Cybersecurity & Technology

"Active management of cyber risk is critical to the stability of IIROC-regulated firms, the integrity of Canadian capital markets and the protection of investors." Andrew Krieger, President and CEO, IIROC

Cybersecurity Summary:

Cybersecurity is a key issue for Dealers and IIROC. Cybersecurity has been an important priority for IIROC for the last few years.

IIROC is committed to helping firms strengthen risk management practices and increase cybersecurity preparedness. IIROC’s initiatives include self-assessment surveys, consultations with cybersecurity professionals, and table-top exercises. We also provide educational resources such as best practice guides and webinars to help Dealers plan and implement effective risk controls and response plans for cyber threats and attacks.

What's new?

  • The cybersecurity tabletop exercise is scheduled for October 26 in Toronto and November 1 in Calgary. You will receive an invitation in your inbox.
  • IIROC has developed a cybersecurity self-assessment tool for IIROC firms that are mainly small and medium-sized. The purpose of tool is to help IIROC firms identify areas of strength and weakness based on the information security practices. IIROC firms can request a copy of the tool and find a short instructional video in this Notice. (July 21, 2022)
  • We published Fundamentals of Technology Risk Management (pdf) to help mainly small and medium-sized IIROC firms take the first steps towards assessing and managing technology risk. This guide provides some helpful information to IIROC firms on how to begin building a technology risk management program. (March 31, 2021)
  • We issued a Notice on Ransomware that outlines what IIROC firms and employees should do to prevent, detect, respond to and recover from a ransomware attack. The Notice also provides some information about the RCMP’s National Cyber Crime Coordination Unit or NC3. (March 16, 2021)
  • We have a mailbox where you can report incidents to IIROC: [email protected]
  • We're seeing increased cybersecurity and fraud attacks targeting clients of our firms. We issued a Notice “Cybersecurity and Fraud – Protecting Clients” that outlines the types of attacks to look out for and discusses what firms and advisors can do to prevent or limit the loss to clients. The Notice also summarizes when and how to report such incidents to IIROC. (November 9, 2020)
  • We have released two webinars: one on Cybersecurity Governance, and another on the Cybersecurity Threat Landscape. Check them out in our Webinars link. (October 29, 2020)
  • Cloud services and application interfaces are being increasingly targeted and their vulnerabilities exploited by cyber attackers. We issued a Notice to recommend some controls that firms can consider to manage these risks. (June 24, 2020)
  • The table-top exercise for small and medium-sized Dealer Members, that was initially planned for 2020, will now be postponed to 2021 due to the COVID-19 pandemic. (June 3, 2020)
  • We published a Notice that outlines some tips for advisors and employees on how to prevent and respond to a cyber attack even when working from home. (April 21, 2020)
  • A Notice has been issued to provide information to IIROC Dealer Members on cybersecurity threats arising from the COVID-19 pandemic, and includes some tips to help firms and its employees protect clients’ information and itself. (March 30, 2020)
  • A new IIROC Cyber Governance Guide has been published. Check it out in our ‘Guides and Resources’ section. (March 3, 2020)

Cybersecurity Information:

Incident Reporting summary:

IIROC implemented rules to require mandatory reporting of a cybersecurity incident by Dealers to IIROC.

Self-assessment surveys:

IIROC conducted cybersecurity self-assessment surveys for all Dealers in 2016, and again in 2018. Each Dealer was issued a confidential Cybersecurity Report (CSR) which identified their level of cybersecurity maturity and set out high-level recommendations for priority attention.

Site visits:

In 2017 and 2019, IIROC engaged cybersecurity consultants and visited selected Dealers with cybersecurity self-assessment maturity levels below the expected target of their industry peer group.

Table-top exercises:

IIROC hosts table-top exercises to help small and medium-sized firms with cybersecurity preparedness and risk management practices.

Guides and resources:

IIROC has published guides and resources to help Dealers protect themselves and their clients against cyber threats and attacks.


Information and links to webcasts on cybersecurity issues released by IIROC’s Member Education Services group.

Helpful Links:

Here are some links to information and resources provided by the Government of Canada on cybersecurity.

Welcome to!

We have a new look! You can find the Canadian Investment Regulatory Organization (CIRO) at with our fresh look and feel.

You can now find new publications published by CIRO since January 1, 2023 on If you are looking for past notices or bulletins published by MFDA or IIROC, you can find those on our legacy websites. Enforcement related content will continue on those websites as well.

You can now find previous Annual Reports and Enforcement Reports on, along with Halts and Resumption, and our ePublications sign up (for all previous MFDA and IIROC subscriber lists).

We will continue moving items off MFDA and IIROC in 2023/2024. Stay tuned for future updates.