ORC challenges CSA cybersecurity sanction, says penalty was premature and procedurally unfair

The dispute now centres on whether the CSA was entitled to sanction and publicly name the ORC before the expiration of the 90-day compliance period, particularly given the Office's claim that the procurement at the heart of the matter was initiated, evaluated and approved months before the Tier One requirement was communicated.

The ORC says the sanction relates to its procurement of a Network Operations Centre (NOC) and Security Operations Centre (SOC), a process it insists was substantially completed before the CSA directed Critical Information Infrastructure (CII) institutions to engage Tier One licensed cybersecurity service providers.

The Office says it engaged the CSA and explained that the NOC/SOC procurement arrangements had been initiated and completed before the Tier One directives were issued.