Item - 2025.PA16.5

The Board of Directors of the Toronto Parking Authority:

1. Directed that the confidential information contained in Confidential Attachment 1 and Confidential Attachment 2 to the report (September 11, 2025) from the President, Toronto Parking Authority remain confidential in its entirety, as it involves the security of property belonging to the City or one of its agencies or corporations.

At its meeting on September 25, 2025, the Toronto Parking Authority - Audit and Risk Management Committee considered Item PR11.5 and made recommendations to the Board of Directors of the Toronto Parking Authority.

Summary from the report (September 11, 2025) from the President, Toronto Parking Authority:

The purpose of this paper is to deliver Management’s semi-annual update regarding our Cyber security posture including efforts to mitigate threats and risks to the Toronto Parking Authority.

For context, the Cyber threat landscape continues to be a clear and present danger to organizations across the globe. Adversaries have grown their sophistication and frequency of attacks to unprecedented levels. For the Toronto Parking Authority (TPA), this heightened threat environment has required the organization to heighten its vigilance in defence of our business.

As detailed in our Enterprise Risk Management (ERM) strategy, Cyber Security has been identified as one of the preeminent risks to the Toronto Parking Authority. The threat environment facing the TPA has evolved from technical vulnerabilities to an existential business risk. The evidence is unequivocal: in an era of nefarious adversaries leveraging AI-enabled threats, our cyber resilience will define our capacity to defend and protect our operational continuity, stakeholder confidence, and brand reputation. As we accelerate our digital transformation—from integrated customer payment systems across our portfolio to AI supported business analytics—it is incumbent upon Management to institutionalize Cyber Security into the operating culture of the TPA including continued IT investments, employee upskilling, leadership development and critically, continued strategic oversight by the Executive team and Board.

The confidential attachment accompanying this report outlines our investments and security enhancements critical to maintaining our defensive posture. Given the sensitive nature of these matters, this presentation will be held in a closed session.