RIBO Cyber Security Guide for Ontario Brokerages

Q: Does RIBO require brokerages to have a cyber security program?

RIBO's published cyber security guidance recommends that firms adopt a cyber security program with written policies and procedures, and sets out what the manual should cover. It is guidance, not a rule with a filing. But the duty to protect client information is real: CISRO notes that using technology to collect and store client information comes with the responsibility of safeguarding it, and privacy law (PIPEDA) applies to how a brokerage protects personal information.

The short answer

RIBO recommends a written cyber security program and strongly recommends cyber liability insurance. Privacy law requires you to protect client information and to report serious breaches. Insurers increasingly ask for proof of coverage and controls such as multi-factor authentication. Here is how the three fit together.

RIBO guidance

Required

Safeguards for personal information. If a breach creates a real risk of significant harm: report it to the Privacy Commissioner and notify the people affected. Keep a record of every breach for 24 months.

Your insurers

Increasingly expected

RIBO notes that most insurers require MFA before issuing a cyber policy, and that insurers increasingly ask brokerages for proof of cyber liability coverage. Policies can require specific safeguards.

This guide is general information for Ontario brokerages, not legal advice. RIBO's guidance can change: check the Principal Broker Handbook page for the current version.

Source 1 · RIBO

What RIBO's cyber security guidance says

RIBO's guidance sits in a two-page supplement to its Principal Broker Handbook. It recommends that firms adopt a cyber security program, and it names the attacks brokerages face most: phishing, social engineering, ransomware (including criminals contacting your clients to demand more) and hacking through weak passwords or unpatched software.

A written manual, available to all staff

RIBO says the policies and procedures manual should be written down, available to everyone, and reviewed as technology changes. It should identify what data needs protecting, the threats you face, your safeguards, and what to do in an incident. It lists four areas:

Data

An inventory of your firm's resources, how they are managed and who can access them; backups.

Safeguards

Who has access to what (internal and external); a secured wireless network; up-to-date software, operating systems and antivirus; early warning of unauthorized activity; password and encryption standards for all devices.

Risks

The attacks you may face and how to spot them; equipment theft, loss or breakage; third parties with access to your data; departing employees; working from home and social media.

Incidents

Systems that monitor for breaches, and how you report incidents to consumers, RIBO and your insurer.

Training and MFA

RIBO calls staff the most likely targets and recommends regular security awareness training. It describes multi-factor authentication for all employees as one of the best measures available: a low-cost control that prevents most phishing and password attacks, and one that most insurers require before issuing a policy.

Cyber liability insurance

RIBO strongly recommends that firms buy cyber coverage for first-party and third-party liability, with limits sufficient for their exposures. As an example it gives a minimum of $5,000,000 per claim/per occurrence with dedicated data breach response limits, and it notes that some policies require certain safeguards to be in place. Our guide to the controls cyber insurers ask about covers what those usually are.

A consultation still to come

The supplement says RIBO intends to consult all licensees on whether cyber insurance should become mandatory for all registered firms, including sole proprietors, partnerships and corporations. Watch RIBO's consultations page for it.

Source 2 · CISRO

The five steps in CISRO's Cybersecurity Readiness

RIBO points brokerages to Cybersecurity Readiness, a reference tool from the Canadian Insurance Services Regulatory Organizations (CISRO), the national forum of insurance intermediary regulators. It applies to agents, brokers, adjusters, MGAs and third-party administrators, and it says practices should fit the size and structure of each organization. It also recommends getting help from a cybersecurity professional to assess and review your current practices.

Make cybersecurity a priority. Give one person responsibility for overseeing and reporting on cyber risk, write policies everyone follows, train regularly, and make it safe for staff to report incidents.
Know what client information and technology to safeguard. Inventory devices and users, know where client data is stored and how sensitive it is, and back it up off-site or in the cloud.
Identify cyber risks, including from third parties. Assess risks continuously, review access, and vet and monitor service providers: "intermediaries are responsible for any services outsourced to third parties."
Implement adequate safeguards. Control and monitor access, limit privileged accounts, enable MFA, patch on a schedule, test for vulnerabilities and dispose of devices securely.
Detect and respond. Monitor activity, write and test an incident response plan, appoint a response team, set a communication protocol, and investigate root causes.

Its incident response plan has five parts: investigation, mitigation, evaluation (including whether to trigger your business continuity plan), communication and documentation.

Source 3 · Privacy law

What privacy law requires when something goes wrong

Ontario brokerages handle personal information in the course of commercial activity, which brings them under the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Its breach rules have applied since November 1, 2018:

Report a breach of security safeguards to the Office of the Privacy Commissioner of Canada when it is reasonable to believe it creates a real risk of significant harm to someone, as soon as feasible.
Notify the affected individuals, and any organization that can help reduce the harm. The notice must say what happened, what information was involved, what you are doing, what they can do, and who to contact.
Record every breach, including those you don't report, and keep the record for 24 months after you determine the breach occurred.

CISRO makes the same point for intermediaries: know your obligations to report incidents under applicable privacy legislation before you need them.

Where brokerages usually get stuck

The manual never gets written. The controls may exist, but nothing on paper says who owns them, so nobody can show a carrier or RIBO what is in place.
"The MSP handles it." The MSP closes tickets; nobody at the brokerage checks what it actually configured or what its contract says about incidents.
MFA has gaps. It is on for email but not for the broker management system, carrier portals or admin accounts.
The incident plan is untested. The first time anyone reads it is during the incident.

This is where ABISOL works: as your fractional CISO, ABISOL sets direction, writes the policies with you, checks your MSP's work and keeps a plan your principal broker can stand behind. See how ABISOL works with insurance brokerages.

Questions brokers ask

Does RIBO require brokerages to have a cyber security program?

RIBO's published cyber security guidance recommends that firms adopt a cyber security program with written policies and procedures, and sets out what the manual should cover. It is guidance, not a rule with a filing. But the duty to protect client information is real: CISRO notes that using technology to collect and store client information comes with the responsibility of safeguarding it, and privacy law (PIPEDA) applies to how a brokerage protects personal information.

Is cyber insurance mandatory for Ontario brokerages?

Not as of RIBO's supplement (last updated October 25, 2023). RIBO strongly recommends first-party and third-party cyber liability coverage, and says it intends to consult all licensees on whether cyber insurance should become mandatory for all registered firms, including sole proprietors, partnerships and corporations. Check RIBO's consultations page for the current status.

How much cyber coverage does RIBO suggest?

RIBO gives an example of a minimum of $5,000,000 per claim/per occurrence, with dedicated data breach response limits. It also notes that insurers are increasingly asking brokerages for proof of cyber liability coverage. Set your limits with your insurer based on the client data you hold and your exposures.

Do we have to report a cyber incident?

RIBO's guidance says your cyber security manual should cover reporting incidents to consumers, RIBO and your insurer. Separately, under PIPEDA you must report a breach to the Office of the Privacy Commissioner of Canada and notify affected individuals when it is reasonable to believe the breach creates a real risk of significant harm, and you must keep a record of every breach for 24 months. Your cyber policy will also have its own notice requirements.

Our MSP handles our IT. Are we covered?

Not on its own. CISRO's guidance is direct: intermediaries are responsible for any services outsourced to third parties. Your MSP can run the controls, but the brokerage still needs to know what is in place, check it, and have contracts that cover security responsibilities and incident notice.

Does this apply to small brokerages and sole proprietors?

Yes. CISRO says some practices should be implemented in a way that suits the size and structure of each organization, so a small brokerage can keep it simple. RIBO's planned consultation on mandatory cyber insurance explicitly includes sole proprietors.

Sources

Read on October 8, 2026. If a source has changed since, the source wins.

What RIBO expects from your brokerage on cyber security