CIRO requires investment dealers to report a cybersecurity incident within three days of discovering it, then file a full report within 30 days. The full report covers the cause, the scope, how many people were harmed, and what you changed. CIRO does not certify anyone or name products. It judges you after the incident, on what was actually in place.
This is not a box you tick with “we use MFA.” It is a regulator, your dealer’s compliance team and your insurer asking for proof, under deadline.
Who this applies to.
Investment dealers and their advisors: the reporting rule applies today.
Mutual fund dealers: not yet. The current Mutual Fund Dealer Rules have no cyber reporting rule, but CIRO has proposed extending it to all dealer members. Build to the investment dealer standard now.
Portfolio managers and every other registered firm: the Canadian Securities Administrators expect cyber risk to be part of the compliance system National Instrument 31-103 already requires.
Independent planners in Ontario: FSRA’s title rules set no cybersecurity requirements, but PIPEDA still does.
What CIRO actually asks for.
Within three days: what happened, when you found it, when it started, your first assessment, what you did about it, and a contact name. Within 30 days: the cause, the scope, the number of people harmed, and what you fixed (CIRO incident reporting FAQ).
An incident at your CRM, file storage or email provider still counts. CIRO says so directly, and its Compliance Report for 2026 flags a rise in incidents coming through third-party providers (CIRO, 2026) [CIRO Compliance Report for 2026].
The CSA adds the standing expectations: written policies, regular staff training, a yearly risk assessment, a written incident response plan, security terms in vendor contracts, and encryption.
Where small offices get stuck.
Try answering the three-day questions on a basic Microsoft 365 setup. Sign-in history is short. Nobody was watching for risky sign-ins. There is no record of which device opened which client file. So the firm pays an outside forensics team to reconstruct it, on deadline, at the worst possible time.
The most common setup we find when we take on a new client is MFA turned on and nothing else. MFA no longer stops the attack we see most: a fake Microsoft sign-in page that relays the password and code to the real site, then steals the session so the attacker stays signed in as you.
The controls that answer CIRO’s questions.
Conditional Access
Every sign-in is checked for a managed device, a normal location and risk before access is granted. A stolen password and a relayed code are not enough. Conditional Access is why none of our clients have lost data to an adversary-in-the-middle (AiTM) attack.
Managed, Encrypted Devices
Microsoft Intune blocks any laptop or phone that is not encrypted, patched and locked. A lost phone is wiped remotely. A home PC never reaches client files. When a dealer questionnaire asks how you know, you send a compliance report.
One Identity, Revoked In Minutes
When an advisor or assistant leaves, disabling one Entra ID account closes email, files, the CRM and every connected app together. No forgotten accounts.
Logs Someone Reads
Sign-in and audit logs turned on, kept long enough, and reviewed. This is what turns the three-day report from a guess into a description.
A Plan You Have Rehearsed
Who calls the dealer’s compliance team, who calls the insurer, who starts the CIRO report. CIRO runs table-top exercises for small and mid-sized dealers because unrehearsed plans fall apart on day one.
The licence gap.
Microsoft 365 Business Basic and Business Standard do not include Conditional Access or Intune. Business Premium does, along with Defender for Business and Windows Autopilot, so a new advisor’s laptop arrives ready and compliant at first sign-in.
The licence alone fixes nothing. The protection comes from configuring it properly and keeping it current, and that is the work we do every day.
Help is here.
See how we support wealth management firms, or read Is Microsoft 365 PIPEDA Compliant? If you want a fully managed IT partner to set this up and run it, book a discovery call or call us at (416) 292-3300.
FAQ
Does CIRO require specific cybersecurity software?
No. CIRO requires incident reporting and the CSA requires firms to manage cyber risk. The tools are your choice, but you need to show the controls are in place and maintained.
Do CIRO cybersecurity reporting rules apply to mutual fund dealers?
Not yet. The reporting rule applies to investment dealers. CIRO has proposed extending it to all dealer members, mutual fund dealers included.
What counts as a reportable incident?
CIRO ties it to outcomes: substantial harm to any person, a material impact on operations, invoking your continuity or disaster recovery plan, or a separate legal duty to notify. Incidents at your service providers count. The three-day clock starts at discovery.
How do CIRO requirements relate to PIPEDA?
They run side by side. One breach can mean a CIRO report, a report to the Privacy Commissioner, notice to clients and an insurance claim review. All of them ask what was actually configured at the time.
