October 24, 2024 Re: House Standing Senate Committee on National Security, Defence and Veterans Affairs Study of Bill C -26,

An Act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other Acts Dear Committee Members: On behalf of its member property and casualty (P&

C) insurers, Insurance Bureau of Canada (IBC) would like to take an opportunity to comment on Bill C -26, which would, if passed, enact the Critical Cyber Systems Protection Act (the “CCSPA”). IBC is the national industry association representing Canada’s private home, auto and business insurers. Our members make up a vast majority of the private P&C insurance market in Canada. For more than 50 years, IBC has worked with governments and insuranc e regulators across the country to help make affordable home, auto and business insurance available for all Canadians.

Increasing Cyber Security Threat has contributed to Insurance Market Growth in Canada In Insurers wrote $550 million worth of cyber insurance premiums, making it one of the most sought after and fastest growing lines of insurance products across Canada.1, With the global landscape becoming increasingly fraught with geopolitical uncertainty, the threat of foreign cyber -attacks on critical infrastructure is escalating, which is anticipated to increase the need for cyber security insurance in the coming years.

A Targeted Amendment to ensure Critical National Infrastructure Operators can access the cybersecurity insurance needed IBC broadly supports the application of Bill C -26 requirements on critical infrastructure operators, as it aligns with the industry’s goals of improving the cyber security of critical national infrastructure in Canada.

IBC believes, however, that if the legislation were to be enacted as presently written, it may negatively impact the ability of critical national infrastructure operators to comply with contractual obligations of their insurance policies which require for the disclosure of material changes in risk as part of maintaining and not compromising cybersecurity insurance coverage. Section 20(1) enables the Governor in Council, by order, to direct any designated operator or class of operators to comply with any measure set out in the direction for the purpose of protecting a critical cyber system.

Section prohibits any designated operator that is subject to such a cyber security direction from disclosing the fact that such direction has been issued, except for the specific exceptions set out in

Section 25. 1 IBC with data from MSA Research Inc. A material change in risk is any change to an insureds operations that would materially alter their risk profile. As the CCSPA is currently written, it is legally unclear if a designated operator who is subject to a cyber security direction would be able to disclose a material change in risk that they become aware of as a result of a cyber security direction, with their insurer. Embedded in every insurance contract is a clause, which requires insureds to report a material change in risk to their insurer.

Insurers require prompt informing of material changes in risk to accurately assess, adjust pricing, prevent fraud, manage risks, comply with legal s and ultimately, maintain the inte grity of insurance contracts. The potential adverse unintended consequence of insureds being unable to inform their insurer of a known material change in risk as a result of the CCSPA, may manifest as more restrictive underwriting requirements for this sector.

This may result from challenges experienced by insurers in accurately appraising the cyber risks associated with critical infrastructure, and an increased risk of policy coverages being compromised arising from the designated operator's inability /failure to notify their insurance provider of material changes in risk that may arise out of a cyber security direction.

Considering the broadening definitional scope of critical infrastructure, and the introduction of new cyber risks, it is our position that the following amendment would significantly contribute to mitigating potential adverse consequences for the cyber insurance market, critical infrastructure, and, ultimately, Canadian cyber security. Please see below a proposed minor amendment to

Section of the CCSPA (below in red). Proposed Amendment Disclosure — when allowed 25

(1) A designated operator that is subject to a cyber security direction may disclose the fact that the direction was issued and its content only to the extent necessary to comply with the direction. Prohibition — further disclosure

(2) A person must not, without the authorization of the designated operator, disclose or allow the disclosure of any information obtained by them under subsection (1). Right to Notify of Change in Material Risk

(3) Nothing in

Section precludes a designated operator from notifying its insurance provider of a change in material risk of which it becomes aware due to a cyber security direction. In our view, the above change would provide the needed legal clarity for insureds to disclose material changes in risk to insurers when such material changes in risk arise out of a cyber security direction, thereby eliminating the potential adverse unintended consequences of the Bill as currently written.

It is important to note that IBC is not asking for an amendment that would allow or require an insured designated operator to disclose that a cyber security direction was issued, or the contents of the direction to their insurer. IBC is merely seeking to confirm that it is not the intent of the Bill to prevent an insured designated operator from notifying their insurer of a material change in risk that arises out of a cyber security direction.

We believe that with a targeted amendment, this significant negative and unintended consequence could be avoided enabling the private cybersecurity insurance market to continue to accurately underwrite cyber insurance coverage to match the growing demand of critical national infrastructure operators. Thank you for your consideration of this matter. We stand ready to offer any clarifications that may be required. For additional details or questions pertaining to this submission please contact: Jason Clark National Director, Climate Change and Federal Issues JClark@ibc.ca