Where the regulation comes from
The regulation is made under the Enhancing Digital Security and Trust Act, 2024, alongside O. Reg. 52/26 on school boards and students’ digital information. That Act was enacted as Schedule 1 of Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (Statutes of Ontario 2024, chapter 24). O. Reg. 51/26 was made on 12 March 2026, filed on 23 March 2026 and came into force on 1 July 2026. On e-Laws, checked on 24 October 2026, it still reads as filed, with no amending regulation.
Who it applies to, and who it leaves out
Section 2 names five kinds of organization: educational institutions as the Freedom of Information and Protection of Privacy Act defines them, which means colleges and universities; public hospitals graded Group A, B or C under the Public Hospitals Act; the University of Ottawa Heart Institute; children’s aid societies; and school boards. The province’s overview adds that Indigenous child and family well-being agencies count with children’s aid societies.
Municipalities are absent from that list. A city, a town or a local board can still use the provincial maturity assessment tool, which Cyber Security Ontario opens to municipalities and agencies on a voluntary basis.
The four duties, briefly
A covered organization must develop and implement a cyber security program that meets at least the rest of the regulation. It designates two employees in senior management with decision-making authority over cyber security, a primary point of contact and an alternate, and sends their contact details to the Chief Information Security Officer of the Ministry of Public and Business Service Delivery and Procurement, with any change reported within 10 business days.
It completes a cyber security maturity assessment under standards or best practices that the Ministry’s CISO endorses: the first no later than one year after the regulation first applies, so by 1 July 2027, then by the second anniversary of that one and at least once in every two-year period after. A summary goes to the CISO within 30 business days of each assessment, approved by the primary contact. Finally, a critical cyber security incident is reported as soon as reasonably practical and no later than 72 hours after the organization confirms it.
What it leaves in place
The regulation adds to existing duties. Section 7 states that the incident report leaves other legal obligations untouched, naming the Freedom of Information and Protection of Privacy Act as one of them, so privacy breach rules still apply alongside the 72-hour report.
Sector details, the exact incident criteria and how an assessment is run in practice sit on our full O. Reg. 51/26 page, with a page for each covered sector.
