Item - 2021.GL27.29

The General Government and Licensing Committee recommends that:

1. City Council direct that Confidential Attachments 1 and 2 to the report (November 19, 2021) from the Chief Information Security Officer remain confidential in their entirety, as they involve the security of property belonging to the City of Toronto.

City Council requested the Chief Information Security Officer to report to the General Government and Licensing Committee on a biannual basis regarding the City-wide cyber security program. This is the first such report and includes two confidential attachments:

- Attachment 1 - Describes the City's Cyber health as seen from three lenses: cyber resilience, cyber maturity, and cyber awareness.
 

- Attachment 2 - Provides an overview of audit remediation status.
 

Further, these attachments provide details on:

a.  Overall cyber health of the organization, the progress made in the past six month and the benefits/efficiencies achieved as a result of the Cyber program implementation, including embedding "cybersecurity by design" principles to support the City's modernization efforts;

b.  The status of all outstanding audit recommendations that have not been implemented to date, including any increase to the City's cybersecurity risk profile

c.  Additional supports required to address cybersecurity risks in an expedited manner.

Subsequent reports to the  General Government and Licensing Committee will include updates on the following:

Projects, initiatives, procurement, and operations where cybersecurity requirements or directives were not included in the process
 

The attachments also include highlights of the progress the Office of the Chief Information Security Officer (OC) has made, in collaboration with Technology Services Division and the City's critical infrastructure Divisions, in embedding cyber security risk management practices in their projects, initiatives, procurement, and operations.