Should Ontario Require Hospitals, Schools, and Colleges to Report Cyber Attacks?

Official title: Cyber Security Regulation under the Enhancing Digital Security and Trust Act, 2024.

Open Regulations & Permits Education Health & Safety Technology & Digital
Ontario wants to create new cyber security rules for hospitals, school boards, children's aid societies, and colleges. The proposed regulation would require these organizations to name a cyber security contact person, complete security assessments, and report major cyber incidents to the government. Right now, reporting cyber attacks isn't mandatory, so the province doesn't have a clear picture of the threats facing public services.

Why This Matters

Use a hospital? Send your kids to public school? Attend college? These organizations hold your personal data—health records, student information, financial details. When they get hacked, your information is at risk. This regulation aims to make sure they're actually prepared for cyber threats and that the government knows when attacks happen.

What Could Change

Hospitals, school boards, children's aid societies, and post-secondary institutions would have to designate a cyber security contact, complete maturity assessments, and report critical incidents to the province. The government says this won't add major costs since many organizations already do this informally. Future phases may add cyber security training requirements.

Key Issues

  • Should public sector organizations be required to designate a cyber security point of contact?
  • What challenges would organizations face in completing cyber security maturity assessments?
  • Should reporting of critical cyber security incidents be mandatory?
  • Should future requirements include cyber security education and awareness training?

How to Participate

  1. Review the proposal details on this consultation page to understand the proposed cyber security requirements.
  2. Submit your feedback using the Comment on this proposal form by the deadline.

Submit Your Input

Comment On Cyber Security Regulation Proposal

Tips for Your Submission

  • Where possible, please provide examples or evidence to support your views.
Questions Being Asked (3)
  1. What existing cyber security practices does your organization have in place?
  2. What challenges might arise in meeting the proposed requirements?
  3. What are the potential benefits and challenges of the proposed Cyber Security Regulation?