![Global rules on foreign direct investment](https://www.nortonrosefulbright.com/-/media/images/nrf/nrfweb/knowledge/publications/us_24355_legal-update--fdi-alert.jpeg?w=265&revision=a5124a65-abf9-40e4-8e96-9df39ffdb212&revision=5250068427347387904&hash=96B456347C3246E5649838DF281C5F5D)
Publication
Global rules on foreign direct investment (FDI)
Cross-border acquisitions and investments increasingly trigger foreign direct investment (FDI) screening requirements.
Canada | Publication | September 1, 2021
The Office of the Superintendent of Financial Institutions (OSFI) recently released an updated Technology and Cyber Security Incident Reporting Advisory and new requirements for the Cyber Security Self-Assessment (the Self-Assessment). Both updated guidance documents are effective immediately. The updates seek to clearly outline OSFI’s expectations for federally regulated financial institutions (FRFIs) when assessing their cybersecurity posture and reporting incidents.
To read part one of this update on the changes made to the advisory, click here. Part two of this update tackles OSFI’s Self-Assessment tool, which is seeing its first update since 2013. In particular, OSFI is enhancing its Self-Assessment to reflect the current cybersecurity risks associated with the digitization of financial services.
OSFI notes that the risk-rating levels are intended to help the FRFI gauge the maturity of its security controls. For each item, a control statement states a best practice, process, responsibility or other safeguard against which the FRFI should compare its internal processes.
With FRFIs accelerating digitization and digital transformation initiatives, the frequency, severity, and sophistication of cyber threats have increased, resulting in a higher risk of attack. OSFI’s objective is to ensure that, in part through the Self-Assessment, FRFIs understand their cybersecurity posture and implement any requirements or remedial actions to achieve (and maintain) the highest rating possible.
Although the Self-Assessment is not mandatory, FRFIs are encouraged to complete the assessment to gain a better understanding of their level of cyber preparedness. This in turn will allow FRFIs to develop and maintain their cyber security practices and be ready in the event of a cyber attack. That said, organizations should be prepared to share their self-assessment with OSFI and be able to effectively justify why they have selected a particular rating for a given category.
Furthermore, OSFI has announced forthcoming guidance that will supplement the Self-Assessment and be regularly refreshed. FRFIs should look out for future OSFI announcements to ensure their cyber security measures are up to date.
The authors wish to thank articling student Marisa Kwan for her help in preparing this legal update.
Publication
Cross-border acquisitions and investments increasingly trigger foreign direct investment (FDI) screening requirements.
Publication
Artificial intelligence (AI) raises many intellectual property (IP) issues.
Publication
We are delighted to announce that Al Hounsell, Director of Strategic Innovation & Legal Design based in our Toronto office, has been named 'Innovative Leader of the Year' at the International Legal Technology Association (ILTA) Awards.
Subscribe and stay up to date with the latest legal news, information and events . . .
© Norton Rose Fulbright LLP 2023