CIRO (Canadian Investment Regulatory Organization, formerly IIROC) has published cybersecurity best practices that registered investment dealers and advisors are expected to follow. ThreeShield delivers an independent security assessment, led and signed by a CISA and built on NIST CSF 2.0, plus Lavawall® continuous monitoring for the financial investment sector.
CIRO's cybersecurity guidance establishes expectations for registered dealers. While expressed as guidance rather than mandatory rules, CIRO examiners assess cybersecurity practices during reviews, and gaps can result in regulatory findings.
Board and senior management oversight of cybersecurity risk. Documented cybersecurity policy and risk appetite. Annual cybersecurity risk assessment.
Principle of least privilege, multi-factor authentication for remote access and client-facing systems, privileged access management, and regular access reviews.
Documented and tested incident response plan. Client notification procedures. Regulatory notification obligations. Post-incident lessons learned process.
Vendor due diligence, contractual security requirements, and monitoring of critical third-party service providers - including cloud platforms and SaaS tools.
Regular cybersecurity training for all staff. Role-specific training for those with elevated access. Phishing awareness and simulation.
Regular vulnerability assessments, timely patching of critical vulnerabilities, and penetration testing - which maps directly to Lavawall® continuous patch monitoring.
An independent information security assessment, led and signed by a Certified Information Systems Auditor (CISA), and written so that management, the audit committee, and a CIRO examiner can each read it without needing anyone to translate between them.
NIST CSF is the framework CIRO's own cybersecurity guidance is built on, so it is the yardstick your examiner already recognizes, not a foreign standard. You get a clear picture of where you stand today, with findings mapped to the CIRO IDPC requirements and the Canadian regulatory expectations that actually apply to your firm.
Not just misconfigured controls, but the process gaps behind them, so each finding connects to why it happened and what closes it.
Recommendations ranked by business impact, regulatory significance, exploitability, and remediation effort, so the roadmap tells you what to address first and why.
The assessment and its supporting evidence are documented in our Lavawall® platform, with three months of access included, so you move straight from assessment into remediation tracking and management reporting.
We start with automated tools, including our Lavawall® security platform, because they cover ground quickly and consistently. But the tools are where we start, not where we finish. Every finding is reviewed by hand, and that review is where most of the value comes from.
A scanner will tell you multi-factor authentication is enabled. It will not tell you which accounts are excluded from the conditional access policy, or that some of the excluded accounts belong to people who have left. A scanner will report a server as fully patched. It will not notice that the service account running on it holds domain administrator rights and has not had its password changed in years. A policy document will say access reviews happen quarterly. Asking to see the last four is what tells you whether they actually do.
Manual review also works in the other direction, which matters for your budget. Scanners generate false positives and flag issues your environment already mitigates. We test those before they reach the report, so you are not spending remediation money and staff time on findings that were never real. Clients are often surprised that a good assessment removes as many items as it adds.
The other half is chaining. Individual findings that each look minor can combine into a path to client information or the trading environment, and recognizing that takes someone who has seen it before and is thinking about your firm specifically. Our founder, a CISA, does this work personally rather than delegating it, so the judgment behind every finding in the report is the judgment of the person who signs it.
NIST CSF 2.0 is the spine, and it is the framework CIRO's own cybersecurity guidance follows, so the assessment speaks the language your regulator already uses. We build the rest of the control set around what applies to your firm rather than a generic checklist.
The relevant CIRO IDPC requirements, plus CIRO's cybersecurity, incident management, governance, and business continuity guidance.
Alberta's Personal Information Protection Act (PIPA) and PIPEDA, mapped to the controls that satisfy them.
Canadian Centre for Cyber Security guidance, applied where it strengthens both your posture and your examination evidence.
If you accept card payments for events or similar activities, we cover the PCI DSS obligations that follow.
We review governance, ownership, management reporting, and escalation, so technical findings connect back to how cyber risk is actually managed within the firm.
Is it configured correctly? Does it produce the evidence you would need in an examination or an incident? And do the controls together make the likely attack paths difficult?
CIRO guidance is not expressed as black-letter rules, but CIRO examinations assess cybersecurity practices as part of business conduct reviews. Firms with significant gaps risk regulatory findings, remediation requirements, and reputational exposure. The direction of travel is toward more prescriptive requirements.
CIRO regulates investment dealers and mutual fund dealers. Provincial securities regulators, OSFI (for banks), and BCFSA (for BC credit unions) have separate but often overlapping cybersecurity expectations. ThreeShield maps requirements across all applicable regulators for your specific business model.
ThreeShield assesses your cybersecurity practices against CIRO guidance and builds the documentation trail your next examination needs.
Book a Scoping CallDIY · Supported · Done-for-You · All engagement models available
Whether you have a strong internal team or need everything handled end-to-end, ThreeShield meets you where you are.
For lean IT departments and cost-conscious firms with internal security capacity
For MSPs, in-house IT with some security resources, and firms that want expert guidance while keeping internal capacity
For organizations that want full compliance delivery without managing the process internally