Report Cybersecurity Incidents - Ottawa City Bylaws

Technology and Data Ontario 3 Minutes Read · published February 11, 2026 Flag of Ontario

Residents of Ottawa, Ontario who suspect a cybersecurity incident affecting city services should act quickly to limit harm and ensure city systems remain available. This guide explains who enforces city policies, how to report incidents to City of Ottawa teams and law enforcement, immediate steps to secure evidence and services, and what to expect under municipal policy and related provincial and federal reporting channels.

Penalties & Enforcement

The City of Ottawa does not publish a municipal bylaw that sets specific fines for cybersecurity incidents on a single consolidated page; specific penalties for offences related to misuse of city systems or unauthorized access are not specified on the cited page. Report and enforcement roles are split between the City of Ottawa Information Technology and Privacy offices for municipal systems, and police or federal cyber agencies for criminal matters. For city reporting and policy information, contact the City of Ottawa Technology and Data team and the City Privacy Office.Technology & Data[1] Privacy[2]

  • Enforcer: City of Ottawa Information Technology Services and Privacy Office for municipal systems; Ottawa Police Service and federal agencies for criminal investigations.
  • Fines: not specified on the cited page; see enforcing agency notices or criminal code penalties as applicable.
  • Escalation: city incident response, then referral to law enforcement or federal cyber centres for criminal investigation; escalation details not specified on the cited page.
  • Non-monetary sanctions: orders to cease access, suspension of accounts or services, administrative remediation, and criminal charges where applicable.
  • Appeals and reviews: administrative decisions by the City may follow existing City appeal or access protocols; time limits for appeals are not specified on the cited pages and will follow the applicable City procedure.
Report incidents promptly to preserve evidence and reduce service disruption.

Applications & Forms

The City does not publish a specific public form titled for reporting cybersecurity incidents; internal incident intake is managed by City IT and privacy teams and criminal reports should be filed with police or the federal cyber reporting service.Canadian Centre for Cyber Security: reporting[3]

How to report an incident

Follow these practical steps to report a cybersecurity incident affecting City of Ottawa services and to protect yourself and city systems.

  1. Immediately isolate affected devices and limit further access to city accounts and services.
  2. Document the incident with timestamps, affected services, screenshots, and logs where possible.
  3. Notify the City of Ottawa Technology and Data or ITS Service Desk as soon as possible; include all collected evidence.Technology & Data[1]
  4. If you suspect criminal activity, file a report with Ottawa Police Service and follow federal reporting guidance to the Canadian Centre for Cyber Security.Privacy[2] Report to federal cyber centre[3]
  5. Follow City instructions for remediation, accept recommended password resets or account suspensions, and keep records of communications for appeals or insurance claims.
Keep a secure copy of logs and communications to support investigations and appeals.

FAQ

Who do I contact first if I find a vulnerability in a City of Ottawa service?
Contact City of Ottawa Technology and Data or ITS Service Desk immediately and do not exploit the vulnerability; if you fear criminal activity, also notify Ottawa Police Service.
Will I be fined for reporting an incident?
Reporting an incident is not a fineable action; specific fines for unauthorized access or misuse are not specified on the cited City pages and depend on the enforcement path.
Is there a public form to submit cybersecurity incident reports?
No specific public form is published for cybersecurity incidents on City pages; internal intake and law enforcement reporting channels are used instead.
If in doubt about criminal activity, file a police report to preserve evidence and enable criminal investigation.

How-To

  1. Stop further access: disconnect affected devices from networks and suspend compromised accounts.
  2. Collect evidence: record dates, times, affected services, screenshots and logs.
  3. Report to City IT and Privacy: submit the evidence to the City of Ottawa Technology and Data team for municipal systems.Technology & Data[1]
  4. Report criminal activity: file a report with Ottawa Police Service and the Canadian Centre for Cyber Security.Report to federal cyber centre[3]
  5. Follow remediation: implement City guidance, change credentials, and keep records for follow-up and appeals.

Key Takeaways

  • Act quickly to isolate systems and preserve evidence.
  • Report to City IT and Privacy teams and to law enforcement as appropriate.
  • Keep detailed records of the incident for investigations and appeals.

Help and Support / Resources

  1. [1] City of Ottawa - Technology and Data
  2. [2] City of Ottawa - Privacy
  3. [3] Canadian Centre for Cyber Security - Reporting a cyber security incident

Categories

General Governance and Administration Public Safety Public Health and Welfare Land Use and Zoning Housing and Building Standards Transportation Environmental Protection Parks and Public Spaces Business and Consumer Protection Taxation and Finance Labor and Employment Education Civil Rights and Equity Elections and Campaign Finance Events and Special Uses Signs and Advertising Utilities and Infrastructure Technology and Data