at a minimum, the requirements set out in the Regulation. Each prescribed public sector entity shall designate one of its employees as its primary point of contact for ensuring cyber security and another employee as an alternate.
A designated primary point of contact or alternate must hold a senior management position and have decision-making authority with respect to cyber security at the entity. The entity shall give the Chief Information Security Officer of the Ministry the contact details of its primary point of contact and alternate and notice of any change as soon as reasonably practical but no later than 10 business days following the change.
An entity shall, subject to an election under subsection 5 (2), complete an initial cyber security maturity assessment no later than one year after the day the Regulation first applies to it, and a further assessment at least once within every subsequent two-year period, and an entity that completed an assessment within one year before that day may elect to consider it the initial assessment.
No later than 30 business days after the completion of a cyber security maturity assessment, the entity shall submit a summary of the assessment to the Chief Information Security Officer of the Ministry. Ontario Regulation 51/26 comes into force on .