uniteTOlove.ca
Mechanically generated from the GOV-ATLAS registry (our public-body and document registries); every field is a direct read of a registry cell, re-derived on each run — nothing here is hand-written analysis.

Toronto Cyber Security

Municipal — Toronto Division Tier 1 — ⚠️ classification still being checked — registry id
: tor-toronto-cyber-security · last checked 2026-07-24 · parent: — none on file · source authority: verify this org exists

NO-SERIES CONFIRMED (GOV-ATLAS-SERIESAUDIT-d1 2026-08-02, re-tested). Prior note: org chart also shows 'Office of the CISO' under City Manager - likely same unit; no current plan located; page has no this library's internal records data links; budget-note

Current this library's internal records: 2026 Operating Budget and 2026-2035 Capital Budget and Plan: Toronto Cyber Security (2026)

Completeness

Endpoints

Document shelf (2 rows)

YearTypeTitleArchive statusFlags
2026Budget / estimates2026 Program Summary: Toronto Cyber Securityarchived
2025Budget / estimates2025 Program Summary: Office of the Chief Information Security Officerarchived

Backgrounder

Source: this library's internal records — a mechanical research draft, not independently reviewed for publication; reproduced as-is.

Toronto Cyber Security (Office of the Chief Information Security Officer) - backgrounder

Backgrounder / this library's government-strategy research Batch 12 / 2026-08-04 / registry row: tor-toronto-cyber-security (this library's government-document registry) / lens file for this org's series briefs

Mandate & statutory basis

Toronto Cyber Security is not a separate corporation; it is a division/office of the City of Toronto, itself continued as a corporation with broad interpretive powers under the City of Toronto Act, 2006, S.O. 2006, c. 11, Sched. A, ss.6(1) and 7 ("the City has the capacity, rights, powers and privileges of a natural person") (https://www.ontario.ca/laws/statute/06c11, not re-fetched this review, cited per house convention established in prior-batch backgrounders for City of Toronto divisions). Its operative mandate document, per its own budget books, is a City Council decision: "Extending the Mandate of the City's Chief Information Security Officer (EX14.3)," adopted May 22, 2024, which "provided visibility into the City agencies and corporations cyber practices to effectively identify and mitigate cyber risks" (2025 Program Summary — Office of the Chief Information Security Officer, sha256-12 bc3b4f4f1a6e, p.6).

Roles, responsibilities & scope

The office's stated vision is "to advance our position as a Global Leader in Urban Cyber Innovation," with five focus areas: Cyber Governance Risk and Compliance, Identity Protection, Cyber Threat Management, Cyber Awareness, and Critical Infrastructure Protection, delivered through two service lines — Cyber Governance and Business Resilience (including Modernization and Recovery) (2025 Program Summary, sha256-12 bc3b4f4f1a6e, p.2, 3; 2026 Program Summary — Toronto Cyber Security, sha256-12 e8ef7f3f675e, p.1-2). Since the May 2024 EX14.3 mandate extension, services cover the City's own divisions plus its agencies and corporations (A&C); by the 2026 budget book, 39 of 40 identified A&C (98%) had executed service agreements (2026 Program Summary, sha256-12 e8ef7f3f675e, p.6).

Governance & reporting line

The office is led by the Chief Information Security Officer; its budget is grouped under "Corporate Services" in the City's Appendix 3 program listing (2025 Program Summary, sha256-12 bc3b4f4f1a6e, p.19). ⚠️ still being checked — the precise reporting line above the CISO (e.g., to the City Manager or a Deputy City Manager) is not named in either budget book read for this org.

Budget scale

$35.992M gross / $35.563M net for 2026 (95.0 approved positions), up from $35.127M gross / $34.526M net in 2025 (96.0 approved positions) — a $1.814M (5.4%) net increase (2026 Program Summary, sha256-12 e8ef7f3f675e, p.7-10; 2025 Program Summary, sha256-12 bc3b4f4f1a6e, p.7-9). The office also carries a 10-year capital plan of $8.667M (2026-2035) for cyber infrastructure and initiatives (2026 Program Summary, sha256-12 e8ef7f3f675e, p.7).

Institutional history

⚠️ still being checked — the office is named "Office of the Chief Information Security Officer" in the 2025 Program Summary (sha256-12 bc3b4f4f1a6e) and renamed "Toronto Cyber Security" in the 2026 Program Summary (sha256-12 e8ef7f3f675e); neither document states a reason or effective date for the rename. Both documents describe the office's most consequential mandate change as the May 22, 2024 Council-adopted EX14.3 report extending cyber services to agencies and corporations. No document in this archived set covers years before 2025.

Strategy evolution brief

Source: this library's internal records — a mechanical research draft, not independently reviewed for publication; reproduced as-is.

Toronto Cyber Security - strategy evolution

2026-08-02 / registry: tor-toronto-cyber-security / grounded in archived copies (cited document id + sha256) / read through our research file for that body

TL;DR: The biggest priority addition is extending cyber services beyond City divisions to the City's 40 agencies and corporations (A&C), funded in 2025 (4 new positions, $1.715M) under Council's May 2024 EX14.3 mandate extension and substantially executed by 2026 — 39 of 40 identified A&C (98%) had signed service agreements. The biggest quietly changed element is the office's own name, "Office of the Chief Information Security Officer" (2025) → "Toronto Cyber Security" (2026), with no stated reason. The load-bearing number is the net operating budget rising from $34.526M (2025) to $35.563M (2026), while the office's own 10-year cyber capital plan roughly halved, from $17.156M (2025-2034) to $8.667M (2026-2035), as Cyber Command Centre construction completed. One open question the two-document window cannot resolve: whether the "Toronto Cyber Security" rename reflects a formal governance change or is administrative relabeling.

Backgrounder summary

Toronto Cyber Security is a division/office of the City of Toronto (no division-specific enabling statute; the City itself operates under the City of Toronto Act, 2006, ss.6(1), 7), operating under Council's May 22, 2024 "Extending the Mandate of the City's Chief Information Security Officer (EX14.3)" decision, which extended cyber governance and services from City divisions to the City's agencies and corporations. It delivers cyber governance/risk/compliance, identity protection, threat management, awareness training, and critical infrastructure protection through two service lines (Cyber Governance; Business Resilience). The backgrounder flags the office's reporting line above the CISO role and the reason for its 2025→2026 rename as unresolved (⚠️ still being checked, backgrounder); this brief does not resolve either gap.

Series inventory

_index.json: 2 ok / 0 stub-suspected / 0 extract-failed.

document id year type archive ref sha256-12 content read?
tor-toronto-cyber-security-bud-2025 2025 budget bc3b4f4f1a6e yes — full 2025 Program Summary (Office of the Chief Information Security Officer), 53,716 chars
tor-toronto-cyber-security-bud-2026 2026 budget e8ef7f3f675e yes — full 2026 Program Summary (Toronto Cyber Security), 47,555 chars

Unlike tor-communications/tor-people-equity in this batch, both of this org's documents are single-org budget books (the CISO office / Toronto Cyber Security is its own standalone program, not folded into a multi-division cluster book) — that batch’s own build note §B2 scoping does not apply here.

SHORT-FORM RULE APPLIES: 2 usable documents, one year apart — enough to show one clear inflection (the EX14.3 mandate extension's rollout) but not a multi-year evolution narrative.

Priority evolution

2025 (bc3b4f4f1a6e): Reports City Council's May 22, 2024 adoption of EX14.3, which "provided visibility into the City agencies and corporations cyber practices to effectively identify and mitigate cyber risks." The 2025 budget funds the mandate's first year: 4 new positions and $1.715M to begin extending cyber services to agencies and corporations (A&C), while maintaining a 90% SLA target. Priority Actions are grouped under three headings that recur in 2026: Enhance Cyber Foundation, Expand Cyber Services, Strengthen Business Resilience (including "Build Cyber Command Centre").

2026 (e8ef7f3f675e): Reports the mandate extension substantially executed — "Of the City's 40 agencies and corporations identified in 2024.EX14.3, 98% (39) have executed agreements," with "core cyber security services... fully deployed and operational... providing 24/7/365 monitoring." The office reports having "transitioned to the new workspace, the largest municipal Cyber Command Center in Canada" (up from "designed" the prior year), and a new partnership with Technology Services Division expanding Web Application Protection for PCI compliance. The same three-heading Priority Actions structure repeats, now emphasizing broadening the service portfolio further and elevating "cyber maturity" across divisions, agencies and corporations.

Priorities added, dropped, renamed

Budget & mandate inflection points

Ontario/Toronto relevance

Direct — a City of Toronto corporate cyber-security office serving City divisions and, since the 2024 EX14.3 mandate extension, the City's agencies and corporations (bc3b4f4f1a6e, p.6; e8ef7f3f675e, p.6).

Residuals & gaps