A-8.2, r. 0.1 - Regulation respecting the management and reporting of information security incidents by certain financial institutions and by credit assessment agents

Français
Texte complet
9. A financial institution or a credit assessment agent shall send a report to the Authority within 30 days following the date the notice is sent to the Authority confirming that the incident is under control and that operations have returned to normal. The report shall, in particular:
1°  identify the source of the incident and the type of incident;
2°  provide the financial institution’s or credit assessment agent’s assessment regarding a potential recurrence of the incident; and
3°  describe the actions taken to reduce the likelihood of incidents of a similar nature occurring in the future.
A.M. 2024-13, s. 9.
In force: 2025-04-23
9. A financial institution or a credit assessment agent shall send a report to the Authority within 30 days following the date the notice is sent to the Authority confirming that the incident is under control and that operations have returned to normal. The report shall, in particular:
1°  identify the source of the incident and the type of incident;
2°  provide the financial institution’s or credit assessment agent’s assessment regarding a potential recurrence of the incident; and
3°  describe the actions taken to reduce the likelihood of incidents of a similar nature occurring in the future.
A.M. 2024-13, s. 9.