Toronto, ON (Sept. 24, 2025) – Stephen Frank, President and CEO of the Canadian Life and Health Insurance Association (CLHIA), has issued a statement in response to the Canadian Council of Insurance Regulators (CCIR) position paper on the Harmonization of Incident Reporting Frameworks:
Canada’s life and health insurers welcome CCIR’s release of recommendations for greater harmonization in cyber incident reporting requirements.
Managing and mitigating cyber security incidents continues to be a key focus for financial institutions, which are increasingly leveraging technology to provide the best service possible to their customers.
Prompt reporting of cyber security incidents is important for regulators’ management of an information security incident and allows them to exercise their consumer protection mandate. However, differences in reporting requirements across Canada can duplicate efforts and create undue burden at a time when companies are focused on addressing the incident.
The position paper represents important guidance from the CCIR, which plays a critical role in promoting an efficient and effective insurance regulatory system in Canada. Greater collaboration and efficient information sharing between governments and regulators during a cyber incident are in the best interest of consumers.
Our members look forward to working collaboratively with the CCIR and Canadian federal regulators to harmonize how cyber security incidents are reported.
About the CLHIA
The CLHIA is a voluntary association whose member companies account for 99 per cent of Canada’s life and health insurance business. These insurers provide a wide range of financial security products including life insurance, annuities (including TFSAs, RRSPs, RRIFs and pensions) and supplementary health insurance to nearly 30 million Canadians. They hold over $1 trillion in assets in Canada and employ almost 180,000 Canadians. For more information, please visit www.clhia.ca.
SOURCE: Canadian Life and Health Insurance Association Inc.
Backgrounder:
CCIR Releasing Position Paper on the Harmonization of Incident Reporting Frameworks
Toronto, ON (May 21, 2025) – The Canadian Council of Insurance Regulators (CCIR) is pleased to announce the release of its Position Paper on the Harmonization of Incident Reporting Frameworks.
Information security incidents, including Cyber incidents, are rapidly growing in frequency and sophistication. At the same time, the cyber threat landscape is expanding amid digital transformation, increased dependencies on third-party service providers and geopolitical tensions.
The Position Paper follows up on the review of the Canadian landscape of incident reporting frameworks. It sets out 11 recommendations to CCIR members to achieve greater harmonization in incident reporting, based on the Financial Stability Board Recommendations to Achieve Greater Convergence in Cyber Incident Reporting.
“Prompt reporting is essential for the orderly management of Information security incidents as it enables regulators to continue exercising their consumer protection mandate. As for insurers, it allows them to manage more effectively incidents that could harm them and damage their reputation, said Patrick Déry CCIR Chair and Superintendent, Financial Institutions, Autorité des marchés financiers. “CCIR members recognize that differences in reporting requirements can create challenges for both the industry and authorities and are committed to achieving greater harmonization in incident reporting.”
By adopting this Position Paper on Harmonization of Incident Reporting Frameworks, CCIR members will be committing to consider the recommendations in this document should they implement or update an incident reporting regime in their jurisdiction.
The paper is available on the CCIR website: Harmonization of Incident Reporting Frameworks.
About CCIR
The Canadian Council of Insurance Regulators is an inter-jurisdictional association of insurance regulators. The mandate of the CCIR is to facilitate and promote an efficient and effective insurance regulatory system in Canada to serve the public interest. CCIR members work together to develop solutions to common regulatory issues. For more information, visit www.ccir-ccrra.org.
Source: Canadian Council of Insurance Regulators (CCIR)
Tags: Canadian Council of Insurance Regulators (CCIR), Canadian Life and Health Insurance Association (CLHIA), cyber attacks, cyber risk, cyber security, whitepaper
