Item - 2026.AU12.3

The Board of Governors of Exhibition Place recommends that:

1. City Council authorize the public release of Confidential Attachment 1 to the report (March 25, 2026) from the Auditor General at the discretion of the Auditor General, after discussions with the appropriate Exhibition Place and City officials.

At its meeting on April 16, 2026, the Board of Governors of Exhibition Place considered Item EP22.1 and made recommendations to City Council.

Summary from the report (March 25, 2026) from the Auditor General:

The Auditor General included a cybersecurity audit of Exhibition Place, an agency of the City of Toronto, in her 2025 Work Plan. Exhibition Place is Canada’s largest convention centre and entertainment and sports venue, generating $595 million[1] in economic impact annually and $67.3 million in revenue in 2024.

Phase One of this cybersecurity audit was presented at Exhibition Place’s December 5, 2025, Board meeting. The Auditor General’s Phase One confidential report included results from testing physical security, user access management, and staff awareness of social engineering in relation to cybersecurity.

The Phase One public cover report is available at: Cybersecurity Audit of Exhibition Place – Phase One: Physical Security, User Access Management and Staff Training

Technology plays a vital role in all aspects of Exhibition Place's operations and services. This Phase Two report includes the results of our vulnerability assessment and penetration testing of the Exhibition Place’s network, systems, applications and devices, as well as cybersecurity incident logging and monitoring review.

This report includes five administrative recommendations. The confidential findings and recommendations are contained in Confidential Attachment 1 to this report. A separate, confidential and detailed technical report was provided to management with technical details to guide them in addressing the report findings and recommendations.

Management agrees with the recommendations contained in the Confidential Attachment 1, which also includes management's response.

[1] Budget TO 2026 Budget Notes Exhibition Place