CSA Staff Notice 33-322 sets out the Canadian Securities Administrators' current cybersecurity expectations for registered firms. It was published 15 July 2026 after a review of 73 firms. It hangs off section 11.1 of National Instrument 31-103, which requires a registered firm to have a compliance system reasonably designed to manage the risks of its business, and the CSA now reads cybersecurity squarely into that obligation.
The CSA reviewed 73 firms before publishing the notice on 15 July 2026. It ties cybersecurity to section 11.1 of National Instrument 31-103, which requires a registered firm to have a compliance system reasonably designed to manage the risks of its business.
The notice covers five practice areas: policies and procedures, training, risk assessments and controls, third-party service providers, and the incident response plan. This applies to every registered firm in Canada, including portfolio managers, exempt market dealers, and investment fund managers that are not CIRO Dealer Members.
Official source: https://www.securities-administrators.ca/news/csa-publishes-updated-cybersecurity-findings-and-guidance-for-registered-firms/
ThreeShield's CISSP- and CISA-certified assessors run the CSA Staff Notice 33-322 engagement, and Lavawall® collects the technical evidence continuously, so your posture is current the day an auditor, insurer, or client asks for it, not just at renewal.
| CSA Staff Notice 33-322 requirement | Lavawall® collects | ThreeShield delivers |
|---|---|---|
| Multi-factor authentication status | ✓ Continuously | — |
| Patch and vulnerability posture | ✓ Continuously | — |
| Encryption at rest and in transit | ✓ Continuously | — |
| Access and audit-log review | ✓ Continuously | — |
| Risk assessment and scoping | ⚑ Platform data | CISSP/CISA-led |
| Policies, procedures, and evidence package | — | Written by ThreeShield |
It does if you are a registered firm in Canada. That includes portfolio managers, exempt market dealers, and investment fund managers that are not CIRO Dealer Members. We confirm scope in the first call, at no charge.
A gap assessment against CSA Staff Notice 33-322 usually takes a few weeks. Closing the gaps and standing up the evidence takes longer, and that is where most of the work sits, so the total depends on your starting point. Because Lavawall® is already collecting the technical evidence while we work, you do not restart from zero at reassessment.
Yes. Many clients begin self-serve on Lavawall®, then bring in ThreeShield for the assessment, the policies, and the sign-off once they know where the gaps are. The three engagement models below are meant to be moved between.
ThreeShield meets you at your current security maturity. Every level includes Lavawall®.
For lean IT teams and cost-conscious organizations with internal security capacity
Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity
Full compliance delivery, managed end to end by ThreeShield
Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so you stay compliant between audits.
Book a Scoping CallDIY · Supported · Done-for-You