The Auditor General’s 2024 Work Plan included a cybersecurity audit of the Toronto Community Housing Corporation (TCHC). TCHC also provides information technology services to Toronto Seniors Housing Corporation (TSHC) which is integrated with TCHC’s enterprise information technology environment. As such, we also included TSHC’s systems in our audit scope.
Confidential attachment 1 is our cybersecurity report that includes our findings covering both TCHC and TSHC, with recommendations to the TCHC. We have provided the confidential detailed technical report to management of TCHC’s Information and Technology Services Division to be able to implement the recommendations, as they manage both TCHC and TSHC’s network, systems, and applications.
A separate cover report will be provided to the TSHC’s Board of Directors for their information. In addition, the Auditor General will be making a confidential presentation to the TSHC’s Board at their July 18, 2024 meeting.
Toronto Community Housing Corporation (TCHC) is the largest social housing provider in Canada and the second largest in North America. TCHC houses tenants in 106 of Toronto’s 158 neighbourhoods, providing homes to over 41,000 low and moderate income households.
Toronto Seniors Housing Corporation (TSHC) provides subsidized rental housing for approximately 15,000 low and moderate-income seniors in 83 buildings across the city. TSHC began operating in June 2022 after the City’s Tenants First plan and partnered closely with TCHC which owns the buildings.
Technology plays a vital role in all aspects of TCHC and TSHC’s operations. TCHC has provided technology services to TSHC since June 2022.
Cybersecurity threats are constantly evolving and becoming more sophisticated.
Cybersecurity threats are constantly evolving and becoming more sophisticated. The 2023-2024 National Cyber Threat Assessment from the Canadian Centre for Cyber Security provided an overview of cyber threats and notes that:
“…Due to its impact on an organization’s ability to function, ransomware is almost certainly the most disruptive form of cybercrime facing Canadians. Cybercriminals deploying ransomware have evolved in a growing and sophisticated cybercrime ecosystem and will continue to adapt to maximize profits.”
and warns that:
“The cyber threat landscape will almost certainly evolve further over the next two years as technologies such as digital assets, machine learning, and quantum computing bring new opportunities and new threats.”
Since 2015, the Auditor General has been proactive in her audits of cybersecurity and has completed several vulnerability assessments and penetration testing of critical systems at the City, and its agencies and corporations.
This Phase 1 report includes the results of our cybersecurity audit of TCHC and TSHC’s network, systems, and applications security. The report contains three administrative recommendations. The confidential findings and recommendations are contained in Confidential Attachment 1 to this report.